FW Profile - C1 Implementation
Demo Application

The Demo Application demonstrates the use of the C1 Implementation by implementing a simplified but realistic monitoring system for a Hardware Device.

The Demo Application consists of several components as described in the table:

Component Description Files
Hardware Device Implements the state machine which models the Hardware Device. FwDaHwDev.h, FwDaHwDev.c
FD Check Implements the base state machine which models a generic Failure Detection (FD) Check. FwDaFDCheck.h, FwDaFDCheck.c
Temperature FD Check Implements the derived state machine which models the FD Check on the temperature of the Hardware Device. FwDaTempCheck.h, FwDaTempCheck.c
Current FD Check Implements the derived state machine which models the FD Check on the current absorbed by the Hardware Device. FwDaCurCheck.h, FwDaCurCheck.c
Delta FD Check Implements the derived state machine which models the FD Check on the change in temperature and current of the Hardware Device. FwDaDeltaCheck.h, FwDaDeltaCheck.c
Current Recovery Action Implements the procedure which models the recovery action for the Current FD Check on current absorbed by the Hardware Device. FwDaCurRecAction.h, FwDaCurRecAction.c
Temperature Recovery Action Implements the procedure which models the recovery action for the Temperature FD Check on the temperature of the Hardware Device. FwDaTempRecAction.h, FwDaTempRecAction.c

Hardware Device

The Hardware Device can be either ON or OFF. When it is ON, it can be either in STANDBY or it can be OPERATIONAL. When it is ON, the Hardware Device periodically collects and makes available a measurement of its temperature and of the current it absorbs. The Demo Application models the measurement process as the generation of random number with a uniform distribution within an interval representing the minimum and maximum temperature/current.

The Demo Application models the Hardware Device as a state machine as in the figure. The outer state machine models the ON/OFF behaviour of the device. The state machine embedded in state ON models the STANDBY/OPERATIONAL behaviour. The model of the Hardware Device is implemented in module FwDaHwDev.h.

HwDev.png

Failure Detection (FD) Checks

The Demo Application monitors the Hardware Device through three Failure Detection (FD) Checks. Each FD Check implements an Anomaly Detection Check which periodically monitors one particular aspect of the behaviour of the Hardware Device. The Anomaly Detection Check detects non-nominal behaviour of the Hardware Device. A call to the Anomaly Detection Check has one of two outcomes: "no anomaly detected" or "anomaly detected".

An FD Check can be ENABLED or DISABLED. When it is disabled, it does not perform any monitoring action. When it is enabled, an FD Check can be in one of three states: HEALTHY, SUSPECTED or FAILED:

  • The FD Check is in state HEALTHY if the Anomaly Detection Check has not detected any anomaly in the Hardware Device.
  • The FD Check enters state SUSPECTED when the Anomaly Detection Check has detected an anomaly.
  • The FD Check enters state FAILED when the Anomaly Detection Check has detected an anomaly for more than a predefined number of consecutive activation cycles.

When the FD Check enters state FAILED, it executes a Recovery Action.

The logic of an FD Check is modelled through the state machine shown in the figure. The model of the FD Check is implemented in module FwDaFailDetCheck.h.

FailDetCheck.png

FD Checks for Hardware Device

The Demo Application implements three concrete FD Checks which specialize the generic FD Check shown in the figure:

  • The Temperature FD Check monitors the temperature of the Hardware Device: it declares an anomaly if the temperature exceeds a predefined threshold.
  • The Current FD Check monitors the current absorbed by the Hardware Device: it declares an anomaly if the absorbed current exceeds a predefined threshold.
  • The Delta FD Check monitors the continuity of temperature and current measurements: it declares an anomaly if either the temperature or the current measurement changes ("jumps") by more than a predefined threshold.

For each FD Check, a State Machine is defined which is derived from the generic FD Check State Machine. The resulting state machine hierarchy is shown in the figure.

FdCheckSm.png

FD Recovery Actions for Hardware Device

When a FD Check finds a failure, it executes a Recovery Action. The recovery action for the three FD Checks are as follows:

  • Temperature FD Check: the recovery action consists in starting a procedure (the Temperature Recovery Action) which first commands the HW Device into STANDBY and then, after waiting for some time, it schecks its temperature. If the temperature is found to be too high, the device is switched off. Othersise, it is commanded back OPERATIONAL.
  • Current FD Check: the recovery action consists in starting a procedure (the Current Recovery Action) which first commands the HW Device into STANDBY and then, after waiting for some time, switches it off.
  • Delta FD Check: the recovery action consists in switching off the Hardware Device.

FD Demo Application Main Program

The Demo Application runs cyclically and in each cycle it executes the three FD Checks. The main program for the Demo Application is in file FwDaMain.c.

P&P Software GmbH, Copyright 2011, All Rights Reserved