Safety, dependability and performance analysis of extended AADL models

Safety, Dependability and PerformanceAnalysis of Extended AADL Models1

Marco Bozzano2 Alessandro Cimatti2 Marco Roveri2

Joost-Pieter Katoen1 Viet Yen Nguyen1 Thomas Noll1

1Software Modelling and Verification GroupRWTH Aachen University, Germany

2Embedded Systems GroupFondazione Bruno Kessler, Italy

ROCKS Kick-Off Meeting28 September 2009

1Funded by ESA/ESTEC under Contract No. 21171/07/NL/JD

Safety, Dependability and PerformanceAnalysis of Extended AADL Models

1. Scope2. AADL Syntax3. Formal Characterisation4. Injecting Faults5. COMPASS Toolset6. Conclusions

How System Engineers Build Space Systems (in Europe)

2009,Viet Yen Nguyen 3/23

AADL: Industry Standard for Modelling Embedded Systems

• 1989 MetaH

• 1998 SAE AS-2C

• 2004 AADL 1.0

• 2006 Error Annex

• 2009 AADL 2.0

ParadigmI Architecture-based and

model-driven top-down andbottom-up engineering

I Real-time and performancecritical distributed systems

I Complements component-basedproduct-line development


Integrated and Coherent Approach for Codesigning Systems

Modelling LanguageI AADL + Error AnnexI Hardware/SoftwareI Error PropagationI Recovery MechanismsI Timing, Probability, HybridI Formal Semantics

COMPASS ToolsetI NuSMVI FSAPI RATI SigrefI MRMC

AnalysesI Symbolic Model CheckingI SAT-SolvingI Probabilistic Model CheckingI FTAI FMEA

Case StudiesI Satellite Thermal Regulation

ManagerI Satellite FDIRI European Train Control

System Level 3








System Level 3








System Level 3


AADL Syntax

AADL Example: Redundant Power System

Power

primary

backup

batt1

voltage

empty

voltage

batt2

voltage

empty

We shall show:I hybrid behaviour of the batteries,I composition of the power system,I formalisation to automata,I semantics as transition systems,I interweaving of errors.


AADL: Modelling the BatteryComponent Type and Implementation

device type Battery

featuresempty: out event port;voltage: out data port real initially 6.0;

end Battery;

device implementation Battery.Imp

subcomponentsenergy: data continuous initially 100.0;

modescharged: activation modewhile energy’=-0.02 and energy>=20.0;

depleted: modewhile energy’=-0.03;

transitionscharged -[]-> charged;charged -[empty]-> depleted;depleted -[]-> depleted;

end Battery.Imp;


AADL: Modelling the BatteryComponent Type Defines the Interface

device type Batteryfeaturesempty: out event port;voltage: out data port real initially 6.0;

end Battery;






end Battery.Imp;


AADL: Modelling the BatteryAdding Modes Behaviour


end Battery;



modescharged: activation mode

while energy’=-0.02 and energy>=20.0;

depleted: mode

while energy’=-0.03;


end Battery.Imp;


AADL: Modelling the BatteryAdding Hybrid Behaviour


end Battery;

device implementation Battery.Impsubcomponentsenergy: data continuous initially 100.0;



transitionscharged -[then voltage:=energy/50.0+4.0]-> charged;charged -[empty when energy<=20.0]-> depleted;depleted -[then voltage:=energy/50.0+4.0]-> depleted;

end Battery.Imp;


AADL: Modelling the Redundant Power SystemPower System with Battery Subcomponents

system Powerfeaturesvoltage: out data port real;

end Power;

system implementation Power.Impsubcomponentsbatt1: device Battery.Impbatt2: device Battery.Imp

connectionsdata port batt1.voltage -> voltage in modes (primary);data port batt2.voltage -> voltage in modes (backup);

modesprimary: initial mode;backup: mode;

transitionsprimary -[batt1.empty]-> backup;backup -[batt2.empty]-> primary;

end Power.Imp;


AADL: Modelling the Redundant Power SystemAdding Dynamic Reconfiguration


end Power;

system implementation Power.Impsubcomponentsbatt1: device Battery.Imp in modes (primary);batt2: device Battery.Imp in modes (backup);




end Power.Imp;


AADL: Modelling the Redundant Power SystemAdding Port Connections


end Power;

system implementation Power.Impsubcomponentsbatt1: device Battery.Imp in modes (primary);batt2: device Battery.Imp in modes (backup);




end Power.Imp;


Formal Characterisation

Formalising AADL Components as Event-Data Automata

Definition (Event-Data Automaton)

An event-data automaton (EDA) is a tuple

A = (M ,m0,X , v0, ι,E , −→ )

withI M finite set of modesI m0 ∈ M initial modeI X = IX ]OX ] LX finite set of input/output/local variablesI V := {v | v : X → . . .} valuationsI v0 ∈ V initial valuationI ι : M → (V → B) mode invariants (where ι(m0, v0) = true)I E = IE ]OE finite set of input/output eventsI −→ ⊆M × Eτ︸︷︷︸

trigger

× (V → B)︸︷︷︸guard

× (V → V )︸︷︷︸effect

×M

(mode) transition relation (where Eτ := E ∪ {τ})



I AADL modes/invariants/transitions; EDA modes/invariants/transitions

I Incoming/outgoing data ports ; input/output variablesI Data subcomponents ; local variablesI AADL incoming/outgoing event ports ; EDA input/output events

Example (Battery)I M = {charged, depleted}, m0 = charged

I IX = ∅, OX = {voltage}I LX = {energy}I IE = ∅, OE = {empty}




I Incoming/outgoing data ports ; input/output variables

I Data subcomponents ; local variablesI AADL incoming/outgoing event ports ; EDA input/output events

Example (Battery)I M = {charged, depleted}, m0 = chargedI IX = ∅, OX = {voltage}

I LX = {energy}I IE = ∅, OE = {empty}




I Incoming/outgoing data ports ; input/output variablesI Data subcomponents ; local variables

I AADL incoming/outgoing event ports ; EDA input/output events

Example (Battery)I M = {charged, depleted}, m0 = chargedI IX = ∅, OX = {voltage}I LX = {energy}

I IE = ∅, OE = {empty}




I Incoming/outgoing data ports ; input/output variablesI Data subcomponents ; local variablesI AADL incoming/outgoing event ports ; EDA input/output events

Example (Battery)I M = {charged, depleted}, m0 = chargedI IX = ∅, OX = {voltage}I LX = {energy}I IE = ∅, OE = {empty}


LTS Semantics of Event-Data Automata

I States := M ×VI Transitions: timed or internal or event-labeled

Example (Battery)

〈mode = charged, energy = 100.0, voltage = 6.0〉↓ 30.0

〈mode = charged, energy = 40.0, voltage = 6.0〉↓ τ〈voltage:=...〉



〈mode = charged, energy = 20.0, voltage = 4.4〉↓ empty

〈mode = depleted, energy = 20.0, voltage = 4.4〉↓ · · ·




Example (Battery)

〈mode = charged, energy = 100.0, voltage = 6.0〉

↓ 30.0〈mode = charged, energy = 40.0, voltage = 6.0〉

↓ τ〈voltage:=...〉〈mode = charged, energy = 40.0, voltage = 4.8〉



↓ empty〈mode = depleted, energy = 20.0, voltage = 4.4〉

↓ · · ·




Example (Battery)







↓ · · ·




Example (Battery)







↓ · · ·




Example (Battery)







↓ · · ·




Example (Battery)







↓ · · ·




Example (Battery)






〈mode = depleted, energy = 20.0, voltage = 4.4〉

↓ · · ·




Example (Battery)






〈mode = depleted, energy = 20.0, voltage = 4.4〉↓ · · ·


Complete AADL Specifications as Networks of EDAs

Dynamic reconfiguration=⇒ component activity and port connections mode dependent

Definition (Networks of Event-Data Automata)

A network of event-data automata (NEDA) is a tuple

N = ((Ai)i∈[n], α,EC ,DC )

with n ≥ 1, [n] := {1, . . . , n}, andI each Ai an EDA Ai = (Mi,m

i0,Xi, v

i0, ιi,Ei, −→ i)

I M :=∏ni=1 Mi set of global modes

I α : M → 2[n] activation mappingI EC : M → ({i.e | i ∈ [n], e ∈ Ei})2 event connection mappingI DC : M → ({i.x | i ∈ [n], x ∈ Xi})2 data connection mapping



I AADL subcomponent in modes declarations; activation mapping:

I root component always activeI c active and in mode m, sc is subcomponent of c, sc in modes m

=⇒ sc active

Example (Power System)

For Power︸︷︷︸1

/Battery1︸︷︷︸2


:

I α(primary, charged, charged) = {1, 2}α(primary, charged, depleted) = {1, 2}

. . .α(backup, charged, depleted) = {1, 3}

. . .



I AADL event/data connections ; EC /DC mappings:follow all end-to-end chains of port connections

c c’

in−to−in

out−to−in

out−to−out

Root

Example (Power System)

For Power︸︷︷︸1



:

I EC (primary,m1,m2) = {(2.empty, 1.batt1.empty)}EC (backup,m1,m2) = {(3.empty, 1.batt2.empty)}

DC (primary,m1,m2) = {(2.voltage, 1.voltage)}DC (backup,m1,m2) = {(3.voltage, 1.voltage)}


LTS Semantics of NEDAs

I States := (M1 ×V1)× . . .× (Mn ×Vn)I Transitions determined by active EDAs:

1. Perform local transitions:I timed local transition in all EDAs orI internal transition in EDA orI multiway event communication from EDA to ≥ 1 connected EDAs

2. Initialize (re-)activated subcomponents3. Establish consistency w.r.t. DC (copy source→ target data port)

Example (Power system)〈m=primary, v=6.0〉〈m=charged, e=100.0, v=6.0〉〈m=charged, e=100.0, v=6.0〉

⇓ 40.0〈m=primary, v=6.0〉〈m=charged, e=20.0, v=6.0〉〈m=charged, e=100.0, v=6.0〉

⇓ τ〈voltage:=...〉〈m=primary, v=4.4〉〈m=charged, e=20.0, v=4.4〉〈m=charged, e=100.0, v=6.0〉

⇓ τ〈empty〉〈m=backup, v=6.0〉〈m=depleted, e=20.0, v=4.4〉〈m=charged, e=100.0, v=6.0〉

⇓ 40.0〈m=backup, v=6.0〉〈m=depleted, e=20.0, v=4.4〉〈m=charged, e=20.0, v=6.0〉

⇓ · · ·











⇓ · · ·











⇓ · · ·











⇓ · · ·











⇓ · · ·











⇓ · · ·











⇓ · · ·


Injecting Faults

Specifying Faulty Behavior

error model BatteryFailurefeatures

ok: initial state;dead: error state;batteryDied: out error propagation;

end BatteryFailure;

error model implementation BatteryFailure.Impevents

fault: error event occurrence poisson 0.01;transitions

ok -[fault]-> dead;dead -[batteryDied]-> dead;

end BatteryFailure.Imp;

Fault InjectionIn error state dead, voltage:=0


Specifying Faulty Behavior

error model BatteryFailurefeatures

ok: initial state;dead: error state;batteryDied: out error propagation;

end BatteryFailure;

error model implementation BatteryFailure.Impevents

fault: error event occurrence poisson 0.01;transitions

ok -[fault]-> dead;dead -[batteryDied]-> dead;

end BatteryFailure.Imp;

Fault InjectionIn error state dead, voltage:=0


Battery ComponentNominal Specification


batteryDied: out event port;

end Battery;


modescharged: activation mode while ...;

charged#ok: activation mode while ...;

depleted: mode while ...;

depleted#ok, charged#dead, depleted#dead: mode while ...;

transitionscharged -[then voltage:=...]-> charged;

charged#ok -[then voltage:=...]-> charged#ok;

charged -[empty when energy<=20.0]-> depleted;

charged#ok -[empty when energy<=20.0]-> depleted#ok;

depleted -[then voltage:=...]-> depleted;

depleted#ok -[then voltage:=...]-> depleted#ok;charged#ok -[then voltage:=0]-> charged#dead;depleted#ok -[then voltage:=0]-> depleted#dead;charged#dead -[then voltage:=0]-> charged#dead;charged#dead -[empty when energy<=20.0]-> depleted#dead;depleted#dead -[then voltage:=0]-> depleted#dead;depleted#dead -[batteryDied]-> depleted#dead;charged#dead -[batteryDied]-> charged#dead;

end Battery.Imp;2009,Viet Yen Nguyen 19/23

Battery Component After Model ExtensionProduct Construction for Modes and Error States



end Battery;


modescharged#ok: activation mode while ...;depleted#ok, charged#dead, depleted#dead: mode while ...;

transitionscharged -[then voltage:=...]-> charged;

charged#ok -[then voltage:=...]-> charged#ok;

charged -[empty when energy<=20.0]-> depleted;

charged#ok -[empty when energy<=20.0]-> depleted#ok;

depleted -[then voltage:=...]-> depleted;

depleted#ok -[then voltage:=...]-> depleted#ok;charged#ok -[then voltage:=0]-> charged#dead;depleted#ok -[then voltage:=0]-> depleted#dead;charged#dead -[then voltage:=0]-> charged#dead;charged#dead -[empty when energy<=20.0]-> depleted#dead;depleted#dead -[then voltage:=0]-> depleted#dead;depleted#dead -[batteryDied]-> depleted#dead;charged#dead -[batteryDied]-> charged#dead;


Battery Component After Model ExtensionIntegrate Nominal Transitions



end Battery;



transitionscharged#ok -[then voltage:=...]-> charged#ok;charged#ok -[empty when energy<=20.0]-> depleted#ok;depleted#ok -[then voltage:=...]-> depleted#ok;

charged#ok -[then voltage:=0]-> charged#dead;depleted#ok -[then voltage:=0]-> depleted#dead;charged#dead -[then voltage:=0]-> charged#dead;charged#dead -[empty when energy<=20.0]-> depleted#dead;depleted#dead -[then voltage:=0]-> depleted#dead;depleted#dead -[batteryDied]-> depleted#dead;charged#dead -[batteryDied]-> charged#dead;


Battery Component After Model ExtensionAdd Fault Injections



end Battery;



transitionscharged#ok -[then voltage:=...]-> charged#ok;charged#ok -[empty when energy<=20.0]-> depleted#ok;depleted#ok -[then voltage:=...]-> depleted#ok;charged#ok -[then voltage:=0]-> charged#dead;depleted#ok -[then voltage:=0]-> depleted#dead;

charged#dead -[then voltage:=0]-> charged#dead;charged#dead -[empty when energy<=20.0]-> depleted#dead;depleted#dead -[then voltage:=0]-> depleted#dead;depleted#dead -[batteryDied]-> depleted#dead;charged#dead -[batteryDied]-> charged#dead;


Battery Component After Model ExtensionNominal Transitions with Fault Effects



end Battery;



transitionscharged#ok -[then voltage:=...]-> charged#ok;charged#ok -[empty when energy<=20.0]-> depleted#ok;depleted#ok -[then voltage:=...]-> depleted#ok;charged#ok -[then voltage:=0]-> charged#dead;depleted#ok -[then voltage:=0]-> depleted#dead;charged#dead -[then voltage:=0]-> charged#dead;charged#dead -[empty when energy<=20.0]-> depleted#dead;depleted#dead -[then voltage:=0]-> depleted#dead;

depleted#dead -[batteryDied]-> depleted#dead;charged#dead -[batteryDied]-> charged#dead;


Battery Component After Model ExtensionAdd Error Propagations

device type Batteryfeaturesempty: out event port;voltage: out data port real initially 6.0;batteryDied: out event port;

end Battery;



transitionscharged#ok -[then voltage:=...]-> charged#ok;charged#ok -[empty when energy<=20.0]-> depleted#ok;depleted#ok -[then voltage:=...]-> depleted#ok;charged#ok -[then voltage:=0]-> charged#dead;depleted#ok -[then voltage:=0]-> depleted#dead;charged#dead -[then voltage:=0]-> charged#dead;charged#dead -[empty when energy<=20.0]-> depleted#dead;depleted#dead -[then voltage:=0]-> depleted#dead;depleted#dead -[batteryDied]-> depleted#dead;charged#dead -[batteryDied]-> charged#dead;


COMPASS Toolset &Conclusions

First Version of Toolset is Up & Running as of April 2009

AnalysesI Requirements ConsistencyI SimulationI BDD + SAT-based Bounded Model

CheckingI Hybrid Systems SMT-based

Bounded Model CheckingI Probabilistic Model CheckingI (Prob.) Dynamic Fault TreeI Failure Modes and Effects TablesI Fault ToleranceI DiagnosabilityI Fault Detection, Isolation & Recovery


Summary + What Hasn’t Been DiscussedFirst ResultFormal semantics of AADL and its Error Annex in terms of (Networkof) Event-Data Automata.

Second ResultAnalyses for correctness, performance, dependability and RAMSaspects over these models with graphical tool support.

AlsoI AADL Standards Body (plans to incorporate our extensions)I Underlying formal models (TwinPlant, Markov Chains, etc.)I Underlying algorithms (lumping, transient, SMT, etc.)I Issues (numerical stability, bottlenecks, usability, etc.)I Case studies (satellite, ETCS)I Demo of toolset (GUI and console)I Comparison to other tools and approaches (BIP, Arcade, etc.)I Methodological integration (into ECSS framework)


Summary + What Hasn’t Been DiscussedFirst ResultFormal semantics of AADL and its Error Annex in terms of (Networkof) Event-Data Automata.

Second ResultAnalyses for correctness, performance, dependability and RAMSaspects over these models with graphical tool support.

AlsoI AADL Standards Body (plans to incorporate our extensions)I Underlying formal models (TwinPlant, Markov Chains, etc.)I Underlying algorithms (lumping, transient, SMT, etc.)I Issues (numerical stability, bottlenecks, usability, etc.)I Case studies (satellite, ETCS)I Demo of toolset (GUI and console)I Comparison to other tools and approaches (BIP, Arcade, etc.)I Methodological integration (into ECSS framework)


References

By Marco Bozzano, Alessandro Cimatti, Joost-Pieter Katoen,Viet Yen Nguyen, Thomas Noll and Marco Roveri:

I Codesign of Dependable Systems: A Component-BasedModeling Language in proceedings of 7th MEMOCODE, 2009.

I The COMPASS Approach: Correctness, Modelling andPerformability of Aerospace Systems in proceedings of 28thSAFECOMP, 2009.

I Verification and Performance Evaluation of AADL Models inproceedings of ESEC/FSE, 2009.

I Model-Based Codesign of Critical Embedded Systems inproceedings of 2nd ACES-MB, 2009.

Slides of COMPASS 2009 workshop talks at ETAPS’09 are available:

compass.informatik.rwth-aachen.de


Safety, dependability and performance analysis of extended AADL models

Documents