Instead, we rely on the fact that the temperature
in this system cannot change too rapidly. We require that each temperature
sample be close to the previous sample. If a sample differs from the previous sample
34 Why We Need Model-Based Analysis
by more than a particular tolerance, then the sensor is considered to be faulty and
no more samples are requested. Instead, the control program commands the sensor
to reset. If the sensor responds by sending back an acceptable temperature that is
close to the last good sample, the sensor is considered to be working correctly again
and the control program resumes polling.
The control program must not compute a calibration factor with a temperature
sample that is considered erroneous, because that would result in controlling the
process with an incorrect calibration factor, which could have serious consequences.
We have a safety requirement which stipulates that the controller must not do
anything bad: the program must not compute a calibration factor with an erroneous
temperature sample. We also have a liveness requirement which stipulates that the
controller must do something good: the controller must respond to a command
by calculating the calibration factor (except where this would violate the safety
requirement).
3.2 Implementation
Our control program uses a typical strategy for implementing reactive programs
(Figures 3.
Pages:
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71