SEKE 2012 Proceedings - Knowledge Systems Institute

Fig. 4.
Configuration Model
error, feature selections which do not satisfy each constraint
should be clarified. For example, if a combination of setting
item and parameters is described by Alternative relation and
some parameters are chosen, this feature selection is invalid.
If feature selection is invalid, it is an error.
Checking correspondence relations between requirement
model and config model is used to check whether configuration
files meet execution of requirements. Therefore, consistency
checking of correspondence relations checks whether features
which are related to an instance of requirement model are
included in an instance of config model. It is an error when
features which are required by the instance of requirement
model are not included in the instance of config model.
C. Error correction
In our method, error correction means to obtain an instance
when there is no instance of configuration model. In particular,
error correction consists of detection of causes of errors and
correction of them. For example, if a combination of setting
item and parameters is described by Alternative relation,
except for choosing setting item and one parameter, the other
choosing is invalid. In particular, choosing no setting item and
one parameter or choosing no setting item and some parameters
are causes of error. In the case of the above example,
choosing setting item is the correction method when no setting
item and one parameter are chosen, and choosing setting item
and one parameter from candidates is the correction method
when no setting item and some parameters are chosen. In this
way, causes of error are defined and correction methods for
each cause are specified.
Correction method of correspondence relations between
requirement model and config model is changing configuration
files in order to satisfy requirements. Correction of configuration
file is to add lacking features which are needed to perform
requirement to an instance of config model.
Those correction methods are not enough to correct feature
selection because only adding or deleting features may
become causes of other errors. Therefore, we implemented a
mechanism which obtains an instance in Alloy.
D. Consistency checking using Alloy
We use Alloy to check configuration model automatically.
Therefore, structure and constraints of the feature diagram are
described by Alloy description, and detection and correction
method for errors are implemented in Alloy.
Alloy is a structural modeling language based on firstorder
relational logic for expressing complex structural constraints
and behaviors, and is described using finite sets and relations.
Basic notations for describing alloy models are as follows.
• sig : A signature introduces a set of atoms
• fact : Always assumed constraints
• fun : A function to a relation from another relation
• pred : A true-false judging of a relation
• run : To search for an instance of a predicate (pred)
An Alloy model consists of sig and relations of sig, which
are described in fact. Operations are described using fun.
Conditions are described using pred. These described things
are verified using the run command. The Alloy Analyzer
which is a tool to verify Alloy models is provided. The
Alloy Analyzer finds the Alloy models which satisfy a given
specification of Alloy models automatically in scopes of sig.
1) Encoding of feature diagram: The structure of feature
diagram is relations between features. Thus, name of each
feature is enumerated, and relations between features are
named and each relation is related to feature names which have
relation between them. Constraints of the feature diagram are
defined by predicate in Alloy.
2) Consistency checking: Consistency checking method for
the feature diagram checks whether chosen features satisfy
constraints of the feature diagram. In this method, constraints
675