Formal Semantics and Analysis of Behavioral AADL Models in Real-Time Maude

Abstract

Abstract. AADL is a standard for modeling embedded systems that is widely used in avionics and other safety-critical applications. However, AADL lacks a formal semantics, and this severely limits both unambiguous communication among model developers, and the development of simulators and formal analysis tools. In this work we present a formal object-based real-time concurrent semantics for a behavioral subset of AADL in rewriting logic, which includes the essential aspects of its behavior annex. Our semantics is directly executable in Real-Time Maude and provides an AADL simulator and LTL model checking tool called AADL2Maude. AADL2Maude is integrated with OSATE, so that OS-ATE's code generation facility is used to automatically transform AADL models into their corresponding Real-Time Maude specifications. Such transformed models can then be executed and model checked by RealTime Maude. We present our semantics, and two case studies in which safety-critical properties are analyzed in AADL2Maude.

An ocarina extension for AADL formal semantics generation

“…In addition, Ocarina can be easily integrated as a backend for other AADL editors (already used through OSATE and AADL Inspector tools), which increases the visibility of our work. AADL Formal approaches are often based on model transformation into different languages such as Lustre [13], TLA+ [22], Signal [5], ACSR [24], TASM [25], Fiacre [4], Real-time Maude [20] and BIP [8]. As examples: many work [5,26] are around the Polychrony platform and Signal language for synchronous verification of AADL models where behavior is specified by BA or Simulink.…”

“…Many projects and tool-chains are dedicated to AADL processing, that often adopt model transformation techniques to allow formal analyses. Several AADL formal semantics are defined using different formalisms such as Petri nets [21,23], timed automata [12,14] and different process algebras [4,5,8,20,25]. These approaches are implemented within platforms such as OSATE and TOPCASED aiming the convenient reuse of existing tools like UPPAAL, Tina and Polychrony.…”

Polychronous modeling, analysis, verification and simulation for timed software architectures

“…In order to perform formal validation and analysis on AADL models, formal models and frameworks are widely used in the process [25,10,26,27,7,8,11,28]. We follow the similar approach, but in comparison, we concentrate on the formal timing analysis of the system and co-modeling, which include clock calculus, affine clock relations, profiling, and architecture exploration.…”

“…It is also possible to perform symbolic model checking and formal timing analysis techniques on our polychronous model. The AADL2Maude tool [11] concentrates on the ambiguity of certain AADL semantics and thus intro-duces a real-time rewriting logic semantics, for a behavioral sub-set of AADL. Simulation and model checking based on LTL [32] are enabled in AADL2Maude.…”

“…In particular, AADL permits the fast yet expressive modeling of a system, including software architecture, execution platform, and their binding. Early-phase analysis and validation, e.g., schedulability, reliability, and allocation, can be rapidly performed based on the AADL models [7], [8], [9], [10], [11], [12].…”