The "operational approach" to software development is based on separation of problem-oriented and implementation-oriented concerns, and features executable specifications and transformational implementation. "Operational specification languages" are ...

Abstract Distributed, software-intensive systems (e.g., in the automotive sector) must fulfill communication requirements under hard real-time constraints. The requirements have to be documented and validated carefully using a systematic requirements engineering (RE) approach, for example, by applying scenario-based requirements notations. The resources of the execution platforms and their properties (e.g., CPU frequency or bus throughput) induce effects on the timing behavior, which may lead to violations of the real-time requirements. Nowadays, the platform properties and their induced timing effects are verified against the real-time requirements by means of timing analysis techniques mostly implemented in commercial-off-the-shelf tools. However, such timing analyses are conducted in late development phases since they rely on artifacts produced during these phases (e.g., the platform-specific code). In order to enable early timing analyses already during RE, we extend a scenario-based requirements notation with allocation means to platform models and define operational semantics for the purpose of simulation-based, platform-aware timing analyses. We illustrate and evaluate the approach with an automotive software-intensive system.

LINGUA Franca (lf) is a polyglot coordination language designed for the composition of concurrent, time-sensitive, and potentially distributed reactive components called reactors. The LF coordination layer facilitates the use of target languages (e.g., C, C++, Python, TypeScript) to realize the program logic, where each target language requires a separate runtime implementation that must correctly implement the reactor semantics. Verifying the correctness of runtime implementations is not a trivial task, and is currently done on the basis of regression testing. To provide a more formal verification tool for existing and future target runtimes, as well as to help verify properties of LF programs, we recruit the use of GemocStudio-an Eclipse-based workbench for the development, integration, and use of heterogeneous executable modeling languages. We present an operational model for LF, realized in GEmocStudio, that is primed to interact with a rich set of analysis and verification tools. Our instrumentation provides the ability to navigate the execution of LF programs using an omniscient debugger with graphical model animation; to check assertions in particular execution runs, or exhaustively, using a model checker; and to validate or debug traces obtained from arbitrary LF runtime environments.

System Engineering involves several disciplines to design, develop and verify complex systems, using different modeling languages with different semantics. A simulation of the global behavior from the heterogeneous executable models is used to verify and validate the emerging behavior of the system. Co-simulation is a way to realize this simulation but it requires coordinating the different heterogeneous artifacts. This coordination is not a trivial task due to the increasing complexity and heterogeneity. In this paper, we propose a language that enables the specification of a coordination between models and the automatic generation of a dedicated coordinator (Master Algorithm) concerning the coordination and the behavioral semantics of the executable models.

Synchronous languages, such as the recently proposed SCCharts language, have been designed for the rigorous specification of real-time systems. Their sound semantics, which builds on an abstraction from physical execution time, make these languages appealing, in particular for safety-critical systems. However, they traditionally lack built-in support for physical time. This makes it rather cumbersome to express things like time-outs or periodic executions within the language. We here propose several mechanisms to reconcile the synchronous paradigm with physical time. Specifically, we propose extensions to the SCCharts language to express clocks and execution periods within the model. We draw on several sources, in particular timed automata, the Clock Constraint Specification Language, and the recently proposed concept of dynamic ticks. We illustrate how these extensions can be mapped to the SCChart language core, with minimal requirements on the run-time system, and we argue that the same concepts could be applied to other synchronous languages such as Esterel, Lustre or SCADE.

International audience

The development of Cyber Physical Systems (CPS) requires to model both the cyber (i.e., digital) parts, the physical parts and the interaction between them. The state of the practice in such domain usually involves different stakeholders, which use dedicated modeling languages tailored syntactically and semantically to their domain. Functional Mock-up Interface (FMI) is a recent standard, which provides technical facilities to enable the co-simulation among the different dedicated modeling languages. In this context, this paper investigates how discrete-event models of the cyber part are supported by FMI standard for co-simulation. Two main results are presented: 1) how SystemC models can be integrated into the FMI environment and 2) FMI limitations for the efficient use of discrete-event models in co-simulation. Both results are illustrated by using a simple but illustrative use case mixing models in SystemC (for the cyber part) and Modelica (for the physical part).

The design of complex systems involves various, possibly heterogeneous, structural and behavioral models. In model-driven engineering, the coordination of behavioral models to produce a single integrated model is necessary to provide support for validation and verification. Indeed, it allows system designers to understand and validate the global and emerging behavior of the system. However, the manual coordination of models is tedious and error-prone, and current approaches to automate the coordination are bound to a fixed set of coordination patterns. In this paper, we propose a Behavioral Coordination Operator Language (B-COoL) to reify coordination patterns between specific domains by using coordination operators between the Domain-Specific Modeling Languages used in these domains. Those operators are then used to automate the coordination of models conforming to these languages. We illustrate the use of B-COoL with the definition of coordination operators between timed finite state machines and activity diagrams.

The emergence of modern concurrent systems (e.g., Cyber- Physical Systems or the Internet of Things) and highly- parallel platforms (e.g., many-core, GPGPU pipelines, and distributed platforms) calls for Domain-Specific Modeling Languages (DSMLs) where concurrency is of paramount im- portance. Such DSMLs are intended to propose constructs with rich concurrency semantics, which allow system design- ers to precisely define and analyze system behaviors. How- ever, specifying and implementing the execution semantics of such DSMLs can be a difficult, costly and error-prone task. Most of the time the concurrency model remains implicit and ad-hoc, embedded in the underlying execution environ- ment. The lack of an explicit concurrency model prevents: the precise definition, the variation and the complete under- standing of the semantics of the DSML, the effective usage of concurrency-aware analysis techniques, and the exploitation of the concurrency model during the system refinement (e.g., during its allocation on a specific platform). In this paper, we introduce a concurrent executable metamodeling approach, which supports a modular definition of the execution seman- tics, including the concurrency model, the semantic rules, and a well-defined and expressive communication protocol between them. Our approach comes with a dedicated meta- language to specify the communication protocol, and with an execution environment to simulate executable models. We illustrate and validate our approach with an implementation of fUML, and discuss the modularity and applicability of our approach.

To deal with the high complexity of embedded systems, engineers rely on high-level heterogeneous models that combine functional and non-functional aspects, hardware/software artifacts, structural and behavioral descriptions. PRISMSYS is a system-level multi-view modeling framework, which provides a means to specify functional and non-functional aspects in interrelated views. Each concern/view is addressed separately with a dedicated set of models and correspondence rules, maintaining the semantic consistency between those different views. The behavioral specification mixes UML state machines with equational models defined as SYSML parametric diagrams. To supply a complete non-functional property-aware simulation environment, it is mandatory to formalize 1) the execution semantics of the UML state machines, 2) the SYSML parametric diagrams and 3) the coordination between them. This is achieved by using CCSL, the Clock Constraint Specification Language, to provide an event-based semantics for each model and their coordination. The proposed co-simulation framework combines TIMESQUARE, a discrete event simulator for CCSL, and Scilab, a tool for numerical computation. The framework is illustrated on a CPU thermal manager case study with a joint simulation of both its functional and non-functional models.

Modeling and analysis of non-functional properties are central concerns in distributed real-time embedded systems. In automotive domain, EAST-ADL is one of the main architectural modeling approaches for real-time embedded systems. In our previous work we introduced the Timing Augmented Description Language V2 (TADL2), which is the new release of the time model for EAST-ADL. It provides new modeling capabilities such as explicit notion of timebase and symbolic timing expressions. In this paper we propose an approach to simulate and analyze TADL2 timing constraints. The formal semantics of TADL2 is given by an exogenous model transformation in QVTo to the Clock Constraint Specification Language (CCSL), a formal language that implements the MARTE Time Model. With this transformation, the analysis of TADL2 constraints become possible through TimeSquare framework dedicated to the analysis of CCSL specifications. The approach is illustrated on the Brake-By-Wire example.

This paper presents an approach for modeling simulating and analyzing multi clocks real time systems during the different steps of a design. These steps range from the first requirements to a model allocated on a specific execution platform. The UML MARTE profile and the CCSL language are used together to specify the causal and temporal characteristics of the software as well as the hardware parts of the system. The TimeSquare environment allows a simulation of such specification and the detection of potential errors and deadlocks. When the specification refinement is finished, to prove the specification correctness, the CCSL specification is used to generate a synchronous model and some observers in Esterel. We illustrate the approach through a spark ignition control system.

The UML Profile for Modeling and Analysis of Real-Time and Embedded systems (MARTE) has been recently adopted. The Clock Constraint Specification Language (CCSL) allows the specification of causal, chronological and timed properties of MARTE models. Due to its purposely broad scope of use, CCSL has an expressiveness that can prevent formal verification. However, when addressing hardware electronic systems, formal verification is an important step of the development. The IEEE Property Specification Language (PSL) provides a formal notation for expressing temporal logic properties that can be automatically verified on electronic system models. In this paper, we determine the part of MARTE/CCSL amenable to support the classical analysis methods from the Electronic Design Automation (EDA) community by comparing \ccsl and PSL expressiveness. We show that neither of these languages is subsumed by the other one. We identify and restrict the CCSL constructs that cannot be expressed in temporal logics so that \ccsl become tractable in temporal logics. Conversely, we also identify the class of PSL formulas that can be encoded in CCSL. We define translations between these fragments of CCSL and PSL using automata as an intermediate representation.

This presentation demonstrates the early results from the French ANR project RT-Simex. RT-Simex proposes a set of tools to analyze parallel embedded code and trace the simulation results back to the initial models from which the code was generated. The whole tool-set relies on standard formats (UML MARTE, Open Trace Format) to ensure a perennial use. The main difficulty is to reconcile different execution traces extracted from codes running concurrently on different unsynchronized platforms. This is achieved through the polychronous logical time model of MARTE.

AADL and MARTE are two modeling formalisms supporting the analysis of real-time embedded systems. Since both cover similar aspects, a clear assessment of their respective strength and weakness is required. Building on previous works, we focus here on the time aspects of the two specifications. Relying on the MARTE Time Model and the operational semantics of its companion language CCSL we attempt to equip UML activities with the executionsemantics of an AADL specification. This is part of a muchbroader effort to build a generic simulator for UML modelswith the semantics explicitly defined within the model.

This document presents a simulation-based method for the development of real time embedded systems. This kind of system is really sensitive to the communication with external environment and the Quality of Service (QoS) provided by the used target. So, the method is MDA-based and proposes to separate the concerns, introducing a communication layer with the outside environment, an application layer and a connection layer between these two layers. Then, it is possible to emulate each part on the system in order to validate it.

This document presents a MDA-based method for the development of systems dedicated to process control. It proposes to introduce a first sensors/actuators independent model. QoS semantic definitions are then stated; thus, dealing with quality of service (QoS) requirements is a way to safely introduce sensors/actuators in the model.