A Formal Approach to Prove Compatibility in Transformation Networks

The increasing complexity of software and cyberphysical systems is handled by dividing the description of the system under construction into different models or views, each with an appropriate abstraction for the needs of specific roles. Since all such models describe the same system, they usually share an overlap of information, which can lead to inconsistencies if overlapping information is not modified uniformly in all models. A well-researched approach to make these overlaps explicit and resolve inconsistencies are incremental, bidirectional model transformations. They specify the constraints between two metamodels and the restoration of consistency between their instances. Relating more than two metamodels can be achieved by combining bidirectional transformations to a network. However, such a network may contain cycles of transformations, whose consistency constraints can be contradictory if they are not aligned with each other and thus cannot be fulfilled at the same time. Such transformations are considered incompatible.
In this article, we provide a formal definition of consistency and compatibility of transformations and propose an inductive approach to prove compatibility of a given network of transformations. ... mehrWe prove correctness of the approach based on these formal definitions. Furthermore, we present an operationalization of the approach at the example of QVT-R. It detects contradictions between relations by transforming them into first-order logic formulae and evaluating them with an SMT solver. The approach operates conservatively, i.e., it is not able to prove compatibility in all cases, but it identifies transformations as compatible only if they actually are. We applied the approach to different evaluation networks and found that it operates conservatively and is able to properly prove compatibility in 80% of the cases, indicating its practical applicability. Its limitations especially arise from restricted capabilities of the used SMT solver, but not from conceptual shortcomings. Our approach enables multiple domain experts to define transformations independently and to check their compatibility when combining them to a network, relieving them from the necessity to align the transformations with each other a priori and to ensure compatibility manually