Architecture Modeling - SPES 2020

Architecture Modeling
strong assumption true since it holds for any environment. The weak assumption states that
the contract holds under the condition that the underlying hardware (BSCU) does not fail. In
this case, the braking system fails only if both redundant sub-systems hydraulic system A and
hydraulic system B fail.
true
BrakingSystem
BSCUFails does not fail
BrakingSystemFails shall only fail if HydraulicSystemAFails &&
HydraulicSystemBFails
BSCUFails BrakingSystemFails HydraulicSystemAFails HydraulicSystemBFails
Figure 4.3: Safety Contracts Example
Since failure conditions are usually complex, abbreviations can be defined for them:
failureCondition TooMuchEnergyConsumption is defined by:
(consumption > 2) holds longer than 2s
Later, these abbreviations may by used to simplify the definitions of safety-related patterns.
4.2 Virtual Integration Testing
Technically, a component may be a (composed) system, which is constructed from a set of
(sub-) components. In more detail, a system is given by a set of components, an interface and
a set of named (inter-) connections. An interface is a set of directed ports, denoted inports
and outports, respectively. Each port specifies a set of typed (data) flows or services 1 . In the
following, we assume for simplicity that ports specify single flows. Hence, we identify ports
and their corresponding flow. Furthermore, we abstract in the following discussion from the
fact, that we have to distinguish between components and instances of components. This fact is
important in the sense, that contracts are defined on components and not on instances (which are
referred as RichComponentProperty in the SPESMM). Thus, if we have two instances
of the same component, we have to uniquely identify the respective ports of these instances.
Otherwise, from a formal point of view, contracts cannot distinguish behavior of different ports.
If, for example, L and R in Figure 4.4 would be instances of the same component, the ports
would have the same name, and could not be distinguished from a semantical viewpoint without
unique identification.
A connection links two ports. It either links two sub-component ports, one outport and one
inport (e.g. port l2r), or one port of the system interface and one sub-component port with
the same direction (e.g. port r2e), or two system interface ports of opposite direction. Each
sub-component inport and each system outport must be linked to exactly one other port. Linked
1 We omit a discussion of services here, which can be seen as a derived concept.
52/ 156