Colin Atkinson

Vitruvius manages heterogeneous EMF models as participants in a Virtual Single Underlying Model (V-SUM) and preserves their consistency through change-driven Reactions. However, due to its EMF basis, it represents each participant using a strict two-level classification arrangement, places rules outside the managed content, and binds consistency specifications to domain-specific Ecore types. This paper investigates whether PAMoLa, a self-describing and level-agnostic modeling substrate, can mitigate these limitations without requiring changes to Vitruvius. The key is the PAMoLa Ecore Metamodel (PEM), a single, fixed Ecore metamodel whose instances represent PAMoLa domain classifiers, instances and values as ordinary model content. Once the PEM is registered as a Vitruvius domain, every PAMoLa model becomes an ordinary XMI participant, irrespective of its domain or ontological depth. Using a published brake-system case study, we examine five model-management benefits that follow from this arrangement and state their costs explicitly. The clearest benefit concerns the reuse of consistency logic. Inspection of the source reveals 24 nearly identical forward routines that mirror brake attributes into CAD parameters. We recast this family as one structural reaction pattern accompanied by 24 declarative feature bindings, and implement the pattern for integer-valued attributes. Finally, a cross-case artifact analysis and comparisons with Commonalities, EMF Views, and Openflexo federation delimit its applicability.

Confidentiality-preserving consistency checking is essential in cross-organizational engineering projects, where participating parties do not want to freely share their model data due to confidentiality and trust issues. Performing consistency checks can be a confidentiality risk as it usually requires accessing, storing and processing the data under the governance and ownership of one of these parties. Trusted Execution Environments (TEEs) could potentially support this task by isolating computations and enforcing remote attestation, yet their security and practicality in this domain are insufficiently understood. This article provides a systematic assessment of attack surfaces and leakage threats inherent to multi-model consistency checking. We develop a methodology and analysis framework to identify vulnerabilities across the full consistency checking workflow and then map these vulnerabilities to the guarantees of common TEEs. Our evaluation shows that TEEs mitigate critical confidentiality threats, particularly during runtime processing, but do not fully address all leakage and trust-establishment risks inherent to cross-organizational consistency checking. The analysis further shows that some of the remaining vulnerabilities require complementary safeguards beyond enclave-based protection, such as attestation-based provisioning mechanisms, distributed trust approaches, or controlled result disclosure. A prototype implementation demonstrates the practical overhead of TEE-protected consistency checking and confirms its feasibility for representative workloads. Together, these results provide a structured assessment of the security characteristics, limitations, and practical applicability of TEEs for confidential multi-model consistency checking.

Confidentiality-preserving consistency checking is essential in cross-organizational engineering projects, where participating parties do not want to freely share their model data due to confidentiality and trust issues. Performing consistency checks can be a confidentiality risk as it usually requires accessing, storing and processing the data under the governance and ownership of one of these parties. Trusted Execution Environments (TEEs) could potentially support this task by isolating computations and enforcing remote attestation, yet their security and practicality in this domain are insufficiently understood. This article provides a systematic assessment of attack surfaces and leakage threats inherent to multi-model consistency checking. We develop a methodology and analysis framework to identify vulnerabilities across the full consistency checking workflow and then map these vulnerabilities to the guarantees of common TEEs. Our evaluation shows that TEEs mitigate many but not all threats; in particular, enclave setup on an untrusted host remains a critical gap. To address this, we propose a secure setup protocol that binds code identity, attestation, and key establishment. A prototype implementation demonstrates the practical overhead of TEE-protected consistency checking and confirms its feasibility for realistic workloads. Together, these results offer the first comprehensive analysis of the security and practicability of TEEs for confidential multi-model consistency checking.

The ability of Generative AI (GAI) technology to automatically check, synthesize, and modify software engineering artifacts promises to revolutionize all aspects of software engineering. Using GAI for software engineering tasks is consequently one of the most rapidly expanding fields of software engineering research, with over a hundred LLM-based code models having been published since 2021. However, the overwhelming majority of existing code models share a major weakness—they are exclusively trained on the syntactic facet of software, significantly lowering their trustworthiness in tasks dependent on software semantics. To address this problem, a new class of “Morescient” GAI is needed that is “aware” of (i.e., trained on) both the semantic and static facets of software. This, in turn, will require a new generation of software observation platforms capable of generating large quantities of execution observations in a structured and readily analyzable way. In this article, we present a vision and roadmap for how such “Morescient” GAI models can be engineered, evolved, and disseminated according to the principles of open science.

Generative AI (GAI) holds great potential to improve software engineering productivity, but its untrustworthy outputs, particularly in code synthesis, pose significant challenges. The need for extensive verification and validation (V&V) of GAI-generated artifacts may undermine the potential productivity gains. This paper proposes a way of mitigating these risks by exploiting GAI’s ability to generate multiple versions of code and tests to facilitate comparative analysis across versions. Rather than relying on the quality of a single test or code module, this “differential GAI” (D-GAI) approach promotes more reliable quality evaluation through version diversity. We introduce the Large-Scale Software Observatorium (LASSO), a platform that supports D-GAI by executing and analyzing large sets of code versions and tests. We discuss how LASSO enables rigorous evaluation of GAI-generated artifacts and propose its application in both software development and GAI research.

Multi-level modeling languages differ in their approaches for controlling the properties of model elements over multiple modeling levels. Over the years the original approach for deeply characterizing model elements, the potency-based deep instantiation mechanism, has received a number of criticisms related to its flexibility, level stability, ontological soundness, type safety, and ability to reduce accidental complexity. However, some of these criticisms are founded on misconceptions and thus cannot usefully inform multi-level modeling language designs. In this paper we identify and clarify these misconceptions in order to help guide future considerations of language feature trade-offs and design choices.

As the scale, complexity, and scope of software-intensive systems continue to grow, so does the importance of synergistically integrating two important emerging paradigms in software engineering - multi-level modeling and multi-view modeling. While stable tooling for both has been developed by research institutions in recent years, to date no tool has attempted to integrate the two at a fundamental level. In this paper, we describe some first steps we have taken in this direction by integrating the Vitruvius V-SUM-based multi-view environment with the Melanee multi-level modeling environment. In particular, we show how Vitruvius's Reactions language, which allows different models in Vitruvius V-SUMs to be kept consistent, can be extended to support multi-level V-SUMs and views represented in Melanee's dialect of multi-level modeling.