<!DOCTYPE article PUBLIC "-//NLM//DTD JATS (Z39.96) Journal Archiving and Interchange DTD v1.0 20120330//EN" "JATS-archivearticle1.dtd">
<article xmlns:xlink="http://www.w3.org/1999/xlink">
  <front>
    <journal-meta />
    <article-meta>
      <title-group>
        <article-title>Bridging the Gap Between Formal Methods and Software Engineering Using Model-based Technology</article-title>
      </title-group>
      <contrib-group>
        <contrib contrib-type="author">
          <string-name>Yann Thierry-Mieg</string-name>
          <email>yann.thierry-mieg@lip6.fr</email>
          <xref ref-type="aff" rid="aff0">0</xref>
        </contrib>
        <aff id="aff0">
          <label>0</label>
          <institution>Sorbonne Universités UPMC Paris 6</institution>
          ,
          <addr-line>CNRS UMR 7606</addr-line>
          ,
          <country country="FR">France</country>
        </aff>
      </contrib-group>
      <fpage>30</fpage>
      <lpage>32</lpage>
      <abstract>
        <p>Model-based technology has evolved rapidly in the last decade, bringing immediate benefits to its users. Defining domain specific languages has never been easier, thanks to the infrastructure provided by frameworks such as eclipse EMF and XText. Industrial adoption is easy, you provide specialists with just the language they need. But this is also an opportunity for formal methods and tools to find a wider user base. A problem hindering adoption of formal methods is the effort one needs to invest in learning a particular formalism and the possible gap that exists between a handcrafted model and the reality. Model translation provides an easy way to obtain formal models from domain models that contain fine grain behavioral information, since a DSL typically also has some runtime or code generation support. This talk will present our experiences in building tools for model-checking of various languages using models and transformations and thus leveraging the state of the art in model engineering technology.</p>
      </abstract>
    </article-meta>
  </front>
  <body>
    <sec id="sec-1">
      <title>-</title>
      <p>
        Unified Modeling Language At the turn of the millenium, the first version
of the UML was proposed [
        <xref ref-type="bibr" rid="ref10">10</xref>
        ], a mostly graphical modeling language designed
to cover all artifacts of a software engineering cycle from requirements through
design and development all the way to maintenance and evolution of
objectoriented applications.
      </p>
      <p>
        To achieve this goal, UML is a motley language of compromises, it aggregates
several popular notations, and each diagram can be used to build both very
abstract and concrete models, depending on the purpose of the diagram, the
phase in the process, and the target audience (role in the process) [
        <xref ref-type="bibr" rid="ref6">6</xref>
        ].
      </p>
      <p>
        The development of the language is rapid, and its adoption is widespread,
it is pushed by the standardization work of the OMG consortium [
        <xref ref-type="bibr" rid="ref8">8</xref>
        ] including
the heavyweights of the computer industry. A huge task force is set to actually
defining the language in a way that allows interchange of models between tools.
      </p>
      <p>
        The elegant and general solution adopted is to define the language through
it’s meta-model, a typed graph storing the syntactic information allowable in
concrete model instances. Pushing the reasoning further, and to enable
development of a concrete infra-structure supporting the UML [
        <xref ref-type="bibr" rid="ref11">11</xref>
        ] and its roughly
900 meta-classes, meta-meta modeling tools [
        <xref ref-type="bibr" rid="ref7">7</xref>
        ] are introduced then refined into
industrial strength solutions such as the EMF [
        <xref ref-type="bibr" rid="ref2">2</xref>
        ].
      </p>
      <p>Y. Thierry-Mieg: Bridging the Gap Between Formal Methods and SWE
Domain Specific Models The UML comes with a specialization mechanism
called profiles to (further) enrich the language with new concepts. Popular UML
tools propose a profile to model databases with “class diagrams” for instance.
The initial idea was to leverage existing UML development environments to
offer graphical modeling to users, even if they were not strictly using UML. But
in practice, UML development environments are much too complex for most
modeling purposes, user experience is poor as the learning curve is steep and the
tools are cluttered with unused features.</p>
      <p>The domain specific modeling language (DSL) approach clears these issues
by considering small languages, with a meta-model as simple as possible, and
directly linked to the concepts of the domain. DSL are not new, Makefile is
a dialect for specifying artifact dependencies and construction rules in a build
system, SQL is designed to query relational databases. The novelty comes from
the progress of meta-meta model driven tools, now giving us the infrastructure
to manipulate a meta-model so that defining such a language is easy.
Meta-Models A meta-meta model is simply a graph, each vertex has a type and
carries named and typed properties, which can be primary data, or references to
other vertex. The references are further qualified as being either composition or
aggregation. A specific designated vertex is the root of a covering tree formed by
composition references such that every vertex of the graph is reachable through
a single path in this tree.</p>
      <p>A language is defined by its meta-model, i.e. an instance of a
meta-metamodel, defining the set of allowable types and references a model instance can
contain. Meta-models can be graphically modeled using UML class diagram, and
emerged from the same task force as the UML, leading to some confusion, but
they are in fact wholly independent from the UML. The key is that a tool defined
at the M2 level takes meta-models (languages) as input.</p>
      <p>
        Given simply a meta-model as input, EMF [
        <xref ref-type="bibr" rid="ref2">2</xref>
        ] can generate support for
serializing and reading models, manipulating models through both a language specific
and language neutral rich and powerful API, tree-like model editors, support for
defining validation rules.
      </p>
      <p>
        From Graphical to Textual Models Tools such as GMF [
        <xref ref-type="bibr" rid="ref4">4</xref>
        ] even promised to
offer support for building editors for graphical notations easily. But the
complexity of building an ergonomic and seamless user experience for graphical models
proved difficult (editing, simulation), the frameworks being so rich that delving
into their customization to obtain the desired effect is very difficult.
Furthermore, graphical specifications suffer from scale issues and are not adapted to all
modeling tasks, for instance code is often more compact and readable than an
equivalent control flow graph, even for simple algorithms.
      </p>
      <p>
        The advent of tools supporting the definition of a textual DSL from a an
annotated BNF grammar such as Xtext [
        <xref ref-type="bibr" rid="ref12">12</xref>
        ] suddenly opens adoption of
modelbased technology for a host of information processing applications.
      </p>
      <p>
        PNSE’16 – Petri Nets and Software Engineering
Leveraging Model-based Engineering for Verification For developers of
formal verification tools and algorithms this is a golden opportunity to leverage
man-decades of software development and build versatile tools that can be
seamlessly integrated into existing software development practices. The requirement
is to align technology choices with the industry standards and follow mainstream
trends in languages and development environments, e.g. Java and Eclipse. The
benefits for a small team are huge however as the frameworks generate most of
the heavy duty code, and their ease of customization (e.g. through dependency
injection [
        <xref ref-type="bibr" rid="ref5">5</xref>
        ]) has made much progress.
      </p>
      <p>
        Case Studies The talk is based and borrows examples from our experience in
developing both graphical and textual DSL. We built VeriSensor a semi graphical
notation for wireless sensor networks [
        <xref ref-type="bibr" rid="ref1">1</xref>
        ], VeriJ a DSL based on a fragment of Java
for control and synthesis [
        <xref ref-type="bibr" rid="ref13">13</xref>
        ], and more recently the Guarded Action Language
(GAL) a DSL to express concurrent semantics [
        <xref ref-type="bibr" rid="ref3">3</xref>
        ]. GAL serves as pivot language
in our verification approach, we built transformations from existing languages
(Promela, Uppaal) to GAL using model-based engineering. The language itself
is supported by a powerful symbolic model-checking engine ITS-tools [
        <xref ref-type="bibr" rid="ref9">9</xref>
        ]. By
building this language-based front-end we claim that we ease adoption of our
formal verification tools in the software development process.
      </p>
    </sec>
  </body>
  <back>
    <ref-list>
      <ref id="ref1">
        <mixed-citation>
          1.
          <string-name>
            <given-names>Ben</given-names>
            <surname>Maïssa</surname>
          </string-name>
          ,
          <string-name>
            <given-names>Y.</given-names>
            ,
            <surname>Kordon</surname>
          </string-name>
          ,
          <string-name>
            <given-names>F.</given-names>
            ,
            <surname>Mouline</surname>
          </string-name>
          ,
          <string-name>
            <given-names>S.</given-names>
            ,
            <surname>Thierry-Mieg</surname>
          </string-name>
          ,
          <string-name>
            <surname>Y.</surname>
          </string-name>
          :
          <article-title>Modeling and Analyzing Wireless Sensor Networks with VeriSensor: an Integrated Workflow</article-title>
          .
          <source>Transactions on Petri Nets and Other Models of Concurrency VIII</source>
          ,
          <fpage>24</fpage>
          -
          <lpage>47</lpage>
          (
          <year>Jul 2013</year>
          )
        </mixed-citation>
      </ref>
      <ref id="ref2">
        <mixed-citation>
          2.
          <article-title>Eclipse modeling framework (EMF)</article-title>
          , http://www.eclipse.org/modeling/emf/
        </mixed-citation>
      </ref>
      <ref id="ref3">
        <mixed-citation>3. Guarded action language, http://ddd.lip6.fr/gal.php</mixed-citation>
      </ref>
      <ref id="ref4">
        <mixed-citation>
          4.
          <article-title>Graphical modeling framework (GMF)</article-title>
          , http://www.eclipse.org/modeling/gmp/
        </mixed-citation>
      </ref>
      <ref id="ref5">
        <mixed-citation>
          5.
          <article-title>Google guice, a lightweight dependency injection framework</article-title>
          , https://github. com/google/guice
        </mixed-citation>
      </ref>
      <ref id="ref6">
        <mixed-citation>
          6.
          <string-name>
            <surname>Kruchten</surname>
            ,
            <given-names>P.:</given-names>
          </string-name>
          <article-title>The rational unified process: an introduction</article-title>
          . Addison-Wesley
          <string-name>
            <surname>Professional</surname>
          </string-name>
          (
          <year>2004</year>
          )
        </mixed-citation>
      </ref>
      <ref id="ref7">
        <mixed-citation>
          7.
          <article-title>Meta object facility (MOF) 2.5</article-title>
          . OMG standard (
          <year>2015</year>
          )
        </mixed-citation>
      </ref>
      <ref id="ref8">
        <mixed-citation>8. Object management group (OMG), http://www.omg.org/</mixed-citation>
      </ref>
      <ref id="ref9">
        <mixed-citation>
          9.
          <string-name>
            <surname>Thierry-Mieg</surname>
            ,
            <given-names>Y.</given-names>
          </string-name>
          :
          <article-title>Symbolic model-checking using ITS-Tools</article-title>
          .
          <source>In: TACAS. Lecture Notes in Computer Science</source>
          , vol.
          <volume>9035</volume>
          , pp.
          <fpage>231</fpage>
          -
          <lpage>237</lpage>
          . Springer (
          <year>2015</year>
          )
        </mixed-citation>
      </ref>
      <ref id="ref10">
        <mixed-citation>
          10.
          <article-title>Unified modeling language (UML) 1.1</article-title>
          . OMG standard (
          <year>1997</year>
          )
        </mixed-citation>
      </ref>
      <ref id="ref11">
        <mixed-citation>
          11.
          <article-title>Unified modeling language infrastructure (UML) 2.4.1</article-title>
          . OMG standard (
          <year>2011</year>
          )
        </mixed-citation>
      </ref>
      <ref id="ref12">
        <mixed-citation>
          12.
          <string-name>
            <surname>Xtext</surname>
          </string-name>
          <article-title>'language engineering made easy'</article-title>
          , http://eclipse.org/Xtext/
        </mixed-citation>
      </ref>
      <ref id="ref13">
        <mixed-citation>
          13.
          <string-name>
            <surname>Zhang</surname>
            ,
            <given-names>Y.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Bérard</surname>
            ,
            <given-names>B.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Hillah</surname>
            ,
            <given-names>L.M.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Kordon</surname>
            ,
            <given-names>F.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Thierry-Mieg</surname>
            ,
            <given-names>Y.</given-names>
          </string-name>
          :
          <article-title>Controllability for Discrete Event Systems Modeled in VeriJ</article-title>
          .
          <source>International Journal of Critical Computer-Based Systems</source>
          <volume>5</volume>
          (
          <issue>3</issue>
          /4),
          <fpage>218</fpage>
          -
          <lpage>240</lpage>
          (
          <year>Sep 2014</year>
          )
        </mixed-citation>
      </ref>
    </ref-list>
  </back>
</article>