Error-Model Annex v2 and PRISM support

Introduction

PRISM is a model-checking tool for processing Markov-Chain. It supports different models such as Discrete Time Markov-Chain (DTMC) or Continuous Time Markov-Chain (CTMC). You can learn more about PRISM on the official website www.prismmodelchecker.org.

AADL export to PRISM function

In order to make some reliability/fault analysis of a system, the use of formal method can be really useful. Then, you need to transform the architecture model into a representation suitable for model-checking tool. In our case, the AADL to PRISM transforms an AADL specification into a PRISM model, either a DTMC or CTMC. The choice of the target model is made in the PRISM menu, as shown below.

The AADL model can be exported either in a DTMC or a CTMC:

To generate PRISM model from an AADL model, you first have to select the instance AADL model and then, invoke the PRISM menu option in OSATE, as shown below.

Once the PRISM model is created, it is available in a subdirectory called report, as shown below.

AADL and PRISM mapping rules

AADL construct PRISM construct
Composite behavior Formula to help the engineer to use the PRISM model
Component state Local variable of a module with component_name_state. The number of values depends on the number of states in the state machine associated to the component. This variable is always initialized with 0.
Component state value As much values as the number of states. Declaration such as :
component_name_state: [0 … NBSTATE] init 0;
A helper formula that eases to reach the component state
Component instance A module
Component OUT port Local variable in the module with a name component_name_portname
Error propagation Values of local variables from port into the component. Declaration as :
component_name_PORTNAME: [0 … NB_ERROR_PROPAGATIONS] init 0;
Component IN port Nothing. On the other hand, when the port as an in propagation and might trigger a state change, we use that when generating transitions
State transition because of an error event Command with probability. The probability value is deduced from the associated occurrence value from the AADL property OccurrenceDistribution.
[] component_state=stateval -> prob1 : (component_state’=newstateval) + 
                               prob2: (component_state’=otherstateval)
State change due to an incoming fault propagation Command with the name of the current state and/or the corresponding outgoing port from the sender component.
[] component_state=stateval & sendercomponent_name_outportname=val -> (component_state’=newstateval) 
OUT propagation on a port when the component is in a particular state Variable assignement while the component is in this state.
[] statevar=stateval -> 
   prob1: (statevar’=newstateval) & (portvar’=errorval) +   
   prob2: (statevar’=newstateval) & (portvar’=errorval2);

Issues and known limitations