<!DOCTYPE article PUBLIC "-//NLM//DTD JATS (Z39.96) Journal Archiving and Interchange DTD v1.0 20120330//EN" "JATS-archivearticle1.dtd">
<article xmlns:xlink="http://www.w3.org/1999/xlink">
  <front>
    <journal-meta />
    <article-meta>
      <title-group>
        <article-title>Generating Effective Test Suites for Model Transformations Using Classifying Terms</article-title>
      </title-group>
      <contrib-group>
        <contrib contrib-type="author">
          <string-name>Loli Burguen˜o</string-name>
          <xref ref-type="aff" rid="aff0">0</xref>
        </contrib>
        <contrib contrib-type="author">
          <string-name>Frank Hilken</string-name>
          <xref ref-type="aff" rid="aff1">1</xref>
        </contrib>
        <contrib contrib-type="author">
          <string-name>Antonio Vallecillo</string-name>
          <xref ref-type="aff" rid="aff0">0</xref>
        </contrib>
        <contrib contrib-type="author">
          <string-name>Martin Gogolla</string-name>
          <email>gogollag@informatik.uni-bremen.de</email>
          <xref ref-type="aff" rid="aff1">1</xref>
        </contrib>
        <aff id="aff0">
          <label>0</label>
          <institution>Universidad de Ma ́laga</institution>
        </aff>
        <aff id="aff1">
          <label>1</label>
          <institution>University of Bremen</institution>
        </aff>
      </contrib-group>
      <abstract>
        <p>Generating sample models for testing a model transformation is no easy task. This paper explores the use of classifying terms and stratified sampling for developing richer test cases for model transformations. Classifying terms are used to define the equivalence classes that characterize the relevant subgroups for the test cases. From each equivalence class of object models, several representative models are chosen depending on the required sample size. We compare our results with test suites developed using random sampling, and conclude that by using an ordered and stratified approach the coverage and effectiveness of the test suite can be significantly improved.</p>
      </abstract>
    </article-meta>
  </front>
  <body>
    <sec id="sec-1">
      <title>1 Introduction</title>
      <p>
        One of the main problems of existing model transformation testing techniques lies in the
difficulty of selecting effective test cases [
        <xref ref-type="bibr" rid="ref1">1</xref>
        ]. This is specially important when dealing
with large models because they normally include many different aspects of the system
under study, which usually deserve individual treatment and particular coverage. This
is why homogeneous sampling techniques for selecting object models that constitute
the test cases tend to fall short.
      </p>
      <p>
        In this paper we explore a new technique for developing test cases for models in
an orderly and comprehensive manner. The approach uses classifying terms [
        <xref ref-type="bibr" rid="ref2">2</xref>
        ] for
partitioning the model space into a set of representative model classes and for selecting
a set of object models from each class in order to implement stratified sampling [
        <xref ref-type="bibr" rid="ref3 ref4">3,4</xref>
        ].
Stratified sampling is a mature probability sampling technique wherein the designer
divides the entire test case population into different subgroups (or strata), each one
focusing on particular characteristics of the test models, and then selects proportionally
the final samples from the different subgroups.
      </p>
      <p>We compare the effectiveness of our proposal with regard to random sampling,
using a case study of a model transformation under test for which we have identified some
kinds of models of particular interest for the tester. We generate a set of test models
using random sampling and analyse their coverage. Then we show how it is possible to
generate specific test models for the reference classes hence significantly improving the
effectiveness and coverage of the samples.</p>
      <p>
        This paper is organized in six sections. After this introduction, Section 2 introduces
the preliminary concepts used in the paper: tracts, classifying terms and stratified
sampling, as well as the running example used to illustrate our proposal. Then, Section 3
describes the technical details of the extension (w.r.t. [
        <xref ref-type="bibr" rid="ref2">2</xref>
        ]) we have developed to
classifying terms that permits generating more than one representative model per equivalence
class and discusses other statistical aspects of the proposal. Section 4 presents the
results of the experiment conducted. Finally, Section 5 relates our work to other similar
approaches and Section 6 concludes and outlines some future work.
2
2.1
      </p>
    </sec>
    <sec id="sec-2">
      <title>Background</title>
      <sec id="sec-2-1">
        <title>Tracts</title>
        <p>
          Tracts were introduced in [
          <xref ref-type="bibr" rid="ref5">5</xref>
          ] as a specification and black-box testing mechanism for
model transformations. They are a particular kind of model transformation contracts [
          <xref ref-type="bibr" rid="ref1 ref6">1,6</xref>
          ]
especially well suited for specifying model transformations in a modular and tractable
manner. Tracts provide modular pieces of specification, each one focusing on a
particular transformation scenario. Thus each model transformation can be specified by means
of a set of Tracts, each one covering a specific use case—which is defined in terms of
particular input and output models and how they should be related by the
transformation. In this way, Tracts permit partitioning the full input space of the transformation
into smaller, more focused behavioral units, and to define specific tests for them. Tracts
also count on tool support for checking, in a black-box manner, that a given
implementation behaves as expected—i.e., it respects the Tracts constraints [
          <xref ref-type="bibr" rid="ref7">7</xref>
          ].
        </p>
        <p>
          The main components of the Tracts approach were described in [
          <xref ref-type="bibr" rid="ref5">5</xref>
          ]: the source and
target metamodels, the transformation T under test, and the transformation contract,
which consists of a Tract test suite and a set of Tract constraints. In total, five different
kinds of constraints are present: the general constraints defined for the source and target
models, and the source, target, and source-target Tract constraints imposed for a given
transformation.
        </p>
        <p>If we assume a source model m being an element of the test suite and satisfying
the source metamodel and the source Tract constraints given, the Tract essentially
requires the result T (m) of applying transformation T to satisfy the target metamodel and
the target Tract constraints, and the tuple hm; T (m)i to satisfy the source-target Tract
constraints.</p>
        <p>To illustrate Tracts, consider a simple model transformation, BiBTex2DocBook,
that converts the information about proceedings of conferences (in BibTeX format)
into the corresponding information encoded in DocBook format3. The source and
target metamodels that we use for the transformation are shown in Fig. 1. Seven constraint
names are also shown in the figure. These constraints are in charge of specifying
statements on the source models (e.g., proceedings should have at least one paper; persons
should have unique names); and on the target models (e.g., a book should have either
an editor or an author, but not both).</p>
        <p>In addition to constraints on the source and target models, tracts impose conditions
on their relationship—as they are expected to be implemented by the transformation’s
execution. In this case, the Tract class serves to define the source-target constraints
for the exemplar tract that we use (although several tracts are normally defined for a
3 http://docbook.org/
transformation, each one focusing on specific aspects or use-cases of the transformation,
for simplicity we will consider only one tract here). The following conditions are part
of the source-target constraints of the tract:
context t:Tract inv sameSizes:
t.file-&gt;size() = t.docBook-&gt;size() and
t.file-&gt;forAll( f | t.docBook-&gt;exists( db |</p>
        <p>f.entry-&gt;selectByType(Proc)-&gt;size() = db.book-&gt;size()))
context prc:Proc inv sameBooks:</p>
        <p>Book.allInstances-&gt;one( bk | prc.title = bk.title and</p>
        <p>prc.editor-&gt;forAll(pE | bk.editor-&gt;one( bE | pE.name = bE.name )))
context pap:InProc inv sameChaptersInBooks:</p>
        <p>Chapter.allInstances-&gt;one( chp |
pap.title = chp.title and pap.booktitle = chp.book.title and
pap.author-&gt;forAll(aP | chp.author-&gt;one(cA | aP.name=cA.name)) )
2.2</p>
      </sec>
      <sec id="sec-2-2">
        <title>Tract Test Suites</title>
        <p>In addition to the source, target and source-target tract constraints, test suites play an
essential role in Tracts. Test suite models are pre-defined input sets of different sorts
aimed to exercise the transformation. Being able to select particular patterns of source
models offers a fine-grained mechanism for specifying the behaviour of the
transformation, and allows the model transformation tester to concentrate on specific behaviours
of the tract. It also enables test repeatability.</p>
        <p>
          The generation of test suites for tracts has been traditionally achieved by random
sampling, i.e., by selecting several object models at random, normally those selected by
using different technologies for exploring all possible valid configurations (object
models) of a metamodel, such as logic programming and constraint solving [
          <xref ref-type="bibr" rid="ref8">8</xref>
          ], relational
logic and Alloy [
          <xref ref-type="bibr" rid="ref9">9</xref>
          ], term rewriting with Maude [
          <xref ref-type="bibr" rid="ref10">10</xref>
          ] or graph grammars [
          <xref ref-type="bibr" rid="ref11">11</xref>
          ].
        </p>
        <p>
          We also proposed the ASSL language (A Snapshot Sequence Language) [
          <xref ref-type="bibr" rid="ref12">12</xref>
          ], an
imperative language developed to generate object diagrams for a given class diagram.
ASSL provides features for randomly choosing attribute values or association ends.
Although quite powerful, imperative approaches such as this one are cumbersome to
use and also present some limitations in practice [
          <xref ref-type="bibr" rid="ref13">13</xref>
          ].
2.3
        </p>
      </sec>
      <sec id="sec-2-3">
        <title>Determining the sample size</title>
        <p>
          Several statistical works [
          <xref ref-type="bibr" rid="ref14 ref3 ref4">3,4,14</xref>
          ] show how the total sample size is calculated depending
on several parameters, which include the size of the entire population (N ), the required
confidence level (1 ) and the precision (d) of the resulting estimates. For example,
one may wish to have the 95% confidence interval be less than 0:06 units wide (i.e., a
required precision of 0:03).
        </p>
        <p>
          Confidence levels are given by the their corresponding critical values (also called
Z -values), which are defined in, e.g., [
          <xref ref-type="bibr" rid="ref14">14</xref>
          ]. For example, the Z -value for a confidence
level of 95% is 1:96 and for a confidence level of 99% is 2:58.
        </p>
        <p>
          Regarding the size N of the entire population, in our case the population consists of
all possible valid models, which is usually a very large and unknown number and then
normally considered infinite for statistical purposes [
          <xref ref-type="bibr" rid="ref3">3</xref>
          ].
        </p>
        <p>Finally, in this context we are concerned with the estimation of proportions, since
we can formulate the problem as the estimation of the ratio of models that fail the test,
e.g., that are incorrectly transformed by the model transformation. The estimator of that
ratio is p = X=n, where n is the sample size and X is the number of successes, i.e.,
“positive” observations (e.g. the number of models for which the transformation fails).
If the ratio of positive observations is unknown, the recommended practice is to assume
it to be p = 0:5.</p>
        <p>With all this, the formula that we have to use to determine the sample size n is
n = (Z2 p (1 p))=d2. The result of the formula is always rounded to the next
integer value. Table 1 shows some examples of sample sizes according to some of these
parameters.
2.4</p>
      </sec>
      <sec id="sec-2-4">
        <title>Classifying terms</title>
        <p>
          Classifying terms [
          <xref ref-type="bibr" rid="ref2">2</xref>
          ] constitute a technique for developing test cases for UML and OCL
models, based on an approach that automatically constructs object models for class
        </p>
        <p>Confidence Level 95% 99% 95% 99% 95% 99% 95% 99%
Failure rate (unkown=50%) 5% 5% 5% 5% 50% 50% 50% 50%</p>
        <p>Precision (uncertainty) 5% 5% 3% 3% 5% 5% 3% 3%</p>
        <p>Resulting sample size 73 126 203 351 384 666 1,067 1,849
models enriched by OCL constraints. By guiding the construction process through
socalled classifying terms, the built test cases in form of object models which are classified
into equivalence classes.</p>
        <p>Classifying terms are arbitrary OCL expressions on a class model that calculate
a characteristic value for each object model. The expressions can either be boolean,
allowing to define up to two equivalence classes; or numerical, where each resulting
number defines one equivalence class. Each equivalence class is then defined by the set
of object models with identical characteristic values and by one canonical representative
object model.</p>
        <p>The process to build the test suite is straightforward. We begin by identifying the
sorts of models that we would like to be part of the test suite. Each sort is specified by
a classifying term, that represents the equivalence class with all models that are
equivalent according to that class, i.e., which belong to the same sort. Once the classifying
terms are defined for a tract, the USE tool generates one representative model for each
equivalence class. These canonical models constitute the test suite of the tract.</p>
        <p>For example, suppose that we want to concentrate on different characteristics of
the input models of the BibTex2DocBook transformation. First, proceedings have two
dates: the year in which the conference event was held (yearE) and the year in which
the proceedings were published (yearP). We want to have input models in which these
two dates coincide in at least one proceeding, and other input models for which the
conference event and publication years are always different. Second, we want to have
some sample input model in which one person is editor of at least one proceeding and
also author of at least one inproceeding, and also models in which the persons are either
author or editors, but not both. Finally, we want to have some source models with at
least one inproceeding whose title coincides with its booktitle, and other input models
where the titles and booktitles of inproceedings are always different.</p>
        <p>As mentioned above, producing test suite models to cover all these circumstances by
an imperative approach or by ASSL is normally tedious and error prone. However, the
use of classifying terms greatly simplifies this task. It is enough to give three Boolean
terms to the model validator, each one defining the classifying term that specifies the
characteristic we want to identify in the model. In this case, these Boolean terms are the
ones shown below.
[ yearE_EQ_yearP ]</p>
        <p>Proc.allInstances-&gt;exists(yearE=yearP)
[ twoRolePerson ]</p>
        <p>Person.allInstances-&gt;exists (proc-&gt;size&gt;0 and inProc-&gt;size&gt;0)
[ title_EQ_booktitle ]</p>
        <p>BibTeXEntry.allInstances-&gt;exists(be |</p>
        <p>InProc.allInstances-&gt;exists(ip | be.title=ip.booktitle))</p>
        <p>
          Given that an object model either belongs or not to any of the equivalence classes,
the three classifying terms define eight equivalence classes (8 = 23) and the the model
validator selects one representative for each one of them by scrolling through all valid
object models. For this, as described in [
          <xref ref-type="bibr" rid="ref2">2</xref>
          ], each classifying term is assigned an integer
value, and the values of the classifying terms are stored for each solution. Using the
classifying terms and these values, constraints are created and given to a Kodkod solver
along with the class model during the validation process. Both the USE tool and the
model validator plugin are available for download from http://sourceforge.
net/projects/useocl/.
3
3.1
        </p>
      </sec>
    </sec>
    <sec id="sec-3">
      <title>Extending Classifying Terms</title>
      <sec id="sec-3-1">
        <title>Selecting more than One Sample per Classifying Term</title>
        <p>Classifying terms permit checking that the behaviour of the transformation is as
expected for the selected sample models. However, this does not prove that the
transformation will always work. For instance, the transformation might behave differently if
the model validator selects other representative models.</p>
        <p>This is why it would be interesting to ask the model validator to produce more than
one model for each equivalence class. There is another good reason for that: we know
that not all sorts of input models have the same likelihood of happening in the source
model space. Thus, we can select more sample models for those equivalence classes
that we think are more frequent. In this way we can exercise the model transformation
in a more focused manner, and produce a richer test suite for the tract (and hence for
the transformation).</p>
        <p>We have extended the model validator to permit the creation of a given number of
representative object models per equivalence class. Then, instead of stopping after one
representative object model is found for a class, the model validator continues searching
until that number is reached or the exploration finishes. The question now is to
determine how many object models of each class should be generated, and this is where the
stratified sampling statistical technique comes into play.
3.2</p>
      </sec>
      <sec id="sec-3-2">
        <title>Stratified sampling</title>
        <p>Sampling is a mature statistical technique aimed at selecting a subgroup of a population
(i.e., a sample) to estimate some characteristics of the whole population. In our context,
the population is the set of all possible object models that conform to a metamodel, and
our goal is to select a representative sample from within them that can be used for testing
an operation on the model. For example, to serve as input for a model transformation.</p>
        <p>
          Sampling theories and methods are nowadays well known. They have become
essential tools used by politicians and marketing managers in their polls and surveys to
estimate the intentions of a target population. We all know that they are able to obtain
very precise and accurate results with rather small samples, and in record time [
          <xref ref-type="bibr" rid="ref14 ref3 ref4">3,4,14</xref>
          ].
In computer graphics they are very useful for, e.g., rendering 3D models [
          <xref ref-type="bibr" rid="ref15">15</xref>
          ]), and
in software engineering they have been applied for the estimation of software
reliability [
          <xref ref-type="bibr" rid="ref16 ref17">16,17</xref>
          ] and also for fault injections [
          <xref ref-type="bibr" rid="ref18">18</xref>
          ].
        </p>
        <p>Stratified sampling permits considering the population organized into different
subgroups (strata), each one with particular characteristics and relevance for the study. Each
stratum is then sampled as an independent population, out of which individual elements
can be randomly selected.</p>
        <p>
          There are several potential benefits to stratified sampling. First, dividing the
population into distinct, independent strata enable researchers to draw inferences about specific
subgroups that may be lost in a more generalized random sample. Second, utilizing a
stratified sampling method can lead to more efficient statistical estimates, provided that
strata are selected based upon relevance to the criterion in question. Even if a stratified
sampling approach does not lead to increased statistical efficiency, such a tactic will
not result in less efficiency than would simple random sampling, provided that each
stratum is proportional to the group’s size in the population. Finally, since each stratum
is treated as an independent population, different sampling approaches can be applied
to different strata, potentially enabling researchers to use the approach best suited (or
most cost-effective) for each identified subgroup within the population [
          <xref ref-type="bibr" rid="ref19">19</xref>
          ].
        </p>
        <p>
          A stratified sampling approach is most effective when three conditions are met:
variability within strata is minimized; variability between strata is maximized, and the
variables upon which the population is stratified are strongly correlated with the desired
dependent variable [
          <xref ref-type="bibr" rid="ref14">14</xref>
          ]. However, stratified sampling also presents some limitations,
being the difficulty of the specification of the different strata and the characterization of
their members the most significant ones. But this is precisely where classifying terms
are strong, since they provide a declarative approach for specifying the equivalence
classes that are of interest to the model transformation tester, and that constitute a
partition of the source model space.
3.3
        </p>
      </sec>
      <sec id="sec-3-3">
        <title>Determining the sample size for each stratum</title>
        <p>Once we know the complete sample size (Section 2.3), we need to decide the number
of elements of each stratum (equivalence class). For this we propose the use of
proportional allocation, whereby the sample size of each stratum respects the proportion
of elements that each stratum represents from the entire population. Hence, the more
elements belong to a group, the larger the sample size for the stratum representing that
group.</p>
        <p>
          In our case, we need to know (or estimate) the proportion of each stratum. One
usual method is to use some a priori knowledge about the population to estimate these
proportions [
          <xref ref-type="bibr" rid="ref4">4</xref>
          ]. In our example, where we had 8 equivalence classes corresponding
to the 3 classifying terms specified for the BibTeX metamodel, we have estimated
that the chances of a model to fulfil each of the classifying terms (yearE EQ yearP,
twoRolePerson and title EQ booktitle) are, respectively, 90%, 70% and 30%.
        </p>
        <p>Table 2 lists these classes and the proportions resulting according to the estimations
we have made. It also shows the number of elements (object models) of each stratum
depending on the total sample size (as previously described in Table 1). For example,
if the total sample size is 203 the corresponding sample sizes for each stratum are,
respectively, 39, 90, 17, 39, 5, 10, 2 and 5 (they add 207 because all numbers are always
rounded up).
4</p>
      </sec>
    </sec>
    <sec id="sec-4">
      <title>Experimental Results</title>
      <p>We checked the effectiveness of our approach by first generating some test suites using
random sampling, and then by comparing the samples with the ones obtained using our
approach. We analyzed the coverage of the random samples against the equivalence
classes defined by the model tester, calculating the percentage of the generated object
models that belonged to each class (see Table 2). Random sampling was performed by
asking the model validator to generate these numbers of object models by exploring all
possible valid configurations (object models) of the source metamodel and returning
those that satisfy the constraints.</p>
      <p>Table 3 shows the results of the experiment. The fifth column shows the expected
percentage of object models that should fall into each equivalence class, while the last
eight columns show, for each of the selected sample sizes, the actual percentage of
object models from those generated by the model validator. For readability reasons, the
numbers have been rounded to the closest integer.
We observe that using random sampling the coverage of the input domain is quite
limited. The models generated belong only to some equivalence classes and leave the
rest of them with no representation. For our first sample size, only classes 1, 2 and
5 have representatives. We need a sample size of 207 to have object models in 5 of
the 8 classes, and a sample size of 1; 071 to have them in 6 of the 8 classes. Even for
our larger sample, in which 1; 852 object models are generated, the equivalence classes
3 and 7 have no representation. Note that these classes are not empty because they
are inconsistent—representatives were generated for them using classifying terms and
stratified sampling.</p>
      <p>Furthermore, the distribution of the representatives among the equivalence classes
does not correspond to the expected. For instance, for our larger sample size, class 6
is not very relevant thus, only 5% of the object models are expected to represent it.
Nevertheless, using random sampling, 42% of the object models belong to it.
5</p>
    </sec>
    <sec id="sec-5">
      <title>Related Work</title>
      <p>
        Several approaches exist to generate object models from class models using different
languages and tools. The USE model validator, used in this work, is based on the
transformation of UML and OCL into relational logic [
        <xref ref-type="bibr" rid="ref20">20</xref>
        ]. Another approach within the
same tool, USE, is the A Snapshot Sequence Language (ASSL) [
        <xref ref-type="bibr" rid="ref12">12</xref>
        ] that we have
discussed above. Its imperative nature requires more effort by the developer and makes
the specification of the test object models a more complex and cumbersome task than
the declarative approach described here. We have also mentioned other approaches to
generate object models relying on different technologies like logic programming and
constraint solving [
        <xref ref-type="bibr" rid="ref8">8</xref>
        ], relational logic and Alloy [
        <xref ref-type="bibr" rid="ref9">9</xref>
        ], term rewriting with Maude [
        <xref ref-type="bibr" rid="ref10">10</xref>
        ] or
graph grammars [
        <xref ref-type="bibr" rid="ref11">11</xref>
        ]. However, they do not support full OCL and only provide random
sampling generation.
      </p>
      <p>
        Finally, there is a vast amount of literature about sampling techniques. Among them,
stratified sampling provides interesting benefits when the population is not
homogeneous, being more effective than random sampling [
        <xref ref-type="bibr" rid="ref19">19</xref>
        ]. Stratified sampling is
commonly used nowadays in quality assurance [
        <xref ref-type="bibr" rid="ref21">21</xref>
        ], surveys and polls [
        <xref ref-type="bibr" rid="ref14">14</xref>
        ]. In the
Informatics domain, it has proved to be very effective in computer graphics for representing
3D models [
        <xref ref-type="bibr" rid="ref15">15</xref>
        ], wherein the sampling strategy is critical for point rendering systems
which rely exclusively on sampled geometry to represent models [
        <xref ref-type="bibr" rid="ref22">22</xref>
        ]. In software
engineering, it has been mainly applied for the estimation of software reliability [
        <xref ref-type="bibr" rid="ref16 ref17">16,17</xref>
        ] and
also for fault injections [
        <xref ref-type="bibr" rid="ref18">18</xref>
        ]. However, we are not aware of any other work in the field
of model-based engineering that uses stratified sampling to generate test object models,
as we propose here.
6
      </p>
    </sec>
    <sec id="sec-6">
      <title>Conclusions</title>
      <p>This paper proposes a new technique for developing test cases for model
transformation testing. It uses stratified sampling, a statistical technique for selecting a small
subgroup of a population that can be representative enough to estimate characteristics of
the population, or to predict its behaviour. We have illustrated with one example how
this technique can be used, and how it can be more effective than random sampling.</p>
      <p>This initial work can be continued in various directions. In particular, we would like
to conduct more exhaustive tests with different kinds of model transformations and with
other classifying terms, in order to get a better estimation of the effectiveness, strengths
and limitations of our proposal. Larger case studies should also give more feedback on
the features and scalability of the approach. Finally, we are working on the integration
of this work into an automated model transformation testing environment that would
fully support tracts.</p>
    </sec>
  </body>
  <back>
    <ref-list>
      <ref id="ref1">
        <mixed-citation>
          1.
          <string-name>
            <surname>Baudry</surname>
            ,
            <given-names>B.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Dinh-Trong</surname>
            ,
            <given-names>T.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Mottu</surname>
            ,
            <given-names>J.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Simmonds</surname>
            ,
            <given-names>D.</given-names>
          </string-name>
          , France,
          <string-name>
            <given-names>R.</given-names>
            ,
            <surname>Ghosh</surname>
          </string-name>
          ,
          <string-name>
            <given-names>S.</given-names>
            ,
            <surname>Fleurey</surname>
          </string-name>
          ,
          <string-name>
            <given-names>F.</given-names>
            ,
            <surname>Le Traon</surname>
          </string-name>
          ,
          <string-name>
            <surname>Y.</surname>
          </string-name>
          :
          <article-title>Model transformation testing challenges</article-title>
          .
          <source>In: ECMDA WS. on Integration of MDD and Model Driven Testing</source>
          . (
          <year>2006</year>
          )
        </mixed-citation>
      </ref>
      <ref id="ref2">
        <mixed-citation>
          2.
          <string-name>
            <surname>Gogolla</surname>
            ,
            <given-names>M.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Vallecillo</surname>
            ,
            <given-names>A.</given-names>
          </string-name>
          , Burguen˜o,
          <string-name>
            <given-names>L.</given-names>
            ,
            <surname>Hilken</surname>
          </string-name>
          ,
          <string-name>
            <surname>F.</surname>
          </string-name>
          :
          <article-title>Employing classifying terms for testing model transformations</article-title>
          .
          <source>In: Proc. of MODELS'15</source>
          ,
          <string-name>
            <surname>IEEE</surname>
          </string-name>
          (
          <year>2015</year>
          )
          <fpage>312</fpage>
          -
          <lpage>321</lpage>
        </mixed-citation>
      </ref>
      <ref id="ref3">
        <mixed-citation>
          3. Sa¨rndal,
          <string-name>
            <given-names>C.E.</given-names>
            ,
            <surname>Swensson</surname>
          </string-name>
          ,
          <string-name>
            <given-names>B.</given-names>
            ,
            <surname>Wretman</surname>
          </string-name>
          , J.:
          <source>Model Assisted Survey Sampling</source>
          . Springer (
          <year>2003</year>
          )
        </mixed-citation>
      </ref>
      <ref id="ref4">
        <mixed-citation>
          4.
          <string-name>
            <surname>Thompson</surname>
            ,
            <given-names>S.K.</given-names>
          </string-name>
          :
          <string-name>
            <surname>Sampling</surname>
          </string-name>
          . John Wiley &amp; Sons (
          <year>2012</year>
          )
        </mixed-citation>
      </ref>
      <ref id="ref5">
        <mixed-citation>
          5.
          <string-name>
            <surname>Gogolla</surname>
            ,
            <given-names>M.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Vallecillo</surname>
            ,
            <given-names>A.</given-names>
          </string-name>
          :
          <article-title>Tractable model transformation testing</article-title>
          .
          <source>In: Proc. of ECMFA'11</source>
          . Volume 6698 of LNCS., Springer (
          <year>2011</year>
          )
          <fpage>221</fpage>
          -
          <lpage>236</lpage>
        </mixed-citation>
      </ref>
      <ref id="ref6">
        <mixed-citation>
          6.
          <string-name>
            <surname>Cariou</surname>
            ,
            <given-names>E.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Marvie</surname>
            ,
            <given-names>R.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Seinturier</surname>
            ,
            <given-names>L.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Duchien</surname>
            ,
            <given-names>L.</given-names>
          </string-name>
          :
          <article-title>OCL for the specification of model transformation contracts</article-title>
          .
          <source>In: Proc. of the OCL and Model Driven Engineering Workshop</source>
          . (
          <year>2004</year>
          )
        </mixed-citation>
      </ref>
      <ref id="ref7">
        <mixed-citation>
          7. Burguen˜o,
          <string-name>
            <given-names>L.</given-names>
            ,
            <surname>Wimmer</surname>
          </string-name>
          ,
          <string-name>
            <given-names>M.</given-names>
            ,
            <surname>Troya</surname>
          </string-name>
          ,
          <string-name>
            <given-names>J.</given-names>
            ,
            <surname>Vallecillo</surname>
          </string-name>
          ,
          <string-name>
            <surname>A.</surname>
          </string-name>
          :
          <article-title>Static Fault Localization in Model Transformations</article-title>
          .
          <source>IEEE Transactions on Software Engineering</source>
          <volume>41</volume>
          (
          <issue>5</issue>
          ) (
          <year>2015</year>
          )
          <fpage>490</fpage>
          -
          <lpage>506</lpage>
        </mixed-citation>
      </ref>
      <ref id="ref8">
        <mixed-citation>
          8.
          <string-name>
            <surname>Cabot</surname>
            ,
            <given-names>J.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Clariso</surname>
            <given-names>´</given-names>
          </string-name>
          ,
          <string-name>
            <given-names>R.</given-names>
            ,
            <surname>Riera</surname>
          </string-name>
          ,
          <string-name>
            <surname>D.:</surname>
          </string-name>
          <article-title>UMLtoCSP: A Tool for the Formal Verification of UML/OCL Models using Constraint Programming</article-title>
          .
          <source>In: Proc. of ASE'07</source>
          ,
          <string-name>
            <surname>ACM</surname>
          </string-name>
          (
          <year>2007</year>
          )
          <fpage>547</fpage>
          -
          <lpage>548</lpage>
        </mixed-citation>
      </ref>
      <ref id="ref9">
        <mixed-citation>
          9.
          <string-name>
            <surname>Anastasakis</surname>
            ,
            <given-names>K.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Bordbar</surname>
            ,
            <given-names>B.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Georg</surname>
            ,
            <given-names>G.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Ray</surname>
            ,
            <given-names>I.</given-names>
          </string-name>
          :
          <article-title>On Challenges of Model Transformation from UML to Alloy</article-title>
          .
          <source>Software and System Modeling</source>
          <volume>9</volume>
          (
          <issue>1</issue>
          ) (
          <year>2010</year>
          )
          <fpage>69</fpage>
          -
          <lpage>86</lpage>
        </mixed-citation>
      </ref>
      <ref id="ref10">
        <mixed-citation>
          10. Rolda´n,
          <string-name>
            <surname>M.</surname>
          </string-name>
          , Dura´n, F.:
          <article-title>Dynamic Validation of OCL Constraints with mOdCL</article-title>
          .
          <source>ECEASST</source>
          <volume>44</volume>
          (
          <year>2011</year>
          )
        </mixed-citation>
      </ref>
      <ref id="ref11">
        <mixed-citation>
          11.
          <string-name>
            <surname>Ehrig</surname>
            ,
            <given-names>K.</given-names>
          </string-name>
          , K u¨ster,
          <string-name>
            <given-names>J.M.</given-names>
            ,
            <surname>Taentzer</surname>
          </string-name>
          , G.:
          <article-title>Generating instance models from meta models</article-title>
          .
          <source>SoSyM</source>
          <volume>8</volume>
          (
          <year>2009</year>
          )
          <fpage>479</fpage>
          -
          <lpage>500</lpage>
        </mixed-citation>
      </ref>
      <ref id="ref12">
        <mixed-citation>
          12.
          <string-name>
            <surname>Gogolla</surname>
            ,
            <given-names>M.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Bohling</surname>
            ,
            <given-names>J.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Richters</surname>
            ,
            <given-names>M.</given-names>
          </string-name>
          :
          <article-title>Validating UML and OCL Models in USE by Automatic Snapshot Generation</article-title>
          .
          <source>Software and Systems Modeling</source>
          <volume>4</volume>
          (
          <issue>4</issue>
          ) (
          <year>2005</year>
          )
          <fpage>386</fpage>
          -
          <lpage>398</lpage>
        </mixed-citation>
      </ref>
      <ref id="ref13">
        <mixed-citation>
          13.
          <string-name>
            <surname>Offutt</surname>
            ,
            <given-names>J.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Irvine</surname>
            ,
            <given-names>A.</given-names>
          </string-name>
          :
          <article-title>Testing object-oriented software using the category-partition method</article-title>
          .
          <source>In: Proc. of TOOLS USA'95</source>
          . (
          <year>1995</year>
          )
          <fpage>293</fpage>
          -
          <lpage>304</lpage>
        </mixed-citation>
      </ref>
      <ref id="ref14">
        <mixed-citation>
          14.
          <string-name>
            <surname>Groves</surname>
            ,
            <given-names>R.M.</given-names>
          </string-name>
          ,
          <string-name>
            <given-names>Fowler</given-names>
            <surname>Jr</surname>
          </string-name>
          .,
          <string-name>
            <given-names>F.J.</given-names>
            ,
            <surname>Couper</surname>
          </string-name>
          ,
          <string-name>
            <given-names>M.P.</given-names>
            ,
            <surname>Lepkowski</surname>
          </string-name>
          ,
          <string-name>
            <given-names>J.M.</given-names>
            ,
            <surname>Singer</surname>
          </string-name>
          ,
          <string-name>
            <given-names>E.</given-names>
            ,
            <surname>Tourangeau</surname>
          </string-name>
          , R.:
          <source>Survey Methodology</source>
          .
          <volume>2</volume>
          <fpage>edn</fpage>
          . Wiley (
          <year>2009</year>
          )
        </mixed-citation>
      </ref>
      <ref id="ref15">
        <mixed-citation>
          15.
          <string-name>
            <surname>Nehab</surname>
            ,
            <given-names>D.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Shilane</surname>
            ,
            <given-names>P.</given-names>
          </string-name>
          :
          <article-title>Stratified point sampling of 3D models</article-title>
          .
          <source>In: Proc. of SPBG'04</source>
          ,
          <string-name>
            <given-names>Eurographics</given-names>
            <surname>Association</surname>
          </string-name>
          (
          <year>2004</year>
          )
          <fpage>49</fpage>
          -
          <lpage>56</lpage>
        </mixed-citation>
      </ref>
      <ref id="ref16">
        <mixed-citation>
          16.
          <string-name>
            <surname>Li</surname>
            ,
            <given-names>Q.Y.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Luo</surname>
            ,
            <given-names>L.</given-names>
          </string-name>
          :
          <article-title>Minimum test case for discrete-type software reliability testing by stratified sampling</article-title>
          .
          <source>Applied Mechanics and Materials</source>
          <year>1874</year>
          (
          <year>2012</year>
          )
          <fpage>263</fpage>
          -
          <lpage>266</lpage>
        </mixed-citation>
      </ref>
      <ref id="ref17">
        <mixed-citation>
          17.
          <string-name>
            <surname>Podgurski</surname>
            ,
            <given-names>A.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Masri</surname>
            ,
            <given-names>W.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>McCleese</surname>
            ,
            <given-names>Y.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Wolff</surname>
            ,
            <given-names>F.G.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Yang</surname>
            ,
            <given-names>C.</given-names>
          </string-name>
          :
          <article-title>Estimation of software reliability by stratified sampling</article-title>
          .
          <source>ACM Trans. Softw. Eng. Methodol</source>
          .
          <volume>8</volume>
          (
          <issue>3</issue>
          ) (
          <year>1999</year>
          )
          <fpage>263</fpage>
          -
          <lpage>283</lpage>
        </mixed-citation>
      </ref>
      <ref id="ref18">
        <mixed-citation>
          18.
          <string-name>
            <surname>de Oliveira</surname>
            <given-names>Moraes</given-names>
          </string-name>
          ,
          <string-name>
            <given-names>R.L.</given-names>
            ,
            <surname>Martins</surname>
          </string-name>
          ,
          <string-name>
            <given-names>E.</given-names>
            ,
            <surname>Poletti</surname>
          </string-name>
          ,
          <string-name>
            <given-names>E.C.C.</given-names>
            ,
            <surname>Mendes</surname>
          </string-name>
          ,
          <string-name>
            <surname>N.V.</surname>
          </string-name>
          :
          <article-title>Using stratified sampling for fault injection</article-title>
          .
          <source>In: Proc. of LADC'05</source>
          . Volume 3747 of LNCS., Springer (
          <year>2005</year>
          )
          <fpage>9</fpage>
          -
          <lpage>19</lpage>
        </mixed-citation>
      </ref>
      <ref id="ref19">
        <mixed-citation>
          19.
          <string-name>
            <surname>Nair</surname>
            ,
            <given-names>V.N.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>James</surname>
            ,
            <given-names>D.A.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Ehrlich</surname>
            ,
            <given-names>W.K.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Zevallos</surname>
            ,
            <given-names>J.:</given-names>
          </string-name>
          <article-title>A statistical assessment of some software testing strategies and application of experimental design techniques</article-title>
          .
          <source>Statistica Sinica</source>
          <volume>8</volume>
          (
          <year>1998</year>
          )
          <fpage>165</fpage>
          -
          <lpage>184</lpage>
        </mixed-citation>
      </ref>
      <ref id="ref20">
        <mixed-citation>
          20.
          <string-name>
            <surname>Kuhlmann</surname>
            ,
            <given-names>M.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Gogolla</surname>
            ,
            <given-names>M.</given-names>
          </string-name>
          :
          <string-name>
            <surname>From</surname>
            <given-names>UML</given-names>
          </string-name>
          and
          <article-title>OCL to relational logic and back</article-title>
          .
          <source>In: Proc. of MODELS'12</source>
          . Volume 7590 of LNCS., Springer (
          <year>2012</year>
          )
          <fpage>415</fpage>
          -
          <lpage>431</lpage>
        </mixed-citation>
      </ref>
      <ref id="ref21">
        <mixed-citation>
          21.
          <string-name>
            <surname>Galin</surname>
            ,
            <given-names>D.</given-names>
          </string-name>
          :
          <article-title>Software Quality Assurance: From Theory to Implementation</article-title>
          . Pearson
          <string-name>
            <surname>Education</surname>
          </string-name>
          (
          <year>2004</year>
          )
        </mixed-citation>
      </ref>
      <ref id="ref22">
        <mixed-citation>
          22.
          <string-name>
            <surname>Grossman</surname>
            ,
            <given-names>J.P.</given-names>
          </string-name>
          ,
          <string-name>
            <surname>Dally</surname>
          </string-name>
          , W.J.:
          <article-title>Point sample rendering</article-title>
          .
          <source>In: Proc. of Rendering Techniques'98</source>
          ,
          <string-name>
            <surname>Springer</surname>
          </string-name>
          (
          <year>1998</year>
          )
          <fpage>181</fpage>
          -
          <lpage>192</lpage>
        </mixed-citation>
      </ref>
    </ref-list>
  </back>
</article>