The polychronous or multi-clock paradigm is adequate to model large distributed systems where achieving a full timed synchronization is not only very costly but also often not necessary. It concerns systems made of a set of components with loose synchronization constraints. We study an approach where those components are orchestrated using logical clocks , made popular by L. Lamport and synchronous languages. The temporal and causal specification of those systems is built by defining a set of clock relations that would constrain the instant when clocks can tick or must not tick, thus defining families of valid schedules . In this article, we propose a specification language, called \(\mathit {LTL}_c/\mathit {CCSL}\) , for specifying temporal properties of multi-clock systems. While traditional temporal logics (LTL, MTL, CTL*), whether linear or branching, rely on a global step, our language, \(\mathit {LTL}_c/\mathit {CCSL}\) , builds a partial order on logical clocks, thus allowing both a hierarchical approach based on refinement of clock hierarchies and compositionality, as what happens in one clock domain may remain largely independent of what may happen in other domains. This good property helps preserve the properties without requiring to perform the proofs again. An \(\mathit {LTL}_c/\mathit {CCSL}\) specification consists of a clock temporal logic \(\mathit {LTL}_c\) , accompanied by a clock calculus called CCSL for specifying clock relations. We build the syntax and semantics of \(\mathit {LTL}_c\) and link its semantics with CCSL. After that, we mainly focus on the verification aspect of \(\mathit {LTL}_c/\mathit {CCSL}\) specifications using a model checking technique. We show how \(\mathit {LTL}_c/\mathit {CCSL}\) can be used for specifying multi-clock systems with an example.

Dealing with the ever-growing complexity of railway systems requires scalable approaches for detecting inconsistent safety requirements in practice. Despite significant efforts to automate the requirements consistency detection, current inconsistency analysis techniques of railway safety requirements still suffer from scalability issues. This paper proposes a two-layer approach for detecting inconsistencies in time-related safety requirements of railway systems, integrating two distinct formal methods from a pragmatic perspective. At the SafeNL layer, we employ an SMT-based approach to extract conflict patterns and use them to filter out inconsistent requirements descriptions, thus avoiding the more expensive general use of the SMT-based approach. At the CCSL layer, temporal dependencies in requirements are transformed into causal relations, which are then detected for circular inconsistencies using a graph search technique. Our evaluations demonstrate the utility and scalability of our approach.

The Clock Constraint Specification Language (CCSL) has been widely acknowledged as a promising system-level specification for the modeling and analysis of timing behaviors of real-time and embedded systems. However, along with the increasing complexity of modern systems coupled with strict time-to-market constraints, it becomes more and more difficult for requirement engineers to accurately figure out CCSL specifications from natural language-based requirement documents, since they lack both expertise in formal CCSL modeling and design automation tools to support quick and automatic generation of CCSL specifications. To solve the above problem, in this paper we introduce a novel and efficient Reinforcement Learning (RL)-based synthesis approach that can facilitate requirement engineers to quickly figure out their expected CCSL specifications. For a given incomplete CCSL specification, our approach adopts RL-based enumeration to explore all the feasible solutions to fill the holes within CCSL constraints, and leverages curiosity-driven exploration to accelerate the enumeration process. Based on the combination of our proposed curiosity-driven exploration heuristic and deductive reasoning techniques, our approach can not only prune unfruitful enumeration solutions effectively, but also optimize the enumeration process to search for the tightest solution quickly, thus the overall synthesis process can be accelerated dramatically. Comprehensive experimental results demonstrate that our approach significantly outperforms state-of-the-art methods in terms of both synthesis time and synthesis accuracy.

As a promising requirement-level specification language for timing behavior modeling, the clock constraint specification language (CCSL) has become popular in the model-driven design community for safety-critical embedded systems. However, due to the skyrocketing design complexity, in practice, it is hard for requirement engineers to accurately construct requirement models with expected timing behaviors using CCSL, especially, for safe timing behaviors. Although more and more CCSL synthesis approaches are designed to facilitate the generation of CCSL specifications, most of them cannot be used directly for the synthesis of requirements models. This is because existing CCSL synthesis methods: 1) focus on filling the holes of CCSL constraints rather than completing requirements models and 2) rely heavily on limited observations of system behaviors, while the (temporal) safety properties of target systems are neglected. To address these issues, this article proposes a novel method that enables the automated synthesis of safe timing behaviors for requirements models. By specifying the safety timing properties of target systems using safely-LTL, our approach adopts CCSL as an intermediate representation of requirement synthesis, where incomplete requirements models coupled with safely-LTL-based properties are encoded into CCSL constraints with holes. Guided by the samples (expected behaviors) provided by requirement engineers, our approach can automatically figure out the complete version of incomplete requirements models. Comprehensive experimental results on two complex case studies demonstrate that our approach can not only quickly and efficiently synthesize requirement models but also guarantee that the synthesized models satisfy specified safety properties in Safely-LTL form.

The Clock Constraint Specification Language (CCSL) has become popular for modeling and analyzing timing behaviors of real-time embedded systems. However, it is difficult for requirement engineers to accurately figure out CCSL specifications from natural language-based requirement descriptions. This is mainly because: i) most requirement engineers lack expertise in formal modeling; and ii) few existing tools can be used to facilitate the generation of CCSL specifications. To address these issues, this paper presents a novel approach that combines the merits of both Reinforcement Learning (RL) and deductive techniques in logical reasoning for efficient co-synthesis of CCSL specifications. Specifically, our method leverages RL to enumerate all the feasible solutions to fill the holes of incomplete specifications and deductive techniques to judge the quality of each trial. Our proposed deductive mechanisms are useful for not only pruning enumeration space, but also guiding the enumeration process to reach an optimal solution quickly. Comprehensive experimental results on both well-known benchmarks and complex industrial examples demonstrate the performance and scalability of our method. Compared with the state-of-the-art, our approach can drastically reduce the synthesis time by several orders of magnitude while the accuracy of synthesis can be guaranteed.

The Clock Constraint Specification Language (CCSL) is a logical time based modeling language to formalize timing behaviors of real-time and embedded systems. However, it cannot capture timing behaviors that contain uncertainties, e.g., uncertainty in execution time and period. This limits the application of the language to real-world systems, as uncertainty often exists in practice due to both internal and external factors. To capture uncertainties in timing behaviors, in this paper we extend CCSL by introducing parameters into constraints. We then propose an approach to transform parametric CCSL constraints into SMT formulas for efficient verification. We apply our approach to an industrial case which is proposed as the FMTV (Formal Methods for Timing Verification) Challenge in 2015, which shows that timing behaviors with uncertainties can be effectively modeled and verified using the parametric CCSL.

UML interactions, aka sequence diagrams, are frequently used by engineers to describe expected scenarios of good or bad behaviors of systems under design, as they provide allegedly a simple enough syntax to express a quite large variety of behaviors. This paper uses them to express formal safety requirements for safety critical systems in an incremental way, where the scenarios are progressively refined after checking the consistency of the requirements. As before, the semantics of these scenarios are expressed by transforming them into an intermediate semantic model amenable to formal verification. We rely on the Clock Constraint Specification Language (CCSL) as the intermediate semantic language. An SMT-based analysis tool called MyCCSL is used to check consistency of the sequence diagrams. We compare these requirements against actual execution traces to prove the validity of our transformation. In some sense, sequence diagrams and CCSL constraints both express a family of acceptable infinite traces that must include the behaviors given by the finite set of finite execution traces against which we validate. Finally, the whole process is illustrated on partial requirements for a railway transit system.

The design flaws and attacks on Cyber-Physical Systems (CPSs) can lead to severe consequences. Thus, security and safety (S&S) issues should be taken into account with functional design as early as possible during the developing process. However, it's rare to see "one-size-fits-all" modeling language and/or design tool. One way to solve this issue is to integrate different nature models into one model system, but this requires a unified semantic among modeling languages. We explore a model-based approach for systems engineering that facilitates the composition of several heterogeneous artifacts (called views) into a sound and consistent system model. Rather than trying to extend either SysML or SysML-sec into more expressive languages to add the missing features, we extract proper subsets of both languages to build a view adequate for conducting a security and safety analysis of Capella (SysML-based) functional models. Our language is generic enough to extract proper subsets of languages and combine them to build views for different experts. Moreover, it maintains a global consistency between the different views.

The Clock Constraint Specification Language (CCSL) has been widely investigated in verifying causal and temporal timing behaviors of real-time embedded systems. However, due to limited expertise in formal modeling, it is difficult for requirement engineers to completely and accurately derive CCSL specifications from natural language-based design descriptions. To address this problem, we present a novel approach that facilitates automated synthesis of CCSL specifications under the guidance of sampled (expected) timing behaviors of target systems. By encoding sampled behaviors and incomplete CCSL constraints provided by requirement engineers using our proposed transformation templates, the CCSL specification synthesis problem can be naturally converted into a SKETCH synthesis problem, which enables the automated generation of CCSL specifications with high accuracy. Experiments on both well-known benchmarks and synthetic examples demonstrate the effectiveness and scalability of our approach.

The Clock Constraint Specification Language ( CCSL ) is a formalism for specifying logical-time constraints on events for the design of real-time embedded systems. A central verification problem of CCSL is to check whether events are schedulable under logical constraints. Although many efforts have been made addressing this problem, the problem is still open. In this paper, we show that the bounded scheduling problem is NP -complete and then propose an efficient SMT-based decision procedure which is sound and complete. Based on this decision procedure, we present a sound algorithm for the general scheduling problem. We implement our algorithm in a prototype tool and illustrate its utility in schedulability analysis in designing real-world systems and automatic proving of algebraic properties of CCSL constraints. Experimental results demonstrate its effectiveness and efficiency.

International audience

The Clock Constraint Specification Language (CCSL) is a clock-based formalism for formal specification and analysis of real-time embedded systems. Previous approaches for the schedulability analysis of CCSL specifications are mainly based on model checking or SMT-checking. In this paper we propose a logical approach mainly based on theorem proving. We build a dynamic logic called 'clock-based dynamic logic' (cDL) to capture the CCSL specifications and build a proof calculus to analyze the schedule problem of the specifications. Comparing with previous approaches, our method benefits from the dynamic logic that provides a natural way of capturing the dynamic behaviour of CCSL and a divide-and-conquer way for 'decomposing' a complex formula into simple ones for an SMT-checking procedure. Based on cDL, we outline a method for the schedulability analysis of CCSL. We illustrate our theory through one example.

Cyber-Physical Systems (CPS) integrate discrete computational processes and continuous physical ones in a feedback loop. Design and analysis of CPS become difficult since their dynamic behaviors rely on heterogeneous descriptions from many fields. Domain-Specific Modeling Language (DSML) offers an effective and tailor-made solution for focusing on a specific field. However, to address CPS we need to bring together several DSMLs in a coordinated sensible way. The GEMOC Studio is meant to be an integration platform for putting together several DSMLs. This paper relies on it and brings a new DSML, called xSHS (for Executable Stochastic Hybrid Statechart), into the focus. It aims at modeling the stochastic and hybrid behaviors of CPS. We discuss here the abstract syntax, a proposed concrete syntax and an operational semantics that makes the language executable. We exploit both the language and modeling workbenches of the GEMOC Studio and we provide a simulation engine that implements the operational semantics. A temperature control system is used as a case study.

Synchronous languages, such as the recently proposed SCCharts language, have been designed for the rigorous specification of real-time systems. Their sound semantics, which builds on an abstraction from physical execution time, make these languages appealing, in particular for safety-critical systems. However, they traditionally lack built-in support for physical time. This makes it rather cumbersome to express things like time-outs or periodic executions within the language. We here propose several mechanisms to reconcile the synchronous paradigm with physical time. Specifically, we propose extensions to the SCCharts language to express clocks and execution periods within the model. We draw on several sources, in particular timed automata, the Clock Constraint Specification Language, and the recently proposed concept of dynamic ticks. We illustrate how these extensions can be mapped to the SCChart language core, with minimal requirements on the run-time system, and we argue that the same concepts could be applied to other synchronous languages such as Esterel, Lustre or SCADE.

Scheduling is a central yet challenging problem in real-time embedded systems. The Clock Constraint Specification Language (CCSL) provides a formalism to specify logical constraints of events in real-time embedded systems. A prerequisite for the events is that they must be schedulable under constraints. That is, there must be a schedule which controls all events to occur infinitely often. Schedulability analysis of CCSL raises important algorithmic problems such as computational complexity and design of efficient decision procedures. In this work, we compare the scheduling problems of CCSL specifications to the real-time scheduling problem. We show how to encode a simple task model in CCSL and discuss some benefits and differences compared to more classical scheduling strategies.

International audience

The hybrid architecture analysis and design language (AADL) has been proposed to model the interactions between embedded control systems and continuous physical environment. However, the worst-case performance analysis of hybrid AADL designs often leads to overly pessimistic estimations, and is not suitable for accurate reasoning about overall system performance, in particular when the system closely interacts with an uncertain external environment. To address this challenge, this paper proposes a statistical model checking-based framework that can perform quantitative evaluation of uncertainty-aware hybrid AADL designs against various performance queries. Our approach extends hybrid AADL to support the modeling of environment uncertainties. Furthermore, we propose a set of transformation rules that can automatically translate AADL designs together with designers' requirements into networks of priced timed automata and performance queries, respectively. Comprehensive experimental results on the movement authority scenario of Chinese train control system level 3 demonstrate the effectiveness of our approach.

We present in this paper a method and tool for the verification of causal and temporal properties of embedded systems, by analyzing the trace streams resulting from virtual prototypes that combines simulated hardware and embedded software. The proposed method makes it possible to analyze different kinds of properties without rebuilding the simulation models. Logical clocks are used to identify relevant points to put observation probes and thus also reducing the trace streams size. We propose a property specification language, called PSML, and based on behavioral patterns that does not require knowledge of temporal logics. From a given PSML specification, simulation is instrumented to generate a trace and the code is dynamically loaded by the simulator. The resulting trace stream is analyzed by parallel automata generated from the specification. The experiments, developed over the SimSoC virtual prototyping framework, show flexibility, possibility of using multi-core platforms to parallelize simulation and verification, providing fast results.

The design of complex systems involves various, possibly heterogeneous, structural and behavioral models. In model-driven engineering, the coordination of behavioral models to produce a single integrated model is necessary to provide support for validation and verification. Indeed, it allows system designers to understand and validate the global and emerging behavior of the system. However, the manual coordination of models is tedious and error-prone, and current approaches to automate the coordination are bound to a fixed set of coordination patterns. In this paper, we propose a Behavioral Coordination Operator Language (B-COoL) to reify coordination patterns between specific domains by using coordination operators between the Domain-Specific Modeling Languages used in these domains. Those operators are then used to automate the coordination of models conforming to these languages. We illustrate the use of B-COoL with the definition of coordination operators between timed finite state machines and activity diagrams.

To deal with the high complexity of embedded systems, engineers rely on high-level heterogeneous models that combine functional and non-functional aspects, hardware/software artifacts, structural and behavioral descriptions. PRISMSYS is a system-level multi-view modeling framework, which provides a means to specify functional and non-functional aspects in interrelated views. Each concern/view is addressed separately with a dedicated set of models and correspondence rules, maintaining the semantic consistency between those different views. The behavioral specification mixes UML state machines with equational models defined as SYSML parametric diagrams. To supply a complete non-functional property-aware simulation environment, it is mandatory to formalize 1) the execution semantics of the UML state machines, 2) the SYSML parametric diagrams and 3) the coordination between them. This is achieved by using CCSL, the Clock Constraint Specification Language, to provide an event-based semantics for each model and their coordination. The proposed co-simulation framework combines TIMESQUARE, a discrete event simulator for CCSL, and Scilab, a tool for numerical computation. The framework is illustrated on a CPU thermal manager case study with a joint simulation of both its functional and non-functional models.

Intelligent Transportation Systems (ITS) are a class of quickly evolving modern safety-critical embedded systems. Dealing with their growing complexity demands a high-level formal modeling language along with adequate verification techniques. STeC has recently been introduced as a process algebra that deals natively with both spatial and temporal properties. Even though STeC has the right expressive power, it does not provide a direct tooled support for verification. We propose to encode STeC specifications as Timed Automata to provide such a support and we illustrate our transformation strategy on a simple example.

The Clock Constraint Specification Language (CCSL) is a formal polychronous language based on the notion of logical clock. It defines a set of kernel constraints that can represent both asynchronous and synchronous relations. It was originally developed as part of the UML Profile for MARTE to express causal and temporal constraints of Real-time and Embedded Systems. In this paper, we explore the use of CCSL for modeling scheduling requirements and to conduct schedulability analysis. For this purpose, a dedicated scheduling library of CCSL has been built. This library is endowed with a state-based operational semantics, and is applied to solve issues related to schedulability analysis and latency-insensitive design. We establish schedulability categories and latency-insensitiveness property in the context of the semantics, and solve those issues by using model checking techniques.

Modeling and analysis of non-functional properties are central concerns in distributed real-time embedded systems. In automotive domain, EAST-ADL is one of the main architectural modeling approaches for real-time embedded systems. In our previous work we introduced the Timing Augmented Description Language V2 (TADL2), which is the new release of the time model for EAST-ADL. It provides new modeling capabilities such as explicit notion of timebase and symbolic timing expressions. In this paper we propose an approach to simulate and analyze TADL2 timing constraints. The formal semantics of TADL2 is given by an exogenous model transformation in QVTo to the Clock Constraint Specification Language (CCSL), a formal language that implements the MARTE Time Model. With this transformation, the analysis of TADL2 constraints become possible through TimeSquare framework dedicated to the analysis of CCSL specifications. The approach is illustrated on the Brake-By-Wire example.

The UML (Unified Modeling Language) Profile for Modeling and Analysis of Real-Time and Embedded (MARTE) systems promises a general modeling framework to design and analyze embedded systems. Lots of works have been published on the modeling capabilities offered by MARTE, much less on verification techniques supported. The Clock Constraint Specification Language (CCSL) has been defined in an annex of MARTE precisely to address semantic issues on time and causal aspects in relation with MARTE models. In the context of System-on-Chip design, some early work was proposed to use CCSL as a high-level specification language from which an observation network could be built. That observation network was used to observe early prototype implementations of the system under design and verify its compliance with respect to the CCSL specification. The proposed approach consisted in manually building a library of observer nodes for each CCSL operator and defining a generic mechanism to compose these nodes. This paper introduces a technique to generate a complete observer directly from a CCSL specification without requiring the manual construction of a library. The technique relies on a new state-based semantics given to a selected subset of CCSL operators. The study focuses specifically on boundedness issues with some CCSL operators that were previously artificially bounded to allow for exhaustive analyses.

The specification of Modeling and Analysis of Real-time and Embedded Systems (MARTE) is an extension of UML in the domain of real-time and embedded Systems. However, unified modeling of continuous and discrete variables in MARTE is still an unsolved problem for hybrid real-time system development. In this paper we propose an extended statechart, Hybrid MARTE statechart, for modeling and analyzing of hybrid real-time and embedded systems. In Hybrid MARTE Statecharts, we unify the logical time and the chronometric time variables. The improvement of MARTE statechart is based on hybrid automata. Formal syntax and semantics of Hybrid MARTE statecharts are given based on labeled transition systems. At the end of this paper, a case study is given to show how to model the behavior of a Train Control System with Hybrid MARTE statecharts.

As the embedded systems are becoming more and more complex, requirements engineering approaches are needed for modeling requirements, especially the timing requirements. Among various requirements engineering approaches, the Problem Frames(PF) approach is particularly useful in requirements modeling for the embedded systems due to the characteristic that the PF pays special attention to the environment entities that will interact with the to-be software. However, no concern is given on timing requirements of the PF at present. This paper studies how to add timing constraints on problem domains in the PF. Our approach is to integrate the problem representation frame in the PF with the timing representation mechanism of MARTE(Modeling and Analysis of Real Time and Embedded systems). A unified problem frame modeling process integrated with timing constraints is provided, and problem frame requirements with timing constraints expressed by MARTE/CCSL(Clock Constraint Specification Language) and clock construction operators are obtained.

In this paper, we present different modeling and execution frameworks that allow us to efficiently analyze, design and verify complex systems, mainly to cope with the specific concerns of the Real-time and embedded systems (RTE) domain. First we depict a UML /MARTE based methodology for executable RTE systems modeling with a framework and its underlying model transformations required to execute UML models conforming to the MARTE standard. The advantages of adopting a more generic action language with formal features are highlighted, in order to raise the level of abstraction with formal features. Then, we investigate how MARTE, with its Time Model facilities, can be made to represent faithfully AADL periodic/aperiodic tasks communicating through event or data ports, in an approach to end-to-end flow latency analysis. An analytical framework allows us to optimize port-based communication by generating a run time executive that utilizes shared data areas where appropriate, while ensuring the timing semantic assumed by the control application. An analysis of the AADL mode change protocol is also provided, exposing a translation process that takes as an input an AADL model and produces as an output a time Petri net. We show how an AADL model transformation provides a formal model for model checking activities and we suggest that model transformation provides useful support to improve the integration of formal verification in an industrial engineering process. As a case study we use an implementation of a UDP /IP protocol stack.

The Clock Constraint Specification Language (CCSL) provides expressions and relations to specify the time requirements and causal dependencies of systems. It was initially proposed, in the context of MARTE: the UML profile for Modeling and Analysis of Real-Time and Embedded Systems. In this paper, we propose a method to verify CCSL specifications. We give a formal state-based interpretation of a fundamental subset of CCSL clock constraints. Based on it, we translate a CCSL specification into a Promela model and feed the result into the model checker SPIN. Then we show some patterns for expressing the properties of the model and do the verification. A digital filter application is used as an example to illustrate the approach.

The UML Profile for Modeling and Analysis of Real-Time and Embedded systems (MARTE) has been recently adopted. The Clock Constraint Specification Language (CCSL) allows the specification of causal, chronological and timed properties of MARTE models. Due to its purposely broad scope of use, CCSL has an expressiveness that can prevent formal verification. However, when addressing hardware electronic systems, formal verification is an important step of the development. The IEEE Property Specification Language (PSL) provides a formal notation for expressing temporal logic properties that can be automatically verified on electronic system models. In this paper, we determine the part of MARTE/CCSL amenable to support the classical analysis methods from the Electronic Design Automation (EDA) community by comparing \ccsl and PSL expressiveness. We show that neither of these languages is subsumed by the other one. We identify and restrict the CCSL constructs that cannot be expressed in temporal logics so that \ccsl become tractable in temporal logics. Conversely, we also identify the class of PSL formulas that can be encoded in CCSL. We define translations between these fragments of CCSL and PSL using automata as an intermediate representation.

This presentation demonstrates the early results from the French ANR project RT-Simex. RT-Simex proposes a set of tools to analyze parallel embedded code and trace the simulation results back to the initial models from which the code was generated. The whole tool-set relies on standard formats (UML MARTE, Open Trace Format) to ensure a perennial use. The main difficulty is to reconcile different execution traces extracted from codes running concurrently on different unsynchronized platforms. This is achieved through the polychronous logical time model of MARTE.

AADL and MARTE are two modeling formalisms supporting the analysis of real-time embedded systems. Since both cover similar aspects, a clear assessment of their respective strength and weakness is required. Building on previous works, we focus here on the time aspects of the two specifications. Relying on the MARTE Time Model and the operational semantics of its companion language CCSL we attempt to equip UML activities with the executionsemantics of an AADL specification. This is part of a muchbroader effort to build a generic simulator for UML modelswith the semantics explicitly defined within the model.

The UML goal of being a general-purpose modeling language discards the possibility to adopt too precise and strict a semantics. Users are to refine or define the semantics in their domain specific profiles. In the UML profile for MARTE, we devised a broadly expressive time model to provide a generic timed interpretation for UML models. Our clock constraint specification language supports the specification of systems with multiple clock domains. Starting with a priori independent clocks, we progressively constrain them to get a family of possible executions. Our language supports both synchronous and asynchronous constraints, just like the synchronous language Signal, but also allows explicit non determinism. In this paper, we give a formal semantics to a core subset of MARTE clock constraint language and we give an equivalent interpretation of this kernel in two other very different formal languages, Signal and time Petri nets.

In the automotive domain, several loosely-coupled architecture description languages (ADLs) compete to provide a set of abstract modeling and analysis services on top of the implementation code. In an effort to make all these languages, and more importantly their underlying models, interoperable, we use the UML profile for MARTE as a pivot to define the semantics of these models.In this paper, we particularly focus on East-ADL2. We discuss the benefits of having an integrated, MARTE-centered, approach. We give a formal semantics of East-ADL2 timing requirements. Relying on this semantics, several kinds of analysis are possible. Requirements become executable and simulations are run. A constraint solver is used to detect logical inconsistencies. Our proposal is illustrated on an anti-lock braking system (ABS).

The UML Profile for Modeling and Analysis of Real-Time and Embedded (MARTE) systems has recently been adopted by the OMG. Its Time Model extends the informal and simplistic Simple Time package proposed by UML2 and offers a broad range of capabilities required to model real-time systems including discrete/dense and chronometric/logical time. MARTE OMG specification introduces a Time Structure inspired by Time models of the concurrency theory and proposes a new clock constraint specification language (CCSL) to specify, within the context of UML, logical and chronometric time constraints.

In the real-time and embedded domain, systems tend to combine periodic and aperiodic computations. This leads to mixing event-triggered with time-triggered communications with their pros and cons. Then, modeling standards of the domain must provide mechanisms to support both kinds whereas historically they pertain to different communities: asynchronous and synchronous designers. In this paper, we compare the expressiveness of two standards of the domain (AADL and MARTE) to model these two kinds of communications. Specifically we focus on the time facilities of MARTE and on AADL models amenable to end-to-end flow latency analyses.

AADL and MARTE are both modeling formalisms supporting the analysis of real-time embedded systems. We investigate how MARTE, with its Time Model facilities, can be made to represent faithfully AADL periodic/aperiodic tasks communicating through event or data ports, in an approach to end-to-end flow latency analysis.

Each domain has its own interpretation of time. We propose to extend UML, which is more and more used in the domain of real-time embedded applications, with a concept of time inherited from reactive system modeling : multiform time. After a brief review of some UML profiles, we present our extensions and we illustrate - on an example from the automotive industry - how to represent and to constraint behaviors depending on multiform time. We advocate that this model of time offers wider possibilities than restricting models only to the physical time.