Architecture Modeling - SPES 2020

Architecture Modeling
The component ValidSwitch takes these signals and decides whether the BSCU is considered
to deliver valid commands. The SelectSwitch finally takes the commands send by
the respective control units. In normal operation mode, it relays the commands from the first
control unit to the hydraulic system. If the first units fails, SelectSwitch switches over to
the second unit. In order to keep the example simple, the redundancy concept of the hydraulic
system is not shown here.
PedalPos1
BSCU1
CMD_AS1
C
always not(fail(PedalPos1))
&& not(fail(PedalPos2))
BSCU
Valid1 Valid2
Valid
Switch
Select
Switch
PedalPos2
BSCU2
CMD_AS2
always not(fault(BSCU1)) or
always not(fault(BSCU2))
C1
always
not(fail(PedalPos1))
C2
always
not(fail(PedalPos2))
CMD_AS
Valid
Hydraulic
always not(fail(CMD_AS1)) or
always not(fail(CMD_AS2))
always not(fault(BSCU1))
always not(fault(BSCU2))
Wheel
Figure 4.9: VIT Example with Safety Contracts
always not(fail(CMD_AS1))
always not(fail(CMD_AS2))
Figure 4.9 also shows some safety contracts. The top-level contract C = (As,Aw,G) defines as
the strong assumption that the brake pedals never fail to send correct position values. The weak
assumption of C states that the contract holds for such situations where not both redundant control
units fail together. In this case, the contract guarantees that at least one of the command lines
delivers correct commands to the hydraulic. Note, that this safety case is strongly simplified. A
comprehensive safety analysis usually would incorporate much more complex situations. For
example, none of the components ValidSwitch and SelectSwitch are considered here.
It is furthermore a rather unrealistic requirement that both brake pedals never fail.
We however assume that a further outcome of safety analysis are two local contracts for the
redundant control units. C1 strongly assumes that PedalPos1 never fails. The weak assumptions
captures situations where BSCU1 does not have a fault. In this case, C1 = (A1s,A1w,G1)
guarantees that the commands send by BSCU1 are correct. A similar contract C2 is defined for
BSCU2.
Showing satisfaction of VIT for this example is simple. We can firstly observe that As =⇒
A1s ∧ A2s, since As equals to A1s ∧ A2s. This proofs the strong VIT condition. Furthermore, it
holds that Aw =⇒ A1w ∨ A2w because Aw equals to A1w ∨ A2w. Assuming satisfaction of C1
and C2, we get A1s ∧ A1w =⇒ G1 for C1, and A2s ∧ A2w =⇒ G2 for C2 by definition.
If we put all four implications together, we can derive As ∧ Aw =⇒ G1 ∨ G2. Since G1 ∨
G2 =⇒ G because of, again, equivalence, we have shown dominance. This concludes the VIT.
59/ 156