AADL Isolette Example!

Size: px

Start display at page:

Download "AADL Isolette Example!"

Bruce Stanley Morton
5 years ago
Views:

1 AADL Isolette Example! Safety Critical Software SAnToS Laboratory Kansas State University John Hatcliff, Brian Larson

2 Objectives Understand how the functional architecture of the Isolette example from the FAA Requirements Engineering Handbook can be represented in AADL Become comfortable with using various AADL tools to specify simple architectural models

It senses the Current Temperature of the Isolette and turns the Heat Source on and off to

3 Isolette Example Isolate Thermostat for an infant incubator The purpose of the Isolette Thermostat is to maintain the air temperature of an Isolette within a desired range. It senses the Current Temperature of the Isolette and turns the Heat Source on and off to warm the air as needed. The Isolate example will be used as the primary running example in our lectures.

AADL Package Packages are used to organize component interface

a package that will hold both component types and implementations for the

4 AADL Package Packages are used to organize component interface specifications (component types) and their blueprints (component implementations) into libraries. package isolette public with Base_Types,iso_variables; end isolette; Name of a package that will hold both component types and implementations for the Isolette. This package will import from other packages definitions for basic AADL types and for variables/types used throughout the Isolette example.

AADL System To describe the top-level structure of the Isolette device, we use the AADL System component category system isolette end isolette; system implementation isolette.

5 AADL System To describe the top-level structure of the Isolette device, we use the AADL System component category system isolette end isolette; system implementation isolette.single_sensor subcomponents connections end isolette.single_sensor; Define the component type named isolette using a system component. In this case, we have no features on our component interface because we are defining a wrapper for the entire system.

6 AADL System To describe the top-level structure of the Isolette device, we use the AADL System component category system isolette end isolette; system implementation isolette.single_sensor subcomponents connections end isolette.single_sensor; Define a component implementation impl for the component type isolette. A component implementation specifies properties/structure (but usually not the complete details) of a components implementation. In this case, we will use the implementation construct to specify the subcomponents of the isolette and the connections (communication) between them.

AADL System Implementation In the system implementation, we can define subcomponents corresponding to the subcomponent identified in the Isolette conceptual architecture from the FAA REMH.

7 AADL System Implementation In the system implementation, we can define subcomponents corresponding to the subcomponent identified in the Isolette conceptual architecture from the FAA REMH. system implementation isolette.single_sensor subcomponents thermostat : system thermostat_single_sensor.impl; temperature_sensor : device Devices::temperature_sensor.impl; heat_source : device Devices::heat_source.impl; operator_interface : system operator_interface.impl; connections end isolette.single_sensor Name each of the subcomponents and associate each with a component category and implementation (declared elsewhere). Note: we don t have a subcomponent for Air because air is an entity of the environment (not an entity of the system to be implemented). We can, if we choose, also model the environment with AADL. This will be addressed elsewhere.

8 Other Components Some components in our models will represent hardware whose details we may choose not to specify (in which case, we leave the implementation empty). device temperature_sensor features air : in data port Iso_Variables::current_temperature current_temperature : out data port Iso_Variables::current_temperature end temperature_sensor; device implementation temperature_sensor.impl end temperature_sensor.impl; We leave the implementation of a component unspecified by using an empty body.

9 AADL Ports Component interfaces (types) have features that capture capabilities and means of interaction made available to other components ( clients of the component type being declared). device temperature_sensor features current_temperature : out data port Iso_Variables::current_temperature end temperature_sensor; Declare a port name, category ( out, data ), and type for the data that will be communicated on that port. Note: we use the device category to model the Temperature Sensor component.

AADL Ports The Thermostat component has a number of ports to capture its communication potential.

lower_desired_temperature : in data port iso_variables::lower_desired_temperature; upper_desired_temperature : in data port iso_variables::upper_desired_temperature;

regulator_status : out data port iso_variables::status; monitor_status : out data port iso_variables::status; display_temperature : out data port

10 AADL Ports The Thermostat component has a number of ports to capture its communication potential. system thermostat_th features current_temperature : in data port iso_variables::current_temperature; heat_control : out data port iso_variables::on_off; lower_desired_temperature : in data port iso_variables::lower_desired_temperature; upper_desired_temperature : in data port iso_variables::upper_desired_temperature; lower_alarm_temperature : in data port iso_variables::lower_alarm_temperature; upper_alarm_temperature : in data port iso_variables::upper_alarm_temperature; regulator_status : out data port iso_variables::status; monitor_status : out data port iso_variables::status; display_temperature : out data port iso_variables::measured_temperature_range; alarm : out data port iso_variables::on_off; end thermostat_th; We will see later that related ports (e.g., all the ports capturing operator settings) can be bundled together in an AADL Feature Group which is a useful abstraction mechanism.

11 AADL Data Type Modeling As our modeling effort unfolds, we maintain a package containing data types defined specifically for the Isolette system. isolette.aadl package isolette public with Base_Types, iso_variables; end isolette; iso_variables.aadl package iso_variables public with Base_Types, Data_Model; --range of Lower Desired Temperature data lower_desired_range properties Data_Model::Real_Range => ; Data_Model::Measurement_Unit => "Fahrenheit"; end lower_desired_range; --range of Display Temperature data measured_temperature_range properties Data_Model::Real_Range => ; Data_Model::Measurement_Unit => "Fahrenheit"; end measured_temperature_range; end iso_variables;

AADL Data Type Modeling As our modeling effort unfolds, we maintain a package containing data types defined specifically for the Isolette system.

12 AADL Data Type Modeling As our modeling effort unfolds, we maintain a package containing data types defined specifically for the Isolette system. system thermostat_th features current_temperature : in data port Iso_variables::current_temperature; heat_control : out data port Iso_variables::on_off; lower_desired_temperature : in data port Iso_variables::lower_desired_temperature; upper_desired_temperature : in data port Iso_variables::upper_desired_temperature; lower_alarm_temperature : in data port Iso_variables::lower_alarm_temperature; upper_alarm_temperature : in data port Iso_variables::upper_alarm_temperature; regulator_status : out data port Iso_variables::status; monitor_status : out data port Iso_variables::status; display_temperature : out data port Iso_variables::display_temperature_range; alarm : out data port Iso_variables::on_off; end thermostat_th; (excerpt from iso_variables.aadl) Declaration of the display_temperature_range type used in the port declaration above. --range of Display Temperature data current_temperature properties Data_Model::Real_Range => ; Data_Model::Measurement_Unit => "Fahrenheit"; end current_temperature;

AADL Connections In the system implementation, we can define connections representing the communication between each of the subcomponents system implementation isolette.

13 AADL Connections In the system implementation, we can define connections representing the communication between each of the subcomponents system implementation isolette.impl subcomponents connections ct : port temperature_sensor.current_temperature -> thermostat.current_temperature; hc : port thermostat.heat_control -> heat_source.heat_control; ldt : port operator_interface.lower_desired_temperature -> thermostat.lower_desired_temperature; udt : port operator_interface.upper_desired_temperature -> thermostat.upper_desired_temperature; lat : port operator_interface.lower_alarm_temperature -> thermostat.lower_alarm_temperature; uat : port operator_interface.upper_alarm_temperature -> thermostat.upper_alarm_temperature; rs : port thermostat.regulator_status -> operator_interface.regulator_status; ms : port thermostat.monitor_status -> operator_interface.monitor_status; dt : port thermostat.display_temperature -> operator_interface.display_temperature; al : port thermostat.alarm -> operator_interface.alarm; end isolette.impl; A connection relates the port of one component to the port of another, representing the communication between the two components via the specified ports. The ports must be compatible (e.g., with respect to port types). E.g., ct names the port communication for Current Temperature.

14 Continuing We can continue in this manner to specify the thermostat architecture following the presentation in the FAA REMH In the following slides, we will illustrate the Regulate Temperature function, and leave the completion of the Monitor Temperature function as an exercise.

Decomposing Thermostat The FAA REMH decomposes the Isolette into a Regulate Temperature function that actually implements the controls of the system and a Monitor Temperature function

15 Decomposing Thermostat The FAA REMH decomposes the Isolette into a Regulate Temperature function that actually implements the controls of the system and a Monitor Temperature function that implements a safety system that will generate an alarm when certain error conditions arise. Decomposing the Thermostat into Regulate Temperature and Monitor Temperature functions.

16 Decomposing Thermostat The component implementation for the thermostat reveals the decomposition. system implementation thermostat_th.impl subcomponents regulate_temperature : process regulate_temperature_mt.impl; monitor_temperature : process monitor_temperature_mt.impl; connections end thermostat_th.impl The Thermostat implementation reveals a decomposition to components representing the Regulate Temperature and Monitor Temperature functions.

17 Regulate Temperature Consider the description of the Regulate Temperature function from the FAA REMH. We will proceed to illustrate how the components, external communication, and internal communication are modeled.

Regulate Temperature Interface We will now consider the modeling of the Regulate Temperature function process regulate_temperature_mt features upper_desired_temperature : in data port

out data port Iso_variables::display_temperature_range; current_temperature : in data port Iso_variables::display_temperature_range; heat_control : out data port Iso_variables::on_off; end

18 Regulate Temperature Interface We will now consider the modeling of the Regulate Temperature function process regulate_temperature_mt features upper_desired_temperature : in data port Iso_variables::upper_desired_temperature; lower_desired_temperature : in data port Iso_variables::lower_desired_temperature; regulator_status : out data port Iso_variables::status; displayed_temp : out data port Iso_variables::display_temperature_range; current_temperature : in data port Iso_variables::display_temperature_range; heat_control : out data port Iso_variables::on_off; end regulate_temperature_mt; Use an AADL process component category to indicate that the address space of Regulate Temperature is separate from that of Monitor Temperature. Declare a port for each type of external communication (for each data flow to/from the module)

Regulate Temperature Impl The internal function and data flows for Regulate Temperature specified in the FAA REMH are reflected in the component implementation process implementation

19 Regulate Temperature Impl The internal function and data flows for Regulate Temperature specified in the FAA REMH are reflected in the component implementation process implementation regulate_temperature.impl subcomponents manage_regulator_interface : thread manage_regulator_interface_mri.impl; manage_heat_source : thread manage_heat_source_mhs.impl; manage_regulator_mode : thread manage_regulator_mode_mrm.impl; connections end regulate_temperature.impl; Declare a thread for each of the three functions of the Regulate Temperature component.

20 Regulate Temperature Impl The internal function and data flows for Regulate Temperature specified in the FAA REMH are reflected in the component implementation process implementation regulate_temperature_mt.impl subcomponents manage_regulator_interface : thread manage_regulator_interface_mri.impl; manage_heat_source : thread manage_heat_source_mhs.impl; manage_regulator_mode : thread manage_regulator_mode_mrm.impl; connections rudt : port upper_desired_temperature -> manage_regulator_interface.upper_desired_temp; rldt : port lower_desired_temperature -> manage_regulator_interface.lower_desired_temp; mudt : port upper_desired_temperature -> manage_heat_source.upper_desired_temperature; mldt : port lower_desired_temperature -> manage_heat_source.lower_desired_temperature; rrs : port manage_regulator_interface.regulator_status -> regulator_status; rdt : port manage_regulator_interface.displayed_temp -> displayed_temp; rcti : port current_temperature -> manage_regulator_interface.current_temperature; rcth : port current_temperature -> manage_heat_source.current_temperature; rhc : port manage_heat_source.heat_control -> heat_control; rdr : port manage_regulator_interface.desired_range -> manage_heat_source.desired_range; rrmh : port manage_regulator_mode.regulator_mode -> manage_heat_source.regulator_mode; rrmi : port manage_regulator_mode.regulator_mode -> manage_regulator_interface.regulator_mode; rctm : port current_temperature -> manage_regulator_mode.current_temperature; rif : port manage_regulator_interface.interface_failure -> manage_regulator_mode.interface_failure; end regulate_temperature_mt.impl; Note: The two desired temperature arcs in the subsystem are broken out into upper/lower values (so we end up with 14 connections compared to 12 arcs in the original diagram.

Manage Heat Source The Manage Heat Source function turns the heating element on/off based on the current temperature and the desired temperature range.

21 Manage Heat Source The Manage Heat Source function turns the heating element on/off based on the current temperature and the desired temperature range. thread manage_heat_source_mhs features heat_control : out data port Iso_Variables::on_off current_temperature : in data port Iso_Variables::current_temperature lower_desired_temperature : in data port Iso_Variables::lower_desired_temperature upper_desired_temperature : in data port Iso_Variables::upper_desired_temperature regulator_mode : in data port Iso_Variables::regulator_mode end manage_heat_source_mhs; thread implementation manage_heat_source_mhs.impl end manage_heat_source_mhs.impl; Note: we do not describe the details of the component at this point in development.

22 Manage Regulator Interface The Manage Regulator Interface function implements the interaction with the operator interface. thread manage_regulator_interface_mri features regulator_status : out data port Iso_Variables::status lower_desired_temp : in data port Iso_Variables::lower_desired_temperature upper_desired_temp : in data port Iso_Variables::upper_desired_temperature current_temperature : in data port Iso_Variables::current_temperature displayed_temp : out data port Iso_Variables::measured_temperature_range regulator_mode : in data port Iso_Variables::regulator_mode interface_failure : out data port Base_Types::Boolean end manage_regulator_interface_mri; thread implementation manage_regulator_interface_mri.impl end manage_regulator_interface_mri.impl;

23 Manage Regulator Mode The Manage Regulator Mode function determines the operating mode (Normal, Failure) of the Regulate Temperature function thread manage_regulator_mode_mrm features regulator_mode : out data port Iso_Variables::regulator_mode current_temperature : in data port Iso_Variables::current_temperature interface_failure : in data port Base_Types::Boolean internal_failure : in data port Base_Types::Boolean end manage_regulator_mode_mrm; thread implementation manage_regulator_mode_mrm.impl end manage_regulator_mode_mrm.impl; Note: we add a notion of interface failure (not specified in the REMH) to the notion of internal failure

AADL Data Type Modeling A separate package of data types is maintained for modeling data values communicated between Isolette components. Data types are defined using AADL data components.

aadl package iso_variables public with Base_Types, Data_Model; We can use properties defined in the AADL Data Model to specify range constraints and units.

24 AADL Data Type Modeling A separate package of data types is maintained for modeling data values communicated between Isolette components. Data types are defined using AADL data components. The name lower_desired_range can be used as a type in other sections of the AADL Isolette model. iso_variables.aadl package iso_variables public with Base_Types, Data_Model; We can use properties defined in the AADL Data Model to specify range constraints and units. --range of Lower Desired Temperature data lower_desired_range properties Data_Model::Real_Range => ; Data_Model::Measurement_Unit => "Fahrenheit"; end lower_desired_range; --range of Display Temperature data display_temperature_range properties Data_Model::Real_Range => ; Data_Model::Measurement_Unit => "Fahrenheit"; end display_temperature_range; end iso_variables;

25 Summary AADL is a natural vehicle for formalizing architectural elements introduced in the FAA REMH methodology. Applying AADL to the Isolette system, we are able to model: Components Interfaces Implementations (nested component structures) Communication between components In subsequent lectures, we will explore additional topics: Using BLESS to define component behaviors and behavioral constraints on components Using the AADL Error Annex to model sources and propagation of errors within the Isolette.

26 For You To Do Starting from the incomplete AADL model in the files isolette.aadl and iso_variables.aadl Give component types and implementations for the temperature sensor and heat source components Add data definitions corresponding to four definitions of variables in the internal variables Table A-12. lower_alarm_temp upper_alarm_temp alarm_range monitor_mode Give all the AADL definitions necessary to model the Monitor Temperature Function Make sure your models are syntactically correct by editing them in the OSATE AADL tool.

27 Acknowledgements The material in this lecture is based on The Isolette example used in the FAA DOT/FAA/AR-08/32, Requirements Engineering Management Handbook. David L. Lempia & Steven P. Miller. Various AADL tutorials available on the AADL website. Thanks to Brian Larson for constructing the AADL model of the Isolette used in this lecture.

Fault Tree Analysis (FTA) Kim R. Fowler KSU ECE February 2013

Fault Tree Analysis (FTA) Kim R. Fowler KSU ECE February 2013 Purpose for FTA In the face of potential failures, determine if design must change to improve: Reliability Safety Operation Secondary purposes: