Modular transformation from AF3 to nuXmv Sudeep Kanav, Vincent - PowerPoint PPT Presentation

Modular transformation from AF3 to nuXmv Sudeep Kanav, Vincent Aravantinos fortiss GmbH

Abstract • A transformation between a high-level and a low-level model • Two way • Modular • Employs reusability • Implemented in Java

Motivation Support formal verification in our MDE tool AutoFOCUS3

Preliminary: AutoFOCUS3 “AF3” (1/2) Behavior modelling Structure modelling Deployment modelling Hardware modelling …

Preliminary: AutoFOCUS3 “AF3” (2/2) • Model-based development tool for embedded systems • Execution semantics à code generation, simulation, formal verification • Integrates most development phases in one tool and connects them à models for: requirements, architecture, behavior, hardware and for connections between those: traces, deployment https://af3.fortiss.org/

nuXmv 1 • Classical symbolic model checker • Systems are modeled as finite state machines • Supports LTL 2 and CTL 3 specifications 1 https://nuxmv.fbk.eu 2 Linear temporal logic 3 Computational tree logic

What is so special?

What is so special? • Metamodel is not a toy metamodel • Reuse: reusing parts of the forward transformation in reverse transformation.

Real world metamodel • Metamodel not designed for demonstrating model transformations • Legacy metamodel: it has been evolving for 8 years • Elements implement various interfaces related to other features of the tool (e.g., UI)

Real world metamodel

Reuse • Modular design makes reuse easier • Parts of the AF3 to nuXmv transformation used for the trace interpretation

Transformation Description

Chain of transformations

Running example

Running Example t = 1 t = 2

Transformation on the running example

Transformation on the running example ToStateAutomaton

NoValResolution

ArrayToStructure

FlattenStructures

StronglyToWeaklyCausal

Counterexample Transformation • The user needs to observe the trace • Lifting the result to the user level • Instead of performing a reverse transformation, we reuse some parts of the above transformation to achieve this

Counterexample Transformation [ip] – Value of “ip” in the trace

Counterexample Transformation [ip] ⟹ [ip_PRESENT] ? [ip] : NoVal (applying NoValResolution transformation)

Counterexample Transformation [ip] ⟹ [ip_PRESENT] ? [ip] : NoVal ⟹ [ip_PRESENT] ? [[ip_elem0], [ip_elem1]] : NoVal (applying ProductToSimpleTypes transformation)