The document discusses representing belief uncertainty in software models. It proposes using a Bayesian probability approach to quantify belief uncertainty, where degrees of belief for model statements are assigned by belief agents. A UML profile and operational semantics are defined to explicitly represent belief agents and propagate credence values through dependent statements. This allows querying credence values to understand the level of confidence in different parts of the model based on the assessing agent. Future work includes associating evidence with beliefs and applying this approach to other model types.

1. Belief Uncertainty in Software Models
MISE 2019
Montreal, Canada, May 26-27, 2019
Loli Burgueño1,2, Robert Clarisó1, Jordi Cabot3,
Sébastien Gérard2 and Antonio Vallecillo4
1Open University of Catalonia, 2CEA-LIST, 3ICREA, 4University of Málaga

2. A simple example of a hotel room
2
Temp. sensor Smoke detector
Alarm center
CO detector

3. A simple example of a hotel room
3

4. System attributes, operations, and constraints
4
class AlarmCenter
attributes
hightTemp : UBoolean derive:
self.room.tempSensor.temperature > 30.0
hightCOLevel : UBoolean derive:
self.room.coSensor.coPPM > 20
smoke : UBoolean derive:
self.room.smokeDetector.smoke
fireAlert : UBoolean derive:
self.highTemp and self.highCOLevel and self.smoke
operations
isHot() : UBoolean = self.tempSensor.temperature > 25
isCold() : UBoolean = self.tempSensor.temperature < 18
constraints
inv TempPrecision: self.temperature.uncertainty() <= 0.2
[Bertoa et al “Expressing Measurement Uncertainty in OCL/UML Datatypes. ECMFA 2018: 46-62]

5. Some Belief Statements about the (model of the) system
 The CO and smoke detectors that we bought have a reliability of 90% (i.e., 10% of
their readings are not meaningful)
 We can only be 98% sure that the precision of the Temperature sensor is 0.5o, as
indicated in its datasheet
 We are 95% confident that the presence of high temperature, high CO level and
smoke really means that there is a fire in the room
 Bob is from the south, so he only assigns a credibility of 50% to the operations that
indicate if the room is hot or cold. In contrast, Mary thinks they are 99% accurate
 Room #3 is close to the kitchen and frequently emits alarms. Everybody thinks that
90% of them are false positives
 Joe the modeler doubts that the type of attribute “number” of class “Room” is Integer.
He thinks it may contain characters different from digits.
 Lucy the modeler is unsure if an “AlarmCenter” has to be attached to only one single
Room. She thinks they can also be attached to several.
5
[About the credibility of the values]
[From individual belief agents]
[About individual instances]
[About the model itself: relations]
[About the behavioral rules]
[About the uncertainty of the values]
[About the model itself: types]
>> How to represent these uncertainties in the system specifications?
>> How to incorporate them into the system structural and behavioral models?

6. The characters (in order of appearance…)
 Uncertainty
 The quality or state the involves imperfect
or unknown information
 It can be aleatory (variations in measurement) or epistemic (lack of knowledge)
 Belief uncertainty
 A kind of epistemic uncertainty in which the modeler, or any other belief agent,
is uncertain about any of the statements made about the system or its
environment. By nature, it is always subjective.
 Belief agent
 An entity (human, institution, even a machine) that holds one or more beliefs
 Belief statement
 Statement qualified by a degree of belief
 Degree of belief
 Confidence assigned to a statement by a belief agent. Normally expressed by
quantitative or qualitative methods (e.g., a grade or a probability)
6

7. Current approaches to represent and operate with Belief Uncertainty
7

8. Our contribution
 A mechanism able to assign a degree of belief to model statements
 A method to operate with the degrees of beliefs and automatically propagate
them through the system operations
How do we do that?
 Explicit representation of Belief Agents (including a default one)
 Degrees of belief represented by means of Bayesian probabilities (Credence)
 Bayesian probability is the most classical model for expressing and operating
with subjective information, and hence for quantifying beliefs
 Credence is a statistical term that refers to a measure of belief strength, which
expresses how much an agent believes that a proposition is true
 Credence values can be based entirely on subjective feelings
 Credence is better understood in the context of gambling, where this concept is
directly related to the odds at which a rational person would place a bet
 UML Profile + operational semantics
8

9. UML Profile
9

10. Operationalization
 A list of pairs (BeliefAgent,credence) for every model statement subject to
Belief Uncertainty
 Operations to add and remove pairs from the list of pairs
 Query operation to know the credence of a statement
10
isHot_Beliefs : Set(Tuple(beliefAgent : BeliefAgent, degreeOfBelief : Real))
isHot_BeliefsAdd(ba : BeliefAgent, d : Real)
post: self.isHot_Beliefs = self.isHot_Beliefs@pre->reject(t|t.beliefAgent=ba)->
including(Tuple{beliefAgent:ba,degreeOfBelief:d})
isHot_credence(a:BeliefAgent): Real =
let baBoD : … = self.isHot_Beliefs->select(t|t.beliefAgent = a) in
let baBoDnull : … = self.isHot_Beliefs->select(t|t.beliefAgent = null) in
if baBoD->isEmpty then -- no explicit credence by “a”
if baBoDnull->notEmpty then -- but if default value exists
baBoDnull->collect(degreeOfBelief)->any(true)
else 1.0 endif
else baBoD->collect(degreeOfBelief)->any(true) endif

11. Running the system…
11
Hotel> !new BeliefAgent('Bob')
Hotel> !new BeliefAgent('Mary')
Hotel> !r1.isHot_BeliefsAdd(Bob,0.5)
Hotel> !r1.isHot_BeliefsAdd(Mary,0.99)
Hotel> !r1.isHot_BeliefsAdd(null,0.95)
Hotel>
Hotel> ?r1.isHot()
-> UBoolean(true,1.0) : Uboolean
Hotel> ?r1.isHot_credence(Bob)
-> 0.5 : Real
Hotel> ?r1.isHot_credence(Mary)
-> 0.99 : Real
Hotel> ?r1.isHot_credence(null)
-> 0.95 : Real

12. Credence propagation on dependent belief statements
12
fireAlert_credence(ba:BeliefAgent): Real =
let baBoD : Set(Tuple(beliefAgent:BeliefAgent, degreeOfBelief:Real)) =
self.fireAlert_Beliefs->select(t|t.beliefAgent = ba) in
(if baBoD->isEmpty then …
else baBoD->collect(degreeOfBelief)->any(true)
endif)
* self.fireAlertDeriveExpr_credence(ba)
fireAlertDeriveExpr_credence(ba:BeliefAgent): Real =
let baBoD : Set(Tuple(beliefAgent:BeliefAgent, degreeOfBelief:Real)) =
self.fireAlertDeriveExpr_Beliefs->select(t|t.beliefAgent = ba) in
(if baBoD->isEmpty then …
else baBoD->collect(degreeOfBelief)->any(true)
endif)
* highTemp_credence(ba)
* highCOLevel_credence(ba)
* smoke_credence(ba)

13. Running the system…
13
Hotel> !r2.alarmCenter. fireAlert_BeliefsAdd(null,0.1)
Hotel> !r1.alarmCenter.fireAlert_BeliefsAdd(Bob,0.99)
Hotel> !r1.alarmCenter.fireAlertDeriveExpr_BeliefsAdd(Bob,0.95)
Hotel> !r1.alarmCenter.highTemp_BeliefsAdd(Bob,0.99)
Hotel> !r1.alarmCenter.highCOLevel_BeliefsAdd(Bob,0.99)
Hotel> !r1.alarmCenter.smoke_BeliefsAdd(Bob,0.99)
Hotel>
Hotel> ?r1.alarmCenter.fireAlert
-> UBoolean(true,0.99) : UBoolean
Hotel> ?r1.alarmCenter.fireAlert_credence(Bob)
-> 0.9125662095 : Real
Hotel> ?r1.alarmCenter.fireAlert_credence(Mary)
-> 1.0 : Real
Hotel> ?r1.alarmCenter.fireAlert_credence(null)
-> 1.0 : Real
Hotel>
Hotel> ?r2.alarmCenter.fireAlert_credence(Bob)
-> 0.04562831047 : Real

14. Conclusions and future work
 Explicit representation and management of belief uncertainty in software
models…
 …in terms of degrees of belief assigned to the model statements by separate
belief agents…
 …about the credibility of
 The values of the represented (physical) elements
 The measurement uncertainty of these values
 The expressions that model the behavior of the system
 The way in which we have modeled the system (types of the attributes, types of
relationships and their cardinalities, etc.)
 Future work
 Associating evidences to belief statements
 Representing degrees of beliefs in other types of models (use cases, sequence
diagrams, pre- and postconditions, …)
 Industrial case studies and further application domains (e.g., model inference,
model mining)
 Empirical validation with industrial modelers
14

15. Further claims (1/2)
 Claim 1: Our current software models are not fully capable of faithfully
representing all key relevant aspects of physical systems. These systems are
never crisp, they are subject to different kinds of uncertainties. This our
models should be able to reflect.
15
(http://www.christophniemann.com)

16. Further claims (2/2)
 Claim 2: Modeling notations and tools (e.g. DSLs) are of little value without
well defined methods and processes, which in turn require solid principles.
We should always ask ourselves if our modeling notations take into account
the principles that govern our physical systems, or are they mere shallow and
cosmetic descriptions of them?
16
“The man who grasps principles can successfully
handle his own methods. The man who tries methods,
ignoring principles, is sure to have trouble”
Ralph Waldo Emerson

17. Belief Uncertainty in Software Models
MISE 2019
Montreal, Canada, May 26-27, 2019
Loli Burgueño1,2, Robert Clarisó1, Jordi Cabot3,
Sébastien Gérard2 and Antonio Vallecillo4
1Open University of Catalonia, 2CEA-LIST, 3ICREA, 4Málaga University