CN116304193A

CN116304193A - SLIM model-to-XSAP model conversion method based on ATL

Info

Publication number: CN116304193A
Application number: CN202310369791.4A
Authority: CN
Inventors: 王立松; 肖曦
Original assignee: Nanjing University of Aeronautics and Astronautics
Current assignee: Nanjing University of Aeronautics and Astronautics
Priority date: 2023-04-10
Filing date: 2023-04-10
Publication date: 2023-06-23

Abstract

The invention discloses a SLIM model-to-XSAP model conversion method based on ATL, which comprises the following steps: according to a predefined model transformation rule, designing a SLIM meta-model and an XSAP meta-model, and obtaining abstract grammar structures of the SLIM meta-model and the XSAP meta-model; based on an ATL design model conversion algorithm, utilizing a meta model and an abstract grammar structure to realize conversion from a SLIM model to an XSAP model, and obtaining the XSAP model in a converted XML format; and (3) designing a verification algorithm, and verifying the XSAP model to obtain a complete SMV-format XSAP model. The invention can directly convert the safety key system from the SLIM model to the XSAP model, and carry out verification analysis on the XSAP model obtained by conversion.

Description

SLIM model-to-XSAP model conversion method based on ATL

Technical Field

The invention belongs to the technical field of safety key system modeling and model conversion, and particularly relates to an ATL-based SLIM model-to-XSAP model conversion method.

Background

In model driven engineering, ATL plays an increasingly important role in creating transitions between models and reducing language differences between models. ATL conversion languages are domain-specific languages that are specialized for solving common model conversion tasks, many conversion languages have been proposed by the research community, which, although their problem domains are fixed, are still different in the programming paradigm employed. Different methods are suitable for different types of tasks. One class of problems can be easily solved in declarative language, while another class is more suitable for imperative methods. ATL is a mixed language that is a mixture of declarative and imperative constructs with a strong ability to solve problems.

The SLIM language follows a component-based paradigm and may refer to software (e.g., threads and processes) and hardware components (e.g., memory and processors) as primary objects. Each component defines a description interface through its type, which enables interactions to be described by a finite state automaton. The set of interaction components can be grouped into composite components, enabling modelers to manage the complexity of the system by introducing a hierarchy of components. Communication is achieved through message exchanges on the event ports. The hierarchical system model, also referred to as the nominal model, generated from the language features describes the system behavior under normal operation. The SLIM model is component-based to represent a system in which software (represented by keyword process, thread or thread group) and hardware (keyword processor, memory, bus, and device) components are used as a primary language structure. The collection of interactive components may be grouped into composite components indicated by a keyword system.

The XSAP model uses smv language as input to describe a finite state machine through declaration and instantiation mechanisms of modules and processes, corresponding to a combination of synchronous and asynchronous, and represents a set of requirements with CTL and LTL. XSAP may perform batch processing or interworking through text interaction shell. smv breaks the system down into modules, each of which can be instantiated multiple times. This provides a modular and hierarchical description for the user and supports the definition of reusable components. Typically, a smv file contains a main module and custom modules.

MBSE is an engineering approach that takes models as part of a technological baseline, including the need for capacity, system or product, analysis, design, implementation and verification throughout the life cycle. SLIM is a common system engineering modeling language, and is used for analyzing a safety key system to construct a model. XSAP may use a model-based security analysis Method (MBSA) to perform security analysis on the system. Therefore, a method for converting a SLIM model into an XSAP model is provided, which has important significance for reducing the gap between MBSE and MBSA in the system development process.

Disclosure of Invention

Aiming at the defects of the prior art, the invention provides an ATL-based SLIM model-to-XSAP model conversion method, which can directly convert a safety key system from a SLIM model to an XSAP model, and perform formal analysis on the XSAP model obtained by conversion through an XSAP engine tool to check the functional consistency and completeness of the model and verify the correctness of the system.

In order to achieve the technical purpose, the invention adopts the following technical scheme:

an ATL-based SLIM model to XSAP model conversion method, comprising:

step S1, designing a SLIM meta-model and an XSAP meta-model according to a predefined model transformation rule, and obtaining abstract grammar structures of the SLIM meta-model and the XSAP meta-model;

s2, based on an ATL design model transformation algorithm, utilizing the meta model and the abstract syntax structure obtained in the step S1 to realize the transformation from the SLIM model to the XSAP model, and obtaining the XSAP model in the transformed XML format;

and step S3, designing a verification algorithm, and verifying the XSAP model obtained in the step S2 to obtain a complete XSAP model in the SMV format.

In order to optimize the technical scheme, the specific measures adopted further comprise:

the characteristics of the SLIM model and the XSAP model are analyzed in S1, and the following transformation rules are predefined:

(1) The rule for mapping the type declaration and the realization definition for describing the components in the physical system in the SLIM model and the module declaration for describing the components in the physical system in the XSAP model;

(2) Rules for mapping data ports in the SLIM model with state variables in the XSAP model;

the data port in the SLIM model is used for describing the state of the component and can be used for exchanging data with other components.

The state variables in the XSAP model are used for describing the state of the module;

(3) Conversion rules of initial value in SLIM model and initial assignment constraint in XSAP model;

the initial values in the SLIM model are specified by data port definitions and are used to represent the initial state of the component.

The initial assignment constraint in the XSAP model is used for designating the initial value of the state variable so as to represent the initial state of the module;

(4) Rules for mapping component states in the SLIM model with state variables in the XSAP model;

the states of the components in the SLIM model are defined through component realization, and conversion is realized between the states;

(5) Rules for mapping sub-components in the SLIM model with instance variables of the instantiation module in the XSAP model;

the sub-component of the SLIM model is used for introducing a hierarchical structure, and the sub-component is defined in the realization of the father component;

the instantiation module instance variables in the XSAP model are used for representing a hierarchical structure among modules;

(6) A conversion rule of unchanged assignment constraint in the XSAP model is connected in the SLIM model;

the SLIM model is connected with a source port and a target port for communication among different components, and the value of the source port is transmitted to the target port without delay, so that the value of the target port is identical to the value of the source port;

the invariable assignment constraint in the XSAP model is used for representing the identity relation of the state variable;

(7) Constraint transformation rules are assigned in the SLIM model and the XSAP model subsequently;

converting the SLIM model to represent the dynamic behavior of the system;

subsequent assignment constraints in the XSAP model are used to specify the next state value of the state variable, thereby representing the dynamic behavior of the module.

And S1, designing and constructing a SLIM meta-model and an XSAP meta-model according to a predefined transformation rule, and extracting a general model characteristic structure, namely an abstract grammar structure of the SLIM meta-model and the XSAP meta-model.

In S2 above, the model conversion algorithm based on the ATL design includes:

(1) Port translation algorithm: for a Port in the SLIM metamodel, a variable Var in the XSAP metamodel is corresponding; if the port has an initial value, generating an initial assignment constraint statement;

(2) State transition algorithm: for the State in the SLIM metamodel, the variable Var in the XSAP metamodel is corresponding; if the initial state exists, generating an initial assignment constraint statement;

(3) Sub-component conversion algorithm: sub-components in the SLIM metamodel correspond to module instances in the XSAP metamodel;

(4) Connection conversion algorithm: for Connection or Flow in the SLIM metamodel, mapping the Connection or Flow into a constant assignment constraint statement in the XSAP metamodel;

(5) Transition conversion algorithm: for transformation Transition in the SLIM metamodel, extracting transformation conditions and influences to generate subsequent assignment constraint statements in the XSAP metamodel;

(6) Component transformation algorithm: the components in the SLIM metamodel correspond to the module definitions in the XSAP metamodel.

The step S3 includes the following steps:

s31, writing a data structure, reading a model into a memory, and constructing a model structure tree by taking a module in the model as a basic unit;

s32, designing a verification algorithm, and verifying a model based on a model structure tree, wherein the verification algorithm comprises a connection redundancy verification algorithm and a unique initial assignment constraint verification algorithm;

and S33, after model inspection is completed, writing a code template to obtain a final XSAP model file.

The connection redundancy check algorithm specifically comprises the following steps:

obtaining all node lists of a model structure tree, traversing the list, judging whether the node is a leaf node, returning if the node is a leaf node, obtaining a sub-component mapping compMap if the node is a middle node, traversing the compMap, obtaining a component variable type of each sub-component variable compVarWrapper, finding out a component node child corresponding to the type from the sub-node, obtaining all assigned assignMap of the sub-component variable, traversing the assignMap if the assignMap is not null, obtaining a variable name varName of a sub-component port variable, finding out a port variable name varName in the child, judging whether an init assignment constraint exists, and deleting if the init assignment constraint exists.

The unique initial assignment constraint checking algorithm specifically comprises the following steps:

and (3) adopting a depth-first traversal model structure tree, returning if the node is a leaf node, otherwise traversing the sub-component mapping compMap of the node, obtaining the type of the component variable for each sub-component variable compVarWrapper, finding out the corresponding component node child of the type from the sub-node, then obtaining the port variable mapping portMap of child, traversing the portMap, obtaining the port variable portVarvwrapper, if the portVarvwrapper has initial assignment constraint and no next subsequent assignment constraint, searching the assignment constraint on the port variable portVarvwrwrapper through the sub-component variable compVarWrapper according to the port variable name, if no next subsequent assignment constraint of the sub-component port variable portVarvwrwrapper exists in the compVarvwrapper, creating the next subsequent assignment constraint, and finally calling the algorithm for all sub-components to complete the traversal of the whole tree.

The invention has the following beneficial effects:

the invention can directly convert the safety key system from the SLIM model to the XSAP model, and for the XSAP model obtained by conversion, formal model verification analysis can be carried out through an XSAP engine tool to check the functional consistency and completeness of the model and verify the correctness of the system.

Drawings

FIG. 1 is a flow chart of the conversion method of the present invention;

FIG. 2 is a transformation framework diagram of the transformation method of the present invention;

FIG. 3 is a SLIM metamodel diagram of the present invention;

FIG. 4 is a diagram of an XSAP metamodel of the present invention;

FIG. 5 is a diagram of the Transition part Transition rules of the ATL Transition algorithm;

FIG. 6 is a schematic diagram of a conversion process;

FIG. 7 is a pseudo code schematic diagram of a join redundancy check algorithm;

FIG. 8 is a pseudo code schematic diagram of a unique initial assignment constraint checking algorithm.

Detailed Description

The present invention will be described in further detail with reference to the drawings and examples, in order to make the objects, technical solutions and advantages of the present invention more apparent. It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the scope of the invention.

Although the steps of the present invention are arranged by reference numerals, the order of the steps is not limited, and the relative order of the steps may be adjusted unless the order of the steps is explicitly stated or the execution of a step requires other steps as a basis. It is to be understood that the term "and/or" as used herein relates to and encompasses any and all possible combinations of one or more of the associated listed items.

Referring to fig. 1, the present invention provides a method for converting an SLIM model to an XSAP model based on an ATL, the conversion method comprising the steps of:

s1, designing a SLIM meta-model and an XSAP meta-model according to a predefined model transformation rule, and obtaining abstract grammar structures of the SLIM meta-model and the XSAP meta-model;

s2, based on an ATL design model conversion algorithm, converting the SLIM model into an XSAP model by utilizing the meta model and the abstract grammar structure obtained in the step S1, and obtaining the XSAP model in the converted XML format;

and S3, designing a verification algorithm, and verifying the XSAP model obtained in the step S2 to obtain a complete XSAP model in the SMV format.

The invention mainly solves the problem of converting a SLIM model into an XSAP model, the implementation flow is divided into three parts, fig. 2 is a conversion framework designed by the invention, and the technical scheme of the invention is explained in detail below with reference to the accompanying drawings.

S11, analyzing characteristics of a SLIM model and an XSAP model, and predefining the following transformation rules by combining grammar and semantic corresponding relations of two languages:

the specific conversion rule is as follows.

Rule 1: component-module mapping: i.e., the type declarations and implementation definitions in the SLIM model that describe components in the physical system, and the rules that map with the module declarations in the XSAP model that describe components of the physical system;

in the SLIM model, components in a physical system are described by type declarations and implementation definitions;

in the XSAP model, components of a physical system are described by module declarations.

Therefore, there is a correspondence between the type declaration in SLIM and the implementation definition and the module declaration in XSAP.

Rule 2: data port-state variable mapping: namely, a rule that a data port in the SLIM model is mapped with a state variable in the XSAP model;

in the SLIM model, the data ports may describe the state of the component and may be used to exchange data with other components.

In the XSAP model, the module state is described through a state variable, and meanwhile, through an instantiation module, a child module variable can be accessed in a parent module, so that data interaction is realized.

Data port—both state variables have a correspondence.

Rule 3: initial value-initial assignment constraint: namely, a transformation rule of initial value in the SLIM model and initial assignment constraint in the XSAP model;

in the SLIM model, the definition of the data port may specify an initial value for representing the initial state of the component.

In the XSAP model, initial values of state variables may be specified by initial assignment constraints, thereby representing the module initial state.

Initial value-initial assignment constraint there is a correspondence.

Rule 4: state-state variable mapping: the rule that the component state in SLIM model and state variable in XSAP model are mapped;

in the SLIM model, component implementations may define possible states of the component, with transitions being implemented between the states.

In the XSAP model, the module state is still described by state variables.

There is a correspondence between the state-state variable mappings.

Rule 5: subcomponent- -Module instance variable mapping: namely, a rule that a sub-component in the SLIM model is mapped with an instantiation module instance variable in the XSAP model;

in the SLIM model, the hierarchy is introduced by defining sub-components, which are defined in the implementation of the parent component.

In the XSAP model, the hierarchy between modules is represented by instantiating the modules.

Sub-components—module instance variables both have correspondence.

Rule 6: connection (flow) -invariant assignment constraint: namely, a conversion rule of unchanged assignment constraint in the XSAP model is connected in the SLIM model;

in the SLIM model, connections are mainly used for communication between different components, the source port and the destination port are operated, and the value of the source port is transmitted to the destination port without delay, so that the value of the destination port is identical to the value of the source port.

In the case of flow, the flow source may be a port or an expression, the semantics and connections of which are the same.

In the XSAP model, identity relationships of state variables are represented by invariant assignment constraints, e.g., a: =expr (b).

Thus, there is a correspondence between the connection (flow) -invariant assignment constraints.

Rule 7: conversion-subsequent assignment constraint: namely, converting in the SLIM model and subsequently assigning constraint and transmission conversion rules in the XSAP model;

in the SLIM model, transitions represent the dynamic behavior of the system, which includes event triggers e, guard g, and effects f for transitions, meaning that a transition from a source state to a target state occurs and effects, i.e., m- [ e wavelet g then ] - > m', occur if an event triggers and guard conditions are met. The effect is a delay effect.

In the XSAP model, the next state value of the state variable, next (a), i.e., expr (m, e, g, f), can be specified by a subsequent assignment constraint, thus representing the dynamic behavior of the module.

There is a correspondence between the transition-subsequent assignment constraint and the transition-subsequent assignment constraint.

And S12, designing and constructing a SLIM meta-model and an XSAP meta-model according to a predefined transformation rule, and extracting a general model feature structure, namely an abstract grammar structure of the SLIM meta-model and the XSAP meta-model.

According to the above defined transformation rules, combined with language characteristics, a SLIM metamodel and an XSAP metamodel are designed as shown in fig. 3 and 4.

S2, designing a model transformation algorithm based on ATL, compiling rules by using ATL transformation language according to the meta-model obtained in the step S1, matching classes in the SLIM meta-model and classes in the XSAP meta-model, processing element transformation between the models, and finally realizing transformation from the SLIM model to the XSAP model to obtain an XSAP model in a transformed XML format;

the model conversion algorithm based on the ATL design comprises the following steps:

(1) Port translation algorithm:

class ports in the SLIM metamodel correspond to class PortVar in the XSAP metamodel. The conversion algorithm first maps the attributes into the PortVar class, where the mapping of the type attribute is by means of a helper function to counteract the differences defined by the two language types. The boolean value type is bool in SLIM and boolean in XSAP. After the basic PortVar class is built, it is necessary to determine whether the converted Port instance contains defaultvalue default values. If the port initial value is not null, generating an initial assignment constraint Init, and realizing conversion from the port initial value to the initial assignment constraint;

(2) State transition algorithm:

the class StateMachine in the SLIM metamodel contains all states that correspond to the class StateVar in the XSAP metamodel. The conversion algorithm builds an instance of StateVar, setting the corresponding attribute. The state set of StateVar is a state variable of StateMachine, namely, the possible value of the state variable is assigned. The State class in SLIM is converted into the State class in XSAP by means of ATL parsing algorithm. If an initial state exists, namely an initial state, generating an initial assignment constraint statement Init;

(3) Sub-component conversion algorithm:

the sub-component class of sub-component in SLIM, it corresponds to sub-module variables in XSAP, defined as ComponentVar class in metamodel, belongs to the state scalar. Constructing a componentVar instance by direct mapping;

(4) Connection (stream) conversion algorithm:

and matching the Connection class in the SLIM metamodel into the Connection class of the XSAP, and storing information as a copy. The transformation emphasis is to generate a constant assignment constraint, which is essentially the transformation from a Connection class in the SLIM metamodel to an assignment class in the XSAP metamodel. First, a Connection class instance of the XSAP is constructed, and Connection information is stored. And constructing assignment constraint represented by assignment class, wherein the assignment object is a connection target port, and the value is a connection source port. Since the invariant assignment constraint is generated, an Invar class instance is generated and assigned to the assignment's Invar variable.

(5) Transition conversion algorithm:

the Transition class in the SLIM metamodel is matched to be the Transition class of the XSAP, and the Transition class is used as copy storage information, wherein the key point is to generate subsequent assignment constraint, namely the effect generated by conversion, and the Transition class in the SLIM metamodel is basically converted into the assignment class in the XSAP metamodel. First, a Transition class instance of XSAP is constructed, and conversion information is stored. The converted information needs to be processed before an assignment class instance is generated. First, the complete conversion condition needs to be extracted as the condition of the subsequent assignment constraint. The current state, trigger and guard of the system are formed.

condition＝val(state)+trigger+guard

After the condition conversion condition is constructed, the generation of the assignment class instance is started. According to the effect, determining the affected port variable name and value, and generating a follow-up assignment constraint Next; the conversion algorithm is shown in fig. 5;

(6) Component transformation algorithm:

the complete components in SLIM consist of declarations and implementations, namely System classes and System Impl classes in SLIM metamodel, corresponding to Module classes in Xsap metamodel. The two are respectively basic constituent elements of the respective models and are also top-level structures of the meta models. The conversion algorithm converts the System class instance and the System im class instance with the same name into a Module class instance. And setting an attribute value to generate a Module instance in the XSAP.

Reading the meta model and the input source model through an ATL conversion engine, and running a conversion algorithm to obtain a converted XSAP model, wherein the use example is shown in FIG. 6.

S31, writing a data structure, reading the model into a memory, and constructing a system model structure tree by taking a module in the model as a basic unit;

s32, designing a verification algorithm, and verifying the model based on the model structure tree;

the XSAP model obtained according to the ATL transformation has a slight difference from the original model, and the following problems are presented:

problem 1, slim if only the output port initial value is determined, the port value remains unchanged. XSAP will subsequently take values randomly if only the initial value is determined for the variable.

Problem 2, port of slim determines an initial value in the component definition, while as a connection target, receiving the value of the source, then the connection overrides the Port initial value. In the XSAP model, the initial and unchanged assignment constraints cannot coexist.

To solve problem 1, a connection redundancy check algorithm is proposed as shown in FIG. 7.

Obtaining all node lists of a model structure tree, traversing the lists, judging whether the nodes are leaf nodes, returning if the nodes are leaf nodes, if the nodes are intermediate nodes, obtaining a sub-component mapping compMap, traversing the compMap, for each sub-component variable compVarWrapper, obtaining a component variable type of the sub-component variable, finding out a component node child corresponding to the type from the sub-nodes, obtaining all assigned assignMap of the sub-component variable, if the assignMap is not null, traversing the assignMap to obtain a variable name varName of a sub-component port variable, finding out a port variable with the variable name varName in the child, judging whether an init assignment constraint exists, and deleting if the init assignment constraint exists

To solve problem 2, a unique initial assignment constraint checking algorithm is proposed as shown in FIG. 8.

And S33, after the model inspection is completed, writing a code module to obtain a final complete XSAP model.

The meaning of English in the invention is specifically as follows:

ATL: atlas Transformation Language ATL conversion language

SLIM: system-Level Integrated Language, system-level Integrated modeling language

XSAP: eXtended Safety Assessment Platform, an extended security assessment platform

MBSE: model Based System Engineering model-based system engineering

MBSA: model Based Safety Analysis model-based security analysis

CTL: computing Tree Language computer tree logic

LTL: linear Temporal Logic Linear temporal logic

It will be evident to those skilled in the art that the invention is not limited to the details of the foregoing illustrative embodiments, and that the present invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. The present embodiments are, therefore, to be considered in all respects as illustrative and not restrictive, the scope of the invention being indicated by the appended claims rather than by the foregoing description, and all changes which come within the meaning and range of equivalency of the claims are therefore intended to be embraced therein. Any reference sign in a claim should not be construed as limiting the claim concerned.

Furthermore, it should be understood that although the present disclosure describes embodiments, not every embodiment is provided with a separate embodiment, and that this description is provided for clarity only, and that the disclosure is not limited to the embodiments described in detail below, and that the embodiments described in the examples may be combined as appropriate to form other embodiments that will be apparent to those skilled in the art.

Claims

1. An ATL-based SLIM model to XSAP model conversion method, comprising:

2. The method for converting an ATL-based SLIM model into an XSAP model according to claim 1, wherein the characteristics of the SLIM model and the XSAP model are analyzed in S1, and the following conversion rules are predefined:

converting the SLIM model to represent the dynamic behavior of the system;

3. The method for converting an ATL-based SLIM model to an XSAP model according to claim 1, wherein step S1 is to design and construct a SLIM meta model and an XSAP meta model according to a predefined conversion rule, and extract a general model feature structure, namely an abstract syntax structure of the SLIM meta model and the XSAP meta model.

4. The ATL-based SLIM model transformation method of XSAP model according to claim 1, wherein in S2, the model transformation algorithm based on the ATL design comprises:

5. The method of converting an ATL-based SLIM model to an XSAP model according to claim 1, wherein step S3 comprises the steps of:

and S33, after model inspection is completed, writing an XSAP model code template in a complete SMV format to obtain a final XSAP model file in the SMV format.

6. The method for converting an ATL-based SLIM model to an XSAP model according to claim 5, wherein said connection redundancy check algorithm is specifically:

7. The method for converting an ATL-based SLIM model into an XSAP model according to claim 5, wherein said unique initial assignment constraint checking algorithm is specifically: