{'fraction_non_alphanumeric': 0.021730541288028447, 'fraction_numerical': 0.0036546819438956933, 'mean_word_length': 4.93841642228739, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
A Modeling Method for Integrated Modular Avionics Dynamic Reconfiguration Process Based on AADL

With the great development of integrated modular avionics (IMA), the dynamic reconfiguration of IMA not only provides great advantages in resource utilization and aircraft configuration but also acts as a valid means for resource failure management. It is very vital to ensure the correction of the IMA dynamic reconfiguration process. The analysis of the dynamic reconfiguration process is a significant task. The Architecture Analysis & Design Language (AADL) is widely used in complicated real-time embedded systems. The language can describe the system configuration and the execution behaviors, such as configuration changes. Petri net is a widely used tool to conduct simulation analysis in many aspects. Therefore, we proposed a modeling method of IMA dynamic reconfiguration based on AADL mode, behavioral annex and error model annex in the system level. The model is our first step to analyze and solve the safety problem of IMA system. It can benefit deep analyzing about dynamic reconfiguration of IMA system as the foundation.


Introduction
Integrated modular avionics (IMA) is a new architecture for avionics. The system has more open and complex architectures compared to other federal avionics systems. The IMA system executes functions based on common functional modules (CFMs). The CFMs help to reduce the weight and size of a plane. In an IMA system, various software functions run on CFMs. The software system is highly integrated because of its complex structure.
For safety purposes, the planes usually restart the applications by redundant backups once some failure occurs. In this paper, dynamic reconfiguration refers to configuration changes conducted when failure occurs during flying. Dynamic reconfiguration can help in creating new backup areas to restart an application [1], which makes the plane more flexible and utilizes the hardware resources more effectively.
There are many studies on dynamic reconfiguration from a static perspective [2]. However, there are few studies on the dynamic reconfiguration process [3]. The correctness of the dynamic reconfiguration process should be considered. Understanding the constraints pertaining to dynamic reconfiguration can help in completing the process correctly and smoothly. However, how to model for analyzing dynamic reconfiguration is a challenge. To analyze the dynamic reconfiguration process, we proposed a model-based method in this study. Modeling of IMA dynamic reconfiguration can benefit the analysis. The IMA system is a real-time embedded system. The Architecture Analysis & Design Language (AADL) is quite effective in modeling embedded systems and is widely applied in the aerospace field [4]. Zhang F [5] applied AADL to model F-16 'Auto Pilot Controller' and analyzed the behavior properties of liveness and trace refinement with various fairness assumptions, considering time capacities and deadlines. Zhao Z [6] built an AADL model for the complex hardware structure and robust software of avionic display system.
AADL not only describes the system components but also describes the system behaviors and other elements, such as mode and all types of annex. Modes can represent different configuration states of a system or component when an event triggers a mode change. All of these features make AADL a good method to describe the transition process of systems [7], especially, the dynamic reconfiguration of IMA.
Above all, during the state transition of IMA, safety problem of dynamic reconfiguration is very important and the research has done is so much. But the process of the dynamic reconfiguration is quite complex and hard to analyze. We consider that AADL modeling solves a lot of problems in various real-time embedded system. So we proposed a modeling method of IMA dynamic reconfiguration based on AADL mode, behavioral annex and error model annex in order to provide a basis for deep analyze.
The rest of this paper is organized as follows. Section 2 provides a brief introduction about IMA dynamic reconfiguration and details about model based on AADL. The case analysis is provided in section 3. The section 4 is the conclusions.

Modeling of IMA Dynamic Reconfiguration Process
The complex process of dynamic reconfiguration is difficult to analyze without modeling. AADL is an effective modeling tool for a real-time embedded system. Dynamic reconfiguration is a process involved in a human operator and automation. The analysis range is quite wide. However, in this study, the events and conditions that change the process are simplified as some triggers. The object is just the process itself. Thus, a detailed decomposition and formalized expression of the simplified process is discussed here.
1) Dynamic reconfiguration process When one or several failures occur on a module of IMA, a health manager detects the failure and informs a fault manager to handle it. The fault manager can handle a series of failures under all types of mechanism. Then, the fault manager determines the type of failure to take actions to solve it, for example, closing dynamic reconfiguration, or reporting to the upper layer manager. If a failure causes dynamic reconfiguration, then the system stops the failure application and backups the data. The connections are destroyed. Then, the target module of reconfiguration is selected based on the functional and non-functional requirements such as minimizing the cost of communication. The next step is to create a new partition on another module for the application. Subsequently, application reloading and connection rebuilding are conducted.
A typical process of dynamic reconfiguration is presented in figure 1. The arrows indicate that messages are being sent during the process. Rectangles represent the important actions that occurred. Compared with the reconfiguration process mentioned in another study that always has redundant modules, dynamic reconfiguration discussed in this study refers to a system without spare modules, especially when reconfiguration in the case redundancy is not designed or is used in the system when dynamic reconfiguration begins.
2) Modeling of the dynamic reconfiguration process A mode of a system can be associated with the logical configurations. Mode transitions imply that the configuration state changes from one to another. A system or a component has different static structures and properties in different modes. A property can describe task scheduling, real-time characteristics, communication, memory, etc. Then, modes at the system level represent the content of a system configuration. A system has its own modules, partitions, processors, and communication bus in each mode. Thus, the static structure of the system in one mode is built by ARINC 653 annex in AADL. Figure 2 reveals a series of substates between two modes. The substates and transitions between the modes can be described in the behavior annex. The initial state in the annex corresponds with the prior   a guard event may specify that certain patterns of error states and propagations are detected and cause an AADL core event, for example, triggering a mode transition.
The modeling method proposed in this study is presented in figure 2. Mode change represents that dynamic reconfiguration occurred. More details and substates between the modes are described using the behavior annex. The trigger condition of the mode transition is declared in the error model annex.
Properties are added to the model, especially to the behavior annex for the following analysis. As a basis of the multiconstraint analysis, elements such as time properties, memory size, and data states are essential elements of the system.

Case Study
Here, in the case of the IMA system, a series of functional modules including navigation, display, communication, and integrated radio frequency sensors (IRFS) are integrated. The navigation module provides the place of the plane and guides the plane in a definition router. The module for an aircraft cockpit display provides the man-machine interface for a pilot. The communication module is responsible for the communication between an aircraft and a ground unit. IRFS integrates all the RF sensors in the aircraft for sending and receiving signals at all frequency ranges.
For simplification, an IMA system with four modules is modeled based on AADL in this section. We denote each module with the first letter of its name-navigation module (N), display module (D), communication (C), and IRFS (I). There are several partitions on each module according to their functions. An application runs on a partition. Process refers to the application here. Moreover, it is assumed that there is one partition in module N and module D. Three partition are set up in the module I. The other two partitions are in module C. The application on each partition communicates with GSM to define the operation of connections and applications. First, the configuration state of a system can be described by AADL. The logic configuration structure needs the ARINC 653 annex in AADL. The ARINC 653 entities fabricated using the system architecture correspond to the AADL components. The model of the IMA system is presented in a graphical manner based on AADL, as shown in figure 3.
When the module N fails, the GSM detects the failure and starts the failure management. In this case, the failure causes process 1 to break down and the system reconfiguration. Thus, dynamic reconfiguration is triggered. The process is presented in figure 4. 1) After data backup for the process 1, the process 1 is shut down and the connections of process 1 in the module N are destroyed.
2) The system selects a proper module to establish a new partition to run process 1. The strategy for selecting the target module is not introduced here. The target module is module D in this case.
3) A new partition is created in the target module D. Moreover, new channels and connections are set up. Process 1 is reloaded and restarted on the new partition in module D.