A Technical History of the SEI

Architecting Software-Reliant, Safety-Critical Systems with SAE
AADL
The Challenge: Reducing Faults in Safety-Critical Defense Systems
Safety- and mission-critical systems, such as aircraft, motor vehicles, and communication systems,
have become increasingly software reliant. The cost of developing such systems has increased
exponentially under the current practice of “build then test” and has become unaffordable—reaching
10 billion dollars for the next-generation aircraft, with software comprising 70
percent or more of the total system cost [Redman 2010]. The results are major delays in system
delivery and unexpected system failures during operation. A major cost driver is the exponential
growth in software size and interaction complexity. This growth is due to the increasing role of
software as the integrator of system functionality and the use of a shared networked computer
hardware infrastructure. Studies show that for safety-critical software systems, 70 percent of
faults are introduced during requirements specification and architecture design; and 80 percent are
currently not caught until integration/acceptance testing and actual operation, with rework cost
factors of 110-1000x [AVSI 2010]. Many of the root causes are related to mismatched assumptions
in the interaction between the software, the hardware, and the physical system [Feiler 2009].
Studies of this problem have recommended a paradigm shift toward an architecture-centric,
model-based practice of end-to-end assurance evidence through predictive analysis and formal
verification to complement testing [NRC 2007].
A Solution: SAE Architecture Analysis & Design Language (AADL)
In the 1990s, DARPA-funded research in software architecture fostered the creation of a number
of architecture description languages (ADLs), one of them being MetaH, which was specifically
designed at the Honeywell Technology Center for embedded software systems and which supported
RMA [Vestal 1993]. Its successful use on a missile guidance system at the U.S. Army Aviation
and Missile Research Development and Engineering Center (AMRDEC) Software Engineering
Directorate (SED) and several other pilot projects led AMRDEC SED, in 1999, to kick
off and chair a standardization effort through the SAE AS-2C Architecture Description Language
Committee in the Avionics Systems Division of SAE International. Under the technical leadership
of the SEI, the AADL standard was approved by 23 voting member organizations and published
in November 2004; it was revised in January 2009 based on feedback from the user community
[SAE AADL 2009]. In June 2006, a set of Annex standards was published to support various
forms of hazard, reliability, and fault-impact analysis. The Annex included the AADL Meta
model and XMI interchange format, and the error model extension to AADL. In January 2011, a
second set of Annex standards was published, consisting of a Behavior Annex, a Data Modeling
Annex, and an ARINC653. With the release of the standard, the SEI provided an Eclipse-based
open source implementation of a tool environment for AADL called OSATE to encourage pilot
projects.
SAE AADL was specifically designed to support modeling and analysis of large-scale embedded
software system architectures in terms of an application runtime architecture bound to a computer
platform architecture and interacting with a physical system in which it is embedded. The architecture
is expressed through concepts with well-defined semantics, such as periodic and aperiodic
tasks with sampled and queued communication operating as a partitioned system on synchronous
CMU/SEI-2016-SR-027 | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY 54
Distribution Statement A: Approved for Public Release; Distribution is Unlimited