Modeling Replacement Functions to Mitigate Failures
Back to Intro
Until now, we have been able to model and reason about hardware failures as well as reconfigure the resulting functional analysis architecture in response to these failures. Now, we want to cover one more possibility which is common in fault tolerant architectures; that is, to replace a function with another. This replacement function is usually limited and not fully functional or provides results with a lesser degree of accuracy. We will capture this through the degradation level.
In our example, if the front radar fails we could use the front camera for obstacle detection and feed its input into the dynamic object detection controller. For the purposes of this example and to keep it short we only model the camera sensor and not the control that goes with it.
All we need to do to add this replacement function is to
define the function and give it cardinality 0..1 as with
the others. We also write the same input and output constraints for what
constitutes a failure of the front camera. Then we need to write a
replacement constraint which states if the front radar function is
missing then we should have the front camera instead in the
architecture. The resulting architecture is as follows:
Now, using Clafer’s assertions we can assert that there are no single points of failure for our system. We capture this by noting we have 8 device nodes in our architecture so we constrain to have only 7 (i.e. only one has failed). Then we can assert that the trajectory planning AP and speed control are always present; which we do find.
Back to Modeling FAA Re-configurations
Back to Intro
The reference remains unchanged.
