Schedulability analysis of AADL architecture models

Full day tutorial, CPS-IoT Week 2019 conférences, April 2019, Montréal, Canada

Frank Singhoff, Lab-STICC UMR CNRS 6285/Université de Bretagne Occidentale
Pierre Dissaux, Ellidiss Tech.

Tutorial Agenda

Agenda of April the 15th, 2019

Exercise 1, demo of the basic AADLInspector analysis features

This set of exercises show how to use AADLInspector to run scheduling analysis with Cheddar.
The slides of the lecture to do those exercises can be downloaded here .

Installation procedure

To do the following exercises, you need AADLInspector. You can download and install AADLInspector from on your laptop (for Windows or Linux targets only).

Running procedure

For windows target, just click on the AADLInspector icon. For Linux station, use the following command:


The objective of this first exercise is to discover the basic analysis options of the tool.
  1. Download the following AADL model. and save those files in a specific folder. Those files are composing an AADLInspector project: the file .aic allows AADLInspector to load all AADL files composing your model from the menu File/Load.
  2. From File/Load, load the project.
  3. With the Static analysis/Parse and Instanciante LMP button, verify the AADL model. What is the root component of this model? Give the instance model graph.
  4. To perform a scheduling analysis, the processor component has to be extended with few properties. Add to the cpu_leon2 component the following properties:
       Scheduling_protocol => (rate_monotonic_protocol);
  5. Compute the scheduling of this thread set with Cheddar by the button Timing Analysis/Simulation timelines (Cheddar). From this simulation, compute with Cheddar the response times of the threads by the button Timing Analysis/Simulation Tests (Cheddar).
  6. Compute theoretical worst case thread response times, always with Cheddar but with the button Timing Analysis/Theoretical Tests (Cheddar).
  7. Are the two sets of worst case response times different? Why they can differ?
  8. Update the Scheduling_protocol property for subcomponent cpu with value posix_1003_highest_priority_first_protocol
  9. Do again the questions 5, 6 and 7. What can you see?

Exercise 2, first handouts with AADLInspector

In this exercise, we will model and analyze a set of threads writing or reading data from a shared memory area. We will assume that the shared memory area is modeled by a data component. Writing or reading an element will be modeled by the access of the data component in mutual exclusion. The objective of this exercise is to gradually build and analyze such model. In the first question, we will define two independant threads, i.e. we do not model the shared memory area. In the next question, we intend to model several readers and writers, always independent. Finally, in the last question, we extend the second version of the model with the thread communications.

Question 1 :

Let assume this sample of AADL model:
package sampling_coms


  thread writer
  end writer;

  thread reader
  end reader;

  thread implementation reader.impl
  end reader.impl;

  thread implementation writer.impl
  end writer.impl;

  process application
  end application;

  process implementation application.impl
  end application.impl;

  processor cpu
  end cpu;

  system smpl
  end smpl;

  system implementation smpl.impl
    process1 : process application.impl;
    cpu1     : processor cpu;
    Actual_Processor_Binding => (reference(cpu1)) applies to process1;
  end smpl.impl;

end sampling_coms;

  1. Change the definition of the threads and the process above in order to:
  2. Check correctness of the model with LMP.
  3. In order to perform scheduling analysis, extend your modele with the following property:

  4. Perform the scheduling analysis with AADLInspector.

Question 2 :

  1. From the model of the previous question and without introducing new component type, extend the model in order to declare 3 writers and 2 readers with the following properties:
  2. Verify your model by simulations with AADLInspector.

Question 3 :

In order to model the thread communications, we now extend the previous model with a data component.
  1. Change your previous model by adding a data component and the required connections to the threads. For this data component, define the following property:
       Concurrency_Control_Protocol => PCP;

  2. Once updated, analyze your model with AADLInspector to locate locks and unlocks of the data component.

Exercise 3, Mars Path Finder, analysis of a model with shared data

This exercise is extracted from [Cottet00] and is about a simplified architecture model of the Mars Pathfinder mission. In this exercise, you must look for a design mistake and propose a solution for it. In 1997, Mars Pathfinder casts a mobile robot called Sojourner on Mars. This mobile robot was controled by a multitask software running on a VxWorks target. This software was composed of the following tasks:

Tasks Priorities Periods/Deadlines Executime time
SCHED_BUS 1 125 ms 25 ms
DATA 2 125 ms 25 ms
CONTROL 3 250 ms 25 ms
RADIO 4 250 ms 25 ms
VIDEO 5 250 ms 25 ms
MESURE 6 5000 ms 50 ms
FORECAST 7 5000 ms Between 50 ms and 75 ms

  1. During the mission of Mars PathFinder, operators noticed that some deadlines were missed, leading to frequent reboots of the hardware. Design an AADL model to discover what are the missed deadlines and why those threads were not able to meet their deadlines.
  2. How to solve this issue? Apply it on your AADL model.

Exercise 4, a simple data port example

Data ports provide a mean to exchange messages between threads. This exercise is a simple example showing two protocols existing with AADL data port: the prococols immediate and delayed.

Exercise 5, Rosace, analysis of a model with data flow

This exercise shows how to synchronize dataflows and control flows in a simplified Flight Control System (see the figure bellow from [Pagetti14] and the AADL model inspired from this article).

Question 1 :

Question 2 :

Question 3 :


[Cottet00] F. Cottet, J. Delacroix, C. Kaiser, and Z. Mammeri. Ordonnancement temps réel. Hermès, 2000.

[Pagetti14] The ROSACE Case Study: From Simulink Specification to Multi/Many-Core Execution, Claire Pagetti, David Saussiéy, Romain Gratia, Eric Noulard, Pierre Siron. RTAS 2014 conference.