1. Final Presentation [CS554] Designs for Software and Systems Supreme Design Khalil Mezyaoui, Jun Ho Yi Jongmin Lee, Taeju Park

2. www.themegallery.com Contents 1. Business Driver 2. Prioritized Utility Tree 3. Architectural Analysis 4. Conclusion

3. Business Driver

4. www.themegallery.com  Business Driver  Since space craft is expensive, it should not be damaged or broken.  Since space craft is usually operating in harsh environment, faults can be easily occurred.  Even small failure of space craft have high probability of leading catastrophe.  Business Goal -> protecting faults in a space craft. Fault Fault Protection System Space Craft Business Driver

5. www.themegallery.com  Business Constraints  This business area require huge amount of developing cost and unexpected developing period. So, it is difficult to manage exact schedule and cost.  Technical Constraints  FPS always interoperates with space craft system.  FPS operates on Space Craft Operating System (SCOS).  Quality Attribute Desired  Reliability  Efficiency  Security Business Driver

6. Prioritized Utility Tree

7. www.themegallery.com Prioritized Utility Tree Quality Attribute FactorPriorityScenario EfficiencyE1: Time Behavior (H, H) E1.1 : If space craft sends parameters, then the FPS should respond to space craft within specific time. (Ex : 1sec) (M, L) E1.2 : FDIR should process detection, isolation, recovery for faults within specific time. (H, H) E1.3 : If there are faults in given parameter, then all functions related to the faults are stopped by FPS. Then, stopped critical function should be resumed as fast as possible. Reliability R1: Recoverability(H, M) R1.1 : Even if faults occur, critical functions should be resumed as soon as possible. R2 : Operation (H, M) R2.1 : Fault in individual device should be restored by using recovery and isolation method for individual device level. Fault in function, subsystem, system control should be also restored by using corresponding mechanism. (M, L) R2.2 : FPS can be controlled by giving commands at any time.

8. www.themegallery.com Prioritized Utility Tree Quality Attribute FactorPriorityScenario Security S1 : Authorization(M, L) S1.1 : When users try to access FPS, authentication function c hecks level of authorization of the user. According to the level of authorization, provided works are limited. S2 : Encryption (L, M) S2.1 : When information is saved into database server or loade d from database server, the information is encrypted by using SHA algorithm and decrypted by using public key. (H, M) S2.2 : Communication messages between base station (Earth) and space craft are encrypted/decrypted before sending messa ges. Maintainability M1 : Changeability (M, H) M1.1 : User can modify range of parameters safely. Modified range of parameters will be adapted to the FPS immediately. S ynchronization should be considered. (M, L) M1.2 : FPS should adapt any device’s edition/deletion in a spa ce craft system. M2 : Testability(M, M) M2.1 : Devices for detection, isolation, recovery in FDIR sho uld be testable and if a device don’t operate well, we should e asily find the reasons.

9. www.themegallery.com Prioritized Utility Tree Quality Attribute FactorPriorityScenario UsabilityU1 : Observation(M, M) U1.1 : Status of FPS can be observed by showing it through display at any time. PortabilityP1 : Adaptability (L, H) P1.1 : FPS should be portable for other space craft system. (M, H) P1.2 : We should be able to easily modifying FPS modules; if ever we change a module system should adapt the new modul e without affecting the other modules.

10. Analysis of Architecture : Overall System

11. www.themegallery.com Analysis of Architectures  Efficiency Scenario E1.1If space craft sends parameters, then the FPS should respond to space craft within spec ific time. (Ex : 1sec) AttributeEfficiency EnvironmentNormal Operation StimulusReceive out of range parameters ResponseThe FDIR detects faults. The FPS informs the fact to space craft within specific time. (Ex : 1sec) R 1 : Server may be overloaded by requests of many clients. In this case, response time will be delayed.

12. www.themegallery.com Analysis of Architectures  Efficiency Scenario E1.1If space craft sends parameters, then the FPS should respond to space craft within spec ific time. (Ex : 1sec) AttributeEfficiency EnvironmentNormal Operation StimulusReceive out of range parameters ResponseThe FDIR detects faults. The FPS informs the fact to space craft within specific time. (Ex : 1sec) S 1 : Since server - client model is centralized model, it means that all communication should pass server at least once. It may take long time. S 2 : Since peer - to - peer communication is done directly between peers. So, we can expect that the communication latency is short.

13. www.themegallery.com Analysis of Architectures  Efficiency Scenario E1.1If space craft sends parameters, then the FPS should respond to space craft within spec ific time. (Ex : 1sec) AttributeEfficiency EnvironmentNormal Operation StimulusReceive out of range parameters ResponseThe FDIR detects faults. The FPS informs the fact to space craft within specific time. (Ex : 1sec) T 2 : Efficiency (-), Portability (-) vs Security (+) : Client - style is not good at efficiency quality attribute because as mentioned S 1. However, using server - client model increases security quality attribute because server can authenticate and authorize all clients ’ request. T 3 : Efficiency (+), Portability (+) vs Security (-) : Peer - to - peer model is good at efficiency quality attribute as mentioned S 2. It also increases portability because if one peer is disconnected by problem, it can ’ t affect transaction between other peers. However, it decreases security because it need to manage separated authentication for each communication.

14. www.themegallery.com Analysis of Architectures  Efficiency Scenario E1.1If space craft sends parameters, then the FPS should respond to space craft within spec ific time. (Ex : 1sec) AttributeEfficiency EnvironmentNormal Operation StimulusReceive out of range parameters ResponseThe FDIR detects faults. The FPS informs the fact to space craft within specific time. (Ex : 1sec) Reasoning  Client - server architectural style is bad candidate in terms of efficiency because of S 1, R 7.  Peer - to - peer architectural style is good candidate in terms of efficiency because of S 2.

15. www.themegallery.com Analysis of Architectures  Security Scenario S2.2S2.2 : Communication messages between base station (Earth) and space craft are encr ypted/decrypted before sending messages. AttributeSecurity EnvironmentNormal Operation StimulusSending message between base station and space craft ResponseMessages become encrypted or decrypted. S 3 : In client - server model, server can handle messages between terminals. So, it can find illegal message and abolish it. It hence security of system. S 4 : Since peer - to - peer communication is done directly between peers. Detecting illegal message like hacking transaction is hard and blocking it is also difficult. So, there is possibility that it makes significant problem.

16. www.themegallery.com Analysis of Architectures  Security Scenario S2.2S2.2 : Communication messages between base station (Earth) and space craft are encr ypted/decrypted before sending messages. AttributeSecurity EnvironmentNormal Operation StimulusSending message between base station and space craft ResponseMessages become encrypted or decrypted. T 4 : Security (+) vs Reliability (-) : Client - server model is good at security quality attribute because of S 3. However it decreases reliability quality attribute. Since all the communications must pass through the server, a process can ’ t succeed within deadline when the server is overloaded. T 5 : Security (-) vs Reliability (+) : Peer - to - peer model decrease security quality attribute because of S 4. However it increases reliability because it can avoid a problem in T 1 by direct communication.

17. www.themegallery.com Analysis of Architectures  Architectural Decision for Overall System

18. www.themegallery.com Analysis of Architectures  Architectural Decision for Overall System Supreme Design System Legend Peer Link Fault Protect System Space Craft Staff DBDisplay

19. Analysis of Architecture : FPS

20. www.themegallery.com Analysis of Architectures  Efficiency Scenario E1.2FDIR should process detection, isolation, recovery for faults within specific time. AttributeEfficiency EnvironmentNormal Operation StimulusInput through interface ResponseFault detection, isolation, recovery result R 1 : The call - return style needs exception handling. Since, we don ’ t know what kind of exceptions will occur, the call - return style should provide exception handling for any kinds of exceptions. R 3 : When the buffer is full in the pipe and filter style, operation can ’ t proceeds the next step. So, predicting completion time is difficult. R 5 : It is hard to define appropriate layers of total processes in FPS because function of each layer should be separated. Separating each layer from this point is very hard.

21. www.themegallery.com Analysis of Architectures  Efficiency Scenario E1.2FDIR should process detection, isolation, recovery for faults within specific time. AttributeEfficiency EnvironmentNormal Operation StimulusInput through interface ResponseFault detection, isolation, recovery result S 1 : Call - return style decreases efficiency of FIDR. Suppose there are several faults in parameters. If the detection device detects one fault of them, then it calls recovery or isolation device. Hence, the other faults can ’ t be detected until the first fault recovery operation is finished. S 2 : Each layer handles own level of faults. So, managing each faults is not required to much time than managing all types of faults. This makes efficiency good.

22. www.themegallery.com Analysis of Architectures  Efficiency Scenario E1.2FDIR should process detection, isolation, recovery for faults within specific time. AttributeEfficiency EnvironmentNormal Operation StimulusInput through interface ResponseFault detection, isolation, recovery result T 1 : Portability (+) vs Efficiency (-) : Call - return style increases adaptability in portability quality attribute because each module can be revised without modifying interface between modules. However, it decreases efficiency because one module should wait until callee module is finished.

23. www.themegallery.com Analysis of Architectures  Efficiency Scenario E1.2FDIR should process detection, isolation, recovery for faults within specific time. AttributeEfficiency EnvironmentNormal Operation StimulusInput through interface ResponseFault detection, isolation, recovery result Reasoning  The call - return style is not good candidate because it makes efficiency worse as mentioned S 1.  Pipe and filter style doesn ’ t significantly affect on efficiency quality attribute.  Layered style is good candidate because it improves efficiency as mentioned S 2.

24. www.themegallery.com Analysis of Architectures  Reliability Scenario R2.1Fault in individual device should be restored by using recovery and isolation method f or individual device level. Fault in function, subsystem, system control should be also restored by using corresponding mechanism. AttributeReliability EnvironmentNormal Operation StimulusSet of faults ResponseEach fault should be processed using fitted detection, isolation, recovery method. S 3 : Pipe and filter style decreases operation of reliability because detection, isolation and recovery is one of filter in the style. So, all the faults are dealt with in a filter. From this point, a fault can be processed with higher level processing mechanism. It leads to increase probability that the fault un - related function stop. S 4 : Because each layer in the layered style deals faults which are corresponded that level, functions in a layer will not be affected by faults in other level.

25. www.themegallery.com Analysis of Architectures  Reliability Scenario R2.1Fault in individual device should be restored by using recovery and isolation method f or individual device level. Fault in function, subsystem, system control should be also restored by using corresponding mechanism. AttributeReliability EnvironmentNormal Operation StimulusSet of faults ResponseEach fault should be processed using fitted detection, isolation, recovery method. Reasoning  Call - return doesn ’ t significantly affect on reliability quality attribute.  Pipe and filter style decreases the operation in reliability because of S 3. It also decreases efficiency because it process with all methods for detection, isolation, recovery for a faults.  Layered style is good candidate because it improves reliability as mentioned S 4. 

26. www.themegallery.com Analysis of Architectures  Architectural Decision for FPS

27. www.themegallery.com Analysis of Architectures  Architectural Decision for FPS Manual FDIR System Control Sub System Function Individual Device FDIR Control Mode

28. Conclusion

29. www.themegallery.com Conclusion  Advantages of ATAM Since the architectural decisions affects the performance of systems, predicting the architecture’s performance in early is important to save time, costs, and efforts. Even we didn’t work with stakeholders in this project, it seems that the true requirements of stakeholders will be adapted to the system well because the ATAM forces related people to participate in the steps. Since the results of the ATAM is formed as documentation, it is easy to make the project outputs to documentations.

30. www.themegallery.com Conclusion  Weak points of the ATAM It was hard to adapted the ATAM in our projects, since the ATAM is not familiar with us at the first. Judgement of architectural decision is highly depends on the experience of the participants. To supplement this decision may require additional methods. Since the ATAM forces related people to participate, it may be hard to meet frequently. ATAM doesn’t support architectural style decision.

31. Any Questions?