Goal models are widely recognized as an e ective means for capturing requirements for socio-technical systems. Recently, models of law have been investigated and analyzed in conjunction with goal models, in order to evaluate the legal compliance of software system requirements. As goal models capture social, often ill-de ned concepts, and as law models capture ambiguous legal settings, both models are characterized by the presence of uncertainty. Consequently, both goal and law models consider uncertainty as part of their analysis, allowing for unknown or inconclusive analysis labels. However, it is also possible to consider uncertainty in the content of such models. Recent work has applied an existing formal method for capturing uncertainty in goal models. In this paper we make a distinction between uncertainty in analysis and uncertainty in content, reporting on the in uence of such uncertainty in models of law and requirements.
The usefulness of goal models (such as i* [
As goal models capture early, social requirements, uncertainty is an
unavoidable factor that has not been widely investigated. Uncertainty is also present
in laws, arising from the intricate structure of law, as well as ambiguities and
exceptions. Although law models (e.g., Nomos 2 [
In this paper we cover two categories of uncertainty: (1) uncertainty in analysis results and (2) uncertainty captured in the model structure. The rst type of analysis has been explicitly considered for both goal and law models. Recent
Silvia Ingolfo, Jennifer Horko , John Mylopoulos
work has considered (2), explicitly capturing uncertainty over the structure of
goal models [
Objectives: In this paper we discuss the explicit consideration of uncertainty in both goal and law modeling and analysis, exploiting the synergies of existing work, and outlining new avenues of uncertainty-related investigation. 2
Background: Nomos 2
Nomos 2 [
The idea behind Nomos 2 is that a set of situations make a norm
applicable and similarly situations can satisfy the norm. To capture this applicability
and satis ability, we model the relations between situations and norms as
label propagation mechanism. The two relations for satis ability (satisf y/break
propagate positive/negative satis ability) and two relations for applicability
(activate/block propagate positive/negative applicability) link situations to
norms. In Nomos 2 situations are propositions that can be known to have
Satis ability True (ST), False (SF), or Unknown (SU). Similar label are
propagated by the relations for Applicability (True AT, False AF, Unknown AU).
Depending on the satis ability of the input situations, the target norm receives
true/false/unknown values for satis ability and applicability. The combination
of this two values de nes the compliance value for a norm (compliant,
notcompliant, tolerated, or inconclusive). Composite relations (derogate, endorse,
imply) capture the relations between norms [
When a product is bought (sat(s1)=ST), the relation s1 activat!e D1 propagates positive applicability to the norm. When the situation s2 is also satis ed, then the relation s2 satisf!y D1 propagates positive satis ability, and we say that the duty is complied with (it is applicable and satis ed). Propagation for s3 is similar. However when s4 holds (the product is VAT-free), then the relation s4 bloc!k D1 propagates negative applicability (label `AF') and the duty is not applicable. 1 The graphical notation used to express the label is only used for illustrative purpose.
meeting ?
Low
We make the distinction between uncertainty in analysis results and uncertainty
over the structure of the model. In this paper, the former refers to uncertainty
about the satisfaction or applicability of a particular model element, while the
latter refers to uncertainty about the presence, uniqueness, or number of model
elements and links. We illustrate this distinction in the following.
Goal Models. Goal models have long provided a \lightweight" consideration
of uncertain analysis results using the unknown contribution link and unknown
analysis value ( ), with the former intended to represent a contribution with
an unknown type (e.g., help, break), and the latter meant to represent the
presence of evidence with unknown polarity (satis ed/denied) and strength
(full/partial) [
Nomos 2 Models. On the legal side, a Nomos 2 model allows us to express and reason about the uncertainty related to the situations holding, as well as the consequences this uncertainty has on the compliance of the model. The analysis of these models can therefore explore how the uncertainty in the situations holding (e.g., domain assumptions or hypothetical scenario) a ect the compliance with applicable laws. For example in the scenario where it is unknown whether a product is bought (sat(s1)=SU), then the applicability of the norm is unknown because the relation s1 activat!e D1 propagates unknown applicability. In MV( )) V(
in meeting M( ) S Profiles (M) Use Low
nwonknU to(mSope)lregeWHatiann(Syigz)se SSMccheheeedtdiunulgleer UnknLoewtn (V) Date
(MS) D (MS) D (MS)
details (MS) D Low
mAetteetnindg (MS) M) ( (MVe)eAtginrgeeDaabtlee (M) (VM)
(M) Decide
(comp) Nomos 2 the norm is evaluated to inconclusive: when it is not known whether the norm applies or not, it is not possible to infer any conclusions about it.
Discussion. Both goal and law models allow for unknown analysis values as initial values/assumptions, starting analysis. Such uncertainty is propagated using existing reasoning procedures, as described. Unlike Nomos 2 models, goal models contain a simple form of uncertainty in the type of contribution relation. We explore this type of uncertainty | uncertainty over model structure | in the next section. 3.2
Model Uncertainties
Goal Models. Previous consideration of uncertainty in the structure or contents
of goal models was limited only to uncertainty in contribution links (unknown).
Although useful, uncertainty may occur in any relationship or element. Recent
work has used the MAVO formal uncertainty framework [
MAVO is a language-independent approach for formally expressing
uncertainty in models. It allows users to express uncertainty using a set of annotations
over elements and relationships in their model. As these annotations can be
applied to any type of model (any metamodel), the approach is language
independent. Speci cally, the approach allows for annotations M, V, and S over model
elements and links, and comp (complete) or inc (incomplete) for the entire model.
We illustrate application of this framework to i* in Figure 2 adapted from [
The M (May) annotation allows us to express uncertainty about the presence of an element or link in a model. In our model, we are uncertain, for example, about whether we really need to Use Pro les as part of Participate in Meeting. The V (variable) annotation allows use to express uncertainty about element distinctness. We are uncertain if Agreeable Meeting Date and Convenient Meeting Dates are distinct goals, or could be merged. The S (set) annotation represents uncertainty about the number of elements, elements which may be sets. We know we must provide Details, but are not sure if there is one detail, or many, or what those details are. We mark the entire model as comp, meaning that there should be no more new elements or relations.
MAVO captures uncertainty formally by expressing metamodels and
constraints in First Order Logic, removing constraints which ensure the presence,
distinctness or number of each element in the formalism. This allows use of
existing solvers to nd \solutions", corresponding to concrete, uncertainty-reduced
models. More detail can be found in [
Nomos 2 Models. As Nomos 2 models are also characterized by uncertainty, such a general uncertainty framework could be applicable. The possibility to express uncertainty in the structure of a Nomos 2 model, could be useful when sources are uncertain. For example we could annotate the fact that a situation \product bought at the airport" May block (make not applicable) the duty to pay the VAT-tax. The uncertainty related to this annotation arises because not all airport products are tax-free: the ones bought at the duty-free are, but products at regular shops usually include VAT. Similarly we could annotate that we are uncertain whether it is enough to ll in the VAT-claim form or maybe there is something else to provide in order to be really compliant. For example, when submitting these VAT-claim forms at the custom o ce, some identi cation documents are needed for the passenger. However, it could be that the proof a valid return ticket is also needed to really comply. We can model this using MAVO by adding additional S and M annotated situations (e.g., (M) valid return ticket is provided, (MS) passenger identi cation documents provided) which can satisfy the norm. Further investigation and examples are needed to evaluate the combination of Nomos 2 and MAVO.
Discussion. In this section we have explored uncertainty over the structure of the model, while previous considerations of uncertainty assumed that the model was certain but considered uncertainty in analysis values. In some cases, the border between uncertainty in model structure and analysis results is di cult to de ne. We provide a preliminary sketch of these dimensions in (5) Future: Uncertain Figure 3. Existing approaches for goal Analysis of Uncertain models consider only a small amount
Models of model uncertainty (unknown links) ityn and uncertainty in analysis using the trae unknown label (point (1) in Figure 3). cn (4) Future: Analysis of Nomos 2 considers uncertainty in satlissyanAU (2) N(ò1Am)pEopxsriot2iancghGeUsMncertain NòmUo(nAs3cn)2eaCrMlutyarsoriindseenoGltfsM: itasanfiaancltytyisoiosnv,ebarunttdhdeaopmepsolindcoeatlb(cilpoitnoyisnidatse(r2pu)a)nr.tceor-f We can envision investigation using other combinations of these diModel Uncertainty mensions. We are currently investigating ways to apply i* analysis over Fig. 3: Model vs. Analysis Uncertainty - MAVO -annotated i* models (point Existing and Proposed Approaches. (3)). This work would allow us to explore analysis results given possible uncertainty reductions, in order to explore alternative requirements by producing sets of possible labels even before uncertainties are resolved. Similar approaches could integrate the semantics of Nomos 2 models with MAVO annotations, considering uncertainty in the evaluation of compliance (point (4)).
By analyzing uncertain goal models, we increase our consideration of model uncertainty (beyond unknown links), but do not consider any further uncertainty in analysis results (beyond the use of unknown labels). Future work could support analysis which allows for the possibility of more uncertainty over possibly uncertain models (point (5)). For example, if we explicitly consider the e ects of an open world assumption (Incomp) during model analysis, the possibility of additional elements and links may cause further types of uncertainty in our analysis results (e.g., an element may be satis ed). Our de nition of model vs. analysis uncertainty may evolve as we consider such possibilities. 4
Conclusions and Future Work In this paper we make the distinction between uncertainty over the contents of the model (model uncertainty) and uncertain analysis results (analysis uncertainty). We have summarized uncertainty as considered in the analysis of i* and Nomos 2 models. We have summarized existing work on model uncertainty for goal models, and provided examples of how such work can be applied to Nomos 2 models. We outline possible future work considering other combinations of uncertainty in modeling or analysis. In the future, we may need further distinctions to characterize uncertainty, e.g. design-time uncertainty over model contents vs. run-time uncertainty over unpredictable aspects of the environment.