CN102184136B - Method for checking operation state and demand consistency of AADL (Architecture Analysis and Design Language) model - Google Patents

Abstract

The invention provides a method for checking operation state and demand consistency of an AADL (Architecture Analysis and Design Language) model, which comprises the steps of: 1, constructing the AADL model according to state in demand and state transition, wherein mode and mode transition in the AADL model respectively correspond to the state in demand and the state transition; 2, converting the mode and the mode transition in the AADL mode into a Petri network model; 3, calculating an incidence matrix C of the Petri network mode; and 4, judging whether the operation state of the constructed AADL mode is consistent with the demand by using a state equation of the Petri network model. In the invention, the mode and the mode transition in the AADL model are mapped to place and transition in the Petri network model, and the Petri network model is used as a measured model, an accessible state set of the AADL model is calculated by combining with properties of the Petri network model and characteristics of the AADL model, therefore, the purpose of judging whether the operation state of the constructed AADL model is consistent to the demand is achieved, the correctness of the constructed AADL model is improved, the system building time is shortened, and the system building cost is saved.

Description

A kind of checking AADL model running state and the conforming method of demand

Technical field

The present invention relates to a kind of checking AADL model running state and the conforming method of demand,

Background technology

In recent years, be accompanied by the continuous increase of scale and the complexity of embedded software, its construction cycle and cost of development also sharply increase, also more and more higher to the requirement of NOT-function attribute.Traditional take the development approach that code is core and can not adapt to this trend, the emphasis of exploitation progressively advances to Stage from code level.Model-driven architecture method MDA (Model Driven Architecture) is exactly a kind of very promising software development methodology based on model being proposed by OMG.Use MDA software development methodology, system designer changes into demand in the design phase a kind of model of Formal Language Description, again system model is carried out to sufficient analysis verification, most of error and solution that may exist, the probability going wrong in the code that system model is generated automatically will reduce greatly, when there is change in system, regenerate code after only need to revising system model, MDA method has become the study hotspot in embedded software developing at present.The key problem of successful Application model driving development method is exactly that can model completely correctly reflect software requirement.The present invention proposes constructed system model running status and the conforming verification method of demand in a kind of software development process based on AADL model.

AADL (Architecture Analysis and Design Language, structure analysis and design language) the lower exploitation of the Shi Mechanic Engineer SAE of association (Society of Automotive Engineers) guidance, in the development approach based on model-driven, be most widely used at present.AADL by member abstract be software component, carry out 3 types of platform (hardware) and the components of a system, according to the interaction between member and member, the structure of application system is described and is analyzed, and support the description to embedded software NOT-function attribute.AADL model is also indifferent to concrete function and is realized, what describe is only system framework, thereby in architecture level, the NOT-function attribute of system is carried out to stipulations, be applicable to the embedded system that challenging resource constraint (as size, weight and power), strict requirement of real time and high-performance guarantee grade.

Towards the testing tool of AADL, mainly comprise at present the Open-Source Tools collection OSATE (open source AADL tool environment) of SEI exploitation, the global simulation instrument ADeS instrument of Axlog exploitation etc.OSATE provides modeling based on AADL and basic semantic test and Architecture Analysis etc., but the input and output connection etc. that lays particular emphasis on member in model checks and analyzes.It is target that the ADeS instrument of Axlog exploitation be take the global analysis of model, but also not support mode and pattern migration at present can only be carried out task analysis, not the running status of can completely verification system under originate mode.The Study on Test Method > > of the computer science disclosed < < of o. 11th AADL model in 2009 utilizes Markov chain model to test AADL model, to investigate the consistance of the model behavior of expecting in institute's established model and demand, but its threshold value etc. obtains according to experience, test result shortcoming accuracy, and last judged result can only broadly say that constructed AADL pattern migration is wrong, can not clearly state mistake and occur in which event migration.

Summary of the invention

Technology of the present invention is dealt with problems and is: overcome the deficiencies in the prior art, a kind of checking AADL model running state and the conforming method of demand are provided, improved the reliability that AADL model is set up.

Technical solution of the present invention is: a kind of checking AADL model running state and the conforming method of demand, and step is as follows:

(1) state according to demand and state transition build AADL model, pattern and pattern migration state and the state transition in corresponding demand respectively in AADL model;

(2) by pattern in AADL model and pattern Transport And Transformation, be Petri pessimistic concurrency control, the transformational relation of AADL model and Petri pessimistic concurrency control is: the mode map in AADL model is the s of storehouse institute in Petri pessimistic concurrency control _i, the s of storehouse institute _iset form S that storehouse collects, i ∈ [0, n], initially the storehouse s of institute ₀token be that the migration of pattern in 1, AADL model is mapped as the transition t in Petri pessimistic concurrency control _j, transition t _jset form transition collection T, j ∈ [1, m];

(3) calculate the incidence matrix C of Petri pessimistic concurrency control, incidence matrix C is collected Sx transition with storehouse and is integrated T as order mark collection, the Elements C (s of its incidence matrix C _i, t _j)=W (t _j, s _i)-W (s _i, t _j), W (s, t) is the power on (s, t), W (t, s) is the power on (t, s);

(4) utilize the state equation of Petri pessimistic concurrency control to judge that whether the AADL model running state building is consistent with demand, concrete deterministic process is as follows:

1) all states in demand are identified to the state st in demand according to storehouse in its corresponding Petri pessimistic concurrency control _icorresponding to the s of storehouse institute in Petri pessimistic concurrency control _i, all state transitions in demand identify according to transition in its corresponding Petri pessimistic concurrency control, the state transition tr in demand _jcorresponding to transition t in Petri pessimistic concurrency control _j, list st according to demand ₀become st _iq transition sequence T, q>=1;

2) for each transition sequence, by the state equation M of Petri pessimistic concurrency control ₀+ CU=M calculates dbjective state sign M, according to M (st in M _i) value judge that whether AADL model running state consistent with demand;

The state equation of described Petri pessimistic concurrency control is M ₀+ CU=M, M ₀for the definite original state mark vector of the state according to demand,

vector element M ₀(st _i) be the lower st of this sign _ithe token value at place; C is incidence matrix; U is the definite transition mark vector of state transition according to demand,

its state elements U (tr _j) be transition tr in concrete transition sequence _jcorresponding sign, as transition tr _ju (tr during generation _j) be 1, transition tr _ju (tr while not occurring _j) be 0; M is the dbjective state mark vector of Petri pessimistic concurrency control,

vector element M (st _i) be the lower st of this sign _ithe token value at place;

According to M (st in M _i) value judge that the AADL model running state process whether consistent with demand is: establish f _pbe p transition sequence T _pthe AADL model running state sign whether consistent with demand after conversion, p ∈ [1, q], if p transition sequence T _pin contain and cause state st _ithe direct transition number and the M (st that occur _i) value identical, at p transition sequence T _plower constructed AADL model running state is consistent with demand, puts f _p=1; If p transition sequence T _pin contain and cause state st _ithe direct transition number and the M (st that occur _i) value not identical, at p transition sequence T _plower constructed AADL model running state and demand are inconsistent, put f _p=0;

If F _i=f ₁* f ₂* ... * f _p* ... * f _qif, F _i=1, from st ₀become st _iq feasible transition sequence T under constructed AADL model running state consistent with demand; If F _i=0, from st ₀become st _iq feasible transition sequence T under constructed AADL model running state and demand inconsistent.

The present invention's beneficial effect is compared with prior art: the present invention proposes " pattern " in AADL model and " pattern migration " to be mapped as the storehouse transition in one's power in Petri pessimistic concurrency control, and using this Petri pessimistic concurrency control as tested model, feature in conjunction with Petri pessimistic concurrency control character and AADL model is calculated the state set that AADL model can reach, reach whether consistent with the demand object of AADL model running state that judgement is set up, thereby improved the correctness of the AADL model of building, shorten the system made time, saved system made cost.

Accompanying drawing explanation

Fig. 1 is process flow diagram of the present invention;

Fig. 2 is the mapping relations figure of AADL model and Petri net.

Embodiment

By " pattern " of member in AADL model and " pattern migration " is mapped as to Petri pessimistic concurrency control, and incidence matrix and the state equation scheduling theory in conjunction with Petri, netted, formed and judged constructed AADL model running state and the conforming verification method of demand, as shown in Figure 1, concrete implementation step is as follows for its flow process:

(1) state according to demand and state transition build AADL model, pattern and pattern migration state and the state transition in corresponding demand respectively in AADL model;

(2) by pattern in AADL model and pattern Transport And Transformation, be Petri pessimistic concurrency control, the transformational relation of AADL model and Petri pessimistic concurrency control is: the mode map in AADL model is the s of storehouse institute in Petri pessimistic concurrency control _i, the s of storehouse institute _iset form S that storehouse collects, i ∈ [0, n], initially the storehouse s of institute ₀token be that the migration of pattern in 1, AADL model is mapped as the transition t in Petri pessimistic concurrency control _j, transition t _jset form transition collection T, j ∈ [1, m];

Petri netting gear has abundant system to describe means and behavioral analysis technology, is a kind of model that is suitable for describing the behavior of distribution concurrent system.Petri pessimistic concurrency control is defined as hexa-atomic group of ∑=(S, T; F, K, W, M ₀), S library representation institute (place) collection wherein, T represents transition (transition) collection, the flow relation (flow relation) of F for constructing from S and T.K, W and M ₀be respectively the capacity function of ∑, weight function and initial marking.

Because AADL model is indifferent to concrete function, realize, but in framework level, system is carried out to modeling.Be that pattern in AADL model and pattern migration are the descriptions to system state and variation on system level, therefore in this sense, it is 1 that AADL model conversation is become to corresponding weight function W after Petri pessimistic concurrency control, capacity function K >=1.

(3) calculate the incidence matrix C of Petri pessimistic concurrency control, incidence matrix C is with S that storehouse is collected _xtransition integrate T as order mark collection, the Elements C (s of its incidence matrix C _i, t _j)=W (t _j, s _i)-W (s _i, t _j), W (s, t) is the power on (s, t), W (t, s) is the power on (t, s);

(4) utilize the state equation of Petri pessimistic concurrency control to judge that whether the AADL model running state building is consistent with demand, concrete deterministic process is as follows:

1) all states in demand are identified to the state st in demand according to storehouse in its corresponding Petri pessimistic concurrency control _icorresponding to the s of storehouse institute in Petri pessimistic concurrency control _i, all state transitions in demand identify according to transition in its corresponding Petri pessimistic concurrency control, the state transition tr in demand _jcorresponding to transition t in Petri pessimistic concurrency control _j, list st according to demand ₀become st _iq transition sequence T, q>=1;

2) for each transition sequence, by the state equation M of Petri pessimistic concurrency control ₀+ CU=M calculates dbjective state sign M, according to M (st in M _i) value judge that whether AADL model running state consistent with demand;

The state equation of Petri pessimistic concurrency control is M ₀+ CU=M, M ₀for the definite original state mark vector of the state according to demand,

vector element M ₀(st _i) be the lower st of this sign _ithe token value at place; C is incidence matrix; U is the definite transition mark vector of state transition according to demand,

its state elements U (tr _j) be transition tr in concrete transition sequence _jcorresponding sign, as transition tr _ju (tr during generation _j) be 1, transition tr _ju (tr while not occurring _j) be 0; M is the dbjective state mark vector of Petri pessimistic concurrency control,

vector element M (st _i) be the lower st of this sign _ithe token value at place;

According to M (st in M _i) value judge that the AADL model running state method whether consistent with demand is: establish f _pbe p transition sequence T _pthe AADL model running state sign whether consistent with demand after conversion, p ∈ [1, q], if p transition sequence T _pin contain and cause state st _ithe direct transition number and the M (st that occur _i) value identical, at p transition sequence T _plower constructed AADL model running state is consistent with demand, puts f _p=1; If p transition sequence T _pin contain and cause state st _ithe direct transition number and the M (st that occur _i) value not identical, at p transition sequence T _plower constructed AADL model running state and demand are inconsistent, put f _p=0;

If F _i=f ₁* f ₂* ... * f _p* ... * f _qif, F _i=1, from st ₀become st _iq feasible transition sequence T under constructed AADL model running state consistent with demand; If F _i=0, from st ₀become st _iq feasible transition sequence T under constructed AADL model running state and demand inconsistent.

Embodiment:

The flight control system of take is example, and implementation step of the present invention is described:

First a given simple demand.The present invention pays close attention to the state in demand and causes the event of state transition.System receives takes off after signal, from original state, enters the standby condition of taking off.Then judge stating control condition, if stating control condition is improper, the system grounding, rudder controls 0, returns to original state.If stating control condition meets, enter takeoff condition, in the process of taking off, by calculating the control state of flights such as angle, until end of run enters grounding state, rudder controls 0, returns to original state.

(1) state according to demand and state transition build AADL model, pattern and pattern migration state and the state transition in corresponding demand respectively in AADL model, and constructed AADL model is as shown in the left-half of Fig. 2 according to demand.

(2) according to transformational relation, convert the pattern in constructed AADL model and pattern migration to Petri pessimistic concurrency control, result right half part as shown in Figure 2, wherein, s ₀represent original state, s ₁represent to take off standby condition, s ₂represent grounding state, s ₃represent takeoff condition; t ₁represent to take off signal, t ₂represent that stating control condition is improper, t ₃represent that rudder controls 0, t ₄represent that stating control condition is suitable, t ₅represent end of run.

(3) calculate the incidence matrix C of Petri pessimistic concurrency control, the matrix element C (s of its incidence matrix _i, t _j)=W (t _j, s _i)-W (s _i, t _j), therefore, the corresponding incidence matrix of Fig. 2 right half part is:

(4) utilize the state equation of Petri pessimistic concurrency control to judge that whether the AADL model running state building is consistent with demand;

All states in demand are identified according to storehouse in its corresponding Petri pessimistic concurrency control, obtain: st ₀represent original state, st ₁represent to take off standby condition, st ₂represent grounding state, st ₃represent takeoff condition; All state transitions in demand identify according to transition in its corresponding Petri pessimistic concurrency control, obtain: tr ₁represent to take off signal, tr ₂represent that stating control condition is improper, tr ₃represent that rudder controls 0, tr ₄represent that stating control condition is suitable, tr ₅represent end of run.

According to demand, original state mark vector

According to the determination methods described in invention, get i=1,2,3, carry out respectively the consistance judgement of AADL model running state and demand:

When i=1

1) list st according to demand ₀become st ₁feasible transition sequence, totally 1;

Transition sequence 1: receive the signal that takes off, corresponding to the tr in demand ₁occur.

2) for this transition sequence, by the state equation M of Petri pessimistic concurrency control ₀+ CU=M calculates dbjective state sign M, according to M (st in M ₁) value judge that whether AADL model running state consistent with demand;

For this transition sequence T ₁,

according to the state equation M of ∑ ₀+ CU=M, calculates under this transition sequence, the dbjective state collection M of system.

$M=\left[\begin{array}{c}1\\ 0\\ 0\\ 0\end{array}\right]+\left[\begin{array}{ccccc}-1& 0& 1& 0& 0\\ 1& -1& 0& -1& 0\\ 0& 1& -1& 0& 1\\ 0& 0& 0& 1& -1\end{array}\right]\left[\begin{array}{c}1\\ 0\\ 0\\ 0\\ 0\end{array}\right]=\begin{array}{}\left[\begin{array}{c}0\\ 1\\ 0\\ 0\end{array}\right]\end{array}$

M (st now ₁)=1.

Because T ₁in contain 1 and cause state st ₁the direct transition tr occurring ₁, i.e. T ₁in contain and cause state st ₁the direct transition number and the M (st that occur ₁) value identical, so f ₁=1.

F ₁=f ₁=1, illustrate from st ₀become st ₁transition sequence under constructed AADL model running state be consistent with demand;

When i=2

1) list st according to demand ₀become st ₂feasible transition sequence, totally two;

Transition sequence 1: receive the signal that takes off, stating control condition does not meet, corresponding to the tr in demand ₁, tr ₂occur;

Transition sequence 2: receive the signal that takes off, stating control condition meets, and end of run, corresponding to the tr in demand ₁, tr ₄, tr ₅occur.

2) for each transition sequence, by the state equation M of Petri pessimistic concurrency control ₀+ CU=M calculates dbjective state sign M, according to M (st in M _i) value judge that whether AADL model running state consistent with demand;

For the 1st transition sequence T ₁, according to the state equation M of ∑ ₀+ CU=M, calculates under this transition sequence, the dbjective state collection M of system.

$M=\left[\begin{array}{c}1\\ 0\\ 0\\ 0\end{array}\right]+\left[\begin{array}{ccccc}-1& 0& 1& 0& 0\\ 1& -1& 0& -1& 0\\ 0& 1& -1& 0& 1\\ 0& 0& 0& 1& -1\end{array}\right]\left[\begin{array}{c}1\\ 1\\ 0\\ 0\\ 0\end{array}\right]=\begin{array}{c}\left[\begin{array}{c}0\\ 0\\ 1\\ 0\end{array}\right]\end{array}$

M (st now ₂)=1.

At this transition sequence T ₁only comprise down 1 and cause st ₂the direct transition tr occurring ₂.So f ₁=1.

For the 2nd transition T ₂,

according to the state equation M of ∑ ₀+ CU=M, calculates under this transition sequence the target identification of system

M (st now ₂)=1.

At this transition sequence T ₂under contain 1 and cause st ₂the direct transition tr occurring ₅.Therefore under this transition sequence, constructed AADL meets demand, f ₂=1.

To sum up, F ₂=f ₁* f ₂=1, illustrate from st ₀become st ₂transition sequence under constructed AADL model running state be consistent with demand;

When i=3

1) list st according to demand ₀become st ₃feasible transition sequence, totally 1;

Transition sequence 1: receive the signal that takes off, stating control condition is suitable, corresponding to the tr in demand ₁, tr ₄occur.

2) for this transition sequence, by the state equation M of Petri pessimistic concurrency control ₀+ CU=M calculates dbjective state sign M, according to M (st in M ₁) value judge that whether AADL model running state consistent with demand;

For this transition sequence T ₁, according to the state equation M of ∑ ₀+ CU=M, calculates under this transition sequence, the dbjective state collection M of system.

$M=\left[\begin{array}{c}1\\ 0\\ 0\\ 0\end{array}\right]+\left[\begin{array}{ccccc}-1& 0& 1& 0& 0\\ 1& -1& 0& -1& 0\\ 0& 1& -1& 0& 1\\ 0& 0& 0& 1& -1\end{array}\right]\left[\begin{array}{c}1\\ 0\\ 0\\ 1\\ 0\end{array}\right]=\begin{array}{c}\left[\begin{array}{c}0\\ 0\\ 0\\ 1\end{array}\right]\end{array}$

M (st now ₃)=1.

Because T ₁in contain 1 and cause state st ₃the direct transition tr occurring ₄, i.e. T ₁in contain and cause state st ₃the direct transition number and the M (st that occur ₃) value identical, so f ₁=1.

F ₃=f ₁=1, illustrate from st ₀become st ₃transition sequence under constructed AADL model running state be consistent with demand;

Because F ₁, F ₂, F ₃value be 1, so constructed AADL model is consistent with demand.

Illustrate: if F _i=0, illustrate from original state st ₀to dbjective state st _itransition sequence have problem, need to return to modification modelling.

The present invention not detailed description is known to the skilled person technology.

Claims (1)

1. verify AADL model running state and the conforming method of demand, it is characterized in that step is as follows:

(1) state according to demand and state transition build AADL model, pattern and pattern migration state and the state transition in corresponding demand respectively in AADL model;

(2) by pattern in AADL model and pattern Transport And Transformation, be Petri pessimistic concurrency control, the transformational relation of AADL model and Petri pessimistic concurrency control is: the mode map in AADL model is the s of storehouse institute in Petri pessimistic concurrency control _i, the s of storehouse institute _iset form S that storehouse collects, i ∈ [0, n], initially the storehouse s of institute ₀token be that the migration of pattern in 1, AADL model is mapped as the transition t in Petri pessimistic concurrency control _j, transition t _jset form transition collection T, j ∈ [1, m];

(3) calculate the incidence matrix C of Petri pessimistic concurrency control, incidence matrix C is multiplied by transition with S that storehouse is collected and integrates T as order mark collection, the Elements C (s of its incidence matrix C _i, t _j)=W (t _j, s _i)-W (s _i, t _j), W (s, t) is the power on (s, t), W (t, s) is the power on (t, s);

(4) utilize the state equation of Petri pessimistic concurrency control to judge that whether the AADL model running state building is consistent with demand, concrete deterministic process is as follows:

1) all states in demand are identified to the state st in demand according to storehouse in its corresponding Petri pessimistic concurrency control _icorresponding to the s of storehouse institute in Petri pessimistic concurrency control _i, all state transitions in demand identify according to transition in its corresponding Petri pessimistic concurrency control, the state transition tr in demand _jcorresponding to transition t in Petri pessimistic concurrency control _j, list st according to demand ₀become st _iq transition sequence T, q>=1;

2) for each transition sequence, by the state equation M of Petri pessimistic concurrency control ₀+ CU=M calculates dbjective state sign M, according to M (st in M _i) value judge that whether AADL model running state consistent with demand;

The state equation of described Petri pessimistic concurrency control is M ₀+ CU=M, M ₀for the definite original state mark vector of the state according to demand,

vector element M ₀(st _i) be the lower st of this sign _ithe token value at place; C is incidence matrix; U is the definite transition mark vector of state transition according to demand,

its state elements U (tr _j) be transition tr in concrete transition sequence _jcorresponding sign, as transition tr _ju (tr during generation _j) be 1, transition tr _ju (tr while not occurring _j) be 0; M is the dbjective state mark vector of Petri pessimistic concurrency control,

vector element M (st _i) be the lower st of this sign _ithe token value at place;

According to M (st in M _i) value judge that the AADL model running state process whether consistent with demand is: establish f _pbe p transition sequence T _pthe AADL model running state sign whether consistent with demand after conversion, p ∈ [1, q], if p transition sequence T _pin contain and cause state st _ithe direct transition number and the M (st that occur _i) value identical, at p transition sequence T _plower constructed AADL model running state is consistent with demand, puts f _p=1; If p transition sequence T _pin contain and cause state st _ithe direct transition number and the M (st that occur _i) value not identical, at p transition sequence T _plower constructed AADL model running state and demand are inconsistent, put f _p=0;

If F _i=f ₁* f ₂* ... * f _p* ... * f _qif, F _i=1, from st ₀become st _iq feasible transition sequence T under constructed AADL model running state consistent with demand; If F _i=0, from st ₀become st _iq feasible transition sequence T under constructed AADL model running state and demand inconsistent.

Images