Managing Design-Time Uncertainty Michalis Famelis, Marsha Chechik - PowerPoint PPT Presentation

Managing Design-Time Uncertainty Michalis Famelis, Marsha Chechik MODELS 2017 Austin TX, USA

Uncertainty in Software Development Many design alternatives Incomplete information Conflicting stakeholder opinions Uncertain inty durin ring th the desig sign of f so soft ftware.

Uncertainty in: Envir ironment Desig sign-tim ime What conditions will the system What should the system be like? operate in? Main concern: Main concern: adapting to change making design decisions Mitigated by uncertainty-aware Mitigated by uncertainty-aware software development methodology sof software sof

Management of Design-Time Uncertainty Key development goals: Quality Speed (time to market) What can developers do? Make a provis isional decision and “run with it” Wai ait until uncertainty gets resolved Fork and maintain a set of solutions We propose: De Defer reso solu lution of uncertainty but incorporate uncertainty handling into the development process to allow progress

Outline • Partial Models: Articulation • Semantics of uncertainty • Notation • Lifting: • Verification Deferral • Diagnosis • Transformation of decisions • Refinement Resolution • Decision-making of uncertainty • Methodology and Tool Support • Worked-out Examples • Conclusion, Future Work

Outline • Par artial l Mod odels ls: • Se Articulation Semantics • Notation • Lifting: • Verification • Diagnosis Deferral • Transformation • Refinement • Decision-making Resolution • Methodology and Tool Support • Worked-out Examples • Conclusion, Future Work

Design-time Possibilities Uncertainty Desig Des ign dec decis isio ions assumed kno ass known Known Known Knowns Unknowns Alt lternativ ive sol solutions ass assumed el elic icited Unknown Unknowns US Secretary of Defense, Donald Rumsfeld discusses Iraqi WMDs, February 12, 2002

Representing Uncertainty with Partial Models Semantics: Solver Solver Solver May element SolverException SolverException x Propositional variable: Unsure if it should “the element exists” be an inner class. x=F, y=F x=T, y=F Solver SolverException Solver + effect : String SolverException SolverException + effect : String y + effect : String x=F, y=T x=T, y=T X v Y May formula Concretization

Outline • Partial Models: • Semantics Articulation • Notation • Lifting: • Verification • Diagnosis Deferral • Transformation • Refin inement • De Resolution Decis ision-makin ing • Methodology and Tool Support • Worked-out Examples • Conclusion, Future Work

Refinement: Reduce the Set Solver Solver Solver SolverException SolverException Operationally: make a decision x x=F, y=F x=T, y=F Solver SolverException Solver + effect : String SolverException SolverException + effect : String y + effect : String x=F, y=T x=T, y=T (X v Y) ¬(X (X Λ Y) Y) Λ Declaratively: with a property [ICSE’12] Partial Models: Towards Modeling and Reasoning with Uncertainty, M. Famelis, R. Salay and M. Chechik

Outline • Partial Models: • Semantics Articulation • Notation • Lif Liftin ing: : • Verification • Di Diagnosis is Deferral • Tran ansformation • Refinement • Decision-making Resolution • Methodology and Tool Support • Worked-out Examples • Conclusion, Future Work

Deferring Uncertainty Resolution DOES NOT COMPUTE MAKE D MAKE DECISIO ECISIONS FIR NS FIRST ST Automated Procedure

Deferral Through “Lifting” Verification: thorough checking. Transformations: preservation of set of concretizations. Development can continue with Automated Procedure Adapting automation to work with partial models

Lifting Verification Example property: “Every inner class has at least one attribute” Property holds for… …all concretizations …some but not all …none Lifted SAT-based + effect : String verification • Applies directly to the partial model • Does not not enumerate concretizations • Computes result using three-valued logic [ICSE’12] Partial Models: Towards Modeling and Reasoning with Uncertainty, M. Famelis, R. Salay and M. Chechik

Lifting Transformations ? [MODELS 2013] Transformation of Models Containing Uncertainty, M. Famelis, R. Salay, A. Di Sandro and M. Chechik

Lifting Transformations [MODELS 2013] Transformation of Models Containing Uncertainty, M. Famelis, R. Salay, A. Di Sandro and M. Chechik ?

Lifting Transformations [MODELS 2013] Transformation of Models Containing Uncertainty, M. Famelis, R. Salay, A. Di Sandro and M. Chechik

Lifting Transformations Design decisions not affected Neither is the transformation! Step 1: St 1: St Step 2: 2: St Step 3: 3: Determine applicability Transform graph Transform constraints [MODELS 2013] Transformation of Models Containing Uncertainty, M. Famelis, R. Salay, A. Di Sandro and M. Chechik

Outline • Partial Models: • Semantics Articulation • Notation • Lifting: • Verification • Diagnosis Deferral • Transformation • Refinement • Decision-making Resolution • Methodology an and Too ool l Su Support • Worked-out Examples • Conclusion, Future Work

UMLet Bug #10 Articulation K0 K1 Make Partial Deferral Resolution

Uncertainty Lifecycle Management Articulation degree of Uncertainty of uncertainty Deferral of decisions Time • Degree of uncertainty: size of the set of concretizations Resolution • Ultimately, a single concrete model: all uncertainty resolved of uncertainty

Design-Time Uncertainty Management (DeTUM) model doWork newUncertainty Deferral of decisions newInformation moreWork

Uncertainty Management Operators • Construct Articulation • MakePartial • Expand of uncertainty doWork • newUncertainty Decide • Constrain • Transform Deferral • Verify • Deconstruct • Generate Counter of decisions Example • Generate Example • Generate newInformation moreWork Diagnostic Core more Uncertainty Resolution of uncertainty moreInformation

Example Operator Specification Con onstruct Nam ame Des Descrip iption Create a partial model from a given set of concrete models that are alternative resolutions to uncertainty. Inp Inputs A set of non-partial models. Ou Outputs A partial model. Us Usage context The developer has at their disposal a known, fully enumerated set of alternative models, but has insufficient information about which of the models is best suited for their purpose. Precondit itions No partial model exists. The set of models must be known and fully enumerated. Pos ostconditions The resulting partial model is in Graphical Reduced Form (GRF) and its set of concretizations is exactly the set of input models. Lim Limitations The developer must have the full knowledge of the input set. Imp Implementatio ion Described in [ICSE’12] as operator “OP1: Construction”. [ICSE’12] Partial Models: Towards Modeling and Reasoning with Uncertainty, M. Famelis, R. Salay and M. Chechik

MU-MMINT (pronounced “moomin”) Verification & Partial Model Decision Tree Dashboard & Lifted Refinement Editor Editor Traceability Transformations Support MMINT: “Model Management INTeractive ” Henshin Graph Eclipse Z3 SMT Solver Transformation Engine MU-MMINT demo: https://youtu.be/kAWUm-iFatM MMINT demo: https://youtu.be/7B7YuV-Jvrc Available at https://github.com/adisandro/MMINT [ICSE 2015] MU-MMINT: an IDE for Model Uncertainty, M. Famelis, N. Ben-David, A. Di Sandro, R. Salay, and M. Chechik [MODELS’15] MMINT: A Graphical Tool for Interactive Model Management, A. Di Sandro, R. Salay, M. Famelis, S. Kokaly, and M. Chechik,

Outline • Partial Models: • Semantics Articulation • Notation • Lifting: • Verification • Diagnosis Deferral • Transformation • Refinement • Decision-making Resolution • Methodology and Tool Support • Worked-out Exam amples • Conclusion, Future Work

Metamodel to Relational Schema Scenario: create a metamodel for Petri nets, then create a schema for storing them Place Token Transition • Atlas Metamodel zoo: 8 different designs / 5 design decisions • Partial model N0 created using MU-MMINT • Demo partial model editor • Demo Verification and Diagnosis • Demo Transformation

Petri Net Metamodel Additional uncertainty: 76 elements, 18 concretizations Which domain-specific extensions should the metamodel support? Articulation/1 1:doWork N0 Construct Design New partial model with 117 Decisions elements, 360 concretizations. Articulation/2 3:moreUncertainty N2 N3 Expand Partial relational schema model, 192 elements U3: Diagram element locations are stored Resolution/1 Deferral/1 2sec 2:newInfo N0 N1 Maybe N2 N0 Transform Verify(U3) Decide 4:doWork Object- Relational 114 sec Resolution/2 Deferral/2 5:newInfo Mapping N3 N4 Transform N3 N5 transformation Decide with 5 layered Partial relational schema Henshin rules model, 293 elements

Lessons Learned from Worked Examples Must better support Articulation with automation Stages of DETUM not rigid (Verification/Diagnosis) May formula makes engineering of lifting hard Changing modality of properties may be more appropriate response to bad verification result