Michalis Famelis, Rick Salay, Alessio Di Sandro, Marsha Chechik

University of Toronto

MODELS 2013, Miami Beach, FL

Transformation of Models Containing Uncertainty

2

This is Natalie.

Natalie is a modeler.

Natalie faces uncertainty in her everyday work.

3

Alternative Designs

Hmm, I don’t know which

one, yet.

4

Conflicting Stakeholder Opinions

What do I do until they decide?

5

Incomplete Information

I don’t know everything about

this, yet.

6

Uncertainty in software development

Uncertainty about the content of the model.

Many design alternatives Conflicting stakeholder opinionsIncomplete information

7

Transformations

Like everygood MBE practitioner,Natalie usesa variety of MTs

8

Transformations

The transformations assumeinputs that don’t containuncertainty

Like everygood MBE practitioner,Natalie usesa variety of MTs

9

Transformations

But only too often, Natalie’s models contain uncertainty:

The transformations assumeinputs that don’t containuncertainty

Like everygood MBE practitioner,Natalie usesa variety of MTs

10

Transforming Models with Uncertainty

Natalie should be able to use model transformations

11

Transforming Models with Uncertainty

Natalie should be able to use model transformations

12

Transforming Models with Uncertainty

Natalie should be able to use model transformations

Existing transformation techniques do not support this!

To apply MTs, Natalie is forced to artificially remove uncertainty

13

Transforming Models with Uncertainty

We need to lift Natalie’s transformations so that they can apply to models with uncertainty

Existing transformation techniques do not support this!

Natalie should be able to use model transformations

14

Outline

Representing Uncertaintywith Partial Models

Transforming Partial Models

ToolSupport

EmpiricalEvaluation

Reminder: Model Transformations

15

Model Transformations With Graph Rewriting

class1

+ attribute : type

class1

- attribute : type+ getAttribute() :type

class1

class2

NegativeApplicationCondition

LeftHandSide

RightHandSide

EncapsulateVariable refactoring:Make fields private and add getter methodsunless they belong to some inner class

Example rule:

16

Example Input Model

SolverSolverException

+ effect : String

class1

+ attribute : type

class1

- attribute : type+ getAttribute() :type

class1

class2

RHSLHSNAC

17

Example Input Model

SolverSolverException

+ effect : String

class1

+ attribute : type

class1

- attribute : type+ getAttribute() :type

class1

class2

RHSLHSNAC

Match

18

Example Input Model

SolverSolverException

+ effect : String

class1

+ attribute : type

class1

- attribute : type+ getAttribute() :type

class1

class2

RHSLHSNAC

NAC also matches! ABORT !

19

Example Input Model 2

SolverException

+ effect : String

class1

+ attribute : type

class1

- attribute : type+ getAttribute() :type

class1

class2

RHSLHSNAC

20

Example Input Model 2

SolverException

+ effect : String

class1

+ attribute : type

class1

- attribute : type+ getAttribute() :type

class1

class2

RHSLHSNAC

Match

21

Example Input Model 2

SolverException

+ effect : String

class1

+ attribute : type

class1

- attribute : type+ getAttribute() :type

class1

class2

RHSLHSNAC

Delete

22

Example Input Model 2

SolverException

effect : String

class1

+ attribute : type

class1

- attribute : type+ getAttribute() :type

class1

class2

RHSLHSNAC

23

Example Input Model 2

SolverException

- effect : String

class1

+ attribute : type

class1

- attribute : type+ getAttribute() :type

class1

class2

RHSLHSNAC

Add

24

Example Input Model 2

SolverException

- effect : String + getEffect() : String

class1

+ attribute : type

class1

- attribute : type+ getAttribute() :type

class1

class2

RHSLHSNAC

Add

25

Example Input Model 2

SolverException

- effect : String + getEffect() : String

class1

+ attribute : type

class1

- attribute : type+ getAttribute() :type

class1

class2

RHSLHSNAC

No more LHS matches.

Stop.

26

Outline

Representing Uncertaintywith Partial Models

27

Representing Uncertainty

Partial Models [ICSE12]

• Points of uncertainty (“May elements”) explicated using syntactic annotations

Solver

SolverException

+ effect : String

Unsure if it should be an inner class.

Unsure if we need this field.

28

Representing Uncertainty

Partial Models [ICSE12]

• Points of uncertainty (“May elements”) explicated using syntactic annotations

Propositional variables: “the element exists”

Solver

SolverException

+ effect : String

X

Y

29

Representing UncertaintySolver

SolverException

+ effect : String

X

Y

Solver

SolverException

Solver

SolverException

Solver

SolverException

+ effect : String

Solver

SolverException

+ effect : String

x=F, y=F x=T, y=F

x=F, y=T x=T, y=T

4 concretizations: 4 ways to resolve uncertainty.

30

Representing Uncertainty

Partial Models [ICSE12]

• Points of uncertainty (“May elements”) explicated using syntactic annotations

• Restrictions to the set of concretizations can be captured in the “May formula”

Solver

SolverException

+ effect : String

X

Y

X v Y

31

Representing UncertaintySolver

SolverException

+ effect : String

X

Y

Solver

SolverException

Solver

SolverException

Solver

SolverException

+ effect : String

Solver

SolverException

+ effect : String

x=F, y=F x=T, y=F

x=F, y=T x=T, y=TX v Y

32

Outline

Transforming Partial Models

33

Transforming Models With Uncertainty

Natalie wants to apply the rule to an input with uncertainty

34

Why Is It Hard?

Solver SolverException

+ effect : String

class1

+ attribute : type

class1

- attribute : type+ getAttribute() :type

class1

class2

RHSLHSNAC

X

Y

X v Y

35

Why Is It Hard?

Solver SolverException

+ effect : String

class1

+ attribute : type

class1

- attribute : type+ getAttribute() :type

class1

class2

RHSLHSNAC

Match???

X

Y

X v Y

36

Why Is It Hard?

Solver SolverException

+ effect : String

class1

+ attribute : type

class1

- attribute : type+ getAttribute() :type

class1

class2

RHSLHSNAC

Match???

X

Y

X v Y

37

Why Is It Hard?

Solver SolverException

+ effect : String

class1

+ attribute : type

class1

- attribute : type+ getAttribute() :type

class1

class2

RHSLHSNAC

Should we delete?

Should we add?

X

Y

X v Y

38

Why Is It Hard?

Solver SolverException

+ effect : String

class1

+ attribute : type

class1

- attribute : type+ getAttribute() :type

class1

class2

RHSLHSNAC

Existing transformation techniques cannot be used.

X

Y

X v Y

39

Intuition

class1

+ attribute : type

class1

- attribute : type+ getAttribute():type

class1

class2

RHSLHSNAC

Solver

SolverException

+ effect : String

X

Y

X v Y

?

(And definition of correctness)

40

Intuition

class1

+ attribute : type

class1

- attribute : type+ getAttribute():type

class1

class2

RHSLHSNAC

Solver

SolverException

+ effect : String

Solver

SolverException

+ effect : StringSolver

SolverException

?

(And definition of correctness)

41

Intuition

class1

+ attribute : type

class1

- attribute : type+ getAttribute():type

class1

class2

RHSLHSNAC

Solver

SolverException

+ effect : String

Solver

SolverException

+ effect : StringSolver

SolverException

Solver

SolverException

-effect : String+getEffect() : String

Solver

SolverException

+ effect : String

Solver

SolverException

(And definition of correctness)

42

Intuition

class1

+ attribute : type

class1

- attribute : type+ getAttribute():type

class1

class2

RHSLHSNAC

Solver

SolverException

+ effect : String

Solver

SolverException

+ effect : StringSolver

SolverException

( X ¬Y ¬a ¬b) ∧ ∧ ∧v(¬X Y ¬a b) ∧ ∧ ∧v( X Y a ¬b)∧ ∧ ∧

Solver

SolverException

+ - effect : String+getEffect() : String

X

Ya

b

(And definition of correctness)

43

Intuition

class1

+ attribute : type

class1

- attribute : type+ getAttribute():type

class1

class2

RHSLHSNAC

Solver

SolverException

+ effect : String

X

Y

X v Y

( X ¬Y ¬a ¬b) ∧ ∧ ∧v(¬X Y ¬a b) ∧ ∧ ∧v( X Y a ¬b)∧ ∧ ∧

Solver

SolverException

+ - effect : String+getEffect() : String

X

Ya

b

(And definition of correctness)

44

Technique

class1

+ attribute : type

class1

- attribute : type+ getAttribute():type

class1

class2

RHSLHSNAC

Solver

SolverException

+ effect : String

X

Y

X v Y

45

Technique

class1

+ attribute : type

class1

- attribute : type+ getAttribute():type

class1

class2

RHSLHSNAC

Solver

SolverException

+ effect : String

X

Y

X v Y

(a) Find Match

Step 1: Determine applicability

46

Technique

class1

+ attribute : type

class1

- attribute : type+ getAttribute():type

class1

class2

RHSLHSNAC

Solver

SolverException

+ effect : String

X

Y

X v Y

(a) Find Match

(b) Make sure the rule applies to at least one concretization

(requires solvinga SAT problem)

Step 1: Determine applicability

47

Technique

class1

+ attribute : type

class1

- attribute : type+ getAttribute():type

class1

class2

RHSLHSNAC

Solver

SolverException

+ effect : String

X

Y

X v Y

Solver

X

Step 1: Determine applicabilityStep 2:Transform graph

SolverException

+ effect : StringY

(a) Copy over unchangedparts

48

Technique

class1

+ attribute : type

class1

- attribute : type+ getAttribute():type

class1

class2

RHSLHSNAC

Solver

SolverException

+ effect : String

X

Y

X v Y

Solver

SolverException

+ - effect : String+getEffect() : String

X

Ya

b

Step 1: Determine applicabilityStep 2:Transform graph

(a) Copy over unchangedparts

(b) Perform additions and deletions

Added and deleted elements become Maybe

49

Technique

class1

+ attribute : type

class1

- attribute : type+ getAttribute():type

class1

class2

RHSLHSNAC

Solver

SolverException

+ effect : String

X

Y

X v Y

Step 1: Determine applicabilityStep 2:Transform graphStep 3:Transform formula

( X ¬Y ¬a ¬b) ∧ ∧ ∧v(¬X Y ¬a b) ∧ ∧ ∧v( X Y a ¬b)∧ ∧ ∧

Solver

SolverException

+ - effect : String+getEffect() : String

X

Ya

b

Constrain Maybe elementsto ensure each thatconcretizationis correctly affected.

50

Overview

class1

+ attribute : type

class1

- attribute : type+ getAttribute():type

class1

class2

RHSLHSNAC

Solver

SolverException

+ effect : String

X

Y

X v Y

( X ¬Y ¬a ¬b) ∧ ∧ ∧v(¬X Y ¬a b) ∧ ∧ ∧v( X Y a ¬b)∧ ∧ ∧

Solver

SolverException

+ - effect : String+getEffect() : String

X

Ya

b

Step 1: Determine applicabilityStep 2:Transform graphStep 3:Transform formula

51

AnalysisIn the paper:

• Proof of correctness• The lifting algorithm implements

our intuition

• Proofs of preservation of properties:1. Confluence

The result of applying a set of rules to a model is the same regardless of the order of application or the order of matching sites.

2. TerminationRepeated applications will reach a point where the rule will no longer be applicable.

52

Outline

ToolSupport

EmpiricalEvaluation

53

Tool Support

• Reuse partial model implementation in MMTF (Eclipse / EMF)

• Algorithm implementation1. Determine rule applicability

• Henshin and the Z3 SMT solver

2. Transform the graph• Henshin

3. Transform the formula• Java (Z3 input strings) MMTF

54

Case Study

• Object–relational mapping (ORM)

• “Translate a class diagram to a relational database

schema.”

• Classic benchmark for model

transformation research

• Triple graph grammar with 5 layered graph rules [Varro06]

(Image from [Varro06])

55

Case Study

• Input model: the Ecore metamodel

• ORM for Ecore is important: cf. CDO and Teneo

• Manually flattened inheritance hierarchy and adapted to the

metamodel in [Varro06]

• Resulting model had 65 model elements:

• 17 classes, 17 associations, 6 generalization links, 25 attributes

• Manually injected points of uncertainty to create partial models

with increasing numbers of concretizations

56

Setup And Results

• RQ: How does lifting scale with increasing uncertainty?

• Varied: number of concretizations of input

• Measured: time to complete the ORM transformation

• Ran on Intel Core i7-2600 3.40GHz×4core, 8GB RAM, Ubuntu-64 12.10.

• Runtime does not increase dramatically. Approach scales.

# concretizations 1 24 48 108 144 192 256

Time (seconds) 32.6 32.8 32.7 32.9 32.6 33.0 48.4

57

Summary

Decision deferral in the presence of uncertainty

Existing techniques cannot handle uncertainty

Explicit uncertainty modelingwith Partial Models

Syntactic annotations and May formula

Transform Partial Models

1. Determine applicability2. Transform graph3. Transform formula

Approach scales for increasing levels of uncertainty

ToolSupport

EmpiricalEvaluation

Case Study: Object-relational mapping for the Ecore metamodel

58

Next Steps

• Implement lifted semantics as a higher-order transformation (HOT)• Given a graph rewrite rule, produce a grammar that

implements the lifted semantics• Benefit: out of the box reuse of existing graph

transformation tools (Henshin, AGG, etc.)

• Expand lifting for other types of model uncertainty, based on the rich MAVO framework [FASE12]

Questions?

icons by:

60

Bibliography[ICSE12] M. Famelis, M. Chechik, and R. Salay. “Partial Models: Towards Modeling and Reasoning with Uncertainty”. In Proc. of ICSE’12, 2012.

[Varro06] D. Varro, S. Varro-Gyapay, H. Ehrig, U. Prange, and G. Taentzer. “Termination Analysis of Model Transformations by Petri Nets”. In Proc. of ICGT’06, pages 260–274, 2006.

[FASE12] R. Salay, M. Famelis, and M. Chechik. “Language Independent Refinement using Partial Modeling”. In Proc. of FASE’12, 2012.