ADAPT: AADL AST-to-GSPN Transformation

• The paper presents a principled transformation method from AADL error-annotated models to GSPN for dependability analysis.
• It details a modular pipeline leveraging OSATE’s AST, EMF-based metamodels, and explicit dependency matching to construct component and dependency subnets.
• It demonstrates how formal mapping rules and integration with tools like SURF-2 yield closed network GSPN models for robust quantitative evaluation.

ADAPT is a toolset that realizes a principled transformation from AADL (Architecture Analysis and Design Language) architectural models, specifically those annotated with Error Model Annex dependability details, to Generalized Stochastic Petri Nets (GSPNs) suitable for quantitative dependability evaluation. The process is grounded in model-driven engineering, leveraging metamodel-driven AST manipulations, modular subnet construction, explicit formal mapping rules, and integration with established tooling ecosystems such as OSATE and SURF-2 (0809.4108).

1. AADL and Error Model Representation in the AST

ADAPT operates directly on the in-memory Abstract Syntax Tree (AST) maintained by the OSATE (Open Source AADL Tool Environment) platform. Each AADL component instance in this AST is modeled with zero or one attached error model, utilizing the Ecore-based metamodel for AADL (SAE-AS5506/1) and the Error Model Annex (SAE-AS5506/1 Annex E). The error model describes a labeled automaton with:

• States $S = \{s_1, \ldots, s_n\}$
• Events $E = \{e_1, \ldots, e_m\}$ and propagations $P = \{p_1, \ldots, p_k\}$, each with an Occurrence property $\mathsf{Occ}(e)$ (either a fixed probability or Poisson rate $\lambda$)
• Transitions $T \subseteq S \times (E \cup P) \times S$
• Optional guard annotations (Guard_In, Guard_Out, Guard_Event) for filtering or masking propagations

All dependability annotations, including Occurrence and Guards, are attached as attributes to the corresponding error-model nodes within the AST (0809.4108).

2. Transformation Pipeline and Tooling Architecture

ADAPT is architected as three Eclipse/OSATE plug-ins, implemented in Java atop the Eclipse Modeling Framework (EMF):

1. gspnModel plug-in: An EMF-generated Ecore metamodel for GSPNs defines the classes Place, Transition, Arc, and PetriNet. It provides factory functions for constructing GSPN instances and a corresponding XMI serialization schema.
2. dependency plug-in: Supplies routines for traversing the AADL AST to discover dependency pairs, i.e., collecting matching in-propagations for each out-propagation via OSATE’s architectural bindings, connections, and bus accesses.
3. aadl2gspn plug-in: Orchestrates the transformation, utilizing OSATE APIs, invoking dependency matching, and assembling subnets via the gspnModel factories.

The workflow is initiated within OSATE when the user selects a system instance and invokes “Generate GSPN.” The aadl2gspn plug-in systematically traverses components, applies transformation rules, and produces the target GSPN in both generic XML/XMI and SURF-2-specific formats (0809.4108).

3. Formal Mapping Rules: Component and Dependency Subnets

The translation of error models to GSPN is modular and rule-based.

• Component Subnets: For each AADL component $C$ with error model $EM$:
  • For every state $s \in EM.S$, instantiate a GSPN place $p_s$ (with initial marking $E = \{e_1, \ldots, e_m\}$0 iff $E = \{e_1, \ldots, e_m\}$1 is initial).
  • For each transition $E = \{e_1, \ldots, e_m\}$2 (with $E = \{e_1, \ldots, e_m\}$3), construct a GSPN transition $E = \{e_1, \ldots, e_m\}$4 with firing parameter $E = \{e_1, \ldots, e_m\}$5. Connect with arcs $E = \{e_1, \ldots, e_m\}$6 and $E = \{e_1, \ldots, e_m\}$7, each of weight $E = \{e_1, \ldots, e_m\}$8.
• Dependency Subnets: For every matched (out-propagation $E = \{e_1, \ldots, e_m\}$9, in-propagation $P = \{p_1, \ldots, p_k\}$0) pair (across components $P = \{p_1, \ldots, p_k\}$1, $P = \{p_1, \ldots, p_k\}$2):
  • Introduce a transition $P = \{p_1, \ldots, p_k\}$3 in the GSPN with rate given by $P = \{p_1, \ldots, p_k\}$4.
  • Link the source state place $P = \{p_1, \ldots, p_k\}$5 in $P = \{p_1, \ldots, p_k\}$6’s subnet to $P = \{p_1, \ldots, p_k\}$7, and $P = \{p_1, \ldots, p_k\}$8 to destination state $P = \{p_1, \ldots, p_k\}$9 in $\mathsf{Occ}(e)$0’s subnet, via weight-$\mathsf{Occ}(e)$1 arcs.
  • Guards, if present, are encoded as inhibitor arcs or precondition places in the Petri net formalism.

The formal mapping is succinctly represented as follows. Let $\mathsf{Occ}(e)$2 for component $\mathsf{Occ}(e)$3, yielding $\mathsf{Occ}(e)$4 where:

• $\mathsf{Occ}(e)$5: create $\mathsf{Occ}(e)$6, $\mathsf{Occ}(e)$7 if $\mathsf{Occ}(e)$8 is initial, else $\mathsf{Occ}(e)$9.
• $\lambda$0: create $\lambda$1, $\lambda$2, $\lambda$3 includes $\lambda$4 and $\lambda$5.
• Dependency events are handled analogously, linking source and destination subnets appropriately (0809.4108).

4. Traversal Algorithm and Execution Semantics

The core transformation is performed via a two-phase, AST-driven pipeline. In pseudocode:

$T \subseteq S \times (E \cup P) \times S$1

Subnets are constructed per the formal rules described above. The modularity of component and dependency subnets enables scalable transformation of large AADL architectures, subject to the granularity of error-model partitioning selected by the model engineer (0809.4108).

5. Example: Sensor Component Transformation

The following table illustrates a direct mapping from a simple AADL error model to the corresponding GSPN elements.

AADL Error Model	GSPN Place	GSPN Transition
State: Idle	Sensor_Idle (1)	Sensor_fail ($\lambda$6)
State: Failed	Sensor_Failed (0)	Sensor_repair ($\lambda$7)

• Transitions: Idle —[fail]→ Failed ($\lambda$8); Failed —[repair]→ Idle ($\lambda$9)
• XML/XMI serialization is directly produced in the gspnModel schema, enabling further processing by tools such as SURF-2 (0809.4108).

6. Assumptions, Limitations, and Extensibility

ADAPT enforces that all error events and propagations must specify Occurrence properties; defaults are immediate transitions of weight $T \subseteq S \times (E \cup P) \times S$0 if not otherwise stated. The implementation currently assumes mode-independent error-model behavior—activate/deactivate transitions and derived error-model rules are unimplemented in the prototype. Composition for extended scenarios such as resource-sharing (e.g., common repairman) or concurrency is achieved via appropriately structured AADL propagations and error-model patterns; ADAPT will propagate such user-specified dependency structures directly into GSPN dependency subnets (0809.4108).

The modular decomposition (component and dependency subnets) is rigid; adjustment of granularity is achievable solely through error-model definitions in the AADL source model. The resulting GSPN is always a closed network by standard GSPN semantics; initial markings and reward structures may be tailored at a later stage within tools such as SURF-2. Extensibility is facilitated via additional transformation rules in the aadl2gspn plug-in, following the established component and dependency subnet pattern.

7. Technology Stack and Interoperability

Transformation is achieved through a hand-coded Java implementation utilizing the EMF APIs and OSATE plug-in interfaces; the approach is not based on model transformation DSLs such as ATL or QVT. The source metamodels are the SAE AS5506/1 AADL standard (Annex C) and its Error Model Annex (Annex E), while the target is an Ecore-based GSPN metamodel auto-generated by EMF. Users interact with the tool via the Eclipse/OSATE UI, seamlessly generating GSPN representations for processing by analysis environments such as SURF-2 or through XML/XMI gateways allowing adaptation to other GSPN-based evaluation frameworks (0809.4108).