Control Software Design and Safeguarding with the support of UML and CT

This thesis will address the use of the Unified Modeling Language (UML) and Communicating Threads (CT) as a tool for designing control software. Since control systems are concurrent systems, the main focus is to explore the suitability of the concurrency model of UML. The CT-paradigm, developed by Gerald Hilderink, comprehends a special concurrency model for developing real-time software, which allows reasoning about concurrency issues and real-time behavior in an elegant way. Therefore it is interesting to research the integration of the CT-paradigm in UML. As a practical usecase, a safeguard is designed for a mechatronic setup. UML is a third-generation object-oriented modeling language that rigorously defines the semantics of the object metamodel and provides a notation for capturing and communicating of object-structure and behavior. The UML provides tools to model various aspects of software design at a high level of abstraction. This coincides with the CT-paradigm that provides reasoning at a high level of abstraction about real-time and parallel software design. The UML tool Rhapsody is used for developing UML models, including the safeguard design. CT is an object-oriented software package. This package provides a clear way of concurrent programming based on the theory of Communicating Sequential Processes (CSP). With CSP a concurrent system can be described by concurrently running processes that communicate with each other via channels. CTC++ is the implementation of the package in C++. A comparison between UML and CT in terms of data transfer, synchronization and concurrent behavior is made. The comparison shows that in UML concurrency is defined on objects and on their operations. UML uses active ? and passive objects to express concurrency and has no native semantical means to express priorities. Scheduling is thread based and the behavior of applications depends on underlying threading mechanism. CT provides channels to let processes communicate with each other. Channels encapsulate synchronization, concurrent behavior and data transfer. CT has extensive means to express concurrent behavior at a high level of abstraction. CTC++ uses `fair? scheduling and its behavior is independent of a threading mechanism. CTC++ can be successfully used as a package in Rhapsody and the approach to create the CTC++ package is given. Object model diagrams are analyzed for the use of communication diagrams and composition diagrams. The analysis shows that object model diagrams are suited to be used as communication diagrams but are not suited to be used as composition diagrams. A recommendation is given to create a tool, which is basically UML compliant but extended with symbols to express concurrent behavior. Statechart ? and activity diagrams and the implementation mechanism of Rhapsody to create these diagrams are analyzed. An approach about the usage of channels, parallel constructs, and alternative constructs in statecharts is given or suggested. A different implementation mechanism is recommended in order to better integrate CTC++ in statechart ? and activity diagrams. A safeguard based on both UML and CT concepts is designed for a mechatronic setup called JIWY. JIWY is a little tabletop robot with 2 rotational degrees of freedom mounted with a camera. A detailed description of JIWY is given and specifications and requirements for the safeguard are extracted. The safeguard consists out various safeguard monitors, which monitor the mechatronic setup for specific hazards. The behavior of the safeguard monitors is specified in statechart ? and activity diagrams. The object model diagrams depict the communication diagram for the design. The main advantage is that the use of channels in combination with the object model diagram makes the design scalable and testable. The disadvantage is that the object model diagrams become large, a lot of objects, and are difficult to read. A recommendation is given to implement missing features on JIWY so that the safeguard can be tested.