The development of distributed computing systems and of their usage in domains such as the Internet of Things, Big Data, etc., raises numerous questions on the tools available to model the complexity of such systems. Non-formal modeling methods fail to create a rigorous way to describe and analyze these systems. In this paper, we propose an approach to model and analyze the structural and behavioural aspect of these systems using formal techniques. As a prerequisite, we build reusable model libraries to specify and verify communication paradigms for modeling software architectures of distributed systems in a component-based system engineering (CBSE) context. First, we describe high-level concepts for system architecture in a component-port-connector fashion as a metamodel. Then, we develop an Event-B interpretation of the metamodel adding communication characteristics such as buffering, FIFO and synchronicity. To validate our work, we studied the two well-known communication paradigms, namely message passing and remote procedure call.

Abstract First-Order Linear Temporal Logic (FOLTL) is particularly convenient to specify distributed systems, in particular because of the unbounded aspect of their state space. We have recently exhibited novel decidable fragments of FOLTL which pave the way for tractable verification. However, these fragments are not expressive enough for realistic specifications. In this paper, we propose three transformations to translate a typical FOLTL specification into two of its decidable fragments. All three transformations are proved sound (the associated propositions are proved in Coq) and have a high degree of automation. To put these techniques into practice, we propose a specification language relying on FOLTL, as well as a prototype which performs the verification, relying on existing model checkers. This approach allows us to successfully verify safety and liveness properties for various specifications of distributed systems from the literature.

Smart contracts are the artifact of the blockchain that provides immutable and verifiable specifications of physical transactions. Solidity is a domain-specific programming language with the purpose of defining smart contracts. It aims at reducing the transaction costs occasioned by the execution of contracts on the distributed ledgers such as Ethereum. However, Solidity contracts need to adhere to safety and security requirements that require formal verification and certification. This paper proposes a method to meet such requirements by translating Solidity contracts to Event-B models, supporting certification. To that purpose, we define a restrained Solidity subset and a transfer function that translates Solidity contracts to Event-B models. Besides, we have implemented a translator to improve the conversion efficiency. As a case study, we take advantage of Event-B method capabilities to simulate models at different levels of abstraction and to express the properties of a typical smart contract: Honeypot contract. Lastly, we verify the generated proof obligations of the Event-B model with the help of the Rodin platform.

Abstract Machine learning (ML) is used increasingly in safety-critical systems to provide more complex autonomy to make the system to do decisions by itself in uncertain environments. Using ML to learn system features is fundamentally different from manually implementing them in conventional components written in source code. In this paper, we make a first step towards exploring the architecture modeling of safety-critical autonomous systems which are composed of conventional components and ML components, based on natural language requirements. Firstly, augmented intelligence for restricted natural language requirement modeling is proposed. In that, several AI technologies such as natural language processing and clustering are used to recommend candidate terms to the glossary, as well as machine learning is used to predict the category of requirements. The glossary including data dictionary and domain glossary and the category of requirements will be used in the restricted natural language requirement specification method RNLReq, which is equipped with a set of restriction rules and templates to structure and restrict the way how users document requirements. Secondly, automatic generation of SysML architecture models from the RNLReq requirement specifications is presented. Thirdly, the prototype tool is implemented based on Papyrus. Finally, it presents the evaluation of the proposed approach using an industrial autonomous guidance, navigation and control case study.

Requirements traceability is broadly recognized as a critical element of any rigorous software development process, especially for building safety-critical software (SCS) systems. Model-driven development (MDD) is increasingly used to develop SCS in many domains, such as automotive and aerospace. MDD provides new opportunities for establishing traceability links through modeling and model transformations. Architecture Analysis and Design Language (AADL) is a standardized architecture description language for embedded systems, which is widely used in avionics and aerospace industries to model safety-critical applications. However, there is a big challenge to automatically establish the traceability links between requirements and AADL models in the context of MDD, because requirements are mostly written as free natural language texts, which are often ambiguous and difficult to be processed automatically. To bridge the gap between natural language requirements (NLRs) and AADL models, we propose an approach to generate the traceability links between NLRs and AADL models. First, we propose a requirement modeling method based on the restricted natural language, which is named as RM-RNL. The RM-RNL can eliminate the ambiguity of NLRs and barely change engineers' habits of requirement specification. Second, we present a method to automatically generate the initial AADL models from the RM-RNLs and to automatically establish traceability links between the elements of the RM-RNL and the generated AADL models. Third, we refine the initial AADL models through patterns to achieve the change of requirements and traceability links. Finally, we demonstrate the effectiveness of our approach with industrial case studies and evaluation experiments.

The specification and the verification of security requirements is one of the major computer-based systems challenges. Security requirements need to be precisely specified before a tool can manipulate them, and though several approaches to security requirements specification have been proposed, they do not provide the scalability and flexibility required in practice. We take this problem towards an integrated approach for security requirement specification and treatment during the software architecture design time. The general idea of the approach is to: (1) specify security requirements as properties of a modeled system in a technology-independent specification language; (2) implement the developed model in a suitable language with tool support for requirement satisfaction through model verification; and (3) suggest a set of security policies to constrain the operation of the system and to guarantee the security properties. In the scope of this paper, we use first-order logic as a formalism that is abstract and technology-independent and Alloy as a tooled language used in modeling and software development. To validate our work, we explore a set of representative security properties from categories based on CIA classification in the context of secure component-based software architecture development.

AADL is a modeling language to design and analyze embedded real-time systems and is widely used to model safety-critical systems. AADL describes the system models hierarchically through components such as systems, processes, and threads, etc. The Behavioral Annex is a supplement of AADL in terms of functional behavior. It enables modeling component and component interaction behavior in a state-machine-based annex sublanguage. At present, there is no mechanism to represent hierarchical automata in the behavioral annex. However, this is a very important feature because industrial complex systems are always described with concurrent and composite states. Although we can model a system with AADL's own hierarchical description capabilities, it will result in a large amount of threads. In actual development, a refinement process is always needed before system synthesis, in which several threads may be combined into one thread that has concurrent and composite states. This paper proposes a hierarchical extension of the AADL behavioral annex which is named HBA (Hierarchical Behavior Annex). First, the formal syntax of HBA is given, and then we formally define the semantics of HBA. We propose a meta-model of HBA and implement its textual and graphical editor in the OSATE environment. Finally, an industrial case study is given to validate the approach.

In this paper, we are concerned by the elaboration of generic development steps for the code generation for synchronous languages. Our aim is to provide a correct by construction solution. For that purpose, we adopt a refinement-based approach where proof obligations for each step guarantee properties preservation. We use the Event-B formal method. We start with a big step semantics specified by an Event-B machine. Through a sequence of refinements, expressed as Event-B refinement machines, we end up with a code generation step which implements a small step semantics preserving the properties of the big step semantics.

In this paper, we investigate how patterns could be used in order to generate Event-B refinements automatically through DSL(s) for temporal, timed or distribution patterns. Our ultimate goal is to generate code for a concurrent, or distributed framework, e.g., BIP.

SIGNAL belongs to the synchronous languages family. Such languages are widely used in the design of safety-critical real-time systems such as avionics, space systems, and nuclear power plants. This paper reports a key step of a verified SIGNAL compiler prototype, that is the transformation from a subset of SIGNAL to S-CGA (a variant of clocked guarded actions) and the proof of semantics preservation. Compared with the existing SIGNAL compiler, we use clocked guarded actions as the intermediate representation, to integrate more synchronous programs into our verified compiler prototype in the future. However, in contrast to the SIGNAL language, clocked guarded actions can evaluate a variable even if its clock does not hold. Thus, we propose a variant of clocked guarded actions, namely S-CGA, which constrains variable accesses as done by SIGNAL. To conform with the revised semantics of clocked guarded actions, we also do some adjustments on the existing translation rules from SIGNAL to clocked guarded actions. Finally, the verified transformation is mechanized in the theorem prover Coq.

Formal specification languages have a lot of notions in common. They all introduce entities usually called processes, offer similar operators, and most importantly define their operational semantics based on labeled transition systems (LTS). However, each language defines specific synchronizing and/or memory structures. For instance, in CSP, the synchronization is defined between identical events, while in CCS and in synchronization vectors-based views it is defined respectively between complementary events or between possibly different events. In this paper, we aim at capturing some similarities of specification languages by defining a label-based composition formal framework. Firstly, we define a high-level synchronization mechanism in the form of an abstract label structure. We then couple this label structure with several compositional operations and properties. Secondly, we introduce an LTS-based behavioral framework and define a unique LTS composition operator which is reused to define syntactic composition of extended transition systems and a compositional semantics.

High-level requirements of real-time systems like as time constraints, communications and execution schedulability make the verification of real-time models arduous, where a system is the interaction of a possibly unbounded set of components. Priorities have been introduced to resolve execution conflicts, and by that, prevent the combinatorial explosion of state space. In this paper, we are interested in the composition and refinement of timed systems by considering static and dynamic priorities. Firstly, we propose a revised definition of the product of extended timed transition systems with static and dynamic priorities associated to individual transitions. Afterwards, we study the(compositional) refinement of compound extended timed systems. Without sacrificing compositionality, we instantiate this framework for the case of UPPAAL networks of timed automata with static priority Committed ness, dynamic priority between channels and priority between processes. Moreover, we show how to associate an Extended Timed Transition System (ETTS) to timed automata (TA), where an unique generalized dynamic priority system of ETTS is derived from both dynamic priority orders: priority between channels and priority between processes.

The analysis and verification of an AADL model usually requires its transformation into the meta-model of this model-checker or that schedulability analysis tool. However, one challenging problem is to prove that the transformation into the target model of computation (MoC) preserves the semantics of the original AADL model or at least some of its properties. Moreover, the AADL standard lacks a formal semantics to make the validation of this translation possible. Albeit some of the related works give informal explanations on the model transformations they apply to interpret or compile AADL, the formal proof of semantics preservation remains in most cases altogether impossible. Our contribution is to bridge this gap by providing two formal semantics for a synchronous subset of AADL, which includes periodic threads and data port communications. Its operational semantics is formalized as a TTS (Timed Transition System). This formalization is one prerequisite to the formal proof of semantics preservation for our model transformation from AADL sources to our target verification formalism: TASM (Timed Abstract State Machine). In this paper, an abstract syntax of (our subset of) AADL is given, together with the abstract syntax of TASM. The translation is formalized by a family of semantics functions, which associates each AADL construct to a TASM fragment. Then, the proof of simulation equivalence between the TTSs of the AADL and the TASM models is formalized and mechanized using the proof assistant Coq.

Designing safety critical systems is a complex task due to the need of guaranteeing that the resulting model can cope with all the functional and non-functional requirements of the system. Obtaining such guarantees is only possible with the use of model verification techniques. This paper presents an approach aimed to fulfill the needs of critical system design. The proposed approach is based on the Architecture Analysis and Design Language (AADL), which is suitable to describe the system's architecture. A sequence of model transformations facilitates the verification of the designed AADL model and so assures its correctness. It must be highlighted that this is not performed in a single step, as it is possible to verify AADL models with different abstraction levels, which allows successive refinements in a top-down approach.

This paper presents some real-time concepts as they are found in the AADL language and proposes their expression in two formalisms suitable for formal analysis: FIACRE which is based on timed transition systems and TASM which extends abstract state machines with resource consumption mechanisms.

In this paper we study the mode concept in asynchronous systems. First, we propose an abstract TLA+ specification. Then, we discuss how the mode concepts proposed by the two architecture languages: Giotto and AADL could be related to this abstraction.

In this paper, we present an evaluation of the AADL Behavioural Annex that is currently in evaluation phase. We relate our experiment with respect to a development concerning the reengineering of a flight software. This experiments has led us to introduce hierarchical aspects and study the link especially with AADL modes. We discuss about the definition of a semantics for the AADL execution model and propose some enhancements.