On the Correctness of Model Transformations in the Development of Embedded Systems

Model based techniques have become very popular in the development of software for embedded systems, with a variety of tools for design, simulation and analysis of model based systems being available (such as Matlab's Simulink [20], the model checking tool NuSMV [4] etc.). Model transformations usually play a critical role in such model based development approaches. While the available tools are geared to verify properties about individual models, the correctness of model transformations is generally not verified. However, errors in the transformation could present serious problems. Proving a property for a certain source model becomes irrelevant if an erroneous transformation produces an incorrect target model. One way to provide assurance about a transformation would be to prove that it preserves certain properties of the source model (such as reachability) in the target model. In this paper, we present some general approaches to providing such assurances about model transformations. We will present some case studies where these techniques can be applied.