Abstract. AADL is a standard for modeling embedded systems that is widely used in avionics and other safety-critical applications. However, AADL lacks a formal semantics, and this severely limits both unambiguous communication among model developers, and the development of simulators and formal analysis tools. In this work we present a formal object-based real-time concurrent semantics for a behavioral subset of AADL in rewriting logic, which includes the essential aspects of its behavior annex. Our semantics is directly executable in Real-Time Maude and provides an AADL simulator and LTL model checking tool called AADL2Maude. AADL2Maude is integrated with OSATE, so that OS-ATE's code generation facility is used to automatically transform AADL models into their corresponding Real-Time Maude specifications. Such transformed models can then be executed and model checked by RealTime Maude. We present our semantics, and two case studies in which safety-critical properties are analyzed in AADL2Maude.

In model-driven development, software artifacts are represented as models in order to improve productivity, quality, and cost effectiveness. In this area, the Meta-Object Facility (MOF) standard plays a crucial role as a generic framework within which a wide range of modeling languages can be defined. The MOF standard aims at offering a good basis for model-driven development, providing some of the building concepts that are needed: what is a model, what is a metamodel, what is reflection in the MOF framework, and so on. However, most of these concepts are not yet fully formally defined in the current MOF standard. In this paper we define a reflective, algebraic, executable framework for precise metamodeling based on membership equational logic (mel) that supports the MOF standard. Our framework provides a formal semantics of the following notions: metamodel, model, and conformance of a model to its metamodel. Furthermore, by using the Maude language, which directly supports mel specifications, this formal semantics is executable. This executable semantics has been integrated within the Eclipse Modeling Framework as a plugin tool called MOMENT2. In this way, formal analyses, such as semantic consistency checks, model checking of invariants and LTL model checking, become available within Eclipse to provide formal support for modeldriven development processes.

Model transformations are used in model-driven development for mechanizing the interoperability and integration among modeling languages. Due to the graph-theoretic nature of models, the theory of graph transformation systems and its technological support provide a convenient environment for formalizing and verifying model transformations, which can then be used for defining the semantics of modelbased domain-specific languages. In this paper, we present an approach for formalizing and verifying QVT-like transformations that reuses the main concepts of graph transformation systems. Specifically, we formalize model transformations as theories in rewriting logic, so that Maude's reachability analysis and model checking features can be used for verifying them. This approach also provides a new perspective on graph transformation systems, where their formal semantics is given in rewriting logic. All the ideas presented are implemented in MOMENT2. In this way, we can define formal model transformations in the Eclipse Modeling Framework (EMF) and we can verify them in Maude. We use a model of a distributed mutual exclusion algorithm to illustrate the approach.

Abstract. This paper explains how the MOMENT2 formal model transformation framework has been extended to support the formal specification and analysis of real-time model-based systems. We provide a collection of built-in timed constructs for defining the timed behavior of model-based systems that are specified with in-place model transformations. In addition, we show how an existing model-based system can be extended with timed features in a non-intrusive way (i.e, without modifying the class diagram) by using in-place multi-domain model transformations supported in MOMENT2. We give a real-time rewrite formal semantics to real-time model transformations, and show how the models can be simulated and model checked using MOMENT2's Maudebased analysis tools. In this way, MOMENT2 becomes a flexible, effective, automatic tool for specifying and verifying model-based real-time and embedded systems within the Eclipse Modeling Framework using graph transformation and rewriting logic techniques. We illustrate our approach on a simple round trip time protocol.

Abstract. In Model-Driven Engineering, a software development process is a sequence of manipulation tasks that are applied to models, where model transformations play a relevant role. MOMENT (MOdel manageMENT) is a framework that is integrated in the Eclipse platform. MOMENT provides a collection of generic set-oriented operators to manipulate EMF models. In this paper, we present the model transformation mechanism that is embodied by the ModelGen operator. This operator uses the term rewriting system Maude as transformation engine and provides support for traceability. ModelGen has been defined in an algebraic specification so that we can use formal tools to reason about transformation features, such as termination and confluence. Furthermore, its application to EMF models shows that formal methods can be applied to industrial modeling tools in an efficient way. Finally, we indicate how the ModelGen operator provides support for the QVT Relations language in the MOMENT Framework.