Research Article

A Comprehensive Formalization of AADL with Behavior Annex

Table 4

Description and code of other rules.

DescriptionCode in Isabelle/HOL

(1) A thread models a concurrent task or an active object, that is, a schedulable unit that can execute concurrently with other threads. Each thread represents a sequential flow of control that executes instructions within a binary image produced from the source text. One or more AADL threads may be implemented in a single operating system thread. A thread always executes within the virtual address space of a process; that is, the binary images making up the virtual address space must be loaded before any thread can execute in that virtual address space. Threads are dispatched; that is, their execution is initiated periodically by the clock or by the arrival of data or events on ports, or by the arrival of subprogram calls from other threads.definition thread_thread2system_valid:: “(′s, ′Dispatcher, ′Port, ′Dataaccess, ′Subpaccess, ′Parameter, ′Subprogramcall, ′Subprogramcalls, ′Connection, ′Data, ′Subprogram, ′Thread, ′Process, ′System, ′BehaviorAnnex) AADL_model ⇒ bool”
  where “thread_thread2system_valid m ≡ ∀sys. ∃sc1 sc2. (if ((system_im m)≠None ∧ (the (system_im m) sys)≠None ∧ (impl_subcomps (get_sysimpl m sys))≠{})
   then (sc1∈(impl_subcomps (get_sysimpl m sys))
     ⟶ (case sc1 of SCThd _ ⇒ True
       | SCPro pro ⇒ (if ((process_im m)≠None ∧ (the (process_im m) pro)≠None ∧ (impl_subcomps (get_proimpl m pro))≠{})
       then (sc2∈(impl_subcomps (get_proimpl m pro)) ⟶
        (case sc2 of SCThd _ ⇒ True
        | _ ⇒ False))
        else False)
        | _ ⇒ False))
else False)” definition thread_thread2process_valid:: “(′s, ′Dispatcher, ′Port, ′Dataaccess, ′Subpaccess, ′Parameter, ′Subprogramcall, ′Subprogramcalls, ′Connection, ′Data, ′Subprogram, ′Thread, ′Process, ′System, ′BehaviorAnnex) AADL_model ⇒ bool”
  where “thread_thread2process_valid m ≡ ∀pro. ∃sc. (if ((process_im m)≠None ∧ (the (process_im m) pro)≠None ∧ (impl_subcomps (get_proimpl m pro))≠{})
then (sc∈(impl_subcomps (get_proimpl m pro)) ⟶ (case sc of SCThd _ ⇒ True
   | _ ⇒ False))
else False)”