The Emerging SAE AADL Standard An Architecture Analysis

The Emerging SAE AADL Standard: An Architecture Analysis & Design Language for Building Embedded Real-Time Systems Society of Automotive Engineers Avionic Systems Division Embedded Computing Systems Committee AS-2 C Avionics Architecture Description Language Subcommittee Software Engineering Institute Embry-Riddle Aeronautical University

Welcome Bruce Lewis Chair, SAE AS-2 C Subcommittee Army AMCOM SED bruce. lewis@sed. redstone. army. mil 256 -876 -3224 Peter Feiler Secretary & Technical Co-editor Software Engineering Institute phf@sei. cmu. edu 412 -268 -7790 John Hudak Software Engineering Institute jhudak@sei. cmu. edu 412 -268 -5291 Dave Gluch Embry-Riddle Aeronautical University & Software Engineering Institute gluchd@erau. edu/dpg@sei. cmu. edu 386 -226 -6455 http: //www. aadl. info AADL Tutorial 2

Architecture Analysis & Design Language (AADL) • Specification of computer systems and So. S. – Real-time – Embedded – Fault-tolerant – Securely partitioned – Dynamically configurable • Software task and communication architectures – Component interface and structure, behavior, properties • Bound to – Distributed multiple processor, integrated hardware architectures • Fields of application – Avionics, Automotive, Aerospace, Autonomous systems, … • Context and vocabulary for the integration of System Eng Technology – Capture of Architecture (& driving requirements), Analysis of Integration Impact (through model checking), Automated Integration to specification. AADL Tutorial 3

Typical Software Development Process Requirements Analysis Design Implementation Integration manual, paper intensive, error prone, resistant to change AADL Tutorial 4

Model-Based System Engineering Model-Based & Architecture-Driven System Integration Requirements Analysis Explicit Architecture M. Engineering Models Use of AADL Design, Analysis and Implementation AADL Tutorial Predictable System Rapid Integration Upgradeability 5

Lifecycle Impact • Requirements that impact computer software and hardware architecture modeled early with partial data • System specification refined during design, coding and integration to final system – each change modeled / model checked against multiple analysis approaches. • Specification is used to integrate system, generating middleware to control system execution and communication, generation is done in compliance with the formal analysis on RT O/S • Specification used throughout the development process – not out of date so always ready for the next system evolution and additional analysis capability. AADL Tutorial 6

AADL-Based System Engineering System Construction System Analysis • Schedulability • Performance • Reliability • Fault Tolerance • Dynamic Configurability Automatic Target Recognition Guidance & Control Mechanized Application Software Supply Chain Application Sensor Developer Ambulatory & Signal Processing • AADL Runtime System • Application Software Integration Software System Engineer Model the Architecture Abstract, but Precise Execution Platform GPS Information Fusion DB HTTPS Ada Runtime . . Devices AADL Tutorial Memory Bus Processor 7

An SAE Standard • Sponsored by – Society of Automotive Engineers (SAE) – Avionics Systems Division (ASD) – Embedded Systems (AS 2) Largest Provider of Avionics Standards – Avionics Architecture Description Language Subcommittee (AS 2 C) • Contact – Bruce Lewis AS 2 C chair, bruce. lewis@sed. redstone. army. mil – http: //www. aadl. info – For Information email to info@aadl. info • Balloted April 2004, expecting Core standard July. AADL Tutorial 8

AS-2 C ADL Subcommittee • Bruce Lewis (AMCOM): Chair, technology user • Peter Feiler (SEI): Secretary, main author, editor, technology user • Steve Vestal (Honeywell): Meta. H originator, coauthor • Ed Colbert (USC): AADL & UML Mapping • Joyce Tokar (Pyrrhus Software): Ada & C Annex Members • Boeing, Rockwell, Honeywell, Lockheed Martin, Raytheon, Smith Industries, Airbus, Axlog, Dassault, EADS , Canadair, High Integrity Systems • NAVAir, Open Systems JTF, British MOD, US Army • European Space Agency Coordination with • NATO, COTRE, OMG-UML AADL Tutorial 9

Priority Processing • Systems interested in immediate use – Common Missile (August) - Eglin AFB Weapons Integration (Toolset SBIRs) – Navy version of Black. Hawk (possibly starting training in June with pre-standard toolset) – European Space Agency (expected Fall 2004) – Airbus (prototype tool building started) – FCS and 7 E 7 (probably too late now but the sooner the better) – Plug and Play (GD Immediate) – SEI Toolset development (started) – TNI Toolset development (started) – UML/OMG RFC – waiting, need to submit ASAP AADL Tutorial 10

Meta. H Case Study at AMCOM • Missile Application reengineered – Missile on-board software and 6 DOF environment simulation executing on dual i 80960 MC, Tartan Ada, VME Boards – Built to Generic Missile Reference Architecture – Specified in Meta. H, 12 to 16 concurrent processes – Meta. H reduced total re-engineering cost 40% on first project it was used on. Missile prime estimated savings at 66%. • Missile Application ported to a new execution environment – multiple ports to single and dual processor implementations – new processors (Pentium and Power. PC), compilers, O/S – first time executable, flew correctly on each target environment – ports took a few weeks rather than 10 months. AADL Tutorial 11

AMCOM Effort Saved Using Meta. H Total project savings 50%, re-target savings 90% 8000 Benefit During Platform Retarget 7000 6000 Man Hours 5000 4000 Benefit During Application Rewrite 3000 Traditional Approach 2000 1000 0 Review 3 -DOF Trans- 6 -DOF late Using Meta. H RT 6 DOF Current Transform Test 6 DOF AADL Tutorial RTMissile Meta. H Build Debug Re-target 12

Why AADL Architecture Analysis and Design Language • Concept - Applies systems engineering (analytical) approach to software intensive systems rather than brute force. Early analysis instead of late failure. • Needed – analyzable architecture =>key to sizable decrease in rework, integration and upgrade costs as well as program risk, complexity. • Enables – rapid system evolution for complex, RT, safety critical systems with cross cutting constraints, predictable change to both HW and SW components. • Open – Becoming a Standard, SAE, NATO, UML. • Readiness - 12 years of DARPA investment + experiments • Extendable – good foundation for additional capabilities in analysis, automated system integration, system of systems, distribution, dynamics. AADL Tutorial 13

An XML-Based AADL Tool Strategy Graphical AADL Textual AADL Model XML Complete Execution Platform Binding AADL Instance XML Scheduling Analysis Commercial Tool like Time. Wiz AADL Runtime Generator Reliability Analysis Filter to Markov Analysis Safety Analysis Project-Specific In-House AADL Tutorial 14

An Open Source AADL Environment Java Development Tools (JDT) Eclipse Platform Workbench JFace SWT Plug-in Development Environment (PDE) Workspace Help Team Debug Platform Runtime AADL Textual Editor AADL Graphical Editor AADL Environment Analysis Tool Via Java Analysis Tool Via XML Eclipse Environment AADL Parser Standalone Generation Tool AADL Object API AADL Tutorial XML Document Persistence 15

Some Meta. H History Meta. H - Precursor 1991 DARPA DSSA program begins to AADL 1992 Partitioned PFP target (Tartan MAR/i 960 MC) 1994 Multi-processor target (VME i 960 MC) 1995 Slack stealing scheduler 1998 Portable Ada 95 and POSIX middleware configurations 1999 Hybrid automata verification of core middleware modules Numerous evaluation and demonstration projects, e. g. Missile G&C reference architecture, demos, others (AMCOM SED) Hybrid automata formal verification (AFOSR, Honeywell) Missile defense (Boeing) Fighter guidance SW fault tolerance (DARPA, CMU, Lockheed-Martin) Incremental Upgrade of Legacy Systems (AFRL, Boeing, Honeywell) Comanche study (AMCOM, Comanche PO, Boeing, Honeywell) Tactical Mobile Robotics (DARPA, Honeywell, Georgia Tech) Advanced Intercept Technology CWE (BMDO, Max. Tech) Adaptive Computer Systems (DARPA, Honeywell) Avionics System Performance Management (AFRL, Honeywell) Ada Software Integrated Development/Verification (AFRL, Honeywell) FMS reference architecture (Honeywell) JSF vehicle control (Honeywell) IFMU reengineering (Honeywell) AADL Tutorial 16

AADL in Context DARPA Funded Research since 1990 Research ADLs • Meta. H – Real-time, modal, system family – Analysis & generation – RMA based scheduling • Rapide, Wright, . . – Behavioral validation • ADL Interchange Ba sis Extension e c n e u l Inf – ACME, x. ADL – ADML (MCC/Open Group, TOGAF)t Industrial Strength • UML 2. 0, UML-RT • HOOD/STOOD • SDL AADL Extensible Real-time Dependable n e m n Alig nt e m ce n a Enh Airbus & ESA AADL Tutorial 17

AADL/UML Relationship To Be submitted to OMG for Adoption Extensible AADL Annexes UML Working Groups AADL Core AADL UML Profile Security Dependability UML 2. 0 UML 1. 4 Detailed design UML-RT Performance Timeliness AADL Tutorial 18

What Is Involved In Using The AADL? • Specify software & hardware system architectures • Specify component interfaces and implementation properties • Analyze system timing, reliability, partition isolation • Tool-supported software and system integration • Verify source code compliance & middleware behavior Model and analyze early and throughout product life cycle AADL Tutorial 19

A Control Engineer Perspective K 1 + - K 2 s Tune p arame Continuous feedback in a controller ters Simulink ysis nal ent A on p Com Matlab Appli with Text_IO; package Main is cation begin Code Val type real is digits 14; type flag is boolean; ida x : real : = 0. 0; ready : flag : = TRUE; te s with Text_IO; package Main is begin type real is digits 14; type flag is boolean; x : real : = 0. 0; ready : flag : = TRUE; imu lati on Continuous feedback for a control engineer AADL Tutorial 20

A Software System Engineer Perspective with Text_IO; package Main is begin Application Components type real is digits 14; type flag is boolean; Continuous feedback for software system engineer x : real : = 0. 0; ready : flag : = TRUE; Execution Platform AADL Tools package Dispatcher is AADL Runtime Timi ng a Relia bility naly sis analy sis A. p 1 : = B. p 2; Case 10 ms: dispatch(a); dispatch(b); Runtime Data T 1 T 2 T 3 T 4 12 12 5 R 16 R 2 R 3 R 4 23 34 8 8 12 12 5 6 24 23 234 23 34 8 8 24 23 234 Refine propertie s T 1 T 2 T 3 T 4 12 12 5 6 23 34 12 8 812 5 6 24 23 234 23 34 8 8 24 23 2 34 R 1 R 2 R 3 R 4 12 12 5 6 23 34 8 8 24 23 234 AADL-based Architecture Model AADL Tutorial 21

A Combined Perspective K 1 + - Matlab K 2 s Tune parameters ent Compon Appli Analysis cation Continuous interaction between Control engineer & system engineer with Text_IO; package Main is Code begin type real is digits 14; type flag is boolean; lid Va x : real : = 0. 0; ready : flag : = TRUE; with Text_IO; package Main is begin type real is digits 14; type flag is boolean; x : real : = 0. 0; ready : flag : = TRUE; e at package Dispatcher is alysi s n ity an io eliab il at Timi AADL-based ng a naly sis Architecture Models R A. p 1 : = B. p 2; Case 10 ms: dispatch(a); dispatch(b); ul m AADL Runtime si AADL Tools Simulink Runtime Data T 1 T 2 T 3 T 4 12 12 5 R 16 R 2 R 3 R 4 23 34 8 8 12 12 5 6 24 23 234 23 34 8 8 24 23 234 Refine propertie s AADL Tutorial T 1 T 2 T 3 T 4 12 12 5 6 23 34 12 8 812 5 6 24 23 234 23 34 8 8 24 23 2 34 R 1 R 2 R 3 R 4 12 12 5 6 23 34 8 8 24 23 234 22

Application Components as Plug-ins Application Software Component AADL Runtime System Real-Time Operating System Embedded Hardware Target Strong Partitioning • Timing Protection • OS Call Restrictions • Memory Protection Interoperability/Portability • Tailored Runtime Executive • Standard RTOS API • Application Components AADL Tutorial 23

Predictable System Integration • Required, predicted, and actual runtime properties • Application components designed against functional and non-functional properties • Application code separated from task dispatch & communication code • Consistency between task & communication model and implementation through generation • Feedback into model parameters: refinement of estimated performance values AADL Tutorial 24

Potential Users New System Engineering Approach based on AADL • • • Airbus ESA Rockwell Collins Lockheed Martin Smith Industries Raytheon Boeing FCS Automotive OEPs Common Missile RT Plug and Play Modeling of Satellite Systems, proposed ASSERT with AADL Modeling of Helicopter Avionics Software System New System Engineering tools using AADL. Leading Candidate for system of systems modeling, analysis Adopted for system integration analysis to support standard AADL Tutorial 25

AADL Components - Graphical Application Software Execution Platform data device Thread process memory bus System Composition processor System AADL Tutorial 26

Modeling Vocabulary • Application System – – – – Thread Group Process System Package Subprogram Data (shared/message) Data Port Event Data Port Connection Mode • Execution Platform – – – • Processor Memory Device Bus System Extension – Inheritance – Properties – Sublanguages (safety, flow, user defined, … component behavior …. ) – Domain Specific Annexes AADL Tutorial 27

Graphical & Textual Notation system Data_Acquisition provides speed_data: in data metric_speed; GPS_data: in data position_carthesian; user_input_data: in data user_input; s_control_data: out data state_control; data port data type of port end Data_Acquisition; speed _data Data_Acquisition s_control_data GPS _data user input data port AADL Tutorial 28

AADL Component Interaction 1553 Flight Mgr • Unidirectional data & event flow • Synchronous call/return • Managed shared data access data Weapons Mgr MFD Pilot Warnings Annunciations MFD Copilot AADL Tutorial 29

Application System & Execution Platform 1553 Flight Mgr Application system binding to execution platform Weapons Mgr MFD Pilot Warnings Annunciations data MFD Copilot High speed network Mission Processor 1553 bus Display Processor Pilot Display Co. Pilot Display AADL Tutorial 30

Thread Properties • • • Dispatch_Protocol => Periodic; Period => 100 ms; Dispatch execution Compute_Deadline => Period; properties Compute_Execution_Time => 20 ms; Initialize_Deadline => 10 ms; Initialize_Execution_Time => 1 ms; Compute_Entrypoint => “Calculate_Trajectory”; Source_Text => “waypoint. java”; Source_Code_Size => 1. 2 KB; Code function to be executed on dispatch Source_Data_Size =>. 5 KB; File containing the application code AADL Tutorial 31

Thread Hybrid Automata AADL Tutorial 32

Task & Interaction Architecture System 1 Typed and constrained data streams Immediate and delayed communication System Subsystem 1 Thread Dispatch Protocols Periodic Aperiodic Sporatic Background Client - Server Process Prc 1 Data 1: Pos Shared data Thread T 3 E 1 Process Prc 2 Data 1: Pos Thread T 1 Data 1: Pos Server Thread T 2 Data 1 E 1 SP 1 Thread T 1 RSP 1 Subprogr SP 2 Thread T 2 E 1 SP 3 Directional Data, event, message ports Queued and unqueued xfer Call/Return Local subprogram Client/server subprogram AADL Tutorial Shared Access Persistent, shareable data Access coordination 33

Thread States Uninitialized Thread Initialize Active Member of current mode Initialize. Complete: Inactive Not member of current mode Initialized Thread Inactive. Init. Mode: Activate Inactive Active. In New. Mode: Active. Init. Mode: Activate. Complete: Active Dispatch: Suspended Complete: Compute Fault: Repaired: Deactivate. Complete: Deactivate Recovered: Recover Inactive. In. New. Mode: Terminate: Thread State with Source Code Execution Finalize. Complete: Terminated Thread Application Source Entrypoints Application as Plug-in AADL Tutorial 34

Hierarchical Modes System 1 Mode as Alternative Configuration E 1 A System Subsystem 1 Initial Mode A: Prc 1, Prc 2; Mode B: Prc 1, Prc 3; Initial Mode A: T 1, T 2, T 3; Mode B: T 1, T 2; Process Prc 3 Process Prc 1 E 1 A Data 1: Pos Shared data Thread T 3 E 1 Process Prc 2 Data 1: Pos Thread T 1 Data 1: Pos Data 1 Server Thread T 2 E 1 SP 1 Thread T 1 RSP 1 Subprog SP 2 SP 3 E 1 Thread T 2 A Application Source Internal Mode Conditional code AADL Tutorial E 1 35

Systems & Execution Platforms Processors, buses, memory, and devices as Virtual Machines System 1 System Linux. Net System Linux. Box System Subsystem 1 Memory Process Prc 1 Process Prc 2 Processor PC 1 Bus Thread T 3 Memory Processor PC 2 Threads as logical unit of concurrency AADL Tutorial 36

AADL and Scheduling • AADL provides precise dispatch & communication semantics via hybrid automata • AADL task & communication abstraction does not prescribe scheduling protocols – Cyclic executive can be supported • Specific scheduling protocols may require additional properties • Predefined properties support rate-monotonic fixed priority preemptive scheduling This scheduling protocol is analyzable, requires small runtime footprint, provides flexible runtime architecture AADL Tutorial 37

Faults and Modes • AADL provides a fault handling framework with precisely defined actions • AADL supports runtime changes to task & communication configurations • AADL defines timing semantics for task coordination on mode switching • AADL supports specification of mode transition actions • System initialization & termination are explicitly modeled AADL Tutorial 38

Behavior Modeling • Operational modes (in core AADL) • Runtime reconfiguration (in core AADL) • End-to-end flows (in core AADL) State reachability Flow traceability • Interaction behavior (extension) – Port interaction pattern of component – Interaction protocol of connection Protocol verification Model checking • Error models & reliability analysis (extension) AADL Tutorial 39

System Safety Engineering Capture the results of • hazard analysis • component failure modes & effects analysis Specify and analyze Supported by Error • fault trees Model Annex • Markov models • partition isolation/event independence Integration of system safety with architectural design • enables cross-checking between models • insures safety models and design architecture are consistent • reduces specification and verification effort AADL Tutorial 40

AADL Version 2 Research Ideas • 1. Dynamic Reconfigurable Real-Time Fault-Tolerant Asynchronous Architectures • 2. Additional trackable automated modeling and analysis methods for architectural specs (composition, pattern recognition to reduce state space) • 3. Rigorous links/relations between multiple engineering modeling approaches – Simulink/VHDL – AADL, SDL – AADL, compositional scheduling • 4. Architectural verification -(is the Architecture spec correct and do components comply with their specs, stronger plug and play ) • 5. Mode transition modeling, state space reduction for mode analysis/scheduling • 6. Modeling of specific system building approaches/patterns – example RT CORBA that can be applied as abstractions at a higher level but used to generate an implementation. • 7. Modeling sublanguages and properties to support special areas of analysis for high integrity systems – Current Error modeling annex, safety and security annex, component behavior annex etc. AADL Tutorial 41

AADL Status • Requirements document SAE ARD 5296 – Input from aerospace industry – Balloted and approved in 2000 • SAE AADL document SAE AS 5506 – Core language: In ballot April 2004, July availability – UML profile, XML schema, Error Model Annex, Ada and C Annex in review, to be balloted in June 2004 AADL Tutorial 42