Correctness of Software Models Mira Balaban, Azzam Maraee Computer Science Department Ben-Gurion University Model correctnessFall 20121

What is a model? An abstraction of software features An abstraction of software features A structure that singles out selected features A structure that singles out selected features Independent from other software elements Independent from other software elements Independent from marginal software details Independent from marginal software details Usually visual (diagrammatic) Usually visual (diagrammatic) MoDELS-2011October 112

UML Class-Diagram MoDELS-2011October 113 CorpCustomer employeeNum department Company turnover Party name address printLetter() employs 1 0..* Reservation dateBooked status cancel() Course title date totalParticipants maxParticipants addReservation() cancel() Customer custNum participant 0..* giveStatistics() printLetter()

UML Class-Diagram enriched with OCL invariants MoDELS-2011October 114 Company turnover Party name address printLetter() Reservation dateBooked status cancel() Course title date totalParticipants maxParticipants addReservation() cancel() Customer custNum participant 0..* giveStatistics() Context Course inv: totalParticipants < maxParticipants Context Reservation Inv: self.dateBooked < self.course.date Context Customer Inv: self.Course->select{c1,c2|c1.date=c2.date}->isEmpty()

UML Rich Class-Diagram MoDELS-2011October 115 {disjoint, complete} Context Membership Inv: self.Customer.cards-> includes(self.card)

UML interaction diagram MoDELS-2011October 116 addReservation() cancel() x1: Customerx2: Customer c: course :programme maintenance r1: Reservation addReservation() r2: Reservation printLetter() cancel() printLetter()

UML Statechart MoDELS-2011October 117 planned bookable full over cancelled do/ cancel / enter data update release new reservation res. cancelled course cancelled course cancelled [is full] [timeout] is_full: totalParticipants = maxParticipants timeout: today >= date Class "Course" / archive data delete

UML Use-Case diagram MoDELS-2011October 118

Model features Usually (diagrammatic) Usually visual structure (diagrammatic) – But OCL is symbolic Partial Abstract Business level Not necessarily executable – Desirable feature: Testable Platform (technology) independent Difference from Programs: Difference from Programs: – Level of abstraction – Possibly no operational semantics MoDELS-2011October 119

Why modeling? Requirement engineering Elaboration of intended goals Specification of – Restrictions – Priorities – Essential services – Structure Business level and partiality enable – Early structuring before software construction: validation of intentions verification debugging Platform independence enables – Reuse MoDELS-2011October 1110

Unified Modeling Language (UML) Widely accepted as modeling standard – OMG standard: Collection of modeling diagrams – Each describes a view of OO software A UML model = A collection of diagrams Object Constraint Language (OCL) – textual – Invariants – Queries – Pre/post conditions UML standard specification is informal – Much research on its formalization Model correctnessFall

Model-Driven-Engineering (MDE) MDE = MDE = – Software development by repeated transformations of models Motivation Motivation – Growing complexity requires multiple levels of abstraction not supported by programming languages Technologies Technologies – Domain specific modeling languages (DSMLs) – Transformation engines – Model level development platforms EMF, MetaEdit, Epsilon Model correctnessFall

Are models used intensively? Not widely used throughout software evolution life cycle Not widely used throughout software evolution life cycle – Neglected in later stages of software development Users neglect essential modeling features Users neglect essential modeling features – Why bother if features are not translated into the code? Model correctnessFall

The missing link Model-level Integrated Development Environment Model-level Integrated Development Environment – At the level of software IDEs Supports Supports – Reasoning – Verification – Testing – Warnings – Refactoring – Patterns – Integration with code Model correctnessFall

Class-diagrams: Syntax and semantics Model correctnessFall Context User inv: self.ownedTable->select(oclIsTypeOf(SystemTable))-> intersection(self.ownedTable-> select(oclIsTypeOf(UserTable)))->isEmpty() OCL

Object-diagrams: Validation of Class-diagrams Model correctnessFall Mary:User grantedTable T1:Table p1:Permission Fred:User grantedTable p2:Permission grantor A legal but invalid state:

Fall Model correctness