In Model-Driven Engineering bidirectionality in transforma- tions is regarded as a key mechanism. Recent approaches to non-deterministic transformations have been proposed for dealing with non-bijectivity. Among them, the JTL language is based on a relational model transformation engine which restores consistency by returning all admissible models. This can be regarded as an uncertainty reducing process: the un- known uncertainty at design-time is translated into known uncertainty at run-time by generating multiple choices. Un- fortunately, little changes in a model usually correspond to a combinatorial explosion of the solution space. In this pa- per, we propose to represent the multiple solutions in a in- tensional manner by adopting a model for uncertainty. The technique is applied to JTL demonstrating the advantages of the proposal.

1. Dipartimento di Ingegneria e Scienze
Università degli Studi dell’Aquila
dell’Informazione e Matematica
Managing Uncertainty in
Bidirectional Model
Transformations
Alfonso Pierantonio
Joint work with
Romina Eramo and Gianni Rosa

2. Alfonso Pierantonio – SLE 2015, Pittsburgh (USA)
2
Bidirectionality
Bidirectionality is about keeping a set or related
models synchronized or in a consistent state:
updates to a source entail updates to the others.

3. Alfonso Pierantonio – SLE 2015, Pittsburgh (USA)
3
Bidirectionality
Bidirectionality is about keeping a set or related
models synchronized or in a consistent state:
updates to a source entail updates to the others.
Many semantic assumptions and misconceptions can
be explored by comparing
synchronization and consistency management

4. Alfonso Pierantonio – SLE 2015, Pittsburgh (USA)
4
Bidirectionality
Bidirectionality is about keeping a set or related
models synchronized or in a consistent state:
updates to a source entail updates to the others.
Many semantic assumptions and misconceptions can
be explored by comparing
synchronization and consistency management
Can we really use these terms interchangeably, do they
represent the same concept?

5. As an example, let us consider
Hierarchical State Machines
(HSM)

6. Out of Service
Off Idle
Self Test
Maintenance
Active
Authentication
Selecting
transaction
Transaction
startup
failed
doneshutdown
in(card)cancel
error
fixed
Model m1: HSM
As an example, let us consider
Hierarchical State Machines
(HSM)

7. As an example, let us consider
Hierarchical State Machines
(HSM)
and State Machines (SM)

8. As an example, let us consider
Hierarchical State Machines
(HSM)
and State Machines (SM)
Model m2: SM
in(card)
Out of Service
Off Idle
Active
shutdown
cancel
fixed
startup
done
error

9. As an example, let us consider
Hierarchical State Machines
(HSM)
and State Machines (SM)
A possible consistency relationship
between them is the following

10. Model m2: SM
Out of Service
Off Idle
Self Test
Maintenance
Active
Authentication
Selecting
transaction
Transaction
startup
failed
doneshutdown
in(card)cancel
error
fixed
Model m1: HSM
in(card)
Out of Service
Off Idle
Active
shutdown
cancel
fixed
startup
done
error

11. Alfonso Pierantonio – SLE 2015, Pittsburgh (USA)
11
A model for bidirectional transformation
Let and be two metamodels, then the relation
can be defined by means of the
following directional mappings
Stevens, Perdita. "Bidirectional model transformations
in QVT: semantic issues and open questions." Software
& Systems Modeling 9.1 (2010): 7-20.

12. Alfonso Pierantonio – SLE 2015, Pittsburgh (USA)
12
A model for bidirectional transformation
Correctness
The transformations and must enforce the
relation , ie they are said correct if
Hippocraticness
In case the models are already consistent then the
following must hold

13. Let us come back to our
State Machine example …

14. Out of Service
Off Idle
Self Test
Maintenance
Active
Authentication
Selecting
transaction
Transaction
startup
failed
doneshutdown
in(card)cancel
error
fixed

15. Out of Service
Off Idle
Self Test
Maintenance
Active
Authentication
Selecting
transaction
Transaction
startup
failed
doneshutdown
in(card)cancel
error
fixed

16. Out of Service
Off Idle
Self Test
Maintenance
Active
Authentication
Selecting
transaction
Transaction
startup
failed
doneshutdown
in(card)cancel
error
fixed
Out of Service
Off Idle
Active

17. Out of Service
Off Idle
Self Test
Maintenance
Active
Authentication
Selecting
transaction
Transaction
startup
failed
done
in(card)
Out of Service
Off Idle
Active
cancel
shutdown
error
fixed

18. cancel
Out of Service
Off Idle
Self Test
Maintenance
Active
Authentication
Selecting
transaction
Transaction
startup
failed
doneshutdown
in(card)
error
fixed
Out of Service
Off Idle
Active
shutdown
cancel
error
fixed

19. Out of Service
Off Idle
Self Test
Maintenance
Active
Authentication
Selecting
transaction
Transaction
startup
failed
doneshutdown
in(card)cancel
error
fixed
Out of Service
Off Idle
Active
shutdown
cancel
error
fixed

20. in(card)
startup
Out of Service
Off Idle
Self Test
Maintenance
Active
Authentication
Selecting
transaction
Transactionfailed
doneshutdown
in(card)cancel
error
fixed
Out of Service
Off Idle
Active
shutdown
cancel
error
fixed
startup
done

21. in(card)
startup
Out of Service
Off Idle
Self Test
Maintenance
Active
Authentication
Selecting
transaction
Transactionfailed
doneshutdown
in(card)cancel
error
fixed
Out of Service
Off Idle
Active
shutdown
cancel
error
fixed
startup
done

22. in(card)
startup
Out of Service
Off Idle
Self Test
Maintenance
Active
Authentication
Selecting
transaction
Transactionfailed
doneshutdown
in(card)cancel
error
fixed
Out of Service
Off Idle
Active
shutdown
cancel
error
fixed
startup
done

23. in(card)
startup
Out of Service
Off Idle
Self Test
Maintenance
Active
Authentication
Selecting
transaction
Transacfailed
doneshutdown
in(card)cancel
error
fixed
Out of Service
Off Idle
Active
shutdown
cancel
error
fixed
startup
done

24. in(card)
startup
Out of Service
Off Idle
Self Test
Maintenance
Active
Authentication
Selecting
transaction
Transacfailed
doneshutdown
in(card)cancel
error
fixed
Out of Service
Off Idle
Active
shutdown
cancel
error
fixed
startup
done
How this manual
change can be
back propagated?

25. in(card)
startup
Out of Service
Off Idle
Self Test
Maintenance
Active
Authentication
Selecting
transaction
Transacfailed
doneshutdown
in(card)cancel
error
fixed
Out of Service
Off Idle
Active
shutdown
cancel
error
fixed
startup
done
The update entails
multiple choices

26. This transformation is
non-deterministic
(ie. the transformation does not always
produce a unique result)

27. Alfonso Pierantonio – SLE 2015, Pittsburgh (USA)
27
Why non-determinism?
The transformation is not-deterministic because
1) The two metamodels are not isomorphic
2) Multiple update strategies are possible and the
designer did not provide a general consistency-
restoration strategy at design-time
Unknown uncertainty: the designer does not hold
enough information for deciding a priori what is the
“wanted” solution
Zan, Tao, Hugo Pacheco, and Zhenjiang Hu. "Writing
bidirectional model transformations as intentional
updates." Procs. 36th International Conference on
Software Engineering, 2014.

28. in(card)
startup
Out of Service
Off Idle
Self Test
Maintenance
Active
Authentication
Selecting
transaction
Transacfailed
doneshutdown
in(card)cancel
error
fixed
Out of Service
Off Idle
Active
shutdown
cancel
error
fixed
startup
done
An update strategy (among
the valid ones) can make
the transformation
deterministic

29. determinism
=
consistency relation
+
update strategy

30. 30
Explicit management of non-determinism
While determinism is a desirable quality
– There is no way to detect whether a bidirectional
transformation is deterministic at static-time
– Languages like QVT Relational consider only one
strategy out of the many possible alternatives
Developers have little or no control: the main reason
because bidirectionality did not hold promise
An explicit management of non-determinism in model
transformations has been investigated

31. Alfonso Pierantonio – SLE 2015, Pittsburgh (USA)
31
Languages with non-determinism
Recently a number of languages has been proposed
with an explicit management of non-determinism:
[1] A. Cicchetti, D. Di Ruscio, R. Eramo, and A. Pierantonio. JTL: a
bidirectional and change propagating transformation language. In SLE10, pages
183–202, 2010.
[2] N. Macedo and A. Cunha. Implementing QVT-R Bidirectional Model
Transformations Using Alloy. In FASE, pages 297–311, 2013.
[3] G. Callow and R. Kalawsky. A Satisficing Bi-Directional Model
Transformation Engine using Mixed Integer Linear Programming. JOT, 12(1):1:
1–43, 2013.

32. Alfonso Pierantonio – SLE 2015, Pittsburgh (USA)
32
JTL
The JTL language provide an explicit support to non-
determinism, intended as
“. . . programmers need only specify a consistency relation,
allowing the bx engine to resolve the under-specification
non-deterministically” [1]
All valid solutions are generated at once
[1] F. Abou-Saleh, J. Cheney, J. Gibbons, J. McKinna,
and P. Stevens. Notions of Bidirectional Computation
and Entangled State Monads. MPC, 187–214, 2015.

33. Alfonso Pierantonio – SLE 2015, Pittsburgh (USA)
33
A model for non-deterministic transformations
Let and be two metamodels, then the relation
can be defined as follows
where and are multivalued functions, ie left-
total relations in which inputs are associated with
multiple outputs.

34. Alfonso Pierantonio – SLE 2015, Pittsburgh (USA)
34
A model for non-deterministic transformations
Correctness
The transformations and must enforce the
relation , ie they are correct if
Hippocraticness
In case the models are already consistent then the
following must hold

35. Little changes, big impact

36. startup
Out of Service
Off Idle
Self Test
Maintenance
Active
Authentication
Selecting
transaction
Transactionfailed
done
shutdown
in(card)cancel
error
fixed
in(card)
Out of Service
Off Idle
Active
shutdown
cancel
fixed
startup
error
error
error
error
error
#error = 3

37. startup
Out of Service
Off Idle
Self Test
Maintenance
Active
Authentication
Selecting
transaction
Transactionfailed
shutdown
in(card)cancel
error
fixed
in(card)
Out of Service
Off Idle
Active
shutdown
cancel
fixed
startup
error
Printing
done
print
Printing
print
printprintprint
error
error
error
error
done
#error = 3
#done = 1
#print = 4

38. startup
Out of Service
Off Idle
Self Test
Maintenance
Active
Authentication
Selecting
transaction
Transactionfailed
shutdown
in(card)cancel
error
fixed
in(card)
Out of Service
Off Idle
Active
shutdown
cancel
fixed
startup
completed
error
Printing
done
print
Printing
print
printprintprint
completed
completed completed completed
error
error
error
error
done
#error = 3
#done = 1
#print = 4
#completed = 4

39. 39
Little changes, big impact
Little changes in one of the source, cause a
combinatorial explosion of alternatives in the other
one
For instance, the overall number of models in the
State Machine example is
3 x 4 x 4 x 1 = 48
Dealing with the myriad of generated models is
intrinsically difficult if not impractical
#error = 3
#done = 1
#print = 4
#completed = 4

40. Alfonso Pierantonio – SLE 2015, Pittsburgh (USA)
40
Intensional representation of the
solution space
We need a construction which permits an intentional
representation of the solution space
Therefore, instead of generating a multitude of
models, we want to represent the solution space of a
non-deterministic transformation with a model with
uncertainty.
R. Eramo, A. Pierantonio, and G. Rosa. Uncertainty in
bidi- rectional transformations. In Procs. of MiSE
2014, 2014.

41. Alfonso Pierantonio – SLE 2015, Pittsburgh (USA)
41
Models with Uncertainty
Given a metamodel M it is possible to derive its
metamodel with uncertainty U(M) by means of an
automated construction.
A model with uncertainty is used to intensionally
represent all the alternative models
generated by a non-deterministic transformation.
R. Eramo, A. Pierantonio, and G. Rosa. Uncertainty in
bidi- rectional transformations. In Procs. of MiSE
2014, 2014.

42. HSM
U(HSM)

43. Alfonso Pierantonio – SLE 2015, Pittsburgh (USA)
43
A model for transformations with uncertainty
The directional mappings and can be
reformulated as
such that
where
with

44. Alfonso Pierantonio – SLE 2015, Pittsburgh (USA)
44
JTL extention to uncertainty
In order to let JTL generate models with uncertainty
for the solution space
1. the “intersection” shared among all choices and
2. the uncertain parts
must be identified.

45. Alfonso Pierantonio – SLE 2015, Pittsburgh (USA)
45
JTL extention to uncertainty
startup
Out of Service
Off Idle
Self Test
Maintenance
Active
Authentication
Selecting
transaction
Transactionfailed
shutdown
in(card)cancel
error
fixed
Printing
print
printprintprint
completed
completed completed completed
error
error
error
done

46. Alfonso Pierantonio – SLE 2015, Pittsburgh (USA)
46
JTL extension to uncertainty
JTL engine is a logic program written in ASP and
non-deterministically resolved by the DLV solver, it
can derive how models are related by means of a
deductive process
Traceability management offers enough information
to understand how the models can be factorized
Tracing information stores relevant details about the
linkage between source and target model elements
at run-time.

47. Alfonso Pierantonio – SLE 2015, Pittsburgh (USA)
47
JTL extension to uncertainty
In essence, given the application
the complete tracing domain is determined as
the collection of all tracing links r(a) = b
Def. An uncertainty point is a set of trace links in
such that if
are two distinguished links in , then

48. Alfonso Pierantonio – SLE 2015, Pittsburgh (USA)
48
JTL extension to uncertainty
startup
Out of Service
Off Idle
Self Test
Maintenance
Active
Authentication
Selecting
transaction
Transactionfailed
shutdown
in(card)cancel
error
fixed
Printing
print
printprintprint

49. This the EMF model with
uncertainty representing all
148 solutions.
Designer can easily
inspect it instead of
navigating the solution
space and for each pair of
models finding the
differences!

50. Alfonso Pierantonio – SLE 2015, Pittsburgh (USA)
50
Experiment
We considered a JTL HSM2SM transformation
consisting of 10 relations
1. The transformation has been (forward) applied to
a model with 20 elements, 29 association and 30
attributes
2. The target model has been increasingly modified
and the transformation (backward) reapplied
The program has been executed on a machine with
an Intel Core i7-4790K 4.00Ghz processor and 8Gb
RAM, running Windows 8.1

51. Alfonso Pierantonio – SLE 2015, Pittsburgh (USA)
51
Experiment
CPU time #model elements Memory

52. Alfonso Pierantonio – SLE 2015, Pittsburgh (USA)
52
Conclusions
The explicit management of non-determinism in
bidirectional transformations is an uncertainty
reducing process
The unknown uncertainty during design-time
translates into known (or bound) uncertainty during
run-time
Managing the non-determinism is not enough
because of the combinatorial explosion of
alternatives