🤖 AI Summary
This work addresses the undecidability of formal verification for model transformations, which stems from Turing completeness, and the path explosion problem that persists even in non-Turing-complete domain-specific languages like DSLTrans. The authors propose a scalable verification approach by establishing, for the first time, a bounded completeness theorem for a fragment of DSLTrans with respect to existential and traceability properties, thereby reducing infinite verification problems to bounded yet complete checks. Their method integrates class-boundary-aware encoding, trace-aware dependency analysis, and a CEGAR-driven refinement strategy to drastically reduce SMT formula size and eliminate spurious counterexamples. Implemented atop Z3 and integrated into a Web IDE, the tool successfully verifies 552 out of 899 properties across 29 real-world transformations, generates 345 valid counterexamples, times out on only two cases, and achieves up to a 112× speedup on challenging instances through refinement.
📝 Abstract
Model transformations are central to MDE, but formal verification is difficult because mainstream transformation languages are undecidable. DSLTrans was designed to be Turing-incomplete to improve verifiability, yet earlier verification based on path-condition enumeration still suffered exponential blow-up and did not scale to realistic cases.
We present a tractable verification workflow for DSLTrans and formalize when it is complete. The method combines three contributions: (i) a Cutoff Theorem proving that bounded model checking is complete for a precise DSLTrans fragment and positive existence/traceability properties, turning an infinite search into a finite computable bound; (ii) composable, soundness-preserving optimizations (per-class bounds, CEGAR-based fragment verification, and trace-aware dependency analysis) that reduce SMT encoding size; and (iii) a Z3-based implementation evaluated on realistic transformations from the ATL Zoo and related benchmarks.
On 29 concrete transformations and 899 properties spanning compiler lowering, schema translation, behavioral modeling, graph mapping, and stress tests, 552 properties are proved, 345 produce concrete counterexamples (including intentional negative and boundary cases), and only 2 remain undecided within timeout. For properties beyond the tractability budget, we introduce tractability-driven refinement (precondition specialization, postcondition decomposition, and transformation instrumentation), achieving up to 112x speedup while eliminating spurious counterexamples. The workflow is supported by a web IDE and a concrete execution engine for runtime validation.