Composability for high-integrity real-time embedded systems

The complexity of software systems rises with the quest for better functionality and quality. The development costs that result from it may also increase significantly. Software reuse is one of the directions pursued by the engineering community to abate those costs. One of the lessons learned in the pursuit of software reuse is that composability is a central prerequisite to it. Composability ensures that the properties proven for a component in isolation continue to hold true at system integration. If component-based approaches are ever to make it into the high-integrity domain, they have to provide sufficient guarantees of composability. In this paper we discuss the role played by composability in a novel approach to model-driven engineering recently devised for use in space applications. 1 Statement of the Problem In recent years we have witnessed a large increase in the deployment of software systems. The flexibility afforded by a software implementation, and its comparatively simpler design flow, have been key factors in this shift, and have made a range of new devices that integrate several complex functionalities possible. Software productivity, however, does not keep pace with the demand for new functions and with the time-to-market and correctness requirements of modern electronic systems. In face of this changing market landscape, the academic and industrial communities have looked at ∗This work was partially supported by the IMOFIS French National Project, the ASSERT EU Project and by the University of Udine (I). software reuse as the winning strategy to improve design productivity. Such a strategy exploits a set of architectural pre-designed components and aggregates them by appropriate composition rules meant to ensure that reuse occurs as intended. When successful, reuse can dramatically shorten the development cycle, while also ensuring high quality. The increased adoption of software reuse methodologies is gradually shifting the cost linked to software development from the design phase to the verification and validation (V&V) phase. This occurs because components are employed in contexts that may differ from those initially intended. Thus, particular care must be taken in ensuring that the interaction between the reused components yields the correct results. The validation of this interaction is typically more complex than that of behavior alone, because of the potentially inordinate number of interaction points incurred by the execution. Numerous errors in software systems are in fact the product of faulty interactions. Correctness by construction (CbyC) has proved effective at reducing the verification cost of software [9, 13]: in fact, the techniques based on CbyC replace the a posteriori validation methods [21] with a priori validation methods, in that CbyC prevents the designer from introducing errors in the early phases of a design, where they cost the most. In the literature, CbyC is defined in different ways with respect to the considered contexts; see, for instance, [9, 21, 22, 7]. In this paper we discuss the use of CbyC techniques for high-integrity real time embedded systems. In particular, we focus on the aerospace domain, and follow the modeling methodology defined in [22]. The cited methodology rests, among others, on three key pillars: separation of concerns, thanks to a multiple-view development style; declarative specification, with contractual interfaces realized via containers and automated transformations; preservation of properties, to assure that the contracts stipulated in the (declarative) specification are understood and actively preserved by the execution platform. One of the pillars of CbyC is the concept of composability: the guarantee that the local properties of architectural artifacts are preserved when the architectural artifacts are aggregated or integrated together; in other words: “the whole must preserve the parts”. One of the main challenges we face in this endeavor is to correctly capture and express the properties that are to be preserved upon composition. Contribution This paper discusses properties of interest to composability and illustrates an approach to guarantee it in a Model-Driven Engineering (MDE) methodology. We discuss how model transformations must guarantee composability and show how we can achieve it. The paper is structured as follows. Section 2 is devoted to related work. In particular we introduce the software reuse has its central mantra in all approaches which provides a component-based design where an architectural artifact is viewed as a set of components. In Section 3 we give the analysis of the problem and we introduce the case study. In Section 4 we discuss our solution of the problem and we illustrate the overall methodology by the case study. Section 5 is devoted to introduce industrial valuation. Finally, in Section 6 we discuss some open-problems and on-going work.