## 5 Model Transformations
### Execution and Implementation of the Model Transformations
In addition to multicasting periodic data among the top-level software components inside the partitions, we observed that lower-level objects inside the top-level software components also used distinct ports to send the same data to multiple objects. The multiple destination sender enhanced connector is also applicable for these cases. ### Case II: Handling Different Configurations

Avinics software projects we studied include requirements for supporting different configurations of devices. An example is using separate communication devices in two different configurations. Version \(A\) of the aircraft uses the communication device \(Com_{1}\), and version \(B\) uses \(Com_{2}\). In this case, the software components which control \(Com_{1}\) and \(Com_{2}\) are designed to use the same interfaces to communicate with other software components. Figure 16: Sampling data produced by a software component sent to multiple destinations. An enhanced connector is used inside Partition A to multicast data. Depending on the project configuration, an intermediate class routes the requests to the active communication device. Figure 17a shows the _Selector_ object in the existing design, which forwards the incoming requests to \(Com_{1}\) or \(Com_{2}\) device accordingly. Figure 17b shows the new design, where we use an enhanced connector that reads the project configuration and forwards the requests to either device. The selector class is replaced with an enhanced connector. If a third device is used in the future, we can modify the connector behavior to handle the change. We encountered the conditional forwarding of requests in another case where two ports with identical required interfaces were connected to two ports of different objects. One of the two objects was for testing purposes, and the other was the live object. The application forwarded the requests to the test object when running in test mode and to the live object when not running in test mode. An enhanced connector can also handle this kind of conditional message routing. ### Case III: Handling Redundant Devices on the Platform

In the projects we examined, some of the cases where multiple ports of the same class required the same interface were designed to handle the redundant devices in the platform. In avionics systems, there are often two devices of the same functionality to minimize the risk of losing critical functions. Having two devices also helps detect sensor errors by comparing readings from both devices. This system design method, known as _dual redundancy_, is used for the devices responsible for critical system functions. Figure 18a shows a typical dual redundant device management scenario in the projects we examined. In the existing design, \(Component_{1}\) is responsible for the device functionalities specific to the avionics software application. Responsibilities of this component can change depending on the avionics software application. On the other hand, \(Component_{2}\) is responsible for the device functionalities only in the scope of the device's capabilities. Responsibilities of \(Component_{2}\) do not change depending on the application, so it can be reused in avionics software applications that require a dual redundant setup of the same device. \(Component_{1}\) includes a device manager software component (\(DeviceMgr\)) which manages a dual redundant device configuration. Additionally, there are two separate objects in \(Component_{1}\) which perform application-specific device management and data transformation tasks for the individual devices (\(Dev_{1}Src\) and \(Dev_{2}Src\)). The data from the devices also follow two separate communication channels towards other software components and partitions. Data sent by \(Dev_{1}Src\) and \(Dev_{2}Src\) arrive at device controllers \(Dev_{1}Dest\) and \(Dev_{2}Dest\) inside \(Component_{2}\). Figure 17: Selector pattern, which forwards requests to different communication devices depending on the project configuration: (**a**) Existing design that uses a dedicated object.