Handling Uncertainty in Automatically Generated Implementation Models in the Automotive Domain
1. Handling Uncertainty in Automatically
Generated Implementation Models in the
Automotive Domain
Alessio Bucaioni, Antonio Cicchetti, Federico Ciccozzi, Saad
Mubeen, Alfonso Pierantonio and Mikael Sjödin
31-08-2016
SEAA 2016
Arcticus Systems
2. 2
We discuss the use of modelling with
uncertainty for representing the uncertainty
that typically accompanies many stages of the
software development of vehicular embedded
systems.
PRESENTATION TAKEAWAY
3. - BRAN SELIC
Father of Real-Time UML
“As our systems grow in complexity
traditional code-centric development
methods are becoming intractable”
“More than 80 percent of vehicles’
innovation comes from embedded
systems”
- MANFRED
BROY
Professor of informatics at Technical University of
Munich
7. BACKGROUND
7
ONE-TO-MANY model transformations
Design space generation/exploration
Proximity_Sensor_DFP Input_Process_DFP Path_Calculator_DFP CAN_Send_DFP
(1)
(2)
(3)
(4)
Software Circuit Clock
Connector data
Connector trigger
Data ports
Trigger ports
Timing constraints
Timing constraints
(1)
(2)
(3)
(4)
Software Circuit Clock
Connector data
Connector trigger
Data ports
Trigger ports
Timing constraints
Timing constraints
(1)
(2)
(3)
(4)
Software Circuit Clock
Connector data
Connector trigger
Data ports
Trigger ports
Timing constraints
Timing constraints
(1)
(2)
(3)
(4)
Software Circuit Clock
Connector data
Connector trigger
Data ports
Trigger ports
Timing constraints
Timing constraints
8. Analysis
results
Execution
model
Execution
model
MOTIVATION - Methodology
8
JTL
transformation engine
Functional
model
Execution
models
Timing analysis
& filter
Execution
model
Execution
models
Analysis
results
In-place model
transformation
Filtered execution models
annotated with analysis results
DesginlevelImplementationlevel
EAST-ADL
design model
EAST-ADL
design MM
C2
Rubus
model
Rubus
model
Rubus
models
RubusMM
C2
C2
Filtered RCM models annotated
with analysis results
Rubus
model
Rubus
models
9. MOTIVATION – Motivating scenario: Intelligent
ParkingAssist
9
Proximity_Sensor_DFP Input_Process_DFP Path_Calculator_DFP CAN_Send_DFP CAN_Receive_DFP Control_DFP Brake_Actuator_DFP
IPAssistant_DFP Actuator_DFP
TIMING REQUIREMENT: “ The calculated age and reaction delays shall
not exceed 20 ms and 15 ms, respectevely ”
15 ms
20 ms
11. MOTIVATION – Motivating scenario: Intelligent
ParkingAssist
11
Timing analysis has filtered the solution space. However there
are still 14 RCM models to inspect.
(1)
(2)
(3)
Software Circuit Clock Connector trigger Trigger ports
12. PROBLEM FORMULATION
12
How can we ease the inspection of the Rubus
models solution space for applying domain
knowledge which can not be automated?
13. CONTRIBUTION
13
Enhancing our methodology by introducing the u-
RubusMM, a compact notation for representing the whole
solution space by means of a single u-rubus model with
uncertainty.
15. u-RubusMM
15
We endow Rubus with uncertainty elements.
Romina Eramo, Alfonso Pierantonio, and Gianni Rosa.
Managing uncertainty in bidirectional model transformations.
In Proceedings of the 2015 ACM SIGPLAN International Conference on Software Language
Engineering.
Performed by an automated transformation, as follows:
I. any class in Rubus is added to u-Rubus; in addition
II. auxiliary classes Uclass and Iclass , with class and Uclass
subclasses of Iclass , are added to u -Rubus;
III. association uVariants : Uclass class is added to u -Rubus;
IV. for each association a : class1 class2 in Rubus, an
association a : class1 Iclass2 is added to u -Rubus.
20. DISCUSSION
20
Q: The exploration of the solution space remains manual.
A: This contribution represents a first step towards an analysis-based and
semi-automatic designspace exploration mechanism.
We are investigating the possibility to run timing analysis on a u-Rubus
model.
Q: The methodology only considers timing aspects.
A: The idea of a compact notation can be exploited for successively
exploring the solution space in relation to various properties.
Exploration chain
Q: The methodology generates too many solutions.
A: The inability of real-time software to meet its primary non- functional
requirements becomes apparent only in the later stages of development.
When this happens, the design may have to be heavily and hurriedly
modified. [Bran Selic]
21. CONCLUSIONAND FUTURE WORK
21
We have enhanced our previous methodology by
introducing u-Rubus.
Analysis
results
u-JTL
Timing analysis
& filter
Analysis
results
In-place model
transformation
DesginlevelImplementationlevel
EAST-ADL
design model
EAST-ADL
design MM
C2
u-Rubus
model
RubusMM
C2
C2
u-Rubus model annotated with
analysis results
u-JTL
Rubus
model
Rubus
models
u-RubusMM
C2
The software engineering community has agreed on three instruments when dealing with the increasing complexity of software and its development
Model transformations can relieve developers from significant engineering effort and mitigate errors typical of manual translations.
They can also potentially create an overwhelming amount of information.
Design-space exploration techniques, characterised by one-to-many model transformations, have the potential to generate hundreds, thousands, or more, models.
Despite we can filter the solution space, their usefulness for the engineer can be limited as the solution space is never really unveiled in the process.
In fact, the engineer still has multiple choices and remains uncertain about the one to take: a decision can only be made by manually inspecting and comparing all candidate models.
For the sake of simplicity, we consider only a portion of the software architecture consisting of two nodes connected to a single network that implements the Controller Area Network (CAN).
The following timing requirement is specified too:
According to our original methodology (Fig. 1), the EAST-ADL model in Fig. 2 is transformed in 32 Rubus models
However, with the current support, such an inspection might be a daunting task as the selected Rubus models greatly overlap one with another
The U-metaclasses represents uncertainty points where to anchor multiple alternative instances. Whereas, the role of the I-classes is to let the propagated interface composition in u -Rubus to refer to either a single Interface instance or to multiple instances through the UInterface (as subclass of IInterface ).