A Sound Execution Semantics for ATL via Translation Validation

Abstract

Abstract. In this work we present a translation validation approach to encode a sound execution semantics for the ATL specification. Based on our sound encoding, the goal is to soundly verify an ATL specification against the specified OCL contracts. To demonstrate our approach, we have developed the VeriATL verification system using the Boogie2 intermediate verification language, which in turn provides access to the Z3 theorem prover. Our system automatically encodes the execution semantics of each ATL specification (as it appears in the ATL matched rules) into the intermediate verification language. Then, to ensure the soundness of the encoding, we verify that it soundly represents the runtime behaviour of its corresponding compiled implementation in terms of bytecode instructions for the ATL virtual machine. The experiments demonstrate the feasibility of our approach. They also illustrate how to automatically verify an ATL specification against specified OCL contracts.

CoqTL: a Coq DSL for rule-based model transformation

“…To make sure Class2Relational is correctly implemented, there are many deductive approaches have been proposed [7,6,10,27]. They aim to certify transformations and prevent them generating faulty models, thereby giving more confidence for the subsequent MDE steps, e.g.…”

“…For example, Listing 2 defines a theorem stating that if all elements contained in the input model have not-empty names, by executing the Class2Relational MT, all generated elements in the output model will also have not-empty names. Interactively proving this simple theorem in Coq takes 56 lines of routine proof code (this short proof can be even automated by using modern automatic theorem provers [6,10]).…”

“…There are many automatic theorem proving approaches for MTs (e.g. [7,6,10,27]). However, interactive theorem proving is inevitable for more serious verification tasks.…”

“…pre/postconditions), then the semantics of the MT language together with contracts and metamodels are encoded into a deductive theorem prover. Thanks especially to recent advancements in SMT solvers, automatic deductive verification is giving good results in several scenarios [7,6,10,27]. However, because of the general undecidability, interactive deductive verification is inevitable for complex tasks (for instance, automatic deductive theorem provers usually lack support for induction, or finding witnesses for existential quantifiers).…”

“…the MT executed in the original environment may have different semantics from the verified MT. Certifying that the semantics of the MT language has being correctly axiomatized in the back-end theorem prover is a hard task, and very few attempts exist [10,1].…”