Abstract. We extend a previously proposed symbolic model transformation property prover for the DSLTrans transformation language. The original prover generated the set of path conditions (i.e., symbolic transformation executions), and verified atomic contracts (constraints on inputoutput model relations) on these path conditions. The prover evaluated atomic contracts to yield either true or false for the transformation when run on any input model. In this paper we extend the prover such that it can verify atomic contracts and more complex properties composed of atomic contracts. Besides demonstrating our prover on a simple transformation, we use it to verify different kinds of properties of an industrial transformation. Experiments on this transformation using our prover show a speed-up in verification run-time by two orders of magnitude over another verification tool that we evaluated in previous research.

The Atlas Transformation Language (ATL) is today a de-facto standard in model-driven development. It is understood by the community that methods for exhaustively verifying such transformations provide an important pillar for achieving a stronger adoption of model-driven development in industry.In this paper we propose a method for verifying ATL model transformations by translating them into DSLTrans, a transformation language with limited expressiveness. Pre-/postcondition contracts are then verified on the resulting DSLTrans specification using a symbolic-execution property prover.The technique we present in this paper is exhaustive for the declarative ATL subset, meaning that if a contract holds, it will hold when any input model is passed to the ATL transformation being checked. We explore the scalability of our technique using a set of examples, including a model transformation developed in collaboration with our industrial partner.

The Atlas Transformation Language (ATL) is currently one of the most-used model transformation languages and has become a de-facto standard in modeldriven engineering for implementing model transformations. At the same time, it is understood by the community that enhancing methods for exhaustively verifying such transformations allows for a more widespread adoption of model-driven engineering in industry. A variety of proposals for the verification of ATL transformations have arisen in the past few years. However, the majority of these techniques are either based on nonexhaustive testing or on proof methods that require human assistance and/or are not complete.In this paper, we describe our method for statically verifying the declarative subset of ATL model transformations. This verification is performed by translating the transformation (including features like filters, OCL expressions, and lazy rules) into our model transformation language DSLTrans. As we handle only the declarative portion of ATL, and DSLTrans is Turingincomplete, this reduction in expressivity allows us to use a symbolic-execution approach to generate representations of all possible input models to the transform-

No abstract