Open source analytics platform · self-hosted · air-gapped
The open source analytics platform for getting value from a SysML investment.
Your organisation has spent years building SysML models. Modelwrite is the open source analytics platform that shows what they are worth. It reads the models you already have, measures coverage, traceability and integration, tracks them baseline by baseline, and answers questions with the evidence attached. You keep your modelling tool.
Open the showcase Browse the examples Try your own model Install it
Proof is the differentiator, not the headline. Every number on this page names the command that produced it, and the limits sit at the same weight as the claims.
Try it
The showcase is open — no registration, six seeded models, and you can see what a model’s coverage, orphans and migration losses actually look like. The registered trial is your own isolated workspace for fourteen days: bring your model, get its loss report, its orphaned items and its coverage. You sign in with a code we email you.
trial.modelwrite.org
Come and see what we can do.
Open, no registration. Six seeded models: coffee-machine, sandwich-toaster, purchasing-terminal, floor-robot, microduck and cafe-stand. The cafe-stand project holds the two-robot trade study, one branch with the floor-robot on floor care and one with microduck. An hourly reset returns it to the seed, so nobody can break it.
Open the showcaseapp.modelwrite.org
Load and analyse your own model.
Your own private workspace, entered with an emailed code — no password. The trial runs in a rolling 14-day window: any authenticated activity, even a read, renews the full 14 days. After 14 days idle it turns read-only for 7 days — reads work, writes are refused with a note naming the trial's end and how to start again — and after 21 days idle it is archived to a copy while your account is kept so the same email can start fresh. The login code is transactional — no marketing consent required — and marketing updates only if you opt in.
Live and session-authenticated, with cross-trial isolation proven. The login code is emailed through Postmark: register with your address and the code lands in your inbox.
01 / See it
Modelwrite reads the SysML you already have. XMI and Cameo import carry a loss report that names what did not survive, so a loss is a decision you make rather than a surprise at acceptance. Three readers are registered today: SysML v1 XMI reads and writes, and SysML v2 textual notation and Capella/Arcadia read as viewers — they import, they do not write back. You keep your modelling tool.
The workbench front door is one target: Drop your SysML model here, or choose a file. The format is detected from the file itself and the project is named from it, so there is nothing to choose and no project to create first. On the drop it reports in plain language what it detected, what it carried, whether it round-trips and the five biggest classes of loss, then offers one button that names the counts it is accepting. The artifact is retained content-addressed before anything is read, so accepting re-reads the bytes already stored rather than asking for the file again; nothing is committed until that button is pressed. When the model lands, the page links straight to its health view.
On the CoffeeMachine MagicDraw container dropped against a local server, the summary reads
that it detected a Cameo/MagicDraw .mdzip, carried 41 blocks, 95 relationships and
25 requirements, round-trips exactly, and found 252 things outside what the reader carries
— 124 it cannot map at all and 128 it carries with a named drop — plus 22 further
declarations recognised as carrying no model content. The one button reads Import 41 blocks
and 95 relationships, accepting these 252 named losses.
The five biggest classes of loss, as that page lists them, each with one real example:
102 × uml:Property. 51 are attributes on a recognised XMI element that the OKF model has no place for; the other 51 are properties whose xmi:id is dropped because an OKF Attribute has no id slot.
33 × uml:Association. 28 drop the association's xmi:id (an OKF GraphEdge has no id slot) and 5 run between elements outside the carried subset.
28 × uml:Abstraction. Every one drops its xmi:id, for the same reason.
14 × uml:Port. 8 are unmapped attributes on a recognised element and 6 drop an xmi:id an OKF Attribute has no slot for.
13 × uml:Package. OKF has no package or namespace concept: members are promoted to the top-level structure and the package is dropped.
Those are the same numbers the XMI reader reports in the loss report below, because it is the same reader: the front door is a second entrance to one measurement, not a second measurement. Reproduce the drop against a server you are running:
curl -F "artifact=@sample/corpus/coffee-machine/legacy/CoffeeMachine-SysML-Model.mdzip" \
http://127.0.0.1:8080/onboardThree readers are registered in the workbench today. Two of them are viewers, and the workbench says so in the reader list, in the loss report and in the refusal when an export is attempted.
sysml-v1-xmi@2.4SysML v1 XMI: MagicDraw, Cameo, and any XMI 2.x writer. It imports and it writes back, so it is the one reader the gate can measure a round trip on.
Reads and writes
sysml-v2-textual@1.0SysML v2 textual notation. It reads a stated subset into OKF and cannot write it back, so a SysML v2 model is never exported from here.
Reads, does not write back
capella-arcadia@1.0Capella/Arcadia: components, functions, functional and component exchanges, allocations and constraints. It reads the semantic model and cannot write it back.
Reads, does not write back
A Capella model is a project folder, but only the .capella file holds the
semantic model, and only it is read: the .aird diagram layer and the
.afm viewpoint metadata are refused with a message naming them. Drop that one
file.
The reason the reader is here is STPA. A team that does STPA in Capella — which is where MIT's STAMP Tools plugin lives — can keep doing it there, bring the Capella model in as a viewer, and have the platform hold the analysis as a versioned model and check its completeness. Nothing has to be converted to get there.
On the real In-Flight Entertainment System model
(dbinfrago/Capella-IFE-sample, EPL-2.0, fetched outside this repository) the reader
carries 335 elements, 29 requirements, 364 graph nodes and 787 graph edges, and names 3,451
content losses and 1,090 lossy id/name drops rather than dropping them in silence. The corpus is
not committed because EPL-2.0 is not AGPL-compatible, so the test skips loudly when it has not
been fetched. Reproduce it:
cargo test -p mw-binding-capella --test real_capella -- --nocapturePut a MagicDraw SysML export through the XMI reader and it reports what it carried and what it did not. On the coffee-machine MagicDraw model the reader carries 41 structure elements (the blocks), 25 requirements, and 66 graph nodes with 95 graph edges. It reports 252 blocking losses in total: 124 unmappable content losses and 128 lossy drops, every one named.
Reproduce it:
cargo test -p mw-binding-xmi --test real_magicdraw -- --nocaptureThe engine reads a stated subset of SysML v2 textual notation. It imports and does not export, so a SysML v2 model cannot be written back. Reproduce it:
cargo test -p mw-binding-sysmlv2 --test real_examples -- --nocapture02 / Measure it
Coverage names which requirements are satisfied, refined, verified or allocated. Traceability names the edges between them. Integration asks whether the model is one connected whole. The graph gaps expose the model nobody can see at a glance.
Orphaned items. A node with no edge. It is present, but nothing connects to it.
Isolated groups. More than one connected component. The model is split.
Dangling links. An edge whose endpoint is missing. The link points at nothing.
Each gap is named, not summarised into a score, and trended baseline by baseline so drift is visible when a baseline changes. These are the metrics in the analytics schema, listed in the analytics section.
Running an analysis stores a record: a named definition, run over one commit, stamped with the definition version and the engine version it was computed at, with the findings it measured and an evidence hash over their canonical bytes. The same definition over the same commit at the same engine version produces the same record, so re-running an unchanged analysis over an unchanged model stores the same record rather than a second one. Records accumulate in a library you can read back and compare, months later, without the engine that produced them.
Two built-in analyses ship today, both at definition version 1, on engine 0.2.0. A definition the bounded run vocabulary cannot express is refused with a reason, never silently approximated.
Requirement coverage. Every requirement the model declares, named, with whether a Satisfy, Refine, Verify or Allocate link covers it. Computed by graph.requirement_coverage in mw-graph — the same coverage report the gate and the requirements page use.
Model health (graph gaps). Orphaned nodes, isolated groups and dangling links. Computed by graph.graph_stats, graph.components and the workbench's own dangling-link detector — the same detector the health view renders, reused rather than reimplemented, so an analysis can never disagree with the page it is an analysis of.
The ruling the frame exists to keep: the engine measures, and an analysis never writes to the model it measures. Running one resolves a commit, reads the document and stores the record; no write path to a model is reachable from it. Where the engine cannot measure at all — a document that carries no graph — the run says so with the reason on each finding and records itself as not measured, rather than publishing a zero that would read as “no gaps”.
The platform holds an authored STPA analysis — losses, hazards, system constraints, controllers, control actions, feedback, unsafe control actions and loss scenarios — as a versioned model, and checks its completeness and internal consistency. Five relational checks, each a relation between STPA elements rather than a judgement about the design:
Unanalysed control actions. Every ControlAction must carry an UnsafeControlAction for each of the four types: not-provided, provided, wrong-timing-or-order, stopped-too-soon-or-applied-too-long. The finding names the types the model did not carry and the ones it did.
Control loops with no feedback. A Controller that issues a ControlAction and receives no Feedback path. Read off the same graph adjacency the orphan and isolation detectors use, so it is a degree check and not a second implementation.
Hazards with no constraint. Every Hazard the analysis names must be mitigated by a SystemConstraint.
Constraints reaching no element. A SystemConstraint no design element satisfies is an aspiration, not a constraint. Read from the platform's own requirement coverage, filtered to SystemConstraints.
UCAs with no loss scenario. A claim that a control action could be unsafe, without a causal scenario, is an assertion.
Above those five sits a method-coverage layer that asks whether each STPA stage was performed at all before judging how consistently it was performed — because a relational check over a stage that was never done returns no findings, and no findings over nothing is not a clean result. That layer, its three states, and the ruling that keeps them honest are set out in the safety argument, where the distinction is the point.
Screenshots
Two more captures from the live showcase (trial.modelwrite.org), each chosen for the claim it proves. They are screen captures of the running workbench, not mock-ups. The model-health capture is in the measure section, where it does the arguing.
03 / Ask it
Agents and the MCP surface ask questions of the model, and every answer carries its basis: the element, the edge and the run that produced it. An agent reads and proposes. It cannot write. Only a human with the write role accepts a proposal into a commit, and the commit records both parties.
A finding's id is a function of the definition, the check and the measured subject, never of the run. The same uncovered requirement therefore has the same address in two runs a month apart, which is what lets two stored runs be compared by finding identity — so what appeared, what was resolved and what was measured differently is read rather than inferred. The three lists are disjoint by construction, and the diff has its own address.
Measured, not asserted. On the coffee-analyses project, requirement coverage v1
run over commit f9591a6b and again over commit a79b8c81, where a
requirement and its links were dropped, reads: 1 appeared, 1 resolved, 1 measured differently,
23 unchanged. The requirement the change adds appears as a gap. The requirement that lost its
covering link is reported as measured differently rather than as newly broken, because its
address did not move — it is the same subject, read with a different severity, and the
evidence of both readings rides the change.
One thing the diff refuses to do is turn “could not be measured” into “clean”: the measured flag is part of the comparison, so a run that had no graph to measure and a run that measured nothing wrong are not reported as the same thing.
A question is answered from the model, not from prose about the model, and the answer carries its basis: the element, the edge and the run it came from. Open a stored run and each finding shows its one-line measurement and, under it, the engine's own values — the measurement itself, not a restatement of it. Where the engine could not measure, the finding says so and carries the reason, instead of a zero.
04 / Trust it
The round-trip gate compares two models and names every element and edge that did not survive. It writes a deterministic evidence record with no timestamp, and CI reproduces both committed records byte for byte on every push. The limits section is the reason the rest is believable.
Proves the reference OKF is a fixed point of the gate: a model compared with itself passes, hashes and all. Reproduce it:
cargo run -p mw-gate -- \
--reference sample/corpus/coffee-machine/okf/expected/coffee_machine_model.json \
--candidate sample/corpus/coffee-machine/okf/expected/coffee_machine_model.json \
--evidence /tmp/self-pass.jsonProves the gate detects loss and fragmentation, and names what it found rather than reporting a score. Reproduce it:
cargo run -p mw-gate -- \
--reference sample/corpus/coffee-machine/okf/expected/coffee_machine_model.json \
--candidate sample/corpus/coffee-machine/okf/corrupted/coffee_machine_model.json \
--evidence /tmp/corrupted-fail.jsonBoth runs use the coffee-machine corpus in
sample/corpus/coffee-machine. Neither record contains a timestamp: dates appear in
filenames only, so a re-run is either byte-identical or it is a bug. That is what makes the result
citable.
The analysis is AUTHORED; the check is COMPUTED. Modelwrite does not perform STPA, does not infer hazards from a design, and will never claim to. It holds your control structure and analysis as a versioned model, checks completeness and internal consistency, names everything missing, and reports each finding's basis.
A completeness check has three states, not two. Reading them as two is the failure the third one exists to prevent: a relational check over a stage that was never performed returns no findings, and an empty list is exactly what a safety engineer would otherwise take as “no problems found”.
Not started
The model lacks the elements the method needs, so nothing was measured over. It names which STPA stage is missing and never shows a clean result. A model with no hazards lands here: the checks reported no findings because they had nothing to measure, which is not the same as finding nothing wrong.
Gaps found
The stages were performed and at least one relational check found a gap. Every finding is named, not counted into a score, and each one carries what it was computed over and what the model did not carry.
Performed
The only state in which a clean result is shown — and it names what it was measured over: the losses, hazards, SystemConstraints, controllers, control actions, UCAs and loss scenarios the clean result was actually computed over.
A defence programme that must produce MIL-STD-882E artefacts asks a fair question: does using
this vocabulary mean abandoning the standard it is accountable to. The project's published
mapping answers with a verdict on every row and nothing mapped silently. exact
where the target says the same thing; lossy where it says something close and the
difference is named in the row; unmappable where there is no counterpart, so the
concept stays in its own vocabulary.
Across the two tables, deduplicating the three mirrored pairs, that is 14 concepts mapped: 1
exact, 5 lossy and 8 unmappable. The spread is the
finding rather than a shortcoming of the mapping. STPA and MIL-STD-882 share their ends —
hazards, and the requirements or constraints that prevent them — and share almost nothing
in the middle. 882 carries risk language STPA does not have; STPA carries control language 882
does not.
The sharpest disagreement is probability, and the document does not try to bridge it: 882 requires a probability for every hazard, because risk is severity and probability together, and STAMP's position is that the probability of a rare high-severity accident is not estimable. A programme that must report a risk assessment code reports one; the table says the platform does not supply it, rather than inventing a number. Nothing is converted in either direction, and the platform takes no side between the two methods. The mapping, and the claims that must be re-checked against a purchased copy of the standard, are in docs/stpa/mil-std-882-mapping.md.
05 / Analytics
This list is generated from spec/analytics/metric_definitions.json, the
authoritative schema produced by the engine. It is not maintained by hand. The schema is
Apache-2.0, so anyone can build a connector.
graph.node_count
active
Number of nodes in the graph section (every element as a node).
depends on graph.nodes
graph.edge_count
active
Number of edges in the graph section (every relationship as an edge).
depends on graph.edges
graph.isolated_count
active
Number of graph nodes with no incident edge. The graph-gaps headline: every orphan is named in graph_stats.isolated.
depends on graph.nodes, graph.edges
graph.component_count
active
Number of connected components in the graph. More than one means the model is split into isolated groups.
depends on graph.nodes, graph.edges
coverage.total
active
Number of requirements in the model.
depends on requirements
coverage.satisfied
active
Number of dependency edges labelled Satisfy that target a requirement.
depends on graph.edges
coverage.refined
active
Number of dependency edges labelled Refine that target a requirement.
depends on graph.edges
coverage.verified
active
Number of dependency edges labelled Verify that target a requirement.
depends on graph.edges
coverage.allocated
active
Number of dependency edges labelled Allocate with a requirement endpoint.
depends on graph.edges
coverage.covered
active
Number of requirements covered by at least one Satisfy/Refine/Verify/Allocate edge.
depends on requirements, graph.edges
coverage.uncovered
active
Number of requirements with no covering edge. Each is named in the coverage report's uncovered list.
depends on requirements, graph.edges
compliance.specification_size
active
Number of requirements in the caller's specification (the portfolio question).
depends on requirements
compliance.covered_count
active
Requirements of the specification present and covered by the model.
depends on requirements, graph.edges
compliance.uncovered_count
active
Requirements of the specification present in the model but uncovered.
depends on requirements, graph.edges
compliance.unknown_count
active
Requirements of the specification absent from the model entirely. Never rendered as a blank.
depends on requirements
cost.costed_count
active
Number of requirements with at least one cost record across the supplied datasets.
depends on requirements, dataset
cost.uncosted_count
active
Number of requirements with no cost record. Never rendered as zero.
depends on requirements, dataset
gate.passed
active
Whether the gate run passed (1) or failed (0) against its reference.
depends on gate
gate.validation_errors
active
Number of validation errors the gate recorded for the candidate.
depends on gate, validate
gate.validation_warnings
active
Number of validation warnings the gate recorded, including dangling edge endpoints.
depends on gate, validate
gate.roundtrip.missing_elements
active
Elements present in the reference but missing from the candidate after a round trip.
depends on gate, diff
gate.roundtrip.extra_elements
active
Elements present in the candidate but not the reference after a round trip.
depends on gate, diff
gate.roundtrip.missing_edges
active
Edges present in the reference but missing from the candidate after a round trip.
depends on gate, diff
gate.roundtrip.extra_edges
active
Edges present in the candidate but not the reference after a round trip.
depends on gate, diff
gate.roundtrip.changed_attributes
active
Attributes whose value differs between reference and candidate after a round trip.
depends on gate, diff
06 / Limits
Each of these is a limit of the current release, and each one is checkable from the repository. This section is the reason the rest of the page is believable.
It proposes. Only a human with the write role accepts a proposal into a commit, and the resulting commit records both parties. An agent token cannot hold a write or admin role.
Model-level analysis is supported: coverage, traceability, composition and process, and the analyses library over both. Model-level simulation — executing a model's own activity or process behaviour, reachability, dead ends, cycles and timing arithmetic — is designed but not built, and is not claimed here. FEA, thermal and fluid solvers are not part of this platform and are not planned. Modelwrite reasons about the model, not about the physics.
On the MagicDraw coffee-machine corpus the reader reports 252 blocking losses. A 36 MB Cameo export, the Thirty Meter Telescope model, carries 362 blocks and 633 edges, round-trips exactly, and reports 48,553 blocking losses (45,725 unmappable + 2,828 lossy) for the constructs it does not carry. Named rather than dropped in silence. SysML v2 textual notation is carried as a viewer: it reads, it does not write back.
Reproduce the two measurements:
cargo test -p mw-binding-xmi --test real_magicdraw -- --nocapture
cargo test -p mw-binding-xmi --test real_tmt -- --nocaptureBoth read into OKF and neither can write back, so an export attempt is refused with a message naming the direction rather than producing an approximate file. The consequence: this is a way to read and measure a SysML v2 or a Capella/Arcadia model, never a way to round-trip one, and the SysML v1 XMI reader is the only reader carrying a measured round trip.
It checks the completeness and internal consistency of an analysis you authored, and every finding names what it was computed over. The consequence is the one that matters in a safety case: a model with no hazards is reported as not started rather than clean, and a check whose subject is absent says it cannot be evaluated yet rather than reporting a zero.
A run reads one commit and stores a record. It cannot change the model it measures, and no write path to a model is reachable from the analyses pages. The consequence: an analysis can tell you what the model says at that commit, and it can never be the thing that changed it.
The gate measures the binding's own OKF-to-XMI-to-OKF round trip. The read rests on the binding's self-reported loss report, not on an independent golden corpus.
Email delivery is configured from the service environment: MW_MAILER=smtp
with MW_MAIL_SMTP_HOST, MW_MAIL_SMTP_USERNAME and
MW_MAIL_SMTP_PASSWORD. A deployment that selects SMTP without those settings
fails the send, naming the missing variable, rather than writing the login code to
the operator log. The consequence: a broken mail configuration shows up as a failed
registration, never as an email everyone believes was delivered except the person waiting
for it.
Modelwrite integrates with CAD rather than replacing it. The 3D side of the CATIA portfolio is out of scope by design, and so is becoming a general-purpose drawing tool.
07 / FAQ
No. Modelwrite reads the model you have and reports what it could not carry; it does not author your model for you, and the two viewer readers cannot write back at all. The SysML v1 XMI reader is the one that also writes, so the gate can measure a round trip on it — that is a measurement of the binding, not a way to edit your project. You keep your modelling tool.
It proposes. A human accepts. An agent cannot write: only a human with the write role accepts a proposal into a commit, and the commit records both parties.
The code is free and open source. The engine, the server, the CLI and today's binding
crates (the importers and exporters) are AGPL-3.0-or-later. The analytics schema
(spec/analytics/) is Apache-2.0. Project policy designates importers and
exporters as Apache-2.0, but that licence is not yet applied to the crates. See the
licence section.
08 / Install
The engine crates, the server and the CLI are published on crates.io at 0.2.0
(cargo install mw-cli installs the CLI). To build from the repository you need
Rust stable via rustup.
cargo build --workspace
cargo test --workspaceExpected output: GATE PASS.
cargo run -p mw-gate -- --reference sample/corpus/coffee-machine/okf/expected/coffee_machine_model.json --candidate sample/corpus/coffee-machine/okf/expected/coffee_machine_model.jsonAs a container, a Compose trial on one machine, or a Helm release.
docker build -f deploy/Dockerfile -t modelwrite/modelwrite:0.1.0 .
docker compose -f deploy/docker-compose.yml up --build
helm install modelwrite deploy/helm/modelwriteOpen mode means an anonymous admin. The image refuses to start
that way unless MW_ALLOW_OPEN=yes is set, so for anything shared, set
MW_AUTH_TOKEN or MW_AUTH_JWKS instead. The Helm chart does not do TLS,
backups or high availability; see deploy/README.md for what it leaves to you.
09 / Architecture
The engine crates are the contract. The server, the CLI and every connector build on them, and nothing bypasses the OKF crate and the gate. Three readers are registered against the binding contract: one reads and writes, two are viewers.
Clients
mw command line and the CI runnermw-serverAGPL-3.0-or-later
Engine cratesAGPL-3.0-or-later
okf · graph (including the STPA completeness checks) · gate · binding · binding-xmi (the SysML v1 XMI reader and writer) · binding-sysmlv2 (the SysML v2 textual viewer) · binding-capella (the Capella/Arcadia viewer)agent (Reasoner and proposals) · capi (C ABI) · mcp (MCP server) · analyticsInterchange
Deployment
10 / Licence
The implementation — the engine crates, the server, the CLI and the binding crates (the
importers and exporters) — is AGPL-3.0-or-later today. The analytics schema
(spec/analytics/) is Apache-2.0. Project policy, stated in
CONTRIBUTING.md, designates importers and exporters as Apache-2.0; that permissive
interchange licence is not yet applied to the crates, which still carry the workspace AGPL
licence. What you install is the thing you can read.