Accepted papers

Accepted papers for SAM 2026

The papers for SAM 2026 are published in the MODELS 2026 Companion proceedings with ACM.

Lukas Walter, Kristian Rother and Stefan Henkler. LLMA-UML: Extending the UML for Modeling LLM-Agent Systems
Click for abstract
Large Language Model (LLM) agents are becoming important building blocks of software systems. However, we show through an analysis of publications that existing modeling approaches for LLM-agent systems are fragmented and rarely grounded in widely adopted standards such as UML, which hinders communication, design review, and early architectural validation. After a review of existing modeling approaches, this paper introduces LLMA-UML, a UML profile with semantics for modeling LLM-agent systems. Designed as a lightweight yet semantically explicit modeling extension, it remains compatible with established UML-based workflows and enables model validation via OCL constraints. The profile explicitly defines the boundaries of agents, including prompts, responses, context, memory, tools and retrieval. It also separates design-time specifications from runtime instances across UML diagrams. We describe the conceptual foundations and profile design of LLMA-UML and evaluate it through a representative case study. The results indicate that LLMA-UML improves the expressiveness and analyzability of UML models for LLM-based agent architectures.
Ouadie Khebbeb, Philippe Merle and Gwen Salaün. Dependency-Aware Reconfigurations of Kubernetes Deployments
Click for abstract
Deployments in Kubernetes can rely on services of other deployments, forming implicit dependencies, but Kubernetes lacks the concept of dependencies between deployments. Consequently, performing reconfigurations on deployments (e.g., replacing a deployment with another one) without a proper coordination with their dependents often leads to failures. Whilst Kubernetes features a self-healing mechanism, it is not designed for dependency-aware reconfigurations, and can thus result in either inefficient or even unstable recoveries at scale. In this paper, we propose a formal approach that allows one to model Kubernetes deployments and their dependencies in the form of a dependency graph, and enables the expression of reconfiguration intents through a high-level, declarative domain-specific language. This approach then allows one to generate a plan of low-level operations that apply the desired reconfiguration, coordinated with respect to the dependencies. We evaluate the performance of this approach in terms of execution times and number of restarts, and report a significant decrease in both metrics.
Max Oesterle, Arne Lange, Nathan Hagel, Terru Stübinger, Anne Koziolek and Ralf Reussner. VitruviusOCL: A Declarative Language for Consistent View-based Software Development
Click for abstract
Large cyber-physical systems normally need to be described using multiple domain-specific modeling languages to allow stakeholders to focus on their respective concerns. However, the use of multiple languages fragments the overall system description, resulting in redundant representations of information and an increased likelihood of cross-model inconsistencies. Unfortunately, existing declarative constraint languages for multi-model environments do not treat the correspondence structures that link views across metamodel boundaries as first-class primitives. Consequently, these languages cannot express correspondence-aware invariants. We present VitruviusOCL, a declarative constraint language and toolchain for view-based modeling built on the formal foundations of OCL# and the Virtual Single Underlying Model concept of the Vitruvius framework. VitruviusOCL introduces the ~ operator as a first-class, axiomatic primitive for accessing the Vitruvius Correspondence Model, together with an explicit metamodel-qualified navigation syntax for heterogeneous multi-model access. This enables declarative, genuinely n-ary cross-metamodel constraints. VitruviusOCL is provided as a full prototype. We evaluate VitruviusOCL in a qualitative feasibility study across two case studies from different domains. The results demonstrate that VitruviusOCL can express multi-model constraints and specify intended behavior during design-space exploration before a concrete repair action has been identified, making it a valuable addition to the engineering process.
Atefeh Nirumand Jazi and Jordi Cabot. PolicyDSL: A Model-Driven Approach for the Definition and Enforcement of Fine-Grained Access Control Policies
Click for abstract
Access control represents a fundamental concern in software systems. Despite the extensive implementation of both Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC), their integration into Model-Driven Development (MDD) remains limited, particularly in supporting both multi-layer enforcement across back-end and front-end (UI) layers and comprising fine-grained control over interface elements. Given the growing importance of security in all types of applications, the need for such integration, and therefore, the model-driven development of secure by design applications has become paramount. To overcome this situation, this paper proposes PolicyDSL, a Domain-Specific Language (DSL) and model-driven approach for multi-layer fine-grained access control. It defines a metamodel for data and GUI elements access control definitions together with run-time enforcement adaptations that guarantee the generated application satisfies the specified access control policies. The approach has been implemented on top of the BESSER low-code platform and evaluated on a use-case with 200 policy variants.
Sara Aissat, Achref Samoud and Francis Bordeleau. A Model-Driven Digital Twin for the Systematic Improvement of CI/CD Pipelines
Click for abstract
CI/CD pipelines are central to DevOps practices, yet their increasing structural and behavioral complexity makes them difficult to interpret, analyze, and evolve systematically. Existing tools mainly expose execution logs or low-level pipeline graphs, offering limited support for model-based reasoning about pipeline behavior, failures, and version-to-version evolution. This paper presents a model-driven Digital Twin (DT) for CI/CD pipelines in which raw CI configurations are transformed into structured BPMN-based process models. By using BPMN as a modeling backbone, the proposed approach provides an explicit and analyzable representation of pipeline activities, dependencies, execution paths, and evolution points. The associated DT architecture supports visual abstraction of pipeline structure, failure tracing, and systematic version comparison between pipeline versions, thereby enabling model-based monitoring and evolution analysis of DevOps processes. Building upon validated DT architectural principles and prior work on build optimization and anomaly detection, the proposed framework provides a modular and extensible foundation for integrating advanced analytical and prescriptive services into software delivery processes. The approach is evaluated on open-source CI/CD projects, while ongoing work targets the integration of additional improvement services and the extension of the DT to broader DevOps lifecycle processes.
Nathan Hagel, Johannes Mäkelburg, Alireza Maleki, Claus Hammann, Raffaela Mirandola, Maribel Acosta and Anne Koziolek. Uncertainty-aware Design Decisions through Probabilistic Uncertainty Quantification and Consistent Merging
Click for abstract
When developing complex, software-intensive or cyber-physical systems, uncertainty must be managed during all stages. Especially if made explicit, it can significantly affect the design decisions of various stakeholders. A necessary requirement for determining the effect of uncertainty on a system and deciding whether it must be resolved is explicit quantification of uncertainty. However, that alone is not enough. Often, in multi-model development processes, dependent parameters are affected by such quantified uncertainty. To ensure efficient development and uncertainty-aware decision making, we present an approach that allows to quantify uncertainty probabilistically or through a sample set. This quantified uncertainty is then kept consistent across all models. Furthermore, uncertainty is propagated and merged onto downstream model elements that depend on model elements or parameters with quantified uncertainty, and the contribution of each uncertain input to the derived uncertainty is quantified using Sobol sensitivity indices. We evaluate the approach using two case studies, comprising seven scenarios from cyber-physical systems and software engineering, based on industry scenarios and literature. The results show that quantified uncertainty can be expressed and correctly propagated and merged across all scenarios, matching an independent analytical oracle.
Iulian Ober. Can LLM agents with generic tools perform MBSE tasks, build-up skills and transfer them?
Click for abstract
An MBSE model can be construed as a complex graph database, and this is true regardless of the underlying modeling language (SysML, SDL, Capella or indeed any Domain Specific Modeling Language). It is hence conceivable that an intelligent artificial agent, for example one based on a LLM, may perform model-based tasks like creating, refactoring or verifying models, using only generic CRUD (Create/Read/Update/Delete) tools, provided that these tools are made available through the Model Context Protocol (MCP), a tool-access protocol that most agents support. It is however not obvious that the agent can be effective at performing those model-based tasks, as MBSE models have to satisfy many internal coherence rules, some (or many) of which are not explicitly specified in language or tool manuals. This paper presents an experiment in building an MCP server for a complex MBSE environment (Capella) based on generic model access functions of the Eclipse Modeling Framework (EMF), evaluating the effectiveness of agents at learning how to use the MCP tools to perform a range of model editing tasks in Capella, and finally, evaluating the effectiveness of in-context transfer of the learned skills to other non-skilled agents.
Masoud Sadrnezhaad, Martin Sjölund, Adrian Pop, José Antonio Hernández López, Torvald Mårtensson and Dániel Varró. ModBench: A Pipeline for Building Modelica Benchmark Datasets Mined from Library Repositories
Click for abstract
Research on equation-based cyber-physical systems modeling languages, such as Modelica, is constrained by the lack of curated benchmark datasets. This limits empirical insight into the evolution and development of models. We address this gap with ModBench, a pipeline that mines Git repositories of Modelica libraries to produce benchmark datasets of model snapshots. The pipeline (1) filters repository commits to retain human-authored, Modelica-relevant revisions; (2) extracts simulation-eligible classes; and (3) builds canonical representations of Modelica classes. For empirical validation, we applied ModBench to the Modelica Standard Library (MSL) and report the resulting dataset, spanning the full commit history (since Modelica language v3), with 85562 distinct class snapshots, and links enabling traceability to original models and Git metadata. The dataset, its API, and the data generation pipeline are publicly available to support future research on model evolution analysis, compiler testing, and automated model repair or generation.
Máté Földiák, Lena Buffoni and Dániel Varró. Towards a Modeling Assistant for Capturing CRML Requirements
Click for abstract
The Common Requirement Modeling Language (CRML) is a domain-specific controled natural language intended to capture requirements in a format that is readable by multidisciplinary stakeholders. However, similarly to other domain-specific languages, CRML suffers from limited available human expertise and material. LLMs provide a tool for experts to increase their productivity, but as CRML is largely excluded from LLM training data or only represented by outdated versions, LLMs and AI assistants cannot directly synthesize correct CRML models. We propose a modeling assistant that enables off-the-shelf LLMs and tools to work with CRML models to formalize natural language requirements in CRML. We leverage CRML specification and tooling to provide LLMs with condensed, usage-focused documentation and interactive syntactic checks of CRML models via the Model Context Protocol (MCP). We provide an initial evaluation of syntactic correctness for CRML models using an open-weight LLM.
Luca Brodo, Giuseppe Scalora, Lukas Walter and Stefan Henkler. Bridging Social and Technical Compliance in Autonomous Systems through a Standardized Pattern Catalog
Click for abstract
As autonomous systems are increasingly deployed in human-centered environments, ensuring their correctness must extend beyond technical properties. While temporal logics such as CTL and TCTL are well-established for specifying and verifying safety and liveness properties, integrating social compliance into the same verification workflow remains an open challenge. Social norms — implicit, context-dependent rules such as yielding to pedestrians or avoiding noise near residential areas — can in principle be expressed in CTL and TCTL, but their nuanced and often defeasible nature makes direct formalization a significant barrier for engineers in practice. To assist engineers in this task, we propose a standardized catalog of reusable observer patterns that bridges informal social requirements and their formal (T)CTL counterparts. Each pattern provides a tripartite interface: a natural language template to guide requirements elicitation, a precise CTL or TCTL formalization, and a corresponding observer automaton ready for integration into established model-checking workflows such as UPPAAL. The catalog covers the core deontic modalities --- permission, prohibition, and obligation --- and extends to exceptions, role-based authority, and graded compliance via fuzzy cost functions. We evaluate the catalog across a diverse set of autonomous systems scenarios in smart farming and autonomous transport, demonstrating how engineers can instantiate the patterns to formalize complex social requirements, resolve norm conflicts, and quantify trade-offs between social compliance and system performance.
Mraikh Nouhaila, Sébastien Picault, Massimo Tisi and Erwan Bousse. A DSL for Epidemiological Model Calibration Workflow
Click for abstract
In epidemiological modelling, sharing analytical workflows and reusing existing work are essential but remain challenging, as epidemiologists require reproducibility, reusability, and automation to efficiently connect observation data to mechanistic models. In practice, sensitivity analysis and parameter estimation are typically implemented through ad hoc scripts that are difficult to maintain, tightly coupled to specific models or datasets, and must be rewritten whenever methodological choices change. To address these limitations, we propose a domain-specific language (DSL) named ASPIRE that enables epidemiologists to define sensitivity analysis and parameter estimation workflows in a declarative and modular way, without manually writing analysis scripts. From a single specification describing the model, observation data, experimental design, and estimation method, the DSL automatically generates a complete and executable workflow, where modifying one aspect only requires updating the corresponding block. The approach supports reproducible and reusable workflows, while providing a homogeneous interface to existing libraries used for sensitivity analysis and parameter estimation, facilitating the exploration of alternative methods and configurations.
Léo Le Van Canh Canh Dit Ban, Luc Fabresse, Xavier Le Pallec and Emmanuel Renaux. Towards ASoT-Based Multi‑View MBSE with SysML v2: A Preliminary Studyz
Click for abstract
Model-Based System Engineering (MBSE) has become essential for the development of complex systems involving multiple stakeholders, engineering domains, and software tools. However, effective collaboration remains hindered by model fragmentation, where critical engineering data is distributed across heterogeneous environments. This fragmentation raises major challenges in terms of semantic consistency, cross-domain traceability, and tool interoperability, ultimately leading to errors and redundant manual effort. This paper analyzes to what extent the SysML v2 environment can help address these challenges and support the definition of an Authoritative Source of Truth (ASoT) principle for systems engineering. In particular, how SysML v2 language constructs, extension mechanisms, and API capabilities can be used to represent core system data, relate heterogeneous engineering artifacts, and support consistency management across tools. We also discuss the current limitations of the SysML v2 environment and identify the missing capabilities that still prevent it from constituting a complete operational solution. This analysis provides a first assessment of the potential and boundaries of SysML v2 as a foundation for a more integrated and consistent digital engineering ecosystem.
Ahmed Hassine and Jameleddine Hassine. Towards LLM-Driven Transformation of Goal Models for AI-Enabled Socio-Technical Systems
Click for abstract
Organizations are increasingly transforming traditional software systems into AI-enabled socio-technical systems. While goal models are widely used to capture stakeholder intentions, organizational objectives, and system requirements, existing approaches provide limited support for systematically evolving these models to reflect AI capabilities and the governance concerns they introduce, such as explainability, fairness, and accountability. This paper presents AI-Oriented Goal Model Transformation (AIGMT), an approach for transforming Goal-oriented Requirement Language (GRL) models of traditional systems into GRL models for AI-enabled socio-technical systems. AIGMT combines an AI Readiness Assessment, a catalog of AI transformation patterns, and Large Language Model (LLM)-assisted reasoning to identify candidate tasks for AI augmentation and generate corresponding model transformations. The methodology systematically introduces AI-enabled tasks, supporting resources, and governance requirements while preserving the original stakeholder intentions and goal-model structure. The approach is evaluated using three representative GRL models from the insurance, education, and healthcare domains, namely Insurance Claim Processing (the running example), University Course Registration, and Hospital Patient Intake and Triage. Together, these examples demonstrate the domain-independence of AIGMT and its ability to systematically evolve existing goal models into AI-enabled systems.
Emmanuel Gaudin. The Rise of Abstraction and Organizational Change: Preserving Human Control in the Age of Artificial Intelligence
Click for abstract
Human history can be viewed as a continuous progression toward higher levels of abstraction. Language abstracts physical experiences into concepts, architectural plans abstract physical constructions into structures, and computer programming abstracts electronic operations into logical descriptions. Across all domains, abstraction enables humans to focus on objectives rather than implementation details, allowing increasingly complex systems to be understood, designed, and managed. This paper examines abstraction as a fundamental driver of both technological and organizational evolution. It first clarifies the distinction between abstraction and representation, arguing that abstraction is primarily concerned with concepts and meaning rather than graphical form. It then analyzes how increasing abstraction progressively shifts attention from the question of how systems are implemented to the question of what they are intended to accomplish. From this evolution emerges the role of the architect, whose primary responsibility is to coordinate intentions, structures, and constraints across multiple domains of expertise. The paper argues that abstraction not only transforms technologies but also reshapes organizations. As abstraction increases, new forms of coordination, visibility, and control emerge, modifying the distribution of responsibilities and authority within organizations. These changes often generate resistance from specialists who may perceive higher abstraction levels as threatening established expertise, autonomy, or professional identity. Such resistance is interpreted not as a simple opposition to change but as a structural consequence of abstraction itself. Finally, the paper discusses the implications of artificial intelligence for the future of software engineering. It argues that the greatest contribution of AI may not be the direct generation of source code, but rather the generation and maintenance of models that remain understandable by humans while enabling automated implementation. The paper concludes that future progress will depend not only on creating higher abstractions but also on preserving human understanding, organizational coherence, and effective control over increasingly complex systems.
Neeraj Katiyar. A Scalable Framework for CIM-to-FMU Integration and Scenario-Based Simulation
Click for abstract
Large-scale power system studies increasingly rely on combining structured data models (e.g., CIM) with simulation components (e.g., FMUs). However, existing workflows for integrating these models are often manual, tightly coupled, and difficult to scale across large numbers of scenarios. This paper presents a configuration-driven framework that automates the integration of CIM-based data with FMU-based simulations and enables scalable execution of large simulation workloads. The approach separates integration into a declarative pipeline for mapping, parameter extraction, and initialization, and a distributed execution architecture that exploits scenario-level parallelism through a worker-based execution model. The proposed design improves reproducibility, reduces manual effort, and enables efficient parallel execution. Experimental results demonstrate up to 3× speedup on single-node systems and improved scalability in distributed environments. The evaluation further shows that process-based execution is essential for scalable FMU-based simulations due to inherent limitations of thread-based approaches. Overall, the framework provides a practical and extensible solution for scalable, reproducible simulation workflows in industrial settings.
Daniel Amyot. On Process Mining Executable Use Case Maps: Concurrency-Aware Scenario Synthesis with Variant- and Data-Driven Conditions
Click for abstract
The Use Case Map (UCM) notation, part of the ITU-T Z.151 User Requirements Notation standard, offers first-class support for executable scenarios that drive the validation of UCM process models. To date, such models and their scenarios have been written manually. This paper presents an end-to-end pipeline, packaged as the open-source PM4Py-UCM, that mines a UCM process model from an event log, clusters the log's traces under a concurrency-aware equivalence, and synthesizes a collection of executable scenario definitions enabling simple validation with stakeholders. The mined models include typed variables, mutually-exclusive OR-fork conditions, and per-loop integer counters that drive predetermined numbers of iterations per scenario. Two condition encodings are supported: a variant-driven baseline where the encoding perfectly replays observed variants from the original event log, and a data-driven alternative where decision-tree-mined expressions over case-level attributes provide business-readable rules. The tool-supported approach is illustrated using realistic event logs, which suggest practical feasibility and benefits.