On Verifying ATL Transformations Using ‘off-the-shelf’ SMT Solvers

Abstract

MDE is a software development process where models constitute pivotal elements of the software to be built. If models are well-specified, transformations can be employed for various purposes, e.g., to produce final code. However, transformations are only meaningful when they are 'correct': they must produce valid models from valid input models. A valid model has conformance to its meta-model and fulfils its constraints, usually written in OCL. In this paper, we propose a novel methodology to perform automatic, unbounded verification of ATL transformations. Its main component is a novel first-order semantics for ATL transformations, based on the interpretation of the corresponding rules and their execution semantics as first-order predicates. Although, our semantics is not complete, it does cover a significant subset of the ATL language. Using this semantics, transformation correctness can be automatically verified with respect to non-trivial OCL pre-and postconditions by using SMT solvers, e.g. Z3 and Yices.

Formal validation of domain-specific languages with derived features and well-formedness constraints

“…Analysis of model and graph transformations SMT solvers have also been used to verify declarative ATL transformations [14] allowing the use of an efficiently analyzable fragment of OCL [21]. The main advantage of using SMT solvers is that it is refutationally complete for quantified formulas of uninterpreted and almost uninterpreted functions and efficiently solvable for a rich subset of logic.…”

“…These approaches mainly focus on mapping core graph transformation semantics, but does not cover many rich query features of the EMFIncQuery language (such as transitive closure and recursive pattern calls). Many ideas are shared with approaches aiming to verify model transformations [16,38,14], as they built upon the semantics of source and target languages to prove or refute properties of the model transformation. However, the validation tasks identified in the paper are different from the verification challenges of model transformations.…”

Verification of ATL Transformations Using Transformation Models and Model Finders

“…For each class c in MF add a constraint context c inv : -For shape IV we distinguish two cases. When we have q = 1 (there is only one rule that can possibly match this type), then we can translate the resolution into two simple navigation steps 6 (the type cast may be omitted when expr already has a sufficient specific type):…”

“…Second, we recently presented an alternative approach to the formal verification of partial correctness of ATL using SMT solvers and a direct translation of the ATL transformation into first-order logic [6]. This approach is complementary to our current one and to other bounded verification approaches for ATL: It reasons symbolically and does not require bounds on the model extent, but it is incomplete (not all properties can be automatically decided this way, although it is refutationally complete in many cases).…”

“…While the lightweight OCL axiomatization presented in our current work is fine for bounded model finders (and has an intuitive interpretation of counter examples as trace models), we were not able to employ SMT solvers for its verification. Using a direct translation of ATL+OCL into FOL [6] we could automatically prove several desired implications using the Z3 theorem prover solver (for the price that this approach requires of a full FOL encoding of ATL and OCL).…”