Architecture Modeling - SPES 2020

Architecture Modeling
next selection. The second assertion defines what happens before this minute. Obviously, it
should not be allowed that the temperature provided after a new selection becomes too high
or too low (maybe due to inappropriate heating or cooling). The specification of the second
guarantee thus states, that temperature fluctuation is within an appropriate range, i.e., the first
momentum of some hull curve of the difference is less than 0.
4.1.2 Real–Time
The very same system could be instantiated at lower abstraction level as depicted in Figure
4.2. It shows a chain of components involved to perform the air conditioning function.
A tempSens component represents the sensor acquiring the temperature of the fuselage. The
sensor values are captured, stored for later use (such as visualization), and forwarded to the
temperature control component AirTempControl. The control component calculates control
parameters with respect to the incoming temperature and the selected one (not shown), thus
implementing a classical control loop. The AirCondition component models a physical
part, possibly consisting of heating and cooling elements, compressors, etc.
temp occurs each 50ms
with jitter 5ms
tempSensor
Delay between temp and tempData within [5ms,7ms]
tempData occurs each
50ms with jitter 10ms
temp tempData
Capture
Delay between tempData and control within [10ms,12ms]
control
AirTempControl AirCondition
Figure 4.2: Real-Time Contracts Example
Derived from the demands of such control loop (e.g. with respect to stability), it might be
required that the loop is executed periodically with a certain period and maximum jitter. Due
to other demands, maximum delays might needed to be satisfied by the control loop. These
requirements belong to the classical real-time domain, and can be represented by a set of realtime
contracts as depicted in the figure.
The contract associated to the component Capture specifies the strong assumption that the
component gets an input each 50ms with a maximum jitter of 5ms. Under this condition, the
component is required to deliver the sensor value within a time span of 5 to 7ms.
A similar contract is assigned to the control component, stating that the maximum jitter is
10ms, and the requirement to deliver control parameters between 10ms and 12ms after it has
received an input.
4.1.3 Safety
Looking at components under the safety aspect requires to address the dysfunctional behavior
of them. When designing a redundant architecture, for instance, the specification needs to
express that a functional failure can only occur when failures in (all) redundant sub-functions
can occur. A typical contract thus looks like as depicted in Figure 4.3. The contract has the
51/ 156