Library and versions

KerML Kernel Function Library, SequenceFunctions, file sysml.library/Kernel Libraries/Kernel Function Library/SequenceFunctions.kerml, lines 57 to 61. The text is identical at SysML-v2-Release tags 2026-07 and 2026-09 (commit b7a6b770) and at master (9546486f), checked 2026-11-03. Not checked against the machine-readable library of the published specification.

function includingAt{ in seq: Anything[0..*] ordered nonunique; in values: Anything[0..*] ordered nonunique;
    in index: Positive[1];
    return : Anything[0..*] ordered nonunique =
        (seq->subsequence(1, index - 1), values, seq->subsequence(index + 1));
}

Problem

The result keeps seq elements 1 to index−1, then values, then seq elements from index+1. The element seq#(index) is in none of the three parts, so it is dropped. The function replaces the item at index instead of inserting values at it.

The library uses the function as an insertion. The behavior addAt (same file, lines 91 to 97) is declared next to add and removeAt and binds seq to seq->includingAt(values, index). Its sibling excludingAt uses endIndex + 1 for its tail, which is the correct shift for a removal. The same shift is wrong for an insertion.

The library file has no doc comment on includingAt, so the intended meaning is taken from its name, from addAt and from excludingAt. We did not find a normative description of it in the specification text.

Expected and actual result

By reading the expression (not run):

• (10, 20, 30)->includingAt(99, 2) gives (10, 99, 30). An insertion gives (10, 99, 20, 30).
• The result has the same length as seq, and 20 is lost.
• Only index = size(seq) + 1 gives the expected result, because the tail is then empty anyway.

Proposed resolution

return : Anything[0..*] ordered nonunique =
    (seq->subsequence(1, index - 1), values, seq->subsequence(index));

This keeps the other two parts unchanged and keeps the tail empty when index = size(seq) + 1.

7.2.5.1 (Namespaces Overview) says

Normally, name resolution begins by searching in the local namespace containing the qualified name reference. If local name resolution is not successful, the search proceeds outwards to successive containing namespaces ...

Applied to this example:

class A {
  feature x;
  feature y; 
  feature z {
    feature u unions x, y; }}

references to x and y under z are resolved as A::x and A::y, respectively. The interpretation of u is exactly the union of interpretations of x and y, per semantic constraint 3 in Clause 8.4.3.2 (Types Semantics). This means for x or y to have interpretations (values), which is probably intended at least sometimes, then all the interpretations of x and y must be triples (to "navigate" through a value of z). This omits the minimal interpretations (pairs of them in this case) needed to make the triples valid, per semantic constraint 3 in Clause 8.4.3.4 (Features Semantics). For example, for the triple (a1, z1, x1) to be an interpretation of x, the pair (a1, x1) must be also, but this cannot be a interpretation of u, because it's missing the middle "step in navigation" through z.

Modelers can address the problem with that :

class A {
  feature x; 
  feature y; 
  feature z {
    feature thatA : A = that;
    feature u unions thatA.x, thatA.y; }}

because the interpretations of u can be triples without preventing pairs as interpretations of x and y. The specification does not explain this or provide a math/modeled semantics to make it unnecesary.

Feature::checkFeatureDataValueSpecialization: exists(selectByKind(X)) is not a Boolean condition

Where:          KerML 1.0 (formal/2026-03-01), §8.3.3.3.4 Feature, PDF p.191 (printed 165)
Published OCL:  ownedTyping.type->exists(selectByKind(DataType)) implies specializesFromLibrary('Base::dataValues')
Correction:     ownedTyping.type->exists(oclIsKindOf(DataType)) implies specializesFromLibrary('Base::dataValues')
Proof of fault: exists needs a Boolean body; selectByKind yields a collection, so the condition can never hold.
Likely cause:   Original error, replicated across a family. Three rules share the ill-typed exists(selectByKind(X)) pattern (DataType, Class, Structure).
Nearest rule:   Feature::checkFeatureOccurrenceSpecialization (KerML 1.0 PDF p.192 (printed 166)): ownedTyping.type->exists(selectByKind(Class)) implies specializesFromLibrary('Occurrences::occurrences')
Same defect in: Feature::checkFeatureDataValueSpecialization, Feature::checkFeatureOccurrenceSpecialization, Feature::checkFeatureObjectSpecialization
Basis of fix:   The only well-typed reading of the prose; OMG's reference implementation behaves the same way.

Provenance: found by deterministic checks of the OCL against the metamodel and OMG's reference implementation; the argument was reviewed and challenged by the reporter before filing. Further information on these methods is available on request.

Not blocking: we are proceeding with the correction above in our own implementation.

Feature::checkFeaturePortionSpecialization: includes(oclIsKindOf(X)) compares types with a Boolean

Where:          KerML 1.0 (formal/2026-03-01), §8.3.3.3.4 Feature, PDF p.194 (printed 168)
Published OCL:  isPortion and ownedTyping.type->includes(oclIsKindOf(Class)) and owningType <> null and (owningType.oclIsKindOf(Class) or owningType.oclIsKindOf(Feature) and owningType.oclAsType(Feature).type->exists(oclIsKindOf(Class))) implies specializesFromLibrary('Occurrence::Occurrence::portions')
Correction:     isPortion and ownedTyping.type->exists(oclIsKindOf(Class)) and owningType <> null and (owningType.oclIsKindOf(Class) or owningType.oclIsKindOf(Feature) and owningType.oclAsType(Feature).type->exists(oclIsKindOf(Class))) implies specializesFromLibrary('Occurrences::Occurrence::portions')
Proof of fault: includes tests a collection of Types for a Boolean value, which it can never contain.
Likely cause:   Original error, replicated across a family. Three rules share includes(oclIsKindOf(X)) (portion, suboccurrence, subobject).
Nearest rule:   Feature::checkFeatureSuboccurrenceSpecialization (KerML 1.0 PDF p.194 (printed 168)): isComposite and ownedTyping.type->includes(oclIsKindOf(Class)) and owningType <> null and (owningType.oclIsKindOf(Class) or owningType.oclIsKindOf(Feature) and owningType.oclAsType(Feature).type->exists(oclIsKindOf(Class))) implies specializesFromLibrary('Occurrence::Occurrence::suboccurrences')
Same defect in: Feature::checkFeaturePortionSpecialization, Feature::checkFeatureSuboccurrenceSpecialization, Feature::checkFeatureSubobjectSpecialization
Basis of fix:   The same body uses the intended form two lines later; counts match OMG's reference export.
Note:           The library path 'Occurrence::Occurrence::portions' (for Occurrences::) is already reported in KERML11-205/206; this issue is the includes/exists condition only.

Provenance: found by deterministic checks of the OCL against the metamodel and OMG's reference implementation; the argument was reviewed and challenged by the reporter before filing. Further information on these methods is available on request.

Not blocking: we are proceeding with the correction above in our own implementation.

1. The model-level evaluation of a MetadataAccessExpression (operator meta) returns a set of MetadataFeatures for a referencedElement, including

   ...a MetadataFeature whose annotatedElement is the
   referencedElement, whose metaclass is the reflective Metaclass corresponding to the MOF class of the referencedElement and whose ownedFeatures are bound to the values of the MOF properties of the
   referencedElement.

   (See the operation evaluate in 8.3.4.8.15 MetadataAccessExpression.)

2. An AnnotatingElement has annotatedElement as one of its MOF properties (se 8.3.2.3.2 AnnotatingElement). In the reflective model KerML.kerml, AnnotatingElement::annotatedElement redefines Metaobject::annotatedElement (see 9.2.17 KerML, item 2, last bullet).
3. Therefore, the model-level evaluation of a MetadataAccessExpression on an AnnotatingElement will produce a MetadataFeature whose annotatingElement is set the referencedElement, not the value actual in the abstract syntax. For example, given

   structure S;
   comment C about S;
   

   The model-level value of the expression "(C meta KerML::Comment).annotatedElement" is C, while the likely expectation is that it should be S.

KerML 10.4.2 (Table 14) maps the UML primitive types Integer and Real to the JSON Schema types integer and number, respectively. The normative KerML.json and SysML.json artifacts consequently declare:

LiteralInteger.value:  {"oneOf": [{"type": "integer"}, {"type": "null"}]}
LiteralRational.value: {"oneOf": [{"type": "number"},  {"type": "null"}]}

These are the only model properties in either schema whose JSON Schema type is integer or number.

The values of these properties are unbounded:

• LiteralInteger::value represents a mathematical integer (8.3.4.8.12; 9.3.2.2.3).
• LiteralRational::value represents a rational value (8.3.4.8.13; 8.4.4.9.2, Note).
• The textual notation places no bound on the number of digits in DECIMAL_VALUE or EXPONENTIAL_VALUE (8.2.2.4, 8.2.5.8.4).

JSON syntax itself does not impose a fixed numeric range or precision. However, RFC 8259 section 6 explicitly permits implementations to limit the range and precision of accepted numbers and states that good interoperability is achieved when no more range or precision than IEEE 754 binary64 is expected. It further identifies integers in the range [-(2^53)+1, (2^53)-1] as interoperable in the sense that implementations using binary64 will agree exactly on their numeric values.

RFC 7493 (I-JSON) section 2.2 similarly states that numbers requiring greater magnitude or precision than IEEE 754 binary64 should not be sent when interoperability is required, and recommends representing such values as strings.

Consequently, the current KerML JSON mapping does not provide an implementation-independent lossless representation for all legal LiteralInteger and LiteralRational values. An implementation using arbitrary-precision numeric representations can preserve such values, but another conforming JSON implementation is permitted to process them with more limited range or precision.

For example, with IEEE 754 binary64 numeric processing:

• 9007199254740993 cannot be represented exactly and is rounded to 9007199254740992.
• 9223372036854775807 and 9223372036854775808 are distinct integers, but both are converted to the same binary64 value, 2^63. A decimal reserialization of that binary64 value therefore cannot preserve both original values.
• 1.234567890123456789012345678901 cannot be represented exactly and is rounded to approximately 1.2345678901234567.
• 1E400 exceeds the finite range of binary64 and therefore cannot be represented as a finite binary64 value at all.

All of these values are legal in the KerML textual notation and denote valid Integer or Rational values, but their exact values cannot be preserved by such processing.

This creates an interoperability gap in the JSON serialization: a producer cannot use an alternative lossless representation, such as a decimal string, while remaining conformant to the current KerML.json and SysML.json schemas, because the relevant properties permit only JSON numbers or null.

As a result, the current JSON serialization does not provide a portable, lossless representation for the full value domains permitted by KerML numeric literals.

The result expression of VectorFunctions::'cartesian-' applies CartesianVectorOf twice, so it does not compute the difference of two vectors (or the negation of one).

Specification p. 394 and library model (SysML-v2-Release 2026-08, Kernel Libraries/Kernel Function Library/VectorFunctions.kerml, line 222):

function 'cartesian-' specializes '-' {
    in v: CartesianVectorValue[1];
    in w: CartesianVectorValue[0..1];
    inv precondition { w != null implies v.dimension == w.dimension }
    return u: CartesianVectorValue[1] =
        CartesianVectorOf(
            if w == null? CartesianVectorOf(v.elements->collect{in x : Real; -x})
            else CartesianVectorOf(
                (1..v.dimension)->collect{in i : Positive; v#(i) - w#(i)}
            )
        );
}

Both branches of the if already construct a CartesianVectorValue. The outer CartesianVectorOf(...) then takes that vector as its components, which are declared Real[*], so the argument does not conform. Read literally, the result is a one-dimensional vector whose single element is the difference vector. Every v - w and -v on Cartesian vectors is affected. The neighbouring 'cartesian+' has no such outer wrapper.

Example:

package Repro {
    private import VectorFunctions::*;
    attribute d = CartesianVectorOf((1.0, 2.0)) - CartesianVectorOf((3.0, 5.0));
    // expected: elements (-2.0, -3.0), dimension 2
    // as defined: dimension 1, and the one element is a CartesianVectorValue, not a Real
}

Proposed resolution: remove the outer CartesianVectorOf:

return u: CartesianVectorValue[1] =
    if w == null? CartesianVectorOf(v.elements->collect{in x : Real; -x})
    else CartesianVectorOf(
        (1..v.dimension)->collect{in i : Positive; v#(i) - w#(i)}
    );

The definition of SequenceFunctions::includingAt in the Kernel Function Library model drops the element at position index, so the function replaces that element instead of inserting the new values before it.

Library model (SysML-v2-Release 2026-08, Kernel Libraries/Kernel Function Library/SequenceFunctions.kerml, line 57; 9.4.14.2 gives only the signature):

function includingAt{ in seq: Anything[0..*] ordered nonunique; in values: Anything[0..*] ordered nonunique;
    in index: Positive[1];
    return : Anything[0..*] ordered nonunique =
        (seq->subsequence(1, index - 1), values, seq->subsequence(index + 1));
}

The result is seq up to index - 1, then values, then seq from index + 1, so element index of seq is lost. Neither the library nor 9.4.14.2 documents the intended semantics, but insertion is the evident intent:

• The name parallels including, which only adds (union(seq, values)).
• excludingAt(seq, i, i) removes exactly one element; with insertion, it undoes includingAt for a single value.
• SequenceFunctions::addAt (p. 389), and through it OccurrenceFunctions::addNewAt ("Add a newly created occurrence to the given ordered group of occurrences at the given index"), are defined by includingAt. As written, addNewAt deletes an existing member of the group.

Example:

package Repro {
    private import SequenceFunctions::*;
    attribute r = includingAt((1, 2, 4), 3, 3);   // expected (1, 2, 3, 4); as defined: (1, 2, 3)
    attribute s = includingAt((1, 2), 9, 1);      // expected (9, 1, 2);    as defined: (9, 2)
}

Proposed resolution: change the second subsequence to start at index:

return : Anything[0..*] ordered nonunique =
    (seq->subsequence(1, index - 1), values, seq->subsequence(index));

subsequence(seq, index) runs to size(seq) by default and is empty for index = size(seq) + 1, so appending at the end still works.

There is currently no constraint that the typing of a subsetting feature conform to the typing of the subsetted feature. For example, the following is currently considered valid:

classifier A;
classifier B;

feature x : A;
feature y : B subsets x;

even if there is no specialization relationship between A and B. Currently, what happens is that y picks up the additions the additional type A due to the subsetting. So the above declaration for y is essentially equivalent to

feature y: B, A subsets x;

Now, unless A and B are declared as disjoint, it is possible that there are instances classified by both A and B, so that this joint typing of y isn't vacuous. Nevertheless, it seems more useful, for static type checking, to presume disjointness and to disallow the above subsetting unless B can be statically determined to specialize A.

This is relevant, in particular, for connectors, in which the related features are determined using reference subsetting. Consider the following:

assoc C {
   end a: A;
   end b: B;
}

feature a1: A;
feature b1: B;

connector c: C from a ::> b1 to b ::> a1;

Because of the above, this is currently allowed. But, as a result, this really seems to make the typing of association ends pretty much useless for connectors.

The OCL of several constraints and operations in 8.3 uses names that do not resolve: properties, operations, variables, types and enumeration literals that are misspelled or do not exist, and an operation called on a receiver that does not have it. In each case the intended name is clear from the metamodel, from a let variable or parameter of the same OCL, or from the description. In addition, two constraint names are misspelled.

1. In 8.3.2.4.3 Membership, in the OCL for the operation isDistinguishableFrom, oclKindOf should be oclIsKindOf (2 occurrences), and shortMemberName should be memberShortName (5 occurrences).
2. In 8.3.2.4.4 MembershipImport, in the OCL for the operation importedMemberships, importAll should be isImportAll.
3. In 8.3.2.4.5 Namespace:
   1. The name of the constraint validateNamespaceDistinguishibility should be validateNamespaceDistinguishability.
   2. In the OCL for the operation namesOf, Namespace has no property memberships, and the let variable elementMemberships is never used: memberships->select(memberElement = element) should be membership->select(memberElement = element), and memberships.memberShortName and memberships.memberName should be elementMemberships.memberShortName and elementMemberships.memberName.
   3. In the OCL for the operation visibilityOf, memberships->includes(mem) should be membership->includes(mem).
   4. In the OCL for the operation visibleMemberships, selectAsKind should be selectByKind.
4. In 8.3.2.4.8 OwningMembership, in the OCL for the operation path, ownedElement should be ownedMemberElement (2 occurrences).
5. In 8.3.3.1.8 Specialization, the name of the constraint validateSpecificationSpecificNotConjugated should be validateSpecializationSpecificNotConjugated.
6. In 8.3.3.1.10 Type:
   1. In the OCL for deriveTypeOwnedSpecialization, s.special should be s.specific.
   2. In the OCL for deriveTypeOwnedConjugator, Sequence(Conjugator) should be Sequence(Conjugation).
   3. In the OCL for deriveTypeInheritedFeature, inheritedMemberships->selectByKind(FeatureMembership).memberFeature should be inheritedMembership->selectByKind(FeatureMembership).ownedMemberFeature.
   4. In the OCL for the operation inheritableMemberships, excludedType should be excludedTypes (the parameter).
   5. In the OCL for the operation directionOf, directionOfExcluding(f, Set{}) should be directionOfExcluding(feature, Set{}) (the parameter).
7. In 8.3.3.3.4 Feature:
   1. In the OCL for deriveFeatureOwnedTyping, ownedGeneralization should be ownedSpecialization.
   2. In the OCL for deriveFeatureType, OrderedSet(Types) should be OrderedSet(Type), and exist should be exists.
   3. In the OCL for deriveFeatureFeaturingType, as revised by resolution KERML11-150 to issue KERML11-7 (approved in Ballot #2), typeFeaturing.type should be typeFeaturing.featuringType (TypeFeaturing has no property type).
   4. In the OCL for checkFeatureFeatureMembershipTypeFeaturing, featuringTypes should be featuringType.
   5. In the OCL for checkFeatureParameterRedefinition, as replaced by resolution KERML11-149 to issue KERML11-6 (approved in Ballot #2), ownerParameters.indexof(self) should be ownerParameters->indexOf(self).
   6. In the OCL for checkFeatureResultRedefinition, superType should be supertype (3 occurrences; the iterator variable is supertype).
   7. In the OCL for validateFeatureEndMultiplicity, allSuperTypes() should be allSupertypes().
   8. In the OCL for the operation isCompatibleWith, supertype.oclIsKindOf(Feature) should be otherType.oclIsKindOf(Feature), and ownedRedefinitions.allRedefinedFeatures() should be allRedefinedFeatures(), as for the otherType on the next line.
   9. In the OCL for the operation subsetsChain, allSuperTypes() should be allSupertypes(), and selectAsKind should be selectByKind.
   10. In the OCL for the operation typingFeatures, subsettedFeature->includes(chainingFeature->last()) should be subsettedFeatures->includes(chainingFeature->last()) (the let variable).
8. In 8.3.4.4.2 Association, in the OCL for validateAssociationBinarySpecialization, associationEnds should be associationEnd.
9. In 8.3.4.5.3 Connector, in the OCL for checkConnectorBinaryObjectSpecialization and validateConnectorBinarySpecialization, connectorEnds should be connectorEnd.
10. In 8.3.4.7.3 Expression:
    1. In the OCL for deriveExpressionResult, featureMemberships should be featureMembership.
    2. In the OCL for the operation evaluate, resultExpr->isEmpty() should be resultExprs->isEmpty() (the let variable).
    3. In the OCL for the operation checkCondition, result->size() = 1 should be results->size() = 1 (the let variable).
11. In 8.3.4.7.4 Function, in the OCL for deriveFunctionResult, featureMemberships should be featureMembership.
12. In 8.3.4.8.3 ConstructorExpression, in the OCL for validateConstructorExpressionOwnedFeatures, ownedFeatures should be ownedFeature.
13. In 8.3.4.8.4 FeatureChainExpression:
    1. In the OCL for checkFeatureChainExpressionResultSpecialization, ownedFeatures->select(direction = 'in') should be ownedFeature->select(direction = FeatureDirectionKind::'in'), and owningExpression.sourceTargetFeature() should be sourceTargetFeature() (the context is the FeatureChainExpression itself).
    2. In the OCL for the operation sourceTargetFeature, ownedFeatures->select(direction = 'in') should be ownedFeature->select(direction = FeatureDirectionKind::'in').
14. In 8.3.4.8.5 FeatureReferenceExpression:
    1. In the OCL for checkFeatureReferenceExpressionBindingConnector, relatedFeatures should be relatedFeature (2 occurrences), and targetFeature should be referent.
    2. In the OCL for checkFeatureReferenceExpressionResultSpecialization, result.owningType() should be result.owningType.
    3. In the OCL for the operation modelLevelEvaluable, isOclKindOf should be oclIsKindOf (2 occurrences), and MetaClass should be Metaclass.
15. In 8.3.4.8.7 InstantiationExpression, in the OCL for the operation instantiatedType, typeMembers->first() should be members->first() (the let variable).
16. In 8.3.4.9.2 Flow, in the OCL for checkFlowWithEndsSpecialization, ownedEndFeatures should be ownedEndFeature.
17. In 8.3.4.10.2 FeatureValue, in the OCL for checkFeatureValueBindingConnector, resolveGlobal( should be featureWithValue.resolveGlobal( (2 occurrences): resolveGlobal is an operation of Namespace, and a FeatureValue is not a Namespace.
18. In 8.3.4.11.2 MultiplicityRange, in the OCL for the operation valueOf, oclAsKindOf should be oclAsType.
19. In 8.3.4.12.3 MetadataFeature:
    1. In the OCL for deriveMetadataFeatureMetaclass, metaClassTypes should be metaclassTypes (the let variable).
    2. In the OCL for checkMetadataFeatureSemanticSpecialization, selectAsKind should be selectByKind (2 occurrences), and baseTypes() should be baseTypes (2 occurrences; the let variable).
    3. In the OCL for the operation evaluateFeature, selectAsKind should be selectByKind.

• checkStepOwnedPerformanceSpecialization OCL targets Objects::Object::ownedPerformance but shall be Objects::Object::ownedPerformances
• checkStepEnclosedPerformanceSpecialization OCL targets Performances::Performance::enclosedPerformance but shall be Performances::Performance::enclosedPerformances

checkFeaturePortionSpecialization and checkFeatureSuboccurrenceSpecialization OCL targets the "Occurence" package segment but shall target "Occurences" package

In 7.4.9.2 Operator Expressions, it states "The classification operators may also be used without a first operand, in which case the first operand is implicitly Anything::self". However, according to 8.2.5.8.1 Operator Expressions, production ClassificationExpression, a classification expression without a first operand on the surface is actually parsed as having a first operand that is a feature reference expression with no referent. However, there is nothing in abstract syntax 8.3.4.8.5 FeatureReferenceExpression to indicate that a feature reference expression with no explicit referent is supposed to default to Anything::self.

In 8.3.3.3.4 Feature, under "Constraints", the constraint checkFeatureValuationSpecialization is:

If a Feature has a FeatureValue, no ownedSpecializations that are not implied, and is not directed, then it
must specialize the result of the value Expression of the FeatureValue.

direction = null and
    ownedSpecializations->forAll(isImplied) implies
        ownedMembership->
            selectByKind(FeatureValue)->
                forAll(fv | specializes(fv.value.result))

However, an implied Subsetting for satisfying this constraint would fail the validateSubsettingFeaturingTypes constraint, because the featuring type of the result of the value Expression is the Expression itself, which is inconsistent with the featuring type of the featureWithValue. Instead, the featureWithValue should specialize a feature chain of the Expression and the result.

The following constraints also have similar problems:

• In 8.3.4.7.3 Expression, checkExpressionResultBindingConnector
• In 8.3.4.7.4 Function, checkFunctionResultBindingConnector
• In 8.3.4.8.6 Index Expression, checkIndexExpressionResultSpecialization
• In 8.3.4.8.18 Select Expression, checkSelectExpressionResultSpecialization

Currently, some of the KerML functions identified in KerML section 9.4 are not defined anywhere in the specification. Some are discussed in 7.4.9 Expressions but some are not. Some are defined in the functions themselves (such as Base Function '!=' being defined as 'not (x==y)') but others are not well-defined.

I would have expected a functions library to have good documentation of what each function does. An example of what I would have expected is in 9.4.18 for Occurrence Functions, where each function has documentation.

Ed confirmed in the Google Group that there is currently no further documentation than what we have in the specification document and XMI files, and that this is a known problem with no issue for it.

Google group discussion post: https://groups.google.com/g/sysml-v2-release/c/jZebfXh5pPE/m/ShKY1Q0PCwAJ?utm_medium=email&utm_source=footer

• The checkFeatureSubobjectSpecialization (Feature) OCL says Occurrence::Occurrence::suboccurrences but should be Objects::Object::subobjects - As per the documentation body of the constraint.
• The checkStepSubperformanceSpecialization (Step) OCL says Performances::Performance::subperformance should be Performances::Performance::subperformances - The subperformance attribute does not exist in Performance, subperformances does.

"New" is not identified as a reserved keyword in the SysML and KerML specifications

I want to propose is that the textual notation support the display of inherited members using the ^ (caret) symbol. This would allow the textual notation to show both owned and inherited features in a type.

Here is an example of what this might look like:

type A{
      feature q;
}
 
type A1 specializes A{
      ^ feature q;
      feature p;
}

This shows that A1 inherits q (without redefining it) from A and also owns a feature p.

I am not sure which section this would best go in. Also it may be better for higher languages (such as SysML) that has the concept of a view to show this? I wanted to capture the idea here.

The description of Element:escapedName() states:

[...] represented as a restricted name according to the lexical structure of the KerML textual notation (i.e., surrounded by single quote characters and with special characters escaped).

It should be unrestricted name instead of restricted name.

The text,

"A multiplicity range can also be written without the lower bound (or ..). In this case, the result of the single
expression is used as both the lower and upper bound of the range, unless the result is the infinite value *, in which
case the lower bound is taken to be 0."

Replace "(or ..)" with "(and ..)" to match the EBNF in Clause 8.2.5.11. The text then should read,

"A multiplicity range can also be written without the lower bound (and ..). In this case, the result of the single
expression is used as both the lower and upper bound of the range, unless the result is the infinite value *, in which
case the lower bound is taken to be 0."

This correction applies to Version 1.1 Beta 1 (Release 2026-05) of the Kernel Modeling Language as well.

Clauses 7.4.8.1 (Functions Overview) and 8.4.4.8.2 (Expressions and Invariants) say

An invariant, though, is a boolean expression that must always evaluate to either true at all times or false at all times. By default, an invariant is asserted to always evaluate to true, while a negated invariant is asserted to always evaluate to false.

Expressions are kinds of Steps. The checkExpressionSpecialization constraint requires that Expressions specialize the base Expression Performances::evaluations (see 9.2.6.2.3), which is a specialization of Performances::performances.

the checkInvariantSpecialization constraint requires that Invariants specialize either the BooleanExpression Performances::trueEvaluations (see 9.2.6.2.2) or, if the Invariant is negated, the BooleanExpression Performances::falseEvaluations (see 9.2.6.2.2), both of which are specializations of Performances::booleanEvaluations.

where the Performance library defines

abstract expr trueEvaluations subsets booleanEvaluations { true }

abstract expr falseEvaluations subsets booleanEvaluations { false }

but do not require models to specify when invariant expressions are evaluated, which are the only times the results are required to be true/false. The conditions they test for might be present only when the invariants happen to be evaluated (see KERML-58 for more about this).

Clause 8.3.4.10.2 (FeatureValue) and 8.4.4.11 (Feature Values Semantics) say

A FeatureValue is a Membership that identifies a particular member Expression that provides the value of the Feature that owns the FeatureValue.

A FeatureValue is a kind of OwningMembership between a Feature and an Expression.

but does not require the model to specify when the expression is evaluated. Expressions (as steps) owned by some features are required to happen (be evaluated) during instances of the featuring types (domain) of that feature (see KERML-11), which might be too loose for some applications, while those owned other features are unconstrained, for example, their values could be the results of an expression evaluated before or after the instance of domain types exists. The results could vary over time if the expression reads values of other features. This seems to apply to all the combinations of default/initial feature values.

The specification in subclause 10.2 lists the textual concrete syntax as one format for model interchange.

However, the textual concrete syntax does not include syntax for the elementId : UUID property of any element specified in such a model interchange. In general, this makes it impossible to derive the net semantic difference between model interchanges of a pair of revisions (or versions) of the same package represented in this format. The elementId identifiers are necessary to detect whether a change constitutes: (1) a newly created element, (2) an updated element (including a moved element), or (3) a deleted element. In general, it will only be possible to derive the net lexical difference. This limitation holds in particular for unnamed (i.e. anonymous) elements, as well as for elements with name and/or shortName changes.

It is therefore debatable whether the textual concrete syntax may be designated as a proper model interchange format.

This limitation of use of the textual concrete syntax as an interchange format should be explicitly addressed through one of the following:

1. Add an explanation of the limitation in the specification.
2. Add a facility in the textual concrete syntax to include representation of the elementId for any element. For usability reasons, implementations should provide a capability to show or hide the elementId snippets in the concrete textual notation editor widgets.

In the Kernel Semantics Library model Transfers, the flow flowTransfers explicitly subsets transfers. However, transfers is also a flow, and it has owned end features. So, according to the constraint checkFlowWithEndsSpecialization, transfers is required to subset flowTransfers. This means transfers and flowTransfers subset each other and are, therefore, semantically equivalent. In addition, messageTransfers explicitly subsets transfers and, in similar fashion, also has an implied subsetting of transfers. As a result, all flows with implied subsetting of messageTransfers end up having the same semantics as flows with implied subsetting of flowTransfers.

The constraint checkIndexExpressionResultSpecialization requires that

The result of an IndexExpression must specialize the result parameter of the first argument of the IndexExpression, unless that result already directly or indirectly specializes the DataType Collections::Array from the Kernel Data Type Library.

This excepts the case of indexing Arrays from the general specialization requirement. However, the indexing function '#' is specialized in the Kernel Functions Library model CollectionFunctions for all kinds of Collections, not just Arrays.

The semantic constraint checkMultiplicityTypeFeaturing (once corrected per KERML_-236) requires that the multiplicity of a Feature have the same featuringType as the Feature. However, if the Feature is an owned cross Feature, then it's featuringType is required to be the type of the opposite end Feature (for a binary association, or a Cartesian product type for an N-ary association). But, if a bound expression of an owned cross Feature is a FeatureReferenceExpression, one would expect the Feature name to be resolved in the context of the containing Association or Connector, as for an end Feature multiplicity. This requires that the featuringType of the multiplicity of an owned cross Feature be that of the end Feature, not the cross Feature.

In 8.3.3.1.10 Type, the OCL for deriveTypeFeatureMembership is

featureMembership = ownedFeatureMembership->union(
    inheritedMembership->selectByKind(FeatureMembership))

with the intent clearly being not to include imported features. The problem is that the inheritedMembership does include imported FeatureMemberships from supertypes. Since Type::feature is derived from featureMembership, this means that a Type may get features that are not owned Features of any of its supertypes and so may have an actual owningType that is not compatible with the original Type.

KerML's missing some functions needed by SysPhSv2 to support equations written in the KerML/SysML expression language. They're taken from Modelica's operators, but the names in KerML could be different, of course.

Numeric:

• sign Result is one of {-1, 0, 1}

• mod Modulo, including for reals, see below comparing to remainder

• div Division rounded to next lower or equal integer, eg, div(13,6) = 2, see below comparing to related functions.

• ceil Real rounded to next greatest or equal integer. Could include floor, for completeness.

Trigonometry: tanh, atan2, sinh, cosh. Could be more, of course

Logarithms: log, log10 Base e and 10.

Derivative: der Differs from the others in requiring simulation to evaluate.

Might need Modelica rem, if KerML's % operator (remainder) is not the same, eg,

  rem(3,1.4)  = 0.2

  rem(-3,1.4) = -0.2

  rem(3,-1.4) = 0.2

compared to Modelica mod, eg

  mod(3,1.4)  = 0.2

  mod(-3,1.4) = 1.2

  mod(3,-1.4) = -1.2

Assuming div defined as above (not mathematical division)

  div(x,y) * y + rem(x, y) = x

The doc annotations of the datatypes in standard library Collections.kerml in machine readable document ad/23-02-05 are not aligned with the contents of subclause 9.3.3 of the KerML specification.

The documentation content should be made identical. The text in the KerML specification should be leading when drafting a resolution for this issue.

The shorthand textual notation for a flow:

flow F of p : P from a.output to b.input;

is parsed to an abstract syntax representation using the special metaclasses PayloadFeature and FlowEnd. However, these metaclasses are not used in the longhand notation:

flow f {
    feature p : P redefines payload;
    end references a {
        ref output redefines sourceOutput;
    }
    end references b {
        ref input redefines targetInput;
    }
}

Further, the derived properties deriveFlowFlowEnd, deriveFlowPayloadFeature and deriveFlowPayloadType will all be empty for the longhand model, because they depend on the special metaclasses as syntactic markers. Finally, the abstract syntax does not prevent using the special metaclasses for some but no all parts of a flow (e.g., the flow has a PayloadFeature, but the ends are not FlowEnds), which cannot be represented in the textual notation at all.

The KerML abstract syntax defines EndFeatureMembership, ParameterMembership, and ReturnParameterMembership.

These concepts do not add additional semantics to the model, as the same can be expressed using FeatureMembership with the appropriate Feature::isEnd and Feature::direction values on owningFeature.

Abstract syntax users (implementors and SysML v2 API users), are confused about which type of membership to use.

Proposal:
Eliminate EndFeatureMembership and ParameterMembership from the abstract syntax.

These modeling aspects are fully covered by Feature::isEnd and Feature::direction.

In KerML 9.2.4.2.13 Occurrence, the documentation for isDispatch says

isDispatch : Boolean

Determines whether the same incoming transfer can be accepted more than once by StatePerformances
composed under dispatchScope. It defaults to true for Performances, and false for other Occurrences
(including Objects).

However, this is potentially misleading compared to the definition of isDispatch in 9.2.11.1 State Performances Overview, which says:

isDispatch being true prevents the same Transfer from being accepted more than once by StatePerformances composed under dispatchScope, and prevents from being accepted at all any acceptable Transfers that are not accepted and are higher in incomingTransferSort order than the one that is. It defaults to true for Performances, including StatePerformances, and false for other Occurrences, while dispatchScope defaults to thisPerformance for StatePerformances, the top Performance (indirectly) composing the StatePerformance (see 9.2.6.2.14 ), and self for other Occurrences (see 9.2.2.1 ).

We should correct this to be consistent.

The wording in section 9.2.4.2.13 Occurrences seems to indicate that isDispatch=true would indicate transfers "can be accepted more than once" in contradiction with 9.2.11.1

In the Semantic Library, the class Occurrence has a feature superoccurrence, but it is not described in the specification.

Maybe the feature should not exist, since it is questionable, whether an Occurrence knows its superoccurrence.

Maybe the description is missing.

SysML v2 includes syntax for enumeration definitions and usages. The semantics for enumerations are based on the general variation/variant semantics in SysML v2, which is itself based on KerML semantics. However, there currently is no syntax for enumerations in KerML. In particular, this leads to an awkward mapping in 9.2.17 KerML of MOF enumerations to KerML data types without specific syntax for enumeration.

Enumerations are the only modeling element in the CMOF subset of UML that does not have a clear mapping to a KerML element. Especially as KerML is considered further for use as the basis of other languages, including their reflective abstract syntaxes, it would be better if enumeration syntax was codified in KerML. This would also make it easier to incorporate enumerations consistently into SysML v2 and future KerML-based languages themselves.

In the following places, the term "(connector) end multiplicities" has not been updated to "(connector) cross multiplicities":

• 9.2.9.1, p. 336
• A.3.3, p. 409 + 410
• A.3.7, p. 417

The text should read "...see Collection Functions." There is a missing space between Collection and Functions; Section 9.4.15 Collection Functions.

In subclause 10.3 under Notes in note 5 the last sentence is:
"If includesImplied is not given, then whether implied relationships are included may vary from one model interchange file to another, and from element to element, as recorded by the value of the includesImplied property for each element."

The second appearance of includesImplied should be replaced with isImpliedIncluded.

I found the following typos on the following pages:

1. Relationsip: 79
2. Relatioship: 89
3. Instatiated: 101
4. Namspace: 113, 129

See also this sister issue for SysML v2: https://issues.omg.org/issues/SYSML21-399

feature myStats : States

should be

feature myStats : Stats (i.e. no e in Stats)

Neither the operation Type::isCompatibleWith (in 8.3.3.1.10 Type, under "Operations", nor its redefinition Feature::isCompatibleWith (in 8.3.3.3.4 Feature, under "Operations") have a return type specified. Both should have return type Boolean.

In the Kernel Semantic Library model Occurrences, the feature Occurrence::surroundedByOccurrences has a single nested end feature

end [1] feature surroundingSpace: Occurrence subsets self;

However, the cross multiplicity is invalid here, because constraint validateCrossSubsettingCrossFeature requires that the owningType of an end feature with an owned cross feature have at least two ends. Indeed, it is not clear why this feature should be an end feature at all.

In the Kernel Semantic Library model TransitionPerformances, the behavior TransitionPerformance has a step accept that subsets Transfers::acceptPerformances, which is typed by Transfers::AcceptPerformance.

1. The step accept explicitly redefines the receiver parameter from AcceptPerformance. However, receiver is the second parameter of AcceptPerformance, but step does not redefine the first parameter payload. Therefore, accept::receiver also has an implied redefinition of payload, which is not intended.
2. The reason receiver is redefined is to bind with a feature value. However, this prevents the parameter from being redefined and rebound in further specializations. Unfortunately, this is exactly what happens in a SysML transition whose accepter has a via part.

The following library models include the declaration of types that have inherited members with the same name, because of diamond inheritance of redefined features.

Kernel Semantic Library

• FeatureReferencingPerformances
• Objects
• Observation

Kernel Function Library

• VectorFunctions

According to 8.4.4.9.6 Operator Expressions, under "Control Functions":

Given the above, a FeatureChainExpression of the form

src.f

(where src is an Expression) is semantically equivalent to the Expression

expr : ControlFunctions::'.' subsets Performances::evaluations { 
    feature redefines ControlFunctions::'.'::source = src {
        feature redefines ControlFunctions::'.'::source::target 
            redefines f;
    }
    alias for f;
    return subsets source.f;
}

Note that the redefining feature for ControlFunctions::'.'::source::target also redefines the feature f. However, according to the constraint validateRedefinitionEndConformance (see 8.3.3.3.8 Redefinition), if a redefinedFeature is an end feature, then the redefiningFeature must be, too. But this prevents an end feature from being used as the target (i.e., f above) of a feature chain expression.

This is particularly problematic, because, in the Kernel Semantic Library model StatePerformances, the declaration of StateTransitionPerformance::transitionLinkTarget has the feature value transitionLink.laterOccurrence, which is a feature chain expression that targets the end feature laterOccurrence.

If an end feature has a feature value, then it will have an implied binding connector between itself and the result of the feature value expression. However, if this is its first non-feature-value owning membership, then the operation Feature::ownedCrossFeature will return it as the owned cross feature of the end feature. Clearly this should not be the case.

In the semantically equivalent notation for Invocation and Constructor Expressions the term alias of appears. This seems to be invalid. The correct notation would be alias for, as is used in other places.

In 8.2.5.8.3 Base Expressions, Table 7 shows that the library functions ControlFunctions::collect and select are model-level evaluable. These are the implied functions for collect and select expressions such as seq.{in x; x * 2} and seq.?{in x; x > 3}. Unfortunately, the argument body expressions {in x; x * 2} and {in x; x > 3} are both not model-level evaluable, so the collect and select expressions are no model-level evaluable, either, even though the functions `collect` and `select` are.

Body expression is parsed as a feature reference expression whose referent is an expression (see production BodyExpression in 8.2.5.8.3 Base Expressions). In 8.3.4.8.5 FeatureReferenceExpression, operation modelLevelEvaluable specifies that such a feature reference expression is model-level evaluable if its referent expression. In 8.3.4.7.3 Expression, the operation modelLevelEvaluable specifies that an expression with just in parameters and a result expression as owned features is model-level evaluable if it's result expression is. The problem is that, as in the examples above, any argument body expression for a useful collect or select expression will have a result expression that contains references to the in parameter of the expression and such references are not model-level evaluable according to FeatureReferenceExpression::modelLevelEvaluable.

Subclause 7.4.14 includes several examples of package filter expressions, such as

filter @Annotations::ApprovalAnnotation and
    Annotations::ApprovalAnnotation::approved and
    Annotations::ApprovalAnnotation::level > 1;

This example (like several others) has subexpressions that are feature reference expressions for non-package-level features, such as Annotations::Approval::approved. However, filter expressions are at package level (have no featuring type), and therefore do not have access to non-package-level features. This results in a violation of the validateSubsettingFeaturingTypes constraint on the subsetting of the referent of the feature reference expression by its result. To avoid this violation, the expression would need to use a cast, such as (as Annotations::Approval).approved.

In the following productions, FeatureDefinition should not be mandatory (i.e., the reference should be "FeatureDefinition?").

• 8.2.5.7.2 Expressions

  Expression =
      FeaturePrefix
      'expr' FeatureDeclaration ValuePart?
      FunctionBody
  

• 8.2.5.7.4 Boolean Expressions and Invariants

  BooleanExpression =
      FeaturePrefix
      'bool' FeatureDeclaration ValuePart?
      FunctionBody
  
  Invariant =
      FeaturePrefix
      'inv' ( 'true' | isNegated ?= 'false' )?
      FeatureDeclaration ValuePart?
      FunctionBody
  

Referring to UML 2.5.1 section 14.2.3.4.5 "Entering a State", it says:

The semantics of entering a State depend on the type of State and the manner in which it is entered. However, in all cases, the entry Behavior of the State is executed (if defined) upon entry, but only after any effect Behavior associated with the incoming Transition is completed. Also, if a doActivity Behavior is defined for the State, this Behavior commences execution immediately after the entry Behavior is executed. It executes concurrently with any subsequent Behaviors associated with entering the State, such as the entry Behaviors of substates entered as part of the same
compound transition.

(Emphasis Added)

To be consistent with the expectations from the UML specification, we want to update KerML to ensure that the StatePerformance::doAction always occurs immediately after the StatePerformance::entryAction

In the Attributes section of 8.3.2.3.2 AnnotatingElement, the /owningAnnotatingRelationship description reads:

"The owningRelationship of this AnnotatingRelationship, if it is an Annotation"

From context, and the example provided in this attribute's mirror /ownedAnnotatingRelationship, 'this' should refer to the enclosing class, which is AnnotatingElement, not AnnotatingRelationship.

Also, there is a period missing at the end of that sentence.

Currently the only possibility to retrieve metadata of the model element is to use indicate element by specifying its (possibly qualified) name in conjunction with .metadata or meta SomeType syntax. During profile building there is a necessity to retrieve metadata of model element that is indicated (somewhat) dynamically – by navigating from current model element (given by annotatedElement). This is currently not possible.

Another use case is to check two stereotypes in the view expose filtering conditions. Currently the metadata is fed into the filtering conditions one by one, separately (thus if you have model element E with two metadatas applied: #M1 #M2, then filtering condition is invoked 3 times – once for the “primary” metadata of E, and once for each metadata application). And writing a filter which checks two stereotype applications is impossible as you need some facility to jump/navigate from one metadata to another

Thus:
1) Some operation or some syntactic structure shall be introduced that takes model element (as a metadata value) as input and returns it’s other metadatas. This operation is model-level evaluable.
2) Reference implementation shall be able to evaluate this operation – whether used in assert constraints or view expose filters
3) A test case in the conformance WG should check both cases – usage in assert constraints and usage in view expose filters

Example1 (assert constraints at meta level):

/**** Some domain library - e.g. UAF *****/

metadata def M1;
metadata def M2;

metadata def CheckOwnerStereo:> Metaobjects::SemanticMetadata{
	:>> annotatedElement: KerML::Type;
	assert constraint ownerMustBeM1 {
		RETRIEVEMETADATA(annotatedElement.owner) @M1;//check if owner is stereotyped by M1
	}
}

/****** User Model ******/

#M1 part def GoodParent {
	#CheckOwnerStereo part p1;//succeed
}
part def BadParent {
	#CheckOwnerStereo part p2;//fail
}

Example2 (view expose filters):

/*********User Model Example with Exposes ***********/
package Container {
	part def notStereotyped;
	#M1 part def singlyStereotyped1;
	#M2 part def singlyStereotyped2;
	#M1 #M2 part def doublyStereotyped;
}

view v {
	export Container::*;
	filter (RETRIEVEMETADATA(self @SysML::PartDefinition) @M1) and (RETRIEVEMETADATA(self @SysML::PartDefinition) @M2);//only pick up the doublyStereotyped
}

Expectation – make RETRIEVEMETADATA possible – by any syntactic means necessary

PayloadFeature has 3 ( but only 2 ). Are we missing a close parenthesis, or do we need to remove an open parenthesis?

Should they instead reference FlowDeclaration? Or should FlowDeclaration be renamed to ItemFlowDeclaration?

Is there a rule missing, or should this be pointing to an existing rule such as InstantiatedTypeMember?

Within this definition:

FunctionOperationExpression : InvocationExpression =
     ownedRelationship += PrimaryArgumentMember '->'
     ownedRelationship += InvocationTypeMember
     ( ownedRelationship += BodyArgumentMember
     | ownedRelationship += FunctionReferenceArgumentMember
     | ArgumentList )
     ownedRelationship += EmptyResultMember

InvocationTypeMember is not defined within the metamodel. According to Ed Seidewitz, this is a mistake in the specification and InvocationTypeMember should have been InstantiatedTypeMember.

In the definition of the MetaclassificationExpression, MetaclassificationTestOperator is incorrectly cased as MetaClassificationTestOperator with an uppercase C, which does not match the MetaclassificationTestOperator rule.

1. Page 93: s.isSufficient
2. Page 102: e.ownedRelationship (TWICE!)

The s. and e. parts were unexpected to me, especially since everywhere else we have isSufficient and ownedRelationship without those prefixes. I suspect they slipped in incorrectly?

Feature is defined in the spec as such:

Feature =
    ( FeaturePrefix
      ( 'feature' | ownedRelationship += PrefixMetadataMember )
      FeatureDeclaration?
      )
    | ( EndFeaturePrefix | BasicFeaturePrefix )
      FeatureDeclaration
    )
    ValuePart? TypeBody

Note that there are 3 ( characters but 4 ) characters! It's not clear to me if we missing a ( or we have an extraneous ).

The following grammar rules (production definitions) should be Foo = or Foo : Bar =, but instead differ.

The following is missing =:
1. ImportDeclaration : Import (page 81)

The following end with : instead of =:
2. SpecificType : Specialization : (page 87)
3. BasicFeaturePrefix : Feature : (page 89)
4. FeaturePrefix : (page 89)
5. PrefixMetadataFeature : MetadataFeature : (page 105)

in the KerML V1.0 Spec, subclause 9.2.4.2.13 Occurrence, [on page 300] the descriptions for "immediatePredecessors" and "immediateSuccessors" are crossed, meaning the (correct) description for immediatePredecessors is under immediateSuccessors, and the (correct) description for immediateSuccessors is under immediatePredecessors.

Proposed solution: flip the descriptions back into the correct order.

The first sentence of the first paragraph of the 7.4.5.3 section is "Association structures are both associations and structures (see 7.4.4 on structures), ", with an hyperlink on the 7.4.4 string. This reference is very far from the affirmation that Association structures are both Association and Structure.

I propose to use "8.3.4.4.1 Overview" or "Figure 26. Associations" in the "8.3.4.4 Associations Abstract Syntax" section, instead of it. It shows clearly the double relationship.

The first paragraph of the section begins with "Association structures are both associations and structures (see 7.4.4 on structures),", and an hyperlink points to the correct 7.4.4 section.

However, this reference is not useful. A more useful reference should be "8.3.4.4.1 Overview" or the "Figure 26. Associations" in the Association Abstract Syntax section which demonstrates that Association structures are both Association and Structure.

The following sentence looks suspicious with the use of the term 'front' instead of 'font' that is used associated with the 'code' font.

Similar stylistic conventions apply to text about KerML models, except that an "italic code" front is used.

It may be intentional to use the term "front", as it is a variation for a typeface of a specific font. But I doubt this is your intention because the term 'front' is not used in different dictionary or encyclopedic sources that I consulted. They are rather using italic or bold font, form or typeface.

2. Conugation (see 7.3.2.4 ) typo. it should be "Conjugation". The letter 'j' is lacking.

deriveMetadataAccessExpressionReferencdElement not spelled correctly...

Referencd should be Referenced

First paragraph is exactly the same text as the following section A.3.1 Overview

In 8.3.3.3.4 Feature, in the OCL for the constraint checkFeatureFlowFeatureRedefinition, the reference to Transfers::Transfer::source::targetInput should be Transfers::Transfer::target::targetInput.

In the normative KerML.xmi file, each of the packages Connectors and Interactions has an association that owns both of its ends, one of which is named participantFeature. These associations are left over from TBD parts of earlier versions of the abstract syntax model. They should have been deleted. They do not appear in the specification document.

There is a typo in checkFeatureObjectSpecialization:

ownedTyping.type->exists(selectByKind(Structure)) implies specializesFromLibary('Objects::objects')

The word "Libary" misses a "r".

Both of the constraints checkFeatureChainExpressionSourceTargetRedefinition and checkFeatureChainExpressionTargetRedefinition have OCL that starts with let sourceParameter : Feature = .... However, the rest of the OCL uses the name sourceTargetFeature. In both cases, the name declared in the let clause should be sourceTargetFeature.

In subclause 7.3.4.2, one but last paragraph, under point 4. composite or portion, the first bullet contains the following editorial mistake:

The sentence "Values of a composite feature also cannot be values of another composite feature that is not on the same instance of the feature's domain." appears twice, so one should be deleted.

The list of keywords on page 80 does not include the keywords 'standard' and 'library'.
Nevertheless, these keywords are throughout the text referenced as keywords, e.g., on 73, buttom.
Also, they are written in bold letters to indicate that they are keywords.

In subclause 9.2.7.2.9 on Transfer, the documentation of feature isInstant incorrectly uses isInstance. This should be replaced with isInstant.

The same typo occurs in standard library Transfers.kerml, so should be corrected there as well.

In the OCL for deriveFeatureFeaturingType, in the expression "featuring.type->asOrderedSet()", the property featuring no longer exists. The property typeFeaturing (opposite of TypeFeaturing::featureOfType) should be used instead.

The OCL for constraint checkFeatureParameterRedefinition uses the OCL indexOf operation to compute the index of a feature as an owned parameter of its owningType. However, according to the OCL specification, the result of this operation will not be defined if the feature is not actually in the list of owned parameters of the owningType. This should therefore be checked before the operation is called.

(In addition, the OCL is missing two close parentheses: one in at the end of line 7 "not ownedRedefinition->exists(not isImplied))" and one in line 19 after "oclIsKindOf(ReturnParameterMembership))".)

The description of the constraint checkMultiplicityTypeFeaturing begins "If the owningType of a Multiplicity is a Feature...". However, a Multiplicity is never owned via a FeatureMembership, so it cannot have a non-null owningType. The constraint should use owningNamespace instead of owningType (in the description and the OCL).

InvocationTypeMember => Page 126
ItemFlowDeclaration => Page 129

MetaclassificationTestOperator => Page 122, Typo, 'c' vs 'C' at use site

In 7.4.7.2 Behavior Declaration "A behavior is declared as a classifier ...". But in the Metamodel a Behavior is a Class (8.3.4.6.1 Overview and 8.3.4.6.2 Behavior).

Clause 7.4.6.1 (Connectors Overview) says

Successions are binary connectors requiring their source and target features to identify Occurrences that are ordered in time.

and 8.4.4.6.3 (Successions) elaborates:

HappensBefore (see 9.2.4.2.1 ) has two associationEnds, asserting that the Occurrence identified by its first associationEnd (earlierOccurrence) temporally precedes the one identified by its second (laterOccurrence), which then also applies to Succession connectorEnds that redefine the associationEnds of HappensBefore.

but neither mention that occurrences identified by succession source/target features are not required to be temporally ordered unless succession end cross multiplicities properly restrict those inherited from HappensBefore's cross features, Occurrence::predecessors and predecessors, which are [0..*]. The clause continues with an example:

succession first f1 then f2;

is, with implied Relationships included, semantically equivalent to

connector subsets Occurrences::happensBeforeLinks {
  end feature earlierOccurrence references f1
    redefines Occurrences::HappensBefore::earlierOccurrence;
  end feature laterOccurrence references f2
    redefines Occurrences::HappensBefore::laterOccurrence; }

The example does not restrict inherited succession end cross multiplicities, meaning occurrences identified by the connected features f1 and f2 are not required to happen in any particular order.

In 8.2.3.5.1 Name Resolution Overview, it states:

The basic name resolution process is used directly to resolve a qualified name in all cases except when the qualified name specifies the redefinedFeature of a Redefinition with an owningFeature that has an owningType. In this case, the basic name resolution processes is repeated with the general Type of each ownedSpecialization of the owningType considered in turn as the local Namespace, until a resolution is found. If no resolution is found for any of these, then the overall resolution fails.

However, consider a model such as:

class A {
    var feature x : ScalarValues::Integer;
    feature ts :> timeSlices {
        var feature x1 redefines x = 1;
    }
}

which is a pattern explicitly accommodated for variable features, to allow them to be bound within time slices of a containing class. However, according to the paragraph quoted above, x as the target of the redefinition of the declaration of x1 will not resolve to A::x. This is because "basic name resolution" includes resolution in outer scopes, but that will happen in the outer scopes of the general types of ts (i.e., timeSlices) not the outer scope of ts itself (i.e., A).

Clause 8.2.2.2 of the KerML specification defines the syntax for a
MULTILINE_NOTE element as follows:

MULTILINE_NOTE =
    '//*' COMMENT_TEXT '*/'

The KerML specification does not contain any examples of multi-line note
elements, however.

The SysML specification does provide a single example of a multi-line
note element in the second code block of its clause 8.4.8.1, near the
top of page 410:

    //* Effective conjugated features:
    out feature a subsets Base::things;
    in feature b subsets Base::things;
    inout feature c subsets Base::things;
    feature d subsets Items::Item;
    *// 

In contrast to the Concrete Syntax grammar given in the KerML
specification, which denotes '*/' (single slash) as the comment closer,
the example in the SysML specification uses '*//' (double slash) as the
comment closer.

It is thus ambiguous which of the two presented variants for closing
MULTILINE_NOTE elements is the correct one.

The Concrete Syntax grammar defines the SINGLE_LINE_NOTE and MULTILINE_NOTE elements, but they are not used by the KerML grammar. Nor does the Concrete Syntax of SysML v2 use these elements.

The semantics, or intended use of these elements thus remain unclear, both in general, and with respect to the REGULAR_COMMENT element.

checkConstructorExpressionResultDefaultValueBindingConnector not specified

ControlFunctions::forAll() and exists() are currently not model-level evaluable.
This precludes their usage in profile building e.g. specifying constraints for MetadataDefinitions (aka “stereotypes”) of custom domains..
Thus:
1) These operations shall be model-level evaluable if and only if the inner predicate that they are using is model-level evaluable.
2) Reference implementation shall be able to evaluate meta-level assert constraints (that are defined against stereotyped model elements)
3) A test case in the conformance WG should check that constraints carrying such operations are (at least) mode-level evaluable (and evaluated by the tools that claim conformance);

Example:

    /**** Some domain library - e.g. UAF *****/

    constraint def StrategicRule;

    abstract metadata def SubjectOfStrategicRule :> Metaobjects::SemanticMetadata{
        :>> annotatedElement: KerML::Type {
            assert constraint onlyStrategicRules {
                ownedFeature
                    -> ControlFunctions::select { in x; x istype SysML::AssertConstraintUsage}
                    -> ControlFunctions::forAll { in y : KerML::Type; y.specializes(StrategicRule meta SysML::ConstraintDefinition) }
            }
        }
    }

    /****** User Model ******/

    #SubjectOfStrategicRule MyEnterprise {
        assert constraint strategy1 : StrategicRule; //valid
        assert constraint strategy2; //invalid - must specialize StrategicRule
    }

KerML spec declares (chapters 8.3.3.1.1, 8.3.3.1.10) that KerML::Type has some operations, which would be useful for building expressions in the user models. We have use cases where this is useful/necessary for profile building to specify baseType expressions in UAF.
More narrowly, the Type::specializes() operation is needed badly.
Unfortunately currently these operations are not accessible/available. The reason they do not work is that they are not provided/exposed in the KerML libraries and subsequently not implemented implemented/exposed in the reference implementation. KerML.kerml, Core::Type metaclass only declares attributes and not operations.
Thus:
1) Provided spec libraries shall expose more operations (at least Core::Type::specializes()). As a consequence the expressions using those operations shall become parseable. Operations shall be marked with model-level evaluability flag.
2) reference implementation should be able to evaluate such expressions.
3) A test case in the conformance WG should check this operation availability.
Example:

/**** Some domain library - e.g. UAF *****/

	part def SpecialContainedType;
	part def OrdinaryType;

	part def SpecialContainerType;
	
    metadata def DomainSpecificMetadata :> Metaobjects::SemanticMetadata {
		:>> annotatedElement : SysML::PartUsage;

        :>> baseType = 
				if ((annotatedElement.owner as KerML::Type).specializes(SpecialContainerType meta SysML::PartDefinition))
					?		SpecialContainedType meta SysML::PartDefinition 
					else	OrdinaryType meta SysML::PartDefinition;                
   }
   
/**** User model ******/

part def UserContainerPartFromSpecDomain :> SpecialContainerType {
	#DomainSpecificMetadata part specialUserPart;
}

#DomainSpecificMetadata part ordinaryUserPart1;

part def UnspecializedUserContainerPart {
	#DomainSpecificMetadata part ordinaryUserPart2;
}

/*
	The expectation is that specialUserPart specializes SpecialContainedType, while ordinaryUserPart1 and ordinaryUserPart2 specializes OrdinaryType.
	This is because baseType expression stipulates that parts inside SpecialContainerType-typed containers must have slightly different specializations
	The current behavior is that .specializes() invocation fails to compile.
*/

In 8.3.4.5.3 Connector, the constraint checkConnectorTypeFeaturing is intended to prevent a situation such as the following, when a related feature of a connector is not "featured within" the featuring type of the connector:

class C {
    feature x;
    feature y {
        feature z;
        connector x to z; // related feature "x" violates constraint
    }
}

However, if the connector and the related feature are both variable features, then the constraint is not violated:

class C {
    var feature x;
    var feature y : Occurrence {
        var feature z;
        var connector x to z; // no violation
    }
}

This was not intended. It happens because the constraint uses the operation isFeatureWithin which, for variable features, uses canAccess. The operation `canAccess` was changed to allow access in outer scopes, but this unintentionally resulting in a weakening of the checkConnectorTypeFeaturing constraint in regard to variable features.

Since unnamed features cannot be referred to by name, there is no textual syntax to specialize them in a type subtyping the featuring type, even though the abstract syntax can express this relationship.

Specialization is key in execution, where our current approach is to specialize and restrict user-defined types to a model that has a single (family of) interpretations, which is included in the set of original interpretations (see Annex A). This involves redefining and subsetting the user-defined type's features.

Based on the above, we can conclude that there is currently no way to describe an execution trace in the textual syntax for a model which contains unnamed elements.

The semantic constraint checkFeatureReferenceExpressionBindingConnector requires that a FeatureReferenceExpression have an implied BindingConnector between its referent and its result. However, since the FeatureReferenceExpression owns its result parameter, but the referent will be outside the expression, the defaultFeaturingType of the implied BindingConnector will be null. This means that the checkConnectorTypeFeaturing constraint cannot be satisfied for the BindingConnector as specified.

Line 124 in sysml.library/Kernel Libraries/Kernel Semantic Library/StatePerformances.kerml requires that transitions happen after the nonDoMiddle steps of their source StatePerformance:

private succession transitionLinkSource.nonDoMiddle[*] then Performance::self[1];

Lines 43 and 34 of States.sysml assert that user-defined substates subset nonDoMiddle, resulting in transitions not starting until all the subsates of the transition's source state have finished.

Since transition performances include the evaluation of the trigger and the guard, transitions cannot be taken until all the substates finish.

This goes against the general semantics of state machines, where substates are "interruptable," i.e., transitions leaving the parent state will deactivate substates as well. Note that the notion of "run to completion" only requires the complete processing of an event before dispatching the next one, where "processing" generally means the steps until reaching a stable state configuration, but not waiting in the new states.

The desired behavior would be that transitions start after the complete initialization of a stable state configuration (which most likely consists of all the entry actions of the new state configuration).

Additionally, line 124 is misaligned with the description in KerML 9.2.11.1:

StateTransitionPeformances require their guards to happen after the nonDoMiddle Step of the transitionLinkSource (all the middle Performances except for do) (...).

In fact, the library now requires the whole StateTransitionPeformance to happen after the nonDoMiddle, which technically includes the guard, but is stronger.

Abstract types (Type::isAbstract=true) are described as

instances of this Type must also be instances of at least one of its specialized Types.

but this semantics is not math/modeled.

In 8.3.2.4.5 Namespace, the description of the operation importedMemberships is:

Derive the importedMemberships of this Namespace as the importedMembership of all ownedImports, excluding those Imports whose importOwningNamespace is in the excluded set, and excluding Memberships that have distinguisibility collisions with each other or with any ownedMembership.

However, the OCL does not seem to cover the part about the exclusion of "Memberships that have distinguisibility collisions with each other or with any ownedMembership".

As document in 8.3.3.1.10 Type for the operation removedRedefinedFeatures, an otherwise inheritable Membership is removed from the inheritedMemberships of a Type if either of the following conditions holds:

1. The memberElement of the Membership is included in redefined Features of another Membership in [the inheritable] memberships.
2. One of the redefined Features of the Membership is a directly redefinedFeature of an ownedFeature of this Type.

But consider applying this rule to the following model:

classifier A {
    feature x;
}
classifier B :> A {
    feature :>> A::x;
}
classifier C :> A, B {
    feature :>> A::x;
}
classifier D :> B, C;

Clearly, in classifiers B and C, the feature A::X is not inherited, because it is directly redefined by an owned feature of the classifier. Moreover, in classifier C, B::x is also not inherited, because B::x redefines A::x, and A::x is directly redefined by an owned feature of C. In classifier D however, both B::x and C::x are inherited. This is because C::x does not actually have a redefinition relationship with B::x, so the first condition of the removeRedefinedFeatures rule does not apply. As a result, D will inherit two redefinitions of x, which is semantically inconsistent and will violate the constraint validateNamespaceDistinguishibility.

This seems in itself potentially anomalous for user expectations. However, there is a more concerning impact when implied specializations are involved. For example, suppose the specialization by C of A and the specialization by D of B are both implied relationships. Since C also specializes B, and B is a supertype of A, according to 8.4.2 Semantic Constraints and Implied Relationships, the implied specialization of A can be considered redundant and not included – and similarly for the implied specialization by D of B. But it is only permitted, not required, that redundant implied relationships be removed. This means that, if a tool removes the implied specializations of A and B, then D is valid, but, if it does not remove them, then D is invalid, which is problematic.

In the KerML standard library for Triggers.kerml, the "TriggerAfter" function returns a TimeSignal by calling TriggerAt with an expression that involves "clock.currentTime". However, this binds the value of the TriggerAt "timeInstant" to an expression involving a "var" feature (currentTime).

The unfortunate result of this is that the value of the resulting TimeSignal is continuously changing !

return signal : TimeSignal[1] = TriggerAt(clock.currentTime + delay, receiver, clock, monitor);

Instead, we likely want to "capture" the value of "currentTime" using an initial value as of when the TriggerAfter is called to start observing the trigger rather than an ongoing binding.

private feature referenceTime : NumericalValue := clock.currentTime;

return signal : TimeSignal [1] = TriggerAt(referenceTime + delay, receiver, clock, monitor);

The resolution to KERML_-224 revised the constraints for ConstructorExpressions so that such expressions are model-level evaluable if their arguments are. However, subclauses 7.4.9.1 Expressions Overview and 8.4.4.9.8 Model-Level Evaluable Expressions were not revised to account for this.

In Clocks.kerml, the TimeOf function defines the timeContinuityConstraint, which states that (endShots of) immediate predecessors of an occurrence (i.e., those connected via a HappensJustBefore) must get the same timestamp (timeInstant in the model) as the start shot of the occurrence:

inv timeContinuityConstraint {
	doc
	/*
	 * If one Occurrence happens immediately before another, then the TimeOf 
	 * the end snapshot of the first Occurrence equals the TimeOf the second
	 * Occurrence.
	 */
	
	o.immediatePredecessors->forAll{in p : Occurrence; 
		TimeOf(p.endShot, clock) == timeInstant
	}
}	

Compare this to the documentation of HappensJustBefore, which states that "HappensJustBefore is HappensBefore asserting that there is no possibility of another occurrences[sic] happening in the time between the earlierOccurrence and laterOccurrence."

Considering that the intent of the libraries is not to constrain the time model and the format of timestamps, I checked this against three widely-used time models.

With continuous (dense) time, the current formulation of the timeContinuityConstraint might make sense, although it fails to capture that an infinite number of snapshots forming a HappensJustBefore chain may actually take non-zero time.

With discrete time, where a timestamp may be treated as a sequence number, for example, an Integer, the invariant may be too restrictive, as HappensJustBefore could apply to two snapshots that have successive sequence numbers, but have no other occurrence in between them. In fact, in a discrete time model, HappensJustBefore with the current definition degrades to HappensWhile because there is no notion of ordering between events with the same timestamp.

In super-dense time, where a clock is usually represented as a pair of a real value (timestamp) and an integer (sequence number to order events with the same timestamp), the invariant is again not very well defined because a pair with the same timestamp and smaller sequence number is generally considered to be (strictly) "less than".

Overall, I think the difference between HappensBefore and HappensJustBefore cannot be captured in the TimeOf function, but should rather be enforced on the succession graph induced by these relations as specified in the documentation of HappensJustBefore (but not formalized, as far as I am aware), independent of the timestamps. This would imply that the invariant should be removed from the library.

Alternatively, if the intent was to say there is no other possible value between the timestamp of the occurrence and that of its immediate predecessors (which degrades to the current definition with continuous time), the constraint could capture this better by asserting that there is no otherTimeInstant such that otherTimeInstant < timeInstant and TimeOf(p.endShot, clock) < otherTimeInstant. This would allow discrete clocks to assign successive timestamps to occurrences in a HappensJustBefore relation, forbid continuous clocks to assign different timestamps (as there is always another real number between any two), and force pairs in super-dense time to assign pairs with the same timestamp and either the same or successive sequence numbers.

The execution algorithm in Annex A should could more cases.

Derived features (Feature::isDerived=true) are described as

Such a feature is typically expected to have a bound feature value expression that completely determines its value at all times.

Whether the values of this Feature can always be computed from the values of other Feature.

but this semantics is not model/mathed.

[From Steve Jenkins ] In 9.2.4.2.5 (HappensLink), Description, second sentence says

They cannot happen in time (be Occurrences), making them disjoint with LinkObject.

and in Transfer.kerml, HappenLink documentation, starting in the second sentence, says

... they cannot also be Occurrences that happen in time. Therefore HappensLink is disjoint with LinkObject, that is, no HappensLink can also be a LinkObject.

which give disjointness more narrowly than the justifications just before them. The declaration of HappenLink in Transfer.kerml is

assoc HappensLink specializes BinaryLink disjoint from Occurrence { ...

aligning with the disjointness justifications above.

Consider the following example:

classifier Organization
classifier Car {
    feature drivers : Person; 
}
classifier Person {
    feature employer : Organization [1] {
        feature salary;
    }
    feature drivenCars : Car {
        redefines feature drivers = that;
    }
}

Now assume we have an M0 universe with organization 'bestCorp', a car 'fastCar', and two persons 'joe' and 'jane', filling the values of corresponding features of persons with the instance(s) of matching type. This will give the following extents:

Organization: { (bestCorp), (joe, bestCorp), (jane, bestCorp) }
Car: { (fastCar), (joe, fastCar), (jane, fastCar) ...? }
Person: { (joe, jane), ...? }
employer: { (joe, bestCorp), (jane, bestCorp) }
salary: { (joe, bestCorp, 100000), (jane, bestCorp, 120000) }
drivenCars: { (joe, fastCar), (jane, fastCar) ...? }
Car::drivers: { (joe, fastCar, joe), (jane, fastCar, jane) ...? }
Person::drivenCars::drivers: { (joe, fastCar, joe), (jane, fastCar, jane), ...? }

Some questions that highlight the meaning of this interpretation:

• Who is Joe's employer (i.e., what is the value of joe.employer)?
  • It is bestCorp.
• Do Jane and Joe work at the same company (i.e., jane.employer == joe.employer)?
  • Yes, the values of these features are the same (bestCorp).
• Do Jane and Joe earn the same at bestCorp (i.e., jane.employer.salary == joe.employer.salary)?
  • No, the values of the feature "salary" for (jane, bestCorp) and (joe, bestCorp) are not the same.
• What car does Joe drive (i.e., what is the value of joe.drivenCars)?
  • He drives fastCar.
• Do Jane and Joe drive the same car (i.e., jane.drivenCars == joe.drivenCars)?
  • Yes, the values of these features are the same (fastCar).
• Who are the drivers of Joe's car (i.e., what is the value of joe.drivenCars.drivers)?
  • They are only Joe because Person::drivenCars::drivers maps from a pair of Joe and fastCar to Joe.
• Who are the drivers of Jane's car (i.e., what is the value of jane.drivenCars.drivers)?
  • They are only Jane because Person::drivenCars::drivers maps from a pair of Jane and fastCar to Jane.
• Who are the drivers of fastCar (i.e., fastCar.drivers)?
  • Nobody, because there is no sequence beginning with fastCar.

The last three questions show the unintended behavior, while those with the employer demonstrate that sometimes this is indeed the desired meaning.

Following the terminology of https://conradbock.org/relation3.html, the underlying problem is that drivenCars is interpreted both as a mapping (or relation) from Person to Car and as a role type specializing Car. Features nested under other features could either be interpreted as the feature of the mapping (or relation), or to the role type. This becomes clear if one tries to refactor this to avoid features nested under features by introducing another classifier:

classifier Organization
classifier Car {
    feature drivers : Person; 
}
classifier Employer :> Organization { 
    feature salary;
}
classifier DrivenCar :> Car {
    // ...?
}
classifier Person {
    feature employer : Employer [1];
    feature drivenCars : DrivenCar;
    bind drivenCars.drivers = self;
}

In this case, the extents would look like this:

Organization: { (bestCorp), (joesEmployer), (janesEmployer) }
Car: { (fastCar), (joesCar), (janesCar) ...? }
Person: { (joe, jane), ...? }
employer: { (joe, joesEmployer), (jane, janesEmployer) }
salary: { (joesEmployer, 100000), (janesEmployer, 120000) }
drivenCars: { (joe, joesCar), (jane, janesCar) ...? }
Car::drivers: { (joesCar, joe), (janesCar, jane) ...? }
DrivenCars::drivers: { (joesCar, joe), (janesCar, jane), ...? }

Answers to the above questions change:

• Who is Joe's employer (i.e., what is the value of joe.employer)?
  • It is joesEmployer.
• Do Jane and Joe work at the same company (i.e., jane.employer == joe.employer)?
  • *No, the values of these features are different (janesCorp vs. joesCorp).
• Do Jane and Joe earn the same at bestCorp (i.e., jane.employer.salary == joe.employer.salary)?
  • No, the values of the feature "salary" for janesCorp and joesCorp are not the same, although we do not know that they work at bestCorp (see previous answer).
• What car does Joe drive (i.e., what is the value of joe.drivenCars)?
  • He drives joesCar.
• Do Jane and Joe drive the same car (i.e., jane.drivenCars == joe.drivenCars)?
  • No, the values of these features are different (janesCar vs. joesCar).
• Who are the drivers of Joe's car (i.e., what is the value of joe.drivenCars.drivers)?
  • They are only Joe because his car is joesCar and that is associated only with Joe.
• Who are the drivers of Jane's car (i.e., what is the value of jane.drivenCars.drivers)?
  • They are only Jane because his car is joesCar and that is associated only with Jane.
• Who are the drivers of fastCar (i.e., fastCar.drivers)?
  • Nobody, because there is no sequence beginning with fastCar.

[From Steve Jenkins and Mr. Hans Peter de Koning] Transfers.kerml says

interaction TransferBefore specializes Transfer, HappensBefore
                           intersects Transfer, HappensBefore { ...

where Transfers are Occurrences and HappensBefores are HappensLinks, if you chase up the taxonomy, but Occurrences.kerml says

assoc HappensLink specializes BinaryLink disjoint from Occurrence { ...

so TransferBefore is only interpretable as an empty set (ie, it's not "instantiable", unsatisfiable).

KerML supports triggers on quantified time, but not quantified space, eg, that an object moves more than a specific distance, or comes within a specific distance of another, etc.

Some (abstract and textual) syntax in Core has (informal) semantics requiring time, such as Feature::isComposite, ::isReadOnly, ::isPortion, as well as ::direction and ::isDerived, see 7.3.4.2 (Feature Declaration) and 8.3.3.3.3 (Feature), but Core does not include a time model.

When redefining features, some metaproperties must be respecified even when they're intended to be the same as the redefined ones, while others don't. For example, feature type and multiplicity do not need to be respecified on a redefining feature when they are intended to be the same as the redefined feature, as I understand it, while direction does, even when it is intended to be the same as the redefined feature. Modelers must remember which feature metaproperties need to be respecified and which don't. The textual syntax would be easier to use if this were the same for all feature metaproperties, and more so if metaproperties could always be omitted in redefining features when they are intended to be the same as the redefined feature.

Literal Values

inout

Values of the Feature on each instance are determined either as in or out directions, or both.

In and out discuss 2 concepts of 'determination' of an instances value, and 'use' of an instances value
Is 'inout' ambiguous as to the features determination and use completely or still constrained?
Both 'in' and 'out' require opposite 'determination' than 'use', but can inout allow same 'determination' and 'use'?
To be more clear, can an inout feature be 'determined' 'externally' and 'used' 'externally'?
How is 'inout' different from not providing a directionality constraint?
How does directionality work with specializations like subsetting/redefinition, should there be constraints?

Usecase: large corporation is working on a project, where also other suppliers deliver parts of the product architecture.

To avoid naming collisions in such constellations, it makes sense to use hierarchical package structures. If everyone just uses plain structures, we have potential conflicts with a duplicate declaration of namespaces.
As within large corporations hundreds of engineers can be working of one product class, which might be organized as namespaces, it makes sense to split the definition of multiple namespaces within the same parent namespace in different files to avoid merge conflicts

Example

package Vehicle{
   part engine : MyCorp::Automotive::Engine::SmallEngine;
   part gearFront : MyCorp::Automotive::Transmission::AT8Gear;
   part rearGear : SomeSupplier::Transmission::FancyGear;
}

Possible resolutions:
1) allow duplicate definitions of namespaces and implicitly merges the resulting trees, dangerous as it could happen unintended
2) allow to merge sub-trees of duplicate namespaces with a keyword
2a) all except one namespace declaration require an addendum keyword, injection of elements possible which might expose private information
2b) all namespaces must declare, that extension is possible

example

partial package CommonParent //declaration can be skipped, if nothing except namespace is declared
package CommonParent::GroupA{
  //some declarations
}
package CommonParent::GroupB{
  //some more declarations
}
package CommonParent::IntegrationLayer{} //should work as no explicitly declared namespace is duplicated
package CommonParent::GroupA::Backdoor {} //should generate an error as the explicitly declared namespace GroupA is duplicated

Clause 8.4.4.12.1 (Multiplicities, Semantics) says

The validateTypeOwnedMultiplicity constraint requires that a Type have at most one ownedMember that is a Multiplicity. If a Type has such an owned Multiplicity, then it is the typeWithMultiplicity of that Multiplicity. The value of the Multiplicity is then the cardinality of its typeWithMultiplicity and, therefore, the type (co-domain) of the Multiplicity restricts that cardinality.

If a Type does not have an owned Multiplicity, but has ownedSpecializations, then its cardinality is constrained by the Multiplicities for all of the general Types of those ownedSpecializations (i.e., its direct supertypes). In practice, this means that the effective Multiplicity of the Type is the most restrictive Multiplicity of its direct supertypes.

The above implies inherited multiplicities do not constrain cardinality of types that

• own a Multiplicity
• inherit them via unowned specializations

while the (math) semantics for specialization and multiplicity says they do (rule 1 in 8.4.3.2, Types Semantics, and rule 5 in 8.4.3.4, Features Semantics, respectively).

The documentation for the validateAssociationStructureIntersection constraint is "If an Association is also a kind of Structure, then it must be an AssociationStructure." with the OCL

oclIsKindOf(Structure) = oclIsKindOf(AssociationStructure)

However, this is really a constraint on the abstract syntax, not user models. Since the current abstract syntax does not have any metaclass that is a subclass of both Structure and Association other than AssociationStructure, this constraint will always be true for every user model. (And, if the abstract syntax did include another subclass of both Structure and Association, then constraint would then be violated by every user model that used that construct!)

In 7.4.9.2 OperatorExpressions, in the bullet for "Classification expressions", it states:

The classification operators may also be used without a first operand, in which case the first operand is implicitly Anything::self (see 9.2.2.2.1). This is useful, in particular, when used as a test within an element filter condition expression (see 7.4.14).

In the concrete syntax, in 8.2.5.8.1 Operator Expressions, the production for ClassificationExpression does, indeed, allow the first operand to be optional. However, there is nothing stated there (or anywhere else in normative Clause 8) about the default for the first operand being Anything::self if it is not given explicitly, as stated in 7.4.9.2.

[From Vince Molnar] Package-level features do not give featuring types, and some have lower multiplicity greater than zero, meaning everything in the universe (instances of Anything), including every data value, is required to give at least that number of values to them (see KERML-56). For example, the libraries include:

Clocks::universalClock[1] {...}
Observation::defaultMonitor[1] : ChangeMonitor[1] {...}
SpatialFrames::defaultFrame : SpatialFrame[1] {...}

Might be others. This one

Occurrences::earlierFirstIncomingTransferSort: IncomingTransferSort{... }

does not give a multiplicity, I couldn't find what this means (even for expressions), tho this particular feature is supposed to have exactly one value.

Clause 7 Language Description includes a large number of example models and snippets, in textual and graphical notation. However, no machine-readable interchange file was submitted for these models. Project interchange files should be provided for them, including textual notation, XMI and JSON versions.

Some library types are sufficient, but do give give any conditions. For example, in Occurrences::Occurrence::

portion feature all portions: Occurrence[1..*] subsets spaceTimeEnclosedOccurrences { ... }

only has text documentation between the curly braces, leaving sufficiency to mean that portions and spaceTimeEnclosedOccurrences are equivalent. Might be others like this.

The Type metaclass is concrete (like all the metaclasses in the abstract syntax), making it it syntactically valid to create a Type that is not a Classifier or a Feature. However, Clause 8.4.3.1.2 (Core Semantics Mathematical Preliminaries) requires the set of Types in a model to be the union of the set of Classifiers and Features. This means instances of Type in a model that are not Classifiers or Features are syntactically valid, but not given semantics (it's not possible to tell if instances of such types are valid or not).

Project interchange files (.kpar) were submitted for all model libraries. However, in all cases, these archives only included textual notation model interchange files (.kerml). There should also be normative model library project interchange files in which the models are formatted in XMI and JSON.

Clause 9.2.9.1 (Control Performances Overview) says

Successions going out of Steps typed by DecisionPerformance or its specializations must:
• ...
• be included in a Feature of its featuringBehavior that unions (see 7.3.2.7) all the outgoing
Successions, and is bound to the outgoingHBLink of the Step (see 7.3.4.6 on feature chaining).

Successions coming into Steps typed by MergePerformance or its specializations must:
• ...
• subset a Feature of its featuringBehavior that unions all the incoming Successions, and is bound to the incomingHBLink of the Step.

but the Description sections of 9.2.9.2.1 (DecisionPerformance) and 9.2.9.2.7 (MergePerformance) say:

All such Successions must subset the outgoingHBLink feature of the source DecisionPerformance.

All such Successions must subset the incomingHBLink feature of the target MergePerformance.

respectively. The same sentences appear in ControlPerformances.kerml as documentation for DecisionPerformance and MergePerformance, respectively, and with other wording in their documentation for outgoingHBLink and incomingHBLink, respectively:

Specializations subset this by all successions going out of a decision step.

Specializations subset this by all successions coming into a merge step.

These allow outgoing/incomingHBLink to have values that are not identified by outgoing/incoming successions when none of the successions is traversed. The pattern in the overview above introduces a feature of {featuringBehavior}} (the one featuring the control step) unioning the successions and binds it to a chain through decision/merge to outgoing/incomingHBLink, ensuring the HB links are identified by the successions.

Some library types might be intended to be sufficient. For example, in Occurrences::Occurrence, the values of

feature spaceTimeCoincidentOccurrences: Occurrence[1..*] subsets timeCoincidentOccurrences, spaceEnclosedOccurrences ... { ...
  feature redefines thatOccurrence subsets largerSpace;
  feature redefines thisOccurrence subsets smallerSpace;
  connector :InsideOf from largerSpace references thatOccurrence [1]
                      to smallerSpace references thisOccurrence [1]; }

presumably should include all timeCoincident/spaceEnclosedOccurrences that meet the condition given by the connector, but the feature is not marked as sufficient. Might be others like this.

Clause 8.4.4.7.2 (Steps, under Behavior Semantics) says

The checkStepSpecialization constraint requires that Steps specialize Performances::performances.

checkStepEnclosedPerformanceSpecialization and checkStepSubperformanceSpecialization constraints require that a Step whose owningType is a Behavior or another Step specialize Performances::Performance::enclosedPerformance or, if it is composite, Performances::Performance::subperformance.

checkStepOwnedPerformanceSpecialization constraint requires that a composite Step whose owningType is a Structure or a Feature typed by a Structure specialize Objects::Object::ownedPerformance.

where enclosedPerformances, subperformances, and ownedPerformances (in)directly subset timeEnclosedOccurrences, the values of which happen during the occurrences "having" the value.

The first constraint leaves open the possibility that steps might not happen during the occurrences they are steps of, bc Performances::performances is a step and subsets occurrences, rather than timeEnclosedOccurrences. This conflicts with the normal meaning of the term "step" (a terminology issue), which typically connotes (in library terms) performances that happen during the occurrences they are steps of.

The second constraint prevents the possibility above for steps owned by behaviors or other steps, while the third only prevents it for composite steps owned by structures.

The step keyword looks like it's sometimes used with other intentions than the constraints indicate. For example, in Observation.kerml:

behavior ObserveChange { ...
  step transfer : TransferBefore[1] ... {
    /* Then send changeSignal to changeObserver. */ ... } ... }

↑ Is it intended that observechange occurrences timeenclose the entire transfer (all the way to it's arrival at its target), as required by the second constraint?

struct ChangeMonitor { ...
  step startObservation { ... }
  step cancelObservation { ... }

↑ Is it intended that the values of start/CancelObservation can happen at other times than the ChangeMonitor occurrence referencing them, as allowed by the third constraint?

Transfers::
  step transfers: Transfer[0..*] nonunique subsets performances, binaryLinks { ... }
  step messageTransfers: MessageTransfer[0..*] nonunique subsets transfers { ... }
  step flowTransfers: FlowTransfer[0..*] nonunique subsets transfers { ... }
  step transfersBefore: TransferBefore[0..*] nonunique subsets transfers, happensBeforeLinks { ... }
  step flowTransfersBefore: FlowTransferBefore[0..*] nonunique subsets flowTransfers, transfersBefore { ... }

↑ These are features of (effectively) Anything, including structures and behaviors, so sometimes they'll be time enclosed and sometimes not. For example:

Occurrence::
  feature incomingTransfers: Transfers::Transfer[0..*] subsets Transfers::transfers { ... }
  feature outgoingTransfers: Transfers::Transfer[0..*] subsets Transfers::transfers { ... }

↑ will be time enclosed for transfers into/out of performances, but not objects, assuming the above are redefined as steps in behaviors or structures (or that features specialized from steps are also steps).

Sufficient types are (Type::isSufficient=true) are described as

A type gives conditions for what things must be in or not in its extent (sufficient and necessary conditions, respectively).

... the type places additional sufficiency conditions on its instances corresponding to all the necessary conditions.

but this semantics is not math/modeled and the syntax cannot specify that only some necessary conditions are to correspond to sufficient ones.

Feature direction (Feature::direction:FeatureDirectionKind) is described as

in, out, inout: Specifies the direction of a feature, which determines what is allowed to change its values on instances of its domain:
-in: Things "outside" the instance. These features identify things input to an instance.
-out: The instance itself or things "inside" it. These features identify things output by an instance.
-inout: Both things "outside" and "inside" the instance. These features identify things that are both input to and output by an instance.

but this semantics is not math/modeled and depends on Kernel for instances changing over time.

Read only features (Feature::isReadOnly=true) are described as

Values of read only features on each instance of their domain are the same during the entire existence of that instance

but this semantics is not model/mathed and depends on Kernel for instances existing in time.

(Note. The resolution to KERML_-57 changes isReadOnly to isConstant, but the lack of formal semantics remains.)

Multiplicity is a feature of a type (feature or classifier), with natural numbers as its type (see description of KERML-1). The math semantics for feature multiplicity (rule 5 in 8.4.3.4, Features Semantics) refers to the multiplicity metaproperty on a feature f as model element, rather than the multiplicity feature on an instance of f 's featuring type, preventing it from covering multiplicity values that change over the life of an instance, and possibly not handling constant values either.

Multiplicity is a feature of a type (feature or classifier), with natural numbers as its type. For a feature f, the values of its multiplicity (as a feature) are allowed cardinalities for the collection of values on each instance of f 's featuring type, while for classifiers they are allowed cardinalities for the collection of its instances. Math semantics for feature multiplicity is available (rule 5 in 8.4.3.4, Features Semantics), but missing for classifier multiplicity. Is it intended that every instance of a classifier give the number of allowable instances of that classifier? What if there are no instances?

Portion features (Feature::isPortion=true) are described as

Portion features are composite features where the values cannot exist without the whole, because they are the “same thing” as the whole. (For example, the portion of a person's life when they are a child cannot be added or removed from that person's life.)

but this semantics is not math/modeled, at least not in Core, which does not include models of time or space. A syntactic constraint that isPortion implies isComposite also seems to be missing.

The OCL operation Namespace::importedMemberships computes the importedMemberships of a Namespace by calling the importMemberships operation on each of the ownedImports of the Namespace. This operation is redefined for Packages so that, if the Package has filterConditions, then any potentially imported Memberships are filtered out if it does not meet any of those conditions.

However, the Import::importMemberships operation, as specified for both MembershipImport (when recursive) and NamespaceImport uses the Namespace::visibleMemberships operation, not the importedMembership operation. The visibleMemberships operation in turn uses the Namespace::membershipsOfVisibility operation to collect both owned and imported Memberships of the proper visibility. But the membershipsOfVisibility operation is inherited by Package and not redefined.

As a result of this, when importing from a Package with filterConditions, the filterConditions are not applied when determining visible importedMemberships re-exported by the Package. In particular, a filtered import of the form "import Pkg::*[condition];" is parsed as an import of an anonymous package that owns the condition, but, with the current formal specification, the filtering will not actually be applied in this case.