Trace-based Approach to Editability and Correspondence Analysis for Bidirectional Graph Transformations

Transcription

1 Trace-base Approach to Eitability an Corresponence Analysis for Biirectional Graph Transformations Soichiro Hiaka National Institute of Informatics, Japan Martin Billes Technical University of Darmstat, Germany Quang Minh Tran Daimler Center for IT Innovations, Technical University of Berlin, Germany Kazutaka Matsua Tohoku University Abstract Biirectional graph transformation is expecte to play an important role in moel-riven software engineering where artifacts are often refine through compositions of moel transformations, by propagating changes in the artifacts over transformations biirectionally. However, it is often ifficult to unerstan the corresponence among elements of the artifacts. The connections view elements have among each other an with source elements, which lea to restrictions of view eitability, an parts of the transformation which are responsible for these relations, are not apparent to the user of a biirectional transformation program. These issues are critical for more complex transformations. In this paper, we propose an approach to analyzing the above corresponence as well as to classifying eges accoring to their eitability on the target, in a compositional framework of biirectional graph transformation where the target of a graph transformation can be the source of another graph transformation. These are achieve by augmenting the forwar semantics of the transformations with explicit corresponence traces. By leveraging this approach, it is possible to solve the above issues, without executing the entire backwar transformation. Keywors: Biirectional Graph Transformation, Traceability, Eitability Copyright c by the paper s authors. Copying permitte for private an acaemic purposes. In: A. Cunha, E. Kinler (es.): Proceeings of the Fourth International Workshop on Biirectional Transformations (Bx 2015), L Aquila, Italy, July 24, 2015, publishe at 51

2 1 Introuction Biirectional transformations has been attracting interisciplinary stuies [5, 20]. In moel-riven software engineering where artifacts are often refine through compositions of moel transformations, biirectional graph transformation is expecte to play an important role, because it enables us to propagate changes in the artifacts over transformations biirectionally. A biirectional transformation consists of forwar (F) an backwar (B) transformations [5, 20]. F takes a source moel (here a source graph [15, 16]) G S an transforms F it into a view (target) graph G V. B takes an upate view graph G G S G V V an returns an upate source graph G S, with possibly propagate upates. eit In many, especially complex transformations, it is not immeiately apparent G S G whether a view ege has its origin in a particular source ege or a part (for example, V B operators or variables) in the transformation, an what that part is. Thus, it is not easy to tell where eits to the view ege are propagate back to. Moreover, in a setting in which usual strong well-behave properties like PutGet [8] is relaxe to permit the backwar transformation to be only partially efine, like WPutGet (WeakPutGet) [13, 16], it is not easy to preict whether a particular eit to the view succees. In particular, backwar transformation rejects upates if (1) the label of the eite view ege appears as a constant of the transformation 1, (2) a group of view eges that are originate from the same source ege are eite inconsistently or (3) eits of view eges lea to changes in control flow (i.e., ifferent branch is taken in the conitional expressions) in the transformation. If a lot of eits are mae at once, it becomes increasingly ifficult for the user to preict whether these eits are accepte by backwar transformation. Biirectional transformations are known for being har to comprehen an preict [7]. Two features are esirable: 1) Explicit highlighting of corresponence between source, view an transformation 2) Classification of artifacts accoring to their eitability. This way, prohibite eits leaing to violation of preefine properties (well-behaveness) can be recognize by the user early. Our biirectional transformation framework calle GRounTram (Graph Rountrip Transformation for Moels) [18, 15, 16] features compositionality (e.g., the target of a sub-transformation can be the source of another sub-transformation), a user-frienly surface syntax, a tool for valiating both moels an transformations with respect to KM3 metamoels, an an performance optimization mechanism via transformation rewriting. It suffers from the above issues. To fix this, we have incorporate these features by augmenting the forwar semantics with explicit trace information. Our main contribution is to externalize enough trace information through the augmentation an to utilize the information for corresponence an eitability analysis. For the user, corresponing elements in the artifacts are highlighte with ifferent colors accoring to eitability an other properties. There are some existing work with similar objectives. Traceability is stuie enthusiastically in moel-riven engineering [9, 25]. Van Amstel et al. [30] propose a visualization of traces, but in the uniirectional moel transformation setting. We focus on the backwar transformation to give enough information on eitability of the views for the programmer of the transformation an the users who eit the views. For classification of elements in the view, Matsua an Wang s work [24], an extension of the semantic approach [31] to general biirectionalization, is also capable of a similar classification, while we reserve opportunities to recommen a variety of consistent changes for more complex branching conitions. In aition, our approach can trace between noes of the graph, not just eges. More etails can be foun in the relate work section (Section 6). The rest of the paper is organize as follows: Section 2 overviews our motivation an goal with a running example. More involve examples can be foun on our project website at gtcontrib/cmpbx/. Section 3 summarizes the semantics of our unerlying graph ata moel, core graph language UnCAL [3], an its biirectional interpretation [13]. Section 4 introuces an augmente semantics of UnCAL to generate trace information for the corresponence an eitability analysis. Section 5 explains how the augmente forwar semantics can be leverage to realize corresponence an eitability analysis. An implementation is foun at the above website. Section 6 iscusses relate work, an Section 7 conclues the paper with future work. The long version of our paper [12] inclues some non-essential technical etails that are omitte in this paper. 1 In this case, the constant in the transformation is pointe out so that user can consier changing it in the transformation irectly. 52

3 {&} 26 country country country name people language continent name people continent language continent language name people Japan ethnicgroup Japanese Asia Germany ethnicgroup Europe German Austria ethnicgroup Japanese German Austrian {&} 0 result result language locate ethnic language locate ethnic German Europe Austrian German Europe German Figure 2: View Graph Generate by Transformation of the Graph in Fig. 1 Figure 1: Example Source Graph 2 Motivating Example This section exemplifies the importance of the esirable features mentione in Sect. 1. Let us consier the source graph in Fig. 1 consisting of fact book information about ifferent countries, an suppose we want to extract the information for European countries as the view graph in Fig. 2. This transformation can be written in UnQL (the surface language as a syntactic sugar of the target language UnCAL) as below. select {result: {ethnic: $e, language: $lang, locate: $cont}} where {country: {name:$g, people: {ethnicgroup: $e}, language: $lang, continent: $cont}} in $b, {$l:$any} in $cont, $l = Europe Listin: Transformation in UnQL S1: In the view graph (Fig. 2), three eges have ientical labels German (3, German, 1), (4, German, 2) an (12, German, 11), but have ifferent origins in the source graph an are prouce by ifferent parts in the transformation. For example, the ege ζ = (3, German, 1) is the language of Germany an is a copy of the ege (1, German, 0) of the source graph (Fig. 1). On the other han, ζ has nothing to o with the ege (11, German, 10) of the source graph espite ientical labels. This later ege enotes the ethnic group instea. In aition, ζ is copie by the graph variable $lang in the select part of the transformation. Other graph variables an ege constructors o not participate in creating ζ. It woul be much easier for the user to unerstan, if the system visually highlights corresponing elements between source graph, view graph an transformation to increase comprehensibility. S2: In this example, the non-leaf eges of the view graph ( result, locate, language an ethnic ) are constant eges in the sense that they cannot be moifie by the user in the view. Ieally, the system shoul make such constant eges easily recognizable to prevent the eits in the view an guie the user to make an eit to the constant in the transformation instea. S3: In another scenario, the user ecies that the language of Germany shoul better be calle German (Germany) an the language of Austria be calle Austrian German an thus rename the view eges (3, German, 1) an (4, German, 2) to (3, German (Germany), 1) an (4, Austrian German, 2) accoringly. However, the backwar transformation rejects this moification because these two view eges originate from the language German in a single ege of the source graph. The backwar propagation of two eits woul conflict at the source ege. Ieally, the system woul highlight groups of eges that coul cause the conflict, an woul prohibit triggering the backwar transformation in that case. S4: Finally, suppose both of the eges labele Europe in the view graph are eite to Eurasia. Although this time these upates woul be propagate to the same originating source ege (3, Europe, 2) without conflict, since the transformation epens on the label of this ege, changing it woul lea to the selection of another conitional path in the transformation in a subsequent forwar transformation. The renaming woul cause an empty view after a roun-trip of backwar an forwar transformation. To prevent this, such eits are rejecte 53

4 in our system. Changes in the control flow are very ifficult or impossible to preict if the transformation is too complex. We can assist the preiction by highlighting the conitional branches involve. Formal property As a remark, our eitability checking is soun in the sense that the eits that passe the checking always succee. We provie a proof sketch in Section 5. Using this property an analysis, aitional interesting observations can be mae. In the Class2RDB example on our project website, there is no ege in the view for which the above last warning is cause. Thus, the transformation is fully polymorphic in the sense that all eges that come from source graph are free from label inspection in the transformation. Note that this eitability property may not be fully etermine by just looking at the transformation. Non-polymorphic transformations may still prouce views that avoi the warning. For example, select $g where {a:$g} in $b is not polymorphic, but the eits on eges in the view never cause conition expressions to be change, because they are not inspecte (they are inspecte by bulk semantics explaine in the next section but left unreachable). Tracing mechanism Though the eitability analysis is powerful enough to, for example, cope with complex interactions between graph variables an label variables, the unerlying iea is simple. For the analysis of a chain of transformations, if an ege ζ is relate to ζ in the first transformation an ζ is relate to ζ in the secon transformation, then trace information allows to relate ζ an ζ, possibly with the occurrence information of the language constructs in the transformation that create these eges. The variable bining environment is extene to cope with this analysis. Support of eiting operations other than ege renaming As another remark, this paper focuses on upates on ege labels, an trace information is esigne as such. However, we can relatively easily exten the ata structure of the trace to cope with ege eletion. The ata structure alreay supports noe tracing, so insertion operation can be supporte by highlighting the noe in the source on which a graph will be inserte. Support of permissive biirectional transformation The biirectional transformation we are ealing with uner relaxe notion of consistency, i.e., WeakPutGet as mentione in the introuction, in fact is permissive in users eits. For example, in the above scenario S3, if the user eits only one of the view ege, then the backwar transformation successfully propagates the changes to the source ege, though the upate view graph on the whole is not perfectly consistent if we efine source s an view v to be consistent if an only if gets = v where get is the forwar transformation, because another forwar transformation from the upate source woul propagate the new ege label to the other copy ege in the view graph. The perfectly consistent view graph woul have been the one which all the eges originating from a common source ege are upate to the same value. However, it might be har for the users to ientify all these copies. Therefore, our system accepts upates in which only one copy is upate in the view. Borrowing the notion of egree of consistency by Stevens [28], such upate views are (strictly) less consistent than the perfect one but still tolerate. 3 Preliminaries We use the UnCAL (Unstructure CALculus) query language [3]. UnCAL has an SQL-like syntactic sugar calle UnQL (Unstructure Query Language) [3]. Listin is written in UnQL. Biirectional execution of graph transformation in UnQL is achieve by esugaring the transformation into UnCAL an then biirectionally interpreting it [13]. This section explains the graph ata moel we use, as well as the UnCAL an UnQL languages. 3.1 UnCAL Graph Data Moel UnCAL graphs are multi-roote an ege-labele with all information store in ege labels ranging over Label {ε} (Label ε ), noe labels are only use as ientifiers. There is no orer between outgoing eges of a noe. The notion of graph equivalence is efine by bisimulation; so equivalence between the graphs is efficiently etermine [3], an graphs can be normalize [16] up to isomorphism. Fig. 3 shows examples of our graphs. We represent a graph by a quaruple (V, E, I, O). V is the set of noes, E the set of eges ranging over the set Ege ε, where an ege is represente by a triple of source noe, label an estination noe. I : Marker V is a function that ientifies the roots (calle input noes) of a graph. Here, Marker is the set of markers of which element is enote by &x. We may call a marker in om(i) (omain of I) an input marker. A special marker & is calle the efault marker. O V Marker assigns noes with markers calle output markers. If (v, &m) O, v is calle an output noe. Intuitively output noes serve as exit points where 54

5 1 a b a 5 & b a c (a) & 1 3 b (b) b 4 Figure 3: Cyclic graph examples e ::= {} {l : e} e e &x := e &y () e e e cycle(e) { constructor } $g { graph variable } if l = l then e else e { conitional } let $g = e in e llet $l = l in e { variable bining } rec(λ($l, $g).e)(e) { structural recursion application } l ::= a $l { label (a Label) an label variable } Figure 4: Core UnCAL Language input noes serve as entry points. For example, the graph in Fig. 3 (a) is represente by (V, E, I, O), where V = {1, 2, 3, 4, 5, 6}, E = {(1, a, 2), (1, b, 3), (1, b, 4), (2, a, 5), (3, a, 5), (5,, 6), (6, c, 3)}, I = {& 1}, an O = {}. Each component of the quaruple is enote by the. syntax, such as g.v for V of graph g = (V, E, I, O). The type of a graphs is efine as the pair of the set of its input markers X an the set of output markers Y, enote by DB X Y. The graph in Fig. 3 (a) has type DB {&}. The superscript may be omitte, if the set is {&}, an the subscript likewise, if the set is empty. The type of this graph is simply enote by DB. 3.2 UnCAL Query Language Graphs can be create in the UnCAL query language [3], where there are nine graph constructors (Fig. 4) whose semantics is illustrate in Fig. 5. We use hooke arrows ( ) stacke with the constructor to enote the computation by the constructors where the left-han sie is the operan(s) an the right-han sie is the result. There are three nullary constructors. () constructs a graph without any noes or eges, so F[[()] DB, where F[[e] enotes the (forwar) evaluation of expression e. The constructor {} constructs a graph with a noe with efault input marker (&) an no eges, so F[[{}]] DB. &y constructs a graph similar to {} with aitional output marker &y associate with the noe, i.e., F[[&y]] DB {&y}. The ege constructor { : } takes a label l an a graph g DB Y, constructs a new root with the efault input marker with an ege labele l from the new root to g.i(&); thus {l : g} DB Y. The union g 2 of {} & &y & () &y &x &y 1... &y m := l & & l g {_:_} 1 &y 1...&y m &y 1...&y m &x.&y 1...&x.&y m g &z 1... &z n &z 1... &z n &x 1...&x m cycle &x 1...&x m &x 1...&x m &y 1... &y n &y 1... &y n &x 1... &x m &x 1...&x m &x 1... &x m ε ε ε ε g 2 g 2 &y 1...&y m &y... 1 &y n &y 1...&y m &y... 1 &y n ε g ε &x 1...&x m &y 1... &y n &x 1...&x m &y 1... &y n g 2 g 2 & x x & y y & x x & y y 1 & m 1 & n 1 & m 1 &x 1...&x m &x 1...&x m & x x &z 1... &z k 1 & m & x x & z z 1 & m g 2 1 &y 1... &y n & ε... ε g 2 &y 1... &y n & n Figure 5: Graph Constructors of UnCAL 55

6 graphs DB X Y 1 an g 2 DB X Y 2 with the ientical set of input markers X = {&x 1,..., &x m }, constructs m new input noes for each &x i X, where each noe has two ε-eges to.i(&x i ) an g 2.I(&x i ). Here, ε-eges are similar to ε-transitions in automata an use to connect components uring the graph construction. Clearly, g 2 DB X Y 1 Y 2. The input noe renaming operator := takes a marker &x an a graph g DB Y Z with Y = {&y 1,..., &y m }, an returns a graph whose input markers are prepene by &x, thus (&x := g) DB &x.y Z where the ot. concatenates markers an forms a monoi with &, i.e., &.&x = &x.& = &x for any marker &x Marker, an &x.y = {&x.&y 1,..., &x.&y m } for Y = {&y 1,..., &y m }. In particular, when Y = {&}, the := operator just assigns a new name to the root of the operan, i.e., (&x := g) DB {&x} Y for g DB Y. The isjoint union g 2 of two graphs DB X X an g 2 DB Y Y with X Y =, the resultant graph inherits all the markers, eges an noes from the operans, thus g 2 DB X Y X Y. The remaining two constructors connect output an input noes with matching markers by g 2 appens DB X X Z an g 2 DB X Z Y by connecting the output an input noes with a matching subset of markers X, an iscars the rest of the markers, g 2 DB X Y. An iiom 2 projects (selects) one input marker &x an renames it to efault (&), while iscaring the rest of the input markers (making them unreachable). The cycle construction cycle(g) for g DB X X Y with X Y = works similarly but in an intra-graph instea of inter-graph manner, by connecting output an input noes of g with matching markers X, an constructs copies of input noes of g, each connecte with the original input noe by an ε-ege. The output markers in Y are left as is. It is worth noting that any graph in the ata moel can be expresse by using these UnCAL constructors (up to bisimilarity), where the notion of bisimilarity is extene to ε-eges [3]. The semantics of conitionals is stanar, but the conition is restricte to label equivalence comparison. There are two kins of variables: label variables an graph variables. Label variables, enote $l, $l 1 etc., bin labels while graph variables enote $g, $ etc., bin graphs. They are introuce by structural recursion operator rec, whose semantics is explaine below by example. The variable biners let an llet having stanar meanings are our extensions use for optimization by rewriting [14]. We take a look at the following concrete transformation in UnCAL that replaces every label a by an contracts eges labele c. rec(λ($l, $g). if $l = a then { : & 1 } 2 else if $l = c then {ε : & 3 } 4 else {$l : & 5 } 6 )($b) 7 If the graph variable $b is boun to the graph in Fig. 3 (a), the result of the transformation will be the one in Fig. 3 (b). We call the first operan of rec the boy expression an the secon operan the argument expression. In the above transformation, the boy is an if conitional, while the argument is the variable reference $b. We use $b as a special global variable to represent the input of the graph transformation. For the sake of biirectional evaluation (an also use in our tracing in this paper), we superscribe UnCAL expressions with their coe position p Pos where Pos is the set of position numbers. For instance, in the example above, the numbers 1 an 2 in { : & 1 } 2 enote the coe positions of the graph constructors & an { : &}, respectively. Fig. 6 shows the bulk semantics of rec for the example. It is bulk because the boy of rec can be evaluate in parallel for each ege an the subgraph reachable from the target noe of the ege (which are corresponingly boun to variables $l an $g in the boy). In the bulk semantics, the noe ientifier carries some information which has the following structure [13] StrID: StrID ::= SrcID Coe Pos Marker RecN Pos StrID Marker RecE Pos StrID Ege, where the base case (SrcID) represents the noe ientifier in the input graph, Coe p &x enotes the noes constructe by {}, { : }, &y, an cycle where &x is the marker of the corresponing input noe of the operan(s) of the constructor. Except for, the marker is always efault an thus omitte. RecN p v &z enotes the noe create by rec at position p for noe v of the graph resulting from evaluating the argument expression. For example, in Fig. 6, the noe RN 7 1, originating from noe 1, is create by rec at position 7 56

7 RE 7 (C 2) (1,a,2) RE 7 (C 1) (1,a,2) RN 7 1 RE 7 (C 6) (1,b,3) b & RE 7 (C 5) (1,b,3) RE 7 (C 6) (1,b,4) b RE 7 (C 5) (1,b,4) RN 7 2 RN 7 3 RN 7 4 RE 7 (C 2) (2,a,5) RE 7 (C 1) (2,a,5) RE 7 (C 2) (3,a,5) RE 7 (C 1) (3,a,5) RE 7 (C 4) (6,c,3) ε RE 7 (C 3) (6,c,3) RN 7 5 RE 7 (C 6) (5,,6) RE 7 (C 5) (5,,6) RN 7 6 Figure 6: Bulk Semantics by Example (RecN is abbreviate to RN in the figure for simplicity, an similarly Coe to C an RecE to RE). We have six such noes, one for each in the input graph. Then we evaluate the boy expression for each bining of $l an $g. For the ege (1, a, 2), the result will be ({(C 2), (C 1)}, {(C 2,, C 1)}, {& C 2}, {(C 2, &)}), with the noes C 2 an C 1 constructe by { : } an &, respectively. For the shortcut eges, an ε-ege is generate similarly. Then each noe v of such results for ege ζ is wrappe with the trace information RE like RE p v ζ for rec at position p. These results are surroune by roun squares rawn with ashe lines in Fig. 6. They are then connecte together accoring to the original shape of the graph as epicte in Fig. 6. For example, the input noe RE 7 (C 2) (1, a, 2) is connecte with RN 7 1. After removing the ε-eges an flattening the noe IDs, we obtain the result graph in Fig. 3 (b). Our biirectional transformation in UnCAL is base on its biirectional evaluation, whose semantics is given by F[[ ]] an B[[ ]] as follows. F[[e]]ρ = G is the forwar semantics applie to UnCAL query e with source variable environment ρ, which inclues a global variable bining $b the input graph. B[[e]](ρ, G ) = ρ prouces the upate source ρ given the upate view graph G an the original source ρ. Biirectional transformations nee to satisfy roun-trip properties [5, 27], while ours satisfy the GetPut an WPutGet properties [13], which are: F e ρ = G V B e (ρ, G V ) = ρ (GetPut) B e (ρ, G V ) = ρ F e ρ = G V B e (ρ, G V ) = ρ (WPutGet) where GetPut says that when the view is not upate after forwar transformation, the result of the following backwar transformation agrees with the original source, an W(Weak)PutGet (a.k.a. weak invertibility [6], a weaker notion of PutGet [8] or Correctness [27] or Consistency [2] because of the rather arbitrary variable reference allowe in our language) emans that for a secon view graph G V which is returne by F e ρ, that backwar transformation B e (ρ, G V ) using this secon view graph as well as the original source environment ρ (from the first roun of forwar transformation) returns ρ again unchange. In the backwar evaluation of rec, the final ε-elimination to hie them from the user is reverse to restore the shape of Fig. 6, an then the graph is ecompose with the help of the structure IDs, an then the ecompose graph is use for the backwar evaluation of each boy expression. The backwar evaluation prouces the upate variable binings (in this boy expression we get the binings for $l, $g an $b an merge them to get the final bining of $b). For example, the upate of the ege label of (1, b, 3) in the view to x is propagate via the backwar evaluation of the boy {$l : &}, which prouces the bining of $l upate with x an is reflecte to the source graph with ege (1, b, 3), replace by (1, x, 3). UnQL as a Textual Surface Syntax of Biirectional Graph Transformation We use the surface language UnQL [3] for biirectional graph transformation. An UnQL expression can be translate into UnCAL, a process referre to as esugaring. We highlight the essential part of the translation in the following. Please refer to [3, 19, 17] for etails. The expression (irectly after the select clause) appears 57

8 in the innermost boy of the neste rec in the translate UnCAL. The ege constructor expression is irectly passe through, while the graph variable pattern in the where clause an corresponing references are translate into combinations of graph variable binings in neste recs as well as references to them in the boy of recs. The following example translates an UnQL expression into an equivalent UnCAL one. select {res:$b} where {a:$g} in $b, {b:$g} in $b rec(λ($l,$g). if $l = a then rec(λ($l,$g). if $l = b then {res:$b} else {})($b) else {})($b). 4 Trace-augmente Forwar Semantics of UnCAL This section escribes the forwar semantics of UnCAL augmente with explicit corresponence traces. In the trace, every view ege an noe is mappe to a corresponing source ege or noe or a part of the transformation. The path taken in the transformation is also recore in the trace for the view elements. The trace information is utilize for (1) corresponence analysis, where a selecte source element is contraste with its corresponing view element(s) by highlighting them, an likewise, a selecte view element is contraste with its corresponing parts in source an transformation, an for (2) eitability analysis, classifying eges by origins to (2-1) pre-reject the eiting of eges that map to the transformation, (2-2) pre-reject the conflicting eiting of view eges whose eit woul be propagate to the same source ege, (2-3) warn the eit that coul violate WPutGet by changing branching behavior of if by highlighting the branch conitions that are affecte by the eit. The augmente forwar evaluation F[[ ]] : Expr Env Graph Trace takes an UnCAL expression an an environment as arguments, an prouces a target graph an trace. The shae part represents the augmente part an we apply the same shaing in the following. The trace maps an ege Ege (resp. a noe Noe) to a source ege (resp. source noe) or a coe position, precee by zero or more coe positions that represent the corresponing language constructs involve in the transformation that prouce the ege (resp. the noe). The preceing parts are use for the warning in (2-3) above. Thus Trace = Ege Noe Trace E Trace V Trace E ::= Pos : Trace E [Ege Pos] Trace V ::= Pos : Trace V [Noe Pos] The environment Env represents binings of graph variables an label variables. Each graph variable is mappe to a graph with a trace, while each label variable is mappe to a label with a trace that contains only ege mapping. Thus Env = Var (Graph Trace) (Label Trace E ). Given source graph g s, the top level environment ρ 0 is initialize as follows. ρ 0 = {$b (g s, {ζ [ζ] ζ g s.e} {v [v] v g s.v})} (InitEnv) As iioms use in the following, we introuce two auxiliary functions of type Trace Trace: prep p to prepen coe position p Pos to traces, an rece p,ζ to wrap the noes in the omain of traces with RecE constructor to ajust to bulk semantics. prep p t = { x p:τ (x τ) t} rece p,ζ t = {(f x) { τ (x τ) t} (RecE p u ζ, l, RecE p v ζ) if x = (u, l, v) Ege where fx = RecE p x ζ if x Noe Now we escribe the semantics F[[ ]]. The graph component returne by the semantics is the same as that of [13] an recappe in Section 3, so we focus here on the trace parts. The subscripts on the left of the constructor expressions represent the result graph of the constructions. For the constructors, we only show the semantics of 58

9 some representative ones. See the long version [12] for the rest. F[[{} p ] ρ = ( G {} p, {G.I(&) [p]}) F[[e 1 p e 2 ] ρ = ( G ( p g 2 ), (t 1 t 2 {v [p] (&x v) G.I})) where ((, t 1 ), (g 2, t 2 )) = (F [e 1 ]]ρ, F[[e 2 ]]ρ) F[[{e L : e} p ] ρ = ( G {l : g} p, {(G.I(&), l, g.i(&)) τ, G.I(&) [p]} t) where ((l, τ), (g, t)) = (F L [[e L ]] ρ, F[[e]] ρ ) (T-emp) (Uni) (Eg) For the constructor {}, the trace maps the only noe (G.I(&)) create, to the coe position p of the constructor (T-emp). The binary graph constructors, returns the traces of both subexpressions, in aition to the trace create by themselves. The graph union s trace maps newly create input noes to the coe position (Uni). For the ege-constructor (Eg), the corresponence between the create ege an its trace create by the label expression e L is establishe, while the newly create noe is mappe to the coe position of the constructor. For label expression evaluation F L [[ ]] : Expr L Env Label Trace E, the trace that associates the label to the corresponing ege or coe position is accompanie with the resultant label value. F L [a p ] ρ = (a, [p]) F L [[$l p ] ρ = (l, p : τ) where (l, τ) = ρ($l) (Lcnst) (Lvar) Label literal expressions (Lcnst) recor their coe positions, while label variable reference expressions (Lvar) a their coe positions to the traces that are registere in the environment. The label variable bining expression (Llet) registers the trace to the environment an passes it to the forwar evaluation of the boy expression e. Graph variable bining expression (Let) is treate similarly, except it hanles graphs an their traces. Graph variable reference (Var) retrieves traces from the environment an a the coe position of the variable reference to it. F F [llet p $l = e L in e]] ρ = F[[e]] ρ {$l (l,p : τ)} where (l, τ) = F L [[e L ]] ρ F[[let p $g = e 1 in e 2 ]] ρ = F[[e 2 ]] ρ {$g (g,prepp t)} where (g, t) = F[[e 1 ]] ρ F [$g p ]] ρ = (g, prep p t) where (g, t) = ρ($g) [ if p (e L = e L ) then e ] true = (g, prep else e p t) false ρ where ((l, ), (l, )) = (F L [[e L ]], F L [[e L]]) b = (l = l ) (g, t) = F[[e b ] ρ (Llet) (Let) (Var) (If) Structural recursion rec (Rec) introuces a new environment for the label ($l) an graph ($g) variable that inclues traces inherite from the traces generate by the argument expression e a, augmente with the coe position p of rec. g v enotes the subgraph of graph g that is reachable from noe v. t v enotes a trace that are restricte to the subgraph reachable from noe v. The function M : Ege (Graph Trace) takes an ege an returns the pair of the graph create by the boy expression e b for the ege, an the trace associate with the graph. t ζ is the trace generate by ajusting the trace returne by M with the noe structure introuce by rec. compose p rec is the bulk semantics explaine in Sect. 3.2 using Fig. 6, for the input graph g an the input/output marker Z of e b, where V RecN enotes the noes with structure ID RecN. 59

10 F[[rec p Z (λ($l, $g).e b)(e a )]] ρ = (g, ζ g.e t ζ t V ) where (g, t) = F[[e a ]]ρ M = {ζ F[[e b ]] ρ ζ g.e, ζ ε, (u, l, v) = ζ, ρ = ρ {$l (l, p : t(ζ)), $g (g v, prep p t v )}} g = (V RecN...,,, ) = compose p rec(m, g, Z) t V = {v [p] v V RecN } t ζ = rece p,ζ (prep p π 2 (M(ζ))) (Rec) The above semantics collects all the necessary trace information whose utilization is escribe in the next section. Even though the tracing mechanisms are efine for UnCAL, they also work straightforwarly for UnQL, base on the observation that when an UnQL query is translate into UnCAL, all ege constructors an graph variables in the UnQL query creating eges in the view graph are preserve in the UnCAL query. One limitation is: in our system, the biirectional interpreter of UnCAL optionally rewrites expressions for efficiency. However, ue to reorganization of expressions uring the rewriting, we currently support neither tracing UnCAL nor tracing UnQL if the rewriting is activate. 5 Corresponence an Eitability Analysis This section elaborates utilization of the traces efine in Sect. 4 for the corresponence an eitability analysis motivate in Sect. 2. Sounness of this analysis is iscusse at the en of this section. Given transformation e, environment ρ 0 (efine by InitEnv), an the corresponing trace t for (g, t) = F[[e]] ρ0 through semantics given in Sect. 4, the trace (represente as a list) for view ege ζ has the following form t(ζ) = p 1 : p 2 :... : p n : [x] (n 0) where x is the origin, an x = ζ Ege if ζ is a copy of ζ in the source graph, or x = p Pos if the label of ζ is a copy of the label constant at position p in the transformation. p 1, p 2,..., p n represent coe positions of variable efinitions/references an conitionals that conveye ζ. For view graph g an trace t, efine the function origin : Ege Ege Pos an its inverse: origin ζ = last(t(ζ)) origin 1 x = {ζ ζ g.e, origin ζ = x} Corresponence is then the relation between the omain an image of trace t, an various iniviual corresponence can be erive, the most generic one being R : Ege Noe Pos Ege Noe = {(x, x) (x τ) t, x τ }, meaning that x an x is relate if (x, x) R. Source-target corresponence being {(x, x) (x τ) t, x = last τ, x (Noe Ege)}. Using origin an origin 1, corresponing source, transformation an view elements can be ientifie in both irections. When a view element such as the ege ζ = (4, German, 2) in Fig. 2 is given, we can fin the corresponing source ege origin(ζ) = (1, German, 0), which will be upate if we change ζ. In contrast, given the view ege (14, language, 4), the coe position of the label constant lang in {lang : $e} of the select part in Listin is obtaine. Given the view ege ζ = (3, German, 1), the coe positions of the graph variables $lang of the select part an $b in Listin are obtaine, utilizing coe positions in p 1,..., p n, because t ζ inclues such positions. These graph variables copy the source ege origin(ζ) = (1, German, 0) to the view graph. In the following, although the trace t can be use for both noes an eges, we only focus on eges instea of noes, an ege renamings as the upate operations. However, the noe trace can be use to support insertion operation by highlighting the noe in the source on which a graph corresponing to the graph to be inserte in the view will be attache. For the eletion operation, we can relatively easily exten the ata structure of the trace efine in the previous section to be tree-structure, being able to trace multiple sources, an exten rule (Rec) to associate each ege create by the boy expression with the trace of the ege boun to the label variable. For eitability analysis, the following notion of equivalence is use. Given the partial function origin E : Ege Ege efine by origin E ζ = origin(ζ) if origin(ζ) Ege, or unefine otherwise. Then, view eges ζ 1 an ζ 2 are equivalent, enote by ζ 1 ζ 2, if an only if origin E ζ 1 = origin E ζ 2. All eges for which origin E is unefine are 60

11 consiere equivalent. The equivalence class for ege ζ is enote by [ζ]. We efine our upates as up : Up where Up = Ege Label, an expression an its environment at position p as expr : Pos Expr Env, an upate propagation along trace t as prop : Env Up Env. Then, our eitability analysis is efine as follows. Definition 1 (Eitability checking). Given (g, t) = F [e]] ρ0 an upate up on g, eitability checking succees if all the following three conitions are satisfie. 1. For all upate eges ζ, other view eges in [ζ] are unchange or consistently upate, i.e., ζ om(up). ζ [ζ].ζ / om(up) up(ζ) = up(ζ ). 2. For every if e B... expression in the backwar evaluation path, applying the eit to the bining oes not change the conition, i.e., p { [p p t(ζ), p Pos] ζ om(up)}, expr(p) = (if e B..., ρ), F[[e B ]] ρ = F[[e B ] prop(ρ,up). For the case of label variables, this interference can be checke by $l FV(e B ), ρ ($l) = (, τ), last(τ) = ζ for ζ = origin E ζ. Weakene version for graph variables is: $g FV(e B ).(g, t ) = ρ ($g), ζ g.e. last(t ((ζ )) origin E (ζ) for all ζ om(up). 3. No eite ege trace to coe position, i.e., ζ om(up). origin(ζ) / Pos. Further, we recap all the three run-time errors to reject upates [13] as (1) failure at environment merging ( inconsistent change etecte ), (2) failure at B[[if...]] ( branch behavior change ) an (3) failure at B L [[a]]( no moifications allowe for label literals. ). Then the following lemmas hol. Lemma 1. Conition 1 in Def. 1 is false iff error (1) occurs. Lemma 2. Error (2) implies conition 2 in Def. 1 is false. Lemma 3. Conition 3 in Def. 1 is false iff error (3) occurs. Base on these lemmas, we have the following theorem. Theorem 1 (Sounness of eitability analysis). Given forwar transformation (g, t) = F[[e]] ρ0 an upate up on g to g, success of eitability checking in Def. 1 implies B[[e]](ρ 0, g ) efine an results in prop(ρ 0, up). Thus eit on the view ege ζ with ζ = origin E ζ efine is propagable to ζ in the source graph by B[[]], when the checking in Def. 1 succees. An eit on the view ege ζ with origin(ζ) = p Pos is not propagable to the source by Lemma 3. Eiting label constant at p in the transformation woul achieve the eits, with possible sie effects through other copies of the label constant. Consier the example in Listin with the source graph of Fig. 1 an view graph of Fig. 2. We get four equivalence classes, one each for the source eges (1, German, 0), (3, Europe, 2), (5, Austrian, 4) an (11, German, 10), as well as the class that violate conition 3. For view ege ζ = (3, German, 1), we have (4, German, 2) [ζ] via origin E ζ = (1, German, 0), so these equivalent eges can be selecte simultaneously, inconsistent eits on which can be prevente (Lem. 1). Direct eits of the view ege ζ = (0, result, 14) are suppresse since origin ζ Pos (Lem. 3). On conition 2, when the view ege ζ = (7, Europe, 5) is given, all the coe positions in t ζ for ζ origin E 1 (origin E ζ) are checke if the positions represent conitionals that refer variables, change of those bining woul change the conitions an woul be rejecte by B. We obtain the position for variable reference $l in the conition ($l = Europe) for warning. Sounness Proof of the Eitability Analysis Cases in which completeness is lost: Note that system may choose the weakene version of conition 2, an just issue warning (i.e., whenever the ege being upate has common source ege with any variable reference occurring free in any of the conitional expressions along the execution path), because when conition inclues not only the simple label comparison expressions but also graph emptiness checking by isempty, the cost of fully checking the change of the conition may amount to re-executing the most part of the forwar transformation. If this warning-only strategy is chosen, backwar transformation may succee espite this warning, because the warning oes not necessarily mean conition value changes. Therefore, the checking is not complete (may warn some safe upates). We argue that this false alarm is not so problematic in practice, with the following reasons. The argument of isempty usually inclues select to test an existence of certain graph pattern. So we further analyze conitions in select own to simple label equivalence check. If the argument is a bare graph variable reference, then we analyze its biner. If the graph variable is $b (the entire input graph), then any changes 61

12 cause false alarms. This preicate may be use only for ebugging purpose to exclue empty source graphs, but otherwise we on t think we frequently encounter this situation. Now we provie a proof sketch. First, we prove Lemma 3. We o this by parallel case analysis on augmente forwar semantics an backwar semantics [13]. Base case No eit is possible for {}, () an &y that prouce no ege. For a transformation {a : e } p an the a view graph as v G, since a is a constant, augmente forwar semantics generates coe position p as trace, which violates conition 3 when a is being upate. Backwar semantics rejects with error (3). Inuctive case Transformation {$l : e } p l an the view graph as v G: Upate on l to l will be hanle by the backwar semantics of $l, which upates its reference. Suppose it is introuce by an expression llet $l = a in {$l : e }.... Then bining $l l is generate an it is passe to the backwar evaluation of label expression a, which is constant. So no value other than a is allowe. So backwar transformation fails with error (3). The trace generates coe position of label constant a, which also signals violation of conition 3. If $l is boun by rec(λ($l, ).{$l : e 1 })(e 2 ), then the upate is also translate to the argument expression e 2, so if corresponing part in e 2 originates from a label constant, then the conition is violate an backwar transformation fails similarly. e 1 e 2, e 1 e 2, e e 2 : We reuce the backwar transformation to that of subexpressions, assuming ecomposition operation for each operator. So assuming Lemma 3 for these subexpressions, Lemma 3 hols for entire expression. Similar argument applies for cycle(e), & := e an if then e 1 else e 2. rec(e 1 )(e 2 ): What is prouce as a trace epens on e 1 an e 2. Assuming the ecomposition of target graph, the backwar evaluation is reuce to those of e 1 an e 2. The only interesting case is a graph variable reference as (sub) expression. The upate on the target graph that was prouce by the variable reference is reuce to upate graph variable binings, an the boun graph is aggregate for each ege in the input graph that was prouce by e 2, an passe to the backwar evaluation of e 2. The trace, on the other han, is prouce by e 2 an combine with the trace by e 1. If e 1 is a graph variable reference, then the (sub) trace inuce from the trace from e 2 is use, so the ege that trace back to constant is inherite in the trace of the result of rec, so attempt to upate an ege that traces back to the constant prouce by e 2 an carrie by the graph variable reference is signale with conition 3. So, assuming Lemma 3 on e 2 by inuction hypothesis, Lemma 3 hols for the entire expression. Thus conclue the proof for Lemma 3. Next we prove Lemma 1. When violation of 1 is signale, multiple ege labels with the same equivalence class is upate to ifferent values. The proof can be conucte similarly to the case for Lemma 3, except that we focus on multiple ege labels generate by ifferent subexpressions of the transformation. {$l : $g}: Suppose binings $l a an $g {b : G} are generate by upates on the target graph. Further, suppose these binings are generate by rec(λ($l, ). rec(λ($l, $g).{$l : $g})({$l : {$l : {}}}))($b) as the inner boy expression of rec an $b is boun to graph {x : {}}. Then, backwar evaluation of the argument expression in the inner rec, i.e., {$l : {$l : {}}} will prouce the binings $l a an $l b for the first label expression $l an the label construction expression {$l : {}}, respectively, an merge these binings by operator relative to original bining $l x. Then backwar transformation fails because of the conflicting binings. In this case, the augmente forwar semantics also allocate the top an the following ege the same origin ege, so the upate signals violation of conition 1. So violation of conition 1 coincies faile backwar transformation. Similar situation can be observe for graph constructors, that unifies the graphs, when conflicting upates are attempte to eges originate from ientical eges. The merge phase for the subexpressions in the backwar transformation causes the failure. Note that the uplicate is propagate through variable binings, so conflicting upates can be etecte within the target graph create by a single graph variable reference, like let $g = rec(λ($l, ). rec(λ($l, $g).{$l : $g})({$l : {$l : {}}}))($b) in $g. The failure takes place in the let expression in this case. We omit the etaile case analysis here. For the Lemma 2, its proof is straightforwar by the warning algorithm in the long version. Note that if we exclue the upate on target that causes violation of conition 2, we have sounness an completeness. In general, we only have sounness. This conclues the proof sketch. 6 Relate Work Our novelty is to analyze eitability using traces in compositional biirectional graph transformations. Tracing mechanism. Traceability is stuie enthusiastically in moel-riven engineering (MDE) [9, 25]. Van 62

13 Amstel et al. propose a visualization framework TraceVis for chains of ATL moel transformations [30]. Systematic augmentation of the trace-generating capability with moel transformations [22] is achieve by higher-orer moel transformations [29]. Although they also trace between source, transformation an target, we also use the trace for eitability analysis. We can help improve this kin of uniirectional tool. Grain size of transformation trace in TraceVis is at ATL rule level, while our trace is more fine graine. If TraceVis refines the transformation trace to support inspection of guars (conitions), they can also support control flow change analysis. To o so, ATL engine may be extene to maintain the variable bining environment similar to ours at run-time, an use it to trace binings within the guars. Our own previous work [13] introuce the trace generation mechanism, but the main objective was the biirectionalization itself. The notion of traces has been extensively stuie in a more general context of computations, like provenance traces [4] for the neste relational calculus. Triple Graph Grammars (TGG) [26] an frameworks base on them are stuie extensively an are applie to MDE [1] incluing traceability [11]. They are base on graph rewriting rules consisting of triples of source an target graph pattern, an the corresponence graph in-between which explicitly contains the trace information. Grammar rules are use to create new elements in source, corresponence an view graphs consistently. By iterating over items in the corresponence graph, incremental TGG approaches can also work with upates an eletions of elements [10]. The transformation language UnQL is compositional in that the target of a (sub)transformation can be the source of another (sub)transformation, while TGG is not. Our tracing over compositions are achieve by keeping track of variable binings. Xiong et al. [32] s traces are eiting operations (incluing eletion, insertion an replacement) embee in moel elements. They are translate along with transformation (in ATL bytecoe). They check control flow changes in these embee operations after finishing backwar transformations an reject upates when these changes are etecte. ATL level trace coul have been compute using our approach for corresponence analysis. Target Element Classification an Eitability Analysis. Moel element classification has been stuie in the context of Preceence Triple Graph Grammars [23]. Though the motivation is not irectly relate to ours, their classification is inee similar in the sense that both group elements in graphs. The ifference is that the equivalence class in [23] is efine such that all the elements in the class are affecte in a similar manner (e.g., create simultaneously) while in our equivalence class, members are efine only on the target sie, an they are originate from the same source ege, so eits on any member result in eits on the source ege. The equivalence class in [23] may correspon to the subgraph create by the same bulk by the boy expression of rec with respect to common ege prouce by the argument expression, so that when the common ege is elete, then all the eges in the bulk are elete simultaneously. Another well-stuie biirectional transformation framework calle semantic biirectionalization [31] generates a table of corresponence between elements in the source an those in the target to guie the reflection of upates over polymorphic transformations, without inspecting the forwar transformation coe (thus calle semantic). The entries in the target sie of the table can be consiere as equivalence classes to etect inconsistent upates on multiple target elements corresponing ientical source element. Although UnCAL transformations are not polymorphic in general because of the label comparison in the if conitionals with constant labels, prohibiting the semantic biirectionalization approach. Matsua an Wang [24] relaxe this limitation by run-time recoring an change checking of the branching behaviors to reject upates causing such change. They also cope with ata constructe uring transformation (corresponing to constant eges in our transformation). So our framework is close to theirs, though we utilize the syntax of transformation. We can trace noes (though we focuse on ege tracing in this paper) while theirs cannot. Hu et al. [21] treat uplications explicitly by a primitive Dup. They o not highlight uplicates in the view, rather they rely on another forwar transformation to complete the propagation among uplicates. 7 Conclusion In this paper, we propose, within a compositional biirectional graph transformation framework base on structural recursion, a technique for analyzing the corresponence between source, transformation an target as well as to classifying eges accoring to their eitability. We achieve this by augmenting the forwar semantics with explicit corresponence traces. The incorporation of this technique into the GUI enables the user to clearly visualize the corresponence. Moreover, prohibite eits such as changing a constant ege an upating a group of eges inconsistently are isable. This allows the user to preict violate upates an thus o not attempt them at the first place. In this paper we only focuse on ege-reaming as eit operation but the propose 63