1. A-7E Avionics System:
A Case Study in Utilizing
Architectural Structures

2. Agenda
• A case study of an architecture designed by
engineering and specifying 3 specific architectural
structures.
• We will see how these structures complement each
other to provide a complete picture of how the
system works
• We will see how certain qualities of the system are
affected by each one.

3. A-7E Corsair II
• It is a single-seat, carrier-based attack aircraft used
by the U.S. Navy throughout the 1960s, 1970s, and
1980s.

4. A-7E Corsair II
• The A-7C (earlier version), was the very first
production aircraft in the world to be equipped with
an onboard computer to help the pilot with
navigation and "weapon delivery"
• The A-7E's onboard computer is a small, special-
purpose IBM machine for which no compiler exists;
programming is in assembly language only
• The computer has special registers connected to A-
D/D-A converters that let it receive and send data
to almost two dozen devices in the aircraft's
avionics suite.

5. Requirements and Qualities

6. Software Functionality
• The A-7E software is responsible for reading sensors and
updating cockpit displays that help the pilot drop
weapons on a target.
• The pilot communicates the location of a ground target
(or a navigational waypoint) to the software in a number
of ways, including the following:
▫ Keying in its latitude and longitude via the keypad
▫ Slewing the map using a joystick until its coordinates
are under the center crosshairs and then "designating"
it by pushing a special button on the control stick
▫ Aiming the forward-looking radar to the point and
designating it
▫ Slewing a special symbol on the heads-up display until
it overlays the point of interest on the ground and
then designating it

7. Software Functionality
• The software then provides navigational information
(direction, distance, time to go) and directional
cues on the heads-up display that take the aircraft
to the designated location.
• The software has at least five direct and indirect
ways to calculate the aircraft's current altitude
▫ Example: a trigonometric scheme using the
range and elevation angle of the forward-looking
radar as components of a triangle
• There are more than 20 weapon delivery modes, all
demanding in terms of the real-time calculations
(repeated 25 times every second) necessary to
maintain the A-7E's bombing accuracy

8. Figure 3.3 Calculation of altitude

9. Quality Attributes
• The architecture we will present is not the
architecture for the original software but that for a
redesign project launched by Navy software
engineers
• The qualities that the software system was
expected to have included real-time performance
and modifiability for expected changes.
• Specifically, the performance requirements were
stated in terms of updates per second of the A7-E's
displays and weapon delivery calculations.
• The modifiability requirements dealt with making
changes to the weaponry, the platform, the
symbology on the display, and the addition of new
input through the keypad

10. Scenarios
• The system was constructed beginning in 1977 for
the naval aviators who flew the A-7E aircraft
• The developing organization was the software
engineering group at the U.S. Naval Research
Laboratory.
• The developers were creating the software to test
their belief that certain software engineering
strategies were appropriate for high-performance
embedded real-time systems.
▫ information hiding
▫ cooperating sequential processes

11. Scenarios
• The architects included one of the authors of this
book (Paul Clements) and one of the leaders in the
development of software engineering principles
(David Parnas)
• There was no compiler available for the target
platform.

12. Relationship to the Architecture
Business Cycle

13. A-7E Avionics System Architecture
• The architecture for the A-7E avionics system is
centered around three architectural structures:
▫ Decomposition, a structure of modules
▫ Uses, a structure of modules
▫ Process, a structure of components and
connectors
• We will discuss each in turn

14. Table 3.1: Architectural Structures
Structure Elements Relations Has Influence over
among
Elements
Module Modules Is a submodule of; Ease of change
Decomposition (implementation shares a secret with
units)
Uses Procedures Requires the correct Ability to field subsets and
presence of develop incrementally
Process Processes; thread Synchronizes with; Schedulability;
of procedures shares CPU with; achieving performance goals
excludes through parallelism

15. Decomposition - Information Hiding
• In case if a device such as an aircraft altitude
sensor is likely to be replaced over the life of an
avionics program
• The information-hiding principle makes the details
of interacting with that device the secret of one
module
• Information hiding is enforced by requiring that
modules interact only via a defined set of public
facilities—their interfaces
• Each module provides a set of access procedures

16. Decomposition – Specific goals
• Each module's structure should be simple enough
to be understood fully.
• It should be possible to change the implementation
of one module without knowledge of the
implementation of other modules and without
affecting the behavior of other modules.
• It should be possible to make a major software
change as a set of independent changes to
individual modules

17. Decomposition – module guide
• The documentation of the decomposition structure
is sometimes called a module guide.
• The guide states the criteria used to assign a
particular responsibility to a module
• We arranges the modules in tree structure, So we
can find the necessary information without
searching through unrelated documentation
• The guide does not describe any runtime
relationship among the modules
• The guide does not talk about how modules interact
with each other while the system is executing

18. Achieves Quality Goals
• How the A-7E Module Decomposition Structure
Achieves Quality Goals
Goal How Achieved
Ease of change to: weapons, platform, Information hiding
symbology, input
Understand anticipated changes Formal evaluation procedure to take
advantage of experience of domain
experts (Because a designer might not
have had all of the relevant experience)
Assign work teams so that their Modules structured as a hierarchy;
interactions were minimized each work team assigned to a second-
level module and all of its descendants

19. A-7E Module Decomposition
Structure
• The decomposition tree is described beginning with the
three highest-level modules.
• These are motivated by the observation that changes
tend to come from three areas
▫ Hardware-Hiding Module
Hides the procedures that need to be changed if any part of
the hardware is replaced by a new unit with a different
hardware/software interface but with the same general
capabilities.
▫ Behavior-Hiding Module
Hides procedures that need to be changed if there are
changes in requirements affecting the required behavior.
▫ Software Decision Module
Hides software design decisions that are based on
mathematical theorems, physical facts, and programming
considerations

20. A-7E Module guide
• The module guide goes on to explain how conflicts
among these categories are arbitrated by a
complete and unambiguous requirements
specification
▫ e.g., is a required algorithm part of the behavior
or a software decision?
• The module guide then describes the second-level &
third-level decomposition
• Notice that many of the Device Interface modules
have the same names as Function Driver modules

21. Hardware-Hiding Module Behavior-Hiding Module
Extended Computer Module Function Driving Module
Data Module Air Data Computer Module
Input/Output Module Audible Signal Module
Computer State Module Computer Fail Signal Module
Paralleslism Control Module Doppler Radar Set Module
Program Module Flight Information Display Module
Virtual Memory Module Forward Looking Radar Module
Interrupt Handler Module Head-Up Display Module
Timer Module Inertial Measurement Set Module
Panel Module
Device Interface Module Projected Map Display Set Module
Air Data Computer Module Shipboard Inertial Navigation System Module
Angle of Attack Sensor Module Visual Indicator Module
Audible Signal Device Module
Weapon Release System Module
Computer Fail Device Module Ground Test Module
Doppler Radar Set Module
Flight Information Displays Module
Forward Looking Radar Module Shared Services Module
Head-Up Display Module Mode Dertermination Module
Inertial Measurement Set Module Panel I/O Support Module
Input/Output Representation Module Shared Subroutine Module
Master Function Switch Module Stage Director Module
Panel Module System Value Module
Projected Map Display Set Module
Radar Altimeter Module
Shipboard Inertial Navigation System Module
Slew Control Module
Switch Bank Module
TACAN Module
Visual Indicators Module
Waypoint Information System Module
Weapon Characteristics Module
Weapon Release System Module
Weight on Gear Module

22. Software Decision Module
Application Data Type Module
Numeric Data Type Module
State Transition Event Module
Data Banker Module
Singular Values Module
Complex Event Module
Filter Behavior Module
Physical Models Module
Aircraft Motion Module
Earth Characteristics Module
Human Factors Module
Target Behavior Module
Weapon Behavior Module
Software Utility Module
Power-Up Initialization Module
Numerical Algorithms Module
System Generation Module
System Generation Parameter Module
Support Software Module

23. Uses –Uses Relation
• The concept behind the uses structure is the uses
relation.
• In practice this relation is similar to but not quite
the same as the calls relation.
▫ Procedure A is simply required to call procedure B
in its specification, but the future computation
performed by A will not depend on what B does
• The unit of the uses (or allowed-to-use) structure is
the access procedure.
• In practice all of the procedures of a module may
share usage restrictions. Hence, the name of a
module might appear in the uses structure.

24. Achieves Quality Goals
• How the A-7E Uses Structure Achieves Quality
Goals
Goal How Achieved
Incrementally build and test system Create "is-allowed-to-use" structure for
functions programmers that limits procedures
each can use
Design for platform change Restrict number of procedures that use
platform directly
Produce usage guidance of manageable Where appropriate, define uses to be a
size relationship among modules

25. Excerpt from the A-7E Allowed-to-
Use Specification
Using procedures: A procedure in… .. Is allowed to use any procedure in …
EC: Extended Computer Module None
DI: Device Interface Module EC.DATA, EC.PGM, EC.IO, EC.PAR, AT.NUM,
AT.STE, SU
ADC: Air Data Computer PM.ECM
IMS: Inertial Measurement Set PM.ACM
FD: Function Driver Module EC.DATA, EC.PAR, EC.PGM, AT.NUM, AT.STE,
SU, DB.SS.MODE, DB.SS.PNL.INPUT,
DB.SS.SYSVAL, DB.DI
ADC: Air Data Computer Functions DB.DI.ADC, DI.ADC, FB
IMS: IMS Functions DB.DI.IMS, DI.IMS
PNL: Panel Functions EC.IO, DB.SS.PNL.CONFIG, SS.PNL. FORMAT,
DI.ADC, DI.IMS, DI.PMDS, DI.PNL

26. Excerpt from the A-7E Allowed-to-
Use Specification
Using procedures: A procedure in… .. Is allowed to use any procedure in …
SS: Shared Services Module EC.DATA, EC.PGM, EC.PAR, AT.NUM, AT.STE,
SU
PNL: Panel I/O Support DB.SS.MODE, DB.DI.PNL, DB.DI.SWB,
SS.PNL.CONFIG, DI.PNL
AT: Application Data Type Module EC.DATA, EC.PGM
NUM: Numeric Data Types None additional
STE: State Transition Events EC.PAR

27. Process
• A process is a set of programming steps that are
repeated in response to a triggering event or to a
timing constraint.
• It has its own thread of control, and it can suspend
itself by waiting for an event (usually by invoking
one of the event-signaling programs on a module's
interface).
• The Extended Computer Module presents a virtual
programming interface that features
multiprocessing capabilities , because A-7E
computer is a uniprocessor

28. Process Structures
• The process structure emerged after the other
structures had been designed.
▫ Function Driver procedures were implemented as
processes.
▫ Other processes computed time-consuming
calculations in the background so that a value
would always be available.
• Two kinds of information were captured in the
process structure.
▫ The first documented what procedures were
included in the body of each process.
▫ The second kind of information in the process
structure documented which processes could not
execute simultaneously.

29. Function driver processes structure
Periodic process: do every 40 milliseconds
- Call other modules ‘ access procedures to gather the values of all
relevant inputs
- Calculate the resulting output value
- Call the appropriate Device Interface procedure to send the output
value to the outside world
End periodic process
Demand process
- Await triggering event
- Calculate the resulting output outcome
- Call the appropriate Device Interface procedure to trigger the action
in the outside world
End demand process

30. Achieves Quality Goals
• How the A-7E Process Structure Achieves Quality
Goals
Goal How Achieved
Map input to output Each process implemented as cycle
that samples, inputs, computes, and
presents output
Maintain real-time constraints Identify process through process
structure and then perform offline
scheduling
Provide results of time-consuming Perform calculations in background and
calculations immediately return most recent value when queried

31. Summary
• This chapter described the architecture of a highly
capable avionics system in terms of three related
but quite different structures.
▫ A module decomposition structure describes
design-time relations among its components,
which are implementation units that can be
assigned to teams.
▫ A uses structure describes runtime usage
relations among its components, which are
procedures in modules. From it, a picture of a
layered architecture emerges.
▫ The process structure describes the parallelism of
the system and is the basis for assignment for the
physical hardware