2 April, 2008AADL/UML workshop - Belfast1 Arcade: A formal, extensible, model-based dependability evaluation framework Hichem Boudali 1, Pepijn Crouzen 1,2, Boudewijn R. Haverkort 1, Matthias Kuntz 1, Mariëlle Stoelinga 1 1 CS, Twente University, The Netherlands 2 CS, Saarland University, Germany

2 April, 2008AADL/UML workshop - Belfast2 Motivation/Goals  Approaches to dependability evaluation:  Low level (CTMC, SPN, SPA)  Dependability specific (fault trees)  Architecture-based (AADL, UML)  None is perfect, in terms of:  Modeling effort  Hierarchy & modularity  Expressiveness  (formal) Clear semantics  Effective solution techniques Our objective: To devise a formalism that scores high on all these aspects

2 April, 2008AADL/UML workshop - Belfast3 Our solution: Arcade methodology  Architectural approach (system design)  Expressive and extensible  Modular modeling  Formal semantics (based on I/O-IMC)  Efficient state-space generation (compositional- aggregation technique)

2 April, 2008AADL/UML workshop - Belfast4 What’s an I/O-IMC?  Combination of I/O automata and CTMC  Discrete state space  Markovian transitions  Interactive transitions  Action signature  ? - Input actions  ! - Output actions  ; - Internal actions  Behavior of the system results from the composition of its elements.  Well-defined composition operator & bisimulation equivalence (state minimization) λ failed!

2 April, 2008AADL/UML workshop - Belfast5 Sketch of the proposal Processor 1Processor 2 Bus Process 1Process 2 Control System Dependability analysis Other analyses Std. solver Result Dependability Annotation (User) compositional -aggregation

2 April, 2008AADL/UML workshop - Belfast6 Arcade: Current status  Use I/O-IMCs as the underlying formal semantics  At an architectural level, we have identified/defined:  (1) Basic (physical/logical) components (BC)  (2) Repair units (RU)  (3) Spare management units (SMU)  All kinds of behaviors/interactions/dependencies, e.g.:  Operational/failure modes  Repair and spare management policies  Functional dependencies  Textual syntax (ultimately graphical and integrate to an ADL)  To each component/unit corresponds a pre-defined basic I/O- IMC  Use I/O-IMCs’ machinery to carry out state-space generation (compositional-aggregation technique) and analysis

2 April, 2008AADL/UML workshop - Belfast7 Example & Results # of states: 98,056 # of transitions: 411,688 Unavailability (50 hours): ∙ Unreliability (50 hours): ∙

2 April, 2008AADL/UML workshop - Belfast8 Arcade: Tool chain

2 April, 2008AADL/UML workshop - Belfast9 Arcade: A summary  Low modeling effort:  High level & Graphical  Standard features (BC, RU, SMU)  Tight to an ADL (alternative to AADL error annex)  Expressive/Extensible  Standard features, but also (well-structured) user- defined features  Formal semantics (I/O-IMCs)  Compositional & efficient SS generation  Hierarchical modeling Architectural Dependability Evaluation with Arcade. Dependable Systems & Networks (DSN 2008), Anchorage, Alaska, USA.

2 April, 2008AADL/UML workshop - Belfast10 Extra slides

2 April, 2008AADL/UML workshop - Belfast11 Arcade: Example 2 MeasureArcadeSANGalileo # states Availability Reliability

2 April, 2008AADL/UML workshop - Belfast12 The State-Space Battle  Defined and used the I/O-IMC formalism to describe the semantics of each DFT element.  I/O-IMCs: CTMC + I/O transitions.  Semantics of the entire DFT arises naturally as the composition of its elements’ semantics.  Used the compositional-aggregation approach to combat the state-space explosion problem.  Lifted the restrictions  extended DFT formalism.

2 April, 2008AADL/UML workshop - Belfast13 The State-Space Battle Translation Composition + Hiding Aggregation (minimization) Repeat Aggregated system CTMC Result: System failure probability compositional -aggregation CORAL