all FREECO11-workshop-papers.pdf - trese

Towards Using Constructive Type Theory for VerifiableModular TransformationsSteffen ZschalerKing’s College London,Department of Informatics,London, UKszschaler@acm.orgIman PoernomoKing’s College London,Department of Informatics,London, UKiman.poernomo@kcl.ac.ukJeffrey TerrellKing’s College London,Department of Informatics,London, UKjeffrey.terrell@kcl.ac.ukABSTRACTModel transformations have been studied for some time, typicallyusing a semantics based on graph transformations. This has beenvery successful in defining, optimising and executing model transformations,but has been less useful for providing a firm semanticbasis for modular, reusable transformations. We propose a novelrendering of transformation semantics in terms of constructive typetheory and show how this can be employed for expressing dependenciesand guarantees of transformation modules in a formal framework.Categories and Subject DescriptorsD2.3 [Software Engineering]: Coding Tools and TechniquesKeywordsProofs-as-model-transformations, type theory, formal model drivenengineering1. INTRODUCTIONModel-Driven Engineering (MDE) focuses on using models asthe central artefact of software development, and model transformationsto turn them into executable code. Model transformationscan encode design rules, platform choices, or even coding conventions.MDE can result in better software quality because it encouragesdevelopers to focus on high-level, domain-centered concepts,which ensures consistency of implementation and reliabilityof analysis.As MDE is being used increasingly within science and industry,and transformations of interest are becoming more complex, thetrustworthiness of transformations is quite rightly receiving moreattention. The informality of MDE as it currently stands makes ituntrustworthy and therefore potentially dangerous. If model transformationsare incorrect, the MDE process can result in software ofa lower quality than that produced by traditional software development.A small number of errors in a complex transformation caneasily lead to an exponential number of errors in the resulting code,which may be difficult to trace and debug.Previous work by Terrell and Poernomo [14] has attempted tosolve this problem within a formal method known as ConstructiveType Theory (CTT). CTT possesses a property known as the Curry-Howard Isomorphism, where data, functions and their correctnessproofs can be treated as ontologically equivalent, and where a similarequivalence holds for the related trinity of typing information,program specifications and programs. A practical implication ofthe isomorphism is that, by proving the logical validity of a modeltransformation specification, we can automatically synthesize animplementation of the transformation that satisfies the specification.Following [13], we call this the proofs-as-model-transformationsparadigm.As transformations become more complex, there is an increasingneed to be able to modularise them. Some work on this hasalready been done [1, 3, 4, 6–8, 11, 12, 17, 19, 20]. However, it isstill difficult to safely reuse transformation modules as there arecurrently no techniques for expressing or verifying a transformationmodule’s dependencies. In [14], Terrell and Poernomo showedhow proofs-as-model-transformations allows us to develop a structuredapproach to provably correct model transformations, definingmaps between class hierarchies. In this paper, we sketch how thisapproach can be extended to formally express contracts for transformationmodules. In particular, we show how the higher-ordernature of CTT can enable a natural characterisation of a transformationmodule’s dependencies.2. SPECIFICATION AND DEVELOPMENTOF MODEL TRANSFORMATIONSConstructive Type Theory (CTT) as a formal method is like aconventional functional programming type system that has beenextended to include logical specifications, so that a valid type inferenceis also a proof of program certification. For example, justas we can find terms 2 and + that satisfy2:int or +:int ∗ int → intas valid type inferences in a typical functional programming language,we can also develop a term t in CTT such thatt : ∀x : int.∃y : int.GreaterP rimeNumber(x, y) (1)Any such term t is simultaneously• a program that, given an input x, will output a prime numbery greater than x satisfying GreaterP rimeNumber(x, y);• a proof that the program meets its specification.That is, t is proof-carrying code, a program and a certification ofthe program’s correctness with respect to its specification (1).We have applied the same principle to model transformations,extending the type system to accommodate EMOF like metamodelsas types so that we can develop certified model transformations tby developing a type inference of the formt : ∀x : Source.Pre(x) →∃y : Target.Post(x, y)Any such term t is simultaneously• a model transformation that, given an input model x of metamodelSource, will output a model y of metamodel Target;