Architecture Modeling - SPES 2020

AirTempSystem
C1
C
temp occurs each 50ms
temp occurs each 50ms
with jitter 5ms
C2
Architecture Modeling
Delay between temp and actTemp within [5ms,7ms]
actTemp occurs each
50ms with jitter 10ms
temp actTemp
Capture
Delay between temp and control within [15ms,20ms]
Delay between actTemp and control within [10ms,12ms]
AirTempControl
Figure 4.7: VIT Example with Real-Time Contracts
control
Due to the fact that, when C1 is satisfied, then also the assumption of C2 is satisfied (remind
that C1 and C2 are compatible), we can eliminate A2s. If both guarantees G1 and G2 are satisfied,
both together satisfy G because the result of G1 ∧ G2 is a simple addition of delays. This
completes the proof chain.
temp occurs each 50ms
temp occurs each 50ms
with jitter 5ms
Delay between temp and actTemp within [5ms,7ms]
actTemp occurs each
50ms with jitter 7ms
actTemp occurs each
50ms with jitter 10ms
!
Delay between temp and control within [15ms,20ms]
Delay between temp and control within [15ms,19ms]
"
Delay between actTemp and control within [10ms,12ms]
Figure 4.8: VIT Example with Real-Time Contracts: Proof Chain
VIT Example for Safety Contracts
Modeling safety aspects is usually more elaborated than for real-time, since specification of
failure conditions and dependencies are often rather complex. A simple application example of
VIT for safety shall however be discussed. Figure 4.9 shows an abstract model of a wheel brake
system. The BSCU controls a hydraulic system, that provides the brake force to a wheel, by
sending commands via CMD AS. The braking system is redundantly implemented. Both BSCU
and Hydraulic contain the relevant parts twice. The figure shows that BSCU is composed of
two redundant control units BSCU1 and BSCU2. The control units take the (also redundant)
brake pedal positions (PedalPos1 and PedalPos2) and calculate respective commands
(CMD AS1 and CMD AS2) to control the hydraulic system. Both controls units maintain validation
ports (Valid1 and Valid2) indicating whether the commands send are valid or not.
58/ 156