Post on 30-Mar-2019
AADL Architecture Analysis & Design
Language(SAE AS-5506A Std)
An Introduction
G. Edward Roberts
eroberts@elparazim.com
6/30/2011 1eroberts@elparazim.com Copyright 2011
Freely taken from
6/30/2011 3eroberts@elparazim.com Copyright 2011
6/30/2011 4eroberts@elparazim.com Copyright 2011
6/30/2011 5eroberts@elparazim.com Copyright 2011
AADL Representation Forms
6/30/2011 6eroberts@elparazim.com Copyright 2011
MetaModel
e.g. For use wthOSATE
6/30/2011 7eroberts@elparazim.com Copyright 2011
6/30/2011 8eroberts@elparazim.com Copyright 2011
9
TOGAF to the Platform
TOGAF
SysML
AADL
Acceleo
UML2
RT Java 5With Annotations
ATL
ATL
System
Enterprise
“Electronics”
Software
Implementations
Phase D
ATL = Atlas Transform Language6/30/2011 eroberts@elparazim.com Copyright 2011
6/30/2011 10eroberts@elparazim.com Copyright 2011
UML2 MARTE Profile
SysML
UML
MARTE
AADL
6/30/2011 11eroberts@elparazim.com Copyright 2011
Modeling and Analysis of Real-Time and Embedded Systems (MARTE)
MARTE Sections• NFP (Non-Functional Properties) Modeling• VSL (Value Specification Language)• Time Modeling• GRM (General Resource Modeling)• Alloc (Allocation) Modeling• GCM (Generic Component Modeling)• HLAM (High-Level Application Modeling)• DRM (Detail Resourced Modeling)• GQAM (Generic Quantitative Analysis Modeling)• SAM (Schedulability Analysis Modeling)• PAM (Performance Analysis Modeling)• RSM (Repetitive Structure Modeling)
6/30/2011 12eroberts@elparazim.com Copyright 2011
NFP (Non-Functional Properties) Modeling
6/30/2011 13eroberts@elparazim.com Copyright 2011
VSL (Value Specification
Language)
6/30/2011 14eroberts@elparazim.com Copyright 2011
Time Example
6/30/2011 15eroberts@elparazim.com Copyright 2011
GRM Example
6/30/2011 16eroberts@elparazim.com Copyright 2011
Alloc
6/30/2011 17eroberts@elparazim.com Copyright 2011
SRM (Software Resource Modeling)
6/30/2011 18eroberts@elparazim.com Copyright 2011
HRM Primitives
6/30/2011 19eroberts@elparazim.com Copyright 2011
SAM (Schedulability Analysis Modeling)
6/30/2011 20eroberts@elparazim.com Copyright 2011
PAM (Performance Analysis Modeling)
6/30/2011 21eroberts@elparazim.com Copyright 2011
Repeative Structure Modeling (RSM)
6/30/2011 22eroberts@elparazim.com Copyright 2011
6/30/2011 23eroberts@elparazim.com Copyright 2011
6/30/2011 24eroberts@elparazim.com Copyright 2011
AADL Toolset• OSATE – Open Source
– SEI developed, full language editing and semantic checking, multiple analysis plug-ins,
Eclipse based, integrated text and graphical editing with TOPCASED
• TOPCASED – Open Source
– Airbus led , 20 companies, Metamodeling Framework, AADL Graphics, AADL XML,
model transformation, Behavior Annex, also will support UML, stable July 2007
• STOOD - Commercial
– CASE toolset supporting UML, HOOD and AADL. Includes transformations between
notations, document support. Works with OSATE, TOPCASED, and Cheddar
• OCARINA – Open Source
– ENST AADL graphics and middleware generation and integration to AADL model of
network distributed processors. Creates formal model of executive integrated in AADL.
Generates to network protocols – CORBA, RT, FT
• Fremont – Open Source, Consulting and Toolset support
– AADL to ACRS (process algebra), formal analysis of concurrent resources.
– AADL to Charon, generation and integration of hybrid control systems.
– AADL Architecture Simulator – integrates event driven and schedule driven
• Generic Modeling Environment (GME) – Consortium
– Vanderbilt Univ, DARPA sponsored Metamodeling Framework, AADL capture and role
based system security analysis, model transformation, integration.
• CHEDDAR – Open Source
– Univ of Brest, advanced scheduling analysis toolset6/30/2011 25eroberts@elparazim.com Copyright 2011
+6M EurosFrom EU
6/30/2011 26eroberts@elparazim.com Copyright 2011
6/30/2011 27eroberts@elparazim.com Copyright 2011
Standard Component Types
•data• subprogram•subprogram group•thread•thread group•process
Software Components Execution Platform Components
•processor,•virtual processor •memory•bus•virtual bus
Compute Hardware:
Physical Environment:
•device
System Component
•system•abstract•prototype
Component
6/30/2011 28eroberts@elparazim.com Copyright 2011
Software Components
Subprogram Group - represent subprogram libraries.
6/30/2011 29eroberts@elparazim.com Copyright 2011
Execution Platform Components
6/30/2011 30eroberts@elparazim.com Copyright 2011
Type vs Implementation
2. the implementation, describes the contents of the component (subcomponents, properties, connections, etc.).
1. Type represents the functional interface of the component, what is visible by other components
Note: Types have thin lines and implementations have thick lines
hierarchical organization of components
6/30/2011 31eroberts@elparazim.com Copyright 2011
Inheritance: type and impl
6/30/2011 32eroberts@elparazim.com Copyright 2011
System State Model
6/30/2011 33eroberts@elparazim.com Copyright 2011
Properties
This Startup_Deadline applies to onlyInstances of this type
This Startup_Deadline applies to onlyThis instance
6/30/2011 34eroberts@elparazim.com Copyright 2011
Property SetsA named group of property types, property definitions, and property constant values.
property set mine isLength_Unit : type units ( mm,
cm => mm * 10,m => cm * 100,
km => m * 1000 );OnOff : type aadlboolean;Car_Length : type aadlreal 1.5 .. 4.5 units Length_Unit ;Speed_Range : type range of aadlreal 0 .. 250 units ( kph );Position : type record (X: aadlinteger; Y: aadlinteger; );Max_Threads : constant aadlinteger => 256;
end mine;
This type declaration references a separately declared units type
This type declaration defines the units in place
6/30/2011 35eroberts@elparazim.com Copyright 2011
Property Types
Boolean – aadlbooleanString – aadlstringEnumerations – enumeration ( literal1, literal2, … )Units – units ( unit1, unit2 => unit * factor, … )aadlinteger [lower_bound .. upper_bound] [units units]aadlreal [lower_bound .. upper_bound] [units units]range of number_typeclassifier * ( category1, category2, … ) +reference * ( named_element_kind1, … ) +record ( field_name1: * list of + property_type1; … )
6/30/2011 36eroberts@elparazim.com Copyright 2011
Predefined PropertiesThe AADL standard includes 7 pre-declared property sets which areavailable in every AADL specification
1. Deployment_Properties – Binding constraints and actual bindings ofapplication software to execution platform components2. Thread_Properties – Characteristics of active components (threads anddevices): dispatching, concurrency, mode transition3. Timing_Properties – Time related characteristics of active components;runtime system support for thread execution4. Communication_Properties – Properties to specify connection topology andqueuing characteristics5. Memory_Properties – Properties related to memory as storage, and memoryand device access6. Programming_Properties – Properties to specify relationship between AADLmodel elements and elements of an implementation in a programminglanguage or hardware description language7. Modeling_Properties – Properties that relate to the model itself
6/30/2011 37eroberts@elparazim.com Copyright 2011
Timing_Properties Example
property set Timing_Properties is…Startup_Deadline: Timeapplies to (processor, virtual processor, process, system);…end Timing_Properties;
One can now see how one could extend these components with propertiesFrom a different domain of interest (in an Annex)
Any namable model element, e.g., components, features, modes, connections,
flows, and subprogram calls
Properties are available for:
6/30/2011 38eroberts@elparazim.com Copyright 2011
Subcomponent
system implementation CarSystem.implsubcomponents
braking: system BrakingSystem;end CarSystem.impl;
system CarSystemend CarSystem;
system BrakingSystemend BrakingSystem;
6/30/2011 39eroberts@elparazim.com Copyright 2011
Subcomponent Array
6/30/2011 40eroberts@elparazim.com Copyright 2011
6/30/2011 41eroberts@elparazim.com Copyright 2011
6/30/2011 42eroberts@elparazim.com Copyright 2011
6/30/2011 43eroberts@elparazim.com Copyright 2011
6/30/2011 44eroberts@elparazim.com Copyright 2011
What do we need to describe an Architecture?
Component Component
Feature
describes an interface of a component through which control and data may be provided to or required from other components.
specify interaction between components at runtime.
Connection
6/30/2011 45eroberts@elparazim.com Copyright 2011
Feature Typesdata port - connection points for transfer of state data such as sensor data
event port - connection points for transfer of control through raised events that can trigger thread dispatch or mode transition.
event data port - connection points for transfer of events with data, i.e., messages that may be queued.
Provided subprogram access - entrypoints to code sequences in source text that is associated with a data type or a thread that can be called locally or remotely
Subprogram parameters - represent in and out parameters of a subprogram.
Data component access - provided and required access to shared data.
Bus component access - provided and required access to buses for processors, memory, and devices.
6/30/2011 46eroberts@elparazim.com Copyright 2011
Ports
6/30/2011 47eroberts@elparazim.com Copyright 2011
Ports
6/30/2011 48eroberts@elparazim.com Copyright 2011
Subcomponents and Connections
6/30/2011 49eroberts@elparazim.com Copyright 2011
System Connections
The Semantic Connection is from thread1.impl to thread2.impl
6/30/2011 50eroberts@elparazim.com Copyright 2011
Port Typing
data Alpha_Typeproperties
Source_Data_Size => 256 Bytes;end Alpha_Type;
thread Pfeatures
Data_Source : out data port Alpha_Type;end P;
6/30/2011 51eroberts@elparazim.com Copyright 2011
Pattern: Message Passing
6/30/2011 52eroberts@elparazim.com Copyright 2011
6/30/2011 53eroberts@elparazim.com Copyright 2011
6/30/2011 54eroberts@elparazim.com Copyright 2011
Connection Types
Timing : enumeration (sampled, immediate, delayed) => sampled
6/30/2011 55eroberts@elparazim.com Copyright 2011
Sampled Data Port Connection
6/30/2011 56eroberts@elparazim.com Copyright 2011
Connection Type (cont.)
6/30/2011 57eroberts@elparazim.com Copyright 2011
6/30/2011 58eroberts@elparazim.com Copyright 2011
6/30/2011 59eroberts@elparazim.com Copyright 2011
6/30/2011 60eroberts@elparazim.com Copyright 2011
Subprogram/Group Access
thread implementation node.icalls
{call1 : subprogram sp;call2 : subprogram sp;};
connectionsparameter e -> call1.e;parameter e -> call2.e;parameter call1.s -> s;parameter call2.s -> s;
end node.i;
subprogram spfeatures
e : in parameter d;s : out parameter d;
end sp;
data dend d;
thread nodefeatures
e : in event data port d;s : out event data port d;
end node;
6/30/2011 61eroberts@elparazim.com Copyright 2011
Execution Semantics: Example
•the first incoming data in e is stored in var1• the second incoming data is passed to call1• call2 uses the first data, stored in var1• call3 uses the output of call1• the output of call1 is stored in var2• the outputs of call2 and call3 are sent through s• the content of var2 is then sent through s
6/30/2011 62eroberts@elparazim.com Copyright 2011
Pattern: Remote Procedure Call
6/30/2011 63eroberts@elparazim.com Copyright 2011
6/30/2011 64eroberts@elparazim.com Copyright 2011
Data Component
data implementation Address.otherssubcomponents
street : data Base_Types::String;streetnumber: data Base_Types::Integer;city: data Base_Types::String;zipcode: data Base_Types::Integer;
end Address.others;
data Addressfeatures
getStreet : provides subprogram access;getCity : provides subprogram access;
end Address;
6/30/2011 65eroberts@elparazim.com Copyright 2011
Pattern: Object Oriented
data classfeatures
public_method : subprogram;end class;
data implementation class.isubcomponents
attribute : data;private_method : subprogram;
end class.i;
6/30/2011 66eroberts@elparazim.com Copyright 2011
6/30/2011 67eroberts@elparazim.com Copyright 2011
6/30/2011 68eroberts@elparazim.com Copyright 2011
Data Access
thread Thread1features
A: provides data access Data1;B: required data access Data2;
end Thread1;
thread Thread2features
C: requires data access Data1;end Thread2;
6/30/2011 69eroberts@elparazim.com Copyright 2011
6/30/2011 70eroberts@elparazim.com Copyright 2011
6/30/2011 71eroberts@elparazim.com Copyright 2011
Bus Shared Accesssystem System1end System1;
system implementation System1.implfeatures
A: provides bus access Bus1;subcomponents
B: processor Processor1;C: device Device1;D: memory Memory1;
connectionsbus access A <-> B.E;
end System1.impl;
processor Processor1features
E: requires bus access Bus1;end Processor1;
6/30/2011 72eroberts@elparazim.com Copyright 2011
6/30/2011 73eroberts@elparazim.com Copyright 2011
Example Flows
6/30/2011 74eroberts@elparazim.com Copyright 2011
6/30/2011 75eroberts@elparazim.com Copyright 2011
6/30/2011 76eroberts@elparazim.com Copyright 2011
6/30/2011 77eroberts@elparazim.com Copyright 2011
6/30/2011 78eroberts@elparazim.com Copyright 2011
Abstract Features
6/30/2011 79eroberts@elparazim.com Copyright 2011
Feature Arrays
6/30/2011 80eroberts@elparazim.com Copyright 2011
Connecting Arrays
6/30/2011 81eroberts@elparazim.com Copyright 2011
Connection Patterns – One Dimension
6/30/2011 82eroberts@elparazim.com Copyright 2011
Connection Patterns – Two Dimensions
6/30/2011 83eroberts@elparazim.com Copyright 2011
Connection Sets
6/30/2011 84eroberts@elparazim.com Copyright 2011
6/30/2011 85eroberts@elparazim.com Copyright 2011
Feature Group as a plug
feature group xfer_plugfeatures
Alpha : out data port Alpha_Type;Beta : in data port Alpha_Type;
end xfer_plug;
process Afeatures
Produce : feature group xfer_plug;end A;
feature group xfer_socket inverse of xfer_plugend xfer_socket;
6/30/2011 86eroberts@elparazim.com Copyright 2011
6/30/2011 87eroberts@elparazim.com Copyright 2011
6/30/2011 88eroberts@elparazim.com Copyright 2011
6/30/2011 89eroberts@elparazim.com Copyright 2011
Binding
thread implementation Producer.Basicproperties
Compute_Execution_Time => 0ms..10ms in binding ( PowerPC.speed_350Mhz );Compute_Execution_Time => 0ms..8ms in binding ( PowerPC.speed_450MHz );
end Producer.Basic ;
processor PowerPCfeatures
Card_Connector : requires bus access VME;end PowerPC;
thread Producerend Producer;
processor implementation PowerPC.speed_350Mhzproperties
Speed => 350Mhz;end PowerPC.speed_350Mhz;
6/30/2011 90eroberts@elparazim.com Copyright 2011
6/30/2011 91eroberts@elparazim.com Copyright 2011
Modeling ARINC 653 Partitions
6/30/2011 92eroberts@elparazim.com Copyright 2011
6/30/2011 93eroberts@elparazim.com Copyright 2011
6/30/2011 94eroberts@elparazim.com Copyright 2011
6/30/2011 95eroberts@elparazim.com Copyright 2011
Abstract Component Example
system implementation carRT.impl extends car.genericsubcomponents
PowerTrain : refined to process power_train;ExhaustSystem : refined to process exhaust_system;
end carRT.impl;
abstract carend car;
abstract implementation car.genericsubcomponents
PowerTrain: abstract power_train;ExhaustSystem: abstract exhaust_system;
end car.generic;abstract power_train
featuresexhaustoutput: requires bus access Manifold;
end power_train;abstract exhaust_system
featuresexhaustManifold: provides bus access Manifold;
end exhaust_system;system carRT extends carend carRT;
6/30/2011 96eroberts@elparazim.com Copyright 2011
Prototype Consistancy
6/30/2011 97eroberts@elparazim.com Copyright 2011
Another Prototype Example
abstract flowComponentprototypes
dt: data;incoming: in feature;
featuresinsignal: in feature incoming;outsignal: out data port dt;
end flowComponent;
process controller extends flowComponent ( dt => data signal.unit16,incoming => event data port signal.unit16 )
end controller;
data implementation signal.unit16end signal.unit16;
data signalend signal;
6/30/2011 98eroberts@elparazim.com Copyright 2011
6/30/2011 99eroberts@elparazim.com Copyright 2011
6/30/2011 100eroberts@elparazim.com Copyright 2011
6/30/2011 101eroberts@elparazim.com Copyright 2011
6/30/2011 102eroberts@elparazim.com Copyright 2011
6/30/2011 103eroberts@elparazim.com Copyright 2011
6/30/2011 104eroberts@elparazim.com Copyright 2011
Packageprovide a means to organize the descriptions by the use of namespaces
package carPackagepublic
system CarSystemend CarSystem;
end carPackage;
6/30/2011 105eroberts@elparazim.com Copyright 2011
Package
package Aircraft::Cockpitpublic
with Avionics::DataTypes,Safety_Properties;AirData renames Avionics::DataTypes::AirData;system MFD
featuresAirdata: in data port AirData;
propertiesSafety_Properties::Safety_Criticality => high;
end MFD;end Aircraft::Cockpit;
A defining package name must be unique in the global namespace.
A defining package name consists of a sequence of one or more package identifiers separated by a double colon
Provides a structure for organizing component type, component implementation, feature group types, and annex libraries into a separate namespace
Packages can be organized hierarchically by giving them nested package names. this hierarchy does not impose any restrictions on whether a package is accessible by other packages
6/30/2011 106eroberts@elparazim.com Copyright 2011
public and private
Declarations in the private section are visible only within private section of the package, i.e., they cannot be referenced from thepublic section or from other packages.
package Apublic
system Bend B;
private system Cend C;system Dend D;
end A;
package Epublic
system F end F;
end E;
Packages have a public and a private section
Declarations in the public section are visible outside the package, i.e., names declared in the public part can be referenced by declarations in other packages.
6/30/2011 107eroberts@elparazim.com Copyright 2011
Annexenable the use of declarations written in another sublanguage.
The AADL core language is extensible through
1. property sets, 2. annex subclauses3. annex libraries (standardized or user-defined)
Annex subclauses consist of annex-specific sublanguages whose constructs can be added to component types and component implementations.
Annex libraries are declarations of reusable annex specificsublanguage elements that are placed in AADL packages and can be referenced in annex subclauses.
You are basically free to define whatever language you want in these libraries.
6/30/2011 108eroberts@elparazim.com Copyright 2011
Use of an Annex in Model
thread Collect_Samplesfeatures
Input_Sample : in data port Sampling::Sample;Output_Average : out data port Sampling::Sample;
annex Error_Model {**Model => Transient_Fault_Model;Occurrence => 10e-4 poisson applies to Transient_Fault;
**};end Collect_Samples;
6/30/2011 109eroberts@elparazim.com Copyright 2011
6/30/2011 110eroberts@elparazim.com Copyright 2011
Standard AnnexAnnex Document A Code Generation [not normative] provides guidance for automatic generation and integration of runtimesystems and application code in different implementation languages. It defines a standardized set of properties for recording mappings from the AADL model to source text and for automatic code generation.
Annex Document B Data Modeling [not normative] provides guidance on data modeling and how to map relevant data modelinginformation into an AADL model if desirable. It defines a standardized set of properties and basic data types in support of data modeling.
Annex Document C Error Modeldefines a standardized core language extension in the form of a sublanguagenotation and properties the component to support annotating AADL models with safety-criticality and dependability related information of a system.
Annex Document D Behavior Modeldefines a standardized core language extension in the form of asublanguage notation to specify the behavior of AADL components as AADL model annotations.
Annex Document E Mini Annexes6/30/2011 111eroberts@elparazim.com Copyright 2011
Error Annex Example
6/30/2011 112eroberts@elparazim.com Copyright 2011
Discussion
• Is this a “formal method”?
• What is the advantages and disadvantages of this over VDM?
6/30/2011 eroberts@elparazim.com Copyright 2011 113