Liberating Object-Oriented Modeling from Programming-Level Abstractions

simplicity. In high-level modeling this concern is even more justiied. Operational modeling should be aaected both by programming notions and by logics for reasoning. Generalizing single-object methods into multi-object actions allows object-oriented modeling at a level where communication aspects have been abstracted away. On the other hand, ease of reasoning on temporal behaviors and practical applicability of formal reenements require an essentially simpler basis than that ooered by traditional programming language concepts. Challenged by these concerns, a simple operational basis has been developed for a rigorous but practical theory, as outlined in this paper. Based on experiences with DisCo 17], fundamentals for object-oriented modeling with multi-object actions have been presented in a language-independent form in 9]. As discussed in 14], the classical algorithmic paradigm is unsatisfactory for modeling interactive systems. Therefore, the theory is based on a reactive paradigm, where all interacting partners can contribute to temporal behaviors. The theory covers three closely interrelated areas: a simple execution model for object-oriented models, a logic for reasoning on collective temporal behaviors in these models, and language principles for constructing such models. Some of its main principles are as follows: { Temporal behaviors exist only in the presence of an environment. Therefore, the closed-system principle is adopted, where objects are always modeled in connection with their assumed environments. { Absence of implicit \program counters" for control threads is essential for the logical simplicity of the approach. Instead of explicit invocation of actions, their execution is controlled by \guard" expressions associated with actions. { The execution model is nondeterministic, allowing modeling without complete information. This is crucial, for instance, in environment modeling. { Models are given as generic patterns, which cover all possible instantiations where objects of the given classes can appear. { TLA 10] is used as the logical basis, giving precise (state-based, linear-time) semantics in terms of temporal behaviors. The execution model gives a natural match between operational models and canonical TLA expressions. { Reasoning can be based on an interleaving model, where actions are executed in some sequential oder. Still, all temporal properties hold also in concurrent implementations, where concurrency is restricted only by the atomicity constraint that no object can participate in more than one action at a time. { Incremental construction of models is supported. At each stage, a model exhibits precisely determined temporal behaviors, which can be subjected to both rigorous reasoning and to validation by animation. …