Ambiguity issues in OCL postconditions

There are two different approaches to specify the behavior of the operations of an Information System. In the imperative approach, the operation effect is defined by means of specifying the set of actions (creation of objects and links, attribute updates...) to apply over the system state. With the declarative approach, the effect is defined by means of contracts stating the conditions that the system state must satisfy before (precondition) and after (postcondition) the operation execution. From a specification point of view, the declarative approach is preferable. The main issue regarding declarative specifications is their ambiguity. Commonly, there are many different system states that satisfy an operation postcondition. However, in general, only one of them is the one the designer had in mind when defining the operation, and thus, that state should be the only one considered valid at the end of the operation execution. In this paper, we identify some of the common ambiguities appearing in OCL postconditions and provide a default interpretation for each of them in order to improve the usefulness of declarative specifications.