Architecture Modeling - SPES 2020

4.2.3 Examples
VIT Example for Functional Contracts
Architecture Modeling
In the following, the application of VIT is discussed by a set of simple examples. We start with a
example for VIT checking of functional specifications as depicted in Figure 4.5. It shows an air
conditioning system providing tempered air. The AirTempSystem component has input ports
for the currently selected and the current temperature, and an output port for the temperature
of the provided air. The corresponding contract to AirTempSystem states that the difference
between selected and current air temperature must be at most 0.5 ◦ C. The contract further states
that whenever some temperature has been selected, it takes at most 60 seconds for the system to
provide air of this temperature. The strong assumption of the contract has three parts. The first
part states that the selected temperature is in the range of between 12 ◦ C and 35 ◦ C. The second
part states that the sensor value actTemp for the actual temperature is updated each 20 ms.
And the third assumption requires from the environment that the actually measured temperature
must not differ more than 0.2 ◦ C from the provided air.
C1
C2
C
tempSelect
actTemp
12°C < tempSelect < 35°C
actTemp occurs each 20ms
always abs(actTemp –
flowTemp) < 0.2°C
AirTempSystem
12°C < tempSelect < 35°C
actTemp occurs each 20ms
whenever chg(tempSelect) occurs nomTemp = tempSelect
holds during [10ms, chg(tempSelect) [
Whenever actTemp occurs control.act = actTemp &&
control.nom = nomTemp occurs within [12ms, 14ms]
tempSelectStore
AirTempControl
whenever chg(tempSelect) occurs abs(flowTemp – tempSelect) <
0.5°C holds during [60s, chg(tempSelect) [
nomTemp
C3
control occurs each 20ms
with jitter 2ms
control
AirCondition
Figure 4.5: VIT Example with Functional Contracts
whenever control occurs abs(flowTemp - control.nom) <
abs(control.act - control.nom) + epsilon holds during [10ms, control [
flowTemp
In order to perform VIT, we start with the VIT condition stating that the strong assumption
of the component, together with all local contracts must imply all local strong assumptions.
As Figure 4.6 shows, this is trivial to see for the local contracts C1 and C2. For C3 =
(A3s,A3w,G3), we can employ existing results from real-time analysis allowing us to derive
a periodical activation pattern for the occurrence of control events from contract C2. This
concludes the strong VIT condition, requiring that all strong assumptions of the sub-components
are satisfied if the strong assumptions of the parent component is (and if all local contracts are
satisfied). Interestingly, the example shows that different aspects of a design are often closely
entangled, in this case the functional and the real-time aspect.
Showing satisfaction of the guarantee of C needs a little more effort. Firstly, we can derive a
new guarantee from C1 and C2, and G3 that replaces in G3 occurrences of control.nom by
56/ 156