Dependability Modelling using AADL and the AADL Error Model Annex

Transcription

1 Dependability Modelling using AADL and the AADL Error Model Annex Ana Rugina October 2005 Copyright ASSERT Project 1

2 Context Dependability evaluation for embedded real-time systems IST FP6 European Integrated Project ASSERT Means: Analytical Modelling Petri nets, Markov chains Industrial practice: UML, AADL models Objectives: Dependability Measures October 2005 Copyright ASSERT Project 2

3 Outline General approach Case study Conclusion October 2005 Copyright ASSERT Project 3

4 Approach AADL Dependability Model AADL System Architecture Model + AADL System Error Model Model transformation Dependability Model Model processing Dependability Measures October 2005 Copyright ASSERT Project 4

5 Dependability Measures Reliability measure of continuous delivery of correct service probability of occurrence of a failure before a given instant of time MTTF (mean time to failure) Availability measure of the readiness for correct service the proportion of correct service deliverance time over a time interval Maintainability ability to undergo modifications and repairs probability of service restoration before a given instant of time MTTR (mean time to restoration) October 2005 Copyright ASSERT Project 5

6 Duplex system architecture duplex_system System1:sub_system.basic_primary System2:sub_system.basic_backup SW1:software.basic_primary SW2:software.basic_backup Primary Backup Primary Backup LAN HW:computer.basic HW:computer.basic October 2005 Copyright ASSERT Project 6

7 AADL Dependability Model SW1:software.basic_primary SW2: software.basic_backup Primary Backup Error model SW.HWSW_SWSWdep Primary Backup Error model SW.HWSW_SWSWdep SW-SW dependency SW-SW dependency HW-SW dependency HW-SW dependency HW:computer.basic Error model HW.HWSW_HWHWdep HW-SW dependency HW-HW dependency Repairman: repairman.basic Error model Repairman.Simple HW:computer.basic Error model HW.HWSW_HWHWdep HW-SW dependency HW-HW dependency HW-HW dependency October 2005 Copyright ASSERT Project 7

8 Dependability Model SW1:software.basic_primary SW2: software.basic_backup Primary Backup Primary Backup Error model SW.HWSW_SWSWdep Error model SW.HWSW_SWSWdep HW:computer.basic SW-SW dependency HW-SW dependency HW:computer.basic SW-SW dependency HW-SW dependency M.SW_SWdep Error model HW.HWSW_HWHWdep HW-SW dependency HW-HW dependency Repairman: repairman.basic Error model HW.HWSW_HWHWdep HW-SW dependency HW-HW dependency M.SW M.SW Error model Repairman.Simple HW-HW dependency M.HW_SWdep M.HW_SWdep M.HW M.HW M.HW_HWdep M.HW_HWdep M.Repairman October 2005 Copyright ASSERT Project 8

9 Error Model Type error model SW features SW_Error_Free: initial error state; SW_Activation_Fault,SW_End_of_Error_Detection_Action, SW_Error_Non_Detected, SW_Error_Detected, SW_End_of_Exception_Handling, SW_In_Restart: error state; SW_Fault, SW_Detection_Action, SW_Detected, SW_Non_Detected,SW_Non_Detected_Disappear, SW_Non_Detected_Perceived,SW_Error_Detected_Handling, SW_Error_Temp, SW_Error_Perm, SW_Restart, Tempo: error event; end SW; October 2005 Copyright ASSERT Project 9

10 Type Transformation error model SW features SW_Error_Free: initial error state; SW_Activation_Fault, SW_End_of_Error_Detection_Action, SW_Error_Non_Detected, SW_Error_Detected, SW_End_of_Exception_Handling, SW_In_Restart: error state; SW_Fault, SW_Detection_Action, SW_Detected, SW_Non_Detected,SW_Non_Detected_Disappear, SW_Non_Detected_Perceived, SW_Error_Detected_Handling, SW_Error_Temp, SW_Error_Perm, SW_Restart: error event; end SW; SW_Non_D etected_pe rceived SW_Non_ Detected_ Disappear SW_Non_ Detected SW_Error_Non _Detected SW_Error _Detected _Handling SW_Error_Free SW_Fault SW_Activation_Fault SW_Detection _Action SW_End_of_ Error_Detection _Action SW_Error _Perm SW_ Detected SW_Error_ Detected SW_Restart SW_Error_ Temp SW_End_of _Exception_ Handling SW_In_Restart October 2005 Copyright ASSERT Project 10

11 Error Model Implementation error model implementation SW.Isolated transitions SW_Error_Free-[SW_Fault] -> SW_Activation_Fault; [ ] SW_In_Restart-[SW_Restart] -> SW_Error_Free; properties -- a fault occurs following a poisson distribution Occurrence => poisson 0,05 applies to SW_Fault; [ ] -- The restart takes some time Occurrence => poisson 60 applies to SW_Restart; end SW.Isolated; October 2005 Copyright ASSERT Project 11

12 Implementation Transformation error model implementation SW.Isolated transitions SW_Error_Free-[SW_Fault] -> SW_Activation_Fault; [ ] SW_In_Restart-[SW_Restart] -> SW_Error_Free; properties -- a fault occurs following a poisson distribution Occurrence => poisson 0,05 applies to SW_Fault; [ ] -- The restart takes some time Occurrence => poisson 60 applies to SW_Restart; end SW.Isolated; SW_Non_ Detected_ Disappear SW_Non_ Detected SW_Error_Free SW_Fault SW_Activation_Fault SW_Detection _Action SW_End_of_ Error_Detection _Action SW_ Detected SW_Restart SW_Non_D etected_pe rceived SW_Error_Non _Detected SW_Error _Detected _Handling SW_Error _Perm SW_Error_ Detected SW_Error_ Temp SW_End_of _Exception_ Handling SW_In_Restart October 2005 Copyright ASSERT Project 12

13 (Type +Impl.) Transformation error model implementation SW.Isolated transitions error model implementation SW.Isolated transitions SW_Error_Free-[SW_Fault] -> SW_Activation_Fault; [ ] properties SW_In_Restart-[SW_Restart] -> SW_Error_Free; -- a fault occurs following a poisson distribution Occurrence => poisson 0,05 applies to SW_Fault; [ ] properties SW_Error_Free-[SW_Fault] -> SW_Activation_Fault; SW_Activation_Fault-[SW_Detection_Action] -> SW_End_of_Error_Detection_Action; SW_End_of_Error_Detection_Action-[SW_Detected] -> SW_Error_Detected; SW_End_of_Error_Detection_Action-[SW_Non_Detected] -> SW_Error_Non_Detected; SW_Error_Detected-[SW_Error_Detected_Handling] -> SW_End_of_Exception_Handling; SW_Error_Non_Detected-[SW_Non_Detected_Disappear] -> SW_Error_Free; SW_Error_Non_Detected-[SW_Non_Detected_Perceived] -> SW_In_Restart; SW_End_of_Exception_Handling-[SW_Error_Temp] -> SW_Error_Free; SW_End_of_Exception_Handling-[SW_Error_Perm] -> SW_In_Restart; -- The restart takes some time SW_In_Restart-[SW_Restart] -> SW_Error_Free; Occurrence => poisson 60 applies to SW_Restart; end SW.Isolated; Occurrence => poisson 0,05 applies to SW_Fault; SW_Non_ Detected_ Disappear SW_Non_ Detected SW_Error_Free SW_Fault SW_Activation_Fault SW_Detection _Action SW_End_of_ Error_Detection _Action SW_ Detected SW_Restart Occurrence => poisson 10e+2 applies to SW_Detection_Action; Occurrence => fixed 0.7 applies to SW_Detected; Occurrence => fixed 0.3 applies to SW_Non_Detected; Occurrence => poisson 10e+10 applies to SW_Non_Detected_Disappear; Occurrence => poisson 10e+6 applies to SW_Non_Detected_Perceived; Occurrence => poisson 10e+2 applies to SW_Error_Detected_Handling; Occurrence => fixed 0.98 applies to SW_Error_Temp; Occurrence => fixed 0.02 applies to SW_Error_Perm; Occurrence => poisson 60 applies to SW_Restart; Occurrence => poisson applies to Tempo; end SW.Isolated; SW_Non_D etected_pe rceived SW_Error_Non _Detected SW_Error _Detected _Handling SW_Error _Perm SW_Error_ Detected SW_Error_ Temp SW_End_of _Exception_ Handling SW_In_Restart October 2005 Copyright ASSERT Project 13

14 Dependency in Error Model error model SW features [ ] SW_KO: in out error propagation; Both_SW_Dead: in error propagation; end SW; error model implementation SW.SWSWdep features SW_Needs_Restart, SW_Now_Restart, SW_Both_Dead: error state refines SW_In_Restart; transitions [ ] SW_Needs_Restart-[out SW_KO] -> SW_Needs_Restart; SW_Needs_Restart-[Tempo] -> SW_Now_Restart; SW_Needs_Restart-[in Both_SW_Dead] -> SW_Both_Dead; properties [ ] Occurrence => fixed 1 applies to SW_KO; end SW.SWSWdep; October 2005 Copyright ASSERT Project 14

15 Component implementation system implementation software.primary modes primary: initial mode; backup: mode; primary-[inp] -> backup; backup-[notification] -> primary; annex Error_Model {** Model => Mymodels::SW. SWSWdep; Vote_In => SW_Both_Dead when inp[sw_ko] and notification[sw_ko] applies to inp, notification; Vote_Transition => inp[sw_ko] applies to inp; Vote_Transition => notification[sw_ko] applies to notification; **}; end software.primary; October 2005 Copyright ASSERT Project 15

16 Transformation / Composition SW_KO Software Replica 1 Primary Backup SW_KO Software Replica 1 SW_KO Software Replica 2 SW_Now_Restart Primary Software Replica 2 Backup SW_Now_Restart tempo SW_Both_Dead SW_Needs_ Restart SW_KO SW_Needs _Restart tempo SW_Both_Dead SW_KO SW_KO Vote_In Both_SW_Dead Both_SW_Dead Vote_In October 2005 Copyright ASSERT Project 16

17 Error Model Annex Evolution Occurrence properties parametric Link between the mode model and the error model mode-dependent behaviour in presence of faults Vote_In and Vote_Out properties evaluate Boolean error expressions when needed Inheritance and refinements similarly to the core standard mechanisms October 2005 Copyright ASSERT Project 17

18 Summary AADL system error model Stepwise construction Building error models as if components were isolated Adding dependencies progressively Error Model Annex assessment Model transformation: manual automatic October 2005 Copyright ASSERT Project 18

19 Dependability Modelling using AADL and the AADL Error Model Annex Ana Rugina October 2005 Copyright ASSERT Project 19