Pith. sign in

REVIEW 3 major objections 4 minor 93 references

Model-Driven Discipline for Multi-Agent LLMs: Requirement-to-Verification Generation of Traceable System Models

T0 review · 3 major / 4 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A single requirement model can drive automatic generation of a domain-specific modelling language, a conforming system model, and a formally verified behaviour model — with traceability links that make change-impact analysis exact.

desk verdict A solid, honest feasibility study of a multi-agent LLM-to-MDE pipeline where the formal verification claim is over-broad; traceability-by-construction is the real contribution. read the letter →

arxiv 2607.16708 v1 pith:BBPOI7KD submitted 2026-07-18 cs.SE

Ran Wei , Le Zhu , Haochi Wang , Ruizhe Yang , Jiapeng Guan , Siyuan Ji , Yuchen Hu , Zhe Jiang
show 1 more author
Xiangyang Ji
This is my paper
classification cs.SE
keywords model-drivenengineeringmulti-agentlargelanguagemodelstraceabilitybyconstructionchangeimpactanalysisformalverificationRoboChartCSPdeadlockfreedom
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

RADIANT is an engineering methodology that combines model-driven engineering with multi-agent LLMs and claims that one carefully written requirement model can drive the entire downstream modelling chain: concept model, domain-specific modelling language, conforming system model, and behaviour model are generated rather than hand-authored, each with element-level traceability links back to the requirements. On top of those links sits an automated change-impact analysis that, given a changed requirement, identifies the affected elements across all artefacts. The generated behaviour models are translated into a process algebra and formally checked for deadlock freedom and convergence, with counterexamples driving an automatic repair loop. Across three LLMs, the multi-agent decomposition reliably improves the syntactic validity of generated formal artefacts, improves executability where the model's code generation is capable, and yields model-dependent semantic gains. A six-participant study reports a 10–15× reduction in development time, and the unchanged pipeline transfers to a second domain.

What carries the argument

The load-bearing mechanism is the generic Multi-Agent LLM layer: a group chat of Generator, Checker, optional Refactorer, and Trace-Generation agents, plus a phase-specific Repair Agent invoked when a hard check gate fails; each generative phase reuses the same layer with different prompts, inputs, and repair targets. The other central object is Bifrost, a traceability metamodel in which each link is an external reference carrying the version and location of the target element, which makes change-impact analysis a computable operation. The behaviour phase adds a third mechanism: generated RoboChart state machines are translated into CSP and checked by the FDR refinement checker for deadlock

What would settle it

Take the generated Last Response Engine state machine, replace the boolean guard variables with the concrete arithmetic guards (velocity thresholds, distances, OPEZ membership) from the requirements, and run FDR on that concrete translation; if FDR reports a deadlock or non-convergent trace that the abstracted model passed, the verification contribution collapses, while a clean pass closes the abstraction gap for this case.

Watch

Extended reading notes

Core claim

RADIANT's central claim is that a complete model-based engineering process — from a requirement model to a formally verified behaviour model — can be automated by chaining generic multi-agent LLM layers, and that traceability need not be recovered afterwards: it is emitted by construction. Every generated element carries a machine-resolvable link to the requirement it realises. On the case study, the chain produces a concept model, a domain-specific modelling language, a conforming system model, and a RoboChart state machine; the state machine is translated into CSP and checked with the FDR refinement checker for deadlock freedom and convergence, with counterexamples driving an automatic rep

Load-bearing premise

The formal verification claim is only as strong as the boolean-guard abstraction: the model checked by FDR has concrete guards stripped out, and the paper does not show that deadlock freedom and convergence of the abstracted machine imply the same properties for the machine with real guards reinstated.

Editorial extensions

If this is right

  • A requirement change no longer requires manual impact assessment: the traceability links plus content hashing identify affected elements across concept model, DSML, system model, and behaviour model.
  • The multi-agent decomposition's most reliable, model-independent gain is syntactic validity of generated formal artefacts; downstream executability improves only where the underlying LLM can produce runnable code.
  • Formal verification enters the loop as a repair driver: state machines that fail FDR checks are automatically repaired, so the final artefact is deadlock-free and convergent at the checked level of abstraction.
  • The unmodified pipeline, including prompts, transfers to a second independently authored domain and drives every phase through its check gate without changes.
  • In a six-participant crossover study, the automated pipeline cut development time by roughly 10–15× relative to manual work with the same MDE tooling, with no measured loss in artefact accuracy.
  • The mechanism for change-impact analysis is exact: over 180 injected requirement changes, precision, recall, and F1 were 1.00 for the behaviour layer, with reliability bounded only by link resolvability.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The verification result as reported covers a boolean-guard abstraction: a natural next step is to prove or disprove property transfer when concrete guards are reinstated — if it transfers, the pipeline can feed safety certification directly.
  • Because change-impact exactness is bounded by link resolvability, a mature deployment should surface unresolved links as first-class risks in the impact report rather than silently dropping them.
  • The 'carefully written' requirement model is itself a skilled manual artefact; counting the time to author it would make the 10–15× efficiency comparison an end-to-end measure rather than a post-requirements one.
  • The consistently strong syntactic-validity gain suggests a cheaper architecture: deterministic parsers and executors as gates, with LLM repair reserved for artefacts those tools reject — an empirical question the paper's data makes addressable.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes RADIANT, a methodology that combines Model-Driven Engineering (MDE) with Multi-Agent LLMs to generate, from a single requirement model, a concept model, a domain-specific modelling language (Emfatic/Ecore), a conforming system model (built via EOL), and a RoboChart behaviour model. Each phase emits element-level executable traceability links via a new Bifrost metamodel, on top of which RADIANT provides automated change-impact analysis. Generated behaviour models are translated to CSP and checked with FDR for deadlock freedom and convergence, with a counterexample-driven repair loop. The evaluation covers an AUV case study across three LLMs (ten repetitions each, single-agent vs multi-agent), a six-participant efficiency study, and an unmodified transfer to a second domain (SRanger). The central claims are: multi-agent decomposition reliably improves syntactic validity and, where the underlying model's code generation permits, executability; semantic gains are model-dependent; development effort is reduced 10–15×; change-impact analysis is exact; and the pipeline transfers across domains.

Significance. If the central claims hold, RADIANT is a substantive contribution: it demonstrates a complete requirement-to-verification chain with traceability by construction, and its multi-agent decomposition is analysed honestly, with model-dependent semantic gains reported rather than overstated. The paper's concrete strengths are its open replication package, transparent set-based accuracy metrics, execution-based evaluation of EOL code, and a falsifiable claim about when multi-agent decomposition helps. The main safety-critical claim — that generated behaviour models are formally verified — is, however, currently unsupported for the concrete state machines because FDR checks a boolean-abstracted guard skeleton. The efficiency comparison is also not like-for-like. These issues are load-bearing for the abstract and the paper's headline contributions, but they are addressable within the manuscript's scope.

major comments (3)
  1. [Sections 4.3.3, 4.7, and 1] The formal-verification claim is unsupported for the concrete behaviour model. Section 4.3.3 states that 'the pipeline deliberately abstracts concrete guards into boolean variables for FDR-verifiability', and Section 4.7 says participants 'checked the structure and reinstated the concrete guards' after FDR checking. No abstraction relation is defined, and no proof is given that deadlock-freedom or convergence of the boolean-guard abstraction transfers to the restored concrete state machine. A deadlock arising only from concrete guard evaluation — e.g., a reachable valuation with no enabled transition — would be invisible to FDR, and the repair loop would repair only the abstraction. The abstract's claim that behaviour models are 'formally verified (e.g. for deadlock freedom and convergence)' therefore applies only to a deliberately weakened artefact. Please either prove a property-preser
  2. [Section 4.7 (Table 4)] The 10–15× efficiency claim is based on a non-commensurable comparison. In the manual condition, participants authored the DSML, EMF model, RoboChart architecture and behaviour models, and performed change-impact analysis by hand. In the automated condition, participants ran MALCOM on the same requirement model and 'checked and lightly edited' the generated artefacts, with the authors noting that 'the automated times reflect review effort and the accuracies are the pipeline's rather than the individual's.' The automated condition therefore excludes the pipeline's own generation time and reduces the participant's task to post-hoc review, while the change-impact task becomes merely checking automated results. The headline '10–15× reduction in development time' compares full authoring effort against review effort. To support the claim, report end-to-end wall-clock time including LLM and MDE
  3. [Sections 4.6 and 5.5] The traceability and change-impact results are validated against a reference that is not independent. Section 4.6 reports F1=1.00 for behaviour-layer trace links against a 'hand-authored expert trace', and change-impact precision/recall of 1.00 against 'expert-intended impact'. Section 5.5 acknowledges that 'the residual construct risk is that the AUV reference is hand-authored by us.' Because the Bifrost trace models and the artefacts are generated by the same pipeline, the perfect scores partly reflect internal consistency rather than independent correctness. The 'exact' change-impact claim should be scoped to the generated trace graph, and the link-correctness evaluation should be repeated with independent ground truth (e.g., separate annotators or a published reference trace) before claiming element-level traceability correctness.
minor comments (4)
  1. [Section 4.6] Behaviour-layer trace F1 is reported as exactly 1.00 for all three models, yet behaviour link resolvability is 1.00/0.97/0.73 (DeepSeek/QWEN/Sonnet). Please clarify how unresolved links are treated in the F1 computation; if a link's target is absent, it should not count as a true positive.
  2. [Section 4.7 (Table 4)] The change-impact task is reported with 'N/a' accuracy for all participants in both conditions. The text says participants performed a change-impact analysis, but no scoring details are given. Please either report the manual change-impact accuracy or state that it was not scored.
  3. [Figure 1] The caption states that 'only the requirement model (Phase 1, dashed) is authored manually', but Section 4.7 has participants manually authoring downstream models in the control condition. Please clarify that the dashed border refers to RADIANT's generative process, not the evaluation's manual condition.
  4. [Section 3.1] The retry cap for the Repair Agent and the few-shot exemplar count per phase are listed as free parameters but their values are not reported anywhere. Please include these values and, ideally, a small sensitivity check, since the multi-agent gain may depend on them.

Circularity Check

1 steps flagged · score 6.0 of 10

Change-impact 'exactness' reduces to a lookup over links validated against the same expert trace; guard abstraction is a separate non-circular gap.

  1. self definitional [Section 3.3 (Phase 6) and Section 4.6 (RQ3)]
    "a content hash of each requirement is compared against the version attribute recorded in the corresponding Bifrost ExternalReference; a mismatch flags the requirement as changed, and the affected downstream elements are read off the traceability links. ... the generated (requirement, transition-edge) links reproduce the hand-authored expert trace (18 transitions) exactly (F1= 1.00 for all three models) ... we inject each of the eighteen behaviour requirements as a change and compare the impact set computed from each run's trace graph against the expert-intended impact. Over 180 changes per mod"

    The change-impact output is by construction the set of elements targeted by Bifrost links from the changed requirement: Section 3.3 defines the computation as reading affected elements off the traceability links. Therefore the reported change-impact correctness is a direct restatement of the link-correctness result, not an independent test. Since link correctness was already measured against the same hand-authored expert trace (F1=1.00), reading off those links trivially reproduces the expert-intended impact and yields F1=1.00. The 'exactness' is true of the lookup data structure over self-generated links, not an independently established property.

full rationale

Most of RADIANT's derivation chain is not circular: the multi-agent generation, RQ1/RQ2 accuracy comparisons, and the FDR checks on the boolean-guard skeletons are empirical evaluations with independent baselines (single-agent control, external RoboChart/FDR). The repair loop adapted from [88] is a same-author citation but is descriptive rather than load-bearing. The one place where a reported result reduces by construction is the change-impact analysis: the impact set is defined as a lookup over the Bifrost links that the same pipeline generated, so the F1=1.00 against 'expert-intended impact' is a restatement of the link-accuracy result measured against the same hand-authored expert trace, not an independent validation. This is a partial, localized circularity. A separate correctness risk (not circularity) is that FDR verifies a deliberately boolean-guard-abstracted state machine, and Sections 4.3.3 and 4.7 confirm concrete guards are reinstated afterwards with no abstraction/preservation argument, leaving the safety-critical verification claim unsupported as stated. The paper does acknowledge the hand-authored-reference threat in Section 5.5, which mitigates but does not eliminate the issue.

Assumptions & free parameters 2 free parameters · 5 assumptions · 1 invented entities

The central claims rest less on fitted parameters than on hand-chosen prompt assets, retry caps, and evaluation references; the main epistemic debts are the internal expert reference, the boolean abstraction for FDR, and the requirement-authoring conventions.

free parameters (2)
  • retry cap
    Section 3.1: repair repeats 'up to a retry cap'; the value is not given but determines when the pipeline accepts a repaired artefact, affecting reported success rates.
  • few-shot exemplar count per phase
    Section 2.2/3.1: few-shot prompting is used; the number of exemplars is chosen by hand per phase and affects output validity.
assumptions (5)
  • ad hoc to paper Requirement models must be rewritten with RADIANT's conventions (Concepts capitalised, Instances quoted, atomic requirements, modularisation) for accurate generation.
    Section 3.2.1: 'From our experience, a few conventions in writing requirements lead to markedly more accurate generation.' The pipeline's accuracy claims assume requirements are authored in this style.
  • ad hoc to paper FDR deadlock/convergence checking on boolean-abstracted state machines is accepted as the safety verification of the behaviour model.
    Section 4.3.3 states guards are abstracted to booleans for FDR-verifiability; no proof is given that the properties transfer to the concrete guards, yet the paper describes generated behaviour models as 'formally verified'.
  • domain assumption The hand-authored expert reference models and expert-intended impact sets are correct and complete.
    Sections 4.4 and 5.5: the reference is 'hand-authored by us'; accuracy and change-impact correctness are measured against this internal reference.
  • domain assumption Ten repetitions per (model, configuration) sufficiently characterize LLM stochasticity for the statistical conclusions.
    Section 4.3.1: ten repetitions per cell; Section 5.5 acknowledges small n and uncorrected p-values, so the assumption is weak.
  • domain assumption MDE transformations are deterministic, so all variability is attributed to the LLM generation phase.
    Section 5.5: 'The MDE transformations themselves are deterministic, so variability is confined to the generation phase.' This underpins the attribution of variance in RQ2.
invented entities (1)
  • Bifrost traceability metamodel
    purpose: Executable element-level trace links between requirements and generated model elements, supporting automated change-impact analysis.
    A new metamodel defined by the authors (Sections 3.2.2, 3.3); no external validation or adoption beyond the paper's own evaluation, and its 'exact' change-impact property is a lookup over its own links.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Model-Driven Discipline for Multi-Agent LLMs: Requirement-to-Verification Generation of Traceable System Models." pith.science (2026). https://pith.science/paper/BBPOI7KD

@misc{pith2026260716708,
  author       = {Pith},
  title        = {Pith review of: Model-Driven Discipline for Multi-Agent LLMs: Requirement-to-Verification Generation of Traceable System Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BBPOI7KD}},
  note         = {Machine review of arXiv:2607.16708}
}
abstract

Software complexity is a long-standing challenge for system engineers. Model-Driven Engineering (MDE) addresses it by treating models as first-class artefacts, but a typical MDE process spans many tools and produces heterogeneous models of different system aspects, making traceability, maintenance, and change management difficult. We propose RADIANT, an engineering methodology that combines MDE with Multi-Agent Large Language Models (LLMs) for complete model-based system development, with a focus on safety-critical systems. From a carefully specified requirement model, RADIANT automatically generates heterogeneous models across engineering phases -- a concept model, a domain-specific modelling language, a conforming system model, and a behaviour model -- together with executable, element-level traceability links, on top of which it provides exact, automated change-impact analysis. Generated behaviour models are translated into CSP and formally verified (e.g.\ for deadlock freedom and convergence) with a counterexample-driven repair loop. Evaluating RADIANT across three LLMs, we find that the multi-agent decomposition reliably improves the \emph{syntactic validity} of the generated formal artefacts over a single-agent baseline -- and their \emph{executability} where the model's code generation permits -- while gains in semantic accuracy are model-dependent. A six-participant study shows an order-of-magnitude ($10$--$15\times$) reduction in development time, and the unmodified pipeline transfers to a second domain.

Figures

Figures reproduced from arXiv: 2607.16708 by the authors.

Figure 1
Figure 1. Overview of RADIANT and its realisation in our tool MALCOM (Section [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. The generic Multi-Agent LLM layer, instantiated once per generative phase (Phases 2–5), as described in the text. [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. The state machine of the Last Response Engine modelled using RoboChart [ [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Per-stage Single- vs. Multi-agent scores per model (mean over ten repetitions). Stars mark significant differences in [PITH_FULL_IMAGE:figures/full_fig_p014_4.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

93 extracted references · 3 canonical work pages

  1. [1]

    Functional safety of electrical/electronic/programmable electronic safety-related systems

    2010. Functional safety of electrical/electronic/programmable electronic safety-related systems

    2010

  2. [2]

    Road Vehicles – Functional Safety

    2018. Road Vehicles – Functional Safety

    2018

  3. [3]

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. 2023. Gpt-4 technical report.arXiv preprint arXiv:2303.08774(2023)

    arXiv 2023

  4. [4]

    Nolan, Julia Rubin, and Yael Shaham-Gafni

    Neta Aizenbud-Reshef, Brian T. Nolan, Julia Rubin, and Yael Shaham-Gafni. 2006. Model Traceability.IBM Systems Journal45, 3 (2006), 515–526

    2006

  5. [5]

    Iván Alfonso, Aaron Conrardy, Armen Sulejmani, Atefeh Nirumand, Fitash Ul Haq, Marcos Gomez-Vazquez, Jean-Sébastien Sottet, and Jordi Cabot

  6. [6]

    Abdurrahman Alshareef, Nicholas Keller, Priscilla Carbo, and Bernard P Zeigler. 2023. Generative AI with Modeling and Simulation of Activity and Flow-Based Diagrams. InInternational Conference on Simulation Tools and Techniques. Springer, 95–109

    2023

  7. [7]

    Anthropic. 2026. Claude Sonnet 4.6. https://www.anthropic.com/claude. Large language model

    2026

  8. [8]

    Giuliano Antoniol, Gerardo Canfora, Gerardo Casazza, Andrea De Lucia, and Ettore Merlo. 2002. Recovering Traceability Links between Code and Documentation.IEEE Transactions on Software Engineering28, 10 (2002), 970–983. doi:10.1109/TSE.2002.1041053 Manuscript submitted to ACM Model-Driven Discipline for Multi-Agent LLMs: Requirement-to-Verification Genera...

    arXiv 2002

Show all 93 references
  1. [9]

    Sathurshan Arulmohan, Marie-Jean Meurs, and Sébastien Mosser. 2023. Extracting Domain Models from Textual Requirements in the Era of Large Language Models. In2023 ACM/IEEE International Conference on Model Driven Engineering Languages and Systems Companion (MODELS-C). 580–587....

    2023

  2. [10]

    Konstantinos Barmpis and Dimitris Kolovos. 2013. Hawk: Towards a scalable model indexing architecture. InProceedings of the Workshop on Scalability in Model Driven Engineering. 1–9

    2013

  3. [11]

    2021.Software Architecture in Practice(4th ed.)

    Len Bass, Paul Clements, and Rick Kazman. 2021.Software Architecture in Practice(4th ed.). Addison-Wesley

    2021

  4. [12]

    2024.Introducing SysEngBench: A novel benchmark for assessing large language models in systems engineering

    Ryan Bell, Ryan Longshore, and Raymond Madachy. 2024.Introducing SysEngBench: A novel benchmark for assessing large language models in systems engineering. Technical Report. Acquisition Research Program

    2024

  5. [13]

    Michel Benaroch and Kalle Lyytinen. 2023. How much does software complexity matter for maintenance productivity? The link between team instability and diversity.IEEE Transactions on Software Engineering49, 4 (2023), 2459–2475

    2023

  6. [14]

    Vincent Bertram, Miriam Boß, Evgeny Kusmenko, Imke Helene Nachmann, Bernhard Rumpe, Danilo Trotta, and Louis Wachtmeister. 2022. Neural Language Models and Few Shot Learning for Systematic Requirements Processing in MDSE. InProceedings of the 15th ACM SIGPLAN International Con...

    2022

  7. [15]

    2016.Implementing domain-specific languages with Xtext and Xtend

    Lorenzo Bettini. 2016.Implementing domain-specific languages with Xtext and Xtend. Packt Publishing Ltd

    2016

  8. [16]

    2017.Model-driven software engineering in practice

    Marco Brambilla, Jordi Cabot, and Manuel Wimmer. 2017.Model-driven software engineering in practice. Morgan & Claypool Publishers

    2017

  9. [17]

    Briand, Yvan Labiche, and Leeshawn O’Sullivan

    Lionel C. Briand, Yvan Labiche, and Leeshawn O’Sullivan. 2003. Impact Analysis and Change Management of UML Models. InProceedings of the International Conference on Software Maintenance (ICSM). IEEE, 256–265

    2003

  10. [18]

    Stephen D Brookes, Charles AR Hoare, and Andrew W Roscoe. 1984. A theory of communicating sequential processes.Journal of the ACM (JACM) 31, 3 (1984), 560–599

    1984

  11. [19]

    1987.No silver bullet

    Frederick Brooks and H Kugler. 1987.No silver bullet. April

    1987

  12. [20]

    Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. 2020. Language models are few-shot learners.Advances in neural information processing systems33 (2020), 1877–1901

    2020

  13. [21]

    Kolovos, and Jordi Cabot

    Hugo Brunelière, Florent Marchand de Kerchove, Gwendal Daniel, Sina Madani, Dimitris S. Kolovos, and Jordi Cabot. 2020. Scalable Model Views over Heterogeneous Modeling Technologies and Resources.Software and Systems Modeling19, 4 (2020), 827–851

    2020

  14. [22]

    Paige, and Alfonso Pierantonio

    Antonio Bucchiarone, Jordi Cabot, Richard F. Paige, and Alfonso Pierantonio. 2020. Grand Challenges in Model-Driven Engineering: An Analysis of the State of the Research.Software and Systems Modeling19, 1 (2020), 5–13

    2020

  15. [23]

    Daniel Busch, Gerrit Nolte, Alexander Bainczyk, and Bernhard Steffen. 2023. ChatGPT in the loop: a natural language extension for domain-specific modeling languages. InInternational Conference on Bridging the Gap between AI and Reality. Springer, 375–390

    2023

  16. [24]

    Jordi Cabot and Robert Clarisó. 2023. Low Code for Smart Software Development.IEEE Software40, 1 (2023), 89–93. doi:10.1109/MS.2022.3211352

    2023

  17. [25]

    Javier Cámara, Javier Troya, Lola Burgueño, and Antonio Vallecillo. 2023. On the assessment of generative AI in modeling tasks: an experience report with ChatGPT and UML.Software and Systems Modeling22, 3 (2023), 781–793

    2023

  18. [26]

    Johan Cederbladh, Antonio Cicchetti, and Jagadish Suryadevara. 2024. Early validation and verification of system behaviour in model-based systems engineering: a systematic literature review.ACM Transactions on Software Engineering and Methodology33, 3 (2024), 1–67

    2024

  19. [27]

    Yupeng Chang, Xu Wang, Jindong Wang, Yuan Wu, Linyi Yang, Kaijie Zhu, Hao Chen, Xiaoyuan Yi, Cunxiang Wang, Yidong Wang, et al. 2024. A survey on evaluation of large language models.ACM Transactions on Intelligent Systems and Technology15, 3 (2024), 1–45

    2024

  20. [28]

    Kua Chen, Yujing Yang, Boqi Chen, José Antonio Hernández López, Gunter Mussbacher, and Dániel Varró. 2023. Automated Domain Modeling with Large Language Models: A Comparative Study. In2023 ACM/IEEE 26th International Conference on Model Driven Engineering Languages and Systems...

    2023

  21. [29]

    2012.Software and systems traceability

    Jane Cleland-Huang, Orlena Gotel, and Andrea Zisman (Eds.). 2012.Software and systems traceability. Springer

    2012

  22. [30]

    Justin Cooper, Alfonso De la Vega, Richard Paige, Dimitris Kolovos, Michael Bennett, Caroline Brown, Beatriz Sanchez Pina, and Horacio Hoyos Rodriguez. 2021. Model-based development of engine control systems: Experiences and lessons learnt. In2021 ACM/IEEE 24th International C...

    2021

  23. [31]

    Andrea De Lucia, Rocco Oliveto, and Genoveffa Tortora. 2008. Adams re-trace: traceability link recovery via latent semantic indexing. In2008 ACM/IEEE 30th International Conference on Software Engineering. 839–842. doi:10.1145/1368088.1368216

    2008

  24. [32]

    DeepSeek-AI, Anyi Xu, Bangcai Lin, Bing Xue, Bingxuan Wang, Bingzheng Xu, Bochao Wu, Bowei Zhang, Chaofan Lin, Chen Dong, Chenchen Ling, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chengyu Hou, Chenhao Xu, Chenze Shao, Chong Ruan, Conner Sun, Damai Dai, Daya Guo, Dejian Yang, De...

    2026

  25. [33]

    Ewen Denney and Ganesh Pai. 2018. Tool support for assurance case development.Automated Software Engineering25, 3 (2018), 435–499

    2018

  26. [34]

    Davide Di Ruscio, Dimitris Kolovos, Juan de Lara, Alfonso Pierantonio, Massimo Tisi, and Manuel Wimmer. 2022. Low-code development and model-driven engineering: Two sides of the same coin?Software and Systems Modeling21 (2022), 437–446

    2022

  27. [35]

    Zhiyu Fan, Xiang Gao, Martin Mirchev, Abhik Roychoudhury, and Shin Hwei Tan. 2023. Automated repair of programs from large language models. In2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE). IEEE, 1469–1481

    2023

  28. [36]

    Simon David Foster, Yakoub Nemouchi, Colin O’Halloran, Nick Tudor, and Karen Stephenson. 2020. Formal Model-Based Assurance Cases in Isabelle/SACM: An Autonomous Underwater Vehicle Case Study. InFormal Methods in Software Engineering (FormaliSE 2020): Proceedings of the 8th In...

    2020

  29. [37]

    Simon David Foster, Frank Zeyda, Yakoub Nemouchi, Pedro Fernando De Oliveira Salazar Ribeiro, and Burkhart Wolff. 2019. Isabelle/UTP: mechanised theory engineering for unifying theories of programming.Archive of Formal Proofs(2019)

    2019

  30. [38]

    Xiaodong Gu, Meng Chen, Yalan Lin, Yuhan Hu, Hongyu Zhang, Chengcheng Wan, Zhao Wei, Yong Xu, and Juhong Wang. 2025. On the effectiveness of large language models in domain-specific code generation.ACM Transactions on Software Engineering and Methodology34, 3 (2025), 1–22

    2025

  31. [39]

    Jin Guo, Jinghui Cheng, and Jane Cleland-Huang. 2017. Semantically Enhanced Software Traceability Using Deep Learning Techniques. In2017 IEEE/ACM 39th International Conference on Software Engineering (ICSE). 3–14. doi:10.1109/ICSE.2017.9

    2017 doi

  32. [40]

    Chawla, Olaf Wiest, and Xiangliang Zhang

    Taicheng Guo, Xiuying Chen, Yaqi Wang, Ruidi Chang, Shichao Pei, Nitesh V. Chawla, Olaf Wiest, and Xiangliang Zhang. 2024. Large Language Model Based Multi-Agents: A Survey of Progress and Challenges. InProceedings of the Thirty-Third International Joint Conference on Artifici...

    2024 doi

  33. [41]

    Sirui Hong, Mingchen Zhuge, Jonathan Chen, Xiawu Zheng, Yuheng Cheng, Jinlin Wang, Ceyao Zhang, Steven Yau, Zijuan Lin, Liyang Zhou, et al

  34. [42]

    John Hutchinson, Mark Rouncefield, and Jon Whittle. 2011. Model-driven engineering practices in industry. InProceedings of the 33rd International Conference on Software Engineering. 633–642

    2011

  35. [43]

    InInternational Conference on Learning Representations, Vol

    MetaGPT: Meta programming for a multi-agent collaborative framework. InInternational Conference on Learning Representations, Vol. 2024. 23247–23275

    2024

  36. [44]

    Jama Software. [n. d.]. Jama Connect. https://www.jamasoftware.com/platform/jama-connect/. Online; accessed 17th June, 2026

    2026

  37. [45]

    IBM. [n. d.]. IBM Engineering Requirements Management DOORS. https://www.ibm.com/products/requirements-management-doors-next. Online; accessed 17th June, 2026

    2026

  38. [46]

    Frédéric Jouault, Freddy Allilaire, Jean Bézivin, Ivan Kurtev, and Patrick Valduriez. 2006. ATL: a QVT-like transformation language. InCompanion to the 21st ACM SIGPLAN symposium on Object-oriented programming systems, languages, and applications. 719–720

    2006

  39. [47]

    Dongming Jin, Zhi Jin, Xiaohong Chen, and Chunhui Wang. 2024. MARE: Multi-Agents Collaboration Framework for Requirements Engineering. arXiv preprint arXiv:2405.03256(2024). arXiv:2405.03256 [cs.SE]

    2024 arXiv

  40. [48]

    2008.Software Language Engineering: Creating Domain-Specific Languages Using Metamodels

    Anneke Kleppe. 2008.Software Language Engineering: Creating Domain-Specific Languages Using Metamodels. Addison-Wesley

    2008

  41. [49]

    1999.Arguing safety: a systematic approach to managing safety cases

    Timothy Patrick Kelly. 1999.Arguing safety: a systematic approach to managing safety cases. Ph. D. Dissertation. University of York York, UK

    1999

  42. [50]

    Dimitrios S Kolovos, Richard F Paige, and Fiona AC Polack. 2006. The epsilon object language (EOL). InModel Driven Architecture – Foundations and Applications (Lecture Notes in Computer Science, Vol. 4066), Arend Rensink and Jos Warmer (Eds.). Springer, 128–142. doi:10.1007/11...

    2006 doi

  43. [51]

    Dimitrios S Kolovos, Richard F Paige, and Fiona AC Polack. 2006. Eclipse development tools for epsilon. InEclipse Summit Europe, Eclipse Modeling Symposium, Vol. 20062. 200

    2006

  44. [52]

    Dimitrios S Kolovos, Richard F Paige, and Fiona AC Polack. 2009. On the evolution of OCL for capturing structural constraints in modelling languages. InRigorous Methods for Software Construction and Analysis. Springer, 204–218

    2009

  45. [53]

    Dimitrios S Kolovos, Richard F Paige, and Fiona AC Polack. 2008. The epsilon transformation language. InTheory and Practice of Model Transformations. Springer, 46–60

    2008

  46. [54]

    Guohao Li, Hasan Hammoud, Hani Itani, Dmitrii Khizbullin, and Bernard Ghanem. 2023. Camel: Communicative agents for" mind" exploration of large language model society.Advances in Neural Information Processing Systems36 (2023), 51991–52008

    2023

  47. [55]

    Juan De Lara and Esther Guerra. 2017. A posteriori typing for model-driven engineering: Concepts, analysis, and applications.ACM Transactions on Software Engineering and Methodology (TOSEM)25, 4 (2017), 1–60

    2017

  48. [56]

    Luiz Eduardo G Martins and Tony Gorschek. 2020. Requirements engineering for safety-critical systems: An interview study with industry practitioners.IEEE Transactions on Software Engineering46, 4 (2020), 346–361. Manuscript submitted to ACM Model-Driven Discipline for Multi-Ag...

    2020

  49. [57]

    Jinfeng Lin, Yalin Liu, Qingkai Zeng, Meng Jiang, and Jane Cleland-Huang. 2021. Traceability Transformed: Generating More Accurate Links with Pre-Trained BERT Models. In2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE). 324–335. doi:10.1109/ICSE43902.2...

    2021

  50. [58]

    Hossain Muhammad Muctadir, Loek Cleophas, and Mark van den Brand. 2024. Maintaining Consistency of Digital Twin Models: Exploring the Potential of Graph-Based Approaches. In2024 50th Euromicro Conference on Software Engineering and Advanced Applications (SEAA). 152–159. doi:10...

    2024

  51. [59]

    Alvaro Miyazawa, Pedro Ribeiro, Wei Li, Ana Cavalcanti, Jon Timmis, and Jim Woodcock. 2019. RoboChart: modelling and verification of the functional behaviour of robotic applications.Software & Systems Modeling18 (2019), 3097–3149

    2019

  52. [60]

    Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. 2022. Training language models to follow instructions with human feedback.Advances in neural information processing systems35 (...

    2022

  53. [61]

    Lukas Netz, Judith Michael, and Bernhard Rumpe. 2024. From Natural Language to Web Applications: Using Large Language Models for Model-Driven Software Engineering. InModellierung 2024. Gesellschaft für Informatik eV, 179–195

    2024

  54. [62]

    1998.Software engineering: theory and practice

    Shari Lawrence Pfleeger. 1998.Software engineering: theory and practice. Prentice Hall

    1998

  55. [63]

    Carlos Luis Parra-Calderón, Julián Garcia-Garcia, Juan Manuel Ramos-Cueli, Celia Alvarez-Romero, Esther Román-Villarán, Alicia Martínez-García, and Eva Maria Schön. 2024. IDE4ICDS: A Human-Centric and Model-Driven Proposal to Improve the Digitization of Clinical Practice Guide...

    2024 doi

  56. [64]

    Cosmina Cristina Raţiu, Wesley K. G. Assunção, Rainer Haas, and Alexander Egyed. 2022. Reactive links across multi-domain engineering models. InProceedings of the 25th International Conference on Model Driven Engineering Languages and Systems(Montreal, Quebec, Canada)(MODELS ’...

    2022

  57. [65]

    Pressman and Bruce R

    Roger S. Pressman and Bruce R. Maxim. 2014.Software Engineering: A Practitioner’s Approach(8th ed.). McGraw-Hill

    2014

  58. [66]

    Cosmina-Cristina Raţiu, Wesley KG Assunção, Edvin Herac, Rainer Haas, Christophe Lauwerys, and Alexander Egyed. 2025. Using reactive links to propagate changes across engineering models.Software and Systems Modeling24, 4 (2025), 1213–1239

    2025

  59. [67]

    Mona Rahimi, William Goss, and Jane Cleland-Huang. 2016. Evolving Requirements-to-Code Trace Links across Versions of a Software System. In 2016 IEEE International Conference on Software Maintenance and Evolution (ICSME). 99–109. doi:10.1109/ICSME.2016.57

    2016 doi

  60. [68]

    Krishna Ronanki, Beatriz Cabrero-Daniel, Jennifer Horkoff, and Christian Berger. 2024. Requirements engineering using generative ai: Prompts and prompting patterns. InGenerative AI for Effective Software Development. Springer, 109–127

    2024

  61. [69]

    Cosmina Cristina Raţiu, Christoph Mayr-Dorn, Wesley K. G. Assunção, and Alexander Egyed. 2023. Taming Cross-Tool Traceability in the Wild. In 2023 IEEE 31st International Requirements Engineering Conference (RE). 233–243. doi:10.1109/RE57278.2023.00031

    2023

  62. [70]

    Douglas C Schmidt. 2006. Model-driven engineering.Computer39, 2 (2006), 25–31. doi:10.1109/MC.2006.58

    2006 doi

  63. [71]

    Louis M Rose, Richard F Paige, Dimitrios S Kolovos, and Fiona AC Polack. 2008. The epsilon generation language. InEuropean Conference on Model Driven Architecture-Foundations and Applications. Springer, 1–16

    2008

  64. [72]

    2011.Software Engineering(9th ed.)

    Ian Sommerville. 2011.Software Engineering(9th ed.). Pearson, Boston

    2011

  65. [73]

    Jonathan Silva, Qin Ma, Jordi Cabot, Pierre Kelsen, and Henderik A. Proper. 2025. Application of the Tree-of-Thoughts Framework to LLM-Enabled Domain Modeling. InConceptual Modeling, Wolfgang Maass, Hyoil Han, Hasan Yasar, and Nick Multari (Eds.). Springer Nature Switzerland, ...

    2025

  66. [74]

    2008.EMF: eclipse modeling framework(2nd ed.)

    Dave Steinberg, Frank Budinsky, Ed Merks, and Marcelo Paternostro. 2008.EMF: eclipse modeling framework(2nd ed.). Addison-Wesley Professional

    2008

  67. [75]

    Ian Sommerville, Dave Cliff, Radu Calinescu, Justin Keen, Tim Kelly, Marta Kwiatkowska, John Mcdermid, and Richard Paige. 2012. Large-scale complex IT systems.Commun. ACM55, 7 (2012), 71–77

    2012

  68. [76]

    Valerio Terragni, Annie Vella, Partha Roop, and Kelly Blincoe. 2025. The Future of AI-Driven Software Engineering.ACM Transactions on Software Engineering and Methodology34, 5 (2025), 1–20

    2025

  69. [77]

    Nisan Stiennon, Long Ouyang, Jeffrey Wu, Daniel Ziegler, Ryan Lowe, Chelsea Voss, Alec Radford, Dario Amodei, and Paul F Christiano. 2020. Learning to summarize with human feedback.Advances in Neural Information Processing Systems33 (2020), 3008–3021

    2020

  70. [78]

    Vladimir Viyović, Mirjam Maksimović, and Branko Perisić. 2014. Sirius: A rapid development of DSM graphical editor. InIEEE 18th International Conference on Intelligent Engineering Systems INES 2014. IEEE, 233–238

    2014

  71. [79]

    Muhammad Aminu Umar and Kevin Lano. 2023. Automated Requirements Engineering in Agile Development: A Practitioners Survey. In2023 3rd International Conference on Electrical, Computer, Communications and Mechatronics Engineering (ICECCME). IEEE, 1–7

    2023

  72. [80]

    Junjie Wang, Yuchao Huang, Chunyang Chen, Zhe Liu, Song Wang, and Qing Wang. 2024. Software testing with large language models: Survey, landscape, and vision.IEEE Transactions on Software Engineering50, 4 (2024), 911–936

    2024

  73. [81]

    2013.Model-Driven Software Development: Technology, Engineering, Management

    Markus Völter, Thomas Stahl, Jorn Bettin, Arno Haase, and Simon Helsen. 2013.Model-Driven Software Development: Technology, Engineering, Management. John Wiley & Sons

    2013

  74. [82]

    2003.The object constraint language: getting your models ready for MDA

    Jos B Warmer and Anneke G Kleppe. 2003.The object constraint language: getting your models ready for MDA. Addison-Wesley Professional

    2003

  75. [83]

    Luqiao Wang, Yangtao Zhou, Huiying Zhuang, Qingshan Li, Di Cui, Yutong Zhao, and Lu Wang. 2024. Unity Is Strength: Collaborative LLM-Based Agents for Code Reviewer Recommendation. InProceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering (Sa...

    2024

  76. [84]

    Ran Wei, Simon Foster, Haitao Mei, Fang Yan, Ruizhe Yang, Ibrahim Habli, Colin O’Halloran, Nick Tudor, Tim Kelly, and Yakoub Nemouchi. 2024. ACCESS: Assurance Case Centric Engineering of Safety–critical Systems.Journal of Systems and Software213 (2024), 112034. Manuscript subm...

    2024

  77. [85]

    Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, et al. 2022. Chain-of-thought prompting elicits reasoning in large language models.Advances in neural information processing systems35 (2022), 24824–24837

    2022

  78. [86]

    Ran Wei, Tim P Kelly, Xiaotian Dai, Shuai Zhao, and Richard Hawkins. 2019. Model based system assurance using the structured assurance case metamodel.Journal of Systems and Software154 (2019), 211–233

    2019

  79. [87]

    Ran Wei, Zhe Jiang, Xiaoran Guo, Haitao Mei, Athanasios Zolotas, and Tim Kelly. 2022. Designing critical systems with iterative automated safety analysis. InProceedings of the 59th ACM/IEEE Design Automation Conference. 181–186

    2022

  80. [88]

    Ran Wei, Le Zhu, Haochi Wang, Jim Woodcock, Fang Yan, Simon Foster, and Xiangyang Ji. 2026. Formal-Method-Guided Vibe Coding: Closing the Verification Loop on AI-Generated Safety-Critical Software Through Model-Driven Engineering.arXiv preprint arXiv:2606.22413(2026)

    2026 arXiv

  81. [89]

    Ran Wei, Ruizhe Yang, Shijun Liu, Chongsheng Fan, Rong Zhou, Zekun Wu, Haochi Wang, Yifan Cai, and Zhe Jiang. 2024. Towards an extensible model-based digital twin framework for space launch vehicles.Journal of Industrial Information Integration41 (2024), 100641

    2024

  82. [90]

    Qingyun Wu, Gagan Bansal, Jieyu Zhang, Yiran Wu, Shaokun Zhang, Erkang Zhu, Beibin Li, Li Jiang, Xiaoyun Zhang, and Chi Wang. 2023. Autogen: Enabling next-gen llm applications via multi-agent conversation framework.arXiv preprint arXiv:2308.08155(2023)

    2023 arXiv

  83. [91]

    Jim Woodcock, Peter Gorm Larsen, Juan Bicarregui, and John Fitzgerald. 2009. Formal Methods: Practice and Experience.Comput. Surveys41, 4 (2009), 1–36

    2009

  84. [93]

    An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, Chujie Zheng, Dayiheng Liu, Fan Zhou, Fei Huang, Feng Hu, Hao Ge, Haoran Wei, Huan Lin, Jialong Tang, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Yang, Jia...

    2025 arXiv

  85. [2024]

    InEnterprise, Business-Process and Information Systems Modeling, Han van der Aa, Dominik Bork, Rainer Schmidt, and Arnon Sturm (Eds.)

    Building BESSER: An Open-Source Low-Code Platform. InEnterprise, Business-Process and Information Systems Modeling, Han van der Aa, Dominik Bork, Rainer Schmidt, and Arnon Sturm (Eds.). Springer Nature Switzerland, Cham, 203–212

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.