Talk given at MODELS 2012 and various seminars about a formal definition of the concept of infinite (software design) model, and associated iterators. Preprint available at https://hal.inria.fr/hal-00716623
SensoDat: Simulation-based Sensor Dataset of Self-driving Cars
Formally Defining and Iterating Infinite Models (MODELS 2012)
1. FORMALLY DEFINING AND ITERATING
INFINITE MODELS
Benoit Combemale
University of Rennes 1, IRISA, France)
Xavier Thirioux
ENSEEIHT, IRIT, France
Benoit Baudry
Inria Rennes, France
2. Very Large Models
• Examples:
• The Eclipse platform: 5M model elements
• Civil engineering models: 7.3M model elements [Steel et al.,
SoSyM'12]
• Etc.
• Existing approaches:
• Lazy model processing [Tisi et al., MoDELS'11]
• NoSQL-based approach for model persistence [Pagán et al.,
MoDELS'11]
Context Formally Defining and Iterating Infinite Models, MODELS 2012 2
3. Models at Runtime
• Examples:
• Monitoring systems
• Adaptive systems
• Etc.
• Existing approaches:
• Models@runtime based on CEP
• Active Operations [Beaudoux et al., MODELS 2010]
Context Formally Defining and Iterating Infinite Models, MODELS 2012 3
4. Infinite Model
• Intuitive Definition:
Models whose the comprehensive set of model elements
is too large to be loaded or even not available
Context
• Challenges:
• Identify locally in an OO metamodel sources of infinity in the
conforming models.
• Understanding the exact meaning of a query over a model for which
the interpretation does not know the size at a given point in time
Formally Defining and Iterating Infinite Models, MODELS 2012 4
• Current Issues:
• Implicit and global infinite evaluation of the model
• Missing a formal and unified semantics (implementation-
independent)
5. Contributions
Contributions Formally Defining and Iterating Infinite Models, MODELS 2012 5
Let’s specify infinite models explicitly, locally,
formally, and in a implementation-independent way!
6. Contributions
1. A MOF extension to locally identify in
metamodels the infinite parts of the
conforming models
2. A corresponding coinductive semantics for
evaluating such infinite parts with OCL
iterators
Contributions Formally Defining and Iterating Infinite Models, MODELS 2012 6
7. Example: the UML State Machine
… Small and Terminating Program … Large or Non-Terminating Program
Formally Defining and Iterating Infinite Models, MODELS 2012 7Contributions
s1_1
s2_1
s2_2
s2_m
sn_1
t1
t1
t1
t2 tn-1
...
Let’s imagine the execution trace of a…
s1_1
s2_1
s2_2
s2_m
sn_1
initial
final
t1
t1
t1
t2 tn-1
...
• Ex1: lazily built at design time while exploring the graph
of reachable states
• Ex2: continuously built at run time while monitoring the
system execution
8. How Infinite Models would come?
• Let’s consider:
• Models are (complex) graphs
• Graphs conform to metamodels
• Metamodels are described using a object-
oriented meta-language
Contributions Formally Defining and Iterating Infinite Models, MODELS 2012 8
9. <<conformsTo>>
*
{ordered}
StateMachine
State Transition
source
target Trigger
initial
InjectEvent
1
1 Event
Occurence
<<enumeration>>
EventKind
endogenous
exogenous
Runtime
Event
kind: EventKind
0..1
cause
outgoing
incoming
Event
eventTo
Process
type1
1
*
*1
1
*
**
*
(Finite)
Trace
SendEvent
* effect
type
1
/nextStates
*
Excerpt from
the UML2
StateMachine
Metamodel
with a Finite
Interpretation
context State::reachableStates : Set(State) derive :
self->asSet()->closure(outgoing->collect(target));
How Infinite Models would come?
Formally Defining and Iterating Infinite Models, MODELS 2012 9Contributions
s1_1
s2_1
s2_2
s2_m
sn_1
t1
t1
t1
t2 tn-1
...s1_1
s2_1
s2_2
s2_m
sn_1
initial
final
t1
t1
t1
t2 tn-1
...
• IN BREADTH: upper bound of a collection (ex: eventToProcess)
• IN DEPTH: unfolding of a transitive closure (ex: nextStates)
<<conformsTo>>
StateMachine
State Transition
source
target Trigger
initial
InjectEvent
1
1 Event
Occurence
ω
{ordered}
<<enumeration>>
EventKind
endogenous
exogenous
Runtime
Event
kind: EventKind
0..1
cause
outgoing
incoming
Event
eventTo
Process
type1
1
*
*1
1
*
**
*
/nextStates
*
Excerpt from
the UML2
StateMachine
Metamodel
with an Infinite
Interpretation
(Infinite)
Trace
SendEvent
* effect
type
1
10. Formally Defining and Iterating Infinite Models, MODELS 2012 10
StateMachine
State Transition
source
target Trigger
initial
InjectEvent
1
1 Event
Occurence
ω
{ordered}
<<enumeration>>
EventKind
endogenous
exogenous
Runtime
Event
kind: EventKind
0..1
cause
outgoing
incoming
Event
eventTo
Process
type1
1
*
*1
1
*
**
*
/nextStates
*
Excerpt from
the UML2
StateMachine
Metamodel
with an Infinite
Interpretation
(Infinite)
Trace
*
{ordered}
SendEvent
* effect
type
StateMachine
State Transition
source
target Trigger
initial
InjectEvent
1
1 Event
Occurence
<<enumeration>>
EventKind
endogenous
exogenous
Runtime
Event
kind: EventKind
0..1
cause
outgoing
incoming
Event
eventTo
Process
type1
1
*
*1
1
*
**
*
(Finite)
Trace
SendEvent
* effect
type
11
s1_1
s2_1
s2_2
s2_m
sn_1
initial
final
t1
t1
t1
t2 tn-1
/nextStates
*
Excerpt from
the UML2
StateMachine
Metamodel
with a Finite
Interpretation
<<conformsTo>><<conformsTo>>
<<conformsTo>>
... s1_1
s2_1
s2_2
s2_m
sn_1
initial
t1
t1
t1
t2 tn-1
...
Finite Interpretation Infinite Interpretation
<<conformsTo>>
Property
lower: Integer = 1
upper : UnlimitedNatural = 1
isOrdered : Boolean = false
isComposite: Boolean = false
default: String = ""
Class
isAbstract: Boolean = false
{ordered} 0..*
ownedAttribute
0..1
opposite
NamedElement
name: String
0..*
superClass
Type TypedElement
type
1
DataType
owner
cyclic digraph
upper bound
Contributions
Let’s consider
MOF (+OCL) as
meta-language
11. How MOF/OCL Does Not Support Infinite Models?
Formally Defining and Iterating Infinite Models, MODELS 2012 11Contributions
• upper is typed by UnlimitedNatural taken from UML
• UML involves a notation for the unlimited value (*) interpreted as
bounded in the type Collection (e.g., result of the OCL iterators)
⇒ All elements are considered as available at any time of the iteration
Property
lower: Integer = 1
upper : UnlimitedNatural = 1
isOrdered : Boolean = false
isComposite: Boolean = false
default: String = ""
Class
isAbstract: Boolean = false
{ordered} 0..*
ownedAttribute
0..1
opposite
NamedElement
name: String
0..*
superClass
Type TypedElement
type
1
DataType
owner
cyclic digraph
upper bound
• The OCL closure refers to the type Collection for the result!
⇒ The closure is a finite processing, which assumes that the whole
model is available for evaluation
12. Defining Infinite Models: A MOF Extension
• Upper bound of a MOF property
• new type for upper identifying possible infinite collection
• upper: Naturalω, s.t. m < * < ω where m∈N
• Naturalω is an extension of UnlimitedNatural from MOF
• Transitive closure of a MOF property
• additional attribute in Property identifying possible infinite
unfolding (only for reflexive relation)
Contributions Formally Defining and Iterating Infinite Models, MODELS 2012 12
A B
context A::a : A derive :
self.b->collect(a)->flatten();
a 0..* b
0..*/a 0..*
13. Iterating Infinite Models: A Coinductive Semantics
• The coinductive principle
• Provides the formal and abstract foundations for reasoning
over infinite data structures
• Come equipped with a ‘produce’ operator instead of a
‘reduce’ operator in the induction principle
• Supported by some of the proof assistant
• We used COQ in our case!
• We provide:
• a CoIterate operator to iterate over infinite collections
• a CoClosure operator to infinitely unfold reflexive relations
Contributions Formally Defining and Iterating Infinite Models, MODELS 2012 13
14. Iterating Infinite Models: A Coinductive Semantics
• CoIterate over infinite collections:
• CoClosure for infinite unfolding of relations:
Contributions Formally Defining and Iterating Infinite Models, MODELS 2012 14
15. Example: the UML State Machine
• Iterating the events to be processed
• Unfolding the reachable states
Evaluation Formally Defining and Iterating Infinite Models, MODELS 2012 15
16. Conclusion & Perspectives
• Contributions
• A MOF extension (abstract and concrete syntaxes)
• Explicit identification of infinite models in metamodels
• Precise and local specification of the infinite parts in the conforming models
• A coinductive semantics (implemented using COQ)
• Formal evaluation of such infinite parts with OCL iterators
• Provides the foundations for the verification of operations that must process
models of unknown size
• Independent of various possible implementations and would be used as
reference for interoperability issues
Conclusion Formally Defining and Iterating Infinite Models, MODELS 2012 16
(object-oriented) definition and
(coinductive) semantics for iterating
(in breadth, in depth)
implementations
(lazy evaluation, models@runtime)
• Future Work:
• Investigate equivalent translations to various
implementations (platform model)
• Investigate the coiterate iterator for model transformation
(using model as accumulator) to formally deal with the
production of models at runtime.