Further implementation work has identified problems with certain resolutions in Ballot #5 that urgently need to be corrected.

KERML_-57 Time and space life/slice/portion modeling patterns are missing

1. validateSubsettingConstantConformance – This constraint requires the subsettingFeature to be constant if the subsettedFeature is. However, a feature can only be constant if it is variable. But this makes invalid the reference subsettings of the ends of, e.g., a succession between constant features, because the ends of a succession cannot be variable (since a succession is not a kind of class).
2. validateSubsettingPortionConformance – This constraint requires the subsettingFeature to be a portion if the subsettedFeature is. But this makes invalid the reference subsettings of the ends of any connector between portion features, because end features cannot be portions.
3. validateRedefinitionDirectionConformance – For the purposes of this constraint, the direction of the redefinedFeature is considered relative to the featuringType of the redefiningFeature. However, this does not work if the redefiningFeature is a variable feature with an implied featuringType. (The OCL for the constraint is also wrong: featuringType should be redefiningFeature.featuringType.)
4. validateRedefinitionFeaturingType – This constraint checks that the redefiningFeature has a different featuringType than the redefinedFeature. However, for variable features with implied featuringTypes, this constraint will always be met, even for features with the same owningType, because the constructed featuringTypes will not be equal (even if semantically equivalent).

KERML_-58 checkFeatureParameterRedefinition fails for named-argument invocations

1. checkFeatureParameterRedefinition – The proposed OCL update fixes the problem stated in the issue, but then this breaks positional-argument notation, because there is no semantic constraint requiring implied redefinitions from the invocation parameters to the parameters of the invoked function. (Also, the OCL replacement snippet should have "implies" at the end.)

KERML_-59 OCL for checkFeatureParameterRedefinition is wrong

1. checkFeatureParameterRedefinition – In the proposed OCL, the expression for let i : Integer is syntactically incorrect, and, even if corrected by adding a closing parenthesis, would not return an integer, as required.

KERML_-132 Constructor invocation expressions are semantically inconsistent

1. ConstructorExpression::modelLevelEvaluable – This operation is redefined to make constructor expressions always not model-level evaluable. However, construction using the previous invocation-expression notation could be model-level evaluable, and this can be useful, e.g., for instantiating RiskMetadata::RiskLevel in a metadata usage.
2. validateInvocationExpressionOwnedFeatures – This constraint requires that all ownedFeatures of an InvocationExpression have direction in. However, in the textual notation grammar, certain classification and metaclassification expressions are parsed to OperatorExpressions (a kind of InvocationExpression with type references that become ownedFeatures without any indicated direction.

The term "Item" in the KerML specification is colloquial and pre-existed the introduction of "Item" as a SysML concept. In SysML "Item" is restricted to an Object (Occurrence), disjoint with DataValue. This means that "Items" in SysML cannot be DataValues (for attributes). This is NOT what is specified in KerML, despite the use of the term "Item" there.

Thus, "ItemFlow" in KerML section 8.3.4.9.3 does not correspond at all to "Items" in SysML.

Because users are looking to KerML for descriptions of the foundational semantics underneath SysML, SysML users and vendors will be looking at KerML to understand semantics around flows at the KerML level to inform how to interpret SysML. Because of this, the use of "Item" as a term in KerML is confusing.

8.4.4.9.4 Invocation Expressions states that:

An InvocationExpression may also have the form T(e1, e2, ...), where the invoked Type T is not a Function. In this case, the InvocationExpression acts as a constructor for an instance of the Type T.

The semantics are then that such a constructor expression is both typed by T and a subset of Performances::evaluations. Now, it is allowable for T to be a data type or a structure, that is, for it to directly or indirectly specialize Base::DataValue or Objects::Object). But this is a semantic inconsistency, because Performance (a generalization of evaluations) is disjoint with both DataValue and Object.

Clause 7.3.4.2 (Feature Declaration) and 8.3.3.3.3 (Feature) say

Portion features are composite features where the values cannot exist without the whole, because they are the “same thing” as the whole. (For example, the portion of a person's life when they are a child cannot be added or removed from that person's life.)

isPortion : Boolean
Whether the values of this Feature are contained in the space and time of instances of the domain of the Feature and represent the same thing as those instances.

and Clause 9.2.4.1 (Occurrences Overview) includes an extended description of time and space modeling in occurrences. But the specification does not explain how to model things (objects and performances) at specific times or places, versus over time or space. For example, cars are driven by one person at a time, but potentially many people over time. How should these multiplicities be specified? See other examples in comments on KERML-204.

In 8.3.3.3.3 Feature, the constraint checkFeatureParameterRedefinition requires:

If a Feature is a parameter of an owningType that is a Behavior or Step, other than the result parameter (if any), then, for each direct supertype of its owningType that is also a Behavior or Step, it must redefine the parameter at the same position, if any.

However, in the textual BNF in 8.2.5.8.3 Base Expressions, a NamedArgumentList for an InvocationExpression is parsed with parameter redefinitions in the order of the argument list, not the original parameter list. Indeed, according to the description in 7.4.9.4 Base Expressions, named arguments may be "given in any order". But, if they are given in an order different than the original parameter order, this will violate checkFeatureParameterRedefinition. And then adding implied redefinitions to the InvocationExpression parameters, in the original parameter order, would potentially result each of the InvocationExpression parameters incorrectly redefining two different of the original parameters.

The current abstract syntax for MetadataAccessExpression violates the rule that non-relationship metaclasses should only be (concretely) related by reified relationships. The property MetadataAccessExpression::referencedElement should be derived from such a reified relationship (like FeatureReferenceExpression::referent), rather than pointing directly to an Element.

Documentation for Within, WithinBoth, and SpaceSliceOf in the specification and libraries say they're transitive, but this isn't formalized in the libraries (might be others), as it is for some other time/space associations.

There is currently no validation rule/check constraint which enforces that when doing redefinitions, if redefined feature has isEnd=true, then redefining feature must also have isEnd=true, which opens modelers to errors, e.g. in the KerML spec,
ControlPerformances::DecisionPerformance::outgoingHBLink::earlierOccurrence is not marked as "end" feature.

The current derivation constraint for AnnotatingElement::ownedAnnotatingRelationship is

ownedAnnotatingRelationship = ownedRelationship->
    selectByKind(Annotation)->
    select(a | a.annotatingElement = self)

Resolution KERML_-135 to KERML_-119 makes Annotation::annotatingElement derived, with the derivation

annotatingElement =
    if ownedAnnotatingElement <> null then ownedAnnotatingElement
    else owningAnnotatingElement
    endif

But Annotation::owningAnnotatedElement does not have its own derivation, but is, rather, determined as the inverse property to AnnotatingElement::ownedAnnotatingRelationship. This means that the derivations for AnnotatingElement::ownedAnnotatingRelationship circularly depend on each other and are, therefore, not well defined.

[From Dr. Charles Manion] SpatialItem (eventually) specializes KerML Body, which are required to be 3 dimensional (innerSpaceDimension=3), but the "shapes" in ShapeItems.sysml are all lower dimensional (Curves and Surfaces, innerSpaceDimension=1 and 2, respectively). Since SpatialItem defines coordinates, it would be contradictory to give shapes (and Points, innerSpaceDimension= 0) coordinates.

Current spec mandates that messages are implemented as flow connectors without ends.
>> (8.4.9.6, page 389, "A message declaration of the form ....
>> is parsed as an abstract FlowConnectionUsage, but without any connectionEnds (see 8.2.2.13.4 ),")

Instead, the connectivity information (what this connector is attached to) is implemented as
sourceEvent and targetEvent parameters that need to be redefined.

This is problematic from implementation standpoint as now we need two different codes for drawing/displaying conectors -
one for all connectors except messages and another one for messages.

There seems to be no strong reason why it should be so. Even the very abstract, non-structural,
purely-behavioral connectors, such as Successions do have ends.
It would be better to make message connectors as connectors with ends, as all other connectors.

The only reason to implement them this way seems to be - to make messages "more" distinguishable from flows.
As there is no special metaclass for messages, the same FlowConnectionUsage is reused.
So flow connection with no ends => message, flow connection with ends =>flow seems to be distinguishing criterion.

Now, if user creates connector ends explicitly/forcefully (using the extended syntax of {<connectorbodydetails>}),
the message connection ceases to be distinguishable from flow connection.
But this is a problem, since users do want to specify message connection ends - namely to indicate the sending and receiving parts.

The spec vaguely says (in chapter 7.13.6) that messages should be abstract, while flows (supposedly) should not be so.
The reasoning for no ends for messages seems to be that connectors without bound ends are abstract connectors (there is such a rule elsewhere in the spec),
thus guarranteeing that connector is abstract; but that is a resoning in the opposite direction
(binding of connector ends should not/does not prevent the connector from being abstract).

A better rule to distinguish messages and flows perhaps could be devised.
Heavyweight approach would be to have a dedicated metaclass for messages, but we understand that this would be a signifficant spec change.
Criterion of inheritance from appropriate library class seems to be sufficient?

To summarise:

a) we propose that messages could also have normal connector ends bound to parts.
Perhaps this could be analogous to the arrangement that flow connectors currently have:
when specifying flow connector as being from a.b.c to d.e.f,
the connector ends are filled as a.b and d.e, while the last steps in the chain - c and f go into special flow-specific features.
In the same manner when message is specified as being from a.b.c to d.e.f, the connector ends could be filled as
as a.b and d.e, while the last steps in the chain - c and f (EventOccurrences) go into message-specific features .

b) The rule to distinguish messages and flows should be revised.

There are some errors in the OCL of certain operations add to Feature by the resolution of KERML_-18.

1. In isCartesianProduct, the first two conditions should not be part of the first operand of the following "implies" (otherwise, e.g., a feature with no type or featuring types would incorrectly be considered a Cartesian product).
2. In isOwnedCrossFeature, "owningType" should be "owningNamespace" (because owned cross features are required to be not owned via FeatureMemberships).
3. In ownedCrossFeature, ownedMembers owned via FeatureValues should also be excluded from the list of ownedMemberFeatures being computed.

In section 8.3.2.4.5 - the spec says
A Namespace can provide names for its members via the memberNames and memberShortNames specified by the Memberships in the Namespace.
However, the only subclass of Membership, OwningMembership redefines memberName, thus:
8.3.2.4.8:
/ownedMemberName : String [0..1]

Presumably this means that effectively memberName must equal ownedMemberName in OwningMembership.
There is no constraint to this effect and i can see it would be tricky, give the redefinition.
I wonder whether the metamodel needs a bit of surgery, given that the majority of Memberships are OwningMemberships and therefore have this issue.

The spec says "For an OwningMembership, the owningMemberName and owningMemberShortName are given by the Element name and shortName"

I think this should be ownedMemberName and ownedMemberShortName

<Note that this was found in Version 1.0, Beta 2.2>

Links::Link:participants and their redefinitions BinaryLink::source/target are readonly, but links with more than two ends aren't required to be.

[From Dr. Charles Manion] In 9.2.4.1 (Occurrences Overview), under Time and Space Slices, the first paragraph starts

Time slices are portions that include all the space of their larger Occurrences within a potentially smaller period of time than the whole Occurrence, ...

while the second paragraph starts

Space slices are portions that include all the space of their larger Occurrences, but not necessary all their time,

making it seem like time and space slices aren't different regarding space and time.

Implementation of the resolution to KERML_-39 as approved has identified some needed corrections that need to be made:

1. The revision to the operation Type::directionOfExcluding is missing the functionality to switch in and out directions on features of a conjugated Type relative to its original Type.
2. In the OCL for the operation Type::visibleMemberships, self needs to be added to excluded in the call to inheritedMemberships.
3. In the OCL for the constraint Type::deriveTypeInheritedMembership, the call to inheritedMemberships needs to be updated to reflect the revised signature for that operation.

In addition, adding the operation allRedefinedFeatures to Membership is ill-advised, because it creates a dependency of a Root metaclass (Membership) on a Core metaclass (Feature), in violation of the intended layering.

package p {
    part b {
        part B;
    }
    part A :> b;
    e = A.? { }.B;
}

The pilot implementation creates implied subsetting for the select expression result parameter to specify more specific return type than Anything.
This is so that the select expression application on collection of objects of type X returns result of collection of type X objects

Pilot implementation creates implied Subsetting for SelectExpression::result, but there is nothing in the spec for this situation. There is no information in semantic chapter “8.3.4.8.15 SelectExpression”, no formal constraint. Is that a miss in the spec?

package ShapeItems {
    part equals;
    item edges {
        item vertices;
    }
    assert constraint {
        in i;
        edges#(i).vertices->equals()
    }
}

The pilot implementation creates implied subsetting for the # expression result parameter to specify more specific return type than Anything.
This is so that the # operation application on Sequence of objects of type X returns result of type X.
But there is nothing about this in the specification at the moment.

The sentence "Classes are required to (directly or indirectly) subclassify Object from the Objects library model, while Features typed by Classes must subset objects" should be changed to "Structures are required to (directly or indirectly) subclassify Object from the Objects library model, while Features typed by Structures must subset objects".

In Concrete Syntax subclause 8.2.5.8.2 Primary Expressions, the productions for CollectExpression and SelectExpression refer to the production BodyExpressionMember, which is not actually defined in the concrete syntax grammar. These references should instead be to BodyArgumentMember, as also used in FunctionOperationExpression, and defined later in the same clause.

The description of the checkFeatureParameterRedefinition constraint is

If a Feature is a parameter of an owningType that is a Behavior or Step, other than the result parameter (if any), then, for each direct supertype of its owningType that is also a Behavior or Step, it must redefine the parameter at the same position, if any.

However, the OCL for the constraint does not exclude the result parameter as stated in the description.

7.3.4.1 (Features Overview) says

Values of a composite feature, on each instance of the feature's domain, cannot exist after the featuring instance ceases to exist.

and 8.3.3.3.3 (Feature) says

isComposite : Boolean
Whether the Feature is a composite feature of its featuringType. If so, the values of the Feature cannot exist after its featuring instance no longer does.

but the spec doesn't seem to say anywhere that the values cannot be values of any composite features on any other instance of the feature's domain ("single owner", "tree" property of composition), as typically expected.

Composite features (Feature::isComposite=true) are described as

Values of a composite feature, on each instance of the feature's domain, cannot exist after the featuring instance ceases to exist. This only applies to values at the time the instance goes out of existence, not to other things in the co-domain that might have been values before that.

but this semantics is not math/modeled and Core does not include models of time.

The phrase "read only" is often enough taken to refer to features/properties that write actions (eg, FeatureWritePerformance) should not be applied to (see library errors in KERML-49, modeler misunderstandings in KERML-3 comments and UML constraint errors in UMLR-815), rather than having constant values, as intended.

Clause 9.2.10.1 (Transition Performances Overview) requires two connectors typed by associations, to constrain transitionLink and transitionLinkSource:

The Succession constrained by a TransitionPerformance is specified by a Connector between the Succession and its transitionStep, a unique Step typed by TransitionPerformance or a specialization of it, of the same Behavior as the Succession. This connector is
• typed by an Association defined to give a value to the transitionLink of TransitionPerformances,
• has connector end multiplicity 0..1 on the Succession end and 1 on the TransitionPerformance Step end.

The transitionStep above is also connected to the Succession's sourceFeature, because conditions on the Succession depend on each Occurrence of its sourceFeature separately, which TransitionPerformances identify as their transitionLinkSource. This connector is
• typed by an Association defined to give a value to the transitionLinkSource of TransitionPerformances.
• with connector end multiplicity 1 on both ends.

but

• succession could subset transitionStep.transitionLink (equivalent to a binding with optional multiplicity on succession end)

• bind succession's sourceFeature and its transitionStep.transitionLinkSource (1 to 1 end multiplicities)

giving the desired result without introducing new associations for each transitionStep. This would also align it with SysML's modeling pattern specified in TransitionUsage::checkTransitionUsageSuccessionBindingConnector and checkTransitionUsageSourceBindingConnector.

The way KerML libraries are provided relies on textual notation files on which element declarations do not include the specification of their elementId property.

As consequence, if the elementId is actually generated by the tool, as written in the KerML specification (p226), it is very likely to have a different value from one computer to another and even from one loading to another on the same computer.

Hence, it is impossible to make sure it will "not change during the lifetime of the Element", as required by in the same paragraph of that specification.

Note: a similar issue will be raised on SysMLv2

Attributes
/owningType : Type {subsets type, redefines membershipOwningNamespace, type}

It is not "immediately" clear which 'type' metaproperty of which metaclass is the subsetted one, and which one is the redefined one. I think the semantics is meant to be that the redefines is for Featuring.type while the subsets is for the unnamed Association with the Type.featureMembership at it's other end.

KERML-22 already requests to name the Association, it should probably define the derivation rule for it's owned derived /type metaproperty... probably subsets membershipNamespace.. it may actually redefine membershipNamespace since only types can own FeatureMemberships

Performances::Performance and Objects::Object redefine self in the libraries, but Clauses 9.2.6.2.13 (Performance) and 9.2.5.2.7 (Object) are missing entries for these. Might be other self redefinitions missing also.

The resolution to KERML_-132 introduces a new ConstructorExpression. The textual notation for a ConstructorExpression has an argument list that is parsed like that of an InvocationExpression, into a set of parameters owned via ParameterMemberships, with the argument Expressions related to the parameters by FeatureValue relationships. However, for a ConstructorExpression, the argument parameters are not directly owned by the ConstructorExpression but, rather, by the result of the ConstructorExpression.

Unfortunately, the validateParameterMembershipOwningType constraint requires that the owningType of a ParameterMembership be a Behavior or a Step (an Expression is a kind of Step). This fails in the in the case of the proposed parsing for a ConstructorExpression, because its result Feature is not a Step.

Line 124 in _sysml.library/Kernel Libraries/Kernel Semantic Library
/StatePerformances.kerml_ requires that transitions happen after the nonDoMiddle steps of their source StatePerformance:

private succession transitionLinkSource.nonDoMiddle[*] then Performance::self[1];

Lines 43 and 34 of States.sysml assert that user-defined substates subset nonDoMiddle, resulting in transitions not starting until all the subsates of the transition's source state have finished.

Since transition performances include the evaluation of the trigger and the guard, transitions cannot be taken until all the substates finish.

This goes against the general semantics of state machines, where substates are "interruptable," i.e., transitions leaving the parent state will deactivate substates as well. Note that the notion of "run to completion" only requires the complete processing of an event before dispatching the next one, where "processing" generally means the steps until reaching a stable state configuration, but not waiting in the new states.

The desired behavior would be that transitions start after the complete initialization of a stable state configuration (which most likely consists of all the entry actions of the new state configuration).

Additionally, line 124 is misaligned with the description in KerML 9.2.11.1:

StateTransitionPeformances require their guards to happen after the nonDoMiddle Step of the transitionLinkSource (all the middle Performances except for do) (...).

In fact, the library now requires the whole StateTransitionPeformance to happen after the nonDoMiddle, which technically includes the guard, but is stronger.

Consider the following example:

classifier Organization
classifier Car {
    feature drivers : Person; 
}
classifier Person {
    feature employer : Organization [1] {
        feature salary;
    }
    feature drivenCars : Car {
        redefines feature drivers = that;
    }
}

Now assume we have an M0 universe with organization 'bestCorp', a car 'fastCar', and two persons 'joe' and 'jane', filling the values of corresponding features of persons with the instance(s) of matching type. This will give the following extents:

Organization: { (bestCorp), (joe, bestCorp), (jane, bestCorp) }
Car: { (fastCar), (joe, fastCar), (jane, fastCar) ...? }
Person: { (joe, jane), ...? }
employer: { (joe, bestCorp), (jane, bestCorp) }
salary: { (joe, bestCorp, 100000), (jane, bestCorp, 120000) }
drivenCars: { (joe, fastCar), (jane, fastCar) ...? }
Car::drivers: { (joe, fastCar, joe), (jane, fastCar, jane) ...? }
Person::drivenCars::drivers: { (joe, fastCar, joe), (jane, fastCar, jane), ...? }

Some questions that highlight the meaning of this interpretation:

• Who is Joe's employer (i.e., what is the value of joe.employer)?
  • It is bestCorp.
• Do Jane and Joe work at the same company (i.e., jane.employer == joe.employer)?
  • Yes, the values of these features are the same (bestCorp).
• Do Jane and Joe earn the same at bestCorp (i.e., jane.employer.salary == joe.employer.salary)?
  • No, the values of the feature "salary" for (jane, bestCorp) and (joe, bestCorp) are not the same.
• What car does Joe drive (i.e., what is the value of joe.drivenCars)?
  • He drives fastCar.
• Do Jane and Joe drive the same car (i.e., jane.drivenCars == joe.drivenCars)?
  • Yes, the values of these features are the same (fastCar).
• Who are the drivers of Joe's car (i.e., what is the value of joe.drivenCars.drivers)?
  • They are only Joe because Person::drivenCars::drivers maps from a pair of Joe and fastCar to Joe.
• Who are the drivers of Jane's car (i.e., what is the value of jane.drivenCars.drivers)?
  • They are only Jane because Person::drivenCars::drivers maps from a pair of Jane and fastCar to Jane.
• Who are the drivers of fastCar (i.e., fastCar.drivers)?
  • Nobody, because there is no sequence beginning with fastCar.

The last three questions show the unintended behavior, while those with the employer demonstrate that sometimes this is indeed the desired meaning.

Following the terminology of https://conradbock.org/relation3.html, the underlying problem is that drivenCars is interpreted both as a mapping (or relation) from Person to Car and as a role type specializing Car. Features nested under other features could either be interpreted as the feature of the mapping (or relation), or to the role type. This becomes clear if one tries to refactor this to avoid features nested under features by introducing another classifier:

classifier Organization
classifier Car {
    feature drivers : Person; 
}
classifier Employer :> Organization { 
    feature salary;
}
classifier DrivenCar :> Car {
    // ...?
}
classifier Person {
    feature employer : Employer [1];
    feature drivenCars : DrivenCar;
    bind drivenCars.drivers = self;
}

In this case, the extents would look like this:

Organization: { (bestCorp), (joesEmployer), (janesEmployer) }
Car: { (fastCar), (joesCar), (janesCar) ...? }
Person: { (joe, jane), ...? }
employer: { (joe, joesEmployer), (jane, janesEmployer) }
salary: { (joesEmployer, 100000), (janesEmployer, 120000) }
drivenCars: { (joe, joesCar), (jane, janesCar) ...? }
Car::drivers: { (joesCar, joe), (janesCar, jane) ...? }
DrivenCars::drivers: { (joesCar, joe), (janesCar, jane), ...? }

Answers to the above questions change:

• Who is Joe's employer (i.e., what is the value of joe.employer)?
  • It is joesEmployer.
• Do Jane and Joe work at the same company (i.e., jane.employer == joe.employer)?
  • *No, the values of these features are different (janesCorp vs. joesCorp).
• Do Jane and Joe earn the same at bestCorp (i.e., jane.employer.salary == joe.employer.salary)?
  • No, the values of the feature "salary" for janesCorp and joesCorp are not the same, although we do not know that they work at bestCorp (see previous answer).
• What car does Joe drive (i.e., what is the value of joe.drivenCars)?
  • He drives joesCar.
• Do Jane and Joe drive the same car (i.e., jane.drivenCars == joe.drivenCars)?
  • No, the values of these features are different (janesCar vs. joesCar).
• Who are the drivers of Joe's car (i.e., what is the value of joe.drivenCars.drivers)?
  • They are only Joe because his car is joesCar and that is associated only with Joe.
• Who are the drivers of Jane's car (i.e., what is the value of jane.drivenCars.drivers)?
  • They are only Jane because his car is joesCar and that is associated only with Jane.
• Who are the drivers of fastCar (i.e., fastCar.drivers)?
  • Nobody, because there is no sequence beginning with fastCar.

The KerML abstract syntax defines EndFeatureMembership, ParameterMembership, and ReturnParameterMembership.

These concepts do not add additional semantics to the model, as the same can be expressed using FeatureMembership with the appropriate Feature::isEnd and Feature::direction values on owningFeature.

Abstract syntax users (implementors and SysML v2 API users), are confused about which type of membership to use.

Proposal:
Eliminate EndFeatureMembership and ParameterMembership from the abstract syntax.

These modeling aspects are fully covered by Feature::isEnd and Feature::direction.

[From Steve Jenkins ] In 9.2.4.2.5 (HappensLink), Description, second sentence says

They cannot happen in time (be Occurrences), making them disjoint with LinkObject.

and in Transfer.kerml, HappenLink documentation, starting in the second sentence, says

... they cannot also be Occurrences that happen in time. Therefore HappensLink is disjoint with LinkObject, that is, no HappensLink can also be a LinkObject.

which give disjointness more narrowly than the justifications just before them. The declaration of HappenLink in Transfer.kerml is

assoc HappensLink specializes BinaryLink disjoint from Occurrence { ...

aligning with the disjointness justifications above.

[From Steve Jenkins and Mr. Hans Peter de Koning] Transfers.kerml says

interaction TransferBefore specializes Transfer, HappensBefore
                           intersects Transfer, HappensBefore { ...

where Transfers are Occurrences and HappensBefores are HappensLinks, if you chase up the taxonomy, but Occurrences.kerml says

assoc HappensLink specializes BinaryLink disjoint from Occurrence { ...

so TransferBefore is only interpretable as an empty set (ie, it's not "instantiable", unsatisfiable).

Since unnamed features cannot be referred to by name, there is no textual syntax to specialize them in a type subtyping the featuring type, even though the abstract syntax can express this relationship.

Specialization is key in execution, where our current approach is to specialize and restrict user-defined types to a model that has a single (family of) interpretations, which is included in the set of original interpretatios (see Annex A). This involves redefining and subsetting the user-defined type's features.

Based on the above, we can conclude that there is currently no way to describe an execution trace in the textual syntax for a model which contains unnamed elements.

KerML supports triggers on quantified time, but not quantified space, eg, that an object moves more than a specific distance, or comes within a specific distance of another, etc.

The doc annotations of the datatypes in standard library Collections.kerml in machine readable document ad/23-02-05 are not aligned with the contents of subclause 9.3.3 of the KerML specification.

The documentation content should be made identical. The text in the KerML specification should be leading when drafting a resolution for this issue.

Derived features (Feature::isDerived=true) are described as

Such a feature is typically expected to have a bound feature value expression that completely determines its value at all times.

Whether the values of this Feature can always be computed from the values of other Feature.

but this semantics is not model/mathed.

In Clocks.kerml, the TimeOf function defines the timeContinuityConstraint, which states that (endShots of) immediate predecessors of an occurrence (i.e., those connected via a HappensJustBefore) must get the same timestamp (timeInstant in the model) as the start shot of the occurrence:

inv timeContinuityConstraint {
	doc
	/*
	 * If one Occurrence happens immediately before another, then the TimeOf 
	 * the end snapshot of the first Occurrence equals the TimeOf the second
	 * Occurrence.
	 */
	
	o.immediatePredecessors->forAll{in p : Occurrence; 
		TimeOf(p.endShot, clock) == timeInstant
	}
}	

Compare this to the documentation of HappensJustBefore, which states that "HappensJustBefore is HappensBefore asserting that there is no possibility of another occurrences[sic] happening in the time between the earlierOccurrence and laterOccurrence."

Considering that the intent of the libraries is not to constrain the time model and the format of timestamps, I checked this against three widely-used time models.

With continuous (dense) time, the current formulation of the timeContinuityConstraint might make sense, although it fails to capture that an infinite number of snapshots forming a HappensJustBefore chain may actually take non-zero time.

With discrete time, where a timestamp may be treated as a sequence number, for example, an Integer, the invariant may be too restrictive, as HappensJustBefore could apply to two snapshots that have successive sequence numbers, but have no other occurrence in between them. In fact, in a discrete time model, HappensJustBefore with the current definition degrades to HappensWhile because there is no notion of ordering between events with the same timestamp.

In super-dense time, where a clock is usually represented as a pair of a real value (timestamp) and an integer (sequence number to order events with the same timestamp), the invariant is again not very well defined because a pair with the same timestamp and smaller sequence number is generally considered to be (strictly) "less than".

Overall, I think the difference between HappensBefore and HappensJustBefore cannot be captured in the TimeOf function, but should rather be enforced on the succession graph induced by these relations as specified in the documentation of HappensJustBefore (but not formalized, as far as I am aware), independent of the timestamps. This would imply that the invariant should be removed from the library.

Alternatively, if the intent was to say there is no other possible value between the timestamp of the occurrence and that of its immediate predecessors (which degrades to the current definition with continuous time), the constraint could capture this better by asserting that there is no otherTimeInstant such that otherTimeInstant < timeInstant and TimeOf(p.endShot, clock) < otherTimeInstant. This would allow discrete clocks to assign successive timestamps to occurrences in a HappensJustBefore relation, forbid continuous clocks to assign different timestamps (as there is always another real number between any two), and force pairs in super-dense time to assign pairs with the same timestamp and either the same or successive sequence numbers.

Some (abstract and textual) syntax in Core has (informal) semantics requiring time, such as Feature::isComposite, ::isReadOnly, ::isPortion, as well as ::direction and ::isDerived, see 7.3.4.2 (Feature Declaration) and 8.3.3.3.3 (Feature), but Core does not include a time model.

The execution algorithm in Annex A should could more cases.

The specification in subclause 10.2 lists the textual concrete syntax as one format for model interchange.

However, the textual concrete syntax does not include syntax for the elementId : UUID property of any element specified in such a model interchange. In general, this makes it impossible to derive the net semantic difference between model interchanges of a pair of revisions (or versions) of the same package represented in this format. The elementId identifiers are necessary to detect whether a change constitutes: (1) a newly created element, (2) an updated element (including a moved element), or (3) a deleted element. In general, it will only be possible to derive the net lexical difference. This limitation holds in particular for unnamed (i.e. anonymous) elements, as well as for elements with name and/or shortName changes.

It is therefore debatable whether the textual concrete syntax may be designated as a proper model interchange format.

This limitation of use of the textual concrete syntax as an interchange format should be explicitly addressed through one of the following:

1. Add an explanation of the limitation in the specification.
2. Add a facility in the textual concrete syntax to include representation of the elementId for any element. For usability reasons, implementations should provide a capability to show or hide the elementId snippets in the concrete textual notation editor widgets.

When redefining features, some metaproperties must be respecified even when they're intended to be the same as the redefined ones, while others don't. For example, feature type and multiplicity do not need to be respecified on a redefining feature when they are intended to be the same as the redefined feature, as I understand it, while direction does, even when it is intended to be the same as the redefined feature. Modelers must remember which feature metaproperties need to be respecified and which don't. The textual syntax would be easier to use if this were the same for all feature metaproperties, and more so if metaproperties could always be omitted in redefining features when they are intended to be the same as the redefined feature.

Literal Values

inout

Values of the Feature on each instance are determined either as in or out directions, or both.

In and out discuss 2 concepts of 'determination' of an instances value, and 'use' of an instances value
Is 'inout' ambiguous as to the features determination and use completely or still constrained?
Both 'in' and 'out' require opposite 'determination' than 'use', but can inout allow same 'determination' and 'use'?
To be more clear, can an inout feature be 'determined' 'externally' and 'used' 'externally'?
How is 'inout' different from not providing a directionality constraint?
How does directionality work with specializations like subsetting/redefinition, should there be constraints?

Usecase: large corporation is working on a project, where also other suppliers deliver parts of the product architecture.

To avoid naming collisions in such constellations, it makes sense to use hierarchical package structures. If everyone just uses plain structures, we have potential conflicts with a duplicate declaration of namespaces.
As within large corporations hundreds of engineers can be working of one product class, which might be organized as namespaces, it makes sense to split the definition of multiple namespaces within the same parent namespace in different files to avoid merge conflicts

Example

package Vehicle{
   part engine : MyCorp::Automotive::Engine::SmallEngine;
   part gearFront : MyCorp::Automotive::Transmission::AT8Gear;
   part rearGear : SomeSupplier::Transmission::FancyGear;
}

Possible resolutions:
1) allow duplicate definitions of namespaces and implicitly merges the resulting trees, dangerous as it could happen unintended
2) allow to merge sub-trees of duplicate namespaces with a keyword
2a) all except one namespace declaration require an addendum keyword, injection of elements possible which might expose private information
2b) all namespaces must declare, that extension is possible

example

partial package CommonParent //declaration can be skipped, if nothing except namespace is declared
package CommonParent::GroupA{
  //some declarations
}
package CommonParent::GroupB{
  //some more declarations
}
package CommonParent::IntegrationLayer{} //should work as no explicitly declared namespace is duplicated
package CommonParent::GroupA::Backdoor {} //should generate an error as the explicitly declared namespace GroupA is duplicated

There is currently no constraint that the typing of a subsetting feature conform to the typing of the subsetted feature. For example, the following is currently considered valid:

classifier A;
classifier B;

feature x : A;
feature y : B subsets x;

even if there is no specialization relationship between A and B. Currently, what happens is that y picks up the additions the additional type A due to the subsetting. So the above declaration for y is essentially equivalent to

feature y: B, A subsets x;

Now, unless A and B are declared as disjoint, it is possible that there are instances classified by both A and B, so that this joint typing of y isn't vacuous. Nevertheless, it seems more useful, for static type checking, to presume disjointness and to disallow the above subsetting unless B can be statically determined to specialize A.

This is relevant, in particular, for connectors, in which the related features are determined using reference subsetting. Consider the following:

assoc C {
   end a: A;
   end b: B;
}

feature a1: A;
feature b1: B;

connector c: C from a ::> b1 to b ::> a1;

Because of the above, this is currently allowed. But, as a result, this really seems to make the typing of association ends pretty much useless for connectors.

Clause 8.4.4.12.1 (Multiplicities, Semantics) says

The validateTypeOwnedMultiplicity constraint requires that a Type have at most one ownedMember that is a Multiplicity. If a Type has such an owned Multiplicity, then it is the typeWithMultiplicity of that Multiplicity. The value of the Multiplicity is then the cardinality of its typeWithMultiplicity and, therefore, the type (co-domain) of the Multiplicity restricts that cardinality.

If a Type does not have an owned Multiplicity, but has ownedSpecializations, then its cardinality is constrained by the Multiplicities for all of the general Types of those ownedSpecializations (i.e., its direct supertypes). In practice, this means that the effective Multiplicity of the Type is the most restrictive Multiplicity of its direct supertypes.

The above implies inherited multiplicities do not constrain cardinality of types that

• own a Multiplicity
• inherit them via unowned specializations

while the (math) semantics for specialization and multiplicity says they do (rule 1 in 8.4.3.2, Types Semantics, and rule 5 in 8.4.3.4, Features Semantics, respectively).

The documentation for the validateAssociationStructureIntersection constraint is "If an Association is also a kind of Structure, then it must be an AssociationStructure." with the OCL

oclIsKindOf(Structure) = oclIsKindOf(AssociationStructure)

However, this is really a constraint on the abstract syntax, not user models. Since the current abstract syntax does not have any metaclass that is a subclass of both Structure and Association other than AssociationStructure, this constraint will always be true for every user model. (And, if the abstract syntax did include another subclass of both Structure and Association, then constraint would then be violated by every user model that used that construct!)

In 7.4.9.2 OperatorExpressions, in the bullet for "Classification expressions", it states:

The classification operators may also be used without a first operand, in which case the first operand is implicitly Anything::self (see 9.2.2.2.1). This is useful, in particular, when used as a test within an element filter condition expression (see 7.4.14).

In the concrete syntax, in 8.2.5.8.1 Operator Expressions, the production for ClassificationExpression does, indeed, allow the first operand to be optional. However, there is nothing stated there (or anywhere else in normative Clause 8) about the default for the first operand being Anything::self if it is not given explicitly, as stated in 7.4.9.2.

Clauses 7.4.8.1 (Functions Overview) and 8.4.4.8.2 (Expressions and Invariants) say

An invariant, though, is a boolean expression that must always evaluate to either true at all times or false at all times. By default, an invariant is asserted to always evaluate to true, while a negated invariant is asserted to always evaluate to false.

Expressions are kinds of Steps. The checkExpressionSpecialization constraint requires that Expressions specialize the base Expression Performances::evaluations (see 9.2.6.2.3), which is a specialization of Performances::performances.

the checkInvariantSpecialization constraint requires that Invariants specialize either the BooleanExpression Performances::trueEvaluations (see 9.2.6.2.2) or, if the Invariant is negated, the BooleanExpression Performances::falseEvaluations (see 9.2.6.2.2), both of which are specializations of Performances::booleanEvaluations.

where the Performance library defines

abstract expr trueEvaluations subsets booleanEvaluations { true }

abstract expr falseEvaluations subsets booleanEvaluations { false }

but do not require models to specify when invariant expressions are evaluated, which are the only times the results are required to be true/false. The conditions they test for might be present only when the invariants happen to be evaluated (see KERML-58 for more about this).

Clause 8.3.4.10.2 (FeatureValue) and 8.4.4.11 (Feature Values Semantics) say

A FeatureValue is a Membership that identifies a particular member Expression that provides the value of the Feature that owns the FeatureValue.

A FeatureValue is a kind of OwningMembership between a Feature and an Expression.

but does not require the model to specify when the expression is evaluated. Expressions (as steps) owned by some features are required to happen (be evaluated) during instances of the featuring types (domain) of that feature (see KERML-11), which might be too loose for some applications, while those owned other features are unconstrained, for example, their values could be the results of an expression evaluated before or after the instance of domain types exists. The results could vary over time if the expression reads values of other features. This seems to apply to all the combinations of default/initial feature values.

[From Vince Molnar] Package-level features do not give featuring types, and some have lower multiplicity greater than zero, meaning everything in the universe (instances of Anything), including every data value, is required to give at least that number of values to them (see KERML-56). For example, the libraries include:

Clocks::universalClock[1] {...}
Observation::defaultMonitor[1] : ChangeMonitor[1] {...}
SpatialFrames::defaultFrame : SpatialFrame[1] {...}

Might be others. This one

Occurrences::earlierFirstIncomingTransferSort: IncomingTransferSort{... }

does not give a multiplicity, I couldn't find what this means (even for expressions), tho this particular feature is supposed to have exactly one value.

Clause 7 Language Description includes a large number of example models and snippets, in textual and graphical notation. However, no machine-readable interchange file was submitted for these models. Project interchange files should be provided for them, including textual notation, XMI and JSON versions.

The Type metaclass is concrete (like all the metaclasses in the abstract syntax), making it it syntactically valid to create a Type that is not a Classifier or a Feature. However, Clause 8.4.3.1.2 (Core Semantics Mathematical Preliminaries) requires the set of Types in a model to be the union of the set of Classifiers and Features. This means instances of Type in a model that are not Classifiers or Features are syntactically valid, but not given semantics (it's not possible to tell if instances of such types are valid or not).

Project interchange files (.kpar) were submitted for all model libraries. However, in all cases, these archives only included textual notation model interchange files (.kerml). There should also be normative model library project interchange files in which the models are formatted in XMI and JSON.

Some library types are sufficient, but do give give any conditions. For example, in Occurrences::Occurrence::

portion feature all portions: Occurrence[1..*] subsets spaceTimeEnclosedOccurrences { ... }

only has text documentation between the curly braces, leaving sufficiency to mean that portions and spaceTimeEnclosedOccurrences are equivalent. Might be others like this.

Some library types might be intended to be sufficient. For example, in Occurrences::Occurrence, the values of

feature spaceTimeCoincidentOccurrences: Occurrence[1..*] subsets timeCoincidentOccurrences, spaceEnclosedOccurrences ... { ...
  feature redefines thatOccurrence subsets largerSpace;
  feature redefines thisOccurrence subsets smallerSpace;
  connector :InsideOf from largerSpace references thatOccurrence [1]
                      to smallerSpace references thisOccurrence [1]; }

presumably should include all timeCoincident/spaceEnclosedOccurrences that meet the condition given by the connector, but the feature is not marked as sufficient. Might be others like this.

Clause 8.4.4.6.2 (Binding Connectors) says

binding f1 = f2;

is equivalent to

connector subsets Links::selfLinks {
  end feature thisThing redefines Links::SelfLink::thisThing references f1;
  end feature thatThing redefines Links::SelfLink::thatThing references f2; 

while the next clause, 8.4.4.6.3 (Successions) says

succession first f1 then f2;

is equivalent to

connector subsets Occurrences::happensBeforeLinks {
  end feature earlierOccurrence references f1
    redefines Occurrences::HappensBefore::earlierOccurrence;
  end feature laterOccurrence references f2
    redefines Occurrences::HappensBefore::laterOccurrence; }

The similarity between the clauses implies the first/then notation is short for successions with multiplicity 1..1 on both ends, but the text does not say it, if that's the intention, and should be clarified in any case.

Clause 9.2.9.1 (Control Performances Overview) says

Successions going out of Steps typed by DecisionPerformance or its specializations must:
• ...
• be included in a Feature of its featuringBehavior that unions (see 7.3.2.7) all the outgoing
Successions, and is bound to the outgoingHBLink of the Step (see 7.3.4.6 on feature chaining).

Successions coming into Steps typed by MergePerformance or its specializations must:
• ...
• subset a Feature of its featuringBehavior that unions all the incoming Successions, and is bound to the incomingHBLink of the Step.

but the Description sections of 9.2.9.2.1 (DecisionPerformance) and 9.2.9.2.7 (MergePerformance) say:

All such Successions must subset the outgoingHBLink feature of the source DecisionPerformance.

All such Successions must subset the incomingHBLink feature of the target MergePerformance.

respectively. The same sentences appear in ControlPerformances.kerml as documentation for DecisionPerformance and MergePerformance, respectively, and with other wording in their documentation for outgoingHBLink and incomingHBLink, respectively:

Specializations subset this by all successions going out of a decision step.

Specializations subset this by all successions coming into a merge step.

These allow outgoing/incomingHBLink to have values that are not identified by outgoing/incoming successions when none of the successions is traversed. The pattern in the overview above introduces a feature of {featuringBehavior}} (the one featuring the control step) unioning the successions and binds it to a chain through decision/merge to outgoing/incomingHBLink, ensuring the HB links are identified by the successions.

Clause 8.4.4.7.2 (Steps, under Behavior Semantics) says

The checkStepSpecialization constraint requires that Steps specialize Performances::performances.

checkStepEnclosedPerformanceSpecialization and checkStepSubperformanceSpecialization constraints require that a Step whose owningType is a Behavior or another Step specialize Performances::Performance::enclosedPerformance or, if it is composite, Performances::Performance::subperformance.

checkStepOwnedPerformanceSpecialization constraint requires that a composite Step whose owningType is a Structure or a Feature typed by a Structure specialize Objects::Object::ownedPerformance.

where enclosedPerformances, subperformances, and ownedPerformances (in)directly subset timeEnclosedOccurrences, the values of which happen during the occurrences "having" the value.

The first constraint leaves open the possibility that steps might not happen during the occurrences they are steps of, bc Performances::performances is a step and subsets occurrences, rather than timeEnclosedOccurrences. This conflicts with the normal meaning of the term "step" (a terminology issue), which typically connotes (in library terms) performances that happen during the occurrences they are steps of.

The second constraint prevents the possibility above for steps owned by behaviors or other steps, while the third only prevents it for composite steps owned by structures.

The step keyword looks like it's sometimes used with other intentions than the constraints indicate. For example, in Observation.kerml:

behavior ObserveChange { ...
  step transfer : TransferBefore[1] ... {
    /* Then send changeSignal to changeObserver. */ ... } ... }

↑ Is it intended that observechange occurrences timeenclose the entire transfer (all the way to it's arrival at its target), as required by the second constraint?

struct ChangeMonitor { ...
  step startObservation { ... }
  step cancelObservation { ... }

↑ Is it intended that the values of start/CancelObservation can happen at other times than the ChangeMonitor occurrence referencing them, as allowed by the third constraint?

Transfers::
  step transfers: Transfer[0..*] nonunique subsets performances, binaryLinks { ... }
  step messageTransfers: MessageTransfer[0..*] nonunique subsets transfers { ... }
  step flowTransfers: FlowTransfer[0..*] nonunique subsets transfers { ... }
  step transfersBefore: TransferBefore[0..*] nonunique subsets transfers, happensBeforeLinks { ... }
  step flowTransfersBefore: FlowTransferBefore[0..*] nonunique subsets flowTransfers, transfersBefore { ... }

↑ These are features of (effectively) Anything, including structures and behaviors, so sometimes they'll be time enclosed and sometimes not. For example:

Occurrence::
  feature incomingTransfers: Transfers::Transfer[0..*] subsets Transfers::transfers { ... }
  feature outgoingTransfers: Transfers::Transfer[0..*] subsets Transfers::transfers { ... }

↑ will be time enclosed for transfers into/out of performances, but not objects, assuming the above are redefined as steps in behaviors or structures (or that features specialized from steps are also steps).

Feature direction (Feature::direction:FeatureDirectionKind) is described as

in, out, inout: Specifies the direction of a feature, which determines what is allowed to change its values on instances of its domain:
-in: Things "outside" the instance. These features identify things input to an instance.
-out: The instance itself or things "inside" it. These features identify things output by an instance.
-inout: Both things "outside" and "inside" the instance. These features identify things that are both input to and output by an instance.

but this semantics is not math/modeled and depends on Kernel for instances changing over time.

Sufficient types are (Type::isSufficient=true) are described as

A type gives conditions for what things must be in or not in its extent (sufficient and necessary conditions, respectively).

... the type places additional sufficiency conditions on its instances corresponding to all the necessary conditions.

but this semantics is not math/modeled and the syntax cannot specify that only some necessary conditions are to correspond to sufficient ones.

Abstract types (Type::isAbstract=true) are described as

instances of this Type must also be instances of at least one of its specialized Types.

but this semantics is not math/modeled.

Portion features (Feature::isPortion=true) are described as

Portion features are composite features where the values cannot exist without the whole, because they are the “same thing” as the whole. (For example, the portion of a person's life when they are a child cannot be added or removed from that person's life.)

but this semantics is not math/modeled, at least not in Core, which does not include models of time or space. A syntactic constraint that isPortion implies isComposite also seems to be missing.

Read only features (Feature::isReadOnly=true) are described as

Values of read only features on each instance of their domain are the same during the entire existence of that instance

but this semantics is not model/mathed and depends on Kernel for instances existing in time.

(Note. The resolution to KERML_-57 changes isReadOnly to isConstant, but the lack of formal semantics remains.)

Multiplicity is a feature of a type (feature or classifier), with natural numbers as its type (see description of KERML-1). The math semantics for feature multiplicity (rule 5 in 8.4.3.4, Features Semantics) refers to the multiplicity metaproperty on a feature f as model element, rather than the multiplicity feature on an instance of f 's featuring type, preventing it from covering multiplicity values that change over the life of an instance, and possibly not handling constant values either.

Multiplicity is a feature of a type (feature or classifier), with natural numbers as its type. For a feature f, the values of its multiplicity (as a feature) are allowed cardinalities for the collection of values on each instance of f 's featuring type, while for classifiers they are allowed cardinalities for the collection of its instances. Math semantics for feature multiplicity is available (rule 5 in 8.4.3.4, Features Semantics), but missing for classifier multiplicity. Is it intended that every instance of a classifier give the number of allowable instances of that classifier? What if there are no instances?

1. In 8.3.3.3.10 Subsetting, in the description of validateSubsettingUniquenessConformance, change the second occurrence of subsettedFeature to subsettingFeature.
2. In 8.3.4.5.3 Connector, in the OCL for checkConnectorBinaryObjectSpecialization, "AssocationStructure" should be "AssociationStructure".
3. In 8.3.4.5.4 Succession, in the OCL for checkSuccessionSpecialization, "Occurences" should be "Occurrences".

Subclause 8.3.3.1.10 (Type), includes inheritedMemberships as an operation with a text description, but no OCL.

KerML association end textual notation/abstract syntax give multiplicity, ordering, and uniqueness that can be redundantly stated on the corresponding features of associated classifiers (association ends in SysML1.x/UML sense, see KERML_-16 about terms), eg, in Occurrences:

Occurrence::suboccurrences [1..*] {...}

HappensDuring {end shorterOccurrence [1..*] subsets longerOccurrence.suboccurrences;}

making it possible for multiplicities, ordering, and uniqueness to get out synch between the features, and potentially be inconsistent. See kerml-assoc-redundancy-issue-description-v2.pdf slides attached.

Annotation relationship creation modifies navigable AnnotatingElement::annotation property.

There is a navigable AnnotatingElement::annotation property, so it means AnnotatingElement is modified if Annotation is connected to it. KerML allows Annotation to be defined outside AnnotatingElement, for example AnnotatingElement can be owned in rootNamespace1, but Annotation connecting to that AnnotatingElement can be owned in rootNamespace2.

This causes exactly same problems with models serialization as UML had with NamedElement::clientDependency before making it derived.

If possible AnnotatingElement::annotation should be non-navigable or derived.

The pilot implementation creates a Subsetting from FeatureChainExpression.result to FeatureChainExpression.targetFeature in this example:

package Q {
  part def F {
       part a : A;
  }
  
  part f : F;
  
  part def A {
    part g = f.a;
  }
}

The line part g = f.a parses into:

This is very similar to CheckFeatureResultSpecialization, but there is no CheckFeatureChainExpressionResultSpecialization constraint in the specification defined which would cover this case.

The abstract syntax for MultiplicityRange specifies that bound redefines ownedMember (see 8.3.4.11.2). However, the concrete syntax production for MultiplicityRange (see 8.2.5.11) allows it to have a TypeBody, which can include additional ownedMembers than the bounds. Indeed, the MultiplicityRanges declared in the Base library model have bodies with documentation comments, which are ownedMembers in addition to the declared bounds.

In 8.3.2.4.5 Namspace, the description of the visibleMembership operation states that "If isRecursive = true, also recursively include all visible Memberships of any visible owned Namespaces." According to the OCL "visible owned Namespace" means any owned Namespace with public visibility.

However, if a recursive import has includeAll = true, then it would seem to be expected that the recursion would continue through all nested namespaces, not just those with public visibility. Indeed, Expose relationships always have includeAll = true, specifically so elements can be exposed in views without regard to visibility. Right now, though, a recursive Expose will not include any elements from private nested Namespaces,

When a feature subsets a feature chain, the subsetting feature inherits features from the last feature in the subsetted feature chain. However, the OCL for the operation directionOf in 8.3.3.1.10 Type does not take this into account. It traverses upwards in the specialization and conjugation hierarchy without checking for feature chains.

For example, consider the model

behavior B {
    composite step s { in x; }
}

struct S {
    step b : B;
    feature f {
        feature c chains b.s;
        step s1 subsets c { out x1 redefines x; }
    }
}

In this model, the in parameter x is inheritable from b.s, so it can be redefined by x1 in step s1. However, according to the constraint validateRedefinitionDirectionConformance, one would expect that it would be an error to redefine x1 to be an out parameter, since x is an in parameter. But validateRedefinitionDirectionConformance uses the directionOf operation, which traverses the ownedSpecializations of feature c without considering its feature chaining. As a result, the directionOf parameter x relative to s1 is null rather than in, and the desired constraint does not apply.

The properties Expression::result and Function::result subset parameter, which means they do not have to be ownedFeatures.

The description of deriveExpressionResult states that

If an Expression has a parameter owned via a ReturnParameterMembership, then that is its result parameter. Otherwise, its result parameter is the result parameter inherited from its function.

As written, the OCL interprets this as meaning that the result parameter of an Expression is either owned by that Expression or inherited from the function of that Expression. However, this derivation does not allow for the possibility that an Expression might inherit its result parameter from a supertype Expression. It would seem to make more sense just to select the result as the parameter owned via a ReturnParameterMembership, whether directly owned or inherited (i.e., owned by a supertype) .

Somewhat similarly, the description of the constraint deriveFunctionResult states that

The result parameter of a Function is its parameter owned via a ReturnParameterMembership (if any).

However, the OCL requires that the result parameter of a Function be owned by that Function and cannot be inherited. That seems to be more restrictive than was intended for this constraint.

It is allowable to have imports at the top-level in a root namespace. If such an import is public, then anything so imported becomes visible in the scope of the global namespace, without qualification. This can potentially introduce name resolution ambiguities that makes global namespace resolution much more difficult.

For example, consider the following three root namespaces (perhaps from separate textual notation files);

package Namespace1 {
    classifier A;
    classifier B;
}

public import Namespace1::*;
package Namespace2 {
   ...
}

public import Namespace1::*;
package Namespace3 {
   ...
}

The classifiers A and B are now globally available not only as Namespace1::A and Namespace1::B from the first root namespace, but also by the unqualified names A and B from both of the other two root namespaces. (And this ambiguity is not invalid according to the global namespace name resolutions rules in 8.2.3.5.4.)

While it can be useful to be able to import names at the top-level into a root namespace, it does not seem necessary to be able to publicly re-export such names into the global namespace. So, disallowing public imports in the root namespace would simplify global name resolution without really removing any particularly useful functionality.

When a Feature has chainingFeatures, then it is sometimes useful to reference that last Feature in the chain in situations in which one would otherwise reference the owning Feature itself if there was no chain. For instance, in a graphical view, an edge with a chained Feature at an end will generally point to the last chainedFeature (possibly nested) rather than the chained Feature itself.

Currently, this means that it is necessary to check for a feature f whether f.chainingFeature is non-empty and, if so, use f.chainingFeature->last() instead of f. It would be more convenient to have a derived property of Feature (called, say, targetFeature) that would do this automatically, that is, be derived as

targetFeature = if chainingFeature.isEmpty() then self else chainingFeature->last() end if

Resolution KERML_-82 to issue KERML_-37, approved in FTF2 Ballot 1, resulted in a property targetFeature to the metaclass Feature. Unfortunately, this causes a name conflict with the similar named properties that already exist in Feature subclasses Connector and FeatureChainExpression.

In general, Feature::type can have more than one value, and there is no restriction on this for end Features. The Association::relatedType property is derived as all the types of all the associationEnds of the Association. However, Association::sourceType is derived to be just the first relatedType. But consider the following Association:

assoc A {
    end feature x : X1, X2;
    end feature y : Y1, Y2;
}

Even though this is a binary Association (it has exactly two ends), it has four relatedTypes: X1, X2, Y1 and Y2. As a binary Association, though, it (implicitly) specializes the library Association BinaryAssociation, with the first end redefining the source and the second end redefining the target. However, with the current derivation, the sourceType of A will be only X1, and the targetTypes will be X2, Y1 and Y2 – even though X2 is a type of the source end.

In 7.4.13 Metadata, the very last example is the declaration

#SecurityRelated #command def Save;

However, def is not a KerML keyword.

In 9.1 Model Libraries Overview, in the first bullet describing the generation of stable model library UUIDs:

1. In the first sub-bullet, it states "name space identifier shall be the NameSpace_URL UUID, as given in [UUID, D.9] (which is 6ba7b812-9dad-11d1-80b4-00c04fd430c8)." The value given for the NameSpace_URL is incorrect. According to the referenced source standard, it should be 6ba7b811-9dad-11d1-80b4-00c04fd430c8 (the last digit of the first block should be 1, not 2).
2. In the second sub-bullet it states "name shall be the URL constructed by prepending https://www.omg.org/KerML/ to the name of the package..." The URL given here should be the standard OMG base URI https://www.omg.org/spec/KerML/ (this was what was actually used to generate the UUIDS in the standard XMI for the library models).

In 8.4.3.1.2 (Core Semantics Mathematical Preliminaries), second bullet list, second bullet (starting "An interpretation"), says

I = (Δ,Σ,⋅^_T) ... is a 2-tuple

The bullets after this describe three elements for I.

[From Brian Larson] In 8.4.3.1.2 (Core Semantics Mathematical Preliminaries), the co-domain of the interpretation function (.^_T) is expressed as

which seems to say all sequences in S begin with the same element of the universe d ₁, is this intended?

Resolution KERML_-79 to issue KERML_-73, approved in Ballot 1, introduces the new validation constraint validateImportTopLevelVisibility with the OCL:

importOwningNamespace.owningNamespace = null implies 
    visibility = VisibilityKind::private

However, the check in the OCL needs to be on importOwningNamespace.owner rather than importOwningNamespace.owningNamespace, because a filtered import is parsed as having a nested package that is actually owned via a NamespaceImport relationship rather than a Membership. In this case, the package will not have an owningNamespace, but it will still not be the root namespace, because it has an owner.

Clause 7.4.5 (Associations), first two paragraphs after the references at the top describes how to declare associations and use of end features, but the

• only example of association end features is later when explaining the more advanced case of association specialization. The text references an earlier very brief description of end features in 7.3.4.2 (Feature Declaration), which points back to 7.4.5 for more information.

• third paragraph (the one starting "An association is also a relationship between the types") describes related types, but does not mention these are same as the end feature types, as specified by the deriveAssociationRelatedType constraint in 8.3.4.4.2 (Association).

Would helpful for 7.4.5 to include a simple example of association end features near the beginning where they are described, and to explain that related types are the same as end feature types.

Clause 8.4.4.6.1 (Connectors, Semantics) says (see KERML-34 for term definitions)

the checkFeatureEndRedefinition constraint requires that the connectorEnds of a Connector redefine the associationEnds of its typing Associations. As a result, a Connector typed by an N-ary Association is essentially required to have the form (with implicit relatiojnships included):

connector a : A subsets Links::links {
end feature e1 redefines A::e1 references f1;
end feature e2 redefines A::e2 references f2;
...
end feature eN redefines A::eN references fN; }

where e1, e2, ..., eN are the names of associationEnds of the Association A, in the order they are defined in A, and the f1, f2, ..., fN are the relatedFeatures of the Connector. Multiplicities declared for connectorEnds have the same special semantics as for associationEnds (see 8.4.4.5).

while 8.3.3.3.8 (Redefinition), under Description (and similar wording in 7.3.4.5 Redefinition) says

Redefinition is a kind of Subsetting that requires the redefinedFeature and the redefiningFeature to have the same values (on each instance of the domain of the redefiningFeature). This means any restrictions on the redefiningFeature, such as type or multiplicity, also apply to the redefinedFeature (on each instance of the domain of the redefiningFeature), and vice versa.

preventing connector ends from giving a smaller lower multiplicity of the corresponding end of their (association) type. For example, people have exactly two parents, but a connector typed by that association might need to specify a [0..2] multiplicity on the parent end to reflect a particular purpose of identifying parents by that connector (such as "lives with").

This restriction is mentioned informally in Clause 8.4.4.6.2 (Binding Connectors):

Since both associationEnds of SelfLink have multiplicity 1..1, both connectorEnds of a BindingConnector do also.

even though some bindings in the libraries have optional connector end multiplicities (see KERML_-13).

The textual and abstract syntaxes (at least) for association end features do not relate to the corresponding ones in the associated classes (association ends in SysML1.x/UML sense, see KERML-34 for term definitions), leaving modelers and tool builders only non-standard ways of maintaining consistency between them. The libraries use a feature subsetting for this, but are not required to. For example, in Occurrences::HappensBefore, the earlier/laterOccurrence association end features subset the corresponding predecessors/successors features of the asssociated occurrence class by chaining through the other end feature:

assoc all HappensBefore specializes HappensLink, Without {
  end feature earlierOccurrence: Occurrence[0..*] ... subsets laterOccurrence.predecessors;
  end feature laterOccurrence: Occurrence[0..*] ... subsets earlierOccurrence.successors; }

abstract class Occurrence specializes Anything { ...
  feature predecessors: Occurrence[0..*] ... {...}
  feature successors: Occurrence[0..*] ... inverse of predecessors {...} }

End features can be multiply subset, and do not identify which subsetting maintains consistency with the corresponding features in the associated classes, preventing tool builders from depending on the subsetting pattern to identify the corresponding features of the associated classifiers, even if the pattern were required.

Clauses 7.4.5 (Associations) and 8.4.4.5.1 (Associations) say

if an association end has a multiplicity specified other than 1..1, then this is interpreted as follows: For each association end, the multiplicity, ordering and uniqueness constraints specified for that end apply to each set of instance of the association that have the same (single) values for each of the other ends. For a binary association, this corresponds to the multiplicity resulting from "navigating" across the association given a value at one end of the association to the other end of the association.

If an associationEnd has a declared multiplicity other than 1..1, then this shall be interpreted as follows: For an Association with N associationEnds, consider the i-th associationEnd ei. The multiplicity, ordering and uniqueness constraints specified for ei apply to each set of instances of the Association that have the same (singleton) values for each of the N-1 associationEnds other than ei.

but this semantics is not math/modeled. In addition, the text above

• does not seem to consider instances of associated classes that do not participate in any links, because only refers to instances of links. In the Product Selection example, the cart in red on the bottom left of the first slide violates the linkedProduct "end" multiplicity 1..*, but the text above would not detect it because it does not participate in any link.
• Applies multiplicity, ordering and uniqueness to links (last sentence), which don't have these characteristics, rather than a feature with the values of ei from all the links.

The specification gives Feature::multiplicity, ordering, and uniqueness very different meanings for what it calls "end" features (see KERML-34 for definition of terms) than other features. This requires modelers and tool builders to create special cases in their minds and implementations to accommodate it. It also prevents

• connector ends from giving smaller lower multiplicity than their association ends (see KERML-55)
• participant features from specifying how many values they have (see KERML-35)
• multiplicities from being uniquely specified (see KERML-36).

Normally feature multiplicity restricts the number of values of a feature, but for association "end" features it restricts the number of values of the corresponding features of associated classifiers (association ends in SysML1.x/UML sense,(see KERML-34 for definition of terms) about terms), see excepts below. For example, in the Product Selection example, the info feature of association Selection has the usual semantics for multiplicity, but the "end" features linkedCart an linkedProduct do not. The same comments apply to end ordering and uniqueness.

Clause 7.4.5 (Associations) says

The semantics of multiplicity is different for end features from that for non-end features (as described in 7.3.4.2). The end features of an association determine the participants in the links that are instances of the association and, as such, effectively have multiplicity of "1" relative to the association. But, if an association end has a multiplicity specified other than 1..1, then this is interpreted as follows: For each association end, the multiplicity, ordering and uniqueness constraints specified for that end apply to each set of instance of the association that have the same (single) values for each of the other ends. For a binary association, this corresponds to the multiplicity resulting from "navigating" across the association given a value at one end of the association to the other end of the association.

Clause 8.4.4.5.1 (Associations) says

As endFeatures, the associationEnds of an Association are given a special semantics compared to other Features. Even if an associationEnd has a declared multiplicity other than 1..1, the associationEnd is required to effectively have multiplicity 1..1 as a participant in the Link. Note that the Feature Link::participant is declared readonly, meaning that the participants in a link cannot change once the link is created.

If an associationEnd has a declared multiplicity other than 1..1, then this shall be interpreted as follows: For an Association with N associationEnds, consider the i-th associationEnd ei. The multiplicity, ordering and uniqueness constraints specified for ei apply to each set of instances of the Association that have the same (singleton) values for each of the N-1 associationEnds other than ei.

Clause 8.3.3.3.3 (Feature) says

isEnd : Boolean
Whether or not the this Feature is an end Feature, requiring a different interpretation of the multiplicity of the Feature. An end Feature is always considered to map each domain instance to a single co-domain instance, whether or not a Multiplicity is given for it. If a Multiplicity is given for an end Feature, rather than giving the co-domain cardinality for the Feature as usual, it specifies a cardinality constraint for navigating across the endFeatures of the featuringType of the end Feature.

That is, if a Type has n endFeatures, then the Multiplicity of any one of those end Features constrains the cardinality of the set of values of that Feature when the values of the other n-1 end Features are held fixed.