1. 28 August 2003 Object Orientation modelling with UML and HRT-UML Case study: AOCS Framework Martin JEAN-BAPTISTE End of studies training period Software Engineering and Standardisation Section

2. Martin JEAN-BAPTISTE, TOS-EME 2 28 August 2003 AOCS Object Oriented modelling Contents Introduction and motivations Design principles of the AOCS Framework UML model of the java version of the AOCS Framework Instantiation of the java AOCS Framework Introduction to the HRT-UML toolset Issue in applying HRT-UML to the AOCS Framework Conclusion

3. Martin JEAN-BAPTISTE, TOS-EME 3 28 August 2003 AOCS Object Oriented modelling Introduction and motivations Satellite systems become increasingly software intensive A need for cost and planning reduction in the lifecycle of software development Object Orientation: a way to increase reusability but a customisation is necessary for space applications Mission criticality of space on-board software has led ESA and the European aerospace community to define their own software design methodology: HRT-HOOD HRT-UML: a mapping from HRT-HOOD onto UML by preserving the significant real-time process of the former and importing Object Oriented flexible features of the latter

4. Martin JEAN-BAPTISTE, TOS-EME 4 28 August 2003 AOCS Object Oriented modelling Contents Introduction and motivation Design principles of the AOCS Framework UML model of the java version of the AOCS Framework Instantiation of the java AOCS Framework Introduction to the HRT-UML toolset Issue in applying HRT-UML to the AOCS Framework Conclusion

5. Martin JEAN-BAPTISTE, TOS-EME 5 28 August 2003 AOCS Object Oriented modelling Design Principles of the AOCS Framework Truly object-oriented methodology Truly object-oriented methodology : the emphasis is put on abstract interfaces. Interaction between components is always performed through the interfaces, never through the concrete classes implementing them. Use of Design Patterns: Use of Design Patterns: optimised reusable architectural solutions Multiple inheritance Multiple inheritance : adapted for mission-critical applications - only single inheritance of implementation - multiple inheritance of interface A component-based framework A component-based framework : to allow inter-operability across language, compiler, process, and processor barriers. Behaviour adaptation in the framework instantiation process: Behaviour adaptation in the framework instantiation process: - Inheritance for static behaviour adaptation - Object composition for dynamic behaviour adaptation

6. Martin JEAN-BAPTISTE, TOS-EME 6 28 August 2003 AOCS Object Oriented modelling Design Principles of the AOCS Framework Typical AOCS software functionalities Attitude control function Orbit control function Telecommand Processing Telemetry Processing Failure Detection and Isolation Failure Recovery Reconfigurations Manoeuvre Execution

7. Martin JEAN-BAPTISTE, TOS-EME 7 28 August 2003 AOCS Object Oriented modelling Design Principles of the AOCS Framework The manager Meta-pattern Real-Time Operating System model An abstract interface capturing the behavioral signature of the functionality An functionality manager component (a core component) maintaining a list of objects seen as instances of the functionality interface Default implementations of the functionality interface (default components) Applying this model to most of the functionalities of the AOCS Framework

8. Martin JEAN-BAPTISTE, TOS-EME 8 28 August 2003 AOCS Object Oriented modelling Contents Introduction and motivation Design principles of the AOCS Framework UML model of the java version of the AOCS Framework Instantiation of the java AOCS Framework Introduction to the HRT-UML toolset Issue in applying HRT-UML to the AOCS Framework Conclusion

9. Martin JEAN-BAPTISTE, TOS-EME 9 28 August 2003 AOCS Object Oriented modelling UML model of the Java AOCS Framework Rationale for porting the AOCS Framework to Java Rationale for porting the AOCS Framework to Java –It has a built-in support for multitasking –It has an associated component model: the Java Beans –To evaluate Java for space application: Java is currently unsuitable for space applications due to the overhead of interpretation –Its wide user base leads to low costs UML Model design process UML Model design process –Names of classes, methods and operations obtained by reverse engineering –Class diagrams: to show inheritance and dependencies between classes as well as interfaces implementation –Sequence diagrams: to model relevant functions used during initialisation and operational phases –State diagrams: manoeuvre state machine and mode transitions

10. Martin JEAN-BAPTISTE, TOS-EME 10 28 August 2003 AOCS Object Oriented modelling Mode Change Actions Telecommands Unit commands Object Monitoring Units Sequential Data Processing Manoeuvres Recovery Actions Recovery Strategies Mode Managers Functionalities Managers Object Lists AOCS Events AOCS Data UML model of the Java AOCS Framework Unit trigger strategy

11. Martin JEAN-BAPTISTE, TOS-EME 11 28 August 2003 AOCS Object Oriented modelling Basic classes Ability to fire failure and configuration events to their event listeners Management of event listeners lists Inherited from interface telemetrable Inherited from interface configurable Inherited from interface resetable Return current time an cycle provided by the Aocs clock plug-in object Plug-in of the system manager Retrieve event listeners lists Internal services (protected methods ) External services (public interfaces) Plug-in of a destruction recovery action SystemManager Constructor: register with system manager by a call to the method internalAddAocsObject() of class SystemManager. Set telemetry image length, and reset state by a call to methods localReset() and localResetConfiguration(). Unload all static plug-in objects and all registered listeners

12. Martin JEAN-BAPTISTE, TOS-EME 12 28 August 2003 AOCS Object Oriented modelling UML model of the Java AOCS Framework Component communication

13. Martin JEAN-BAPTISTE, TOS-EME 13 28 August 2003 AOCS Object Oriented modelling UML model of the Java AOCS Framework Component communication Example of failure event creation Event mechanism is compatible with the Java Beans event model to ensure that the framework events can be manipulated by standard beanbox environment. However Java applications typically create a new event dynamically before firing it, this is not allowed in the framework. The adopted model is as follows.

14. Martin JEAN-BAPTISTE, TOS-EME 14 28 August 2003 AOCS Object Oriented modelling UML model of the Java AOCS Framework Controller management Instantiation of the controller design pattern

15. Martin JEAN-BAPTISTE, TOS-EME 15 28 August 2003 AOCS Object Oriented modelling UML model of the Java AOCS Framework Failure detection management Instantiation of the failure detection design pattern

16. Martin JEAN-BAPTISTE, TOS-EME 16 28 August 2003 AOCS Object Oriented modelling UML model of the Java AOCS Framework Failure recovery management Instantiation of the failure recovery design pattern

17. Martin JEAN-BAPTISTE, TOS-EME 17 28 August 2003 AOCS Object Oriented modelling System management Instantiation of the system management design pattern for the system reset function UML model of the Java AOCS Framework

18. Martin JEAN-BAPTISTE, TOS-EME 18 28 August 2003 AOCS Object Oriented modelling System management Instantiation of the system management design pattern for the system configuration check function UML model of the Java AOCS Framework

19. Martin JEAN-BAPTISTE, TOS-EME 19 28 August 2003 AOCS Object Oriented modelling Telecommand management UML model of the Java AOCS Framework Instantiation of the command management design pattern

20. Martin JEAN-BAPTISTE, TOS-EME 20 28 August 2003 AOCS Object Oriented modelling Telemetry management UML model of the Java AOCS Framework Instantiation of the telemetry management design pattern

21. Martin JEAN-BAPTISTE, TOS-EME 21 28 August 2003 AOCS Object Oriented modelling Contents Introduction and motivation Design principles of the AOCS Framework UML model of the java version of the AOCS Framework Instantiation of the java AOCS Framework Introduction to the HRT-UML toolset Issue in applying HRT-UML to the AOCS Framework Conclusion

22. Martin JEAN-BAPTISTE, TOS-EME 22 28 August 2003 AOCS Object Oriented modelling Automated Framework Instantiation (AFI) project Instantiation of the Java AOCS Framework Application Model / Spec Component Composition Env. Formal Comp. Description Framework Components Formal Configuration Desc. Application Code Encoding Process Code Generation Process Item covered by the AOCS f/w project Items covered by the AFI project Standard Bean Composition Tool XML-Based XSLT Program

23. Martin JEAN-BAPTISTE, TOS-EME 23 28 August 2003 AOCS Object Oriented modelling Automated Framework Instantiation project Instantiation of the Java AOCS Framework Application is component-based, a component is characterized only by its external interface   only the externally visible characteristics of the components need to be modelled Only application instantiation process is of interest   only the characteristics of the components that are relevant to the instantiation process need to be modelled visual proxy component To each fw component a visual proxy component is associated that is a visualizable Java Beans. They can be manipulated in a bean composition environment that models the instantiation-relevant part of the fw component. Users perform the instantiation process in the On-Board Software (OBS) Bean Builder upon the visual proxy beans and their instantiation actions are later transposed to the fw components to create the final application

24. Martin JEAN-BAPTISTE, TOS-EME 24 28 August 2003 AOCS Object Oriented modelling Automated Framework Instantiation: OBS Bean Builder composition environment Instantiation of the Java AOCS Framework

25. Martin JEAN-BAPTISTE, TOS-EME 25 28 August 2003 AOCS Object Oriented modelling Contents Introduction and motivation Design principles of the AOCS Framework UML model of the java version of the AOCS Framework Instantiation of the java AOCS Framework Introduction to the HRT-UML toolset Issue in applying HRT-UML to the AOCS Framework Conclusion

26. Martin JEAN-BAPTISTE, TOS-EME 26 28 August 2003 AOCS Object Oriented modelling Introduction to the HRT-UML toolset HOOD and HRT-HOOD HOOD provided and required interfaces HOOD objects have provided and required interfaces and are internally structured as a set of co-operating child objects activepassive Object Description Skeleton(ODS) HOOD objects may be active or passive and have a structural textual description, called Object Description Skeleton (ODS) which defines the meta-model of the method HRT-HOOD (based on HOOD 3.1) cyclicsporadic HRT-HOOD broke the concept of active object into cyclic and sporadic objects protected Introduction of protected object to permit controlled sharing of resources real-time attributes Improvement of the HOOD ODS to permit the expression of the real-time attributes (e.g. period, deadline, priority, worst-case execution time )   HRT-HOOD is now an industrially-applied method because it provides a design freedom for structural conformance to rigorously-defined computational model (like Ada Ravenscar profile) from analysis throughout to coding.

27. Martin JEAN-BAPTISTE, TOS-EME 27 28 August 2003 AOCS Object Oriented modelling Introduction to the HRT-UML toolset Mapping HRT-HOOD to UML Inversion of the Object-Oriented development paradigm in HRT-UML system Normal OO development HRT-UML developmentSingleton HRT-HOOD Class modelmain constructive model background concept Isomorphic Object modelanalysis aidmain constructive model underlying class prototype instance The underlying class model in HRT-UML enables multiple static instantiation at design time by cloning the structure defined by a prototype instance descriptor Any HRT-UML object carries a descriptor, a pair comprised of: - - Underlying class: describes abstract properties of objects of that class (e.g. HRT type, provided operation type, required attributes ) - - Prototype instance: describes the internal topology of the object placeholder object The concept of placeholder object is introduced to specify the required interface to be satisfied when a new instance is created

28. Martin JEAN-BAPTISTE, TOS-EME 28 28 August 2003 AOCS Object Oriented modelling Introduction to the HRT-UML toolset HRT-UML toolset

29. Martin JEAN-BAPTISTE, TOS-EME 29 28 August 2003 AOCS Object Oriented modelling Contents Introduction and motivation Design principles of the AOCS Framework UML model of the java version of the AOCS Framework Instantiation of the java AOCS Framework Introduction to the HRT-UML toolset Issue in applying HRT-UML to the AOCS Framework Conclusion

30. Martin JEAN-BAPTISTE, TOS-EME 30 28 August 2003 AOCS Object Oriented modelling Applying HRT-UML to the AOCS Framework Recasting AOCS objects into the objects types allowed by HRT-UML (see picture on next slide) In an typical instantiation active components are scheduled in accordance with a cyclical policy, except for the TelecommandLoader irregularly awakened by the arrival of a new telecommand, thus: HActive including an HCyclic – Objects implementing interface ActiveObject in the Java release of the framework should be mapped to HActive including an HCyclic child object in the HRT-UML model HActive including an HSporadic – Except the TelecommandLoader that should be mapped to HActive including an HSporadic child object in the HRT-UML model HProtected Passive objects (objects not implementing interface ActiveObjects) should be mapped to HProtected objects because the operations they expose can be called by any component from any thread during concurrent execution.

31. Martin JEAN-BAPTISTE, TOS-EME 31 28 August 2003 AOCS Object Oriented modelling Applying HRT-UML to the AOCS Framework Main object model diagram

32. Martin JEAN-BAPTISTE, TOS-EME 32 28 August 2003 AOCS Object Oriented modelling Applying HRT-UML to the AOCS Framework Public methods of the java class of an active manager are declared in the provided interface of the Active object in HRT-UML Protected and private methods are only accessible by child objects inside the parent Active object Methods marked “synchronised” (methods used during operational phase in multi-threading) in the java class are stereotyped HSER (Highly Synchronous Execution Request) in the active object and delegated to a PSER (Protected Synchronous Execution Request) operation in an internal protected object Methods not marked “synchronised” (methods used during initialisation phase) are stereotyped ASER (ASynchronous Execution Request) in the active object and delegated to PAER (Protected Asynchronous Execution Request) operation in an internal protected object Mapping the methods from a Java class to the HRT-UML operations (see example of the failure detection manager further)

33. Martin JEAN-BAPTISTE, TOS-EME 33 28 August 2003 AOCS Object Oriented modelling Applying HRT-UML to the AOCS Framework As any active manager, the failure detection manager owns a protected child object (named NameOfTheManagerProt), a kind of constructor for the manager where its specific operations are delegated Services common to all active managers as configuration error reporting, failure reporting, telemetry, reset and configuration are represented by instances of the corresponding classes  Due to the multiple static instantiation The cyclic behaviour of the manager is represented by an HCyclic object which thread action performs the task of the method runOneCycle() of the java program Some of the objects used by the cyclic object are child objects of the manager because it is composed by them (in the sense of the composition relationship defined by UML), it means that the manager’s class owns one attribute of the corresponding type for each of them. The others are defined in the object’s environment and could eventually be included in another object. Internal topology of an active manager (see example of the failure detection manager on next slide)

34. Martin JEAN-BAPTISTE, TOS-EME 34 28 August 2003 AOCS Object Oriented modelling Separate diagram of the failure detection manager

35. Martin JEAN-BAPTISTE, TOS-EME 35 28 August 2003 AOCS Object Oriented modelling Applying HRT-UML to the AOCS Framework Details about the concept of placeholder object When new instances are created a placeholder item shows explicitly the relationships to be satisfied Use relations in the main object model Used objects appear in the active manager environment of the separate diagram

36. Martin JEAN-BAPTISTE, TOS-EME 36 28 August 2003 AOCS Object Oriented modelling Conclusion The AOCS Framework Project adopts a truly object-oriented methodology which puts the emphasis not on objects but on abstract interfaces.object-oriented The term object-oriented design as used in the space sector (e.g. HRT- HOOD) often refers to systems that are more properly called object-based.object-based Currently HRT-UML design methodology is more object-based rather than object-oriented. Thus, delegation of responsibility is not possible and reusability less easy. But system complexity is always handled through hierarchical object decomposition. Improvements foreseen for the future release of HRT-UML Accepting UML interfaces Accepting inheritance in a controlled way Fiting the Ravenscar Profile Improving hierarchical modelling through packages and subsystems A very promising object-oriented tool combining component reusability and a computational model adapted to the design of hard real-time systems