The SynchAADL2Maude Tool Demo
Kyungmin Bae1, Peter Ölveczky2, Abdullah Al-Nayeem1, and José Meseguer1
1University of Illinois at Urbana-Champaign2University of Oslo
Bae, Ölveczky, et al. (UIUC, UiO) 1 / 35
Outline
1 Basic OSATE
2 Invoking SynchAADL2Maude
3 Synchronous AADL Constraints Checker
4 Code Generation and Simulation
5 Model Checking Synchronous AADL Models
Bae, Ölveczky, et al. (UIUC, UiO) 2 / 35
Outline
1 Basic OSATE
2 Invoking SynchAADL2Maude
3 Synchronous AADL Constraints Checker
4 Code Generation and Simulation
5 Model Checking Synchronous AADL Models
Bae, Ölveczky, et al. (UIUC, UiO) 3 / 35
OSATE
OSATE is atoolset for AADLgiven by a set ofEclipse plugins.
This is the firstscreen that youcan see when youexecute OSATE.
Bae, Ölveczky, et al. (UIUC, UiO) 4 / 35
OSATE - Importing an Example (I)
We start with asimple example.
First, we willimport the ActiveStandby example.
Bae, Ölveczky, et al. (UIUC, UiO) 5 / 35
OSATE - Importing an Example (II)
The activestandby examplein out toolwebpage can beimported as anexisting project.
Bae, Ölveczky, et al. (UIUC, UiO) 6 / 35
The Active Standby Example - Text
Main.aadl is atop-level systemfile that shows abrief architecture.
SynchAADLproperties aredeclared here, toexpress that thissystem is inSynchronousAADL
Bae, Ölveczky, et al. (UIUC, UiO) 7 / 35
The Active Standby Example - Graphic
The AADLgraphical model ofthe active standbyexample is alsogiven in the fileMain.aaxldi
Bae, Ölveczky, et al. (UIUC, UiO) 8 / 35
The Active Standby Example - XML
The AADL XMLmodel of theactive standbyexample isautomaticallygenerated byOSATE in the fileMain.aaxl
Bae, Ölveczky, et al. (UIUC, UiO) 9 / 35
The Active Standby Example - Instance Model
We can create aninstance modelfrom a systemimplementation bypressing theInstantiate
system button.
The top levelsystemimplementation ofthe active standbysystem isinstantiated here.
Bae, Ölveczky, et al. (UIUC, UiO) 10 / 35
Outline
1 Basic OSATE
2 Invoking SynchAADL2Maude
3 Synchronous AADL Constraints Checker
4 Code Generation and Simulation
5 Model Checking Synchronous AADL Models
Bae, Ölveczky, et al. (UIUC, UiO) 11 / 35
Invoking the SynchAADL2Maude Window
TheSynchAADL2-Maude windowcan be invokedfrom an AADLinstant model.
Bae, Ölveczky, et al. (UIUC, UiO) 12 / 35
AADL Maude Property Editor Wizards
From the Filemenu, we cancreate an AADLMaude PropertyEditor file.
Bae, Ölveczky, et al. (UIUC, UiO) 13 / 35
Creating an AADL Maude Property File
We can chooseany valid AADLinstance modelfrom the wizard.
Bae, Ölveczky, et al. (UIUC, UiO) 14 / 35
The SynchAADL2Maude Window
This screen showsthe SynchAADL2-Maude window.
There are fourbuttons in thiswindow:Constraints
Check,Code
Generation,Perform
Simulation, andPerform
Verification.
Bae, Ölveczky, et al. (UIUC, UiO) 15 / 35
Outline
1 Basic OSATE
2 Invoking SynchAADL2Maude
3 Synchronous AADL Constraints Checker
4 Code Generation and Simulation
5 Model Checking Synchronous AADL Models
Bae, Ölveczky, et al. (UIUC, UiO) 16 / 35
Checking SynchAADL Constraints
We can checkSynchAADLconstraints byclicking on theConstraints
Check button.
Bae, Ölveczky, et al. (UIUC, UiO) 17 / 35
SynchAADL Constraints - Erroneous Cases (I)
What if someSynchAADLconstraint is notsatisfied?
We add an invalidimmediateconnection, andsee whathappened.
Bae, Ölveczky, et al. (UIUC, UiO) 18 / 35
SynchAADL Constraints - Erroneous Cases (II)
Our tool thennotifies errors.
Bae, Ölveczky, et al. (UIUC, UiO) 19 / 35
Outline
1 Basic OSATE
2 Invoking SynchAADL2Maude
3 Synchronous AADL Constraints Checker
4 Code Generation and Simulation
5 Model Checking Synchronous AADL Models
Bae, Ölveczky, et al. (UIUC, UiO) 20 / 35
The Active Standby Example
Let us go back tothe correct model.
Bae, Ölveczky, et al. (UIUC, UiO) 21 / 35
Real-Time Maude Code Generation (I)
We canautomaticallycreate thecorrespondingReal-Time Maudemodel from aSynchronousAADL model byclicking on theCode Generation
button.
Bae, Ölveczky, et al. (UIUC, UiO) 22 / 35
Real-Time Maude Code Generation (II)
We can find thegeneratedReal-Time Maudemodel on theAADL navigatorsidebar.
Bae, Ölveczky, et al. (UIUC, UiO) 23 / 35
Maude Development Tool Setting
When a Maudefile is firstexecuted, theMDT settingwindow ispopped-up.
The correct pathsof both a Maudebinary file and aFull Maude fileshould beinserted.
If “logging to file”is enabled, weshould also inserta console logdirectory.
Bae, Ölveczky, et al. (UIUC, UiO) 24 / 35
SynchAADL Simulation in Real-Time Maude
We can simulate agiven modelwithin somebound by pressingthe PerformSimulation
button.
The result will beshown in theMaude Console.
Bae, Ölveczky, et al. (UIUC, UiO) 25 / 35
Outline
1 Basic OSATE
2 Invoking SynchAADL2Maude
3 Synchronous AADL Constraints Checker
4 Code Generation and Simulation
5 Model Checking Synchronous AADL Models
Bae, Ölveczky, et al. (UIUC, UiO) 26 / 35
XML Property File (I)
AADL Maudeproperty files areactually XMLfiles.
We can see andmodify thecontent of the fileby clicking on theright tab at thebottom.
Bae, Ölveczky, et al. (UIUC, UiO) 27 / 35
XML Property File (II)
The LTL formulascan be defined bydefinition tags.
The LTLspecifications tobe verified aredefined incommand tags.
Let us copy andpaste the propertydefinitions fromthe active standbyexample in thetool webpage.
Bae, Ölveczky, et al. (UIUC, UiO) 28 / 35
Model Checking LTL Specifications (I)
The LTLspecification to beverified are shownin the AADLProperty
Requirement
table.
Bae, Ölveczky, et al. (UIUC, UiO) 29 / 35
Model Checking LTL Specifications (II)
When we pressthe PerformVerification
button, the LTLproperties in thetable are modelchecked inReal-Time Maude.
The modelchecking resultwill be shown inthe MaudeConsole.
Bae, Ölveczky, et al. (UIUC, UiO) 30 / 35
Model Checking LTL Specifications (III)
Here is the modelchecking result ofthe active standbyexample in alarger window.
Bae, Ölveczky, et al. (UIUC, UiO) 31 / 35
Model Checking LTL Specifications (IV)
SynchAADL2-Maude creates theReal-Time Maudeverification modelfrom a XMLproperty file.
The verificationmodel can be alsofound in theAADL Navigatorsidebar.
Bae, Ölveczky, et al. (UIUC, UiO) 32 / 35
Counterexamples (I)
If a given LTLproperty is notsatisfied in amodel, then acounterexample isgenerated.
We illustrate suchcounterexampleswith an incorrectLTL specificationfor the activestandby model.
Bae, Ölveczky, et al. (UIUC, UiO) 33 / 35
Counterexamples (II)
Here is ageneratedcounterexample inSynchAADL2-Maude.
For each state, acomponent nameand its localvariables aredisplayed.
Bae, Ölveczky, et al. (UIUC, UiO) 34 / 35
Thank you!
Bae, Ölveczky, et al. (UIUC, UiO) 35 / 35
Basic OSATEInvoking SynchAADL2MaudeSynchronous AADL Constraints CheckerCode Generation and SimulationModel Checking Synchronous AADL Models
