Model Checking and Code Generation for UML State Machines and Collaborations

Abstract

The “Unified Modeling Language” (UML [1]) is generally accepted as the de facto standard notation for the analysis and design of object-oriented software systems. It provides diagrams for the description of static, dynamic, and architectural aspects of systems at different levels of detail. In particular, dynamic aspects of system behavior can be specified with the help of interaction (i.e., collaboration or sequence) diagrams that describe single system runs. A more operational view is provided by UML state machines, a variant of the Statechart notation introduced by Harel [2], that are associated with instances of classes. The UML deliberately encourages the use of redundant descriptions of the same aspects of a system, for example during different phases of software development. This redundancy generates an obvious opportunity for verification and validation techniques to ensure the consistency of these descriptions. Moreover, formal methods are generally most beneficial when applied to abstract descriptions. We describe an ongoing project to develop a set of tools, tentatively called HUGO, where model checking technology is applied to relate UML state machines and interaction diagrams. Considering the state machine view as the “model” and the interaction view as the “property”, model checking can be used to ensure that a system run as specified by the interaction diagram can indeed be realised by a set of interacting state machines. In some cases, the absence of errors can be expressed as the impossibility to realise certain “erroneous” interactions. As is typical for applications of model checking, we concentrate on the control part of UML models and largely abstract from the data manipulations. While verification technology such as model checking can reveal errors in system designs, coding errors during later implementation stages may still occur. Since state machines can specify an object’s behavior in full detail, we propose to generate code directly from the UML model. Ideally, formal analysis and code generation are applied to the same model, raising the confidence in the correctness of the resulting system.