=Paper=
{{Paper
|id=Vol-2245/mdebug_paper_4
|storemode=property
|title=Towards an Automated Fault Localizer while Designing Meta-models
|pdfUrl=https://ceur-ws.org/Vol-2245/mdebug_paper_4.pdf
|volume=Vol-2245
|authors=Adel Ferdjoukh,Jean-Marie Mottu
|dblpUrl=https://dblp.org/rec/conf/models/FerdjoukhM18
}}
==Towards an Automated Fault Localizer while Designing Meta-models==
https://ceur-ws.org/Vol-2245/mdebug_paper_4.pdf
Towards an Automated Fault Localizer while Designing Meta-models
Adel Ferdjoukh Jean-Marie Mottu
TU Wien University of Nantes, LS2N (UMR CNRS 6004)
Vienna, Austria Nantes, France
adel.ferdjoukh@univ-nantes.fr jean-marie.mottu@univ-nantes.fr
ABSTRACT in order to build conformed models. The inputs of a generator are: a
Meta-models are the centrepiece of Model Driven Engineering, re- meta-model, a set of OCL constraints and instantiation parameters.
quired in many activities: modelling, creating DSLs (Domain Spe- With these, the user configures the generator in order to choose the
cific Languages), xDSLs (executable DSLs), or writing model trans- characteristics of instantiated model(s) (e.g., setting the number of
formations. Designing large meta-models could be a complicated instances generated for each class). Then, the tool transforms those
and error-prone task. Meta-models should then be validated consid- inputs to send them to a solver which returns model(s) in case of
ering their instantiability in particular. Automatic model generators success or error messages if it fails to generate a valid solution. How-
are used and if they are unable to generate models it means the meta- ever, even if it can alert on the non instantiability of meta-models, it
model with its instantiation parameters (e.g. size of the models) is provides too few help to debug them.
wrong. Several generators exist, but most of them have binary output: The goal of the approach that is described in this paper, is to
success or failure, without helping the meta-model debugging. In help the meta-model designers to detect and fix invalid meta-models
this paper, we introduce an approach, in which we statically analyse before facing the annoying but frequent case of generation failure.
a meta-model with its instantiation parameters. In this first work, We develop an automated fault localizer to help them in debugging
we detect inconsistencies considering each reference or each inheri- a non instantiable meta-model. Our approach uses Systems of Linear
tance separately. Therefore we provide feedback to the meta-model Inequalities (SLI) and focuses on the class’ relations in the meta-
designer to help her to debug the meta-model. model and the instantiation parameters. The structure of an Ecore
meta-model is translated into SLI and our custom solver checks
KEYWORDS the consistency of a model generation process. In this paper, we
show the first version of the translation of a meta-model into a linear
Meta-modelling, Model Generation, Fault Localization
system, and we describe how we use this in order to provide fixing
suggestions for meta-model designers. The contributions are already
1 INTRODUCTION
implemented in a tool named TIWIZI which is independent from any
Model Driven Engineering (MDE) is very helpful in managing the model generation tool.
complexity or heterogeneity of software systems. A model-driven The rest of the paper is organised as follows: Section 2 gives
process often begins by the definition of a new meta-model, required, the context and the motivation of the work. Section 3 describes
for instance, to define Domain Specific Language (DSL). The meta- the fault localization mechanism and presents TIWIZI, a tool that
model plays a key role in all the operations that will be performed implements our contribution. Section 4 discusses existing work.
over the software system. For example, meta-models are used to Finally, Section 5 draws conclusions and opens perspectives.
write model transformations (MT) [25] which transform models into
other models (M2M), or into source code or text (M2T)1 .
To ensure the correctness of any MDE process, only valid meta- 2 CONTEXT & MOTIVATION
models must be considered. However designing meta-models is In this section, we describe the context and the motivations of the
tedious while dealing with complex systems. It could result in meta- paper when tackling non instantiability of meta-models.
models invalid for different reasons: semantically wrong w.r.t. its
specification, syntactically wrong (e.g. missing values), or part of 2.1 Meta-Modelling
it could be non instantiable, which is the case considered in this
The meta-models we consider are written using the EMF/Ecore
work. Checking the validity of meta-models becomes, de facto, a
language.
very important issue. To validate their meta-models, domain experts
Each class can have one or more attributes. The possible types for
try to instantiate them by creating real life models. However, that
attributes are all the usual primitive types (integer, char, string, etc)
manual checking cannot be applied at a large scale and is therefore
and enumerations.
not sufficient. For this task, an existing solution is based on model
In our approach, we consider the relations between classes and
generators which are already highly used in the next steps of a
their three variations in an Ecore diagram: reference, bidirectional
MDE development (e.g., generating test models to validate model
reference (a reference and its opposite), composition (a bidirectional
transformations [21]).
reference in which one class contains the other one). Each relation
Several model generation tools exist [14]: e.g., GRIMM [9], PRA -
has two cardinalities (lower and upper bound) that bound the num-
MANA [24], EMFto CSP [4], USE [13]. They instantiate a meta-model
ber of objects that could be linked to a given object. Bidirectional
1
M2M: Model to Model transformation; M2T: Model to Text transformation references have cardinalities in both sides. As a good practice rule, a
MDEbug’18, October 2018, Copenhagen, Denmark
unique root class is the top container and it is instantiated only once
2018. as a root of a tree of containment relations between all the objects
in a model. We also consider classes inheriting from other classes. 2.3 Meta-model validation
This is defined by a super type relation. Meta-model could be invalid for different reasons: semantically
A meta-model can also have constraints, typically written in OCL, wrong w.r.t. its specification, syntactically wrong (e.g. missing val-
to precise its semantics. However considering the constraints is out ues), or part of it could be non instantiable, which is the case consid-
of the scope of this first work. ered in this work.
The domain expert is supposed to design valid meta-model. Her
2.2 Meta-model instantiation expertise helping to focus on its semantic. She could additionally be
Depending on how the models will be used during the development a meta-modelling expert and manage to follow good meta-modelling
of a MDE tool chain (DSLs, transformations), they are created as practices2 . However, a dedicated step of validation is required, such
instances of a meta-model. Instantiability of a meta-model should as for any development. In that case, current technique using model
be considered to prevent issues on the models in a MDE process: generators could be not a skill of the domain expert.
For instance, a real life model provided by a user or another part
2.3.1 Model Generators. Usually, the first automatic non valida-
of the chain could fail to conform the meta-model, preventing it
to be transformed for instance. Moreover, representative models tion of a meta-model is done by a model generator when it fails to
should be generated to validate DSLs or model transformations instantiate it.
implementation. A model generator then requires instantiable meta- Generators are based on a translation into a search-based or com-
models to compute valid instances as test models. binatorial technique to find models. The most famous techniques that
are used are: SAT [1], CSP (Constraint Satisfaction Problem) [22],
2.2.1 Instantiation parameters. It gathers the information that Alloy [16] and SMT (SAT Modulo Theory) [7]. Such techniques
is required to instantiate a meta-model, e.g. by a model generation always provide existing and easy-to-use solvers to find solutions.
tool. For example in the model generator GRIMM, it concerns the Those solvers return a binary output: success if a model is found or
following information: failure if there is no solution. However, they give too few information
• Number of exact instances for each class of the meta-model. about the origin of failure.
• Bounds for unbounded references. A user study from the authors [10], shows that the users of model
• Values for enumerations. generation tools, as GRIMM [9], PRAMANA [24] or EMFtoCSP [4],
• Domains for attributes (optional but suitable for more preci- have many difficulties when they meet a failure, because most of
sion). them are familiar with either Ecore or one the combinatorial tech-
• Probability distributions for links between classes. niques that tools use: CSP, SAT or SMT. An Ecore expert can manu-
ally check the meta-model and its elements, mainly references. Then,
Depending on the scope considered when validating the meta- she tries to debug the generation algorithm. Beside that, a CSP or
model instantiability, some instantiation parameters are used as can- SAT expert can look up into the intermediary files (eg. xcsp files),
didate values: that are generated by the tool and try to find what is wrong inside
D EFINITION 1. Candidate Values (CV) are information given by them. All these verifications have to be done manually. They are
the user and used in checking instantiability of meta-models. They time consuming. Worse, they have to be done each time the tool fails
consist of two different kinds of information: to generate a model. Another solution would be the use of the Fault
Localization mechanisms that combinatorial techniques provide. For
• Number of exact instances for each class of the meta-model. example, in Constraint Programming, there exists a sub-field called
• Bounds for unbounded references. Max-CSP [17], in which the goal is to identify the subset of con-
2.2.2 Non instantiable Meta-models. A meta-model is non intan- straints responsible of the failure. However, Max-CSP suffers from
tiable when at least one part of its meta-elements (classes, relations, a lack of scalability and a reverse step has to be done in order to
etc.) could not be instantiated in a model. We distinguish three major map from constraints into meta-models elements. An equivalent
reasons why meta-model instantiation could be not possible: mechanism exists in SAT [12] as well, but without providing more
help to debug.
• Unreachable candidate values. The instance that the user tries In summary, model generators use search-based techniques and
to generate is not reachable because given CV cannot satisfy do not provide fault localization mechanisms to help the users in
the cardinality of at least one reference in the meta-model. debugging. Some of search-based and combinatorial techniques have
• Inconsistent meta-model structure. A combination of ele- kind of debuggers and fault localizers. Unfortunately, they are hard
ments is impossible to instantiate. For example, three classes to use for MDE experts and reverse engineering is needed to map
are linked by a cycle of relations and no combination of values bugs into meta-models elements. For all these reasons, meta-model
that satisfies all the cardinalities is possible. designers prefer to not use a tool for model generation. They validate
• Incorrect OCL constraints. The source of errors in this case their meta-models only manually. To fix that, a Fault Localization
are the OCL constraints of the meta-model. mechanism during meta-model instantiation is needed.
Remark Another obvious source of error is a faulty syntax (e.g.
an unnamed class). This kind of errors can be checked using Ecore 2.3.2 Tiwizi and Model Generators complementarity. The objec-
validator in Eclipse for instance. tive of this work is to reconcile meta-model designers with model
In this first work, we consider only unreachable CV. Our ideas for
tackling the two other sources of problems are discussed in section 5. 2
https://sites.google.com/site/metamodelingantipatterns/
generation tools. We provide a user friendly tool to assist them dur-
ing design task. Concretely, we developed TIWIZI, an interactive
fault localizer. The role of TIWIZI is to help to validate Ecore meta-
models. TIWIZI does not generate models. GRIMM, PRAMANA or Figure 2. An example of unidirectional reference
EMF to CSP keep their role for meta-model instantiation.
3 AUTOMATED FAULT LOCALIZATION type Room by a reference called rooms. The cardinality (1..5) means
that a House is linked to at least 1 and to at most 5 Rooms.
This section presents the main contribution of our paper. We describe Let us assume that we have only one instance of class House.
how to perform automated fault localization and provide fixing sug- In Figure 3, we show the minimal and maximal configurations
gestions. As well, we present TIWIZI, the fault localizer we created. for the previous reference. In the minimal configuration we have
Our fault localization mechanism is based on Systems of Linear #House = #Room (one room per house) and in the maximal #Room =
Inequalities (SLI). Fradet et al. [11] successfully useds SLI to check 5 ∗ #House (5 rooms per house). This means that all consistent
consistency for multiple view software architectures.An SLI is a set configurations are between these two bounds. So, to translate an
of Linear Inequalities between the same variables. Each inequality unidirectional reference into SLI, we create the following pair of
has the following shape: inequalities:
a1 x1 + a2 x2 + . . . + an xn [<, ≤, >, ≥, =, ,] b
#House ≤ #Room
The variables are xi . ai are called coefficients and b is a constant #Room ≤ 5 × #House
term. Every inequality must have one of the inequality symbols
(<, ≤, >, ≥, =, ,). For a more complete overview of this area, please
refer to [26].
To perform fault localization, the structure of a meta-model is
automatically translated into a system of linear inequalities (SLI):
considering classes’ name, relations and their cardinalities, inheri-
tance, as detailed in this section. The pair composed of the generated
SLI and the input candidate values is checked in order to localize
errors in the process of model generation. Figure 1 shows the steps
of our method and tool (TIWIZI). It consists on three important steps:
(1) generate the SLI, (2) check the consistency of the generated Figure 3. Minimal (left side) and maximal (right side) configuration for reference
system and (3) deduce fixing suggestions. Each one of these steps is in figure 2 if we have only one House.
explained in a dedicated sub-section.
3.1 Generation of Linear Inequalities 3.1.2 Bidirectional references. They associate two classes (pos-
sibly the same) in two opposite directions. It is modelized in Ecore
This section describes the System of Linear Inequalities (SLI) we with two references, each one being the eOpposite of the other one.
build, in order to localize faults while designing meta-models. The The main difference between one unidirectional reference and a pair
work described in this paper focuses on four main elements of meta- of bidirectional references, is that this last requests two cardinality
models: unidirectional references, bidirectional references, contain- constraints (one for each direction) to be checked at the same time,
ments and inheritance. while instantiating them.
3.1.1 Unidirectional references. They associate two classes (pos- We cannot process this configuration by considering two unidi-
sibly the same) of the meta-model in one direction only. An example rectional references, otherwise many false-positive examples are
of unidirectional reference is shown in Figure 2. In this example we encountered. We then propose a way to manage the bidirectional
want to say that objects of type House are connected to objects of references as a pair. Let us explain our solution by translating the
bidirectional references of the Figure 4.
Figure 4. An example of bidirectional references
This solution is based on a particular graph, called regular bipar-
tite graph [23]. A bipartite graph G = (U,V, E) is regular bipartite
if all the nodes of U have the same degree x and all the nodes of V
have the same degree y. It is denoted (x, y)-regular. Regular bipartite
graphs have an interesting characteristic: x × |U| = y × |V |.
We use this kind of graphs because the instantiation of a reference
Figure 1. Steps for fault localization and suggestion generation using TIWIZI always produces a bipartite graph. The instances of the first class
instance of A can be linked to 1..5 instances of B, C and D at the
same time (instances of concrete classes are only considered). This
case is translated into SLI using the following inequalities:
#A ≤ (#B + #C + #D)
(#B + #C + #D) ≤ 5 × #A
(a) (4, 2)-regular graph (b) (4, 1)-regular graph
Remark equivalent treatments are applied for bidirectional refer-
ences with inheritance.
Figure 5. Minimal and maximal configurations
3.2 SLI Checker
(e.g., Room) are the first part U of the graph and the instances of the Here, we explain how we use input candidate values in order to check
second class (e.g., Wall) are the second part V . the consistency of the generated SLI. The algorithm in Listing 1
First, we consider instances of class Room, and the number of explains how a generated SLI is checked according to the candidate
connected instances of class Wall. The extreme configurations are values. For each one of the inequalities, we check if the candidate
the following: values given by the user are consistent. When the checking fails, we
consider that an anomaly is detected. The next step is to generate a
• Minimal configuration. Rooms share as many walls as pos-
fixing suggestion to help the user.
sible. It means that each wall is connected to a maximum
number of rooms (= 2). This configuration produces a (4, 2)- input: SystemLinearInequalities sli
regular graph (Figure 5.a). CandidateValues cvs
• Maximal configuration. Rooms do not share their walls. Each output: List < DetectedAnomaly > anomalies
wall is connected to only one room. This configuration then
produces a (4, 1)-regular graph (Figure 5.b). begin
foreach (i: Inequality in sli ) do
These two configurations remain valid whatever the number of
if ( not check (i , cvs .get(i))) then
rooms and walls. It is only related to the cardinalities of correspond- a: new DetectedAnomaly (i , cvs .get(i))
ing references: 1..2 & 4..4. anomalies .add(a)
The previous regular graphs are characterized by the following endif
formulas: endfor
4 × #Room = 1 × #Wall ∨ 4 × #Room = 2 × #Wall return( anomalies )
end
It means that all consistent configurations must respect the fol-
Listing 1. Algorithm for checking SLIs
lowing inequalities:
1 × #Wall ≤ 4 × #Room ∨ 4 × #Room ≤ 2 × #Wall Our goal is not to solve the system of linear inequalities in order to
So, to encode the pair of opposite references, we create 4 inequal- find a valid solution because we use the CV given by the user. For this
ities: reason, we check the SLI instead of solving it. One improvement
1
#Room ≤ #Wall of our current work would be mixing solving (using an existing
4
#Wall ≤ 42 #Room solver) and checking. Indeed, sometimes the user does not want to
42 #Wall ≤ #Room give all the candidate values, because the meta-model is too big for
example. In this case, we could try to solve the SLI as well, in order
#Room ≤ 41 #Wall
to suggest a whole consistent input configuration or to complete a
3.1.3 Composition references. A composition relation (A to B) partial one. The complexity of solving SLIs is much greater than
with cardinalities (l..u) is treated as a pair of bidirectional references checking that a vector of CVs is a solution. However, there exist a
with cardinalities (1..1) in one side and (l..u) in the other side. This polynomial algorithm for checking that a homogeneous SLI has no
is done this way in order to force involved objects to have a unique solution [8]. An SLI is homogeneous if all constant terms (b values
container. This gives us the following inequalities: of inequalities) are zeros. The SLI that is created from the translation
1 of meta-models is homogeneous.
u #A ≤1 #B
#B ≤ l #A
l × #B ≤ #A
#A ≤ u × #B
3.1.4 Super type relations. The methodology we propose for
treating inheritance between classes is inspired by the translation of
a meta-model into CSP that is performed in GRIMM tool [9]. Let us
take the illustrative example in Figure 6. We can see a class A linked
to a class B which had two sub-classes C and D. It means that an Figure 6. An example of unidirectional reference with inheritance
3.3 Generation of Fixing Suggestions TIWIZI needs two inputs: a meta-model and a configuration file
Once an inconsistency between an inequality and a list of candidate that contains the candidate values. The tool is fully automated and
values is met by the SLI checker, a fixing suggestion is automatically giving the input is the only manual task. The output is a list of fixing
calculated and returned to the user. The goal is to help her/him to suggestions in case of failure or a call to the model generation tool
quickly fix the problem. in case of success. The first release of TIWIZI is available on our
Here we give an example of such a suggestion. Let us recon- github repository (https://github.com/ferdjoukh/tiwizi/).
sider again the example of reference given in Figure 2, in which Remark Filling the configuration file manually is very often time-
an instance of class House can be linked to 1..5 instances of class consuming and boring, as the size of the meta-model is growing. In
Room. Listing 2 shows a fixing suggestion provided by our tool. The order to help the users to quickly fill all this information, our tool gen-
problem here is that the user tries to create an inconsistent model erates a pre-filled file. Users only need to bring their modifications
containing 1 instance of House and 6 instances of Room. This con- if necessary.
figuration violates inequality 2 because 6 ≰ 5 × 1. To satisfy this
inequality, we must decrease its left side or increase its right side. 4 RELATED WORK
The tool then suggests to reconsider either the cardinality (> 5), the In this section, we list several works that consider the quality of meta-
value for Room (< 6) or House (> 1). models with different approaches and other approaches assessing
-- references the quality of modelling using Linear Algebra as well.
rooms : House [] - >[1..5] Room A first set of works identifies pattern and anti-pattern which in-
crease and reduce the quality of the meta-models. They do not focus
-- inequalities
House <= Room on the instantiability of the meta-model but prevent to build models
Room <= 5* House of low quality, e.g. in [6].
In [15], Hinkel et al. confirm thanks to an empirical study the im-
-- candidate values portance of the instantiability. It was already considered by Cadavid
[ House =1 , Room =6]
et al. in [5]. Such as most of the existing works, they request test
-- fixing suggestions model instances of the meta-model to validate it.
Please reconsider cardinalities for reference [ rooms ] >> In [18] and [19], Lopez et al. present a language, called mmSpec
upperBound++ whose the main purpose is to define quality criteria over meta-models.
Please reconsider number of instances >> more [ House ] or
For example, one can ensure the strong connection of meta-models
Less [ Room ]
or the reachability of classes by using such criteria. The objective
Listing 2. An example of fixing suggestion given by TIWIZI is both assisting in meta-modelling and analysing existing meta-
By default, the suggestions are written in a very succinct mode models. There is a complementarity between this work and our
directly in the terminal. But, for a better readability, the user can ask approach. Therefore, users should use both tools for a more accurate
for a verbose mode that generates a tiwizi log file for all detected validation of meta-models.
anomalies (as shown in Listing 2). A pdf file summarising all the In [20], Ma et al. define metrics over meta-models with the pur-
suggestions is then created using our custom syntax highlighting pose of assessing their quality. These metrics are inspired for classic
(calling LATEX). object oriented metrics (e.g. depth of inheritance tree). The authors
Fixing suggestions are useful because big meta-models contain also found correlations between their metrics and quality properties,
dozens of classes and references. Thus, it is hard to manually local- such as, reusability or understandability of meta-models.
ize all possible faults. Moreover, conducted user experiments [9] In [2] and [3], Boufares et al. consider the consistency of cardi-
show that many problems come from the CVs. The suggestions are nalities in UML diagrams and ER-Schemas. In both papers, they
automatically generated by TIWIZI. However, fixing meta-models translate the cardinality systems into Integer Linear Programming
and modifying the CVs is manually done by an expert. (ILP). An ILP solver then solves it and answers if the cardinalities
are consistent or no. However, the papers do not give much details
3.4 Tooling about the fault localization mechanism which seems to be manual.
All the contributions of this paper are implemented in a tool called
TIWIZI . The tool is designed as a plug-in for any model generation
5 CONCLUSION & FUTURE WORK
tool: it garantee the instantiability of the meta-model before the In this paper, we present a method for automated fault localization
generator try to instantiate it. Currently, TIWIZI is plugged to GRIMM during the task of designing meta-models. The main objective of
as an initial step of its generation process. Such a connection can our work is to help users to check if their meta-models could be
easily be done with any model generator and our code is open source. instantiated and to localize the origin of failure if not. This first work
The core part of the code that concerns the generation and the focuses on errors occurring between the candidate values that are
checking of a system of linear inequalities is written in Java. We chosen by the user and some elements of the meta-model: references,
preferred to write our own SLI checker because available checkers bidirectional references, compositions and inheritance relations.
need big efforts to adapt them to our MDE purpose. Our checker Our method is based on Linear Algebra. We model the problem of
was carefully tested on diverse meta-models to ensure it correctness. consistency of meta-models as a System of Linear Inequalities (SLI)
Both the pdf creation task for verbose suggestions and the connection and we check their consistency in order to localize bugs. The contri-
to GRIMM tool are written in bash. butions of the paper are implemented in a tool called TIWIZI. TIWIZI
takes a meta-model and candidate values (instantiation parameters) model generation tools and compare it to the time that TIWIZI needs
as input and provides fixing suggestions. Those suggestions are to automatically localize the same bugs.
guidelines for the user. They are used to modify and correct the
meta-model and the instantiation parameters. The role of our tool is REFERENCES
to guarantee the success of a model generation process or to debug [1] A. Biere, M. Heule, and H. van Maaren. Handbook of satisfiability, volume 185.
IOS press, 2009.
it and automatically localize anomalies. Beside that, model gener- [2] F. Boufares and H. Bennaceur. Consistency Problems in ER Schemas for Database
ators keep their role for meta-model instantiation. The complexity Systems. Information Sciences, 163(4):263–274, 2004.
of TIWIZI is linear and depends only on the number of references [3] F. Boufarès, H. Bennaceur, and A. Osmani. On the Consistency of Cardinality
Constraints in UML Modelling. In ISPE, International Conference on Enhanced
of the meta-model, not on the size of generated models. In addition, Interoperable Systems, pages 287–292, 2003.
the tool is fully automated. [4] J. Cabot, R. Clarisó, and D. Riera. Verification of UML/OCL Class Diagrams
using Constraint Programming. In ICSTW, IEEE International Conference on
Software Testing Verification and Validation Workshop, pages 73–80, 2008.
5.1 Limitations & Future work [5] J. Cadavid, B. Baudry, and H. Sahraoui. Searching the boundaries of a modeling
space to test metamodels. In Fifth IEEE International Conference on Software
This sections aims to list the limitations of our work, and the future Testing, Verification and Validation, Montréal, Canada, Apr. 2012.
[6] H. Cho and J. Gray. Design patterns for metamodels. In Proceedings of the
challenges that rise from it. compilation of the co-located workshops of SPLASH 2011, pages 25–32, 2011.
The current version of our tool considers the structure of the [7] L. M. De Moura and N. Bjørner. Satisfiability Modulo Theories: Introduction and
meta-model (references between classes and inheritance) and all Applications. Communications of the ACM Journal, 54(9):69–77, 2011.
[8] L. L. Dines. Systems of linear inequalities. Annals of Mathematics, pages 191–199,
the fixing suggestions we generate are related to these elements of 1919.
the meta-model. We did not include the attributes of classes in our [9] A. Ferdjoukh, A.-E. Baert, E. Bourreau, A. Chateau, and C. Nebut. Instantiation
translation into SLI. We think that we can add some features to our of Meta-models Constrained with OCL: a CSP Approach. In 3rd International
Conference on Model-Driven Engineering and Software Development (MODEL-
tool in order to take into account the attributes as well. All this can SWARD 2015), pages 213–222, 2015.
be inspired from what model generators do for attributes. We could [10] A. Ferdjoukh, F. Galinier, E. Bourreau, A. Chateau, and C. Nebut. Measurement
and generation of diversity and meaningfulness in model driven engineering. IJAS,
for example detect anomalies in types or missing values. International Journal On Advances in Software, 11(1-2):131–146, 2018.
As described in section 2.2.2, non-instantiability of meta-models [11] P. Fradet, D. Le Métayer, and M. Périn. Consistency checking for multiple view
is due to three major reasons. The first one is the topic of the current software architectures. In Software Engineering—ESEC/FSE’99, pages 410–428.
Springer, 1999.
paper. However, for a complete fault localizer, we must consider the [12] Z. Fu and S. Malik. On solving the partial max-sat problem. In International
two other sources of errors. Hereinafter, we discuss the promising Conference on Theory and Applications of Satisfiability Testing, pages 252–265.
ideas for improving this work. Springer, 2006.
[13] M. Gogolla, F. Büttner, and M. Richters. USE: A UML-based specification
Some meta-models are faulty because of their own structure with- environment for validating UML and OCL. Science of Computer Programming,
out regarding the CV. For example, in some cycles of linked classes, 69(1–3):27–34, 2007.
[14] W. Hao. Automated Metamodel Instance Generation Satisfying Quantitative
wrong cardinalities exclude any possibility of success (the work Constraints. PhD thesis, National University of Ireland Maynooth, 2013.
in [27] explains that for UML models). Therefore, we could identify, [15] G. Hinkel, M. E. Kramer, E. Burger, M. Strittmatter, and L. Happe. An empirical
define and detect such suspicious patterns for Ecore diagrams and study on the perception of metamodel quality. In 4th International Conference
onModel-Driven Engineering and Software Development (MODELSWARD 2016),
apply our approach on a larger scope of meta-model elements. This pages 145–152, 2016.
would help us to target larger or more accurate fixing suggestions. [16] D. Jackson. Software Abstractions: logic, language, and analysis. MIT Press,
The usefulness of a fault localization mechanism for OCL is un- 2012.
[17] J. Larrosa and P. Meseguer. Exploiting the use of DAC in Max-CSP. In CP,
doubted. Again, we can use the OCL translators of model generators International Conference on Principles and Practice of Constraint Programming,
in order to tackle this interesting challenge and take into account pages 308–322, 1996.
[18] J. López-Fernández, E. Guerra, and J. de Lara. Assessing the quality of meta-
OCL constraints of meta-models. We can imagine a solution that models. In Workshop on Model-Driven Engineering, Verification and Validation
finds the maximum set of consistent constraints. Then, we could co-located with International Conference on Model Driven Engineering Lan-
suggest to the user to correct only the suspicious set. This solution guages and Systems, pages 3–12, 2014.
[19] J. López Fernández, E. Guerra, and J. Lara. Meta-model validation and verification
can for example iterate on the OCL constraints and translate only with metabest. In ASE, ACM/IEEE International Conference on Automated
one at each step. If an inconsistency is detected then the constraint Software Engineering, pages 831–834, 09 2014.
is added to the set of suspicious candidates. [20] Z. Ma, X. He, and C. Liu. Assessing the quality of metamodels. Frontiers of
Computer Science, 7(4):558–570, 2013.
The final improvement of this work is of course an experimental [21] J.-M. Mottu, S. S. Simula, J. Cadavid, and B. Baudry. Discovering model transfor-
study to measure the benefits of our proposal. We plan to run two mation pre-conditions using automatically generated test models. In Proceedings
of the 2015 IEEE 26th International Symposium on Software Reliability Engineer-
different steps: (i) statistical and quantitative study and (ii) user ing, pages 88–99, Gaithersburg, MD, USA, 2015.
experience study. [22] F. Rossi, P. Van Beek, and T. Walsh, editors. Handbook of Constraint Program-
The statistical and quantitative study consists in the running of the ming. Elsevier Science Publishers, 2006.
[23] E. R. Scheinerman and D. H. Ullman. Fractional graph theory: a rational ap-
tool on several meta-models of different sizes and origins. The goal proach to the theory of graphs. Courier Corporation, 2011.
here is to show that TIWIZI is able to localize faults precisely whereas [24] S. Sen, B. Baudry, and J.-M. Mottu. On Combining Multi-formalism Knowledge
model generators are only able to notice failures. For example, if we to Select Models for Model Transformation Testing. In ICST, IEEE International
Conference on Software Testing, Verification and Validation, pages 328–337, 2008.
create mutant of the meta-models, we can count the number of bugs [25] S. Sendall and W. Kozaczynski. Model transformation: The heart and soul of
that our tool discovers. model-driven software development. IEEE software, 20(5):42–45, 2003.
[26] G. Sierksma. Linear and integer programming: theory and practice. CRC Press,
The goal of the user experience study is to show that TIWIZI 2001.
really helps people to localize bugs during meta-modelling. We can [27] R. Wille, M. Soeken, and R. Drechsler. Debugging of inconsistent uml/ocl models.
measure the time that a user needs to find a bug using several existing In DATE, Design, Automation and Test in Europe, pages 1078–1083, 2012.