Model-Based Systems Engineering (MBSE) has made substantial progress in managing system complexity, yet it still lacks principled support for understanding system behavior during early design. SysML v2 introduces a richer semantics for modeling behavior, but its utility remains limited by a lack of executable semantics, weak interoperability, and the absence of native support for formal verification and design-space exploration. We argue that a paradigm shift is needed, one in which behavioral models become first-class, executable artifacts, navigable within a dynamic design multiverse. This position paper presents the vision for the Living SysML v2 Blueprint, a next-generation SysML v2 virtual machine that unifies dynamic execution, multiverse exploration, and native formal verification. Central to this vision is the Transparent Execution, Observation, and Control (TEOC) API, enabling accurate semantic inspection and tool interoperability without model transformation. By tolerating incomplete models and exposing structured execution traces, the LivingBlueprint VM empowers system engineers, verification experts, and business strategists to engage with design decisions iteratively, rigorously, and early. This architecture redefines the semantics–verification–execution triad at the heart of MBSE, offering new foundations for explainability, trust, and AI-augmented design. This paper outlines the theoretical pillars, practical challenges, and community-wide opportunities of this approach and invites collaborative efforts toward a new class of MBSE platforms centered around behavioral fidelity and multiverse awareness.

Real-world design processes often involve the evolution and divergence of design paths (by branching, revising, merging, etc.), especially when multiple stakeholders or teams operate concurrently and/or explore different alternatives for complex and heterogeneous systems. Unfortunately, this variability in time and space can not be directly managed in current modeling spaces but requires resorting to external tools and methodologies. In order to tackle this problem, we introduce the Design Multiverse. The Design Multiverse aims to integrate in the modeling space a selection of revisions and variants, representing snapshots of a design state composed of multiple artifacts. This enables stakeholders to seamlessly trace, analyze, and manage design decisions, system variants, and their interdependencies. Concretely, in this paper we present a conceptual definition of the Design Multiverse, discuss usage scenarios such as model product lines and model/metamodel co-evolution, and propose an implementation leveraging the model federation paradigm.

In complex engineering environments, models are often developed independently within different technological spaces. Managing such models, while ensuring consistency, traceability, and life cycle evolution, is a critical challenge in Model-Based Systems Engineering (MBSE). In this paper, we present our contribution to the MoM Challenge 2025 (https://doi.org/10.5281/zenodo.15285132) with the use of Openflexo, a model management platform for model federation. We show how Openflexo federates heterogeneous models, OWL ontologies, JSON architecture files, Excel-based requirements, and text reports, while facilitating traceable and consistent linking of these multiple models. We present our contribution to the five key scenarios identified in the challenge and evaluate our contribution along key axes of model management.

Model-based Systems Engineering (MBSE) advocates the use of models in every stage of development, leading to large number of models that need coordination, collaboration, and discipline management. Model Management (MoM) is a possible approach to manage inter-related collections of models among which Model Federation (MF) provides unique capabilities, like independence of development in individual modelling domains. There is currently a lack of studies about commonalities, variabilities, and gaps in MF approaches. In this paper, we propose a survey and a critical discussion of carefully selected papers about MF. From 59 contributions collected by experts in MoM, we selected, and classified, 23 papers. We extract the main trends we observed, according to our Classification. We then critically review the Classification, and discuss important gaps found in our corpus. The survey results and artefacts are all available online.

In the context of complex system development, heterogeneous modeling responds to the need to integrate several domains. This need requires the use of the most appropriate formalism and tooling for each domain to be efficient. Model federation promotes the semantic interoperability of heterogeneous models by providing the means to reify correspondences between different model elements, add custom behaviors and bridge the gap between technological spaces. As such, it can be used as an infrastructure to address many different system engineering problems. This is what we have been doing for over a decade, as part of a close collaboration between a small software engineering startup and academia. This paper reports on this experience. Concretely, we discuss the context, ambitions, and challenges that led to the inception of our practice of model federation, and we present five use cases experiences, stemming from real industrial and academic needs, and elaborate on lessons learned. In addition, we also report on challenges and lessons learned regarding the development and maintenance of a model-driven model federation tool, the Openflexo framework. Finally, we set up a road map for the future of model federation and Openflexo.

Associations are a key concept in modeling languages as a way to formalize the relationships between domain concepts. Unfortunately, the support of semantically rich associations able to represent complex relationships is often missing, and this is both at the model and code level. At the model level, complex constraints on associations are often represented by using external, textual constraint languages which are difficult to understand and to maintain. At the code level, the situation is even worse, as mainstream object-oriented languages lack direct support for associations. In order to alleviate this problem, in this paper we propose a reification of complex association constraints so that they can be easily specified at development time and monitored at run-time. We do this by leveraging PAMELA, an annotation-based Java modeling framework, which promotes blending classical programming with modeling through the use of annotations and runtime code instrumentalization and monitoring. PAMELA is in the scope of Model-Oriented Programming approaches. We provide a classification of association constraints and discuss different implementation strategies. Finally, we demonstrate the feasibility of our approach with a prototype implementation and an initial catalog of association patterns.

There is a wide range of security solutions on cyber-physical systems, most aimed at preventing an adversary from gaining access to the system. However, to make a cyber-physical system more resilient and discover possible attack scenarios, it is necessary to analyze systems by taking into account their interactions with their environment. Standard formal analysis approaches are based on a model of the system. From a quantitative and qualitative point of view, the results of these analyzes depends on the model abstraction relative to the system. Usually, property verification is performed with formulas expressed in specific logics such as LTL or CTL. One of the problems is the semantic gap between textual requirements and these formalisms. In a security context, attacker interests are also necessary to take into account in the properties expression, in addition to system requirements. In this article we propose an approach allowing to analyze a real cyber-physical system while taking into account the interests of an attacker and while reducing the semantic gap between the textual requirements and logic formulas. The proposed methodology relies on the property specification patterns and the specification of an interface related to the state of the deployed embedded software. The motivating example used in this article comes from an industrial partner included in a collaborative project.

This article presents PAMELA, an annotation-based Java modeling framework. PAMELA provides a smooth integration between model and code and enables Java developers to handle software development both at conceptual level and at source-code level, without code transformation and/or generation, avoiding round-trip-related issues. (C) 2021 Published by Elsevier B.V.

With the ever growing digitization of activities, software systems are getting more and more complex. They must comply with new usages, varied needs, and are permanently exposed to new security vulnerabilities. Security concerns must be addressed throughout the entire development process and in particular through appropriate architectural choices. The security patterns are the founding principles to provide the architectural and design guidelines. Nevertheless, researchers have pointed out the need for further research investigations to improve quality and effectiveness of security patterns. In this paper, we focus on enhancing security patterns specification to improve the security of the systems using them. Thus, to reach this goal, we present a formal Design by Contract approach to improve the behavioral definition of the security patterns. This approach seeks to define both functional behavior and implicit parts of security design patterns. Our approach includes the contract formalization of security patterns and a comparative implementation on two Java annotation frameworks. The application of the proposal in a proof of concept case highlights the security enforcement at design time or on a legacy source code.

Cybersecurity is becoming vital as industries are gradually moving from automating physical processes to a higher level automation using cyber physical systems (CPS) and internet of things (IoT). In this context, security is becoming a continuous process that runs in parallel to other processes during the complete life cycle of a system. Traditional threat analysis methods use design models alongside threat models as an input for security analysis, hence missing the life-cycle-based dynamicity required by the security concern. In this paper, we argue for an attacker-aware systems modeling language that exposes the systems attack surfaces. For this purpose, we have designed Pimca, a domain specific modeling language geared towards capturing the attacker point of view of the system. This study introduces the formalism along with the Pimca workbench, a framework designed to ease the development and manipulation of the Pimca models. Finally, we present two relevant use cases, serving as a preliminary validation of our approach.

Software development projects seeking a high level of accuracy reach out to formal methods as early as the requirements engineering phase. However the client perspective of the future system is presented in an informal requirements document. The gap between the formal and informal approaches (and the artifacts used and produced by them) adds further complexity to an already rigorous task of software development. Our goal is to bridge this gap through a fine-grained level of traceability between the client-side informal requirements document to the developer-side formal specifications using a semi-formal modeling technique, model federation. Such a level of traceability can be exploited by the requirements engineering process for performing different actions that involve either or both these informal and formal artifacts. The effort and time consumed in developing such a level of traceability pays back in the later phases of a development project. For example, one can accurately narrow down the requirements responsible for an inconsistency in proof obligations during the analysis phase. We illustrate our approach using a running example from a landing gear system case study.

Model-Driven Engineering (MDE) proposes to modularize complex software-intensive systems using multiple models where each module serves a specific concern. These concerns of a system might be diverse and the use of multiple heterogeneous models often becomes inevitable. These models adhere to different paradigms and use distinct formalisms, which makes it hard to ensure consistency among them. Moreover, these models might contain certain concepts ( at times overlapping) that are reused for building cross-concern views/models. Maintaining models using separation of concerns in a heterogeneous modeling space becomes difficult. Traditional MDE suggests the use of model transformations to maintain the mappings between heterogeneous models. In this paper, we introduce a different approach based on model federation to map heterogeneous models. In contrast to traditional approaches where heterogeneous models are gathered in a single technological space, model federation keeps them in their own technological spaces. We provide a mechanism so that elements of these models are accessible for the development of cross-concern views/models from their respective technological spaces.

Researchers in software engineering have been striving to produce new methods to improve the quality of development methodologies to consequently produce quality products. Proposition of iterative and evolutionary approaches was triggered by the realization that requirements engineering is not confined to the initial phases of software development only. With this shift of perspective, requirements engineering has become more or less a continuous process in software development lifecycles. We believe that existing requirements engineering approaches and associated tooling leave a room for improvement in putting 'continuity' into practice. A continuous requirements engineering methodology needs to take into account different concerns of all the stakeholders involved in the process. Approaches like KAOS bring the multi-view nature of requirements modeling in focus by using different views for goal, responsibility, object and operation modeling. We argue that a multi-view approach, maintaining a dynamic link between the requirement models and multiple sources of requirements, can offer a better support for continuous requirements engineering methodology. In this paper, we expand on this argument and present the early findings with the associated in progress tooling support.

Mostly the development of domain specific modeling languages (DSML) follows the traditional model driven engineering practices. First the syntax and semantics of the language are defined (at meta-level) and then it is used for the development of user models. In certain situations, it is hard even to conceptualize the demands of the user, let alone the definition of the language. Agile methods for software development suggest that the development activities should be performed alongside a client stakeholder for incremental development of the system. This approach helps in the elicitation of requirements in parallel to the actual development of the system. We followed this approach for developing a domain specific modeling language and its tooling for a local government project, Brest Métropole. The project aimed at filling the communication gap between the elected representatives (politicians) and the bureaucracy (government officers). We used a modeling methodology that does not restrict a modeler's interaction to a single abstraction level. Thus a modeler can develop both models and metamodels at the same time, where the definition of one helps in defining the other. In this article, we explain our experiences from this project and share the lessons learnt.

Nous proposons d'identifier des situations de modélisation en mettant en évidence des actions élémentaires sur les artéfacts de modélisation que sont les modèles et les méta-modèles.Nous illustrons la démarche de modélisation par une étude de cas détaillée.Nous pensons que l'identification de ces situations élémentaires permet de mieux comprendre la modélisation et par conséquent les besoins des outils de modélisation.Nous présentons Openflexo, un outil de modélisation libre qui nous permet de mettre en oeuvre cette approche.ABSTRACT.We propose to identify modeling situations highlighting elementary actions on modeling artifacts such as models and meta-models.We apply a modeling process to a detailled use case.We believe that identification of these basic situations helps better understand the modeling and therefore modeling tools requirements.We present Openflexo a free modeling tool that helps us implementing this approach. MOTS-CLÉS :