Architecture Analysis And Design Language Research Articles

ADEPT 2022 workshop: a summary of strengths and weaknesses of the AADL ecosystem

The Architecture Analysis and Design Language (AADL) is a SAE Standard for the modeling of both the hardware and the software of embedded systems. The AADL standard is now mature and is today employed by numerous stakeholders in the domain of critical embedded real-time systems to address a large set of concerns: performances (latency, schedulability), safety, or security, ... The ADEPT workshop aims to present and report on current projects in the field of design, implementation, and verification of critical systems where AADL is a first-citizen technology. This article is a summary of the ADEPT 2022 workshop.

C2AADL_Reverse: A Model-Driven Reverse Engineering Approach for Development and Verification of Safety-Critical Software

The safety-critical system communities have been struggling to manage and maintain their legacy software systems because upgrading such systems has been a complex challenge. To overcome or reduce this problem, reverse engineering has been increasingly used in safety-critical systems. This paper proposes C2AADL_Reverse, a model-driven reverse engineering approach for safety-critical software development and verification. C2AADL_Reverse takes multi-task C source code as input, and generates AADL (Architecture Analysis and Design Language) model of the legacy software systems. Compared with the existing works, this paper considers more reversed construction including AADL component structure, behavior, and multi-threaded run-time information. Moreover, two types of activities are proposed to ensure the correctness of C2AADL_Reverse. First, it is necessary to validate the reverse engineering process. Second, the generated AADL models should conform to desired critical properties. We propose the verification of the reverse-engineered AADL model by using UPPAAL to establish component-level properties and the Assume Guarantee REasoning Environment (AGREE) to perform compositional verification of the architecture. This combination of verification tools allows us to iteratively explore design and verification of detailed behavioral models, and to scale formal analysis to large models. In addition, the prototype tool and the evaluation of C2AADL_Reverse using a real-world aerospace case study are presented.

Modelling Robot Architectures with AADL

Robots are complex systems composed of many interacting subsystems, each coordinating a multitude of hardware and software components. In the last twenty years, robotic frameworks helped accelerate the development process by providing a reference structure and publicly available software components. However, current practices are not sustainable for modern robotic systems. In this work, we present a modelling approach based on the Architecture Analysis and Design Language (AADL) to define robotic systems and enhance software development practices for robotics. Additionally, we exploit the model to perform automatic code generation, which reduces development time and guarantees a more reliable and robust implementation.

Reliability Evaluation Based on the Colored Petri Net Converted from AADL Models for the Wheel Brake System of Aircraft

Traditional reliability analysis methods such as Reliability Block Diagram, Fault Tree Analysis, and Markov Analysis are all subjective methods whose results significantly depend on the analysts’ skills and experiences. A model-based reliability method is proposed for the wheel brake system by using the architectural analysis and design language (AADL). The wheel brake system is modeled based on the AADL, and the AADL Error Model Annex is applied to describe the fault propagation of the system. An information extraction approach is proposed for the AADL-based model, and rules for transforming AADL-based models to colored Petri nets are given according to the information extracted. The reliability analysis of the wheel brake system is conducted in terms of the Colored Petri Nets. Through Monte Carlo simulation and linear regression, it is inferred that the lifetime of the wheel brake system follows a Weibull distribution with shape parameter 1.303 and scale parameter 9.992 × 103, and the accuracy of the method has been verified. In this study, the reliability analysis results are generated via the system model automatically; they do not depend on the analysts’ experiences and skills, and ambiguity among different analysts can be avoided.

An AADL Contract Language Supporting Integrated Model- and Code-Level Verification

Model-based systems engineering approaches support the early adoption of a model - a collection of abstractions - of the system under development. The system model can be augmented with key properties of the system including formal specifications of system behavior that codify portions of system and unit-level requirements. There are obvious gaps between the model with formally specified behavior and the deployed system. Previous work on component contract languages has shown how behavior can be specified in models defined using the Architecture Analysis and Design Language (AADL) - a SAE International standard (AS5506C). That work demonstrated the effectiveness of model-level formal methods specification and verification but did not provide a strong and direct connection to system implementations developed using conventional programming languages. In particular, there was no refinement of model-level contracts to programming language-level contracts nor a framework for formally verifying that program code conforms to model-level behavioral specifications. To address these gaps and to enable the practical application of model-contract languages for verification of deployed high-integrity systems, this paper describes the design of the GUMBO AADL contract language that integrates and extends key concepts from earlier contract languages. The GUMBO contract language (GCL) is closely aligned to a formal semantics of the AADL run-time framework, which provides a platform- and language- independent specification of AADL semantics. We have enhanced the HAMR AADL code generation framework to translate model-level contracts to programming language-level contracts in the Slang high-integrity language. We demonstrate how the Logika verification tool can automatically verify that Slang-based AADL component implementations conform to contracts, both at the code-level and model-level. Slang-based implementations of AADL systems can be executed directly or compiled to C for deployments on Linux or the seL4 verified microkernel.

A combination method for integrated modular avionics safety analysis

PurposeThis study aims to solve the problem that the traditional hierarchically performed hazard origin and propagation studies (HiP-HOPS) cannot make dynamic model for the complex system such as integrated modular avionics (IMA) system.Design/methodology/approachA new combination method that combines HiP-HOPS with architecture analysis and design language (AADL) is proposed.FindingsThe combination method potentially reduces the amount of rework required for safety analysis and modelling of a modified design.Research limitations/implicationsModelling the IMA system with the combination method can just make qualitative analysis but cannot make quantitative analysis.Practical implicationsThe static model depicts the fault propagation among the components while the dynamic model describes the composite fault with AADL for IMA system.Originality/valueThe results of the case study show that the proposed method not only keeps model consistency but also makes safety analysis and modelling for IMA system efficiently.

A Modeling Method of Agents and SOA in Advanced Avionics System Based on AADL

The modeling method of agents and service-oriented architecture (SOA) in avionics systems describes agents and SOA in avionics systems with models. To our knowledge, however, the current modeling methods cannot describe the behavior of agents and SOA accurately and do not fit well with the existing avionics system models. This paper addresses the above problems by presenting a modeling method based on architecture analysis and design language (AADL). In this method, the working states of agents are described by the mode components, with the working process being triggered by the input of agents; and the services are described by the process component. The application of the software system is described by the system components that contain several process components. Moreover, different modes of the system are used to describe different applications, and the transitions of application are triggered by specific application requests. Software architecture of an avionics system is modeled by the proposed method. This case demonstrates that the proposed method can accurately describe how agents and SOA work in a new way and fit well with the existing avionics system models.

The systems architecture ontology (SAO): an ontology-based design method for cyber–physical systems

Purpose Managing components' resources plays a critical role in the success of systems' architectures designed for cyber–physical systems (CPS). Performing the selection of candidate components to pursue a specific application's needs also involves identifying the relationships among architectural components, the network and the physical process, as the system characteristics and properties are related. Design/methodology/approach Using a Model-Driven Engineering (MDE) approach is a valuable asset therefore. Within this context, the authors present the so-called Systems Architecture Ontology (SAO), which allows the representation of a system architecture (SA), as well as the relationships, characteristics and properties of a CPS application. Findings SAO uses a common vocabulary inspired by the Architecture Analysis and Design Language (AADL) standard. To demonstrate SAO's applicability, this paper presents its use as an MDE approach combined with ontology-based modeling through the Ontology Web Language (OWL). From OWL models based on SAO, the authors propose a model transformation tool to extract data related to architectural modeling in AADL code, allowing the creation of a components' library and a property set model. Besides saving design time by automatically generating many lines of code, such code is less error-prone, that is, without inconsistencies. Originality/value To illustrate the proposal, the authors present a case study in the aerospace domain with the application of SAO and its transformation tool. As result, a library containing 74 components and a related set of properties are automatically generated to support architectural design and evaluation.

A Comprehensive Formalization of AADL with Behavior Annex

In safety-critical fields, architectural languages such as AADL (Architecture Analysis and Design Language) have been playing an important role, and the analysis of the languages and systems designed by them is a challenging research topic. At present, a formal method has become one of the main practices in software engineering for strict analysis, and it has been applied on the tools of formalization and analysis. The formal method can be used to find and resolve the problems early by describing the system with precise semantics and validating the system model. This article studies the comprehensive formal specification and verification of AADL with Behavior annex by the formal method. The presentation of this specification and semantics is the aim of this article, and the work is illustrated with an ARINC653 model case study in Isabelle/HOL.

Assuring Increasingly Autonomous Systems in Human-Machine Teams: An Urban Air Mobility Case Study

As aircraft systems become increasingly autonomous, the human-machine role allocation changes and opportunities for new failure modes arise. This necessitates an approach to identify the safety requirements for the increasingly autonomous system (IAS) as well as a framework and techniques to verify and validate that an IAS meets its safety requirements. We use Crew Resource Management techniques to identify requirements and behaviors for safe human-machine teaming behaviors. We provide a methodology to verify that an IAS meets its requirements. We apply the methodology to a case study in Urban Air Mobility, which includes two contingency scenarios: unreliable sensor and aborted landing. For this case study, we implement an IAS agent in the Soar language that acts as a copilot for the selected contingency scenarios and performs takeoff and landing preparation, while the pilot maintains final decision authority. We develop a formal human-machine team architecture model in the Architectural Analysis and Design Language (AADL), with operator and IAS requirements formalized in the Assume Guarantee REasoning Environment (AGREE) Annex to AADL. We formally verify safety requirements for the human-machine team given the requirements on the IAS and operator. We develop an automated translator from Soar to the nuXmv model checking language and formally verify that the IAS agent satisfies its requirements using nuXmv. We share the design and requirements errors found in the process as well as our lessons learned.

C2AADL_Reverse: A model-driven reverse engineering approach to development and verification of safety-critical software

The safety-critical system communities have been struggling to manage and maintain their legacy softwaresystems because upgrading such systems has been a complex challenge. To overcome or reduce this problem, reverse engineering has been increasingly used in safety-critical systems. This paper proposes C2AADL_Reverse , a model-driven reverse engineering approach for safety-critical software development and verification. C2AADL_Reverse takes multi-task C source code as input, and generates AADL (Architecture Analysis and Design Language) model of the legacy software systems. Compared with the existing works, this paper considers more reversed construction including AADL component structure, behavior, and multi-threaded run-time information. Moreover, two types of activities are proposed to ensure the correctness of C2AADL_Reverse . First, it is necessary to validate the reverse engineering process. Second, the generated AADL models should conform to desired critical properties. We propose the verification of the reverse-engineered AADL model by using UPPAAL to establish component-level properties and the Assume Guarantee REasoning Environment (AGREE) to perform compositional verification of the architecture. This combination of verification tools allows us to iteratively explore design and verification of detailed behavioral models, and to scale formal analysis to large models. In addition, the prototype tool and the evaluation of C2AADL_Reverse using a real-world aerospace case study are presented.

Electric drives as fog nodes in a fog computing‐based industrial use case

Electric drives, which are a main component in industrial applications, control electric motors and record vital information about their respective industrial processes. The development of electric drives as Fog nodes within a fog computing platform (FCP) leads to new abilities such as programmability, analytics, and connectivity, increasing their value. In this study, the FORA FCP reference architecture is used to implement electric drives as Fog nodes, which is called “fogification”. The fogified drive architecture and its components are designed using Architecture Analysis and Design Language (AADL). The design process was driven by the high-level requirements that the authors elicited. Both the fogified drive architecture and the current drive architecture are used to implement a self baggage drop system in which electric drives are the key components. The fog-based design was then evaluated using several key performance indicators (KPIs), which reveal its advantages over the current drive architecture. The evaluation results show that safety-related isolation is enabled with only 9% overhead on the total Fog node utilization, control applications are virtualized with zero input–output jitter, the hardware cost is reduced by 44%, and machine learning at the edge is performed without interrupting the main drive functionalities and with an average 85% accuracy. The conclusion is that the fog-based design can successfully implement the required electric drive functionalities and can also enable innovative uses needed for realizing the vision of Industry 4.0.

Towards Formal Specification for AADL with Behavior Annex in Isabelle

The analysis of safety-critical systems designed by architectural languages such as AADL (Architecture Analysis and Design Language) is a challenging research topic. In such a context, formal methods become an advocated practice in software engineering for rigorous analysis. Moreover, they are applied on specific formalisms to be analyzed on dedicated tools. This paper studies the comprehensive formal specification for AADL language, in particular supporting major components of AADL and Behavior Annex. The presentation of this specification and modeling is the aim of this paper. This work is illustrated with a ARINC653 case study. As a study case, this work develops an AADL model from an ARINC653, specify a set of critical properties of the model and perform formal modeling in in Isabelle/HOL.

AADL-Based safety analysis using formal methods applied to aircraft digital systems

Model-based engineering tools are increasingly being used for system-level development of safety-critical systems. Architectural and behavioral models provide important information that can be leveraged to improve the system safety analysis process. Model-based design artifacts produced in early stage development activities can be used to perform system safety analysis, reducing costs, and providing accurate results throughout the system life-cycle. In this paper we describe an extension to the Architecture Analysis and Design Language (AADL) that supports modeling of system behavior under failure conditions. This safety annex enables the independent modeling of component failures and allows safety engineers to weave various types of fault behavior into the nominal system model. The accompanying tool support uses model checking to verify safety properties in the presence of faults and comprehensively enumerate all applicable fault combinations leading to failure conditions under quantitative objectives as part of the safety assessment process. The approach allows exploration of the effects of faulty component behavior on system level failure conditions without requiring explicit propagation specifications. It also supports a shared system model, a modeling language that can describe real-time embedded systems, and usable safety analysis artifacts.

Communication architecture for autonomous passenger ship

Novel innovations have been witnessed in the past few years in the field of technology for autonomous vehicles. These have been exploited in various applications in the maritime domain; one such application is the proposal to develop autonomous passenger ships (APS) or ferries for carrying passengers in urban waterways. Such technology requires the integration of several components to support the safe and secure operation of the ferries. In this paper, a communication architecture is proposed, that satisfies pre-established communication requirements and supports autonomous and remotely controlled functions of an APS. The architecture was designed using the Architecture Analysis and Design Language (AADL); this enabled an iterative design process to be followed and allows for future improvements. The proposed architecture is verified by showcasing the role of the different architectural components in addressing the requirements and in supporting the expected functions in a number of operational scenarios based on the expected operations of an APS use case called “Autoferry.” Furthermore, the proposed architecture has been evaluated by demonstrating its ability to achieve the expected performance according to the requirements, in simulated experiments using the network simulator GNS3.

VERDICT: A Language and Framework for Engineering Cyber Resilient and Safe System

The ever-increasing complexity of cyber-physical systems is driving the need for assurance of critical infrastructure and embedded systems. However, traditional methods to secure cyber-physical systems—e.g., using cyber best practices, adapting mechanisms from information technology systems, and penetration testing followed by patching—are becoming ineffective. This paper describes, in detail, Verification Evidence and Resilient Design In anticipation of Cybersecurity Threats (VERDICT), a language and framework to address cyber resiliency. When we use the term resiliency, we mean hardening a system such that it anticipates and withstands attacks. VERDICT analyzes a system in the face of cyber threats and recommends design improvements that can be applied early in the system engineering process. This is done in two steps: (1) Analyzing at the system architectural level, with respect to cyber and safety requirements and (2) by analyzing at the component behavioral level, with respect to a set of cyber-resiliency properties. The framework consists of three parts: (1) Model-Based Architectural Analysis and Synthesis (MBAAS); (2) Assurance Case Fragments Generation (ACFG); and (3) Cyber Resiliency Verifier (CRV). The VERDICT language is an Architecture Analysis and Design Language (AADL) annex for modeling the safety and security aspects of a system’s architecture. MBAAS performs probabilistic analyses, suggests defenses to mitigate attacks, and generates attack-defense trees and fault trees as evidence of resiliency and safety. It can also synthesize optimal defense solutions—with respect to implementation costs. In addition, ACFG assembles MBAAS evidence into goal structuring notation for certification purposes. CRV analyzes behavioral aspects of the system (i.e., the design model)—modeled using the Assume-Guarantee Reasoning Environment (AGREE) annex and checked against cyber resiliency properties using the Kind 2 model checker. When a property is proved or disproved, a minimal set of vital system components responsible for the proof/disproof are identified. CRV also provides rich and localized diagnostics so the user can quickly identify problems and fix the design model. This paper describes the VERDICT language and each part of the framework in detail and includes a case study to demonstrate the effectiveness of VERDICT—in this case, a delivery drone.

Integrated modeling method of Cyber physical system based on extended AADL

The concept and connotation of CPS are analyzed firstly in the paper, then the challenges of system modeling brought by heterogeneous feature of the CPS system are pointed out. How to describe the CPS model are studied. We propose a description method of CPS integrated modeling framework based on extended AADL (architecture analysis and design language); and realize the unified description of the computing entity, the physical entity and interactive entity through extending the standard and appendix of AADL.

Communication scheduling data generation for pre-configured IMA network

PurposeIn modern integrated modular avionics (IMA), it plays an important role to guarantee safety and reliability of the system. The safety and reliability of communication scheduling plays a crucial role in this IMA platforms-based network system. To verify the safety and reliability of the communication scheduling in this network, sufficient and typical test data must be generated to input into the network, obtain and evaluate the corresponding output.Design/methodology/approachTo generate communication scheduling data, this paper presents an iterative communication scheduling data generation algorithm for a configured network of IMA platforms. First, the algorithm generates all possible communication schedules for the first timestamp. Then, constraint is introduced to decrease the quantity of communication schedules to improve the efficiency. The communication schedules are gradually extended to the second timestamp until the final timestamp, i.e. length of communication scheduling sequence.FindingsTo verify the efficiency and feasibility of the algorithm, a model is built based on the architecture analysis and design language (AADL) by mapping the correlation time of generated communication scheduling data into task properties. Schedulability is analyzed by loading this model into AADL Inspector. The simulation result illustrates that the proposed algorithm is efficient and feasible.Practical implicationsThe proposed method can provide data support for communication scheduling test for the network of IMA platforms.Originality/valueA constraint-based iterative communication scheduling data generation algorithm is proposed for the network of IMA platforms automatically.

PAD-A: performance antipattern detector for AADL

In this article we have investigated the use of software performance antipatterns in tackling the performance issues in software architectures modelled using architecture analysis and design language (AADL). We have implemented our approach and developed a tool for OSATE (open source AADL tool environment) called PAD-A (performance antipattern detector for AADL). We evaluate our approach by applying it to two case studies. Results suggest effectiveness of antipatterns in tackling performance problems in early development phases.

Architecture-level particular risk modeling and analysis for a cyber-physical system with AADL

Cyber-physical systems (CPSs) are becoming increasingly important in safety-critical systems. Particular risk analysis (PRA) is an essential step in the safety assessment process to guarantee the quality of a system in the early phase of system development. Human factors like the physical environment are the most important part of particular risk assessment. Therefore, it is necessary to analyze the safety of the system considering human factor and physical factor. In this paper, we propose a new particular risk model (PRM) to improve the modeling ability of the Architecture Analysis and Design Language (AADL). An architecture-based PRA method is presented to support safety assessment for the AADL model of a cyber-physical system. To simulate the PRM with the proposed PRA method, model transformation from PRM to a deterministic and stochastic Petri net model is implemented. Finally, a case study on the power grid system of CPS is modeled and analyzed using the proposed method.