Michalis Famelis, Rick Salay, Alessio Di Sandro, Marsha Chechik University of Toronto MODELS 2013, Miami Beach, FL Transformation of Models Containing Uncertainty

2 This is Natalie. Natalie is a modeler. Natalie faces uncertainty in her everyday work.

Alternative Designs 3 Hmm, I dont know which one, yet.

Conflicting Stakeholder Opinions 4 What do I do until they decide?

Incomplete Information 5 I dont know everything about this, yet.

Uncertainty in software development 6 Uncertainty about the content of the model. Many design alternativesConflicting stakeholder opinionsIncomplete information

Transformations 7 Like every good MBE practitioner, Natalie uses a variety of MTs

Transformations 8 The transformations assume inputs that dont contain uncertainty Like every good MBE practitioner, Natalie uses a variety of MTs

Transformations 9 But only too often, Natalies models contain uncertainty: The transformations assume inputs that dont contain uncertainty Like every good MBE practitioner, Natalie uses a variety of MTs

Transforming Models with Uncertainty 10 Natalie should be able to use model transformations

Transforming Models with Uncertainty 11 Natalie should be able to use model transformations

Transforming Models with Uncertainty 12 Natalie should be able to use model transformations Existing transformation techniques do not support this! To apply MTs, Natalie is forced to artificially remove uncertainty

Transforming Models with Uncertainty 13 We need to lift Natalies transformations so that they can apply to models with uncertainty Existing transformation techniques do not support this! Natalie should be able to use model transformations

Outline 14 Representing Uncertainty with Partial Models Transforming Partial Models Tool Support Empirical Evaluation Reminder: Model Transformations

Model Transformations With Graph Rewriting 15 class1 + attribute : type class1 - attribute : type + getAttribute() :type class1 class2 Negative Application Condition Left Hand Side Right Hand Side EncapsulateVariable refactoring: Make fields private and add getter methods unless they belong to some inner class Example rule:

Example Input Model 16 Solver SolverException + effect : String class1 + attribute : type class1 - attribute : type + getAttribute() :type class1 class2 RHS LHS NAC

Example Input Model 17 Solver SolverException + effect : String class1 + attribute : type class1 - attribute : type + getAttribute() :type class1 class2 RHS LHS NAC Match

Example Input Model 18 Solver SolverException + effect : String class1 + attribute : type class1 - attribute : type + getAttribute() :type class1 class2 RHS LHS NAC NAC also matches! ABORT !

Example Input Model 2 19 SolverException + effect : String class1 + attribute : type class1 - attribute : type + getAttribute() :type class1 class2 RHS LHS NAC

Example Input Model 2 20 SolverException + effect : String class1 + attribute : type class1 - attribute : type + getAttribute() :type class1 class2 RHS LHS NAC Match

Example Input Model 2 21 SolverException + effect : String class1 + attribute : type class1 - attribute : type + getAttribute() :type class1 class2 RHS LHS NAC Delete

Example Input Model 2 22 SolverException effect : String class1 + attribute : type class1 - attribute : type + getAttribute() :type class1 class2 RHS LHS NAC

Example Input Model 2 23 SolverException - effect : String class1 + attribute : type class1 - attribute : type + getAttribute() :type class1 class2 RHS LHS NAC Add

Example Input Model 2 24 SolverException - effect : String + getEffect() : String class1 + attribute : type class1 - attribute : type + getAttribute() :type class1 class2 RHS LHS NAC Add

Example Input Model 2 25 SolverException - effect : String + getEffect() : String class1 + attribute : type class1 - attribute : type + getAttribute() :type class1 class2 RHS LHS NAC No more LHS matches. Stop.

Outline 26 Representing Uncertainty with Partial Models

Representing Uncertainty Partial Models [ICSE12] Points of uncertainty (May elements) explicated using syntactic annotations 27 Solver SolverException + effect : String Unsure if it should be an inner class. Unsure if we need this field.

Representing Uncertainty Partial Models [ICSE12] Points of uncertainty (May elements) explicated using syntactic annotations Propositional variables: the element exists 28 Solver SolverException + effect : String X Y

Representing Uncertainty 29 Solver SolverException + effect : String X Y Solver SolverException Solver SolverException Solver SolverException + effect : String Solver SolverException + effect : String x=F, y=F x=T, y=F x=F, y=Tx=T, y=T 4 concretizations: 4 ways to resolve uncertainty.

Representing Uncertainty Partial Models [ICSE12] Points of uncertainty (May elements) explicated using syntactic annotations Restrictions to the set of concretizations can be captured in theMay formula 30 Solver SolverException + effect : String X Y X v Y

Representing Uncertainty 31 Solver SolverException + effect : String X Y Solver SolverException Solver SolverException Solver SolverException + effect : String Solver SolverException + effect : String x=F, y=F x=T, y=F x=F, y=Tx=T, y=T X v Y

Outline 32 Transforming Partial Models

Transforming Models With Uncertainty 33 Natalie wants to apply the rule to an input with uncertainty

Why Is It Hard? 34 Solver SolverException + effect : String class1 + attribute : type class1 - attribute : type + getAttribute() :type class1 class2 RHS LHS NAC X Y X v Y

Why Is It Hard? 35 Solver SolverException + effect : String class1 + attribute : type class1 - attribute : type + getAttribute() :type class1 class2 RHS LHS NAC Match??? X Y X v Y

Why Is It Hard? 36 Solver SolverException + effect : String class1 + attribute : type class1 - attribute : type + getAttribute() :type class1 class2 RHS LHS NAC Match??? X Y X v Y

Why Is It Hard? 37 Solver SolverException + effect : String class1 + attribute : type class1 - attribute : type + getAttribute() :type class1 class2 RHS LHS NAC Should we delete? Should we add? X Y X v Y

Why Is It Hard? 38 Solver SolverException + effect : String class1 + attribute : type class1 - attribute : type + getAttribute() :type class1 class2 RHS LHS NAC Existing transformation techniques cannot be used. X Y X v Y

Intuition 39 class1 + attribute : type class1 - attribute : type + getAttribute():type class1 class2 RHS LHS NAC Solver SolverException + effect : String X Y X v Y ? (And definition of correctness)

Intuition 40 class1 + attribute : type class1 - attribute : type + getAttribute():type class1 class2 RHS LHS NAC Solver SolverException + effect : String Solver SolverException + effect : String Solver SolverException ? (And definition of correctness)

Intuition 41 class1 + attribute : type class1 - attribute : type + getAttribute():type class1 class2 RHS LHS NAC Solver SolverException + effect : String Solver SolverException + effect : String Solver SolverException Solver SolverException -effect : String +getEffect() : String Solver SolverException + effect : String Solver SolverException (And definition of correctness)

Intuition 42 class1 + attribute : type class1 - attribute : type + getAttribute():type class1 class2 RHS LHS NAC Solver SolverException + effect : String Solver SolverException + effect : String Solver SolverException ( X ¬Y ¬a ¬b) v (¬X Y ¬a b) v ( X Y a ¬b) Solver SolverException + - effect : String +getEffect() : String X Y a b (And definition of correctness)

Intuition 43 class1 + attribute : type class1 - attribute : type + getAttribute():type class1 class2 RHS LHS NAC Solver SolverException + effect : String X Y X v Y ( X ¬Y ¬a ¬b) v (¬X Y ¬a b) v ( X Y a ¬b) Solver SolverException + - effect : String +getEffect() : String X Y a b (And definition of correctness)

Technique 44 class1 + attribute : type class1 - attribute : type + getAttribute():type class1 class2 RHS LHS NAC Solver SolverException + effect : String X Y X v Y

Technique 45 class1 + attribute : type class1 - attribute : type + getAttribute():type class1 class2 RHS LHS NAC Solver SolverException + effect : String X Y X v Y (a) Find Match Step 1: Determine applicability

Technique 46 class1 + attribute : type class1 - attribute : type + getAttribute():type class1 class2 RHS LHS NAC Solver SolverException + effect : String X Y X v Y (a) Find Match (b) Make sure the rule applies to at least one concretization (requires solving a SAT problem) Step 1: Determine applicability

Technique 47 class1 + attribute : type class1 - attribute : type + getAttribute():type class1 class2 RHS LHS NAC Solver SolverException + effect : String X Y X v Y Solver X Step 1: Determine applicability Step 2: Transform graph SolverException + effect : String Y (a)Copy over unchanged parts

Technique 48 class1 + attribute : type class1 - attribute : type + getAttribute():type class1 class2 RHS LHS NAC Solver SolverException + effect : String X Y X v Y Solver SolverException + - effect : String +getEffect() : String X Y a b Step 1: Determine applicability Step 2: Transform graph (a)Copy over unchanged parts (b)Perform additions and deletions Added and deleted elements become Maybe

Technique 49 class1 + attribute : type class1 - attribute : type + getAttribute():type class1 class2 RHS LHS NAC Solver SolverException + effect : String X Y X v Y Step 1: Determine applicability Step 2: Transform graph Step 3: Transform formula ( X ¬Y ¬a ¬b) v (¬X Y ¬a b) v ( X Y a ¬b) Solver SolverException + - effect : String +getEffect() : String X Y a b Constrain Maybe elements to ensure each that concretization is correctly affected.

Overview 50 class1 + attribute : type class1 - attribute : type + getAttribute():type class1 class2 RHS LHS NAC Solver SolverException + effect : String X Y X v Y ( X ¬Y ¬a ¬b) v (¬X Y ¬a b) v ( X Y a ¬b) Solver SolverException + - effect : String +getEffect() : String X Y a b Step 1: Determine applicability Step 2: Transform graph Step 3: Transform formula

Analysis In the paper: Proof of correctness The lifting algorithm implements our intuition Proofs of preservation of properties: 1. Confluence The result of applying a set of rules to a model is the same regardless of the order of application or the order of matching sites. 2. Termination Repeated applications will reach a point where the rule will no longer be applicable. 51

Outline 52 Tool Support Empirical Evaluation

Tool Support Reuse partial model implementation in MMTF (Eclipse / EMF) Algorithm implementation 1. Determine rule applicability Henshin and the Z3 SMT solver 2. Transform the graph Henshin 3. Transform the formula Java (Z3 input strings) 53 MMTF

Case Study Object–relational mapping (ORM) Translate a class diagram to a relational database schema. Classic benchmark for model transformation research Triple graph grammar with 5 layered graph rules [Varro06] 54 (Image from [Varro06])

Case Study Input model: the Ecore metamodel ORM for Ecore is important: cf. CDO and Teneo Manually flattened inheritance hierarchy and adapted to the metamodel in [Varro06] Resulting model had 65 model elements: 17 classes, 17 associations, 6 generalization links, 25 attributes Manually injected points of uncertainty to create partial models with increasing numbers of concretizations 55

Setup And Results RQ: How does lifting scale with increasing uncertainty? Varied: number of concretizations of input Measured: time to complete the ORM transformation Ran on Intel Core i GHz×4core, 8GB RAM, Ubuntu Runtime does not increase dramatically. Approach scales. 56 # concretizations Time (seconds)

Summary 57 Decision deferral in the presence of uncertainty Existing techniques cannot handle uncertainty Explicit uncertainty modeling with Partial Models Syntactic annotations and May formula Transform Partial Models 1. Determine applicability 2. Transform graph 3. Transform formula Approach scales for increasing levels of uncertainty Tool Support Empirical Evaluation Case Study: Object-relational mapping for the Ecore metamodel

Next Steps Implement lifted semantics as a higher-order transformation (HOT) Given a graph rewrite rule, produce a grammar that implements the lifted semantics Benefit: out of the box reuse of existing graph transformation tools (Henshin, AGG, etc.) Expand lifting for other types of model uncertainty, based on the rich MAVO framework [FASE12] 58

Questions? icons by:

Bibliography [ICSE12] M. Famelis, M. Chechik, and R. Salay. Partial Models: Towards Modeling and Reasoning with Uncertainty. In Proc. of ICSE12, [Varro06] D. Varro, S. Varro-Gyapay, H. Ehrig, U. Prange, and G. Taentzer. Termination Analysis of Model Transformations by Petri Nets. In Proc. of ICGT06, pages 260–274, [FASE12] R. Salay, M. Famelis, and M. Chechik. Language Independent Refinement using Partial Modeling. In Proc. of FASE12,