Generating model with uncertainty by means of JTL Gianni Rosa Università degli Studi dell’Aquila I-67100 L’Aquila, Italy Email:gianni.rosa@univaq.it Abstract—In Model-Driven Engineering, the potential advan- key to success. Recently, few declarative approaches [2], [3], tages of using bidirectional transformations are largely recog- [16] to bidirectionality have been proposed. They are able to nized. Despite its crucial function, in certain cases bidirectionality cope with the non-bijectivity by generating all the admissible has somewhat limited success because of the ambivalence con- cerning non-bijectivity. In fact, consistently propagating changes solutions of a transformation at once. Among them, the Janus from one side to the other is typically non univocal as more Transformation Language [3] (JTL) is a model transformation than one correct solution is admitted. This gives place to a language specifically tailored to support bidirectionality and form of uncertainty which means that, rather than having a change propagation. The problem of managing a set of models single model, we actually have a set of possible models but we explicitly is impractical as its size might be quite large, do not know what is the right one. In this paper, we discuss how dealing with multiple solutions is important and requires designers need to be supported with suitable mechanism and specialized tools and support. In particular, handling a set of tools in order to avoid the effect of having multiple design models explicitly is generally non-viable. Thus, we extended alternatives. the JTL semantics to generate a model with uncertainty which The solution proposed in this paper, is an extension of is semantically equivalent to the set of models it represents. The approach is implemented and a metamodel-independent the JTL semantics and of its engine capable of generating a technique is proposed. uniform characterization of the solution in terms of models with uncertainty instead of a set of models, such that a) I. P ROBLEM AND M OTIVATION the approach is metamodel-independent, in sense that starting In Model-Driven Engineering [20] (MDE) bidirectionality in from an arbitrary base metamodel can automatically generate transformations has been always regarded as a key mech- the corresponding uncertainty metamodel; b) the resulting anism [21]. Its employment comprises mapping models to model conforms to the uncertainty metamodel; and c) each other models to focus on particular features of a system, model with uncertainty has to be considered semantically simulate/validate a given application, and primarily keeping a equivalent to the set of its concretizations, i.e. the models set of interrelated models synchronized or in a consistent state. obtainable from the uncertainty model by resolving the point Despite its relevance, bidirectionality has rarely produced of uncertainties. anticipated benefits as demonstrated by the lack of a lan- By way of example, consider the Collapse/Expand State guage comparable to what ATL1 represents for unidirectional Diagrams round-trip benchmark [4]. The forward transforma- → − transformations. Probably the main reason why bidirectional tion T translates the hierarchical state machine in Fig. 1(a) → − techniques had limited success can be found to some extent into the flatten version in Fig. 1(b). T is clearly non-injective in the ambivalence concerning non-bijectivity. For instance, because different hierarchical machines can be translated into while MDE requirements demand enough expressiveness to the same model. Let us suppose now that the designer wants write non-bijective transformations [23], the QVT standard is to manually modify the target model by means of the changes somewhat uncertain in asserting whether the language permits ∆ highlighted in bold and with thicker lines in Fig. 1(c). More such transformations [22]. In particular, when reversing a non- in details, ∆ consists of the following modifications: injective bidirectional mapping more than one admissible solu- – a new state Printing is added, tion can be found. This gives place to a form of uncertainty (as – a new transition print from Active to Printing is known in [18]): rather than having a single model, we actually added, have a set of possible models and we are not sure which is – the transition done from Active to Idle is deleted and the right one. On the other hand, while a transformation can replaced by a new transition completed, always be disambiguated at design-time by fixing those details – a new transition done from Printing to Idle is added, that leave the solution open to multiple alternatives, in many and finally cases this is non-viable because the designer does not detain – a new transition critical error from Out of enough information beforehand for establishing a general services to the initial state Off is added. solution. Thus, harnessing declarative approaches capable of At this point, the original source model and the revised target dealing with the intrinsic uncertainty of non-bijective bidirec- model are not consistent any longer. Therefore, the backward tional transformations in a rigorous and precise way can be ← −−1 transformation T can be used to restore the consistency 1 http://www.eclipse.org/atl/ by propagating the changes in ∆. Not surprisingly, there is Fig. 1. Collapse/expand state diagrams in a round-trip process not a unique way of updating the source model. In fact, the works, often with the intention to express and represent it added transitions in the target may be mapped to either of in models. In [10], the notion of partial model is introduced the nested states as well as to the container state itself, as in order to let the designer specify uncertain information by illustrated in Fig. 1(d), where the dotted edges represent the means of a base model enriched with annotations and first- alternative transitions. Despite the changes on the target model order logic. Model transformation techniques typically operate are relatively simple, their impact on the source model is under the assumption that models do not contain uncertainty. typically exponential. In fact, the overall number of admissible Nevertheless, the work in [11] proposes a technique for models in this case is adapting existing model transformations in order to deal with models containing uncertainty. The main is a lifting operation, |print| × |completed| × |critical error| which permits to adapt unidirectional transformations for be- = 4 × 4 × 3 = 48 ing used over models with uncertainty preserving their original where |name| is the number of alternative model elements behavior. In [17] a formal approach called MAVO is proposed called name. It is worth noting that the models in Fig. 1(d) are and applied to design models in order to express and allow represented by means of the dotted notation, which is informal: automated reasoning in presence of uncertainty. in this case a bidirectional transformation implemented in Concerning the multiplicity of solutions in bidirectional JTL would generate a collection of 48 distinguished models. transformations, most of the existing languages are determin- Clearly, whenever the implementor is unable to disambiguate istic, i.e., they produce one model at a time. However, in [1] the transformation by making it deterministic, the decision the authors propose PROGRES, a bidirectional transformation must be left to the modeler rather than to the language solution based on Triple Graph Grammars (TGGs) which is internals. able to recognize ambiguous mappings and in case resolve It is not difficult to demonstrate that for a specific instance, them by interactively asking the user, who need to be an if n is the number of uncertainty points and m the number of expert in these techniques. In [22] the QVT-R bidirectional alternative model elements for each of them, then the result transformation language is discussed. In particular, the author consists of mn different alternative solutions. Hence, it is observes that the formal semantics of QVT-R is ambiguous of crucial relevance that modelers are adequately assisted in and it is not possibile to conclude that QVT-R supports non- dealing with the combinatorial explosion of design alternatives bijective transformations. An attempt in making bidirectional as described in the sequel. transformation deterministic by means of intentional updates is The paper is organized as follows. Section II describes represented by the BiFluX language [24], however the problem related work about this topic, Section III presents the proposed that a transformation cannot be tested for non-determinism at approach to represent uncertainty by means of JTL, Section IV static-time reduces its effectiveness. Recently some interesting proposes a new semantic for the JTL engine able to generate solutions based on lenses have been proposed: [5] illustrates a and manage models with uncertainty. Finally, Section V draws technique to support bidirectional transformations relying no some conclusion and future work. more on mapping between models but across manipulations (or differences) operable on them. However, the management II. R ELATED WORK of non-bijective problems is not clearly addressed. Although Uncertainty is ubiquitous within contexts such as requirements researchers are actively working on bidirectional transforma- engineering [6], software processes [15] and adaptive sys- tions in several communities [14], a lot effort must be made to tems [19]. Uncertainty management has been studied in many make such kind of transformations ripe for the industrial en- vironment [13]. Finally, the ability to deduce and generate all 20 get_uncertainty_set(t1,t2), getID(ID,t1), getUMM(UMM,t1), getUMC(UMC,t1). the possible solutions of an uncertain transformation has been 21 achieved by few approaches, including JTL [7], [8]. In [16] 22 edge(UMM,IDe,URef,ID,IDt) :- the authors propose a bidirectional transformation approach 23 get_uncertainty_set(t1,t2), getRefID(IDe,ID), getID(ID,t1), getUMM(UMM,t1), in which the QVT-R semantics is implemented by means of 24 getChildID(IDt,ID), getURef(URef,t1). Alloy. Different generated alternatives may be obtained from Listing 1. A fragment of the adapted JTL engine the execution of a model transformation and reduced by adding With reference to the scenario described in Sect. I, the model extra OCL constraints or by limiting the upper-bound search with uncertainty corresponding to the admissible 48 solutions, criteria. While in [2] similar results are obtained by using is shown in Fig. 2. In particular, the alternative transitions a variety of integer linear programming. These approaches are collected in the uncertainty point (UTransition) print, introduced over the last few years on one hand demonstrate completed, new operation which contains the transitions that there is a need for an in-depth discussion about the nature targeting each one of the nested states within Active as well of bidirectionality; and on the other hand, shown how mature as to the composite state itself. techniques and semantics are available for dealing with an intrinsically difficult problem. III. A PPROACH AND UNIQUENESS The main challenge to address in order to let JTL generate the model with uncertainty is to detect those model elements which are shared throughout the solution space, i.e., the certain part of the solution. Referring to Fig. 1(d), it consists of all elements in the model but the dotted edges. This is obtained by logically connecting those elements in the source model which originated the same target elements. Since the JTL engine is a logic program written in ASP, it can derive how models are related by means of a deductive process. In this respect, the existing traceability management offers enough information to understand how the models can be factorized by identifying those elements which are connected among them. In particular, tracing information stores relevant details about the linkage between source and target model elements at execution-time (including the applied transformation rules). An excerpt of the implemented mechanism is given in Listing 1. In particular, it contains (part) of the ASP encoding of the transitions print present in the modified simple machine in Fig. 1.(c) (line 1) and in the hierarchical state machine in Fig. 1.(d) (lines 3-6); the corresponding trace links are given in lines 8-11. During the execution of the transformation, the engine is able to deduce both the concretization models and/or the model with uncertainty. Any point of uncertainty is derived by calculating the uncertainty set among model elements (lines 15-24). 1 node(SM, p, transition). 2 3 node(HSM, p1, transition). 4 node(HSM, p2, transition). Fig. 2. UHSMm model 5 node(HSM, p3, transition). 6 node(HSM, p4, transition). 7 Due to the metamodel structure (Fig.4), models with un- 8 trace_link(tl1,s1,t1,r1). certainty may over-approximate the sets of transformation 9 trace_link(tl2,s1,t2,r2). 10 trace_link(tl1,s1,t3,r3). candidates. For instance, the scenario in Fig. 1 suggests 11 trace_link(tl2,s1,t4,r4). that only one print transition can exist in the final model. 12 13 getID(p,s1). getID(p1,t1). getID(p2,t2). getID(p3,t3). However, the generated model with uncertainty admits also getID(p4,t4). models with multiple print transitions giving place to more 14 15 get_uncertainty_set(t1,t2) :- concretizations than those expected. Therefore, in order to 16 trace_link(tl1,s1,t1), trace_link(tl2,s2,t2), avoid multiple print transitions, an operation of refining with 17 equals_id(s1,s2), equals_id(t1,t2). 18 a constraint on the model is needed in order to reduce the 19 node(UMM,ID,UMC) :- concretizations to cases with one print transition only. The constraints are directly generated by the JTL engine, which possesses all the information in the trace links between models source and target. IV. R ESULTS It is worth noting how uncertainty is becoming increasingly important in today’s software based systems. Rather than ignoring uncertainty, it should be considered as a first-class concern in the design, implementation, and deployment of those systems [12]. Typically, it occurs when the designer does not have complete, consistent and accurate information required to take a decision during any stage of software devel- Fig. 3. The HSM metamodel opment. Introducing uncertainty in modeling processes means that, rather than having a single model, designer actually have a set of possible models and she is not sure which is the correct one [10]. In bidirectional transformations, uncertainty becomes manifest only after the transformation is executed but clearly originates from the inability of providing intentional updates at design-time. The idea of representing a set of solutions with a single model with uncertainty is the starting point for extending a language like JTL. In order to reduce the burden of managing a collection of models, a metamodel-independent approach to uncertainty representation based on preliminary work in [9] is shown below. Fig. 4. The U (HSM) metamodel The uncertainty metamodel U (M ) is obtained by extending a base metamodel M with specific connectives to represent The above metamodel permits to represent with a single the multiple outcomes of a transformation. These connectives model a set of state machines. For instance, in Fig. 1(d) a set of denote the uncertainty points where alternative model ele- hierarchical machines are given. Most of the model elements ments are attached. Moreover, such points of uncertainty are (all the nodes and part of the transitions) are shared among traceable in order to ease the traversal of the solution space them, they represent the certain part of the models. Whilst, the and to permit the identification of specific concretizations, dotted alternative transitions denoted by print, completed, i.e., instances. Let us consider the metamodel HSM of the and critical error correspond to three different uncer- hierarchical state machines given in Fig. 3. The uncertainty tainty points of type UTransition, each connected to the metamodel U (HSM) in Fig. 4 is automatically obtained by related alternative Transition elements. extending the base metamodel as follows: The main advantage of the approach is that the uncertainty 1) the abstract metaclass TracedClass with attributes represented by a set of alternative models is leveraged to a trace and ref is added, first-class status. A complete set of models can therefore be 2) for each metaclass c in HSM, such that it is non-abstract manipulated as whole, for instance with an automated transfor- and does not specialize other metaclasses: mation, without iterating over each individual in the set. The 2.1) a direct sub-metaclass uc of c is added, above discussion captures the fact that non-injective mappings 2.2) c is generalized by TracedClass, when reversed can produce multiple results. However, as 3) each metaclass uc is composed with c, enabling the rep- discussed in the previous section managing a multitude of resentation of a point of uncertainty and its alternatives, models is impractical. What is needed is a construction capable finally of representing a set of models generated by a transformation 4) the cardinality of attributes and references are relaxed and in an intensional way. Hence, the revised JTL engine is able made optional in order to permit to express uncertainty to distinguish among two different behaviors: also over them. – extensional, generate all the models satisfying the relation In particular, the metaclasses UStateMachine, UState and defined in the bidirectional transformation; UTransition in U (HSM) are derived from StateMachine, – intensional (or with uncertainty), generate a model with State and Transition in HSM, which are in turn gener- uncertainty which is semantically equivalent to the mod- alized by TracedClass. The purpose of TracedClass is els of the extensional case, i.e., the corresponding set of to maintain information about the relationships between the models can be generated from it. uncertainty points and the correspondent own alternatives in However, one important issue arising from this scenario the concretization models. is that models with uncertainty may be over-approximations of the sets of transformation candidates. This is due to the [10] M. Famelis, R. Salay, and M. Chechik. Partial models: Towards ”combinatorial” nature of these models since each point of modeling and reasoning with uncertainty. In ICSE, pages 573–583, 2012. uncertainty collects the different alternatives. Consequently, it [11] M. Famelis, R. Salay, A. D. Sandro, and M. Chechik. Transformation can happen that certain combinations produce concretizations of models containing uncertainty. In MoDELS, pages 673–689, 2013. which are not part of the extensional solution space. Therefore, [12] D. Garlan. Software engineering in an uncertain world. In Proceedings of the FSE/SDP workshop on Future of software engineering research, besides the models with uncertainty it is important to generate pages 125–128. ACM, 2010. also those constraints which limit the solution to the admissible [13] J. Hutchinson, M. Rouncefield, and J. Whittle. Model-driven engineering concretization only. practices in industry. In Software Engineering (ICSE), 2011 33rd International Conference on, pages 633–642. IEEE, 2011. [14] D. Hutchison, T. Kanade, J. Kittler, J. Kleinberg, F. Mattern, J. Mitchell, V. C ONCLUSION M. Naor, O. Nierstrasz, C. P. Rangan, B. Steffen, et al. Bidirectional transformations: A cross-discipline perspective, grace meeting notes, Bidirectional model transformations represent at the same state of the art, and outlook. In Theory and Practice of Model time an intrinsically difficult problem and a crucial mecha- Transformations, Second International Conference, ICMT 2009, Zurich, nism for keeping consistent and synchronized a number of Switzerland, June 29-30, 2009. Proceedings, volume 5563. Springer, 2009. related models. One of the prevalent factors within software [15] H. Ibrahim, B. H. Far, A. Eberlein, and Y. Daradkeh. Uncertainty engineering is the problem of non-determinism in bidirectional management in software engineering: Past, present, and future. In transformations. When modellers are not able to fix a design CCECE, pages 7–12. IEEE, 2009. [16] N. Macedo and A. Cunha. Implementing qvt-r bidirectional model decision they may encode ambiguities in their model transfor- transformations using alloy. In V. Cortellessa and D. Varró, editors, mation specification, e.g. not providing additional constraints FASE, volume 7793 of Lecture Notes in Computer Science, pages 297– that would make the transformation deterministic. The lack of 311. Springer, 2013. [17] R. Salay, M. Chechik, J. Horkoff, and A. D. Sandro. Managing information affects models, for instance ambiguous mapping requirements uncertainty with partial models. Requir. Eng., 18(2):107– may cause the generation of multiple solution models each 128, 2013. one representing a different design decision. [18] R. Salay, M. Famelis, and M. Chechik. Language independent refine- ment using partial modeling. In FASE, pages 224–239, 2012. Therefore, the proposed approach is based on the refinement [19] P. Sawyer, N. Bencomo, J. Whittle, E. Letier, and A. Finkelstein. of the JTL engine, which permits the generation of models Requirements-aware systems: A research agenda for re for self-adaptive with uncertainty in order to leverage the solution space to a systems. In RE, pages 95–103. IEEE Computer Society, 2010. [20] D. Schmidt. Guest Editor’s Introduction: Model-Driven Engineering. first-class concern. The approach has been implemented and Computer, 39(2):25–31, 2006. can be used for any Ecore artifact. [21] S. Sendall and W. Kozaczynski. Model Transformation: The Heart and Soul of Model-Driven Software Development. IEEE Software, 20(5):42– ACKNOWLEDGMENT 45, 2003. [22] P. Stevens. Bidirectional model transformations in QVT: semantic issues This research was supported by the EU through the Model- and open questions. Software and Systems Modeling, 8, 2009. Based Social Learning for Public Administrations (Learn Pad) [23] S. Witkop. MDA users’ requirement for QVT transformations. In OMG doc 05-02-04, 2005. FP7 STREP project (619583)2 . [24] T. Zan, H. Pacheco, and Z. Hu. Writing bidirectional model transfor- mations as intentional updates. In ICSE Companion, pages 488–491, R EFERENCES 2014. [1] S. M. Becker, S. Herold, S. Lohmann, and B. Westfechtel. A graph-based algorithm for consistency maintenance in incremental and interactive integration tools. Software and System Modeling, 6(3):287–315, 2007. [2] G. Callow and R. Kalawsky. A Satisficing Bi-Directional Model Trans- formation Engine using Mixed Integer Linear Programming. Journal of Object Technology, 12(1):1: 1–43, 2013. [3] A. Cicchetti, D. Di Ruscio, R. Eramo, and A. Pierantonio. JTL: a bidirectional and change propagating transformation language. In Procs. of SLE 2010, LNCS 6563, pages 183–202. Springer, 2011. [4] K. Czarnecki, J. N. Foster, Z. Hu, R. Lämmel, A. Schürr, and J. F. Ter- williger. Bidirectional Transformations: A Cross-Discipline Perspective - GRACE meeting notes, state of the art, and outlook. In Procs. of ICMT2009, volume 5563 of LNCS, pages 260–283. Springer, 2009. [5] Z. Diskin, Y. Xiong, and K. Czarnecki. From state- to delta-based bidirectional model transformations. pages 61–76, 2010. [6] C. Ebert and J. D. Man. Requirements uncertainty: influencing factors and concrete improvements. In Procs. of ICSE, pages 553–560. ACM Press, 2005. [7] R. Eramo, I. Malavolta, H. Muccini, P. Pelliccione, and A. Pierantonio. A model-driven approach to automate the propagation of changes among Architecture Description Languages. SOSYM, 1(25):1619–1366, 2010. [8] R. Eramo, A. Pierantonio, J. R. Romero, and A. Vallecillo. Change management in multi-viewpoint system using asp. In Procs of EDOCW, pages 433–440, Washington, DC, USA, 2008. IEEE Computer Society. [9] R. Eramo, A. Pierantonio, and G. Rosa. Uncertainty in bidirectional transformations. In Procs. of MiSE 2014, 2014. 2 www.learnpad.eu