Skip to main content
Model-Driven Software Development

The model is the source of truth.

A formal model describes the structure, behaviour and logic of the system. From it, production-ready code is generated reproducibly, deterministically and platform-independently. Domain knowledge is preserved in the model, regardless of whether the target language, platform or toolchain changes over the product lifecycle. Especially for embedded, safety-critical and long-lived systems, this is a strategic advantage.

Fundamentals

What is Model-Driven Software Development?

MDSD describes a development approach in which formal models form the central starting point: an executable, generatable specification, not merely documentation. The model defines the core abstractions of a system: its structure, behaviour, domain logic. Source code, configurations, interfaces and documentation are generated automatically from a model. The model is the single source of truth for all modelled domain aspects. Generated artefacts are derived quantities, not an independently maintained state.

Two variants complement each other in practice:

  • Architecture-centric MDSD: structure, components, interfaces and data models take centre stage. A system is described by its architectural framework; the behavioural logic of individual components can be specified separately.
  • Behaviour-centric MDSD: the dynamic behaviour of a system is modelled, typically via state machines, sequences or rules. The model describes how the system reacts to events, independent of the later implementation language.

Formal models enable validation and simulation before the first line of code. Additionally, traceability between model elements and generated artefacts is created automatically: a key advantage wherever traceability is required, such as in safety-critical development processes under ASPICE or ISO 26262.

Models

What is meant by a model?

In MDSD, a model is a formal, precise description of a system or domain: formal enough to automatically generate code, tests or documentation from it. Unambiguity is ensured by metamodels: they define which concepts exist, which relationships between them are permitted and which rules apply, comparable to a grammar for natural languages.

The notation is independently selectable: graphical, textual or tabular, depending on what suits the domain and team best. Two language families dominate:

  • General modelling languages such as UML or SysML are standardised across industries and cover a broad spectrum. For a specific use case, their generic framework is tailored to the respective domain through profiling.
  • Domain-specific languages (DSLs) are designed specifically for a concrete domain. They represent exactly its terms and rules. Nothing more and nothing less. A well-scoped DSL rules out entire error classes from the outset.

Whether UML/SysML or DSL is a decision based on domain, team and goal. Both approaches can be combined in the same toolchain.

Two examples make the spectrum tangible:

Textual DSL (Insurance): A domain language in which tariff and premium rules are formulated directly in insurance terms. Domain experts read and review the rules in plain text; the calculation logic is reproducibly generated from them: versionable, diff-able and close to domain reality.

Graphical model (Control system): The behaviour of a traffic light control system as a state machine, with states, time-controlled transitions and safety conditions. The behaviour is understandable at a glance, simulatable and directly transferable into code.

The design of custom textual and graphical languages is the central topic of the Custom Tools area.

Code Generation

Reproducible code generation: the core of MDSD

The decisive difference from handwritten or AI-generated code is reproducibility: the same model always produces the same code with the same generator. The result is deterministic, traceable and versionable, and that is precisely what makes the difference in projects where quality must not merely be claimed but demonstrated.

Code generators ensure not only correctness but also compliance with industry and company standards: coding guidelines such as MISRA C/C++ or project-specific architectural requirements are automatically adhered to. Whoever configures and qualifies the generator once gets this conformity automatically with every generation run.

For regulated and safety-critical domains this is a prerequisite. Development under ISO 26262 and IEC 61508 or DO-178C requires traceable, repeatable development steps. Deterministic generation makes it possible to qualify the generator itself or to assign the generated code to defined, verified patterns: both central building blocks for the evidence chain in functional safety.

The difference from generative AI is more fundamental: AI-generated code is statistical: the same prompt delivers different results, without a guarantee of conformity or traceability. MDSD and AI are complementary tools. More on this in the AI & MDSD section.

Quality assurance

Finding errors early: four methods

Models are executable and testable long before integration. Errors become visible in the model, not only in the target system. Classic shift-left. What formal methods actually deliver in practice — and where they hit walls — is covered in this post from our research.

Validation

Structural and semantic consistency is ensured through static checking of consistency rules. A large part of these checks run live during input: errors are displayed immediately, not only on the next build run.

Simulation

Behaviour can be played through directly on the model; states and transitions become interactively traceable, without target hardware. Domain reviews take place on the executable model, comprehensible even for stakeholders who cannot read code.

Tests

Models can be tested automatically, for example as unit tests that execute the model via simulation. Tests are formulated at the same level of abstraction as the model: closer to the domain specification than classical code tests.

Formal Verification

Models can be exhaustively checked against properties using formal methods: mathematical proof that undesired states are unreachable. Central for evidence under ISO 26262 and IEC 61508.
Common language

A common domain language and independence from the target platform

Formal models (and DSLs in particular) create more than a precise specification: they become the shared working basis for heterogeneous teams. Domain experts, architects and developers work on the same artefact instead of separate, inconsistent interpretations. At exactly these interfaces, the most expensive errors in complex projects typically arise. A formally defined domain language makes them visible before they become entrenched in code.

At the same time, MDSD decouples the model from the target platform. One and the same model can be transferred into different target languages and platforms via exchangeable generators: a change of target language requires no new domain implementation. This protects the domain investment across technology cycles: platforms, compilers and languages change; the domain model persists.

For products with long lifecycles (typical in automotive, MedTech or industrial automation), this is a strategic advantage that extends far beyond initial development efficiency.

This aspect closely links MDSD with the Systems Engineering area, where models act as a common language across disciplines and development phases.

State machines

Modelling behaviour with state machines

The state machine (or statechart) is the most widespread model for behaviour-centric MDSD and the natural model for reactive systems: software that reacts to external events, manages states and triggers actions under defined conditions.

Interactive demo: bicycle light as a statechart

Fahrradlicht aus

The bicycle light is a classic introductory statechart: a real device that reacts to a single input (a button press) and cycles through several operating modes (off, steady light, flashing). Simple enough to be immediately understandable; complex enough to make the essence of reactive systems tangible. States, transitions, events and guards, all directly explorable, without installation, without a single line of code:

Zum Interagieren hier klicken

That is precisely what itemis CREATE delivers: model statecharts, simulate interactively and generate code in C, C++, C#, Java, Python and further target languages: deterministic, auditable, platform-independent. In series use at BSH Hausgeräte, MAN and Dräger, from household appliance controls to safety-relevant functionality under ISO 26262.

Embedded Systems

MDSD for Embedded Systems

Embedded software is developed under a combination of requirements that few other fields know in this density: resource-constrained hardware, real-time requirements, increasing complexity, variant diversity and evidence obligations. MDSD is the natural tool for this.

Platform independence

Embedded projects change target hardware, compilers and runtime environments, often multiple times. A model describing domain logic in a platform-independent way protects domain knowledge. When a new target architecture arrives, the generator is adapted, not the specification.

Deterministic quality

Safety standards require repeatable development steps. Deterministically generated code automatically adheres to MISRA C; the generator itself can be qualified: the basis for evidence under ISO 26262, IEC 61508 and DO-178C.

Early validation

Hardware is often only available late. Simulation on the model enables early behavioural testing and domain reviews without hardware access. Traceability between model elements and generated code is automatically present.

Variant management

Automotive and industrial projects often manage dozens of ECU variants. A shared model with variant-specific generation configurations keeps the domain logic consistent, instead of duplicating it in parallel code states.

Reactive behaviour

Embedded systems react to sensors, switches, timers and communication messages. State machines are the most precise description means for exactly this behaviour: more precise than prose, more comprehensible than code, directly executable.

Common domain language

Domain experts, architects and developers work on the same artefact. The most expensive errors arise at the interfaces between disciplines. A formally defined language makes them visible before they become entrenched in code.
AI & MDSD

Is MDSD still relevant in the age of AI?

Briefly: yes, and the combination is stronger than either approach alone.

Generative AI is powerful but statistical. The same prompt generates different outputs, without a guarantee of conformity, traceability or correctness. Precisely the properties that AI structurally lacks (determinism, auditability, reproducible generation) are non-negotiable in embedded and regulated development. Here MDSD delivers what AI cannot.

At the same time, AI is an effective accelerator for MDSD. Concretely in the workflow: requirements texts are transferred by AI into initial model drafts, existing models are explained or checked for consistency, refactorings are suggested. The model space, with its defined semantics, rules and constraints, provides AI with a precise context that free text generation cannot offer. AI suggestions remain limited to valid model constructs; entire error classes are structurally excluded in the model space before a human reviews them.

The decisive step remains with the human: no AI suggestion becomes the basis for generation without domain approval. AI accelerates model building; the model remains the deterministic source of truth; code generation remains reproducible. The three levels complement each other; none replaces the other.

Demarcation

MDSD vs. low-code platforms

At first glance, MDSD and low-code share one thing: both reduce handwritten code. The difference lies in how and for whom, and is fundamental for embedded, safety-critical systems.

Real source code, no platform dependency

MDSD generates source code that belongs to the company: readable, verifiable, versionable. No proprietary runtime format, no dependency on a single vendor over the product lifecycle.

No runtime platform required

The generated code runs independently, even on resource-constrained embedded target hardware without an operating system or cloud connection. Low-code platforms structurally presuppose a managed runtime environment.

Transparent generation

The generator is inspectable, adaptable and, where necessary, qualifiable. This is the basis for evidence in regulated development processes. A black-box platform cannot deliver this.

Integration rather than replacement

MDSD fits into existing build, test and safety processes. The generated code is first class in the existing tool and process environment: no special path, no break with established engineering standards.
Introduction

Introducing MDSD: how itemis proceeds

1. MDSD Readiness Assessment & Target Definition

We review development processes, domain structure, target hardware and toolchain landscape and define a shared target picture with measurable KPIs. We clarify which system areas offer the greatest benefit from modelling and generation, and which quality and evidence requirements determine the generation strategy.

2. Methodological Tailoring & Language Design

Selection or design of the appropriate modelling language (UML profile or DSL), definition of core abstractions and generator strategy for the relevant target platforms. This includes the simulation environment for early behavioural validation and the integration of model-based tests into existing build and CI processes.

3. Support in the Pilot Project

We accompany you through a suitable pilot project directly in day-to-day work: technically in modelling, in calibrating code generators and in building a consistent evidence chain: from simulation through automated tests to formal verification. The goal is a productively deployed generator stack that your team can operate independently.

4. Scaling & Roll-out

Extension to further projects, product lines, target platforms and departments. Generator configurations, simulation environments and test frameworks are systematically transferred and adapted.

5. Long-term Support & Maintenance

Further development of generators and modelling languages, adaptation to new target platforms, compilers or standard requirements, and maintenance of simulation and test infrastructure across version cycles. On request, we also take over the modernisation of existing generator stacks and legacy DSLs.

Frequently asked questions

FAQ on Model-Driven Software Development

What is the difference between MDSD and low-code platforms?
Low-code platforms do not generate an independently executable artefact and bind the result to a proprietary runtime environment. MDSD generates real source code that belongs to the company: readable, verifiable, versionable, without platform dependency over the product lifecycle. For embedded, safety-critical and long-lived systems, MDSD is therefore the only viable approach.
Which target languages does itemis CREATE support?
itemis CREATE generates code in C, C++, C#, Java and Python. Further target languages are realisable via customisable generators. The target language is decoupled from the model: a model can be ported to a different platform by exchanging the generator, without rewriting the specification.
Is MDSD suitable for embedded systems?
Yes. MDSD is particularly valuable for embedded systems. Deterministically generated code automatically complies with coding guidelines such as MISRA C, the generator can be qualified (ISO 26262, IEC 61508), and the model remains platform-independent even when target hardware or compilers change over the product lifecycle.
What is the difference between a DSL and UML?
UML is a cross-industry standard notation that can be tailored to a domain through profiles. A domain-specific language (DSL) is designed from the ground up for a concrete domain: it makes only the possible expressible and structurally rules out entire error classes. DSLs are more precise and more directly generatable; UML offers broader tool support and standardisation.
How does MDSD relate to AI-assisted code generation?
AI-generated code is statistical and non-reproducible: the same prompt delivers different results, without a guarantee of conformity or traceability. Model-based generation delivers a deterministic, auditable result. AI is valuable as an accelerator for model building (requirements → model draft, review, refactoring) but does not replace the deterministic source of truth. Both approaches complement each other.
Our Experts
Axel Terfloth

Principal Engineer · itemis AG

Axel Terfloth is Principal Engineer at itemis AG with a focus on model-based and model-driven development of technical and embedded systems, and Product Owner of itemis CREATE (formerly YAKINDU Statechart Tools). Since 2001 he has been working on model-driven software development — since 2006 at itemis, where he supports customers in introducing and extending model-based development methods and builds the necessary tools and tool integrations. He has spoken at numerous professional conferences and published academic articles on these topics.
Andreas Mülder

Principal Software Engineer · itemis AG

Andreas Mülder is Principal Software Engineer at itemis, responsible as technical project lead for itemis CREATE. Since 2007 he has been developing tools for platforms such as Eclipse, Visual Studio Code, Cloud and Web — with a focus on language engineering, domain-specific languages, simulators and code generators, as well as the integration of generative AI into production-ready tools. He shares his knowledge in blog posts on language engineering and AI-assisted tool development.
Get started

Request an MDSD workshop

Schedule a call with Axel Terfloth and Andreas Mülder.

Expertise

Insights on Model-Driven Software Development

Formal Error Detection on State Machines: What Works and What Doesn't
Blog Model driven software development

Formal Error Detection on State Machines: What Works and What Doesn't

An unreachable transition, an unsatisfiable guard, a numeric overflow: these bugs hide in the model long before any test reveals them. A results report from two master's theses on formal error detection for state machines using symbolic execution and SMT solvers.

Read Article
Andreas Mülder Andreas Mülder 9 min read
Taking SCXML to the next level
Blog Model driven software development

Taking SCXML to the next level

How itemis CREATE adds higher-level modeling, simulation and unit testing on top of the SCXML standard.

Read Article
Andreas Mülder Andreas Mülder 5 min read
References

From practice