Here the controller
is built up from events and handlers that communicate through variables and the
timer. The design is expressed by the guard expressions that test the variables to
determine which handler to run, and the statements in the handlers that assign these
variables and start or cancel the timer. Each failure results from tests or assignments
that do not produce the intended behaviors, when combined with the other tests and
assignments in the program. All the tests and assignments cooperate to produce the
behaviors, and it is necessary to consider them all to understand the failures.
All of the failures shown in Section 3.4 can be understood in this way. The
CommandWhenWaiting run fails because no handler for the Command event is enabled
when the controller is waiting for a message. The OutOfRangeMessageWhenIdle run
fails because no handler for the Message event is enabled when the controller is
waiting for a time-out. The LostMessageWhenIdle run reaches a deadlocks after
a message is lost because no handler for the Timeout event is enabled when the
controller is waiting for a message and the sensor is considered erroneous, and
no preceding handler requested another message or scheduled another time-out.
The InitialOutOfRangeMessage run cycles endlessly because none of the enabled
handlers can make progress by assigning the sensor status to OK.
Pages:
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85