Validating Modal Aspects of OntoUML Conceptual Models Using Automatically Generated Visual World Structures.
ABSTRACT Assessing the quality of conceptual models is key to ensure that conceptual models can be used effectively as a basis for understanding, agreement and construction of information systems. This paper proposes an approach to assess conceptual models defined in OntoUML by transforming these models into specifications in the logicbased language Alloy. These Alloy specifications include the modal axioms of the theory underlying OntoUML, allowing us to validate the modal metaproperties representing ontological commitments of the OntoUML types and relations.

Conference Paper: InstanceLevel Modelling and Simulation Revisited
[Show abstract] [Hide abstract]
ABSTRACT: Instancelevel modelling is a sort of conceptual modelling that deals with concrete objects instead of general classes and types. Instancelevel modelling approach offers a rather innovative way for communication with domain experts extremely useful for them, as they can see their real data in the context of the given model. Various approaches were presented in the paper “InstanceLevel modelling and Simulation Using LambdaCalculus and ObjectOriented Environments” at EOMAS 2011. The present paper is a sequel and it presents additional approaches we find useful in practice: Factoriented modelling, OntoUML in combination with OCL and the Alloy and Eclipsebased framework DresdenOCL. We present key features of the various approaches and demonstrate them on a running example, we follow up with a discussion comparing these approaches. Notice that OntoUML combined with the Alloy is an original research achievement built on the research of OntoUML.EOMAS@CAiSE; 01/2013  SourceAvailable from: Tiago Prince Sales
Conference Paper: Identification of Semantic AntiPatterns in OntologyDriven Conceptual Modeling via Visual Simulation
[Show abstract] [Hide abstract]
ABSTRACT: The construction of largescale reference conceptual models and ontologies is a complex engineering activity. To develop high quality models, a modeler must have the support of expressive engineering tools such as theoretically wellfounded modeling languages and methodologies, ontological patterns and computational environments. Patterns and AntiPatterns are known to be an efficient way to reuse knowledge from experts’ successful past experiences. This paper proposes a set of Semantic AntiPatterns for ontology engineering. These antipatterns capture error prone modeling decisions which can result in the creation of models that allow for unintended model instances (representing undesired state of affairs). The antipatterns presented here have been empirically elicited through an approach of ontology conceptual models validation via visual simulation.OntologyDriven Information Systems Engineering (ODISE), Graz, Austria; 01/2012  SourceAvailable from: Nicola Guarino
Conference Paper: Towards a Commitmentbased Reference Ontology for Services
Julio Cesar Nardi, Ricardo de Almeida Falbo, João Paulo A. Almeida, Giancarlo Guizzardi, Luis Ferreira Pires, Marten J. van Sinderen, Nicola Guarino[Show abstract] [Hide abstract]
ABSTRACT: The concept of "service" has been characterized by different disciplines and authors from various points of view. The variety of characterizations reveals that this notion, although an intuitive one, is far from trivial. Given the importance of services in enterprise computing and Service Science in general, we believe that a clear account of services and servicerelated concepts is necessary and would serve as a basis for communication, consensus and alignment of various approaches and perspectives. In this paper we propose a commitmentbased account of the notion of service captured in a core reference ontology called UFOS. We address the commitments established between service providers and customers, and show how such commitments affect the service lifecycle. We show that the commitmentbased account can serve to harmonize different notions of service in the literature.17th IEEE International EDOC Conference; 09/2013
Page 1
Validating Modal Aspects of OntoUML Conceptual
Models Using Automatically Generated Visual World
Structures
Alessander Botti Benevides
(Ontology and Conceptual Modeling Research Group (NEMO), Computer
Science Department, Federal University of Esp´ ırito Santo (UFES), Brazil
abbenevides@inf.ufes.br)
Giancarlo Guizzardi
(Ontology and Conceptual Modeling Research Group (NEMO), Computer
Science Department, Federal University of Esp´ ırito Santo (UFES), Brazil
gguizzardi@inf.ufes.br)
Bernardo Ferreira Bastos Braga
(Ontology and Conceptual Modeling Research Group (NEMO), Computer
Science Department, Federal University of Esp´ ırito Santo (UFES), Brazil
bfbbraga@inf.ufes.br)
Jo˜ ao Paulo Andrade Almeida
(Ontology and Conceptual Modeling Research Group (NEMO), Computer
Science Department, Federal University of Esp´ ırito Santo (UFES), Brazil
jpalmeida@ieee.org)
Abstract: Assessing the quality of conceptual models is key to ensure that conceptual
models can be used effectively as a basis for understanding, agreement and construction
of information systems. This paper proposes an approach to assess conceptual models
defined in OntoUML by transforming these models into specifications in the logicbased
language Alloy. These Alloy specifications include the modal axioms of the theory
underlying OntoUML, allowing us to validate the modal metaproperties representing
ontological commitments of the OntoUML types and relations.
Key Words: Model Validation and Analysis, Knowledge Representation Formalisms
and Methods, Formal Definitions and Theory
Category: I.6.4, I.2.4, D.3.1
1Introduction
John Mylopoulos [Mylopoulos 1992] defines conceptual modeling as “the activity
of formally describing some aspects of the physical and social world around us for
purposes of understanding and communication”. In this view, a conceptual model
is a means to represent what modelers (or stakeholders represented by modelers)
perceive in some portion of the physical and social world, i.e., a means to express
their conceptualization [Guizzardi 2005] of a certain universe of discourse.
Journal of Universal Computer Science, vol. 16, no. 20 (2010), 29042933
submitted: 7/1/10, accepted: 13/9/10, appeared: 1/11/10 © J.UCS
Page 2
If conceptual models are to be used effectively as a basis for understand
ing, agreement, and, perhaps, construction of an information system, conceptual
models should express as accurately as possible a modeler’s intended conceptu
alization. More specifically, the model should ideally describe all states of affairs
that are deemed admissible and rule out those deemed inadmissible according
to the conceptualization [Guizzardi 2005].
In pace with Degen et al. [Degen et al. 2001], we argue that “every domain
specific ontology must use as framework some upperlevel ontology”. This claim
for an upperlevel (or foundational) ontology underlying a domainspecific ontol
ogy is based on the need for fundamental ontological structures, such as theory of
parts, theory of wholes, types and instantiation, identity, dependence, unity, etc.,
in order to properly represent reality. From an ontology representation language
perspective, this principle advocates that, in order for a modeling language to
meet the requirements of expressiveness, clarity and truthfulness in representing
the subject domain at hand, it must be an ontologically wellfounded language
in a strong ontological sense, i.e., it must be a language whose modeling prim
itives are derived from a proper foundational ontology [Guarino and Guizzardi
2006,Guizzardi 2006].
An example of a general conceptual modeling and ontology representation
language that has been designed following these principles is the version of UML
proposed in [Guizzardi 2005]. This language (later termed OntoUML) has been
constructed in a manner that its metamodel reflects the ontological distinctions
prescribed by the Unified Foundation Ontology (UFO). UFO is a foundational
ontology designed specially for conceptual modeling languages. The ontological
categories comprising UFO are motivated by a number of theories in formal
ontology, philosophical logics, cognitive science and linguistics. Moreover, for
mal constraints have been incorporated in OntoUML’s metamodel in order to
incorporate the formal axiomatization in UFO. Therefore a UML model that
is ontologically misconceived taking UFO into account is syntactically invalid
when written in OntoUML.
The OntoUML language has been able to provide mechanisms for addressing
a number of classical conceptual modeling problems [Guizzardi et al. 2004], and
the language has been successfully employed in application domains [Gon¸ calves
et al. 2007,Oliveira et al. 2007]. However, one would certainly be naive to assume
that modelers make no mistakes while constructing the models and that they
fully understand the theory that supports the language. These cases could lead
to illdefined conceptual models, which may be: (i) syntactically incorrect; (ii)
syntactically correct, but unsatisfiable; (iii) syntactically correct, satisfiable, but
invalid according to the intended conceptualization.
Previous efforts in addressing the assessment of OntoUML models have fo
cussed on syntactic correctness (the type (i) of illdefined conceptual models) and
2905
Benevides A.B., Guizzardi G., Braga B.F.B., Almeida J.P.A.: Validating ...
Page 3
led to the specification of OntoUML’s syntactical constraints as OCL expressions
on the language’s metamodel and the building of a graphical editor [Benevides
and Guizzardi 2009] that is capable of automatic syntax verification. In this
paper, we go beyond syntax verification and aim at addressing the validity of
OntoUML models by simulation (type (iii)).
We believe that, in general, performing validation of OntoUML models is
not an easy task. Many of the ontological metaproperties incorporated into On
toUML are modal in nature and it may be difficult for human beings to reason
upon the several possible changes in the instances in a set of worlds. In our previ
ous workshop paper [Benevides et al. 2009], we have discussed an approach based
on the generation and presentation of instances of OntoUML models in order to
provide visualizations of the possible changes in the instances in distinct worlds.
Indeed, we believe that by confronting the results of his/her specifications with
the expected ones, the modeler can improve his/her confidence in the validity
of the model. Here, we extend the previous version of the paper by clarifying
the technical contributions of our research and by introducing a discussion on
temporal interpretation, which were not accessible in [Benevides et al. 2009]. We
also further elaborate on the presentation of the OntoUML language, namely, we
have added a deeper discussion on relational dependence and on the treatment
of partwhole relations. Moreover, we extend the approach presented there to
include rigid mixin universals (categories). Here, we explain the constructs of
Alloy that are used in the OntoUML to Alloy transformation. Finally, we also
improve the coverage of related work.
More specifically, we discuss an approach based on formal specifications in the
logicbased language Alloy [Jackson 2006] to generate instances of an OntoUML
model. In our approach, the Alloy specification is fed into the Alloy Analyzer
to generate an instance[1]composed of a set of objects (atoms) representing
instances of the classifiers taken from the OntoUML model and a world structure
that reveals the possible dynamics of object creation, classification, association
and destruction. Each world in this structure represents a snapshot of the objects
and relations that exist in that world. A world structure is necessary since the
metaproperties characterizing most of the ontological distinctions in UFO are
modal in nature. Therefore, we believe that the sequence of possible snapshots
in this world structure will improve our confidence on claims of validity.
Although there are other works concerning type (iii) models (for exam
ple [Anastasakis et al. 2007,Gogolla et al. 2007]), none of them deals with onto
logically wellfounded conceptual modeling languages.
This article is further structured as follows. [Section 2] briefly comments on
the system of modal logics employed in this article. [Section 3] presents a running
[1]In order to avoid the many overloadings of the term “model”, the Alloy developers
call them instances instead [Jackson 2002, p. 267].
2906
Benevides A.B., Guizzardi G., Braga B.F.B., Almeida J.P.A.: Validating ...
Page 4
example that is used to introduce concepts from OntoUML and Alloy languages,
and also to define a transformation from OntoUML models to Alloy specifica
tions. [Section 4] presents an illustration of a validation for the running example.
[Section 4] also discusses the temporal world structure and the customization of
visualization themes in the Alloy Analyzer to provide visualization mechanisms
to the generated instances which we believe to be more amenable to human
users. [Section 5] discusses related work. Finally, [Section 6] presents our final
considerations.
2A Note on the Quantified System of Modal Logics
Before we begin discussing the ontological distinctions behind the OntoUML
system, a brief note on the modal logics employed in this article is needed.
We make use here of a language L of quantified modal logics with identity. The
alphabet of L contains the traditional operators of ∧ (conjunction), ¬ (negation),
→ (conditional), ↔ (biconditional), ∀ (universal quantification), ∃ (existential
quantification), with the addition of the equality operator = and the modal
operators ? (necessity) and ♦ (possibility). The following holds for these two
latter operators: (1) ♦A
=¬?¬A; (2) ?A
models assumed here are the socalled normal models [Fitting and Mendelsohn
1999], i.e., the equality operator is defined between individuals in the domain
of quantification in each world, and equality if it holds, it holds necessarily. In
other words, the formula ∀x,y((x = y) → ?(x = y)) is valid.
A modeltheoretic semantics for this language can be given by defining an
interpretation function δ that assigns values to the nonlogical constants of the
language and a world structure S. In this language, S has a structure ?W,R,D?
where W is a nonempty set of worlds, R represent an accessibility relation be
tween worlds such that ?w,w?? ∈ R iff w?is accessible from w, and D is a function
mapping worlds to nonempty domains of objects. Therefore, we are assuming
here a varying domain of quantification of an actualist modal logics, hence, we
have that in each world w, the domain of quantification D(w) contains only the
individuals that are assumed to exist in that world. Here, unless explicitly men
tioned, we take worlds to represent maximal states of affairs which can be factual
or counterfactual. Informally, we can state that the truth of formulæ involving
the modal operators can be defined such that the semantic value of formula ?A
is true in world w iff A is true in every world w?accessible from w. Likewise,
the semantic value of formula ♦A is true in world w iff A is true in at least one
world w?accessible from w.
Finally, in [Section 3], following the original formal characterization of the
OntoUML language [Guizzardi 2005], we assume all worlds to be equally acces
sible and, as a result, we have the language of quantified modal logic QS5 with
varying domain frames.
defdef
=¬♦¬A. Additionally, we add that the
2907
Benevides A.B., Guizzardi G., Braga B.F.B., Almeida J.P.A.: Validating ...
Page 5
3A Whirlwind Tour
In this section, we briefly introduce Alloy language and some concepts of UFO
ontology. Then we introduce the running example and deepen the explanation
of UFO and Alloy syntax by means of the running example, its corresponding
OntoUML model and Alloy specification. For a complete presentation and formal
characterization of OntoUML and Alloy, one should refer to [Guizzardi 2005]
and [Jackson 2006], respectively.
3.1 The Logicbased Language Alloy
Alloy offers a setbased formula syntax by which one can express constraints that
are amenable to a fully automatic semantic analysis [Jackson 2002, pp. 256,257].
Moreover, there is a tool, named Alloy Analyzer[2], that supports simulation of
specifications, in which the consistency of an invariant or operation is demon
strated by generating an instance. If an Alloy specification has at least one in
stance, it is said to be consistent [Jackson 2002, pp. 260,267] [Jackson 2006, p. 3].
This approach is sometimes called “lightweight formal methods”, because it tries
to obtain the benefits of traditional formal methods, such as theorem proving
techniques, at lower cost [Jackson 2006, p. XIII].
The search for instances is conducted in a space whose dimensions are spec
ified by the user in a “scope”, which assigns a bound to the number of objects
of each type [Jackson 2006, p. 3]. An instance is within a scope of k if it assigns
to each type a set consisting of no more than k atoms. If the analysis succeeds
in finding an instance to an specification, consistency is demonstrated. Fail
ure to find an instance within a given scope, however, does not prove that the
specification is inconsistent, because, since the kernel in which Alloy is based
is undecidable, it is impossible to determine automatically whether an Alloy
specification is consistent [Jackson 2002, p. 267] [Jackson 2006, p. 259]. In other
words, the inexistence of an instance that fits in a scope k does not imply that
there is no scope larger than k in which an instance exists.
Furthermore, by constraining the search to a finite scope, the analysis of
Alloy specifications is decidable, and as a SAT problem, it is NPcomplete. From
version four, the Alloy Analyzer translates constraints to be solved from Alloy
into boolean constraints, which are fed to the SATbased model finder Kodkod[3].
From [Jackson 2006, p. XII]:
“As solvers get faster, so Alloy’s analysis gets faster and scales to
larger problems. Using the best solvers of today, the analyzer can exam
ine spaces that are several hundred bits wide (that is, of 1060cases or
more).” [Jackson 2006, p. XII]
[2]http://alloy.mit.edu/community.
[3]http://alloy.mit.edu/kodkod.
2908
Benevides A.B., Guizzardi G., Braga B.F.B., Almeida J.P.A.: Validating ...
Page 6
Moreover, when translating Alloy specifications into boolean formulæ, Alloy
Analyzer applies a variety of optimizations, where the most important is sym
metry breaking. Every Alloy specification has an intrinsic symmetry given by
the possibility to permute the atoms in any instance of a command, without
ceasing to satisfy the Alloy specification. So, the space of assignments (possible
solutions) can be divided into equivalence classes, and the solver has to search
for only one assignment at each equivalence class [Jackson 2006, p. 151].
In pace with Daniel Jackson [Jackson 2002, p. 260], we believe that “simu
lation helps catch errors of overconstraint, by reporting, contrary to the user’s
intent, that no instance exists within the finite bounds of a given “scope””,
or errors of underconstraint, “by showing instances that are acceptable to the
specification but which violate an intended property.”.
As the specification of the running example in Alloy must take into account
some modal distinctions taken from UFO, then we will progressively present
the Alloy syntax, by means of partial specifications of the running example, as
we present some of the UFO’s modal distinctions. Moreover, by showing how
an OntoUML model can be specified in Alloy, we will progressively define the
transformation patterns from OntoUML to Alloy.
3.2The Ontologically Wellfounded Modeling Language OntoUML
The OntoUML language is an ontologically wellfounded version of the class di
agram part of UML 2.0, proposed in [Guizzardi 2005], so that its metamodel
reflects the ontological distinctions prescribed by UFO. Moreover, these distinc
tions are motivated by a number of formal metaproperties, some of which will
be discussed in the sequel. Due to space limitations, we concentrate here on a
fragment of the UFO ontology, with a specific focus on those distinctions that are
spawned by variations in metaproperties of a modal nature. These categories
are depicted in [Fig. 1] and are briefly discussed in the remainder of this section
by using a running example, whose OntoUML rendering is depicted in [Fig. 2].
Since OntoUML is a modelling language whose metamodel is designed to be iso
morphic to the UFO ontology, these leaf ontological distinctions for Universals in
[Fig. 1] appear as modelling primitives in the language (see stereotyped classes
and relationships in [Fig. 2]).
3.3OntoUML, Alloy and the Transformation
Our example basically consists of a domain about persons, their phases in life,
their biological organs, namely brains and hearts, organizations and relationships
between organizations and persons. More specifically, a person must be born
either a man or a woman, and must be either living or deceased. While living,
a person can be said to be in a phase of child, teenager or adult. Furthermore
2909
Benevides A.B., Guizzardi G., Braga B.F.B., Almeida J.P.A.: Validating ...
Page 7
Figure 1: UFO taxonomy excerpt [Guizzardi 2005]
Figure 2: Running example
persons can play the role of students while enrolled to organizations, which in
turn will play the role of a school. As we explain OntoUML concepts, we will
further constrain this example in order to illustrate some ontological choices
made. This choices are reflected in [Fig. 2] by names of stereotypes decorating
classes and relationships, which represents the leaf concepts shown in [Fig. 1].
2910
Benevides A.B., Guizzardi G., Braga B.F.B., Almeida J.P.A.: Validating ...
Page 8
The UFO categorization starts with a general catchall notion of Entity. En
tity can be distinguished in Universal and Individual, where Individuals are enti
ties that exist in reality possessing a unique identity, and Universals, conversely,
are spacetime independent pattern of features, which can be realized in a num
ber of different Individuals. In our example, an individual person, such as John,
would be an Individual, while the concept of Person would be an Universal. In
Alloy, Individuals are represented as atoms and the instantiation of Universals
by Individuals is represented as inclusion in a set that, in turn, represents the
Universal’s extension.
Universal can be distinguished in Monadic Universal and Relation (entities
that glue together other entities). Within the category of Monadic Universal, in
order to show the differences between Substance Universal and Relator Universal,
we need to explicate what are Substances and Moments.
3.3.1 Substances and Moments
The distinction between Substances and Moments[4]is based on the formal no
tion of existential dependence, a modal notion that can be briefly defined as
follows:
Definition 1 (existential dependence): Let the predicate ε denote existence[5].
We have that an Individual x is existentially dependent on another Individual
y (symbolized as ed(x,y)) iff, as a matter of necessity, y must exist whenever
x exists, or in other words, that in every world w in which x exists, then y
must also exist in w. Since we assume that every Individual in the domains of
quantification possibly exists and possibly do not exist (i.e., there is no nec
essarily existing Individuals) [Guizzardi 2005], formally, we have that: ed(x,y)
def
= ?(ε(x) → ε(y)).
Substances are existentially independent Individuals, i.e., there is no Entity y
disjoint from x that must exist whenever a Substance x exists. Let ≤ represent
the (improper) partof relation. This constraint can be formalized as follows:
disjoint(x,y)
= ¬∃z((z ≤ x)∧(z ≤ y)) and ∀x,y((Substance(x)∧Substance(y)∧
disjoint(x,y)) → (¬ed(x,y) ∧ ¬ed(y,x))).
Examples of Substances include ordinary mesoscopic objects such as an indi
vidual person and an organization. Conversely, a Moment is an Individual that
is existentially dependent on other Individuals. A moment can be existentially
dependent on one single Individual (e.g., a color) or on multiple Individuals
?
def
[4]The notion of moment comes originally from the writtings of E. Husserl to denote
an existentially dependent entity (sometimes named Accident, Trope or Particularized
Property). Thus, this notion as used here bears no relation to the commonsense use
of the term as a temporal instant.
[5]Notice that in an actualist system, the existence operator ε can then be explicitly
defined such that ε(x)
= ∃y(y = x).
def
2911
Benevides A.B., Guizzardi G., Braga B.F.B., Almeida J.P.A.: Validating ...
Page 9
(e.g., an enrollment), in which case they are named Relational Moments or sim
ply Relators. The particular sort of existential dependence Relation connecting
a Relator to the Individuals on which it is dependent is the Formal Relation
of mediation (m). This relation can be formally characterized as follows: (i)
∀x,y(m(x,y) → (Relator(x)∧Substance(y))), (ii) ∀x,y(m(x,y) → ed(x,y)) and
(iii) ∀x(Relator(x) → ∃y,z(¬(y = z) ∧ m(x,y) ∧ m(x,z))).
So, a Substance Universal is a Universal whose instances are Substances (e.g.,
the Universal Person), while a Relator Universal is a Universal whose instances
are Individual Relational Moments (e.g., the particular enrollment connecting
John and a certain University).
3.3.2Substance Universals
Substance Universals can be Sortal Universals or Mixin Universals. Sortal Uni
versals are Universals that provide a principle of individuation and identity to its
instances (e.g., the Universal Brain), while Mixin Universals are abstractions of
properties of instances of Sortal Universals (e.g., BiologicalOrgan). We need to
define some modal notions to be able to make further distinctions within these
categories.
Definition 2 (Rigidity): A Universal U is rigid if for every instance x of U, x is
necessarily (in the modal sense) an instance of U. In other words, if x instantiates
U in a given world w, then x must instantiate U in every possible world w?in
which x exists. This can be formally expressed by the following formula schema:
R(U)
= ?(∀x(U(x) → ?(ε(x) → U(x)))).
Substance Universals that are rigid are named Kinds and subKinds. Due to
the transitivity of instantiation over the subtyping relation, if x instantiates a
subKind SK then x instantiates every Universal of which SK is a subtype of.
At the root of this rigid specialization chain we have a Kind, i.e., a Kind is the
unique ultimate Rigid Sortal that the Individual x instantiates. For instance, in
[Fig. 2], Person is a Kind that is partitioned in the subKinds Man and Woman.
In Alloy, we model Kinds and subKinds as signatures. A signature is a dec
laration of a set that can contain only atoms. Alloy allows the definition of
subsignatures (subsets) by the keywords “in”, which collapses the ∈ and ⊆ set
theoretic operators, and “extends”, which is used to declare disjoint subsigna
tures of a signature ([Line 2] of [Listing 1]). The keyword “abstract” ([Line 1]
of [Listing 1]) indicates that when an “abstract” signature “S” is extended by
other subsignatures “S1”,...,“Sn”, then all the atoms of “S” must be atoms of
at least one of the “S1”,...,“Sn” signatures. Moreover, all toplevel signatures
(i.e., signatures that are subsignatures of no signature) are pairwise disjoint.
By modeling Kinds as toplevel signatures in Alloy ([Lines 1 and 3] of [Listing
1]), (i) the instances of these signatures are automatically pairwise disjoint, what
is suitable because these instances are meant to be distinct objects carrying
def
?
2912
Benevides A.B., Guizzardi G., Braga B.F.B., Almeida J.P.A.: Validating ...
Page 10
distinct identities; and (ii) an instance of a signature never ceases to instantiate
this signature, what reifies the notion of rigidity [Definition 2].
Listing 1: Alloy signatures
1 abstract
2 sig Man, Woman extends Person {}
3 sig Heart , Brain ,
sig Person {}
Organization {}
Returning to subKinds, a subKind must be a refinement of a Kind, and we
represent it in Alloy by making subKinds as subsignatures, and using the Alloy
keyword “in” followed by the signature representing its supertype. If there is a
GeneralizationSet constraining some subKinds to be disjoint, we declare them
with the keyword “extends” instead of “in” ([see Line 2] of [Listing 1]); and
if there is a GeneralizationSet constraining them to be complete, we declare
a signature fact within the signature of the supertype constraining the set of
instances of the supertype to be equal to the union of the sets of its subtypes’
instances. Facts are logical statements about signatures and relations that are
always true for the whole specification. When created within signatures, facts
are called signature facts and are implicitly universally quantified over all the
atoms of the signature. Finally, if there is a GeneralizationSet constraining the
subtypes to partition the supertype, then we can substitute the signature fact
by the keyword “abstract” before the supertype signature (as shown in [Line 1]
of [Listing 1]).
Besides rigidity, UFO defines the concept of antirigidity, which allows dy
namic classification of Individuals. Object Migration has been an important issue
in the literature of conceptual modeling at least since the late seventies [Bachman
and Daya 1977] and its role in capturing subtle semantics aspects of software sys
tems can be summarized by the following quote from [Papazoglou and Kr¨ amer
1997]: “To effectively model complex applications in which constantly changing
situations can be represented, a systems must be able to support the evolution
... of individual objects. The strict uniformity of objects contained in a class is
unreasonable ... An object that evolves by changing its type dynamically is able
to represent changing situations as it can be an instance of different types from
moment to moment.”.
Definition 3 (Antirigidity): A Universal U is antirigid if for every instance
x of U, x is possibly (in the modal sense) not an instance of U. In other words,
if x instantiates U in a given world w, then there must be a possible world w?in
which x exists and in which x does not instantiate U. Formally, we have that:
AR(U)
= ?(∀x(U(x) → ♦(ε(x) ∧ ¬U(x)))).
Within the category of antirigid Substance Universals, we have a further dis
tinction between Phases and Roles. Both Phases and Roles are specializations of
Sortal Universals. However, they are differentiated w.r.t. their specialization con
def
?
2913
Benevides A.B., Guizzardi G., Braga B.F.B., Almeida J.P.A.: Validating ...
Page 11
ditions. For the case of Phases, the specialization condition is always an intrinsic
one. In our example, we could classify Persons regarding their age, creating
phase partitions such as Child, Teenager and Adult. For Roles, in contrast, their
specialization condition is a relational one: a student is a LivingPerson who is
enrolled in (has a study relation to) a School. Formally speaking, this distinction
is based on a metaproperty named Relational Dependence:
Definition 4 (Relational Dependence): A type T is relationally dependent on
another type P via relation R iff for every instance x of T there is an instance y
of P such that x and y are related via R. In the following formula schema, we
have that: RD(T,P,R)
= ?(∀x(T(x) → ∃y(P(y) ∧ R(x,y)))).
Finally, as discussed in [Guizzardi 2005], Phases (contrarily to Roles) are
always defined in a partition set. For instance, in [Fig. 2], the universals Child,
Teenager and Adult define a phase partition for the Kind Person. As a con
sequence, we have that in an each world w, every Person is either a Child, a
Teenager or an Adult in w and never more than of the these. Additionally, if x
is a Child (Teenager, Adult) in w, there is always a possible world w?in which
x will not be a Child, in which case he will be either a Teenager or an Adult.
There is no builtin notion of state change in Alloy. In order to represent
object dynamics, we must reify a notion of state change by means of a world
structure that will be presented in detail in [Section 4]. Features that are time
dependent, such as individual existence, dynamic classification and transitory
relationships must be indexed by worlds in which they occur, i.e., antirigid
universal instantiation is dynamic, thus we represent it as a relationship between
worlds and Individuals.
Therefore, in order to represent modality in Alloy, we create a signature
named “World”, shown in [Line 1] of [Listing 2]. As we are adopting an actual
ist domain of quantification, then for every world w there is a relation named
“ domain of quantification ” ([see Line 2] of [Listing 2]) representing its domain of
quantification (D(w)), which contains some (w,ts) tuples in which ts is a toplevel
signature.
In Alloy, relations are sets of tuples, which may be of any finite arity, but
containing only atoms. As shown in [Listing 2], they must be declared as fields
within signatures. [Line 2] depicts a relation named “ domain of quantification ”
between the signatures “World” and the union of the signatures “Person”, “Heart
”, “Brain”, “Organization” and “Enrollment” (the signature “Enrollment” will be
explained later). The keyword “+” is the settheoretic union operator, which can
also be used to form sets from scalars. Also, the keyword “some” is equivalent
to the cardinality “1..*” and, in [Line 2] of [Listing 2], it is used to constrain the
cardinalities on the extremity connected to the union of the signatures “Person”,
“Heart”, “Brain”, “Organization” and “Enrollment”.
As Phases and Roles are antirigid, then its extensions may vary from world
def
?
2914
Benevides A.B., Guizzardi G., Braga B.F.B., Almeida J.P.A.: Validating ...
Page 12
Listing 2: Alloy relations
1 abstract
2
domain of quantification : some ( Person + Heart +
Brain + Organization + Enrollment )}
to world. Therefore, these classes are modeled within the “World” signature as
binary relations from worlds to Kinds or subKinds that are its supertypes and
that are in the domain of quantification of that world. We model subtyping in two
ways, regarding the nature of the supertype. If the superclass is a Rigid Sortal
RS, then we use the Alloy Range Restriction operator (“:>”) to constrain the set
of tuples of the relation representing the subtype to be a subset of the set of tuples
of the relation representing the domain of quantification in which the second
element is an instance of RS. In Alloy, the expression r :> s contains the tuples
of r that end with an element in s. Examples can be seen in [Lines 3, 6, 7 and
8] of [Listing 3]. Otherwise, as Phases and Roles must be (directly or indirectly)
subtypes of Kinds, then a Phase (or a Role) that is indirectly subtype of a Kind is
transitively constrained by constraints created for its supertypes that are directly
subtypes of Kinds. Therefore, we declare the range of the Alloy relation as the
signature of the (nonrigid) supertype, as shown in [Lines 4, 5 and 9] of [Listing
3]. In these lines, the “disj” keyword states pairwise disjointness of relations,
and the “set” keyword implies the inexistence of cardinality restrictions (“*”).
sig World {
Listing 3: Modeling Phases and Roles in Alloy (extends [Listing 2])
1 abstract
...
3
d isj
sig World {
2
LivingPerson , DeceasedPerson :
domain of quantification ,
Adult , Child , Teenager :
Student : set LivingPerson ,
d isjFunctionalHeart ,
:>domain of quantification ,
d isjFunctionalBrain ,
:>domain of quantification ,
d isjActiveOrganization ,
Organization:>domain of quantification ,
School : set ActiveOrganization }
Furthermore, in order to model GeneralizationSets of Phases and Roles, if
the subclasses are disjoint and are not part of another disjoint GeneralizationSet,
we use the keyword “disj ” before their declaration ([Lines 3, 4, 6, 7 and 8] of
[Listing 3]), otherwise, for each disjoint GeneralizationSet we create “ disj [...]
” facts containing the disjoint subtypes. Signature facts are created within a
set Person:>
4
5
6
d isj set LivingPerson ,
NonfunctionalHeart :set Heart
7
NonfunctionalBrain :set Brain
8
ExtinctOrganization :set
9
2915
Benevides A.B., Guizzardi G., Braga B.F.B., Almeida J.P.A.: Validating ...
Page 13
second pair of braces, as shown in [Line 1] of [Listing 4], just after the ellipsis
between the first pair of braces. If the GeneralizationSets are complete and the
superclass is not a Rigid Sortal (if it is declared as a relation), then we create
a signature fact within the signature “World” stating that the set of tuples of
the relation representing the superclass is equal to the union of the set of tuples
of the relations representing the subclasses ([see Line 4] of [Listing 4]). If the
subclasses are complete and the superclass is a Rigid Sortal, then we constrain
the domain of quantification to only contain instances of the superclass that are
also instances of at least one subclass ([Lines 2, 6, 8 and 10] of [Listing 4]).
Furthermore, Phases are always defined in a partition set
straining a Sortal Universal S [Guizzardi 2005, p. 103], and it is always possible
(in the modal sense) for an instance x of S to become an instance of each Pi
(i ∈ 1,...,n) [Guizzardi 2005, p. 104]. Therefore, for any world w, if x is an
instance of S in w, then x must be an instance of exactly one Phase of S in w
and for each Phase Piof S, there must exist a world in which x is an instance
of Pi. In [Lines 3, 5, 7, 9 and 11] of [Listing 4] we show how we model the last
constraint. In these lines, the Alloy keyword “@” is used to prevent a field name
from being expanded. In Alloy, field names are automatically expanded when
used within the signature in which they were specified. For example, just like
a reference to a field of a receiver in an objectoriented program, LivingPerson
now implicitly refers to this.LivingPerson, which is not a relation, but a set of
atoms.
Observe that these two last constraints together imply antirigidity. There
fore, there is no need to model antirigidity constraints for Phases. However, we
have to model antirigidity for Roles, but only for the ones that are not subtypes
of another Roles or Phases. Because, from the [Definition 3], when antirigidity
is guaranteed for a class, then it is automatically guaranteed for all its subtypes.
In other words, we only have to model antirigidity for the top level Roles. As in
our running example all the Roles are subtypes of Phases, then there is no need
to explicitly model antirigidity for them. However, for the sake of completeness,
we show how we would model antirigidity in the commented [Lines 12 and 13]
of [Listing 4].
ÆP1,...,Pn
? con
Listing 4: Modeling Constraints of Phases and Roles in Alloy (extends [Listing
3])
1 abstract
2
Person:>domain of quantification = LivingPerson +
DeceasedPerson
3
a l l x : Person  some w0,w1: World  (x in
w0.@LivingPerson) and (x in w1.@DeceasedPerson)
4
LivingPerson = Adult + Child + Teenager
5
a l l x :LivingPerson  some w0,w1,w2: World  (x in
sig World {...}{
2916
Benevides A.B., Guizzardi G., Braga B.F.B., Almeida J.P.A.: Validating ...
Page 14
w0.@Child ) and (x in w1.@Teenager) and (x in
w2.@Adult )
Heart:>domain of quantification = FunctionalHeart +
NonfunctionalHeart
a l l x : Heart  some w0,w1: World  (x in
w0.@FunctionalHeart) and (x in
w1.@NonfunctionalHeart )
Brain:>domain of quantification = FunctionalBrain +
NonfunctionalBrain
a l l x : Brain
 some w0,w1: World  (x in
w0.@FunctionalBrain ) and (x in
w1.@NonfunctionalBrain)
Organization:> domain of quantification =
ActiveOrganization + ExtinctOrganization
a l l x :Organization  some w0,w1: World  (x in
w0.@ActiveOrganization ) and (x in
w1.@ExtinctOrganization)}
12 −−a l l x : Student  some w: World  (x in
w.@domain of quantification) and (x not in
w.@Student )
13 −−a l l x : School  some w: World  (x in
w.@domain of quantification) and (x not in
w.@School )
6
7
8
9
10
11
Regarding the Mixin Universals [see Fig. 1], the rigid ones are named Cate
gories. A Category classifies entities having distinct indentity criteria and sharing
some essential characteristic. As shown in [Fig. 2], BiologicalOrgan is modeled as
a Category. In order to model Categories in Alloy, we use Alloy functions, which
are reusable Alloy expressions. For example, the Alloy code “fun BiologicalOrgan
(): (Heart + Brain) {Heart + Brain}” shows a nullary function in which the ex
pression “Heart + Brain” represents both the type of the result and the result
itself.
As Categories are abstract, their instances are always instances of at least one
of their subtypes, and as they are rigid, their instances never cease to be instances
of them. Therefore, if a Category has subtypes, then it can be modeled as a set
that is the union of the instances of its subtypes. So, we model a Category
as a nullary function composed of a constant output that is the union of the
signatures/functions of all of its subtypes. For example, if the Category C1 is
the supertype of C2,...,Cn, then the function “C1” will be the union of “C2
”,...,“Cn”, as shown in [Line 1] of [Listing 5]. If there is a GeneralizationSet
stating that C2,...,Cnare disjoint, then we create a new fact stating that “C2
”,...,“Cn” are pairwise disjoint, as shown in [Line 2] of [Listing 5].
2917
Benevides A.B., Guizzardi G., Braga B.F.B., Almeida J.P.A.: Validating ...
Page 15
Listing 5: Modeling Categories
1 fun C1() : (C2 + ... + Cn) {C2 + ... + Cn}
2 factdisjoint categor ies { di sj[C2,... ,Cn]}
3.3.3Relator Universals and Relations
As one can observe in [Fig. 1], the Relation category in UFO is differentiated in
Formal Relation and Material Relation. Formal Relations are Relations that hold
between two or more entities directly, without any further intervening Individual.
Material Relations, conversely, in order to hold between a number of Individuals,
require that a particular Relator exists mediating them. For instance, we can
say that a particular student x studies in a particular school y iff there is an
Enrollment z that mediates x and y. This situation is illustrated in [Fig. 2]. In
this case, we write that the relation study is derived from the existence of the
Relator Universal Enrollment. This relation of Derivation between a Material
Relation and a Relator Universal is represented in OntoUML by the symbol
, in which the black circle is connected to the Relator Universal. In
general, a Relation R can be formally defined by the following schema:
Definition 5 (Formal and Material Relations): Let ϕ(a1,...,an) denote a
condition on the Individuals a1,...,an. A Relation R is defined for the Univer
sals U1,...,Uniff ∀a1,...,an(R(a1,...,an) ↔((∧i≤nUi(ai))∧ϕ(a1,...,an))).
dition ϕ is obtained from URas follows: ϕ(a1,...,an) ↔ ∃k(UR(k)∧∧i≤nm(k,
Formal Relation.
We have then that an ntuple (a1,...,an) instantiates a Material Relation
R iff there is one Relator r (instance of UR) that mediates (and is existentially
dependent on) every single ai.
Just as Kinds, Relator Universals also provide a principle of identity for
their instances, but this principle is dependent on the principles provided by the
Universals that they mediate. However, OntoUML makes no distinction between
the ultimate Relator Universals and the Relator Universals that are subtypes of
the former, inheriting its unique principle of identity. Therefore, we will take
toplevel Relator Universals as ultimate and model them in Alloy as signatures
([Line 1] of [Listing 6]), as we did for Kinds, and the nontoplevel ones will be
modeled as subsignatures, just as subKinds. The Mediation relationships will be
explained further on.
A Relation is called material if there is a Relator Universal URsuch that the con
ai)). Otherwise, if such a Relator Universal URdoes not exists, R is termed a
?
3.3.4PartWhole Relations
Parthood is a relation of significant importance in conceptual modeling, be
ing present in practically all conceptual modeling languages (e.g., OML, UML,
2918
Benevides A.B., Guizzardi G., Braga B.F.B., Almeida J.P.A.: Validating ...