This document discusses applying the ProMoBox framework to the GISMO domain-specific modelling language (DSML). ProMoBox shifts verification tasks to the DSM level by generating separate sublanguages for the DSML. It was applied to GISMO by annotating and simplifying the metamodel. Properties written in the GISMO syntax could then be checked and counterexamples shown. Future work includes reducing verification time/space and broadening language support while minimizing simplification requirements.

1. ProMoBox in Practice : A Case Study on the
GISMO Domain-Specific Modelling Language
1
Romuald Deshayes
Bart Meyers
Tom Mens
Hans Vangheluwe
September 30, 2014

2. ProMoBox in Practice : A Case Study on the
GISMO Domain-Specific Modelling Language
1. Introduction and problem statement
2. ProMoBox : Shifting verification to DSM level
3. The GISMO DSML
4. Simplifying GISMO
5. Applying ProMoBox to GISMO
6. Specifying and checking properties on GISMO
7. Conclusion and FW
ProMoBox in Practice 2

3. Introduction : Context of the work
Goal : providing high quality designed systems
Different activities help increase system quality :
➢ Test-Driven development
➢Design before implementing
➢ Properties checking
➢ ...
ProMoBox in Practice 3

4. Introduction : DSM in the Design Phase
Design phase is usually performed by a domain-expert
➢ No low-level detail knowledge
➢ No generic language knowledge
Domain-expert needs a Domain-Specific Modelling
Language (DSML)
conforms to
ProMoBox in Practice 4

5. Problem : Specifying and checking Properties
on DSML
Specifying Properties in LTL
Properties of the modelled system
Have to be written in LTL
ProMoBox in Practice 5

6. Problem : Specifying and checking Properties
on DSML
Specifying Properties in LTL
Properties of the modelled system
Have to be written in LTL
ProMoBox in Practice 6

7. Problem : Current Architecture
user-defined model
generated model
automatic transformation
(provided by framework)
user-defined model
generated model
automatic transformation
(manually implemented)
conforms to
automatic transformation
(manually implemented)
automatic transformation
(language level)
conforms to
DSL
InstanceModel
1
1
SuperUglyRule.ltl InstanceModel.pml
DSM
Formal methods
SPIN
3
2
3
2
Trace.txt
InstanceModel.trail
ProMoBox in Practice 7

8. Problem : Current Architecture
user-defined model
generated model
automatic transformation
(provided by framework)
user-defined model
generated model
automatic transformation
(manually implemented)
conforms to
automatic transformation
(manually implemented)
automatic transformation
(language level)
conforms to
DSL
InstanceModel
1
1
SuperUglyRule.ltl InstanceModel.pml
DSM
Formal methods
SPIN
3
2
3
2
Trace.txt
InstanceModel.trail
ProMoBox in Practice 8

9. Problem : Current Architecture
DSL
InstanceModel
1
1
SuperUglyRule.ltl InstanceModel.pml
DSM
Formal methods
SPIN
3
2
3
2
Trace.txt
user-defined model
generated model
automatic transformation
(provided by framework)
user-defined model
generated model
automatic transformation
(manually implemented)
conforms to
InstanceModel.trail
automatic transformation
(manually implemented)
automatic transformation
(language level)
conforms to
ProMoBox in Practice 9

10. Solution : shifting verification tasks up to the
DSM level
Separate languages (generated)
user-defined model
generated model
automatic transformation
(provided by framework)
user-defined model
generated model
automatic transformation
(manually implemented)
conforms to
automatic transformation
(manually implemented)
automatic transformation
(language level)
conforms to
DSL’
DSLP DSLD DSLO
1
bow
1
hasArrow
1
hasArrow.ltl bow.pml
DSLI DSLR
configuration state
5
DSM
Formal methods
counterExample
4
3 Trace.txt
3
SPIN bow.trail
2
2
ProMoBox in Practice 10

11. Solution : shifting verification tasks up to the
DSM level
ProMoBox [1] can be applied to any DSML(*)
However, some steps have to be performed
➢ Simplification of the language
➢ Annotation of the language
[1] B Meyers , R Deshayes , L Lucio , E Syriani , H Vangheluwe, M Wimmer
ProMoBox: A Framework for Generating Domain-Specific Property
Languages, SLE2014
ProMoBox in Practice 11

12. The GISMO Domain-Specific Modelling
Language (in AToMPM)
ProMoBox in Practice 12

13. Applying ProMoBox to GISMO
Manual annotation :
Annotation Design Runtime Input Output Property
x x x x
<<rt>> x x x
<<ev>> x
<<tr>> x x x x x
For each sub-language, generic metamodel elements
(template-based approach) are interwoven with DSML
metamodel elements
ProMoBox in Practice 13

14. Simplifying the GISMO metamodel
Most simplifications aim to reduce combinatorial search
space of SPIN
➢ Scalability issue inherent to model checking technique
ProMoBox in Practice 14

15. Applying ProMoBox to GISMO
Output language
Execution trace of a
Simulation, used for
counter-examples
All constructs of
GISMO' are preserved
ProMoBox in Practice 15

16. Applying ProMoBox to GISMO
Output language
Execution trace of a
Simulation, used for
counter-examples
All constructs of
GISMO' are preserved
ProMoBox in Practice 16

17. Applying ProMoBox to GISMO
Input language
Models the environment
of the system (input scenario)
Constructs of
GISMO' not annotated
with ev or tr are removed
ProMoBox in Practice 17

18. Applying ProMoBox to GISMO
Input language
Models the environment
of the system (input scenario)
Constructs of
GISMO' not annotated
with ev or tr are removed
ProMoBox in Practice 18

19. Applying ProMoBox to GISMO
Property language
template
Allows the user to define
temporal properties over
the system behaviour
4 constructs
➢ Quantification
➢ Temporal patterns
➢ Structural patterns
➢ Domain-specific pattern
(not shown)
DSM elements inherits from
PropertyElement
ProMoBox in Practice 19

20. Specifying and checking properties on GISMO
Runtime instance modelling behaviour of a bow
ProMoBox in Practice 20

21. Specifying and checking properties on GISMO
P1 : Whenever the bow is fired, the amount of available
arrows should decrement
(global variable nbarrow is represented by integer id 1).
ProMoBox in Practice 21

22. Specifying and checking properties on GISMO
P1 : Whenever the bow is fired, the amount of available
arrows should decrement
(global variable nbarrow is represented by integer id 1).
OK
ProMoBox in Practice 22

23. Specifying and checking properties on GISMO
P2 : A bow cannot be bent if there is no arrow on it.
(global variable nbarrow is represented by integer id 1).
ProMoBox in Practice 23

24. Specifying and checking properties on GISMO
P2 : A bow cannot be bent if there is no arrow on it.
(global variable nbarrow is represented by integer id 1).
ProMoBox in Practice 24

25. ProMoBox in Practice : A Case Study on the
GISMO Domain-Specific Modelling Language
Wrap up :
ProMoBox is a generative approach allowing properties
specification and verification using the DSM syntax.
Properties are checked and counter-examples can be
shown in the DSM syntax
Some minor operations have to be performed before
applying ProMoBox :
➢ Simplification of the DSM metamodel
➢ Annotation of the DSM metamodel
ProMoBox in Practice 25

26. Future Work
➢ Investigate other model checking techniques to
reduce verfication time and space
(bounded/symbolic model checking, generation
and execution of test cases)
➢ Broaden language support : languages and
properties including time
➢Minimize amount of required simplification to be
able to verify properties on full GISMO models
➢ Support masking of simplification in models
ProMoBox in Practice 26

27. ProMoBox in Practice : A Case Study on the
GISMO Domain-Specific Modelling Language
Thank You for Listenning
Questions ?
ProMoBox in Practice 27