Modeling of Architectural Reconfiguration Case Study: Automated Teller Machine

Real-time software is becoming more prevalent in avionics systems such as unmanned aerial vehicles and spacecrafts. More often, these systems operate with limited human interaction or an increased latency in human response. Therefore, these systems require autonomous fault detection and a repair mechanism to respond to off nominal conditions that could arise. In order to prevent a hazard, these systems require assurance that they will operate in a safe manner while successfully completing a mission. Assurance, as a software engineering activity involves the reduction of risk, and inversely, an increase in confidence in a software system. In the context of fault management, this becomes a question of increasing confidence that a software system can detect and respond to the offnominal conditions occur. This activity is not always straight forward as off-nominal conditions in complex real-time systems do not always manifest as singular events, but rather as a combination of symptoms. Furthermore, for fault management assurance to be useful it needs to be rigorous. Therefore, the approach needs to be supported by a standard, repeatable framework. The foundation for this framework is in the ability to model the fault management system integrated in the hardware and software avionics real-time system. Models can assist in assuring both functional and quality attribute requirements such as reliability. The Architecture Analysis and Design Language (AADL) is a Society of Automotive Engineers (SAE) standard notation (AS5506/1) for the modeling and analysis of real-time systems. AADL has been extended to model fault management behavior through the AADL Error Annex, also an SAE standard. At its core, the AADL Error Annex provides rules for how software and hardware components are allowed to propagate an error across the avionics real-time system modeled in AADL. Because a standard notation is being used, there is intrinsic confidence to the approach. This paper will explore how the assurance of software fault management can be applied in practice. First, it is important to briefly review AADL and the AADL Error Annex as well as common terminology related to software fault management. Next, the application of software fault management assurance will be discussed. The first step in this application is to understand the very basic (atomic) hardware and software faults that occur at the component level. This information can be collected in the form of a failure modes and effects analysis (FMEA). An analysis is required in order to evaluate the ability of the software fault management system to, at the very least, detect the symptoms. This analysis answers two fundamental questions. First, to what degree are faults visible to the avionics software? Second, to what degree does the avionics software handle these faults? This paper presents an example to demonstrate the assurance of software fault management. The software fault management assurance framework proposed in this paper utilizes a standard notation, coupled with a formal mechanism for modeling faults. This provides a rigorous foundation for analysis on the avionics software real-time system in a repeatable manner. Therefore a model based assurance activity of a software fault management system can successfully be applied.

This document is a guide to help practitioners using the Architecture Analysis and Design Language (AADL), an international industry standard for the model-based engineering of real-time and embedded systems. The primary goal of this document is to describe an approach for and the mechanics of constructing an architectural model that can be analyzed based on the AADL. The first section of this document presents an overview of AADL concepts and many of the keywords of the language. The second part of the document illustrates a model-building approach using the AADL. It takes the perspective of an engineer who is developing a model for the first time using the AADL. This guide leads the reader through complete AADL model development based on automotive embedded control systems (cruise control, traction control, etc.) by describing the use and syntax of the AADL and interleaving modeling abstraction tradeoffs to achieve models that are abstract but precise. Models are constructed with different analysis perspectives in mind to illustrate the semantics as well as the richness of the AADL.

Safety-critical systems are widely used in different domains and lead to an increasing complexity. Such systems rely on specific services such space and time isolation as in the ARINC653 avionics standard. Their criticality requires a carefully driven design based on an appropriate development process and dedicated tools to detect and avoid problems as early as possible.Model Driven Engineering (MDE) approaches are now considered as valuable approach for building safety-critical systems. The Architecture Analysis and Design Language (AADL) proposes a component-based language suitable to operate MDE that fits with safety-critical systems needs.This paper presents an approach for the modeling, verification and implementation of ARINC653 systems using AADL. It details a modeling approach exploiting the new features of AADL version 2 for the design of ARINC653 architectures. It also proposes modeling patterns to represent other safety mechanisms such as the use of Ravenscar for critical applications. This approach is fully backed by tools with Ocarina (AADL toolsuite), POK (AADL/ARINC653 runtime) and Cheddar (scheduling verification). Thus, it assists system engineers to simulate and validate non functional requirements such as scheduling or resources dimensioning.

Architecture Analysis and Design Language (AADL) is an emerging industry standard notation for modeling architecture of embedded real-time systems. AADL has capability to model normal and faulty behavior of the system. It can model error behavior, for all of its components, their interactions and propagations. This capability makes it suitable for modeling safety critical systems, where fault detection, isolation and re-configuration are of paramount importance. This paper proposes using AADL to do safety validation of an embedded real-time system. AADL is used as a basis to systematically derive requirements and parameters specific to safety validation at both platform level and application level. Behavior and error models corresponding to system level AADL models are used to derive the parameters. Such parameters can then be monitored at the system integration testing level automatically using a safety monitor. We present our ideas using a detailed case study involving safety validation of a automatic flight control system (AFCS) from its AADL model that includes behavior and error modeling.

For efficiency and cost control reasons, system designers' will is to use an integrated set of methods and tools to describe specifications and design, and also to perform dependability analyses. The SAE (Society of Automotive Engineers) AADL (Architecture Analysis and Design Language) has proved to be efficient for architectural modeling. We present a modeling framework allowing the generation of dependability-oriented analytical models from AADL models, to facilitate the evaluation of dependability measures, such as reliability or availability. We propose a stepwise approach for system dependability modeling using AADL. The AADL dependability model is transformed into a GSPN (Generalized Stochastic Petri Net) by applying model transformation rules that can be automated. The resulting GSPN can be processed by existing tools. The modeling approach is illustrated on a subsystem of the French Air Traffic Control System.

A formal analytical and verification method was proposed to solve the schedulability problem of Architecture Analysis and Design Language(AADL) model.It used model checker UPPAAL to model external environment and to verify AADL thread component's schedulability under non-preempt dispatch strategy.Moreover,a tool for model's translation from AADL to UPPAAL was implemented.Experiment demonstrates that analyzing and verifying the schedulability of AADL models by UPPAAL is feasible.This method produces more precise results than other informal verification method.

Several requirements modeling languages such as the requirements package of SysML have been developed to improve the elicitation, analysis, validation and verification of requirements during project development life cycles. However, none of these languages is generic enough to embed explicit traces to components of arbitrary system architecture languages intending to provide a solution to the problem formalized by requirements specifications. For example, systems engineers using the Architecture Analysis and Design Language (AADL) cannot broidge SysML requirements to their architecture models in the same way it is done for UML models. The only way would be to define an external trace model linking the requirements to AADL model elements. In this paper, the new Requirements Definition and Analysis Language (RDAL) is presented. Inspired from SysML and the IEEE 15288 system life cycle processes standards, RDAL requirements can be traced to elements from any language of the solution domain, according to a settings model defining the allowed element types. Moreover, RDAL requirements can be expressed formally in terms of any constraint language such as OCL or REAL (for AADL) to provide automated verification against the associated solution (architecture) models. RDAL also adds important requirements engineering concepts such as environmental assumptions and goals not covered in SysML. RDAL is currently being standardized by the SAE AS-2C committee to become an annex of AADL.

Wireless Mesh Networked Control Systems (WMNCSs) are typical cyber-physical systems widely used in industry that have to meet critical safety requirements. The control algorithm and system are usually designed by different persons. The isolated design process leads to higher integration, testing and debugging costs and poor resource utilization. To bridge this gap, this paper proposes a controller/ architecture co-design framework for WMNCSs. This framework is based on architecture analysis and design language (AADL) and real-time calculus (RTC) theory. Firstly, we show how to build AADL model of WMNCSs, then a method of model transformation that translates AADL model to RTC model is proposed. With these two models, we can analyze the non-function properties of the system before implementation. Matlab/Simulink and OSATE are integrated to support the realization of this framework. We also develop several tools as plugins of OSATE to support the analysis of WMNCSs. The synthesis of above contributions is a largely automated co-design and analysis process of WMNCSs.

Determining whether a software architecture meets its security requirements is an early step in assuring the security of the products developed from the architecture. In this paper, we propose a tool-based technique using an authorization scheme to analyze the security of software architectures. Such technique will serve as debugging support for software architectures to identify the portion in the software architecture that fails to meet the required level. Security is analyzed in terms of its aggregate attributes: availability, confidentiality, and integrity. In this paper, we address confidentiality and show that integrity is measured in a complementary manner to confidentiality. A scenario based approach is taken to analyze security in a software architecture. Our work is implemented in the OSATE environment and analyzes software architectures modeled using AADL (Architecture Analysis and Design Language).

The Architecture Analysis and Design Language (AADL) is a SAE standard for modeling both hardware and software architecture of embedded systems. Widely embraced by stakeholders in critical real-time embedded systems, the AADL standard is used to address a large set of concerns including performances (latency, schedulability), safety, and security. The ADEPT workshop aims to present and report on current projects in the field of design, implementation, and verification of critical real-time embedded systems where AADL is a first-citizen technology. This article is a summary of the second edition of the workshop in 2023.

: As systems become more software intensive and complex, managing their development and implementation also becomes more complex. Models in development today are isolated, domain-specific artifacts that are created throughout the design lifecycle. A mechanism is needed to integrate the design models with simulation environments as the models are being developed and refined in order to rapidly see the impacts as the design matures. The ability to perform verification, validation, and accreditation (VV&A) early in the modeling process and throughout the lifecycle could greatly improve the model and its contribution. But in order to perform VV&A on complex systems, a precise language would be required to model these systems in an integrated fashion to remove ambiguity and the segmented developmental lifecycle. Objectives of this research included exploring the unique capabilities of Architectural Analysis and Design Language (AADL) for developing high confidence (verified and validated) models as part of a system development lifecycle and to determine the maturity of the AADL tools for VV&A model refinement. This report has two parallel components where the first component is focused on an AADL approach and exploits synergies and the other component is focused on a SYSML based approach.

Architecture Analysis and Design Language (AADL) is a standard in avionics system design. However, the communication patterns provided by AADL are not sufficient to the current context of Real-Time Embedded System (RTES) in which some multi-periodic communication patterns may occur. We propose an extension of a precedence model between tasks of different periods (multiperiodic communication). This relies on the Semaphore Precedence Constraint (SPC) model that is inspired from the concept of Semaphore, and more specifically on the m-n producer/consumer paradigm. We reinforce the SPC semantics by allowing cycles in the SPC precedence graph. We also present another viewpoint on the periodicity of tasks system using SPC based on a graph apart from the encoding technique presented in the SPC seminal work. An implementation of SPC in AADL and its associated analysis tool are also provided to study the temporal behaviour of systems using SPC.

In the system architecture design phase, there may be flaws introduced by the access control design. The flaws make the system design vulnerable. Vulnerabilities that are not detected during the design phase will be taken to the subsequent phases of the system development. This reduces system security and leads to more repair cost. In order to detect the access control flaws in the design phase as early as possible, we propose the security analysis method using Architecture Analysis and Design Language (AADL). This method analyzes the access control policies between components. It can analyze and detect the access control flaws in the AADL architecture model. For describing the access control policies, vulnerability model annex is created. We use a case study, based on a module from an aircraft intelligent information system, to introduce the application of modeling and analysis methods.

Designing safety critical systems is a complex task due to the need of guaranteeing that the resulting model can cope with all the functional and non-functional requirements of the system. Obtaining such guarantees is only possible with the use of model verification techniques. This paper presents an approach aimed to fulfill the needs of critical system design. The proposed approach is based on the Architecture Analysis and Design Language (AADL), which is suitable to describe the system's architecture. A sequence of model transformations facilitates the verification of the designed AADL model and so assures its correctness. It must be highlighted that this is not performed in a single step, as it is possible to verify AADL models with different abstraction levels, which allows successive refinements in a top-down approach.

This paper presents a model-based approach to system-software co-engineering which is focused on aerospace systems but is relevant to a much wider class of dependable systems. We present the main ingredients of the SLIM modeling language and give a precise interpretation of SLIM models by providing a formal semantics using networks of event-data automata. The major distinguishing aspects of this component-based approach are the possibility to describe nominal hardware and software operations, hybrid (and timing) aspects, as well as probabilistic faults and their propagation and recovery. As our approach bears strong resemblance to the standardized AADL (Architecture Analysis and Design Language), a secondary contribution of this paper is a formal semantics of a large fragment of AADL including its Error Model Annex.