  In model-driven engineering, models abstract the relevant features of
software artefacts and model transformations act on them automating complex
tasks of the development process. It is, thus, crucially important to provide
pragmatic, reliable methods to verify that model transformations guarantee the
correctness of generated models in order to ensure the quality of the final end
product. In this paper, we build on an object-oriented algebraic encoding of
metamodels and models as defined in the standard Meta-Object Facility and in
tools, such as the Eclipse Modeling Framework, to specify a domain-specific
language for representing the action part of model transformations. We
introduce the big-step operational structural semantics of this language and
its type system, which includes a notion of polymorphic model subtyping,
showing that well-typed model transformations are well behaved. That is, that
metamodel-conformant model transformations never go wrong.
