The document describes model-driven development of ARINC 653 configuration tables using a PIM-PSM mapping process. It was developed as part of the DIANA project to improve the use of model-driven engineering in avionics systems. The mapping process involves importing platform independent and hardware models, allocating applications to partitions and resources, specifying interfaces, communication and health monitoring tables, and generating configuration files and artifacts with traceability. A PIM-PSM editor was created to implement the mapping as a series of model transformations while ensuring contracts and validating models. The approach aims to systematically generate safety-critical configurations from models.

1. Model-Driven Development ofModel-Driven Development of
ARINC 653 Configuration TablesARINC 653 Configuration Tables
Model-Driven Development ofModel-Driven Development of
ARINC 653 Configuration TablesARINC 653 Configuration Tables
Ákos HorváthÁkos Horváth, Dániel Varró, Dániel Varró
Budapest University of Technology and EconomicsBudapest University of Technology and Economics
Tobias SchoofsTobias Schoofs
GMVGMV
Ákos HorváthÁkos Horváth, Dániel Varró, Dániel Varró
Budapest University of Technology and EconomicsBudapest University of Technology and Economics
Tobias SchoofsTobias Schoofs
GMVGMV

2. 2
OutlineOutlineOutlineOutline
Overview and Context
Model-Driven Development of
Configuration Tables
Conclusions

3. 3
OutlineOutlineOutlineOutline
Overview and Context
Model-Driven Development of
Configuration Tables
Conclusions

4. 4
Introduction and ObjectivesIntroduction and ObjectivesIntroduction and ObjectivesIntroduction and Objectives
DIANA – Distributed equipment Independent
environment for Advanced avioNic Application
 EU funded research project
 GMV, AleniaSia, Atego, Dassault, Embraer, NLR, THALES,
TU Budapest and Karlsruhe Institute of Technology
 2006-2010
Objectives:
 to improve the use of MDD in avionics systems development
 to enable the execution of object oriented applications over virtual
machines on avionics platforms (e.g., SC-Java)
 to provide services supporting secure distribution (e.g. RT CORBA)
for avionics applications

5. 5
Introduction and ObjectivesIntroduction and ObjectivesIntroduction and ObjectivesIntroduction and Objectives
DIANA – Distributed equipment Independent
environment for Advanced avioNic Application
 EU funded research project
 GMV, AleniaSia, Atego, Dassault, Embraer, NLR, THALES,
TU Budapest and Karlsruhe Institute of Technology
 2006-2010
Objectives:
 to improve the use of MDE in avionics systems development
 to enable the execution of object oriented applications over virtual
machines on avionics platforms (e.g., SC-Java)
 to provide services supporting secure distribution (e.g. RT CORBA)
for avionics applications

6. Goal of MDD in DIANAGoal of MDD in DIANAGoal of MDD in DIANAGoal of MDD in DIANA
Demonstrate the use of MDD in an avionics context
Systematic Design of ARINC653 configuration tables
Design Space Exploration problem
 functionally equivalent solutions
 selection based on
− quality metrics
− non-functional requirements
Support Certification activities by
 integration of V&V activities
 traceability between models and file artifacts
 on-the-fly validation
Target Platforms
 Wind River VxWorks ARINC 653
− COTS RTOS
 GMV SIMA – Simulated Integrated Modular Avionics
− functional ARINC653 OS simulator
6

7. 7
OutlineOutlineOutlineOutline
Overview and Context
Model-Driven Development of
Configuration Tables
Conclusions

8. 8
Model Driven System DevelopmentModel Driven System DevelopmentModel Driven System DevelopmentModel Driven System Development
Platform
Independent
Model
Platform
Independent
Model
Platform
Specific
Model
Platform
Specific
Model
Software
Application
Software
Application
PIM-to-PSM
mapping
Code
generation
Platform Independent Model
(PIM)
 Precise specification of
− Requirements
− Architecture
− Behavior
Platform Specific Model
 Implementation details of
− Communication
− Interfaces
− Services
− Deployment

9. 9
Continuous
V&V
Process
Application of MDE to Safety Critical System DevelopmentApplication of MDE to Safety Critical System DevelopmentApplication of MDE to Safety Critical System DevelopmentApplication of MDE to Safety Critical System Development
Platform
Independent
Model
Platform
Independent
Model
Behavioral
model
Behavioral
model
Architectural
model
Architectural
model
Software
Components
Software
Components
System
configuration
System
configuration
Correct refinement /
Design decisions
Model consistency
Certified
Code Generators
Model
Checking
Model
Checking
TestingTesting
TraceabilityTraceability
WCET
Analysis
WCET
Analysis
Resource
Allocation
Application
Scheduling
Replication
Testing
Certification
Traceability
Interface
Mapping
SysML,
Simulink
Stateflow

10. 10
Continuous
V&V
Process
Application of MDE to Safety Critical System DevelopmentApplication of MDE to Safety Critical System DevelopmentApplication of MDE to Safety Critical System DevelopmentApplication of MDE to Safety Critical System Development
Platform
Independent
Model
Platform
Independent
Model
Behavioral
model
Behavioral
model
Architectural
model
Architectural
model
Software
Components
Software
Components
System
configuration
System
configuration
Correct refinement /
Design decisions
Model consistency
Certified
Code Generators
Model
Checking
Model
Checking
TestingTesting
TraceabilityTraceability
WCET
Analysis
WCET
Analysis
Resource
Allocation
Application
Scheduling
Replication
Testing
Certification
Traceability
Interface
Mapping
SysML,
Simulink
Stateflow
PIM-PSMMapping

11. 11
Models of PIM-PSM mappingModels of PIM-PSM mappingModels of PIM-PSM mappingModels of PIM-PSM mapping
Inputs:
 PIM:
− List of required SW functionalities
− Non-functional attrs (redundancy)
− Symbolic message specs
 HW: ARINC platform model
− Capability of underlying HW/SW platform (ARINC
653)
Intermediate models:
 Allocated model
− From functionalities
− To ARINC 653 platform
Outputs:
 Configuration tables
 End-to-end traceability links

12. 12
PIM-PSM mapping processPIM-PSM mapping processPIM-PSM mapping processPIM-PSM mapping process
Tasks:
 Design input models
− Platform Independent Model
− Platform/Hardware Description Model
 Express design constraints
− Performance, dependability, security
 Define variability points
 Resource allocation
 (Scheduling/Optimization)
 Generate design artifacts
− Configuration tables, etc.
Challenges:
 Design constraints (functional + non-functional)?
 Designer-driven mapping?
 Design process + roles?
 Traceability?

13. 13
DIANA PIM-DIANA PIM-
PSM EditorPSM Editor
DIANA PIM-DIANA PIM-
PSM EditorPSM Editor

14. 14
Model import
Import various input models
• Platform independent
• Architectural description
• ARINC 653 Platform
specification
•Support COTS models
• Simulink
•Resolution of dependability parameters
• replication
Model import
Import various input models
• Platform independent
• Architectural description
• ARINC 653 Platform
specification
•Support COTS models
• Simulink
•Resolution of dependability parameters
• replication
DIANA PIM-DIANA PIM-
PSM EditorPSM Editor
DIANA PIM-DIANA PIM-
PSM EditorPSM Editor

15. 15
Application definition and allocation
•Definition
• ARINC 653 partitions
• Memory requirements
• Compatibility mapping
•Automated allocation
• All solutions are generated
• Based on predefined constraints
Application definition and allocation
•Definition
• ARINC 653 partitions
• Memory requirements
• Compatibility mapping
•Automated allocation
• All solutions are generated
• Based on predefined constraints
DIANA PIM-DIANA PIM-
PSM EditorPSM Editor
DIANA PIM-DIANA PIM-
PSM EditorPSM Editor

16. 16
Interface Control Document (ICD)
Specification of Data types and Messages
•Definition
• Message details
• Concrete platform specific types
•Mapping
• Symbolic types to concrete types
•Validation of ICD constraints
• Resolution
• Keys
Interface Control Document (ICD)
Specification of Data types and Messages
•Definition
• Message details
• Concrete platform specific types
•Mapping
• Symbolic types to concrete types
•Validation of ICD constraints
• Resolution
• Keys
DIANA PIM-DIANA PIM-
PSM EditorPSM Editor
DIANA PIM-DIANA PIM-
PSM EditorPSM Editor

17. 17
Communication
•Definition
• Interface types (e.g., ARINC653)
• Channel compatibility mapping
•Automated allocation
• Communication Channels
•Validation of Interface Architecture
•Visualization
Communication
•Definition
• Interface types (e.g., ARINC653)
• Channel compatibility mapping
•Automated allocation
• Communication Channels
•Validation of Interface Architecture
•Visualization
DIANA PIM-DIANA PIM-
PSM EditorPSM Editor
DIANA PIM-DIANA PIM-
PSM EditorPSM Editor

18. 18
Health Monitoring Tables
•Definition
• Standard
• HM tables
• ARINC 653 actions
• VxWorks specific
• Error code
• Action specification
Health Monitoring Tables
•Definition
• Standard
• HM tables
• ARINC 653 actions
• VxWorks specific
• Error code
• Action specification
DIANA PIM-DIANA PIM-
PSM EditorPSM Editor
DIANA PIM-DIANA PIM-
PSM EditorPSM Editor

19. 19
Configuration Generation
•Generated artifacts
• Middleware configuration
• ICD Descriptors
• AIDA Logbook configuration
• VxWorks specific ARINC653 files
• Trace files
Configuration Generation
•Generated artifacts
• Middleware configuration
• ICD Descriptors
• AIDA Logbook configuration
• VxWorks specific ARINC653 files
• Trace files
DIANA PIM-DIANA PIM-
PSM EditorPSM Editor
DIANA PIM-DIANA PIM-
PSM EditorPSM Editor

20. 20
Traceability
•End-to-End traceability from PIADL to
generated artifacts
•Model-to-Model: based on the
Integrated System Model
•Model-to-Text: separately generated
for each artifact
•Explicit traceability definition
Traceability
•End-to-End traceability from PIADL to
generated artifacts
•Model-to-Model: based on the
Integrated System Model
•Model-to-Text: separately generated
for each artifact
•Explicit traceability definition
DIANA PIM-DIANA PIM-
PSM EditorPSM Editor
DIANA PIM-DIANA PIM-
PSM EditorPSM Editor

21. Additional FeaturesAdditional FeaturesAdditional FeaturesAdditional Features
Contracts
Design-by-contract principles
Steps of the workflow guarded by contracts
− precondition defines ”what is expected” from the input
− postcondition defines ”what is guaranteed” for the output
On-the-fly validation of contracts
Development means
Extensive use of open source tools and platforms
−Eclipse, EMF, JET, UML-EMF, VIATRA2 MT
Integration of off-the-shelf tools (e.g. Simulink)
Tool integration driven by models and transformations
21

22. 22
Summary of PIM-PSM mapping processSummary of PIM-PSM mapping processSummary of PIM-PSM mapping processSummary of PIM-PSM mapping process
Design constraints (functional + non-functional)?
 Dependability + Performance attributes
Designer-driven mapping?
 Partial automation
 On-the-fly detection of design constraint validation
 No automation of human design decisions
Design process + roles?
 Systematic design workflow
 Precise development steps (start + end requirements)
 Assembled into complex design workflows
Traceability?
 End-to-end traceability persisted as models
 Inter-model traceability
 Model-to-text traceability
 Closely aligned with V&V activities

23. 23
OutlineOutlineOutlineOutline
Overview and Context
Model-Driven Development of
Configuration Tables
Conclusions

24. Summary and Future WorkSummary and Future WorkSummary and Future WorkSummary and Future Work
Model-driven development in DIANA
 Feasible for configuring avionics systems
 Relies on heavy use of models
− From various viewpoints (architectural, behavioral, dependency, etc.)
− On various levels of abstraction (PIM, PSM)
− Captured in various tools
 Adaptive and customizable process for new
− Modeling standards
− Software and Hardware platforms
Future work
 Collaborative support for model development
− Versioning, distributed development, access control
 Early model-based verification and validation
− Compositionality, scalability, back-annotation
 Certification of model transformation
 Model-Based tool integration
24