Towards the Model-Driven Engineering of Secure yet Safe Embedded Systems

We introduce SysML-Sec, a SysML-based Model-Driven Engineering environment aimed at fostering the collaboration between system designers and security experts at all methodological stages of the development of an embedded system. A central issue in the design of an embedded system is the definition of the hardware/software partitioning of the architecture of the system, which should take place as early as possible. SysML-Sec aims to extend the relevance of this analysis through the integration of security requirements and threats. In particular, we propose an agile methodology whose aim is to assess early on the impact of the security requirements and of the security mechanisms designed to satisfy them over the safety of the system. Security concerns are captured in a component-centric manner through existing SysML diagrams with only minimal extensions. After the requirements captured are derived into security and cryptographic mechanisms, security properties can be formally verified over this design. To perform the latter, model transformation techniques are implemented in the SysML-Sec toolchain in order to derive a ProVerif specification from the SysML models. An automotive firmware flashing procedure serves as a guiding example throughout our presentation.Comment: In Proceedings GraMSec 2014, arXiv:1404.163

Contracts and Behavioral Patterns for SoS: The EU IP DANSE approach

This paper presents some of the results of the first year of DANSE, one of the first EU IP projects dedicated to SoS. Concretely, we offer a tool chain that allows to specify SoS and SoS requirements at high level, and analyse them using powerful toolsets coming from the formal verification area. At the high level, we use UPDM, the system model provided by the british army as well as a new type of contract based on behavioral patterns. At low level, we rely on a powerful simulation toolset combined with recent advances from the area of statistical model checking. The approach has been applied to a case study developed at EADS Innovation Works.Comment: In Proceedings AiSoS 2013, arXiv:1311.319

Supporting ISO 26262 with SysML, Benefits and Limits

International audienceThis article deals with the issue of deploying efficiently the ISO 26262: the new standard in automotive systems development. The directives enclosed in this norm demands the establishment of a product lifecycle fully integrating the safety assessment activities. To tackle this subject, this paper explores the way of setting up Model-Based Design methodology to express and organize the concepts manipulated during the ISO 26262 process. This attempt is founded on the use of SysML and on the creation of a profile dedicated to ISO 26262 development context. We provide an introduction to Model-Based Design paradigm and its appli-cation in a safety relevant context. An overview of ISO 26262 is given, followed by the description of an on-going project on the subject. Modeling propositions are formulated and the use of diverse SysML diagrams are mapped on the automotive safety lifecycle process

Graphical documentation to aid simulation studies of manufacturing

Computer processing power has developed to the stage where simulation has become an extremely popular and applicable way of representing real world systems for investigation. For the most part simulation studies as a whole can be long complex projects. Through-out the simulation industry there is a common consensus from available literature that certain steps should be followed to create a credible, successful simulation. While this is well known it appears that these guidelines are more “Do what I say, not as I do,” within the simulation community. In the experience of the author of this project simulation teams and modellers approach their own simulation studies in their own different ways, yet when the simulation study reaches its conclusion a credible simulation still has to be presented to a client or relevant party. For example a simulation modeller may often spend the most time and in turn resources on building the simulation model, yet this model will be next to useless without any documentation relating to the validation of said model. With good documentation being applied through-out a study, to each specific step, it only serves to make the succeeding steps easier to implement. This project highlights and uses the Systems Modelling Language (SysML) as a tool and method to develop diagrams to aid either the team or the modeller. These diagrams can be used as references when adhering to the steps of creating a credible, successful simulation study as well as a graphical support when presenting the entire simulation study to the client or relevant parties involved. This thesis also covers an independent assessment of the generated SYSML diagrams. Importantly when developing a method such as using SYSML as a graphical aid for simulation studies it must be reviewed by interested parties so that the areas that work well can be highlighted as well any areas which lack or need developing

Static analysis techniques to verify mutual exclusion situations within SysML models

AVATAR is a real-time extension of SysML supported by the TTool open-source toolkit. So far, formal verification of AVATAR models has relied on reachability techniques that face a state explosion problem. The paper explores a new avenue: applying structural analysis to AVATAR model, so as to identify mutual exclusion situations. In practice, TTool translates a subset of an AVATAR model into a Petri net and solves an equation system built upon the incidence matrix of the net. TTool implements a push-button approach and displays verification results at the AVATAR model level. The approach is not restricted to AVATAR and may be adapted to other UML profiles

PRISE: An Integrated Platform for Research and Teaching of Critical Embedded Systems

In this paper, we present PRISE, an integrated workbench for Research and Teaching of critical embedded systems at ISAE, the French Institute for Space and Aeronautics Engineering. PRISE is built around state-of-the-art technologies for the engineering of space and avionics systems used in Space and Avionics domain. It aims at demonstrating key aspects of critical, real-time, embedded systems used in the transport industry, but also validating new scientific contributions for the engineering of software functions. PRISE combines embedded and simulation platforms, and modeling tools. This platform is available for both research and teaching. Being built around widely used commercial and open source software; PRISE aims at being a reference platform for our teaching and research activities at ISAE

Significantly Increasing the Usability of Model Analysis Tools through Visual Feedback

National audienceA plethora of theoretical results are available which make possible the use of dynamic analysis and model-checking for software and system models expressed in high-level modeling languages like UML, SDL or AADL. Their usage is hindered by the complexity of information processing demanded from the modeler in order to apply them and to effectively exploit their results. Our thesis is that by improving the visual presentation of the analysis results, their exploitation can be highly improved. To support this thesis, we define a trace analysis approach based on the extraction of high-level semantics events from the low-level output of a simulation or model-checking tool. This extraction offers the basis for new types of scenario visualizations, improving scenario understanding and exploration. This approach was implemented in our UML/SysML analyzer and was validated in a controlled experiment that shows a significant increase in the usability of our tool, both in terms of task performance speed and in terms of user satisfaction

Extending relational model transformations to better support the verification of increasingly autonomous systems

Over the past decade the capabilities of autonomous systems have been steadily increasing. Unmanned systems are moving from systems that are predominantly remotely operated, to systems that include a basic decision making capability. This is a trend that is expected to continue with autonomous systems making decisions in increasingly complex environments, based on more abstract, higher-level missions and goals. These changes have significant implications for how these systems should be designed and engineered. Indeed, as the goals and tasks these systems are to achieve become more abstract, and the environments they operate in become more complex, are current approaches to verification and validation sufficient? Domain Specific Modelling is a key technology for the verification of autonomous systems. Verifying these systems will ultimately involve understanding a significant number of domains. This includes goals/tasks, environments, systems functions and their associated performance. Relational Model Transformations provide a means to utilise, combine and check models for consistency across these domains. In this thesis an approach that utilises relational model transformation technologies for systems verification, Systems MDD, is presented along with the results of a series of trials conducted with an existing relational model transformation language (QVT-Relations). These trials identified a number of problems with existing model transformation languages, including poorly or loosely defined semantics, differing interpretations of specifications across different tools and the lack of a guarantee that a model transformation would generate a model that was compliant with its associated meta-model. To address these problems, two related solvers were developed to assist with realising the Systems MDD approach. The first solver, MMCS, is concerned with partial model completion, where a partial model is defined as a model that does not fully conform with its associated meta-model. It identifies appropriate modifications to be made to a partial model in order to bring it into full compliance. The second solver, TMPT, is a relational model transformation engine that prioritises target models. It considers multiple interpretations of a relational transformation specification, chooses an interpretation that results in a compliant target model (if one exists) and, optionally, maximises some other attribute associated with the model. A series of experiments were conducted that applied this to common transformation problems in the published literature