Job No/ 1 © British Crown Copyright 2008/MOD Developing a High Integrity Code Generator Using iUML/iCCG Sam Moody AWE plc, Aldermaston, Berkshire, United Kingdom

Job No/ 2 © British Crown Copyright 2008/MOD Outline l Motivation l Building a code generator with iUML/iCCG l Application Development with iUML l Current Results l Other work exploring xUML

Job No/ 3 © British Crown Copyright 2008/MOD Motivation l Historically development has been based on bespoke processes l Research advances in software engineering in academia and industry l Links AWE formal methods research to commercial toolsets l Explore code generation l Combined with tried and trusted high integrity tools such as the SPARK toolset

Job No/ 4 © British Crown Copyright 2008/MOD Challenging Requirements l We must demonstrate 100% freedom of anomalous behaviour l 30 year working life cycle l Not to be maintained l Process and design must be understood over life

Job No/ 5 © British Crown Copyright 2008/MOD Tool Selection – Why xUML l UML is the prevalent modelling technology in use by the software industry at large l UML suffers semantic weaknesses l Precise Executable profile of the Unified Modelling Language (xUML) l Adds Action Semantics to Standard UML Diagrams l Supports Model Driven Architecture

Job No/ 6 © British Crown Copyright 2008/MOD Tool Selection – Why Kennedy-Carter l Interested in the application of static techniques l A business model which encourages technology transfer l Code generators built using the xUML formalism l Models are platform independent with full behavioural specification defined in ASL l No need to embed target code (i.e. SPARK, Ada or C)

Job No/ 7 © British Crown Copyright 2008/MOD Outline l Motivation l Building a code generator with iUML/iCCG l Application Development with iUML l Current Results l Other work exploring xUML

Job No/ 8 © British Crown Copyright 2008/MOD Building a code generator with iCCG Implementation Definition of Mapping Rules Requirements of software platform Code Generator

Job No/ 9 © British Crown Copyright 2008/MOD Code Generator Development with iUML l iCCG is a meta-model of the entire xUML profile itself in xUML l The classes in the iCCG are instantiated by the model for which code is to be generated l Operations added in ASL to target code generation to the desired language – ie. SPARK l Existing xUML code generators include targets such as C, C++, Java and Ada

Job No/ 10 © British Crown Copyright 2008/MOD Extract of the iCCG Meta-model Class Attribute Operation © Copyright Kennedy Carter Ltd Reproduced with permission

Job No/ 11 © British Crown Copyright 2008/MOD Building a code generator with iCCG

Job No/ 12 © British Crown Copyright 2008/MOD Building a code generator with iCCG

Job No/ 13 © British Crown Copyright 2008/MOD Building a code generator with iCCG l Precise xUML model of xUML l The same formalism used for application and code generator development l The code generator design will have longevity l Transformation rules are readily understandable l Allows different implementations to be targeted

Job No/ 14 © British Crown Copyright 2008/MOD Outline l Motivation l Building a code generator with iUML/iCCG l Application Development with iUML l Current Results l Other work exploring xUML

Job No/ 15 © British Crown Copyright 2008/MOD Application Development Write Annotations in description field Write ASL in the method field Examiner report Skeleton Class Diagram Generate SPARK code and Analyse with SPARK toolset Executable Model

Job No/ 16 © British Crown Copyright 2008/MOD Development Process – Model Annotation l Code generator provides ‘low-level’ embedded annotations l “Inherits”, “Owns” and operations supporting the formalism l Analyst provides annotations for the design on xUML active elements l i.e. State Actions and Operations

Job No/ 17 © British Crown Copyright 2008/MOD xUML Skeleton Design

Job No/ 18 © British Crown Copyright 2008/MOD xUML Annotated Design

Job No/ 19 © British Crown Copyright 2008/MOD xUML Annotated Design

Job No/ 20 © British Crown Copyright 2008/MOD xUML Executable Design

Job No/ 21 © British Crown Copyright 2008/MOD Multi-Domain Bridge CPR1

Job No/ 22 © British Crown Copyright 2008/MOD Multi Domain l Supports complete analysis on domain by domain bases l Domains can be implemented and tested in isolation l Bridges analysed in context of relevant domain l Minor constraints on xUML bridges

Job No/ 23 © British Crown Copyright 2008/MOD Outline l Motivation l Building a code generator with iUML/iCCG l Application Development with iUML l Current Results l Other work exploring xUML

Job No/ 24 © British Crown Copyright 2008/MOD Current Status l Successfully analysed a representative model using SPARK Examiner l Generation of SPARK from multi domain xUML models l Process defined to allow complete system analysis l Supports all SPARK ‘core’ Annotations l Only minor restrictions on xUML

Job No/ 25 © British Crown Copyright 2008/MOD Outline l Motivation l Building a code generator with iUML/iCCG l Application Development with iUML/iCCG l Current Results l Other work exploring xUML

Job No/ 26 © British Crown Copyright 2008/MOD SystemB Project l Automatic generation of CSP||B specifications from xUML models l Generator built using Kennedy Carter tools l Generator based on model-text transformations l Verification of CSP||B specifications using ProB and FDR l Provides greater assurance in UML models than is possible within Kennedy Carter tools xUML MetaModel xUML ModelCSP ModelCSP||B Model SystemB CCG

Job No/ 27 © British Crown Copyright 2008/MOD Summary l Code generator is itself captured in a precise industrially accepted format l The resulting code is produced from a precisely defined, traceable process l Generated code can be statically checked for correctness l Provides additional rigour to development cycle l Development can begin earlier before Hardware is available or known. l Knowledge captured is likely to have longevity

Job No/ 28 © British Crown Copyright 2008/MOD Questions ?