1.Lightweight and Static Verification ofUML Executable Models a PhD thesis byElena PlanasAdvised by: Dr. Jordi Cabot and Dra. Cristina Gmez21st March, 2013

2. what is the meaning of no-quality ? 3. what is the meaning ofno-quality ?FAILURENokia Lumia 900 software bug 4. how can the qualityof a software productbe improved? 5. contributions conclusions& further work related experimentationwork toolM2M may be evaluatedTransformationscompared throughwe extractimplemented in can also beapplied to state of syntactic the art correctness our focuses correctnesson executability solution properties has beenaddressed in completenesswe propose followsresearch researchproblem methodology 6. contributions conclusions& further work related experimentationwork toolM2M may be evaluatedTransformationscompared throughwe extractimplemented in can also beapplied to state of syntactic the art correctness our focuses correctnesson executability solution properties has beenaddressed in completenesswe propose followsresearch researchproblem methodology 7. Software development lifecycleAnalysisDesign Implementation ModelModel Code Driven Development (MDD)A model is a simplified representation of acomplex reality [Brown,2002]Research Problem 8. Software development lifecycleAnalysisDesign Implementation ModelModel Code Driven Development (MDD)A model is a simplified representation of acomplex reality [Brown,2002]Research Problem 9. Software development lifecycleAnalysis Design Implementation ModelModelCode Driven Development (MDD)Research Problem 10. Software development lifecycle Analysis Design Implementation Executable Model ModelCode Driven Development (MDD) Boehms curveResearch Problem Errors are most frequent during the first phases of the development activities and are more expensive the later they are removed 11. Software development lifecycle Analysis Design Implementation Executable Model ModelCode Driven Development (MDD) Boehms curveResearch Problemerrors should be removedASAP 12. Software development lifecycle Analysis Design Implementation Executable Model ModelCode Driven Development (MDD) Boehms curve how can the quality ofResearch Problemerrors should be removedASAPexecutable models be improved? 13. quality of UML executable models quality quality of software of modelsResearch Problem 14. An executable modelsis a model with a behavioral specificationsufficiently detailed so it can besystematicallyimplemented/executedin the production environment 15. An executablemodelsmay be specified using severalmodeling languages Model Modelling Languages Transformation LanguagesxUML OCL ALFQVTstandards 16. An executablemodelsUMLStructural Model Detailed Behavioral Modelexecutable UML Class Diagram + UML Behavioral Diagrammodelintegrity constraints precisely defined 17. An executable modelsUMLStructural Model Detailed Behavioral Model executableUML Class Diagram + UML Behavioral Diagram model integrity constraints precisely defined RestaurantBranch Menu Courseaddress: String * Offers *name: String * IsComposedOf2..*description: Stringphone: String[0..2] price: Real category: CourseCategory{incomplete} CourseCategory Period SpecialMenu Starter * OfferedDuring 1..*discount: Real iniDate: Date MainCourse endDate: Date Dessertcontext SpecialMenu inv validDiscount: self.discount >=10context SpecialMenu inv atMost3SpecialMenus: SpecialMenu.allInstances()->size()exists(m|m.name=_name) ) { Menu m = new Menu();operations m.name = _name; m.price = _price; for ( i in 1.._courses->size() ) { IsComposedOf.createlink(menu=>m,course=>_courses[i]); } } } 21. An executable models UML Structural ModelDetailed Behavioral Modelexecutable UML Class Diagram +UML Behavioral Diagrammodelintegrity constraintsprecisely defined Using Alf action language (OMG).Alf is a clear, precise yet abstract textuallanguage to specify executable models in the context of UMLMenu Coursename: String * IsComposedOf 3..* price: Real activity addMenu (in _name: String, in _price: Real, in _courses:Course[3..*]) { action-based if ( !Menu.allInstances()->exists(m|m.name=_name) ) { Menu m = new Menu();operations m.name = _name; m.price = _price; for ( i in 1.._courses->size() ) { IsComposedOf.createlink(menu=>m,course=>_courses[i]); } } } 22. An executable models UML Structural ModelDetailed Behavioral Modelexecutable UML Class Diagram +UML Behavioral Diagrammodelintegrity constraintsprecisely defined Using Alf action language (OMG).Alf is a clear, precise yet abstract textuallanguage to specify executable models in the context of UMLMenu Coursename: String * IsComposedOf 3..* price: Real activity addMenu (in _name: String, in _price: Real, in _courses:Course[3..*]) { action-based if ( !Menu.allInstances()->exists(m|m.name=_name) ) { Menu m = new Menu();operations m.name = _name; m.price = _price; for ( i in 1.._courses->size() ) { IsComposedOf.createlink(menu=>m,course=>_courses[i]); } } } 23. An executablemodels UML Structural Model Detailed Behavioral Modelexecutable UML Class Diagram + UML Behavioral Diagrammodelintegrity constraints precisely defined Using Alf action language (OMG). Alf is a clear, precise yet abstract textual language to specify executable models inthe context of UMLMenu Coursename: String * IsComposedOf 3..* price: Real activity addMenu (in _name: String, in _price: Real, in _courses:Course[3..*]) {action-based if ( !Menu.allInstances()->exists(m|m.name=_name) ) { Menu m = new Menu(); operations m.name = _name; m.price = _price; association.createLink(role1=>object1, role2=>object2) for ( i in 1.._courses->size() ) { IsComposedOf.createlink(menu=>m,course=>_courses[i]); } } } 24. An executable models UML Structural ModelDetailed Behavioral Modelexecutable UML Class Diagram +UML Behavioral Diagrammodelintegrity constraintsprecisely defined Using Alf action language (OMG).Alf is a clear, precise yet abstract textuallanguage to specify executable models in the context of UMLMenu Coursename: String * IsComposedOf 3..* price: Real activity addMenu (in _name: String, in _price: Real, in _courses:Course[3..*]) { action-based if ( !Menu.allInstances()->exists(m|m.name=_name) ) { Menu m = new Menu();operations m.name = _name; m.price = _price; for ( i in 1.._courses->size() ) { IsComposedOf.createlink(menu=>m,course=>_courses[i]); } } } 25. An executable modelsraise the level ofabstraction productivityplatform independent modelsallow early verificationcostsbetter software at less cost standards for executable modellingALF February 2011Concrete Syntax for UMLFoundational Subset for October 2010 19972005[UML version 1.0][UML version 2.0]Action LanguageExecutable UML Models[Alf version 1.0 - Beta 1] [fUML version 1.0 - Beta] 2013 26. An executablemodels raise the level of abstractionproductivity platform independent models allowearly verification costs better software at less coststandards for executable modelling1992 In the future, most 2001 developments will be xUML: softwaredevelopment based on an exe-methodologyALF cutable specificationFebruary 2011 Concrete Syntax for UMLFoundational Subset forOctober 2010designed to 1997 2005 [Harel][UML version 1.0] precisely define the[UML version 2.0]Action LanguageExecutable UML Modelssemantics of [Alf version 1.0 - Beta 1] [fUML version 1.0 - Beta]executable models2013 27. Analysis Design ImplementationExecutable ModelModelCode Driven Development (MDD) need for methods and tools to evaluateResearch Problem the correctness of executable models 28. how can the quality of UML executable models be improved?how can the quality of executable models be decomposed intoquality properties?what methodscan be employed to support the verication of the qualityproperties of executable models?what kind of feedbackResearch Problem can help the designers to improve her executable models? what types of executable models can be veried using these methods? 29. contributions conclusions& further work related experimentationwork toolM2M may be evaluatedTransformationscompared throughwe extractimplemented in can also beapplied to state of syntactic the art correctness our focuses correctnesson executability solution properties has beenaddressed in completenesswe propose followsresearch researchproblem methodology 30. correctness properties to be verifiedProperties type of model Domain to be verifiedState of the Art Type of method employed to performthe verification 31. Dimension 1. Domain Information they represent Behavioural Model Model to StructuralNonExecutableModel ModelexecutableBehavioural TransformationBehaviouralModelModel[activity, statechart, sequence]UML/fUML diagrams class diagram declarativeOCLoperations OMG imperativeAlfstandardsoperations M2MQVT transformation ATLM2MState of the Arttransformation Language othersxUML xUML model 32. Dimension 1. Domain Information they represent Behavioural Model Model to StructuralNonExecutableModel ModelexecutableBehavioural TransformationBehaviouralModelModel[activity, statechart, sequence]UML/fUML diagrams class diagram declarativeOCLoperations OMG imperativeAlfstandardsoperations M2MQVT transformation ATLM2MState of the Arttransformation Language othersxUML xUML model 33. Dimension 2. Properties * According to Lindlands framework [Lindland et al. Understanding Quality inLevel of quality Conceptual Modeling. 1994] SyntacticSemantic Pragmatic Properties Properties PropertiesDomain checking that there arenot two different menusSpecificwhich contain exactly the Propertiessame coursessyntactic correctness safetycomprehension Level of abstraction livenessDomainIndependentconsistency PropertiesState of the Artexecutabilitycompleteness 34. Dimension 2. Properties * According to Lindlands framework [Lindland et al. Understanding Quality inLevel of quality Conceptual Modeling. 1994] SyntacticSemantic Pragmatic Properties Properties PropertiesDomain checking that there arenot two different menusSpecificwhich contain exactly the Propertiessame coursessyntactic correctness safetycomprehension Level of abstraction livenessDomainIndependentconsistency PropertiesState of the Artexecutabilitycompleteness 35. Dimension 3. Method Level of formalization they useNon Formal LightweightFormal Methods Methods Methods How the analysis is done?inspectionStatic Methodsabstract interpretationreview Dynamic model checking Methods testingState of the Art 36. Dimension 3.Method Level of formalization they useNon FormalLightweightFormal Methods MethodsMethods How the analysis is done?inspectionStatic Methods our verification methods abstract interpretationreview Dynamic model checking Methods testingState of the Art 37. contributions conclusions& further work related experimentationwork toolM2M may be evaluatedTransformationscompared throughwe extractimplemented in can also beapplied to state of syntactic the art correctness our focuses correctnesson executability solution properties has beenaddressed in completenesswe propose followsresearch researchproblem methodology 38. we propose a verication framework to help the designers improve the quality of their executable models correctnessexecutable should fulfill propertiesmodelsof executablebehavioural models can beprovidecheckedfeedback tousingOur solution: Overview improve lightweightand static verification methods 39. we propose a verication frameworkmethod for verifying the method formethod forverifying the verifying thesyntactic executability completeness feedback correctness No model execution lightweight No translation to a formal languageOur solution: Overview and staticQuick feedback methods Easy integration in the development process Partial analysis 40. contributions conclusions& further work related experimentationwork toolM2M may be evaluatedTransformationscompared throughwe extractimplemented in can also beapplied to state of syntactic the art correctness our focuses correctnesson executability solution properties has beenaddressed in completenesswe propose followsresearch researchproblem methodology 41. An operation is syntactically correctiff all the actions in the operation satisfy all therules dened in the UML/fUML metamodels. English UMLlanguagelanguage EnglishUML/fUML defined by syntax metamodelProperties: Syntactic correctnessConformConform to toUML model Well-Formedness RulesEnglish (example: Alf- sentences based operations) 42. An operation issyntactically correctiff all the actions in the operation satisfy all therules dened in the UML/fUML metamodels.WFR: We cannot create instances of an abstract classifier.context CreateObjectAction inv: not (self.classifier.isAbstract = true)Properties: Syntactic correctness Course activity addCourse() { Course c = new Course(); {complete} } ItalianCourse VegetarianCourse 43. An operation issyntactically correctiff all the actions in the operation satisfy all therules dened in the UML/fUML metamodels.WFR: We cannot create instances of an abstract classifier.context CreateObjectAction inv: not (self.classifier.isAbstract = true)Properties: Syntactic correctness Course activity addCourse() { Course c = new Course(); {complete} } ItalianCourse VegetarianCourseFeedback: Theclassifier cannotbe abstract. 44. An operation issyntactically correctiff all the actions in the operation satisfy all therules dened in the UML/fUML metamodels.39 Well-Formedness RulesProperties: Syntactic correctness75% from UML | 15% from fUML | 10% added40% rules from the UML/fUML metamodels corrected 45. contributions conclusions& further work related experimentationwork toolM2M may be evaluatedTransformationscompared throughwe extractimplemented in can also beapplied to state of syntactic the art correctness our focuses correctnesson executability solution properties has beenaddressed in completenesswe propose followsresearch researchproblem methodology 46. The executabilityof an operation is its ability to run without breaking the integrity constraints defined in the structural model.Two levels of correctness:An operation is weakly executable (WE) An operation is strongly executable (SE)when there is a chance that a user may when it is always successfully executed.successfully execute the operation.Property: Executability 47. The executabilityof an operation is its ability to run without breaking the integrity constraints defined in the structural model.Two levels of correctness:An operation is weakly executable (WE) An operation is strongly executable (SE)when there is a chance that a user may when it is always successfully executed.successfully execute the operation. Menucontext SpecialMenu inv validDiscount: self.discount >=10 name: Stringcontext SpecialMenu inv atMost3SpecialMenus: SpecialMenu.allInstances()->size()=10 ) { SpecialMenuclassify self to SpecialMenu;OfferedDuring.createLink(specialMenu=>self,period=>_period);discount: RealProperty: Executabilityself.discount = _discount;*} OfferedDuring }1..*Period iniDate: Date endDate: Date 48. The executabilityof an operation is its ability to run without breaking the integrity constraints defined in the structural model.Two levels of correctness:An operation is weakly executable (WE) An operation is strongly executable (SE)when there is a chance that a user may when it is always successfully executed.successfully execute the operation. Menucontext SpecialMenu inv validDiscount: self.discount >=10 name: Stringcontext SpecialMenu inv atMost3SpecialMenus: SpecialMenu.allInstances()->size()=10 ) { SpecialMenuclassify self to SpecialMenu;OfferedDuring.createLink(specialMenu=>self,period=>_period);discount: RealProperty: Executabilityself.discount = _discount;*} OfferedDuring }1..*Period iniDate: Date endDate: Date 49. The executabilityof an operation is its ability to run without breaking the integrity constraints defined in the structural model.Two levels of correctness:An operation is weakly executable (WE) An operation is strongly executable (SE)when there is a chance that a user may when it is always successfully executed.successfully execute the operation. Menucontext SpecialMenu inv validDiscount: self.discount >=10 name: Stringcontext SpecialMenu inv atMost3SpecialMenus: SpecialMenu.allInstances()->size()=10 ) { SpecialMenuclassify self to SpecialMenu;OfferedDuring.createLink(specialMenu=>self,period=>_period);discount: RealProperty: Executabilityself.discount = _discount;*} OfferedDuring }1..*Period iniDate: Date endDate: Date Italian menu Vegetarian menu Japanese menu(special menu) (special menu)(special menu) 50. The executabilityof an operation is its ability to run without breaking the integrity constraints defined in the structural model.Two levels of correctness:An operation is weakly executable (WE) An operation is strongly executable (SE)when there is a chance that a user may when it is always successfully executed.successfully execute the operation. Menucontext SpecialMenu inv validDiscount: self.discount >=10 name: Stringcontext SpecialMenu inv atMost3SpecialMenus: SpecialMenu.allInstances()->size()=10 ) { SpecialMenuclassify self to SpecialMenu;OfferedDuring.createLink(specialMenu=>self,period=>_period);discount: RealProperty: Executabilityself.discount = _discount;*} OfferedDuring }1..*Period iniDate: Date endDate: Date Italian menu Vegetarian menu Japanese menu Another special menu(special menu) (special menu)(special menu)(special menu) 51. INPUTTo determineComputing if an operation isexecutableexecution pathsAnalyzing PVAswe propose aDiscarding PVAs four-stepverificationProperty: ExecutabilityClassifying themethodoperation OUTPUT 52. INPUTComputingexecution pathsAnalyzing PVAsDiscarding PVAsProperty: ExecutabilityClassifying theoperation OUTPUT 53. An execution pathINPUTis a consecutive sequence ofactions that may be followed during the execution of anComputingexecution paths operationAnalyzing PVAsDiscarding PVAsProperty: ExecutabilityClassifying theoperation OUTPUT 54. INPUTAn execution paths INPUTactivity classifyAsSpecialMenu (in _discount:Real, in _preiod: Period) {if ( _discount>=10 ) { classify self to SpecialMenu; OfferedDuring.createLink(specialMenu=>self,period=>_period);Computingself.discount = _discount;execution paths }}Analyzing PVAsEXECUTION PATHSDiscarding PVAsif _discount >= 10Property: ExecutabilityClassifying theclassify self to SpecialMenuoperationOfferedDuring.createLink(specialMenu=>self,period=>_period) OUTPUT self.discount = _discount 55. INPUT An execution paths INPUT activity classifyAsSpecialMenu (in _discount:Real, in _preiod: Period) { if ( _discount>=10 ) {classify self to SpecialMenu;OfferedDuring.createLink(specialMenu=>self,period=>_period);Computing self.discount = _discount;execution paths} }Analyzing PVAsEXECUTION PATHSDiscarding PVAs1st path if_discount >= 10Property: ExecutabilityClassifying the classify self to SpecialMenuoperation OfferedDuring.createLink(specialMenu=>self,period=>_period) OUTPUTself.discount = _discount 56. INPUT An execution paths INPUT activity classifyAsSpecialMenu (in _discount:Real, in _preiod: Period) { if ( _discount>=10 ) {classify self to SpecialMenu;OfferedDuring.createLink(specialMenu=>self,period=>_period);Computing self.discount = _discount;execution paths} }Analyzing PVAsEXECUTION PATHSDiscarding PVAs2nd path if_discount >= 10Property: ExecutabilityClassifying the classify self to SpecialMenuoperation OfferedDuring.createLink(specialMenu=>self,period=>_period) OUTPUTself.discount = _discount 57. INPUTComputingexecution pathsAnalyzing PVAsDiscarding PVAsProperty: ExecutabilityClassifying theoperation OUTPUT 58. A Potentially Violating ActionsINPUTis an action that its effect canchange the system state in a wayComputingthat some integrity constraintsbecome violatedexecution pathsAnalyzing PVAsDiscarding PVAsProperty: ExecutabilityClassifying theoperation OUTPUT A path does not have PVAs is WE/SE A path has some PVAs may be not WE/SE 59. A Potentially Violating ActionsINPUTifComputing_discount >= 10execution pathsclassify self to SpecialMenuAnalyzing PVAsOfferedDuring.createLink(specialMenu=>self,period=>_period) self.discount = _discountDiscarding PVAsProperty: ExecutabilityClassifying theoperation OUTPUT 60. APotentially Violating ActionsINPUTifComputing_discount >= 10execution paths classify self to SpecialMenuAnalyzing PVAsOfferedDuring.createLink(specialMenu=>self,period=>_period) self.discount = _discountDiscarding PVAs MenuProperty: ExecutabilityClassifying thename: Stringoperationprice: Real{incomplete} SpecialMenu Period OUTPUT * OfferedDuring 1..* iniDate: Datediscount: RealendDate: Datecontext SpecialMenu inv validDiscount: self.discount >=10context SpecialMenu inv atMost3SpecialMenus: SpecialMenu.allInstances()->size()= 10execution paths classify self to SpecialMenuAnalyzing PVAsOfferedDuring.createLink(specialMenu=>self,period=>_period) self.discount = _discountDiscarding PVAs MenuProperty: ExecutabilityClassifying thename: Stringoperationprice: Real{incomplete} SpecialMenu Period OUTPUT * OfferedDuring 1..* iniDate: Datediscount: RealendDate: Datecontext SpecialMenu inv validDiscount: self.discount >=10context SpecialMenu inv atMost3SpecialMenus: SpecialMenu.allInstances()->size()= 10execution pathsEach special menu must berelated with at least one Period classify self to SpecialMenu[weak and strong executability]Analyzing PVAsOfferedDuring.createLink(specialMenu=>self,period=>_period) self.discount = _discountDiscarding PVAs MenuProperty: ExecutabilityClassifying thename: Stringoperationprice: Real{incomplete} SpecialMenu Period OUTPUT * OfferedDuring 1..* iniDate: Datediscount: RealendDate: Datecontext SpecialMenu inv validDiscount: self.discount >=10context SpecialMenu inv atMost3SpecialMenus: SpecialMenu.allInstances()->size()= 10execution pathsEach special menu must berelated with at least one Period classify self to SpecialMenu[weak and strong executability]Analyzing PVAsThere may exist at most 3 OfferedDuring.createLink(specialMenu=>self,period=>_period) special menus in the system[strong executability] self.discount = _discountDiscarding PVAs MenuProperty: ExecutabilityClassifying thename: Stringoperationprice: Real{incomplete} SpecialMenu Period OUTPUT * OfferedDuring 1..* iniDate: Datediscount: RealendDate: Datecontext SpecialMenu inv validDiscount: self.discount >=10context SpecialMenu inv atMost3SpecialMenus: SpecialMenu.allInstances()->size()= 10execution pathsEach special menu must bePVArelated with at least one Period classify self to SpecialMenu[weak and strong executability]Analyzing PVAsThere may exist at most 3 OfferedDuring.createLink(specialMenu=>self,period=>_period) special menus in the system[strong executability] self.discount = _discountDiscarding PVAs MenuProperty: ExecutabilityClassifying thename: Stringoperationprice: Real{incomplete} SpecialMenu Period OUTPUT * OfferedDuring 1..* iniDate: Datediscount: RealendDate: Datecontext SpecialMenu inv validDiscount: self.discount >=10context SpecialMenu inv atMost3SpecialMenus: SpecialMenu.allInstances()->size()= 10execution pathsPVA classify self to SpecialMenuAnalyzing PVAsOfferedDuring.createLink(specialMenu=>self,period=>_period) self.discount = _discountDiscarding PVAs MenuProperty: ExecutabilityClassifying thename: Stringoperationprice: Real{incomplete} SpecialMenu Period OUTPUT * OfferedDuring 1..* iniDate: Datediscount: RealendDate: Datecontext SpecialMenu inv validDiscount: self.discount >=10context SpecialMenu inv atMost3SpecialMenus: SpecialMenu.allInstances()->size()= 10execution pathsPVA classify self to SpecialMenuAnalyzing PVAsOfferedDuring.createLink(specialMenu=>self,period=>_period) self.discount = _discountDiscarding PVAs The value of the discount attribute must be >= 10 [strong executability] MenuProperty: ExecutabilityClassifying thename: Stringoperationprice: Real{incomplete} SpecialMenu Period OUTPUT * OfferedDuring 1..* iniDate: Datediscount: RealendDate: Datecontext SpecialMenu inv validDiscount: self.discount >=10context SpecialMenu inv atMost3SpecialMenus: SpecialMenu.allInstances()->size()= 10execution pathsPVAclassify self to SpecialMenuAnalyzing PVAsOfferedDuring.createLink(specialMenu=>self,period=>_period) PVA self.discount = _discountDiscarding PVAsProperty: ExecutabilityClassifying theoperation MAY BE NOT[weakly | STRONGLY] OUTPUTEXECUTABLE 68. INPUTComputingexecution pathsAnalyzing PVAsDiscarding PVAsProperty: ExecutabilityClassifying theoperation OUTPUT 69. when aPVA may be discarded?INPUTThe path contains a guard way 1Computing that ensures the PVA will onlybe executed in a safe contextexecution pathsAnalyzing PVAs Critical scenario Safe scenarioAif ( A.allInstances()size()=0 ){A a = new A();A a = new A();}Discarding PVAs Cmax(A)=1Property: ExecutabilityClassifying theoperation OUTPUT 70. when a PVA may be discarded?INPUTThe path contains a guard way 1Computing that ensures the PVA will onlybe executed in a safe contextexecution pathsAnalyzing PVAsThe path contains another actionwhich counters or complementsway 2Discarding PVAs the effect of the PVA in order to maintain the integrity of the systemProperty: ExecutabilityClassifying theoperation Critical scenario Safe scenario A a0.destroy(); //where a0.type == A OUTPUT A a = new A(); a1 = new A();Cmax(A)=1 71. when aPVA may be discarded?INPUTThe attribute discount must be initializedif[weak and strong executability]Computing_discount >= 10execution pathsEach special menu must bePVArelated with at least one Period classify self to SpecialMenu[weak and strong executability]Analyzing PVAsThere may exist at most 3OfferedDuring.createLink(specialMenu=>self,period=>_period) special menus in the system[strong executability]PVA self.discount = _discountDiscarding PVAs The value of the discount attribute must be >= 10 [strong executability] MenuProperty: ExecutabilityClassifying thename: Stringoperationprice: Real{incomplete} SpecialMenu Period OUTPUT * OfferedDuring 1..* iniDate: Datediscount: RealendDate: Datecontext SpecialMenu inv validDiscount: self.discount >=10context SpecialMenu inv atMost3SpecialMenus: SpecialMenu.allInstances()->size()= 10execution pathsEach special menu must bePVArelated with at least one Period classify self to SpecialMenu[weak and strong executability]Analyzing PVAsThere may exist at most 3OfferedDuring.createLink(specialMenu=>self,period=>_period) special menus in the system[strong executability]PVA self.discount = _discountDiscarding PVAs The value of the discount attribute must be >= 10 [strong executability] MenuProperty: ExecutabilityClassifying thename: Stringoperationprice: Real{incomplete} SpecialMenu Period OUTPUT * OfferedDuring 1..* iniDate: Datediscount: RealendDate: Datecontext SpecialMenu inv validDiscount: self.discount >=10context SpecialMenu inv atMost3SpecialMenus: SpecialMenu.allInstances()->size()= 10execution pathsEach special menu must bePVArelated with at least one Period classify self to SpecialMenu[weak and strong executability]Analyzing PVAsThere may exist at most 3OfferedDuring.createLink(specialMenu=>self,period=>_period) special menus in the system[strong executability]PVA self.discount = _discountDiscarding PVAs The value of the discount attribute must be >= 10 [strong executability] MenuProperty: ExecutabilityClassifying thename: Stringoperationprice: Real{incomplete} SpecialMenu Period OUTPUT * OfferedDuring 1..* iniDate: Datediscount: RealendDate: Datecontext SpecialMenu inv validDiscount: self.discount >=10context SpecialMenu inv atMost3SpecialMenus: SpecialMenu.allInstances()->size()= 10execution pathsPVA classify self to SpecialMenuAnalyzing PVAsThere may exist at most 3OfferedDuring.createLink(specialMenu=>self,period=>_period) special menus in the system[strong executability]PVA self.discount = _discountDiscarding PVAs The value of the discount attribute must be >= 10 [strong executability] MenuProperty: ExecutabilityClassifying thename: Stringoperationprice: Real{incomplete} SpecialMenu Period OUTPUT * OfferedDuring 1..* iniDate: Datediscount: RealendDate: Datecontext SpecialMenu inv validDiscount: self.discount >=10context SpecialMenu inv atMost3SpecialMenus: SpecialMenu.allInstances()->size()= 10execution pathsPVA classify self to SpecialMenuAnalyzing PVAsThere may exist at most 3OfferedDuring.createLink(specialMenu=>self,period=>_period) special menus in the system[strong executability]PVA self.discount = _discountDiscarding PVAs The value of the discount attribute must be >= 10 [strong executability] MenuProperty: ExecutabilityClassifying thename: Stringoperationprice: Real{incomplete} SpecialMenu Period OUTPUT * OfferedDuring 1..* iniDate: Datediscount: RealendDate: Datecontext SpecialMenu inv validDiscount: self.discount >=10context SpecialMenu inv atMost3SpecialMenus: SpecialMenu.allInstances()->size()= 10execution pathsPVA classify self to SpecialMenuAnalyzing PVAsThere may exist at most 3OfferedDuring.createLink(specialMenu=>self,period=>_period) special menus in the system[strong executability]PVA self.discount = _discountDiscarding PVAs MenuProperty: ExecutabilityClassifying thename: Stringoperationprice: Real{incomplete} SpecialMenu Period OUTPUT * OfferedDuring 1..* iniDate: Datediscount: RealendDate: Datecontext SpecialMenu inv validDiscount: self.discount >=10context SpecialMenu inv atMost3SpecialMenus: SpecialMenu.allInstances()->size()= 10execution paths PVAclassify self to SpecialMenuAnalyzing PVAs There may exist at most 3 OfferedDuring.createLink(specialMenu=>sm,period=>_period)special menus in the system [strong executability]self.discount = _discountDiscarding PVAsProperty: ExecutabilityClassifying theoperationAll PVAs discardedthe path is WE/SE NOT All PVAs discardedthe path is not WE/SE OUTPUT At least one path is WEthe operation is WE All paths are SE the operation is SE 79. Our method provides feedbackINPUTto help the designers identifying and repairing the detected errorsComputingexecution pathsAnalyzing PVAsDiscarding PVAsProperty: ExecutabilityClassifying theoperation OUTPUT 80. Our method provides feedbackINPUT OUTPUTactivity classifyAsSpecialMenu (in _discount:Real, in _preiod: Period) {if ( _discount>=10 ) { classify self to SpecialMenu;ComputingOfferedDuring.createLink(specialMenu=>self,period=>_period);execution pathsself.discount = _discount;}}Analyzing PVAs#1Discarding PVAsProperty: ExecutabilityClassifying theoperation #2 OUTPUT#3 81. Our method providesfeedbackINPUT OUTPUTactivity classifyAsSpecialMenu (in _discount:Real, in _preiod: Period) {if ( _discount>=10 and SpecialMenu.allInstances()->size()self,period=>_period);execution pathsself.discount = _discount;}}Analyzing PVAs# 1 Add a guard to prevent the execution of the PVADiscarding PVAswhen SpecialMenu has already 3 instancesProperty: ExecutabilityClassifying theoperation #2 OUTPUT#3 82. Our method providesfeedbackINPUT OUTPUTactivity classifyAsSpecialMenu (in _discount:Real, in _preiod: Period) { if ( _discount>=10 ) {Computing if ( SpecialMenu.allInstances()==3 ){execution pathso.destroy(); //where o.type == SpecialMenu } classify self to SpecialMenu; OfferedDuring.createLink(specialMenu=>self,period=>_period); self.discount = _discount;Analyzing PVAs}}# 1 Add a guard to prevent the execution of the PVADiscarding PVAswhen SpecialMenu has already 3 instancesProperty: ExecutabilityClassifying theoperation # 2 Add an action to destroy an instance of SpecialMenu OUTPUT#3 83. Our method providesfeedbackINPUT OUTPUTactivity classifyAsSpecialMenu (in _discount:Real, in _preiod: Period) { if ( _discount>=10 ) {Computing if ( SpecialMenu.allInstances()==3 ){execution pathsclassify o from SpecialMenu; //where o.type == SpecialMenu } classify self to SpecialMenu; OfferedDuring.createLink(specialMenu=>self,period=>_period); self.discount = _discount;Analyzing PVAs}}# 1 Add a guard to prevent the execution of the PVADiscarding PVAswhen SpecialMenu has already 3 instancesProperty: ExecutabilityClassifying theoperation # 2 Add an action to destroy an instance of SpecialMenu action to take out an object from SpecialMenu OUTPUT# 3 Add an 84. Strongly executable operations Always succeedLevels of correctnessWeakly executableoperations Sometimes succeedNon-executable operations Always failProperty: Executability 85. method based on static analysistakes into account 13 types of integrity constraintsof the structural model identifies 23patterns for detecting PotentiallyViolating Actions proposes 41repairing patterns to [discard the PVAs | suggest as FEEDBACK]Property: Executability 86. method based on static analysistakes into account 13 types of integrity constraintsof the structural model identifies 23patterns for detecting PotentiallyViolating Actions proposes 41repairing patterns to [discard the PVAs | suggest as FEEDBACK] but static analysis has severallimitationsit cannot take into account all the possible types ofintegrity constraints conditions of conditionals and loop structuresProperty: Executabilityit is not able to compare the specific it may return FALSE POSITIVES (but not FALSE NEGATIVES!)but I can resolve it! 87. contributions conclusions& further work related experimentationwork toolM2M may be evaluatedTransformationscompared throughwe extractimplemented in can also beapplied to state of syntactic the art correctness our focuses correctnesson executability solution properties has beenaddressed in completenesswe propose followsresearch researchproblem methodology 88. A set of operations is complete if all possible changes (inserts/updates/deletes) on all parts of the system state can be performed through theexecution of those operations.Property: Completeness 89. A set of operations is complete if all possible changes (inserts/updates/deletes) on all parts of the system state can be performed through theexecution of those operations. MenuCourse* IsComposedOf 2..* name: String description: String price: Realcategory: CourseCategoryactivity addCourse (in _description: String, in _category: CourseCategory) { SpecialMenuCourse c = new Course();c.description = _description;discount: Realc.category = _category;}Property: Completeness CourseCategory activity deleteMenu() {self.destroy(); Starter MainCourse} Dessert 90. A set of operations is complete if all possible changes (inserts/updates/deletes) on all parts of the system state can be performed through theexecution of those operations. MenuCourse* IsComposedOf 2..* name: String description: String price: Realcategory: CourseCategoryactivity addCourse (in _description: String, in _category: CourseCategory) { SpecialMenuCourse c = new Course();c.description = _description;discount: Realc.category = _category;}Property: Completeness CourseCategory activity deleteMenu() {self.destroy(); Starter MainCourse} Dessert Feedback: Actions to destroy courses or tocreate menus shouldbe specified. 91. A set of operations is complete if all possible changes (inserts/updates/deletes) on all parts of the system state can be performed through theexecution of those operations. MenuCourse* IsComposedOf 2..* name: String description: String price: Realcategory: CourseCategoryactivity addCourse (in _description: String, in _category: CourseCategory) { SpecialMenuCourse c = new Course();c.description = _description;discount: Realc.category = _category;}Property: Completeness CourseCategory activity deleteMenu() {self.destroy(); Starter MainCourse} Dessertactivity addMenu () {activity deleteCourse() { activity () {Menu m = new Menu(); self.destroy(); } }} 92. contributions conclusions& further work related experimentationwork toolM2M may be evaluatedTransformationscompared throughwe extractimplemented in can also beapplied to state of syntactic the art correctness our focuses correctnesson executability solution properties has beenaddressed in completenesswe propose followsresearch researchproblem methodology 93. Model transformations need to be verified Model Executable Transformations ModelsApplication to M2M TransformationsGraph Transformation Language weak executability weak executabilitycompleteness 94. contributions conclusions& further work related experimentationwork toolM2M may be evaluatedTransformationscompared throughwe extractimplemented in can also beapplied to state of syntactic the art correctness our focuses correctnesson executability solution properties has beenaddressed in completenesswe propose followsresearch researchproblem methodology 95. Our Plug-in Alf-editor UML2Tools Alf-verifier Plug-inEclipse PlatformTool 96. Tool 97. contributions conclusions& further work related experimentationwork toolM2M may be evaluatedTransformationscompared throughwe extractimplemented in can also beapplied to state of syntactic the art correctness our focuses correctnesson executability solution properties has beenaddressed in completenesswe propose followsresearch researchproblem methodology 98. #1 experiment RelevanceProposition: writing executable models by hand is error prone students14% female | 86% male good background about modelling in UML good programming skillsTask: design acomplete set of correct Alf-basedoperations to implement a set of given requirements.Experimentation 99. #1experiment RelevanceProposition: writing executable models by hand is error prone non-syntacticallynon-executable correctness68%incomplete 55%90% 45% 32%26% 10%Experimentationsyntacticallyweakly stronglycompletecorrectexecutable 100. #1 experiment Relevancedesigners are not able to easily writecorrect executable operations by themselvesneed for methods and toolsable to evaluatethe quality of executable modelsExperimentation 101. #2experiment EfficiencyProposition:Our lightweight static tool is efficient* 6 classes13 classes100 classes 8 attributes 28 attributes 200 attributes4 associations7 associations40 associations 1 generalization 3 generalizations 10 generalizations13 constraints46 constraints100 constraints 5 operations4 operations2 operations4 actions each 11 actions each 100 actions eachExperimentation* efficiency is the ability toaccomplish a purpose with areasonable time 102. #2experiment EfficiencyProposition:Our lightweight static tool is efficient*3,6 s 3,5 s4,9 s 6 classes13 classes100 classes 8 attributes 28 attributes 200 attributes4 associations7 associations40 associations 1 generalization 3 generalizations 10 generalizations13 constraints46 constraints100 constraints 5 operations4 operations2 operations4 actions each 11 actions each 100 actions eachExperimentation* efficiency is the ability toaccomplish a purpose with areasonable time 103. #2 experiment EfficiencyProposition: Our lightweight static tool is efficient*our method isefficientand it is suitable to be integratedin the development processExperimentation* efficiency is the ability toaccomplish a purpose with areasonable time 104. contributions conclusions& further work related experimentationwork toolM2M may be evaluatedTransformationscompared throughwe extractimplemented in can also beapplied to state of syntactic the art correctness our focuses correctnesson executability solution properties has beenaddressed in completenesswe propose followsresearch researchproblem methodology 105. 1. Domain (model) 2. Properties 3. MethodRelated Work 106. 1. Domain (model) RepairingIntegrityInclude 2. Properties3. MethodFeedbackAuthors/Work Behavioural Model Constraints actions?? supported? Gogolla et al. Declarative operationsYes (all) NoValidation checksAnimationNo USE: A UML-based specification environment for (OCL) validating UML and OCL (2007) Cabot et al. Declarative operationsYes (all) NoWeak and StrongConstraint No Verifying UML/OCL Operation Contracts (2009) (OCL)ExecutabilityPgoramming Queralt et al. Declarative operationsYes (subset)No Weak Executability Query No Reasoning on UML Conceptual Schemas with (OCL)Containment Operations (2009) I. Abdelhalim et at.UML ativity diagramNoYesDeadlock free, Model CheckingNo Towards a Practical Approach to Checkand statechart diagram(fUML)consistency UML/fUML Models Consistency using CSP (2011) An integrated framework for checking the behaviour of fUML models using CSP (2012) Graw et al.UML statechart diagramNo Yes (UML)Consistency Model CheckingNo Transformation and Verification of Executable and sequence diagram UML Models (2004) Hansen et al. xUML model NoYesSafety Model CheckingNo Automated Verification of Executable UML (xUML) Models (2010) Xie et al.xUML model NoYes Domain specific Model CheckingNo Model Checking for an Executable Subset of UML (xUML)properties (2001) Bousse et al. SysML statechart YesYes (Alf) Safety Theorem proving No Aligning SysML with the B Method to Provide diagram V&V for Systems Engineering (2012) Lai et al.UML activity diagram No Yes (Alf) Basic redundanciesStatic analysisNoRelated Work Defining and verifying behaviour of domain specific language with fUML (2012) Our work Imperative Yes (subset)Yes (Alf)Syntactic Static AnalysisYesoperations correctness,executability,completeness 107. 1. Domain (model) RepairingIntegrityInclude 2. Properties3. MethodFeedbackAuthors/Work Behavioural Model Constraints actions?? supported? Gogolla et al. Declarative operationsYes (all) NoValidation checksAnimationNo USE: A UML-based specification environment for (OCL) validating UML and OCL (2007) Cabot et al. Declarative operationsYes (all) NoWeak and StrongConstraint No Verifying UML/OCL Operation Contracts (2009) (OCL)ExecutabilityPgoramming Queralt et al. Declarative operationsYes (subset)No Weak Executability Query No Reasoning on UML Conceptual Schemas with (OCL)Containment Operations (2009) I. Abdelhalim et at.UML ativity diagramNoYesDeadlock free, Model CheckingNo Towards a Practical Approach to Checkand statechart diagram(fUML)consistency UML/fUML Models Consistency using CSP (2011) An integrated framework for checking the behaviour of fUML models using CSP (2012) Graw et al.UML statechart diagramNo Yes (UML)Consistency Model CheckingNo Transformation and Verification of Executable and sequence diagram UML Models (2004) Hansen et al. xUML model NoYesSafety Model CheckingNo Automated Verification of Executable UML (xUML) Models (2010) Xie et al.xUML model NoYes Domain specific Model CheckingNo Model Checking for an Executable Subset of UML (xUML)properties (2001) Bousse et al. SysML statechart YesYes (Alf) Safety Theorem proving No Aligning SysML with the B Method to Provide diagram V&V for Systems Engineering (2012) Lai et al.UML activity diagram No Yes (Alf) Basic redundanciesStatic analysisNoRelated Work Defining and verifying behaviour of domain specific language with fUML (2012) Our work Imperative Yes (subset)Yes (Alf)Syntactic Static AnalysisYesoperations correctness,executability,completeness 108. 1. Domain (model) RepairingIntegrityInclude 2. Properties3. MethodFeedbackAuthors/Work Behavioural Model Constraints actions?? supported? Gogolla et al. Declarative operationsYes (all) NoValidation checksAnimationNo USE: A UML-based specification environment for (OCL) validating UML and OCL (2007) Cabot et al. Declarative operationsYes (all) NoWeak and StrongConstraint No Verifying UML/OCL Operation Contracts (2009) (OCL)ExecutabilityPgoramming Queralt et al. Declarative operationsYes (subset)No Weak Executability Query No Reasoning on UML Conceptual Schemas with (OCL)Containment Operations (2009) I. Abdelhalim et at.UML ativity diagramNoYesDeadlock free, Model CheckingNo Towards a Practical Approach to Checkand statechart diagram(fUML)consistency UML/fUML Models Consistency using CSP (2011) An integrated framework for checking the behaviour of fUML models using CSP (2012) Graw et al.UML statechart diagramNo Yes (UML)Consistency Model CheckingNo Transformation and Verification of Executable and sequence diagram UML Models (2004) Hansen et al. xUML model NoYesSafety Model CheckingNo Automated Verification of Executable UML (xUML) Models (2010) Xie et al.xUML model NoYes Domain specific Model CheckingNo Model Checking for an Executable Subset of UML (xUML)properties (2001) Bousse et al. SysML statechart YesYes (Alf) Safety Theorem proving No Aligning SysML with the B Method to Provide diagram V&V for Systems Engineering (2012) Lai et al.UML activity diagram No Yes (Alf) Basic redundanciesStatic analysisNoRelated Work Defining and verifying behaviour of domain specific language with fUML (2012) Our work Imperative Yes (subset)Yes (Alf)Syntactic Static AnalysisYesoperations correctness,executability,completeness 109. 1. Domain (model) RepairingIntegrityInclude 2. Properties3. MethodFeedbackAuthors/Work Behavioural Model Constraints actions?? supported? Gogolla et al. Declarative operationsYes (all) NoValidation checksAnimationNo USE: A UML-based specification environment for (OCL) validating UML and OCL (2007) Cabot et al. Declarative operationsYes (all) NoWeak and StrongConstraint No Verifying UML/OCL Operation Contracts (2009) (OCL)ExecutabilityPgoramming Queralt et al. Declarative operationsYes (subset)No Weak Executability Query No Reasoning on UML Conceptual Schemas with (OCL)Containment Operations (2009) I. Abdelhalim et at.UML ativity diagramNoYesDeadlock free, Model CheckingNo Towards a Practical Approach to Checkand statechart diagram(fUML)consistency UML/fUML Models Consistency using CSP (2011) An integrated framework for checking the behaviour of fUML models using CSP (2012) Graw et al.UML statechart diagramNo Yes (UML)Consistency Model CheckingNo Transformation and Verification of Executable and sequence diagram UML Models (2004) Hansen et al. xUML model NoYesSafety Model CheckingNo Automated Verification of Executable UML (xUML) Models (2010) Xie et al.xUML model NoYes Domain specific Model CheckingNo Model Checking for an Executable Subset of UML (xUML)properties (2001) Bousse et al. SysML statechart YesYes (Alf) Safety Theorem proving No Aligning SysML with the B Method to Provide diagram V&V for Systems Engineering (2012) Lai et al.UML activity diagram No Yes (Alf) Basic redundanciesStatic analysisNoRelated Work Defining and verifying behaviour of domain specific language with fUML (2012) Our work Imperative Yes (subset)Yes (Alf)Syntactic Static AnalysisYesoperations correctness,executability,completeness 110. 1. Domain (model) RepairingIntegrityInclude 2. Properties3. MethodFeedbackAuthors/Work Behavioural Model Constraints actions?? supported? Gogolla et al. Declarative operationsYes (all) NoValidation checksAnimationNo USE: A UML-based specification environment for (OCL) validating UML and OCL (2007) Cabot et al. Declarative operationsYes (all) NoWeak and StrongConstraint No Verifying UML/OCL Operation Contracts (2009) (OCL)ExecutabilityPgoramming Queralt et al. Declarative operationsYes (subset)No Weak Executability Query No Reasoning on UML Conceptual Schemas with (OCL)Containment Operations (2009) I. Abdelhalim et at.UML ativity diagramNoYesDeadlock free, Model CheckingNo Towards a Practical Approach to Checkand statechart diagram(fUML)consistency UML/fUML Models Consistency using CSP (2011) An integrated framework for checking the behaviour of fUML models using CSP (2012) Graw et al.UML statechart diagramNo Yes (UML)Consistency Model CheckingNo Transformation and Verification of Executable and sequence diagram UML Models (2004) Hansen et al. xUML model NoYesSafety Model CheckingNo Automated Verification of Executable UML (xUML) Models (2010) Xie et al.xUML model NoYes Domain specific Model CheckingNo Model Checking for an Executable Subset of UML (xUML)properties (2001) Bousse et al. SysML statechart YesYes (Alf) Safety Theorem proving No Aligning SysML with the B Method to Provide diagram V&V for Systems Engineering (2012) Lai et al.UML activity diagram No Yes (Alf) Basic redundanciesStatic analysisNoRelated Work Defining and verifying behaviour of domain specific language with fUML (2012) Our work Imperative Yes (subset)Yes (Alf)Syntactic Static AnalysisYesoperations correctness,executability,completeness 111. contributions conclusions& further work related experimentationwork toolM2M may be evaluatedTransformationscompared throughwe extractimplemented in can also beapplied to state of syntactic the art correctness our focuses correctnesson executability solution properties has beenaddressed in completenesswe propose followsresearch researchproblem methodology 112. Design-Science Research (DSR) is aproblem-solving methodology thatconsists of activities aimed at constructing and evaluating artifacts addressed to meetthe requirements of organizations as well asdeveloping their associatedResearch Methodology research theories. 113. Design-Science Research (DSR) Design as anArtifact DesignCommunication Evaluation of Research Correctnessproperties feedback verificationtoolResearch frameworkContributions3 International1 NationalProblemRelevance Conferences(CAiSE09, Conference(DSDM08) ResearchResearch MethodologyVL/HCC10,ER11, ER12) need for Complete and Correct Executable Schemas [Oliv et al. A Research Agenda for Conceptual Schema- Rigor Centric Development. 2007] more work is needed on model quality assessment [Genero et al. Quality of UML models. 2009]Design as a additional work remains to be done to verifySearch 2 International1 International Alf specifications [Perseil. ALF formal. 2011]ProcessWorkshops(CAiSE09, MtATL11)Demonstration (ER2012) 114. Design-Science Research (DSR) Design as anArtifact DesignCommunication Evaluation of Research Correctnessproperties feedback verificationtoolResearch frameworkContributions3 International1 NationalProblemRelevance Conferences(CAiSE09, Conference(DSDM08) ResearchResearch MethodologyVL/HCC10,ER11, ER12) need for Complete and Correct Executable Schemas [Oliv et al. A Research Agenda for Conceptual Schema- Rigor Centric Development. 2007] more work is needed on model quality assessment [Genero et al. Quality of UML models. 2009]Design as a additional work remains to be done to verifySearch 2 International1 International Alf specifications [Perseil. ALF formal. 2011]ProcessWorkshops(CAiSE09, MtATL11)Demonstration (ER2012) 115. Design-Science Research (DSR) Design as anArtifact DesignCommunication Evaluation of Research Correctnessproperties feedback verificationtoolResearch frameworkContributions3 International1 NationalProblemRelevance Conferences(CAiSE09, Conference(DSDM08) ResearchResearch MethodologyVL/HCC10,ER11, ER12) need for Complete and Correct Executable Schemas [Oliv et al. A Research Agenda for Conceptual Schema- Rigor Centric Development. 2007] more work is needed on model quality assessment [Genero et al. Quality of UML models. 2009]Design as a additional work remains to be done to verifySearch 2 International1 International Alf specifications [Perseil. ALF formal. 2011]ProcessWorkshops(CAiSE09, MtATL11)Demonstration (ER2012) 116. Design-Science Research (DSR) Design as anArtifact DesignCommunication Evaluation of Research Correctnessproperties feedback verificationtoolResearch frameworkContributions3 International1 NationalProblemRelevance Conferences(CAiSE09, Conference(DSDM08) ResearchResearch MethodologyVL/HCC10,ER11, ER12) need for Complete and Correct Executable Schemas [Oliv et al. A Research Agenda for Conceptual Schema- Rigor Centric Development. 2007] more work is needed on model quality assessment [Genero et al. Quality of UML models. 2009]Design as a additional work remains to be done to verifySearch 2 International1 International Alf specifications [Perseil. ALF formal. 2011]ProcessWorkshops(CAiSE09, MtATL11)Demonstration (ER2012) 117. contributions conclusions& further work related experimentationwork toolM2M may be evaluatedTransformationscompared throughwe extractimplemented in can also beapplied to state of syntactic the art correctness our focuses correctnesson executability solution properties has beenaddressed in completenesswe propose followsresearch researchproblem methodology 118. 1. how can the quality of executable models be decomposed intoquality properties? 2. what methods can be employed to support the verication of the quality properties of executable models? 3. what kind of feedback can help the designers to improve her executable models? 4. what types of executable models can be veried using these methods? how can the quality of UMLConclusions & Further Work executable models be improved? 119. 1. how can the quality of executable models be decomposed intoquality properties? 2. what methods can be employed to support the verication of the quality properties of executable models? 3. what kind of feedback can help the designers to improve her executable models?4. what types of executable models can be veried using these methods? quality can be decomposed into a set of quality propertiesConclusions & Further Work syntactic [weak | strong] completeness correctness executability 120. 1. how can the quality of executable models be decomposed into quality properties?2. what methods can be employed to support the verication ofthe quality properties of executable models?3. what kind of feedback can help the designers to improveher executable models?4. what types of executable models can be veried using thesemethods? lightweight and static methodsConclusions & Further Work Easy to be integrated inLimitations the development process 121. 1. how can the quality of executable models be decomposed into quality properties?2. what methods can be employed to support the verication ofthe quality properties of executable models?3. what kind of feedback can help the designers to improveher executable models?4. what types of executable models can be veried using thesemethods? feedback expressed in the sameConclusions & Further Work language used to express the input model 122. 1. how can the quality of executable models be decomposed intoquality properties? 2. what methods can be employed to support the verication of the quality properties of executable models? 3. what kind of feedback can help the designers to improve her executable models?4. what types of executable models can be veried using thesemethods? our verification methods can be applied toConclusions & Further WorkUMLM2M executable modelstransformations using Alf action languageusing ATL transformation languageor graph transformation rules 123. Extend the input model add new OCL constraints other types of UML models including actions Add new properties completeness regarding readings new semantic properties Extend our methods Alf formal specification (to use formal methods) OthersConclusions & Further Work Validate our framework in a real environment Provide guidelines to help the designers during the verification process 124. QUALITY IS NEVER AN ACCIDENT; IT IS ALWAYS THE RESULT OFINTELLIGENT EFFORTJohn Ruskin (1819-1900). Poet, Writer, Art critic