Modeling and Analysis of Real-time and Embedded Systems

Transcription

1 Modeling and Analysis of Real-time and Embedded Systems Susanne Graf, Øystein Haugen, Iulian Ober and Bran Selic 1 VERIMAG, Grenoble, France, {Susanne.Graf, Iulian.Ober}@imag.fr 2 University of Oslo, Oslo, Norway Oystein.Haugen@ifi.uio.no 3 IBM, Canada bselic@ca.ibm.com Abstract: This paper presents an overview of the workshop MARTES on Modeling and Analysis of Real-time and Embedded Systems that has taken place for the first time in association with the MODELS/UML 2005 conference. The main themes discussed at this workshop concerned (1) methodologies and tools for quantitative analysis and (2) methodologies and languages for modeling quantitative aspects of real-time and embedded systems in the context of model driven development. 1. Introduction The idea of model-based development, in which models representing specifications of functional aspects are compiled into code for particular platforms, is a very attractive idea. In particular application domains, tools supporting such an approach have been developed already in the past. A good example is the SCADE tool for the development of real-time controllers with guaranteed properties for very simple nondistributed platforms or for platforms like TTA maintaining for the application the illusion of a non distributed platform [CR01, CM05]. The more recent OMG Model Driven Architecture (MDA) initiative puts forward the similar idea that in general future process development will be focussing on models, thus keeping application development and underlying platform technology as separate as possible, where the aspects influenced by the underlying platform technology concern mainly non-functional aspects and communication primitives. A significant consequence of the MDA paradigm is the possibility to build application models that can be conveniently ported to new technologies like new implementation languages or middleware with minimal effort and risk, and that can be analyzed directly or through model transformation in order to validate or/and verify real-time properties and schedulability. As already mentioned, in the area of DRES (Distributed, Real-time and Embedded Systems), this model-oriented trend is also extremely promissing, and it should be extended to more general frameworks than the before-mentioned ones. DRES however, have particular demands concerning the useful modeling concepts, semantic interoperability of models and tools or the use of verification methods.

2 2 Susanne Graf, Øystein Haugen, Iulian Ober and Bran Selic The Unified Modeling Language UML aims at providing an integrated modeling framework encompassing architecture descriptions and behavior descriptions. Even though UML 2.0 includes a simple time model, real-time aspects are not yet handled in a completely satisfactory fashion and are also not well integrated today in existing tools. A first step to the inclusion of extra-functional characteristics into the modeling framework has been achieved by the UML profile for Schedulability, Performance and Time [OMG03]. More recently, several efforts have been and are being undertaken to improve this initial proposal in several aspects, e.g. to integrate the profile with UML 2.0 rather than UML 1.4. A UML Profile for Modeling Quality of Service and Fault Tolerance Characteristics and Mechanisms (QoS) [OMG04]. The IST project Omega [Omega] aimed precisely at the definition of a UML profile for real-time and embedded systems with a semantic foundation [GOO05] and with tool support for validation [OGO05]. Notice that this realtime framework defines a set of modeling elements, expressive enough to define a precise semantics for all the time constraints introduced in SPT as tag values or stereotypes by means of constraints between well defined occurrences of events. Events represent time points, and we have defined naming conventions for events associated with the execution of any syntactic construct 1. The objectives of the MARTES workshop were to discuss the possible uses and deficiencies of the existing profiles, as well as the usefulness of new features, in particular in the context of ongoing efforts in model driven development, such as the current call for proposal MARTE Modeling and Analysis of Real Time and Embedded systems. A motivation for this call was to express modeling paradigms, such as the synchronous approach, that are used in the context of real-time and embedded systems, but have not been addressed so far by UML. Another issue addressed by this call is the expression of real-time properties and requirements and their analysis. Another ongoing development important for real-time and embedded systems which has been discussed already in previous workshops is related to the development of a notation for semantics. Finally, a goal of this workshop was to bring together researchers from academia and industry to discuss and progress on these issues, as well as other issues in the context of time, scheduling and architecture in UML and UML-related notations, such as notations for expressing time and architecture related requirements, semantic issues, analysis tools and modeling paradigms. 2. The Contributions Eight quality contributions were presented at the workshop, backed by a full paper or by a shorter position paper. All the papers together are available on the workshop 1 This is a similarity to UML 2.0 where with every behavior execution is associated a start and a finish event, but we have introduced a concrete syntax for these events, and we have defined a set of concrete attributes these events may have.

3 Modeling and Analysis of Real-time and Embedded Systems 3 webpage 2. Here, we provide a short summary of the individual papers. They looked at the workshop s themes from very different angles. Two of them appear in these proceedings; they have been chosen for their intrinsic quality and particular interest for the subjects of this workshop. 2.1 A Unified Approach for Predictability Analysis of Real-Time Systems using UML-based Control Flow Information [GBL05] The aim of this position paper is an approach to predictability analysis for (distributed) Real-Time Systems (RTS) based on UML. The models are mainly standard UML 2.0 Sequence Diagrams (SD), and the analysis is based on a control flow analysis method for SD, augmented with analysis of timing and distribution information. The approach targets resource usage analysis, load forecasting, and dynamic dependency analysis in time-dependent systems, in particular in early phases of the software lifecycle. Standard UML models and extensions are used as input. The use of the profiles is demonstrated on hand of a case study, in which the resource usage of network traffic is analyzed in a distributed RTS. There is a common core for the different predictability analyses proposed, namely the control flow analysis of SD. The hope is that this does increase reusability of analysis information and will simplify the implementation of other predictability analysis algorithms. 2.2 Modular Verification of Safe Online-Reconfiguration for Proactive Components in Mechatronic UML [GH05] While traditionally the environment considered by an autonomous mechatronic system consisted only of the measurable surrounding physical world, today s advanced mechatronic systems are complex distributed systems acquiring sensor values and sending commands through buses or even wireless networks. In this context, mechatronic systems consist of cooperating agents optimizing the system behavior by adjusting their local behavior and cooperation structure to better serve their current goals depending on the experienced mechanical and information environment. The Mechatronic UML approach defines a profile and a methodology for the componentwise development of such self-optimizing mechatronic systems by providing a notion for hybrid components represented by state machines: states correspond to modes in which particular control laws are used (laws which might be developed using tools like Simulink), and mode changes are used to adapt the control laws due to particular observations in the system. At last year s workshop, an environment for modular analysis integrated in the Fujaba tool [BGN+04] has been presented for the verification of purely reactive behavior with only restricted time constraints, where modularity is obtained through particular required and provided interfaces represented by state charts. This 2 See

4 4 Susanne Graf, Øystein Haugen, Iulian Ober and Bran Selic environment has been adapted for applying model checking to verify safe modular reconfiguration for systems which include components with complex time constraints and proactive behavior. The tool is demonstrated on a case study, an automatic shuttle system in which shuttles may build convoys to save energy. The tool also includes automatic code generation for the particular platform used in the case study, which makes it of particular practical interest. We considered that this approach was a particularly interesting demonstration of the usefulness of UML for model based development in a particular application domain. 2.3 Timing analysis and validation of the embedded MARS bus manager [OGY05] This paper presented the profile for modeling real-time systems and their requirements defined in the Omega project [GOO05] by using it in a case study done by an industrial user with the IF/IFx tool developed for this profile [OGO05]. The aim of the profile is, contrary to the one presented [GH05], not to be bound to a particular methodology for a particular set of application, but to be adaptable to a larger set of applications. The Omega real time profile provides means for specifying the timing of design models at different levels of abstraction by using timers and clocks in system objects for handling time-dependent design or in environment objects for describing an environment with particular timing properties. Platform dependent execution times needed for the analysis are annotated back into the models. Requirements are represented by observers, state machines triggered by semantic level events and representing acceptors of timed languages of such events. Observers can express arbitrary properties and in particular all those standard property patterns identified in SPT or in [EDG+05] below. Observers are also related to protocol machines, as they represent externally visible properties of some context; the difference is that they can refer to more semantic level events and have acceptance and ignore states allowing the expression of richer properties. The aim of the paper was to show the usability of the Omega profile and its tools for designers of real-time systems on hand of a case study in which functional decomposition has been used for modular verification of a small system with complex timing properties. 2.4 Validating temporal properties of a deployed application with an MDD approach [HCB+05] This paper shows another usage of the Omega profile, but in the context of telecommunication systems where the description of the deployment of functional service components on a distributed platform and timing properties are important issues. The paper proposes a particular methodology for representing (static) software and platform architectures by component diagrams annotated with properties expressing the relevant typing information for different kinds of resources. Also some dynamic aspects related to resources, such as processor usage policies, are represented by a small number of keywords. The dynamic aspects of the developed services by

5 Modeling and Analysis of Real-time and Embedded Systems 5 composition of service components are described by means of Live Sequence Charts [DH99, HKP04], a non-standard notation, similar to Sequence diagrams but appropriate for the expression of properties of systems rather than of particular runs. Notice that they are of similar expressiveness as the above mentioned observers but propose a different style, well adapted for service level requirement specifications. Using the available LSC tools, requirements are first analyzed as such and then translated into state machine models. These state machine models are then composed with the platform model and analyzed with the IF/IFx tool. The paper suggests also the use of symmetry reduction techniques as an alternative to the use of modular abstractions proposed in [OGY05] as it is potentially easier to automate, and is useful for analyzing systems with reasonably small multiplicities. Using another model transformation to appropriate tools, still under development, these specifications will also be used for the validation of QoS properties of statistical nature. 2.5 Modeling and Analysis of Concurrent and Real-Time Object-Oriented Designs [PG05] This position paper proposes a method for early design analysis, in which hierarchical colored Petri nets (CPN) are used for capturing the dynamic aspects of an object oriented architecture provided by an UML based model. The UML model is transformed in a structural way based on appropriate stereotypes and templates, into a CPN and partially completed at the CPN level. The proposed approach is essentially top-down, making intensive use of hierarchical construction. On the resulting model existing analysis tools can be used. For Petri nets there exist syntax level analysis methods for validating control invariants and deadlock freedom, but here the main interest was the use of the powerful (simulation based) state space and performance analysis provided by the tool DesignCPN [Jen99]. Like in the previous paper, an important aspect is the use of the same model for requirements and performance oriented analysis. Currently, the flow of the method is addressing designers familiar with both notations, UML and Petri nets. A toolsupported method for translating back the resulting CPN models into UML is future work. 2.6 Introducing Control in the Gaspard2 Data-Parallel Metamodel: Synchronous Approach [LDB+05] This paper is about the introduction of explicit control into the array oriented language Gaspard2, used for programming of computation intensive reactive systems. The aim is to exploit the explicit representation of data parallelism for deriving efficient code or hardware for a given platform. The derivation of code for complex and distributed platforms requires taking into account specific timing information and some kind of architecture exploration. In order to reuse existing code generation algorithms based on the synchrony hypothesis, it is needed to explicitly introduce both timing information and control. At user level, this is done by means of a particular

6 6 Susanne Graf, Øystein Haugen, Iulian Ober and Bran Selic UML profile which introduces explicit control by state machines used as mode automata [MR98]. In order to reuse existing code generation tools, the functional specification and the extensions with explicit control and times are mixed into a unique array specification, in which time and control correspond to particular dimensions. The obtained specification is used for validation and code generation. This is interesting work, very much related to the approach proposed earlier in [GH05] or to recent proposals for extending SCADE for distributed platforms, or also to the work on compilation for the synchronous language Signal. Presently, the verification is done separately for the functional model and for timing and control. To evaluate to what extent this is realistic and to provide useful results, are the objectives of future work. 2.7 Some Requirements for Quantitative Annotations of Software Designs [PW05] The main aim of this paper is to provide general mechanisms for the definition of QoS annotations and a comparison of the expressiveness of existing profiles. This effort is made in the context of work for the MARTE profile. In MARTE, the general mechanisms introduced will be used to indicate timing and memory-usage properties of the software and of its behavior, as well as timing, capacity and utilization properties of resources. Other kinds of non-functional requirement analysis need different types of characteristics; for instance reliability analysis calls for failure rates and probabilities. The authors define a meta-model of quantitative annotations that identifies which quantities are relevant to the analysis domain; this meta-model will then help to define the issues that need to be resolved for each analysis domain: (1) which is the quantitative domain the analysis is working on, (2) how quantitative characteristics are attached to model elements, (3) how different quantitative characteristics are related to each other and finally (4) the actual expression of constraints on and between quantitative characteristics which may represent hypotheses or requirements on the system. Especially for performance analysis, it is important to distinguish realizations that are values for characteristics that actually occur during execution runs and measures defining statistical properties over all realizations in any run. The paper considers how two previous profiles, SPT [OMG03] and QOS [OMG04], address these requirements and raises issues and questions related to defining a UML profile for MARTE. 2.8 A General Structure for the Analysis Framework of the UML MARTE Profile [EDG+05] This paper focuses like [PW05] on the expression of non functional properties in the context of MARTE, under a slightly different angle. It aims to provide a robust basis to the MARTE profile for Modeling and Analysis of Real-Time and Embedded systems. It analyzes in particular the existing annotating mechanisms of extra-functional properties and some specific requirements of the concerned RFP to consistently derive

7 Modeling and Analysis of Real-time and Embedded Systems 7 a preliminary framework for the subprofile concerning analysis and expression of requirements. It mainly focuses on providing a Quantitative Analysis domain model which gives a good account of the relevant attributes and measures and their relations in the form of catalogs. It includes a flexible mechanism to easily add and suppress QoS attributes without changing the associated Domain Model and Profile, which covers inclusion of modeling capability for new analysis techniques. The analysis domains covered include both performance and scheduling analysis. Its final aim is indeed to allow the unification of the existing Schedulability and Performance modeling sub-profiles in the pertinent aspects, whereas letting them separated in the specialized ones. For this purpose, it is structured into four modeling views which influence the relevant analysis techniques and which are the workload, behavior, allocation and the platform view. 3. Workshop discussions and results Most presentations directly addressed modeling or validation of systems with real-time properties, and most of them are more or less related to UML. Some approaches proposed the use of UML and provided therefore some extensions, whereas some proposed completion of UML modeling by external formalisms, such as Petri nets [PG05] or array languages [LDB+05]. All validation approaches include naturally mappings into analysis specific formalism. Two papers were directly related to the ongoing effort for the MARTE RFP. Contrary to last year, no paper provided in-depth discussion of semantic issues. The approaches presented in [GH05, LDB+05] are complete, in the sense that they provide tools for both validation and code generation, the other ones propose rather a high-level design and refinement approach, including platform related characteristics as far as they are needed for validation, but no actual code generation. They are meant for complementing some code generation process which does not exist or at least is not made precise. The approaches presented in [GBL05, HCB+05, PG05] propose analysis for service oriented requirement specifications; in [HCB+05] it is also proposed to later on check these requirements against the design level specifications of software components defining the actual system, where in the future tools based on synthesis methods may be used for generating such design specifications. The approaches in [GH05, OGY05, LDB+05] work on design specifications. In [LDB+05], they main accent is on code generation by guaranteeing the specified design. Emerging global properties of runs (temporal properties) are not really addressed. In [GH05] verification of temporal safety properties is done locally on individual components, where a methodology based on refinement is used for addressing global properties. [OGY05] does allow specification of global temporal properties, where the observers used for that purpose represent properties of all interactions, rather than under specifications as it is the case for sequence diagrams. Both [GH05] and [OGY05] do verification compositionally, where decomposition of properties and designs is used to make verification tractable. In [GH05]

8 8 Susanne Graf, Øystein Haugen, Iulian Ober and Bran Selic decompositions are always checked for refinement, whereas in [OGY05] abstraction is used to show that a decomposed system still satisfies the same global properties. We may notice that most approaches go along with some methodology bound to some application domain. In the discussion arose the question which method could also be useful for the problem (often some particular case study) solved by the other approaches. Indeed, the approaches are quite complementary, but not all the approaches match the need of all addressed domains. In particular, the application domain of real-time controllers, addressed in [GH05, LDB+05] and to some context also in [OGY05] which have to satisfy hard real-time constraints, scenario-based performance analysis seems to play a less important role, whereas in the strongly service oriented systems, as for example those presented in [HCB+05], beyond statistical properties, mainly untimed safety properties are relevant which depend however on a timed model. 4. Conclusions Compared with last year, where we have noted in the context of real-time analysis a clear trend towards either small profiles, including just what is available for the targeted validation tools or profiles providing rich but rigid catalogs of properties, the situation has slightly evolved. With respect to the analysis of real-time properties, the MARTE profile includes some catalog representative for the domain of real-time properties, but it aims also at providing means for the expression of general, user defined properties and moreover, it is less biased to annotations of interactions. However, it still provides syntax and means to extend syntax, without providing also appropriate means for defining the semantics of the proposed annotations. An important result of the workshop is the merging of the proposals made in [PW05] and in [EDG+05]; the result is [EGP+05] which has been chosen for inclusion in the conference proceedings. Concerning validation of real-time constraints, we consider that the most important issue is to provide methodologies making this kind of intrinsically global properties compositional. We found that [GH05] represents the most complete approach with this respect, and we have therefore chosen this paper to appear in the proceedings. References [BGHS04] S. Burmester, H. Giese, M. Hirsch, and D. Schilling. Incremental Design and Formal Verification with UML/RT in the FUJABA Real-Time Tool Suite, in Wshp on Specification and Verification of Real Time Embedded systems, SVERTS [CM05] P. Caspi and O. Maler. From Control loops to real-time programs. In Handbook of Networked and Embedded Control Systems. CRC Press, [CR01] P. Caspi and P. Raymond. From Control system design to embedded code: the synchronous data-flow approach. In 40 th IEEE Conference on Decision and Control (CDC 01), Florida, December 2001.

9 Modeling and Analysis of Real-time and Embedded Systems 9 [DH99] W. Damm and D. Harel. LSCs: Breathing life into Message Sequence Charts. In FMOODS 99 IFIP Int. Conf. on Formal Methods for Open Object-Based Distributed Systems. Kluwer, Also to appear in Journal on Formal Methods in System Design. [EDG+05] Huascar Espinoza, Hubert Dubois, Sébastien Gérard, and Julio Medina. A General Structure for the Analysis Framework of the UML MARTE Profile. In [GGHS05]. [EGP+05] Huáscar Espinoza, Hubert Dubois, Sébastien Gérard, Julio Medina, Dorina C. Petriu, Murray Woodside. Annotating UML Models with Non-Functional Properties for Quantitative Analysis. In these proceedings. [GBL05] Vahid Garousi, Lionel Briand and Yvan Labiche. A Unified Approach for Predictability Analysis of Real-Time Systems using UML-based Control Flow Information. In [GGHS05]. [GGHS05] S. Gérard, S. Graf, O. Haugen, and B. Selic, editors. MARTES 2005, Workshop on Modelling and Analysis of Real Time and Embedded Systems, with MODELS [GH05] Holger Giese and Martin Hirsch. Modular Verification of Safe Online-Reconfiguration for Proactive Components in Mechatronic UML. In [GGHS05] and these proceedings. [GOO05] S. Graf, I. Ober, and I. Ober. Timed annotations in UML. STTT, Int. Journal on Software Tools for Technology Transfer, under press. [HCB+05] Jean-Louis Houberdon, Pierre Combes, Jean-Philippe Babau, and Isabelle Auge- Blum. Validating temporal properties of a deployed application with an MDD approach. In [GGHS05]. [HKP04] D. Harel, H. Kugler, and A. Pnueli. Smart Play-Out Extended: Time and Forbidden Elements. In Int. Conf. on Quality Software (QSIC04). IEEE Press, [Jen99] K. Jensen, "DesignCPN," 4.0 ed. Aarhus, Denmark: University of Aarhus, 1999 [LDB+05] Ouassila Labbani, Jean-Luc Dekeyser, Pierre Boulet, and Eric Rutten. Introducing Control in the Gaspard2 Data-Parallel Metamodel: Synchronous Approach. [GGHS05]. [MR98] F. Maraninchi and Y. Rémond, Mode-automata: About modes and states for reactive systems, European Symp. On Programming ESOP, LNCS 1381, Lisbon, Portugal, 1998 [OGO05] I. Ober, S. Graf, and I. Ober. Validating timed UML models by simulation and verification. Int. Journal on Software Tools for Technology Transfer, Under press. [OGY05] Iulian Ober, Susanne Graf, and Yuri Yushtein. Timing analysis and validation of the embedded MARS bus manager. In [GGHS05]. [Omega] The homepage of the Omega project [OMG03] OMG. UML Profile for Schedulability, Performance, and Time, formal/ , 09/2003. [OMG03b] OMG. Object Constraint Language, version 2.0. Final adopted specification, document ptc/ , 10/2003. [OMG04] OMG. UML Profile for Modelling Quality of Service and Fault Tolerance Characteristics and Mechanisms. Specification, ptc/ , 06/2004. [PG05] Robert Pettit and Hassan Gomaa. Modeling and Analysis of Concurrent and Real-Time Object-Oriented Designs. In [GGHS05]. [PW05] Dorina Petriu and Murray Woodside. Some Requirements for Quantitative Annotations of Software Designs. In [GGHS05].