Architecture Analysis And Design Language Model Research Articles

C2AADL_Reverse: A Model-Driven Reverse Engineering Approach for Development and Verification of Safety-Critical Software

The safety-critical system communities have been struggling to manage and maintain their legacy software systems because upgrading such systems has been a complex challenge. To overcome or reduce this problem, reverse engineering has been increasingly used in safety-critical systems. This paper proposes C2AADL_Reverse, a model-driven reverse engineering approach for safety-critical software development and verification. C2AADL_Reverse takes multi-task C source code as input, and generates AADL (Architecture Analysis and Design Language) model of the legacy software systems. Compared with the existing works, this paper considers more reversed construction including AADL component structure, behavior, and multi-threaded run-time information. Moreover, two types of activities are proposed to ensure the correctness of C2AADL_Reverse. First, it is necessary to validate the reverse engineering process. Second, the generated AADL models should conform to desired critical properties. We propose the verification of the reverse-engineered AADL model by using UPPAAL to establish component-level properties and the Assume Guarantee REasoning Environment (AGREE) to perform compositional verification of the architecture. This combination of verification tools allows us to iteratively explore design and verification of detailed behavioral models, and to scale formal analysis to large models. In addition, the prototype tool and the evaluation of C2AADL_Reverse using a real-world aerospace case study are presented.

C2AADL_Reverse: A model-driven reverse engineering approach to development and verification of safety-critical software

The safety-critical system communities have been struggling to manage and maintain their legacy softwaresystems because upgrading such systems has been a complex challenge. To overcome or reduce this problem, reverse engineering has been increasingly used in safety-critical systems. This paper proposes C2AADL_Reverse , a model-driven reverse engineering approach for safety-critical software development and verification. C2AADL_Reverse takes multi-task C source code as input, and generates AADL (Architecture Analysis and Design Language) model of the legacy software systems. Compared with the existing works, this paper considers more reversed construction including AADL component structure, behavior, and multi-threaded run-time information. Moreover, two types of activities are proposed to ensure the correctness of C2AADL_Reverse . First, it is necessary to validate the reverse engineering process. Second, the generated AADL models should conform to desired critical properties. We propose the verification of the reverse-engineered AADL model by using UPPAAL to establish component-level properties and the Assume Guarantee REasoning Environment (AGREE) to perform compositional verification of the architecture. This combination of verification tools allows us to iteratively explore design and verification of detailed behavioral models, and to scale formal analysis to large models. In addition, the prototype tool and the evaluation of C2AADL_Reverse using a real-world aerospace case study are presented.

Towards Formal Specification for AADL with Behavior Annex in Isabelle

The analysis of safety-critical systems designed by architectural languages such as AADL (Architecture Analysis and Design Language) is a challenging research topic. In such a context, formal methods become an advocated practice in software engineering for rigorous analysis. Moreover, they are applied on specific formalisms to be analyzed on dedicated tools. This paper studies the comprehensive formal specification for AADL language, in particular supporting major components of AADL and Behavior Annex. The presentation of this specification and modeling is the aim of this paper. This work is illustrated with a ARINC653 case study. As a study case, this work develops an AADL model from an ARINC653, specify a set of critical properties of the model and perform formal modeling in in Isabelle/HOL.

Architecture-level particular risk modeling and analysis for a cyber-physical system with AADL

Cyber-physical systems (CPSs) are becoming increasingly important in safety-critical systems. Particular risk analysis (PRA) is an essential step in the safety assessment process to guarantee the quality of a system in the early phase of system development. Human factors like the physical environment are the most important part of particular risk assessment. Therefore, it is necessary to analyze the safety of the system considering human factor and physical factor. In this paper, we propose a new particular risk model (PRM) to improve the modeling ability of the Architecture Analysis and Design Language (AADL). An architecture-based PRA method is presented to support safety assessment for the AADL model of a cyber-physical system. To simulate the PRM with the proposed PRA method, model transformation from PRM to a deterministic and stochastic Petri net model is implemented. Finally, a case study on the power grid system of CPS is modeled and analyzed using the proposed method.

Transformation from AADL to Colored Petri Nets for Dynamic Reconfiguration Process

Although integrated modular avionics (IMA) provides many advantages such as the reduced weight and higher efficiency for system operations, safety problems in IMA dynamic reconfiguration process come up due to its complexity to analyze. Architecture Analysis and Design Language (AADL) has advantage to model for embedded systems. However, it is quite limited to employ AADL for analyzing system safety. This paper, seeks to translate the AADL models of IMA dynamic reconfiguration process into colored petri net (CPN), which have advantages to simulate and evaluate embedded systems. Then, the colored petri net (CPN) is proposed for the analysis for AADL models, because CPN can describe the properties and behaviors of dynamic reconfiguration process well. Moreover, it is essential to make a transformation from the AADL models to the CPN models. This work will benefit the subsequent analysis of IMA dynamic reconfiguration process. Finally, a case study is provided for effectiveness the transformation rules.

An Approach to Generate the Traceability Between Restricted Natural Language Requirements and AADL Models

Requirements traceability is broadly recognized as a critical element of any rigorous software development process, especially for building safety-critical software (SCS) systems. Model-driven development (MDD) is increasingly used to develop SCS in many domains, such as automotive and aerospace. MDD provides new opportunities for establishing traceability links through modeling and model transformations. Architecture Analysis and Design Language (AADL) is a standardized architecture description language for embedded systems, which is widely used in avionics and aerospace industries to model safety-critical applications. However, there is a big challenge to automatically establish the traceability links between requirements and AADL models in the context of MDD, because requirements are mostly written as free natural language texts, which are often ambiguous and difficult to be processed automatically. To bridge the gap between natural language requirements (NLRs) and AADL models, we propose an approach to generate the traceability links between NLRs and AADL models. First, we propose a requirement modeling method based on the restricted natural language, which is named as RM-RNL. The RM-RNL can eliminate the ambiguity of NLRs and barely change engineers’ habits of requirement specification. Second, we present a method to automatically generate the initial AADL models from the RM-RNLs and to automatically establish traceability links between the elements of the RM-RNL and the generated AADL models. Third, we refine the initial AADL models through patterns to achieve the change of requirements and traceability links. Finally, we demonstrate the effectiveness of our approach with industrial case studies and evaluation experiments.

Safety Analysis of AADL Models for Grid Cyber-Physical Systems via Model Checking of Stochastic Games

As safety-critical systems, grid cyber-physical systems (GCPSs) are required to ensure the safety of power-related systems. However, in many cases, GCPSs may be subject to uncertain and nondeterministic environmental hazards, as well as the variable quality of devices. They can cause failures and hazards in the whole system and may jeopardize system safety. Thus, it necessitates safety analysis for system safety assurance. This paper proposes an architecture-level safety analysis approach for GCPSs applying the probabilistic model-checking of stochastic games. GCPSs are modeled using Architecture Analysis and Design Language (AADL). Random errors and failures of a GCPS and nondeterministic environment behaviors are explicitly described with AADL annexes. A GCPS AADL model including the environment can be regarded as a game. To transform AADL models to stochastic multi-player games (SMGs) models, model transformation rules are proposed and the completeness and consistency of rules are proved. Property formulae are formulated for formal verification of GCPS SMG models, so that occurrence probabilities of failed states and hazards can be obtained for system-level safety analysis. Finally, a modified IEEE 9-bus system with grid elements that are power management systems is modeled and analyzed using the proposed approach.

Model transformation for analyzing dependability of AADL model by using HiP-HOPS

The Architecture Analysis and Design Language (AADL) has emerged as a potential future standard in aerospace, automobile and avionics industries for model-based development of dependability-critical systems. As AADL is relatively new, some existing analysis methods and tools are not able to accept AADL models. In this paper we show that, by using model transformation techniques, we can automatically transform AADL models into a form that is directly executable by fault-tree-based dependability analysis and optimisation tools. This model transformation opens a path by which AADL models may benefit from automatic synthesis and analysis of fault trees, temporal fault tree analysis, multiple failure mode and effects analysis and model architecture optimisation.In this paper, we present a new model transformation framework. The core of the framework is a novel transformation from a state machine-based error model to a fault-tree model. The framework has been implemented as a plug-in (AADL2HiP-HOPS) for the AADL model development tool OSATE. The plug-in may be used to transform AADL models into a state-of-the-art dependability analysis and optimisation tool: HiP-HOPS. To illustrate the transformation and subsequent HiP-HOPS analysis, an example AADL model is transformed.

Approach for integrated modular avionics reconfiguration modelling and reliability analysis based on AADL

To optimise the configuration and reconfiguration strategies in integrated modular avionics (IMA), modelling and evaluating the reliability of the reconfigurable IMA system have drawn great attention from system engineers and designers. Currently most researches regard each configuration as a single system state, but the detailed system architecture under each configuration or the events that trigger the reconfiguration behaviour are not involved. In this study, a modelling method is proposed for these complex processes of the IMA reconfiguration. It employs architecture analysis and design language (AADL) along with its Error Model Annex, ARINC653 Annex, and mode transition mechanisms to model the correlated component error state transitions, system configuration architectures, and reconfiguration behaviours. Based on the proposed AADL modelling approach, these model information is extracted purposefully to establish computable models. Then a reliability analysis approach is proposed which is able to result in various reliability attributions, such as component reliability, configuration reliability under the software architecture, single task reliability, and multi-tasking reliability. These evaluation processes take into account both of the fault isolation reconfiguration and task mode reconfiguration for the first time. Finally, the case study is involved, which demonstrates the feasibility of the analysis approach for IMA based on an AADL model.

Approach to analyzing AADL end-to-end flow latency based on timed automata

End-to-end flow latency analysis of complex embedded system is an effective way to assess system's real-time performance. Architecture analysis and design language( AADL) is the standard language to specify the architecture of complex embedded system,end-to-end flow of which describes the components' interaction. At present,most manual latency analysis approaches could consider flow's precise semantics. However,the efficiency of this time consuming analysis is low; although automatic methods have better efficiency,the accuracy is not satisfying because of the low coverage of delay-contribution attributes. What's more,both kinds of methods only focus on the typical interactive situations such as the worst-latency analysis. The impact of design elements resulting in uncertainty cannot be analyzed. Thus,one approach to analyzing AADL end-toend flow latency based on timed automata model was proposed. First,latency-contributed attributes meta-model of flow was constructed to improve the coverage of latency-contributed attributes. Then the transformation from AADL end-to-end flow to timed automata model was studied. Latency analyzing was performed through simulating the timed automata model. Finally,the experiments based on one case study demonstrate that our way can precisely model the transportation semantics and the latency attributes semantics of a flow,illustrating our way's sufficient expressive competence. Additionally,the experiments also show flexible analysis ability of our approach by dealing with the various interactive scenarios and even the random time factors in the transportation of information. Meanwhile,the state transition and the changing on the time factors provide a basis and suggestions for the further improvement of the original AADL model.

Exploring AADL verification tool through model transformation

Architecture Analysis and Design Language (AADL) is often used to model safety-critical real-time systems. Model transformation is widely used to extract a formal specification so that AADL models can be verified and analyzed by existing tools. Timed Abstract State Machine (TASM) is a formalism not only able to specify behavior and communication but also timing and resource aspects of the system. To verify functional and nonfunctional properties of AADL models, this paper presents a methodology for translating AADL to TASM. Our main contribution is to formally define the translation rules from an adequate subset of AADL (including thread component, port communication, behavior annex and mode change) into TASM. Based on these rules, a tool called AADL2TASM is implemented using Atlas Transformation Language (ATL). Finally, a case study from an actual data processing unit of a satellite is provided to validate the transformation and illustrate the practicality of the approach.

Reliability Evaluation based on the AADL Architecture Model

The structure of the embedded system gets much more complicated. Current basic Architecture Analysis and Design Language (AADL) reliability model cannot meet the requirements of software reliability being evaluated while being designed. For the present, reliability evaluated needs abundant fault analysis which can not be realized in the early of software development. The article has come up with a methodology based on system architecture using AADL to perform reliability evaluate at Early development With good understanding of rules and transformation from AADL based system architecture model to Petri Net, a one-to-one mapping rule was achieved between AADL elements and Petri Net elements. Using current mathematic model of Petri Net to evaluate the reliability of software architecture. At last, a flight control system of AADL model was given as an example to validate the availability of the given method

From AADL to Timed Abstract State Machines: A verified model transformation

Architecture Analysis and Design Language (AADL) is an architecture description language standard for embedded real-time systems widely used in the avionics and aerospace industry to model safety-critical applications. To verify and analyze the AADL models, model transformation technologies are often used to automatically extract a formal specification suitable for analysis and verification. In this process, it remains a challenge to prove that the model transformation preserves the semantics of the initial AADL model or, at least, some of the specific properties or requirements it needs to satisfy. This paper presents a machine checked semantics-preserving transformation of a subset of AADL (including periodic threads, data port communications, mode changes, and the AADL behavior annex) into Timed Abstract State Machines (TASM). The AADL standard itself lacks at present a formal semantics to make this translation validation possible. Our contribution is to bridge this gap by providing two formal semantics for the subset of AADL. The execution semantics provided by the AADL standard is formalized as Timed Transition Systems (TTS). This formalization gives a reference expression of AADL semantics which can be compared with the TASM-based translation (for verification purpose). Finally, the verified transformation is mechanized in the theorem prover Coq.

A Mapping Simulation of Code Generation for Partitioned System

It is crucial for real-time embedded system to design and verify for a little fault may lead to a catastrophe. Architecture Analysis and Design Language (AADL) is a modeling language used to design and analysis the architecture of real-time embedded system based on Model Driven Architecture (MDA). Code generation of AADL model to codes running on the Real-time Operation System can avoid hand-writing mistakes and improve the efficiency of development. Partitioning is introduced into embedded system to control fault transmission. This paper presents a mapping approach to generate codes from AADL model for partitioned system, and the generated codes which include configuration codes and C codes will run on a partitioned platform.

Multi-objective Architecture Optimisation Modelling for Dependable Systems

The design of dependable systems must address both cost and dependability (i.e. safety, reliability, availability and maintainability) concerns. For large systems, the design space of alternatives with respect to both dependability and cost is very large and automation is essential to explore this space. The model-based approach to the development and analysis of complex dependable systems is increasingly popular and recently, the Architecture Analysis and Design Language (AADL) has emerged as a potential future standard for model-based development of dependability-critical systems. The paper tackles the problem of describing, within an AADL model, the design space of alternative designs. A new AADL property set is proposed for modelling component and system variability for cost and dependability optimisation. The proposed method is illustrated with an example of an AADL model of a safety critical embedded system.

AADL: An Architecture Design and Analysis Language for Complex Embedded Real-Time Systems

This paper firstly presents a summary of AADL (architecture analysis and design language), including its progress over the years and its modeling elements. Then, it surveys the research and practice of AADL from a model-based perspective, such as AADL modeling, AADL formal semantics, model transformation, verification and code generation. Finally, the potential research directions are discussed.

Safety, Dependability and Performance Analysis of Extended AADL Models

This paper presents a component-based modelling approach to system-software co-engineering of real-time embedded systems, in particular aerospace systems. Our method is centred around the standardized Architecture Analysis and Design Language (AADL) modelling framework. We formalize a significant subset of AADL, incorporating its recent Error Model Annex for modelling faults and repairs. The major distinguishing aspects of this component-based approach are the possibility to describe nominal hardware and software operations, hybrid (and timing) aspects, as well as probabilistic faults and their propagation and recovery. Moreover, it supports dynamic (i.e. on-the-fly) reconfiguration of components and inter-component connections. The operational semantics gives a precise interpretation of specifications by providing a mapping onto networks of event-data automata. These networks are then subject to different kinds of formal analysis such as model checking, safety and dependability analysis and performance evaluation. Mature tool support realizes these analyses. The activities reported in this paper are carried out in the context of the correctness, modelling, and performance of aerospace systems, project which is funded by the European Space Agency.

Model-Based Engineering for the Development of ARINC653 Architectures

The concept of partitioned kernel, introduced by the Integrated Modular Avionics (IMA) architecture comes with new challenges (isolation enforcement, partitioning trade-off, etc.) that must be addressed during the design and the implementation of partitioned architectures. However, the development process frequently consists in handwriting code, which makes difficult the analysis of the system. Such a development process does not ease the design of high-integrity systems. Model Based Engineering describes architecture and application requirements with models. Models can be then used to ensure requirements enforcement or produce code, ensuring that requirements are enforced inside the implementation. In this paper, we claim the Architecture Analysis and Design Language (AADL) as a valuable candidate to support a Model-Based method for the design and the implementation of ARINC653 systems. Using the AADL as a backbone language, we model such architectures using first-class citizen AADL constructs (virtual processors and buses) and detail their validation. We present our code generator that automatically assembles, configures and deploys application code from AADL models. We also discuss the efficiency of a model-based approach in the design of certifiable systems and explain how it helps the system integrator to certify its system. INTRODUCTION

Schedulability verification of AADL model based on UPPAAL

A formal analytical and verification method was proposed to solve the schedulability problem of Architecture Analysis and Design Language(AADL) model.It used model checker UPPAAL to model external environment and to verify AADL thread component's schedulability under non-preempt dispatch strategy.Moreover,a tool for model's translation from AADL to UPPAAL was implemented.Experiment demonstrates that analyzing and verifying the schedulability of AADL models by UPPAAL is feasible.This method produces more precise results than other informal verification method.