Research in code and architectural analysis has demonstrated that a clear understanding of structural dependencies among software elements helps developers comprehend the impact of change. Yet examples are abundant from industry of major issues due to missed dependencies associated with different views of the architecture. Key concerns include dependencies related to allocation of modules to implementation packages to improve safety-critical testing and allocation of implementation packages to hardware partitions to optimize performance. In this paper, we present an in-depth study of a safety-critical system that underwent major changes as a result of missed architectural dependencies. We describe the challenges that resulted in re-architecting the system, the techniques we used for intervention, our results, and the developers' perspective. While the engineering tools provided coverage of design concerns, they missed implications of end-to-end integration testing, latency, and cost of change. In our study, we observed that the tools led the engineers to focus on data and control flow and therefore to miss many data-entity relationships, resource behavior, and deployment-related dependencies. Research continues to focus on more tooling and automation to assist with dependency analysis rather than interim, easier-to-adopt solutions. Our findings demonstrate that providing developers with a lightweight, semantically well-defined description of dependencies enables them to reason about change impact and propagation implications that they might otherwise overlook.

In this paper, we present different modeling and execution frameworks that allow us to efficiently analyze, design and verify complex systems, mainly to cope with the specific concerns of the Real-time and embedded systems (RTE) domain. First we depict a UML /MARTE based methodology for executable RTE systems modeling with a framework and its underlying model transformations required to execute UML models conforming to the MARTE standard. The advantages of adopting a more generic action language with formal features are highlighted, in order to raise the level of abstraction with formal features. Then, we investigate how MARTE, with its Time Model facilities, can be made to represent faithfully AADL periodic/aperiodic tasks communicating through event or data ports, in an approach to end-to-end flow latency analysis. An analytical framework allows us to optimize port-based communication by generating a run time executive that utilizes shared data areas where appropriate, while ensuring the timing semantic assumed by the control application. An analysis of the AADL mode change protocol is also provided, exposing a translation process that takes as an input an AADL model and produces as an output a time Petri net. We show how an AADL model transformation provides a formal model for model checking activities and we suggest that model transformation provides useful support to improve the integration of formal verification in an industrial engineering process. As a case study we use an implementation of a UDP /IP protocol stack.

Many application systems maintain state as part of their behavioral semantics. This state can reflect continuous state, e.g., sensor measurements, or discrete state. Modeling notations like Simulink combine the two to support modeling of hybrid control systems. In this paper we examine whether the intended behavior of state-based systems is implemented correctly by different runtime architectures. We identify several classes of such state based systems with variations in their semantics,represent their architecture in AADL, and use these mantic framework of AADL to discuss potential pitfalls with the chosen implementation.

An established approach to achieve fault tolerance is to deploy multiple copies of the same functionality on multiple processors to ensure that if one processor fails another can provide the same functionality. This approach is known as replication. In spite of the number of studies on the topic, designing a replication pattern is still error prone. This is due to the fact that its final behavior is the result of the combination of design decisions that involves reasoning about a collection of non-deterministic events such as hardware failures and parallel computations. In this paper we present an approach to model replication patterns in the architecture analysis and design language (AADL) and analyze potentially unintended behaviors. Such an approach takes advantage of the strong semantics of AADL to model replication patterns at the architecture level. The approach involves developing two AADL models. The first one defines the intended behavior in synchronous call sequences. And the second model describes the replication architecture. These two models are then compared using a differential model in Alloy where the requirements of the first model and the concurrency and potential failure of the second are combined. The additional behaviors discovered in this model are presented to the designer as potential errors in the design. The designer then has the opportunity to modify the replication architecture to correct these behaviors or qualify them as valid behaviors. Finally, we validated our approach by recreating the verification experiment presented in but limiting ourselves to the AADL syntax.

Traditionally shared data areas have been used to efficiently communicate between embedded system tasks, such as periodically executing control system tasks. Such implementations are highly sensitive to the execution order of tasks, i.e., they depend on a static timeline. SAE AADL supports a port communication model that ensures deterministic processing of signal streams. In this paper we discuss an analytical framework that allows us to optimize such port-based communication by generating a runtime executive that utilizes shared data areas where appropriate, while ensuring the timing semantic assumed by the control application.

Resource allocation decisions are critical for the design of embedded real-time systems. Today's trend to software integration makes these decisions tightly coupled to the software architecture. In this paper we discuss the use of architectural models to guide and maintain the integrity of the resource allocation decision at different levels of refinement of the system design. We discuss the budgeting process to split the development process into different teams, the use of bin packing techniques for low level resource allocation and the isolation strategies to separate the different criticality levels of these systems.

The development of embedded systems through models requires the creation of both a platform independent model (PIM) and a platform specific model (PSM). xUML is an extension to UML that adds precise execution semantics to models enabling a full description of platform independent models and the generation of code from them. However, to achieve different non-functional properties, a platform specific model is needed. Architecture Analysis and Design Language (AADL) enables the creation and exploration of PSMs and the analysis of its non-functional properties. In this work we present the integration of xUML and AADL in a development process. This includes the translation of the xUML concurrency model into AADL and the exploration of concurrency variations in AADL.

Real time control systems typically receive streams of sampled data signals, process them, and generate output to control devices via actuators. Control system components make assumptions about sampling rate and other characteristics, such as filtering of data streams. These application-specific semantic dependencies and time-sensitive semantic properties are usually not explicit in the source code implementation. The paper discusses an approach to modeling the system architecture of real time applications, capturing semantic dependencies, and recording time-sensitive properties. Analysis of the model can identify inconsistencies in a system design and can determine the impact of a system change. This architectural dependency model can evolve incrementally to record hidden side effects, as they are discovered during maintenance, and prevent such errors in the future.

Abstract DOSE is unique among structure editor generatiors in its interpretive approach. This approach leads to very fast turn‐around time for changes and provides multi‐language facilities for no aditional effort or cost. This article compares the interpretive approach to the compilation approach of other structure editor generators. It describes some of the design and implementation decisions made and remade durign this project and the lessons learned. It emphasizes the advantages and disadvantages of DOSE with respect to other structure editing systems.

This paper describes an incremental programming environment (IPE) based on compilation technology, but providing facilities traditionally found only in interpretive systems. IPE provides a comfortable environment for a single programmer working on a single program.