European Component Oriented Architecture (ECOA ) Collaboration Programme: Architecture Specification Part 3: Mechanisms

Transcription

1 Eurpean Cmpnent Oriented Architecture (ECOA ) Cllabratin Prgramme: Architecture Specificatin Part 3: Mechanisms BAE Ref N: IAWG-ECOA-TR-007 Dassault Ref N: DGT E Issue: 5 Prepared by BAE Systems (Operatins) Limited and Dassault Aviatin This specificatin is develped by BAE SYSTEMS, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés. AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE SYSTEMS, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés. AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. Nte: This specificatin represents the utput f a research prgramme and cntains mature high-level cncepts, thugh lw-level mechanisms and interfaces remain under develpment and are subject t change. This versin f dcumentatin is recmmended as apprpriate fr limited lab-based evaluatin nly. Prduct develpment shuld rely n the DefStan r BNAE publicatins f the ECOA standard. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 i

2 Cntents 0 Intrductin vi 1 Scpe 1 2 Warning 1 3 Nrmative References 1 4 Definitins 2 5 Abbreviatins 2 6 ECOA Mechanisms 3 7 Interactins Mdule Interactins Timestamping Mdule Instance Queues Event Event Sent by Prvider Event Received by Prvider Request Respnse Synchrnus Request Asynchrnus Request Respnse Versined Data Publicatin Ntifying Versined Data Trigger Dynamic Trigger Dynamic Trigger Operatins Interactins within Cmpnents Assembly, Cmpnent and Mdule Prperties Persistent Infrmatin Private PINFO Private PINFO Attributes Public PINFO Public PINFO Attributes PINFO rganizatin PINFO API Driver Cmpnents 23 8 ECOA System Management Lifecycle 26 This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 ii

3 8.1.1 Mdule Startup Supervisin Mdule Startup Nn-Supervisin Mdule Startup Mdule Run-time Behaviur Mdule Shutdwn Mdule Runtime Lifecycle Example Health Mnitring Fault Handling Errr Categrizatin Errr Prpagatin and Recvery Actins Applicatin Errrs Prpagatin and Recvery Actins Infrastructure Errrs prpagatin and Recvery Actins Operatins and faults Mdule Cntext 40 9 Scheduling Scheduling Plicy Activating and nn-activating Mdule Operatins Service Availability Initialisatin Assembly Schema Service Links and Ranks Dynamic Service Availability Service Link Behaviur Intrductin Active Prvider Cmpnent Summary f Behaviur Examples Mdule Operatin Link Behaviur Utilities Inter Platfrm Interactins Cmpsites 54 Figures Figure 1 ECOA Interactins - Key 4 Figure 2 Event Sent by Prvider 6 Figure 3 Event Received by Prvider 7 This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 iii

4 Figure 4 Synchrnus Client Request-Respnse 8 Figure 5 Asynchrnus Client Request-Respnse 9 Figure 6 Deferred Respnse Server Request-Respnse 10 Figure 7 Versined Data Behaviur 12 Figure 8 Ntifying Versined Data Behaviur 13 Figure 9 Trigger Behaviur 14 Figure 10 Dynamic Trigger Behaviur 15 Figure 11 Interactins within Cmpnents Synchrnus Request-Respnse 16 Figure 12 Aspects f PINFO 18 Figure 13 PINFO rganizatin prir t deplyment 20 Figure 14 Fcus n Private PINFO rganizatin befre and after deplyment 21 Figure 15 PINFO API 22 Figure 16 Driver Cmpnent Example Interactin with Bespke APIs 24 Figure 17 Driver Cmpnent Example External Asynchrnus Interactin 25 Figure 18 Mdule Runtime Lifecycle 26 Figure 19 Lifecycle Example 29 Figure 20 Prpagatin path f nn-fatal applicatin errr 31 Figure 21 Prpagatin path f fatal applicatin errrs 32 Figure 22 Prpagatin path f infrastructure errrs 33 Figure 23 Errr prpagatin path 34 Figure 24 Event faults prpagatin behaviur 35 Figure 25 Request-Respnse faults prpagatin behaviur part 1 36 Figure 26 Request-Respnse faults prpagatin behaviur part 2 37 Figure 27 Versined Data faults prpagatin behaviur part 1 39 Figure 28 Versined Data faults prpagatin behaviur part 2 39 Figure 29 Management f Mdule Cntext 41 Figure 30 Service Links 44 Figure 31 Example Assembly Schema 47 Figure 32 Generatin f an Event 48 Figure 33 Cnsumptin f an Event 49 Figure 34 Synchrnus Request-Respnse Operatin 50 Figure 35 Asynchrnus Request-Respnse Operatin 50 Figure 36 Selectin f Versined Data 51 Figure 37 Interactins between Service Operatins and Mdule Operatins 53 Figure 38 A Cmpsite 55 This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 iv

5 Tables Table 1 Timestamp Pints 4 Table 2 User and Warm Start Mdule Cntext Vlatility 40 Table 3 Behaviur acrss a Service Link 46 This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 v

6 0 Intrductin 0.1 Executive Summary The Eurpean Cmpnent Oriented Architecture (ECOA ) prgramme represents a cncerted effrt t reduce develpment and thrugh-life-csts f the increasingly cmplex, sftware intensive systems within military platfrms. ECOA aims t facilitate rapid system develpment and upgrade t supprt a netwrk f flexible platfrms that can cperate and interact, enabling maximum peratinal effectiveness with minimum resurce cst. ECOA prvides the imprved sftware architectural appraches required t achieve this. The standard is primarily fcussed n supprting the missin system sftware f cmbat air platfrms - bth new build and legacy upgrades - hwever the ECOA slutin is equally applicable t missin system sftware f land, sea and nn-cmbat air platfrms. The ECOA specificatin is dcumented in ten parts, cllectively identified as the Architecture Specificatin. 0.2 Main Intrductin This Architecture Specificatin prvides the specificatin fr creating ECOA -based systems. It describes the standardised prgramming interfaces and data-mdel that allw develpers t prduce ECOA cmpnents and cnstruct ECOA -based systems. It uses terms defined in the Definitins (Architecture Specificatin Part 2). The details f the ther dcuments cmprising the rest f this Architecture Specificatin can be fund in Sectin 3. This dcument is Part 3 f the Architecture Specificatin; it acts as an intrductin t ECOA. The dcument is structured as fllws: Sectin 6 prvides an verview f the mechanisms that are used fr interactins between Mdules in the system. Sectin 7 describes in details the behaviur f the interactins in an ECOA system. Sectin 8 describes the System Management mechanisms that are prvided by the Infrastructure. Sectin 9 describes the supprt fr scheduling within an ECOA system. Sectin 10 describes the mechanisms fr managing Service Availability in an ECOA system. Sectin 11 describes Service Link behaviur. Sectin 12 describes Mdule Operatin behaviur. Sectin 13 describes the utilities prvided by the ECOA Sftware Platfrm. Sectin 14 describes hw inter-platfrm cmmunicatin ccurs within an ECOA system. Sectin 15 describes the cncept f a cmpsite (cllectin f Applicatin Sftware Cmpnents) This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 vi

7 1 Scpe This Architecture Specificatin specifies a unifrm methd fr design, develpment and integratin f sftware systems using a cmpnent riented apprach. 2 Warning This specificatin represents the utput f a research prgramme and cntains mature high-level cncepts, thugh lw-level mechanisms and interfaces remain under develpment and are subject t change. This standard f dcumentatin is recmmended as apprpriate fr limited lab-based evaluatin nly. Prduct develpment based n this standard f dcumentatin is nt recmmended. 3 Nrmative References Architecture Specificatin Part 1 Architecture Specificatin Part 2 Architecture Specificatin Part 3 Architecture Specificatin Part 4 Architecture Specificatin Part 5 Architecture Specificatin Part 6 Architecture Specificatin Part 7 Architecture Specificatin Part 8 Architecture Specificatin Part 9 IAWG-ECOA-TR-001 / DGT Issue 5 Architecture Specificatin Part 1 Cncepts IAWG-ECOA-TR-012 / DGT Issue 5 Architecture Specificatin Part 2 Definitins IAWG-ECOA-TR-007 / DGT Issue 5 Architecture Specificatin Part 3 Mechanisms IAWG-ECOA-TR-010 / DGT Issue 5 Architecture Specificatin Part 4 Sftware Interface IAWG-ECOA-TR-008 / DGT Issue 5 Architecture Specificatin Part 5 High Level Platfrm Requirements IAWG-ECOA-TR-006 / DGT Issue 5 Architecture Specificatin Part 6 ECOA Lgical Interface IAWG-ECOA-TR-011 / DGT Issue 5 Architecture Specificatin Part 7 Metamdel IAWG-ECOA-TR-004 / DGT Issue 5 Architecture Specificatin Part 8 C Language Binding IAWG-ECOA-TR-005 / DGT Issue 5 Architecture Specificatin Part 9 C++ Language Binding This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 1

8 Architecture Specificatin Part 10 Architecture Specificatin Part 11 IAWG-ECOA-TR-003 / DGT Issue 5 Architecture Specificatin Part 10 Ada Language Binding IAWG-ECOA-TR-031 / DGT Issue 5 Architecture Specificatin Part 11 High Integrity Ada Language Binding ISO/IEC 8652:1995(E) with COR.1:2000 ISO/IEC 9899:1999(E) ISO/IEC 14882:2003(E) Ada95 Reference Manual Issue 1 Prgramming Languages C Prgramming Languages C++ SPARK_LRM The SPADE Ada Kernel (including RavenSPARK) Issue 7.3 sca-assembly-1.1-spec-cd03 Service Cmpnent Architecture Assembly Mdel Specificatin Versin 1.1 Available at: 4 Definitins Fr the purpse f this standard, the definitins given in Architecture Specificatin Part 2 apply. 5 Abbreviatins API ASC CPU ECOA ELI FIFO ID OS PINFO QS UDP XML XSD Applicatin Prgramming Interface Applicatin Sftware Cmpnent Central Prcessing Unit Eurpean Cmpnent Oriented Architecture. ECOA is a registered trademark. ECOA Lgical Interface First In, First Out Identifier Operating System Persistent Infrmatin Quality f Service User Datagram Prtcl extensible Markup Language XML Schema Definitin This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 2

9 6 ECOA Mechanisms The Architecture Specificatin Part 1 defines an architecture which uses Applicatin Sftware Cmpnents and Services. This dcument describes the mechanisms defined by ECOA and the way that Cmpnents interact. Additinally, it describes the behaviur f ther aspects f an ECOA system including management and utility functins alng with hw different ECOA Sftware Platfrms interact. Sme f the mechanisms are described in detail within this dcument, whereas thers are nly discussed at a high level, as they are cvered in greater depth in ther dcuments. Where this is the case a reference will be prvided. The intended audience fr this reference manual is: Cmpnent Develpers: T understand the mechanisms available fr develping applicatins ECOA Platfrm Develpers: T understand the behaviur an ECOA Platfrm is required t prvide fr a given mechanism This dcument describes the mechanisms available t an Applicatin Sftware Cmpnent, but it is the Architecture Specificatin Part 4 which prvides the abstract API fr implementing the mechanisms described herein. 7 Interactins 7.1 Mdule Interactins Interactins between Mdule Instances in an ECOA system rely n three primary mechanisms: Events Request-Respnse Versined Data publicatin The interactins between Mdule Instances can ccur within a single Applicatin Sftware Cmpnent, r between Mdule Instances f different Applicatin Sftware Cmpnents, as a cnsequence f their Services. Fr detail n the behaviurs, see sectins 11 and 12 respectively. In additin t the abve mechanisms, Operatins exist fr Infrastructure Services t allw the management f the runtime lifecycle, prperties, lgging, faults, time services, service availability, persistent infrmatin and cntext management. The fllwing sectins include numerus figures, which illustrate the interactins within an ECOA system and prvide visual clarity. The key shwn in Figure 1 ffers guidance n the cluring and symblgy used thrughut these sectins. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 3

10 Figure 1 ECOA Interactins - Key Nte that the Cmpnent develper is nly respnsible fr implementing the functinality within the Mdule Instance. The ther infrastructure bjects shwn are the respnsibility f the ECOA Platfrm Develper and cmprise the Platfrm Integratin Cde (e.g. Trigger Instances, Mdule Instance Queues, Versined Data repsitries, Service Links etc.) Timestamping Freshness f data is an imprtant cnsideratin in a missin system and fr this reasn timestamping f peratins (i.e. cmmunicatin) is supprted. A timestamp pint is related t the rigin f the peratin (Sender). The timestamp allws the user f the timestamp t rebuild a chrngram based n the same reference, the sender s clck. The ECOA infrastructure (i.e. cntainer) will be able t recrd timestamps fr peratins as shwn in Table 1. Table 1 Timestamp Pints Event_Send Operatin API Timestamp pint Descriptin Request_Sync Request_Async Respnse_Send Publish_Write_Access Updated When Mdule calls the Cntainer API When Mdule calls the Cntainer API When Mdule calls the Cntainer API When the Mdule calls the Cntainer API When Mdule calls Cntainer API (publish) When Mdule calls Cntainer API (publish) When an event is sent by the requiring r prviding Cntainer When a request is sent by the requiring Cntainer When a respnse is sent by the prvider Cntainer When data is published by the prvider Cntainer When data is published by the prvider Cntainer This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 4

11 At present peratin timestamps will always be prvided by the infrastructure. In future timestamps may be made ptinal (fr perfrmance reasns) and a cmpnent may be able t specify whether it prvides r requires a timestamp. The timestamp assciated with the sent event, sent request r sent respnse are available t the receiving mdule in the Mdule Instance cntext. The timestamp assciated with the publicatin f versined data is available within the versin data handle. 7.2 Mdule Instance Queues Mdule run-time behaviur is dependent upn the Mdule Runtime Lifecycle state (see 8.1). A set f predefined Mdule Operatins called Mdule Lifecycle Operatins exist t allw the Cntainer t infrm the Mdule f changes t its Lifecycle. Mdule Lifecycle Operatins are handled in any state (t enable the Lifecycle f a Mdule Instance t be managed), whereas nrmal Mdule Operatins are nly handled in the RUNNING state. Mdule Operatin calls are placed in the Mdule Instance Queue, and the crrespnding entry-pint fr the Mdule Instance is invked when the Operatin reaches the frnt f the queue (if the Operatin is specified as an activating Operatin, see sectin 9.2 fr further detail n activating and nn-activating Operatins). Mdule Operatin calls ther than Mdule Lifecycle Operatins are nly queued if the Mdule Instance is in the RUNNING state and if, fr a particular Mdule Operatin, the maximum number f waiting peratin calls des nt reach the value given by the attribute fifsize defined n the receiving part f the assciated OperatinLink. If the Mdule Instance is nt in the RUNNING state Mdule Operatins are discarded. Fr Request peratins arriving t a nn-running Mdule, the Cntainer will directly return a Respnse indicating that the Operatin is nt available. 7.3 Event The Event mechanism is used fr ne-way asynchrnus push-style cmmunicatin between Mdule Instances and may ptinally carry typed data. When Events are used t implement a Service Operatin, a Mdule Instance may be either the sender r receiver f an Event irrespective f whether it is designated as the Prvider r Requirer f the Service. Events are wait-free and ne-way : the Sender is never blcked and des nt receive any feedback frm the Receiver. Events arriving n a full Receiver queue are lst, and the fault is reprted t the faultmanagement Infrastructure. There may be multiple receivers f an Event within a Cmpnent (e.g. ther Mdule Instances r Service Instances), in which case instances f the Event are bradcast t all receivers. If an Event arrives at a Service Instance that is declared unavailable, the Event is discarded silently. Fr Events between Cmpnent instances, the behaviur is defined by the Rank and alleventsmulticasted attributes assciated with the Service Link. If the Service Link is nt identified as alleventsmulticasted; then nly the Cmpnent instance cnnected t the Service Link with the lwest value f Wire Rank shall receive the Event. Further detail f this behaviur is described in sectin 11. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 5

12 7.3.1 Event Sent by Prvider In the case f an Event sent by Prvider, the prviding Applicatin Sftware Cmpnent initiates the sending. This behaviur is shwn in Figure 2. Figure 2 Event Sent by Prvider Figure 2 shws, at pint 1, a Mdule Operatin being invked n the sender Mdule Instance (f the Prviding Cmpnent instance) as a result f sme ther activity. During this executin, the Mdule Instance perfrms an Event Send Cntainer Operatin (Sent by Prvider) at pint 2. The Send peratin returns immediately, allwing the Sender Mdule Instance t cntinue its executin. The Event will be queued n the Receiver Mdule Instance Queue, (f the Requiring Cmpnent instance) shwn at pint 3. The apprpriate Event Received Mdule Operatin will then be invked n the Receiver Mdule Instance when the queue is prcessed and the Event reaches the frnt f the queue, at pint Event Received by Prvider In the case f an Event received by Prvider, the requiring Cmpnent initiates the sending. This behaviur is shwn in Figure 3. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 6

13 Figure 3 Event Received by Prvider Figure 3 shws, at pint 1, a Mdule Operatin being invked n the Sender Mdule Instance (f the requiring Cmpnent instance) as a result f sme ther activity. During this executin, the Mdule Instance perfrms an Event Send Cntainer Operatin (sent by requirer) at pint 2. The Event Send peratin returns immediately, allwing the initiating Mdule Instance t cntinue its executin. The Event will be queued n the Receiver Mdule Instance Queue (f the Prviding Cmpnent instance) shwn at pint 3. The Event Received Mdule Operatin will then be invked n the Receiver Mdule Instance when the queue is prcessed and the Event reaches the frnt f the queue, at pint Request Respnse The Request-Respnse mechanism is a tw-way cmmunicatin between Mdule Instances. The calling Mdule Instance Requests an peratin and the called Mdule Instance prvides a Respnse. The Requesting Mdule Instance (sender f the Request) is named the Client, and the prviding Mdule Instance (sender f the Respnse) is named the Server. A Request may carry data ( in parameters) and the Respnse may als carry data ( ut parameters). All parameters are named and typed. There are tw mechanisms fr Request peratins which prvide synchrnus and asynchrnus behaviur at the Client and ne mechanism fr Respnse peratins at the Server. The details f these are described in the fllwing sectins. Nte that the chice f mechanism fr either a Request r a Respnse peratin can be cmpletely independent f each ther. Fr each Request-Respnse, the set f pssible Clients and Servers are identified at design time, as is the type f the mechanism e.g. synchrnus/asynchrnus. When a Client perfrms a Request, if the Server is a Mdule Instance within the same Cmpnent instance, then this Server is used. Hwever, if the Request is cnnected t a Service, there may be multiple pssible Servers available; nly the Server cnnected with the Service Link with the lwest value f Wire Rank is used (knwn as the active Server, see Sectin 10). A Respnse frm a Server is nly sent t the particular Client that has issued the Request. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 7

14 A call may fail if the Server is nt available. The Client is ntified f the failure f the call, and the fault reprted t the fault-management Infrastructure. The client Cntainer instance implements a timeut in rder t unblck the Client f a Synchrnus Request-Respnse r t infrm the Client f an Asynchrnus Request Respnse if n Respnse is received within the given delay. The value f the timeut is defined at cmpnent implementatin level; it can be determined by the maximum Respnse time defined by the required QS. If the Respnse arrives after the timeut, the Respnse is discarded by the cntainer and the fault is handled by the fault management. If the timeut is set t <0, it is cnsidered as infinite; the Client f a Synchrnus Request- Respnse remains blcked indefinitely. The three types f Request-Respnse are detailed in the fllwing sectins Synchrnus Request In the case f a Synchrnus Request, the Client Mdule Instance is blcked until the Respnse is received, as shwn in Figure 4. Figure 4 Synchrnus Client Request-Respnse Figure 4 shws, at pint 1, a Mdule Operatin being invked n the Client Mdule as a result f sme ther activity. During this executin, the Mdule Instance perfrms a Synchrnus Request peratin at pint 2. At the pint the Request is made, the Client Mdule Instance becmes blcked. When blcked, the Client Mdule Instance des nt handle any ther incming Mdule Operatin. Frm a mdule lifecycle pint f view, this blcking situatin is cnsidered as a sub-state f the RUNNING state (see 8.1). The Request peratin is cnnected via a Service Link t the Server Mdule Instance, whereby the Request peratin is queued in the Server Mdule Instance Queue, at pint 3. The Request is accepted by the Server Mdule Instance as lng as it has enugh resurces t handle the Respnse. If nt, the Request is discarded. The Request peratin will be invked n the Server Mdule Instance at pint 4, which, in this example, will send the Respnse at pint 5 just befre cmpleting the Request peratin. Once the Respnse is received by the Client Mdule Instance, it will becme unblcked and can cntinue its executin at pint 6. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 8

15 7.4.2 Asynchrnus Request In the case f an Asynchrnus Request, the Client is released as sn as the Request has been sent and may cntinue t execute ther functinality. The Respnse results in the call f an peratin n the Requesting Mdule Instance, as shwn in Figure 5. Figure 5 Asynchrnus Client Request-Respnse Figure 5 shws, at pint 1, a Mdule Operatin being invked n the Client Mdule Instance as a result f sme ther activity. During this executin, the Mdule Instance perfrms an Asynchrnus Request peratin at pint 2. At the pint the Request is made, the Client Mdule Instance des NOT blck meaning it can finish its executin f the invked peratin. The Request peratin is cnnected via a Service Link t the Server Mdule Instance, whereby the Request peratin is queued in the Server Mdule Instance Queue, at pint 3. The Request is accepted by the Server Mdule Instance as lng as it has enugh resurces t handle the Respnse. If nt, the Request is discarded. The Request peratin will be invked n the Server Mdule Instance at pint 4, which, in this example, will send the Respnse at pint 5 just befre cmpleting the Request peratin. The Respnse will then be placed in the Client Mdule Instance Queue at pint 6, and the Respnse call-back peratin will be invked n the Client Mdule Instance at pint Respnse The Server decides when it replies t the Client. It can be dne in the same blck f functinality assciated t the Request (see and 7.4.2) r the Server may defer the prvisin f the Respnse e.g. where it needs t invke a Request-Respnse Service in rder t prvide the Respnse. In the secnd case the Server may cntinue t execute ther functinality befre prviding the Respnse, as shwn in Figure 6. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 9

16 Figure 6 Deferred Respnse Server Request-Respnse Figure 6 shws, at pint 1, a Mdule Operatin being invked n the Client Mdule Instance as a result f sme ther activity. During this executin, the Mdule Instance perfrms, in this example, a Synchrnus Request peratin at pint 2. At the pint the Request is made, the Client Mdule Instance becmes blcked. The Request peratin is cnnected via a Service Link t the Server Mdule Instance, wherein the Request peratin is queued in the Server Mdule Instance Queue, at pint 3. The Request is accepted by the Server Mdule Instance as lng as it has enugh resurces t handle the Respnse. If nt, the Request is discarded. The Request peratin will be invked n the Server Mdule Instance at pint 4. The Server may, by design, use the Respnse Cntainer Operatin t send the respnse at sme later time. Fr example, in rder t cmpute the Respnse, it may be necessary t invke a further Asynchrnus Request peratin, meaning the riginal Respnse cannt be cmputed until receipt f this Respnse ccurs. Pint 5, shws anther Mdule Operatin invked n the Mdule Instance, during this executin, at pint 6, the Respnse Cntainer Operatin is called t send the Respnse back t the Client. Once the Respnse is received by the Client Mdule Instance at pint 7, it will becme unblcked and can cntinue its executin. 7.5 Versined Data Publicatin The Versined Data publicatin mechanism allws Mdule Instances t share typed data, accrding t a cncurrency-safe read-write paradigm. A reading Mdule Instance is named a Reader, and a writing Mdule Instance is named the Writer. The Writer can request a lcal cpy f the data and subsequently cmmit r cancel any changes made. This write actin is atmic. It means that the data is written entirely r nt at all. This write peratin is independent f any ther updates t the data-set. The Versined Data writes are timestamped (timestamp is perfrmed by the ECOA Sftware Platfrm). This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 10

17 A Reader can als request a lcal cpy f the data, which will be the latest data value(s) at the time f the read request. This lcal cpy will nt be affected by any subsequent changes t the data-set (i.e. by a Writer updating the data-set). Nte that althugh it is pssible fr the Reader t mdify its lcal cpy f the data, it is nt able t update the glbal data-set. Writers and Readers have t specify the beginning and the end f each (read r write) access t the data. The mechanism is wait-free : n Writer r Reader is blcked waiting fr anther Writer r Reader t release the data r waiting fr the underlying synchrnisatin mechanism t update the lcal data-set. It is pssible fr multiple instances f the same Versined Data repsitry t exist in an ECOA system e.g. where the Readers are n different Cmputing Ndes. When the access begins, the Writer r the Reader always gets the latest cpy f data available lcally. The timestamp enables the caller t determine the freshness f the data. The Reader gets an errr if data has never been received r initialized. Nte that at the mment the data is requested, there is n guarantee that it is synchrnised with the latest update, particularly in a distributed system. Where there are multiple Writers the timestamps can be used by any Readers t determine the rder in which the data was published. Any cpy that is made t enable a read r write access is islated, in that it will nt be changed by any cncurrent mdificatins f the data, and lcal changes will nt cause the Versined Data repsitry t be updated. The lcal cpy is discarded after the read r write has been cmpleted. A write access ends with tw pssible alternatives: publish mdificatins made by the Writer are published t the Versined Data repsitry cancel the mdified lcal cpy f the data is discarded withut making any mdificatins t the Versined Data repsitry. Data publicatins are atmic; simultaneus publicatins f the same dataset cannt crrupt the data cntent. This behaviur may require supprt frm the Infrastructure. An ptinal attribute (maxversins) may be set in the Cmpnent Implementatin as an attribute f the data read/write peratin t specify the maximum number f cncurrent read r write accesses that may ccur. The default is ne access per peratin e.g. a Read must be released befre the next Read starts. A read r write access Request may fail if a new lcal cpy f the data cannt be created. In this case, a null Data Handle is returned, the Client is ntified f the failure f the call, and the fault reprted t the faultmanagement Infrastructure. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 11

18 Figure 7 Versined Data Behaviur Figure 7 shws, at pint 1, a Mdule Operatin being invked n the Writer Mdule Instance as a result f sme ther activity. During this executin, the Mdule Instance perfrms a publish Cntainer Operatin at pint 2. The data is written t the Cmpnent instance lcal cpy f the repsitry at pint 3. The Infrastructure is then respnsible fr cpying the data t any requiring Cmpnents (which may nt be immediate depending upn the implementatin f the Infrastructure) at pint 4 and pint 5 respectively. Als nte that the Infrastructure may ptimise this database management such that the lcal cpies are ne in the same where the cmpnents are deplyed in the same prtectin dmain. Independently, f the Writer, the Reader Mdule Instance can read frm the Versined Data repsitry. Pint 6 shws a Mdule Operatin being invked n the Reader Mdule Instance by sme means (e.g. an Event Received). During this executin, the Mdule Instance perfrms a read Cntainer Operatin at pint Ntifying Versined Data Versined Data Readers can als specify an ptinal attribute (ntifying) t receive a ntificatin f any updates t Versined Data. This behaviur is achieved by queuing a ntificatin Event n the Reader Mdule Instance, which als cntains a reference t the latest versin f the data. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 12

19 Figure 8 Ntifying Versined Data Behaviur Figure 8 shws, at pint 1, a Mdule Operatin being invked n the Writer Mdule Instance as a result f sme ther activity. During this executin, the Mdule Instance perfrms a publish Cntainer Operatin at pint 2. The data is written t the Cmpnent instance lcal cpy f the repsitry at pint 3. The Infrastructure is then respnsible fr cpying the data t any requiring Cmpnents (which may nt be immediate depending upn the implementatin f the Infrastructure) at pint 4 and pint 5 respectively. When the requiring Cmpnent receives the updated data (and as the Reader Mdule Instance has defined the peratin t be ntifying) a ntificatin Event is generated at pint 6 which is queued n the Reader Mdule Instance Queue at pint 7. This invkes the ntificatin Mdule Operatin, which als includes a cpy f the updated Versined Data. Nte that specifying a Versined Data Read peratin as ntifying des nt preclude the use f standard Cntainer Operatins fr getting a read-nly cpy f the data at any time, as detailed in sectin 7.5. Bth mechanisms share the same underlying memry buffers. 7.6 Trigger Triggers generate peridic Events which can be used t invke sme functinality prvided by a Mdule Instance r set f Mdule Instances. The Trigger can generate Events which are queued t Mdule Instances within the same Applicatin Sftware Cmpnent and/r generate Events which are queued t Mdule Instances in different Applicatin Sftware Cmpnents via a Service e.g. where a single central Trigger is used t crdinate the executin f functinality f multiple Cmpnents, in the manner f a central clck. The Trigger behaviur fr the case f generating events within a same Cmpnent is shwn in Figure 9. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 13

20 Figure 9 Trigger Behaviur Figure 9 shws, at pint 1, the Trigger Instance sending an Event t the Receiver Mdule Instance Queue. This causes the Mdule Operatin cnnected t the Trigger t be invked n the Receiver Mdule Instance at pint 2. The Trigger Instance will generate the Event at a peridic interval as defined by the Cmpnent implementer. The first Event will be generated ne perid after the Trigger Instance has been started by the Supervisin Mdule. The Trigger Instance is prvided by the underlying Infrastructure t generate an Event at a set time interval. The Trigger Instance exhibits a sub-set f the Mdule interface, t enable the Supervisin Mdule t cntrl the Mdule Lifecycle f the Trigger. NOTE: the Trigger can be cnnected t ne r mre Mdule Operatins and/r Service Operatins. Each peratin link may specify a different trigger perid, s a single trigger may generate events at different perids. 7.7 Dynamic Trigger A Dynamic Trigger sends an Event after a given delay (knwn as the ut Event) frm the receipt f an input Event (knwn as the in Event). The in Event specifies the delay time. A Dynamic Trigger may als receive a reset Event, which will purge all unexpired delays. It is pssible fr multiple Mdule Instances t: Send in and reset Events t the same Dynamic Trigger. Receive the same ut Event. As with the peridic Trigger, the Dynamic Trigger can generate Events which are queued t Mdule Instances within the same Applicatin Sftware Cmpnent and/r generate Events which are queued t Mdule Instances in different Applicatin Sftware Cmpnents via a Service. Multiple ccurrences f the in Event may be prcessed such that a number f delays are waiting t expire. A reset Event is used t purge all currently active delays. The first parameter f a Dynamic Trigger is the delay. The remaining parameters can be any pre-defined type. The ut Event is generated with exactly the same parameters as the in Event, except that the first (delay) parameter is mitted. The ut Event is sent at the time resulting frm adding the timestamp f the in Event and the delay time. The timestamp f the ut Event is the time at which the Event is sent by the Dynamic Trigger. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 14

21 Figure 10 Dynamic Trigger Behaviur Figure 10 shws, at pint 1, a Mdule Operatin being invked n a Mdule Instance as a result f sme ther activity. During this executin, the Mdule Instance perfrms, at pint 2, a Cntainer Operatin t Request the Dynamic Trigger Instance t send a Trigger Event after a given perid (in Event). The in Event is queued in the Dynamic Trigger Instance Queue, at pint 3, therwise if the queue is full, the event is discarded and an errr raised t the Fault Handler. The queue is prcessed by the Dynamic Trigger, and if the maximum number f cncurrent delays has been reached, the delay is discarded and an errr raised t the Fault Handler, therwise the delay is started. After the delay time has expired, the Dynamic Trigger Instance will generate an ut Event t the Receiver Mdule Instance Queue, shwn at pint 4. The Dynamic Trigger Instance exhibits a sub-set f the Mdule interface, t enable the Supervisin Mdule t cntrl the Mdule Lifecycle f the Dynamic Trigger Dynamic Trigger Operatins The Dynamic Trigger can be cnsidered as a Mdule whse peratins are: EventReceived in On receptin, the Dynamic Trigger sets the trigger fr the time calculated frm the timestamp at which the in was sent+delay Parameters: delay : ECOA:duratin (secnds, nansecnds) p1, p2, etc: ECOA types EventSent ut The Dynamic Trigger sends an ut Event at the time calculated frm the timestamp at which the crrespnding in was sent+delay. The timestamp f "ut" is the time at which "ut" is sent. Parameters: p1, p2, etc: are identical (number, types and psitin identical t thse f the in Event) EventReceived reset On receptin, the Dynamic Trigger cancels the trigger settings fr all "in" Events already previusly received and nt yet expired. The transmitted Events in and ut can have several ther parameters (p1, p2, etc.): This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 15

22 These parameters are sent unchanged by the Dynamic Trigger. The number f parameters and their types are defined in the Cmpnent implementatin mdel at instance definitin level. 7.8 Interactins within Cmpnents Althugh the majrity f examples shwn in the preceding sectins display interactins between Mdule Instances in multiple Cmpnents (using Services), the exact same interactins can ccur within a Cmpnent bundary (Mdule t Mdule cmmunicatins). Figure 11 Interactins within Cmpnents Synchrnus Request-Respnse Figure 11 shws the interactins f a Synchrnus Request Respnse peratin between tw Mdule Instances within a Cmpnent. At pint 1, a Mdule Operatin is invked n the Client Mdule Instance frm a Service Operatin. During this executin, the Mdule Instance perfrms a Synchrnus Request peratin at pint 2. At the pint the Request is made, the Client Mdule Instance becmes blcked. The Request peratin is cnnected t anther Mdule Instance within the Cmpnent. The Request peratin is queued in the Server Mdule Instance Queue, at pint 3. The Request peratin will be invked n the Server Mdule Instance at pint 4, which can pefrm any prcessing required in rder t prduce the Respnse. In this example, at pint 4, the Mdule Instance invkes a Cntainer Operatin t perfrm an Event Send. The Server Mdule Instance sends the Respnse at pint 5 just befre the Mdule Operatin cmpletes and returns cntrl t the Cntainer. Once the Respnse is received by the Client Mdule Instance, it will becme unblcked and can cntinue its executin at pint 6. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 16

23 7.9 Assembly, Cmpnent and Mdule Prperties Cmpnents may be instantiated multiple times within a system. Cmpnent Prperties prvide a means t tailr the behaviur f a Cmpnent Instance. A Cmpnent Prperty is declared as part f the Cmpnent Definitin. Within the Assembly Schema the Cmpnent Instance Prperty Values are assigned fr each Cmpnent Instance. These values are assigned at design time and cannt be changed during executin. A Cmpnent Instance Prperty Value may either be a literal value r a reference an Assembly Prperty Value. An Assembly Prperty Value is a prperty which is accessible by all Cmpnents within the Assembly. As part f a Cmpnent Implementatin a Mdule Type can have Mdule Prperties declared, which can then be used t tailr different behaviur fr each Mdule Instance. Fr each Mdule Instance, a Mdule Prperty can either reference a Cmpnent Prperty, r be assigned a value at Cmpnent Implementatin time (design time) which cannt be changed during executin. Nte that in rder fr Cmpnent Prperties t be accessed; a Mdule Prperty must be created t reference the Cmpnent Prperty. Mdule Instances can then access Mdule Prperties, and cnsequently Cmpnent Prperties if referenced, via the Cntainer Interface at run-time. The Architecture Specificatin Part 4 cntains mre detail regarding Prperties Persistent Infrmatin Persistent infrmatin is brken dwn int tw main categries related t the extent f its accessibility as fllws: Private PINFO is data accessible by Mdule Instances within the same ASC Instance. Private PINFO can be defined in Read-Only r Read-Write mde Public PINFO is data accessible by any Mdule Instance in the Assembly Schema. Public PINFO is Read-Only PINFO defined in Read-Only mde can be referenced (i.e. accessed) by multiple Mdule Instances. PINFO defined in Read-Write mde can nly be referenced (i.e. accessed) by a single Mdule Instance. Figure 12 illustrates the aspects f PINFO and hw they are being declared in an ECOA system. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 17

24 Figure 12 Aspects f PINFO Private PINFO Private PINFO Attributes Private PINFO has the fllwing attributes assciated with it: PINFO name: This is the name used at Mdule level fr accessing the PINFO. It is NOT the filename assciated t the PINFO. Access Mde: Read-Only r Read-Write. PINFO'capacity: The maximum size f PINFO (applicable nly in Read-Write access mde). Filename Assciatin: (Path and filename) This is where the file cntaining PINFO data is stred prir t deplyment n the target ECOA Platfrm. Declaratin f private PINFO is bunded by the fllwing rules: PINFO Filename Assciatin is declared as a string: The maximum length f that string is 256 characters, Regarding PINFO path, the characters can be alphabetical, numerical r special characters amng _,., / Regarding PINFO name, the characters can be alphabetical, numerical r special characters amng _ PINFO Filename Assciatin is nt case sensitive. A Filename Assciatin can be assciated with nly ne Private PINFO in read-write mde, amng all Mdule Instances f a given Cmpnent Implementatin. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 18

25 A Filename Assciatin can be assciated with mre than ne Private PINFO in read-nly mde, amng all Mdule Instances f a given Cmpnent Implementatin. Private PINFO are stred in 4-CmpnentImplementatins/<Cmpnent Implementatin Name>/Pinf directry, and their Filename Assciatin is declared as a relative path t that directry (sub-directries are allwed). NOTE: This fllws the interim data rganisatin structure as defined in Architecture Specificatin Part Public PINFO Public PINFO Attributes Public PINFO has the fllwing attributes assciated with it: PINFO name: This is the name used at Mdule level fr accessing the PINFO. It is NOT the filename assciated t the PINFO. Filename Assciatin: (Path and filename) This is where the file cntaining PINFO data is stred prir t deplyment n the target ECOA Platfrm. Declaratin f public PINFO is bunded by the fllwing rules: PINFO Filename Assciatin is declared as a string: The maximum length f that string is 256 characters, Regarding PINFO path, the characters can be alphabetical, numerical r special characters amng _,., / Regarding PINFO name, the characters can be alphabetical, numerical r special characters amng _ PINFO Filename Assciatin is nt case sensitive. Public PINFO are stred in 5-Integratin/Pinf directry, and their Filename Assciatin is declared as a relative path t that directry (sub-directries are allwed). NOTE: This fllws the interim data rganisatin structure as defined in Architecture Specificatin Part PINFO rganizatin Prir t deplyment n the target ECOA Platfrm(s), PINFO is rganised as fllws: PINFO are stred in directries specified in and Private PINFO is cmmn t all ASC Instances f a given ASC Implementatin (as it is stred at ASC Implementatin level) This rganisatinal structure is illustrated in Figure 13. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 19

26 Figure 13 PINFO rganizatin prir t deplyment Subsequent t deplyment n the target ECOA Platfrm(s), PINFO is rganised as fllws: PINFO are stred in the ECOA Infrastructure, which is specific t each ECOA Platfrm. Fr each ASC Implementatin, the ECOA Infrastructure shall duplicate all Private PINFO int as many cpies as there are ASC Instances f that ASC Implementatin. The ECOA Infrastructure shall nly let Mdule Instances f a given ASC Instance access t the Private PINFO cpies related t that ASC Instance. Ratinale: this is aimed at cmplying with Access Scpe as defined in 7.10 The rganisatinal structure after deplyment is illustrated in Figure 14 This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 20

27 Figure 14 Fcus n Private PINFO rganizatin befre and after deplyment PINFO API The ECOA Infrastructure is respnsible fr making PINFO accessible t Mdule Instances: PINFO used by a Mdule Instance shuld be made accessible t that Mdule Instance prir t the INITIALIZE peratin being invked when it is in the IDLE state, PINFO used by a Mdule Instance shuld cease t be accessible t that Mdule Instance when it ges t the IDLE state and any nging SHUTDOWN peratin has returned. Frm a Mdule Instance pint f view, PINFO has the fllwing frm, illustrated by Figure 15: PINFO is an array f bytes, PINFO has an index, dented by PINFO index which indicates the current psitin in the array f bytes at which the next access will ccur: PINFO index is expressed as a number f bytes, PINFO index starts frm zer. PINFO has an upper bund dented by PINFO'capacity (fr Read-Write access mde, as defined in ), PINFO has a current size dented by PINFO'size. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 21

28 Figure 15 PINFO API Mdule Instances invke the fllwing Cntainer API fr accessing PINFO: PINFO Read: The Mdule Instance asks its Cntainer t read a number f cnsecutive bytes in the PINFO, starting at PINFO index psitin. The Cntainer prvides the bytes read t the Mdule Instance. The Cntainer ensures that PINFO'size is nt exceeded. The Cntainer increments PINFO index accrding t the number f read bytes. PINFO Write: This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 22

29 The Mdule Instance asks its Cntainer t write a number f cnsecutive bytes int the PINFO, starting at PINFO index psitin. The Cntainer writes these bytes int the PINFO. The Cntainer ensures that PINFO'capacity is nt exceeded. The Cntainer increments PINFO index and PINFO'size accrding t the number f written bytes, with regard t PINFO'capacity upper bund. PINFO Seek: The Mdule Instance asks its Cntainer t mve PINFO index frward r backward by a specified number f bytes relative t a starting psitin. The starting psitin is ne f start f PINFO, current index, size f PINFO. The Cntainer mves PINFO index and returns its new psitin t the Mdule Instance. The Cntainer ensures that the new PINFO index psitin is greater than r equal t zer. The Cntainer ensures that PINFO'size is nt exceeded. Fr a given Mdule Instance and fr a given PINFO, the PINFO API available in the Cntainer depends upn the declaratin f PINFO Access Scpe, as defined in The ECOA Infrastructure sets the PINFO index fr a Mdule Instance t zer just prir t it invking an INITIALIZE r REINITIALIZE Mdule peratin Driver Cmpnents Driver Cmpnents prvide a means f allwing interactins between the ECOA and nn-ecoa dmains. This interactin may be with hardware devices r with nn-ecoa sftware. As a result, driver cmpnents may be less prtable than ther ECOA cmpnents. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 23

30 Any Driver Cmpnent must cmply with any specified prvided and required Quality f Service. Figure 16 Driver Cmpnent Example Interactin with Bespke APIs Figure 16 shws an example Driver Cmpnent whse mdule interacts with nn-ecoa sftware thrugh tw bespke APIs. At pint 1 a Mdule Operatin is invked n the Client Mdule Instance frm a Service Operatin. During this executin, the Mdule Instance invkes sme nn-ecoa functinality via a bespke API at pint 2. The nn-ecoa functinality is implemented by sme bespke sftware at pint 3 (e.g. an SQL database), and perfrms sme functinality prir t returning cntrl. The Mdule Instance cntinues peratin and invkes sme alternate nn-ecoa functinality via a secnd bespke API at pint 4. This alternate functinality is implemented at pint 5 by sme nn-ecoa sftware prvided by the cmpnent supplier. This nn-ecoa sftware may interact with ther sftware r hardware as required by the cmpnent prvider. Once cmplete, cntrl is returned back t the Mdule Instance. Any nn-ecoa sftware invked by an ECOA Driver Cmpnent must ensure that it als cmplies with the ECOA Inversin f Cntrl principle, as it is effectively part f the Mdule Instance thread f cntrl. If any This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 24

31 bespke sftware requires an interactin that wuld blck the Mdule Instance frm cntinung, then this must be implemented by a separate thread f cntrl. Within a Driver Cmpnent, an ECOA Mdule Instance can make use f a bespke API t invke nn- ECOA sftware as described abve. An external interface is defined [Architecture Specificatin Part 4] t allw nn-ecoa sftware t asynchrnusly interact with ne r mre ECOA Mdule Instances r ECOA dynamic Trigger Instances. The externally generated event may be cnnected t ne r mre Mdule Instance peratins and/r Dynamic Trigger instance event peratins fllwing the nrmal rules f Event Links. This allws an externally generated event t be delivered t multiple Mdule Instances and/r Dynamic Trigger Instances within the Cmpnent Instance. An external interface may nt be cnnected t a Prvided r Required Service Operatin. Figure 17 Driver Cmpnent Example External Asynchrnus Interactin Figure 17 shws an example f hw nn-ecoa sftware asynchrnusly interacts with ne Mdule Operatin f a single Mdule Instance thrugh a defined external interface (pint 1). When the ECOA external interface (implemented by the cntainer) is invked by the nn-ecoa sftware at pint 1, an event is placed int the Mdule Instance queue at pint 2. The event will be prcessed as usual, and the assciated peratin will be invked n the Mdule Instance at pint 3. The Mdule Instance can then perfrm the apprpriate prcessing fr the received event. Due t the chsen apprach, nly ne single instance f ne given driver cmpnent implementatin can be deplyed per prtectin dmain; this limitatin des nt preclude the deplyment f several driver cmpnent instances within the same prtectin dmain if they refer t distinct driver cmpnent implementatins. Any Mdule Instances f the same ASC Instance that are linked t the same external peratin must be deplyed in the same Prtectin Dmain alng with the nn-ecoa sftware that invkes the assciated External API. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 25

32 8 ECOA System Management 8.1 Lifecycle A Cmpnent Instance is cmpsed f Mdule Instances. The Runtime Lifecycle f a Mdule Instance defines its runtime state. Figure 18 illustrates the Mdule Runtime Lifecycle. Figure 18 Mdule Runtime Lifecycle A Mdule Instance has three pssible lgical states: IDLE state reached after instantiatin, fatal errr raising r shutdwn. READY state reached when the mdule has been initialized. RUNNING state where the Mdule Instance is handling incming Mdule Operatins. In the RUNNING state, the Mdule Instance may be blcked when invking Cntainer Interface blcking peratins such as synchrnus request-respnses. A Mdule Instance can transitin between these states as shwn in Figure 18. The states and transitins are managed by the Cntainer, which invkes Mdule Interface entry pints fr each state change. The Mdule Instance states d nt necessary reflect the states f the underlying OS tasks which supprt the Mdule Instances, e.g. a Mdule Instance may be in a RUNNING state while the underlying task may be in a ready state waiting fr the CPU resurce. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 26

33 The Mdule Interface cntains entry pints that are invked by the Cntainer as a result f a Mdule Lifecycle state change. They are: INITIALIZE REINITIALIZE START STOP SHUTDOWN NOTE Fr an INITIALIZE cmmand, the Cntainer will invke the INITIALIZE entry pint if the Mdule is in the IDLE state and the REINIITIALIZE entry pint if it is in the READY r RUNNING state. The lifecycle f nn-supervisin Mdule Instances within a Cmpnent instance are managed by the Supervisin Mdule with the assistance f the Cntainer: In rder t achieve this, the Supervisin Mdule Cntainer Interface prvides the fllwing peratins (ne set per nn-supervisin Mdule Instance): INITIALIZE START STOP SHUTDOWN Mdule Startup Upn start-up f the ECOA System, the ECOA Infrastructure is respnsible fr the allcatin and initializatin all the resurces (threads, libraries, bjects, etc.) needed t execute the functinality f the Mdule Instances and their Cntainers. Fllwing allcatin and initialisatin f resurces each Mdule Instance is brught t the IDLE state Supervisin Mdule Startup When all Mdule Instances have been brught t the IDLE state, the Cntainer cmmands all Supervisin Mdule Instances t INITIALIZE and START by perfrming the fllwing: the Cntainer calls the INITIALIZE entry pint in the Supervisin Mdule Interface when the entry pint returns, the Cntainer changes the state f the Supervisin Mdule Instance frm IDLE t READY, and calls the START entry pint in the Supervisin Mdule Interface. when the entry pint returns, the Cntainer changes the state f the Supervisin Mdule Instance frm READY t RUNNING. NOTE: Althugh the Supervisin Mdule is able t manage nn-supervisin Mdules at any time; it is recmmended that it nly manages them in the RUNNING state (i.e. during r after the START entry pint) Nn-Supervisin Mdule Startup Within a Cmpnent, the Supervisin Mdule can Request nn-supervisin Mdule Instances t INITIALIZE (r REINITIALIZE depending n the state f the Mdule Instance). The Mdule Instance then perfrms any actins required t initialize, r re-initialize, such as allcating further resurces, setting its internal variables and/r reading its Prperties t reach a functinally cherent and initialized internal state. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 27

34 Fllwing initialisatin the Mdule Instance is READY and the Supervisin Mdule can Request it t START. At this pint, the Mdule Instance has the pprtunity (via its START peratin) t perfrm any actins relevant t its transitin t the RUNNING state (these are likely t be specific t the functinality f the design.). Once started the Mdule Instance enters the RUNNING state. The fllwing are the steps taken t change the state f a Mdule Instance: the Supervisin Mdule Requests a Mdule Instance lifecycle state change via the Cntainer Interface the Cntainer invkes the apprpriate entry pint in the nn-supervisin Mdule Interface when the entry pint returns the Cntainer changes the state f the Mdule Instance the Cntainer then ntifies the Supervisin Mdule indicating the state change is cmplete Mdule Run-time Behaviur Lifecycle Events that d nt represent a valid transitin frm the current state, as shwn by the Mdule Lifecycle state diagram in Figure 18, are discarded, and the fault management Infrastructure will be ntified (see sectin 8.3). Lifecycle Events are activating peratins. Lifecycle Events have n pririty ver ther peratins: On receipt f STOP, SHUTDOWN r INITIALIZE Events, peratins already executing are allwed t cmplete and peratin calls already queued will be executed. Operatins arriving when a Mdule Instance is entering the RUNNING state will be queued and executed after the START entry-pint has returned. A Mdule cannt invke any Request-Respnse peratins in its Cntainer Interface as part f the implementatin f a Mdule Lifecycle peratin. The Mdule may hwever invke Event r Versined Data peratins in this case Mdule Shutdwn When its SHUTDOWN entry pint is called the Mdule Instance may de-allcate any assciated resurces (thse previusly allcated during INITIALIZE). When its SHUTDOWN entry pint returns the Infrastructure de-allcates the resurces used by the Mdule Instance, after which the Mdule Instance enters the IDLE state. Whenever a Mdule Instance enters the IDLE state, its queue is cleared and the Infrastructure releases all Versined Data handles assciated with it, including thse invlved in pending update ntificatins Mdule Runtime Lifecycle Example Figure 19 prvides an example f hw the Mdule lifecycle can be used in a Cmpnent by a Supervisin Mdule t manage ther mdules This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 28

35 Figure 19 Lifecycle Example Here the Supervisin Mdule, nce it has been initialized and started by the platfrm, autmatically initializes and starts the ther mdule in the Cmpnent. At each step the Supervisin Mdule is ntified f the Supervised Mdule state transitin t ensure that it crrectly sequences the cmmands. Once the Supervised Mdule is Initialized, the cmpnent can be thught f as initialized, and nce the Supervised Mdule is Running, the Cmpnent can be thught f as being in a running state. This is a very simple example, and mre cmplex cmpnents may nt autmatically initialize and start all Supervised Mdules immediately. This culd be related t sme specific management plicy fr a cmpnent, r may be related t a hierarchical cmpnent lifecycle defined by the system being develped. Each Applicatin Sftware Cmpnent manages internally its wn state based n its wn Mdule Runtime Lifecycle states. By default, this internal cmpnent-level state is nt shared with ther cmpnents. 8.2 Health Mnitring Unlike Fault Handling, ECOA assumes that Health Mnitring is related t applicatin and functinal system design and that it can be addressed by designing ASCs fr this purpse. 8.3 Fault Handling Errr Categrizatin Errr is a glbal term that encmpases: This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 29

36 Applicatin errrs: cnsequences f faults ccurring at applicatin Mdule r Supervisin Mdule level. Their management is the respnsibility f the cmpnent prvider. An Errr can be: A fatal Errr: the Mdule knws it cannt recver n its wn and uses mechanisms prvided by the Infrastructure t reprt the Errr A nn-fatal Errr: the Mdule may be able t recver n its wn (in case f minr Errrs) r it may reprt the Errr Infrastructure errrs: cnsequences f faults ccurring at ECOA Infrastructure level, i.e. Mdule Cntainer level, Prtectin Dmain level, Cmputing Nde level r Cmputing Platfrm level, r faults raised by a Supervisin Mdule. Their management is the respnsibility f the system architect and system integratr Errr Prpagatin and Recvery Actins Errrs can be detected at several levels: Mdule level (applicatin errrs) Mdule Cntainer level (Infrastructure errrs) Prtectin Dmain level (Infrastructure errrs) Cmputing Nde level (Infrastructure errrs) Cmputing Platfrm level (Infrastructure errrs) Depending n the nature f the errr (applicatin errr r Infrastructure errr) and the level f detectin, fault management may prvide recvery prcedures at: Mdule level Cmpnent level Prtectin Dmain level Cmputing Nde level Cmputing Platfrm level The recvery prcedures fr Infrastructure errrs, prvided by the ECOA Infrastructure, are dne by an entity named Fault Handler. ECOA Fault Handling at infrastructure level may be implemented int ne r several such entities n a single platfrm. The scpe f the ECOA Fault Handler(s) cannt be wider than platfrm level (e.g. in a system made f tw platfrms cnnected thrugh ELI, there shall be at least ne ECOA Fault Handler entity per platfrm) Applicatin Errrs Prpagatin and Recvery Actins Applicatin errrs may be detected by an applicatin Mdule r a Supervisin Mdule. The Cmpnent prvider determines the recvery actins (if any) t be applied by an applicatin Mdule, r by a Supervisin Mdule when an applicatin errr ccurs. If an applicatin errr is detected by an applicatin Mdule, the recvery prcedure may be: In case f nn fatal applicatin errr, the Mdule may Handle the applicatin errr if it has been cded t recver frm that type f errr, Raise the applicatin errr t its Supervisin Mdule thrugh raise_errr. In case f fatal applicatin errr, the applicatin Mdule uses the raise_fatal_errr API. The errr is autmatically sent t the Supervisin Mdule and the applicatin Mdule is immediately placed int the IDLE state by the ECOA middleware withut the assciated lifecycle ntificatin being sent t the This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 30

37 Supervisin Mdule. The Supervisin Mdule may then (as an example) change the availability f ne r mre services f the Cmpnent (related t the faulty Mdule). Figure 20 illustrates the prpagatin f Nn-fatal applicatin errrs. Figure 20 Prpagatin path f nn-fatal applicatin errr When an applicatin errr is detected by a Supervisin Mdule r received frm an applicatin Mdule, the prcedure may be: Handle the applicatin errr, where the recvery actins may be: Shutdwn the faulty Mdule r all the Mdules f the faulty Cmpnent (using the nrmal Mdule Lifecycle peratins) Restart the faulty Mdule r all the Mdules f the faulty Cmpnent (using the nrmal Mdule Lifecycle peratins) Change the availability f ne r mre Cmpnent Services The Supervisin Mdule cannt handle the applicatin errr and raises it t the Fault Handler thrugh raise_errr, the Fault Handler will determine the Recvery Actin The Supervisin Mdule is the faulty Mdule, r it cannt handle the applicatin errr and raises it t the Fault Handler thrugh raise_fatal_errr: The ECOA middleware sets the Cmpnent services as unavailable and immediately places the Supervisin Mdule and all its applicatin Mdules int the IDLE state withut the assciated lifecycle ntificatin being sent t the Supervisin Mdule. The Fault Handler will determine the Recvery Actin This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 31

38 Figure 21 illustrates the prpagatin f fatal applicatin errrs. Figure 21 Prpagatin path f fatal applicatin errrs Infrastructure Errrs prpagatin and Recvery Actins An Infrastructure errr is a fault detected at Infrastructure level, i.e. at Mdule Cntainer level, Prtectin Dmain level, Cmputing Nde level, Cmputing Platfrm level r raised by a Supervisin Mdule. Figure 22 illustrates Infrastructure errr prpagatin: If the Infrastructure errr invlves the Fault Handler (itself r its Prtectin Dmain r its Cmputing Nde): If there is nly ne Fault Handler instance n the ECOA platfrm, it is handled by the ECOA platfrm that applies a default recvery actin Otherwise it may be handled by anther Fault Handler (r, still, by the ECOA platfrm), depending n the implementatin chsen by the platfrm supplier Otherwise: If the Infrastructure errr is detected by a Mdule Cntainer, it is raised t the Fault Handler If the Infrastructure errr cmes frm a Prtectin Dmain, a Cmputing Nde, r anther Cmputing Platfrm, it is directly detected by the Fault Handler Then, the Fault Handler lgs the fault and applies the crrespnding recvery prcedure. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 32

39 Figure 22 Prpagatin path f infrastructure errrs The parameterizatin f the Fault Handler recvery rutines (i.e. the recvery actins t be applied) is the respnsibility f the system architect and the system integratr. Recvery actins fr Infrastructure errrs may be applied at sme levels: At Cmpnent level, the Fault Handler may: Shutdwn the faulty Cmpnent Warm/cld restart the faulty Cmpnent At Prtectin Dmain level, the Fault Handler may: Shutdwn the Prtectin Dmain Warm/cld restart the Prtectin Dmain At Cmputing Nde level, the Fault Handler may: Shutdwn the Cmputing Nde Warm/cld restart the Cmputing Nde At Cmputing Platfrm level, the Fault Handler may: Shutdwn the Cmputing Platfrm Warm/cld restart the Cmputing Platfrm Change the deplyment The cmpnent shutdwn actin cnsists in the Infrastructure putting all Mdule Instances f the targeted Cmpnent Instance in idle state (with the Supervisin Mdule Instance being the first). The Infrastructure frees assciated resurces, withut calling the shutdwn entry pint f these ptentially faulty Mdule Instances. Therefre, this is nt a graceful functinal shutdwn and is nt part f the Mdule Lifecycle. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 33

40 The cmpnent restart actin cnsists in the Infrastructure f triggering a cmpnent shutdwn actin, fllwed by initialize and start lifecycle actins targeted at the Supervisin Mdule Instance f the Cmpnent Instance. In rder t allw fault filtering, the Fault Handler has a cntext that can be used as a memry t stre the number f ccurrences fr each fault n a slipping time frame. As an example, it allws t distinguish a spradic fault frm a recurrent fault, and then t apply recvery actin nly if a given fault ccurs mre than X times in the given time frame. Figure 23 summarizes the errr prpagatin path and applicable recvery actins. Fault handling at applicatin level Levels Actins Restart cld/warm Fault handling at infrastructure level Cmpnent Prtectin Dmain Cmputing Nde Cmputing Platfm OK OK OK OK Shutdwn OK OK OK OK Lad new cmpsite OK applicable recvery actins if RAISE_ERROR r RAISE_FATAL_ERROR Applicatin Mdule if RAISE_ERROR r RAISE_FATAL_ERROR Supervisin Mdule errr Fault Handler lg errr errr Figure 23 Errr prpagatin path Operatins and faults ECOA allws the cmpnent supplier t use three types f peratins in his applicatin mdules: Event Versined Data Synchrnus and Asynchrnus Request/Respnse Each f these peratins has specific behaviurs regarding identified errrs and infrastructure errrs. Event: N errr cde is returned t the Mdule, due t fire-and-frget schema Infrastructure errrs handled by the Fault Handler: RESOURCE_NOT_AVAILABLE client cntainer unable t send the event This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 34

41 OPERATION_NOT_AVAILABLE server cannt handle the event UNKNOWN_OPERATION requested peratin ID is invalid Figure 24 illustrates these behaviurs. Client Client Mdule event Client Cntainer Fault utside client area: n server side n cmmunicatin link Client Client Mdule event Client Cntainer Errr detected by the client cntainer RESOURCE_NOT_AVAILABLE r OPERATION_NOT_AVAILABLE r UNKNOWN_OPERATION Fault Handler Figure 24 Event faults prpagatin behaviur Request-Respnse: Request faults: Errr cdes returned t the Mdule: OK n errr NO_RESPONSE QS timeut Infrastructure errrs handled by the Fault Handler: RESOURCE_NOT_AVAILABLE client cntainer unable t send the request OPERATION_NOT_AVAILABLE server cannt handle the request UNKNOWN_OPERATION requested peratin ID is invalid Respnse faults: This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 35

42 Errr cdes returned t the Mdule: OK n errr INVALID_IDENTIFIER API called with invalid request-respnse ID Infrastructure errrs handled by the Fault Handler: RESOURCE_NOT_AVAILABLE server cntainer unable t send the respnse OPERATION_NOT_AVAILABLE client cannt handle the respnse OVERFLOW server cntainer unable t retain the request (maxcncurrentrequests has been reached) The Figure 25 and Figure 26 illustrate these behaviurs. Client Client Mdule request NO_RESPONSE Client Cntainer Fault utside client area: n server side n cmmunicatin link Supervisin Mdule Client Client Mdule request NO_RESPONSE Client Cntainer Errr detected by the client cntainer RESOURCE_NOT_AVAILABLE r OPERATION_NOT_AVAILABLE r UNKNOWN_OPERATION Supervisin Mdule Fault Handler Figure 25 Request-Respnse faults prpagatin behaviur part 1 This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 36

43 Server Server Mdule respnse INVALID_IDENTIFIER Server Cntainer Errr detected by the server cntainer Supervisin Mdule Server Server Mdule respnse OK Server Cntainer Errr detected by the server cntainer RESOURCE_NOT_AVAILABLE r OPERATION_NOT_AVAILABLE r OVERFLOW Fault Handler Figure 26 Request-Respnse faults prpagatin behaviur part 2 Nte that in case f NO_RESPONSE returned t the Mdule due t an Infrastructure errr detected by the client Cntainer after a request call, the Infrastructure errr is handled by the Fault Handler. At the same time, the Mdule has the pssibility t raise an errr t its Supervisin Mdule, which ptentially may raise it t the Fault Handler t, causing tw recvery actins fr a same riginal fault. Nte als that when a fault is detected utside f the client area after a request call, the platfrm supplier has the pssibility t chse between tw implementatins: he can chse t send NO_RESPONSE t the client thugh the ECOA middleware, r d nthing and wait fr the timeut t happen n the client side (which causes the client Cntainer t send a NO_RESPONSE t the client Mdule). Versined Data: Get_read_access: Errr cdes returned t the Mdule: OK n errr INVALID_HANDLE API called with a invalid versined data handle (e.g. null pinter) NO_DATA nt an errr ; the data has never been written (reader side) This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 37

44 Infrastructure errr handled by the Fault Handler: RESOURCE_NOT_AVAILABLE client cntainer unable t access the memry slt Release_read_access Errr cdes returned t the Mdule: OK n errr INVALID_HANDLE API called with an invalid versined data handle (e.g. null pinter) Infrastructure errr handled by the Fault Handler: RESOURCE_NOT_AVAILABLE client cntainer unable t access the memry slt Get_write_access: Errr cdes returned t the Mdule: OK n errr INVALID_HANDLE API called with an invalid versined data handle (e.g. null pinter) DATA_NOT_INITIALIZED nt an errr ; the data has never been written (writer side) Infrastructure errr handled by the Fault Handler: RESOURCE_NOT_AVAILABLE client cntainer unable t access the memry slt Publish_write_access: Errr cdes returned t the Mdule: OK n errr INVALID_HANDLE API called with an invalid versined data handle (e.g. null pinter) Infrastructure errr handled by the Fault Handler RESOURCE_NOT_AVAILABLE client cntainer unable t access the memry slt Cancel_write_access: Errr cdes returned t the Mdule: OK n errr INVALID_HANDLE API called with an invalid versined data handle (e.g. null pinter) N Infrastructure errr The Figure 27 and Figure 28 illustrate these behaviurs. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 38

45 Client Client Mdule get_read_access released_read_access get_write_access publish_write_access errr Cntainer Fault detected by the infrastructure Versined Data Supervisin Mdule Client Client Mdule get_read_access released_read_access get_write_access publish_write_access Cntainer Versined Data Fault detected by the client cntainer RESOURCE_NOT_AVAILABLE Fault Handler Figure 27 Versined Data faults prpagatin behaviur part 1 Client Client Mdule cancel_write_access Client Cntainer errr Fault detected by the infrastructure Versined Data Supervisin Mdule Figure 28 Versined Data faults prpagatin behaviur part 2 This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 39

46 8.4 Mdule Cntext In rder fr a single mdule implementatin t be instantiated multiple times, the mdule shuld nt make use f "glbal" state; it shuld access instance specific data cntained in the Mdule Cntext.. The Mdule Cntext cntains tw parts: User Cntext Warm Start Cntext User Cntext is instance specific data defined and managed by the mdule implementatin t allw it t maintain private state between each mdule peratin invcatin. This is analgus t the cntext f thread lcal strage in traditinal perating system implementatins. User Cntext is zered by the infrastructure prir t an Initialize/Reinitialize Mdule Instance entry pint is activated. Warm Start Cntext is instance specific data defined and managed by the mdule implementatin t allw it t maintain private state between transitins f Mdule Lifecycle states where the transitin is an Initialize. The Mdule Implementatin has access t a Cntainer API s that it may request the Cntainer t save the Warm Start Cntext in nn-vlatile strage such that it may be restred during a future Warm Restart. Warm Restart can be initiated by the Fault Handler, r when the Supervisin Mdule restarts a Mdule Instance. The Infrastructure shall perfrm the save peratin atmically. If the save peratin fails n errr is returned t the calling Mdule; hwever an errr may be raised t the Fault Handler. The calling mdule is respnsible fr determining the validity f the Warm Start Cntext. This may be achieved by incrprating additinal validity entries in the Warm Start Cntext itself. Fr a Cld Start frm pwer up r a Cld Restart initiated by a Fault Handler the saved value f the Mdule Warm Start Cntext is zered by the infrastructure. In this way fr a Warm Start initiated by a Fault Handler, the Mdule Warm Start Cntext is either restred frm a previusly zered versin, r the mst recently saved versin. Warm Start Cntext used by a Mdule Instance is zered/restred by the infrastructure prir t any activatin f the Initialize/Reinitialize Mdule Instance entry pint. Fr restarts initiated by the physical platfrm, the Warm Start Mdule Cntext is nn-vlatile. Table 2 details the vlatility f the User and Warm Start Mdule Cntext. Table 2 User and Warm Start Mdule Cntext Vlatility User Cntext Warm Start Cntext Warm Cld Warm Cld Vlatile Vlatile Nn Vlatile Vlatile Figure 29 shws hw the User Cntext and Warm Start Cntext are managed thrugh these transitins. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 40

47 Figure 29 Management f Mdule Cntext Architecture Specificatin Part 4 describes the detail f hw the User Cntext and Warm Start Cntext are represented in varius languages, and the language bindings specifies the detail f the implementatin. 9 Scheduling 9.1 Scheduling Plicy Supprt fr scheduling f deplyed Mdule/Trigger Instances is prvided by the underlying perating system. A deplyed Mdule/Trigger Instance is single-threaded and will be assigned a pririty by the System Integratr. The System Integratr shall take int accunt the relative pririties set by each Cmpnent Supplier n the Mdule/Trigger Instances declared in their Cmpnent Implementatin. Any ECOA platfrm shall respect the pririties defined by the System Integratr n deplyed Mdule/Trigger Instances. This implies: Deplying Mdule/Trigger Instances nt OS tasks accrding t their pririties: Mdule/Trigger Instances with different pririties shall nt be deplyed nt the same OS task, Mdule/Trigger Instances with identical pririties may be deplyed nt the same OS task, OS task pririties shall be set with respect t the pririty f the Mdule/Trigger Instances deplyed nt them. Mdule pre-emptin capability in ECOA platfrms: Any deplyed Mdule/Trigger Instance becmes eligible fr executin n the cmputing nde resurce whenever it receives an activating peratin in its queue (including receptin f the respnse f a synchrnus request-respnse), A Mdule/Trigger Instance currently executing n the cmputing nde resurce may be preempted by anther eligible Mdule/Trigger Instance f a higher pririty, This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 41

48 A Mdule/Trigger Instance becmes ineligible fr executin n the cmputing nde resurce when its queue des nt cntain any activating peratin. The rules defined abve allw early verificatin f the system behaviur t take place at ECOA Mdule/Trigger Instance level, and prvide assumptins t facilitate Cmpnent integratin and reuse. Scheduling f OS tasks (which Mdule/Trigger Instances are being deplyed nt) is the respnsibility f the Infrastructure and any scheduling plicy supprted by the OS/Middleware may be used as required by the System Integratr, prvided that it respects the rules defined abve. Scheduling analysis is utside the scpe f ECOA; althugh it is anticipated that it wuld be carried ut fllwing existing, established methds. The type f scheduling analysis required will be dependent upn the chsen scheduling plicy. 9.2 Activating and nn-activating Mdule Operatins By default, Mdule Operatins are activating; the arrival f a new peratin implies the executin f the assciated entry-pint as sn as the Mdule Instance is able t execute. This schema is an Event-driven prgramming mdel. T disable this default behaviur, attributes are defined within the Cmpnent Implementatin at EventLink, RequestLink and DataLink level: activating which is a blean specifying the plicy used by the Cntainer t handle the peratin: when True (default value), the Cntainer activates the assciated entry-pint as sn as pssible. when False, the peratin is queued and remains pending. When an activating Mdule Operatin arrives t the same Mdule Instance thrugh anther Mdule Operatin Link, all pending Mdule Operatins arrived befre the activating ne are then prcessed in FIFO rder and executed as any ther Mdule Operatin in accrdance with the pririty f the Mdule Instance. If nn activating Mdule Operatins are queued while this prcessing is dne, their prcessing is pstpned until the arrival f a new activating Mdule Operatin. It is envisaged that this type f mechanism culd be used t implement a time-driven prgramming mdel, which may allw fr easier schedule feasibility analysis. fifsize which is an integer specifying the maximum number f pending peratins f a single type at each receiving Cntainer level. The fifsize attribute is defined against an peratin Link; therefre different peratins can be specified t have different maximum queue sizes. When the maximum number is reached fr a given peratin, the receiving Cntainer discards the new incming Mdule Operatins assciated t the Link. Fr an incming Request Respnse, the receiver Cntainer sends back an errr message t the sending Cntainer in rder t ntify the Client f the failure. Hwever, this chice des nt apply t Mdule Lifecycle Operatins, which are necessarily activating peratins (i.e.-e it is nt pssible t define them as being nn-activating). NOTE Activating n DataLink is nly useful when assciated t a ntifying Versined Data (attribute ntifying set t true) (see 7.5.1). 10 Service Availability The availability f Services prvided by a Cmpnent instance can be set, n a per Service basis, by the Supervisin Mdule Instance via the Cntainer Interface. The availability f a prvided Service is ttally left under the respnsibility f the Prvider cmpnent: it is likely t be dependent upn a cmbinatin f cmpnent internal lgic and the availability f any required Services necessary in rder t successfully prvide its Service. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 42

49 The availability f Services may be affected by run-time errrs that culd cause Mdule Instances t be shutdwn Initialisatin During initialisatin the ECOA Sftware Platfrm sets all Services as unavailable, and will prpagate the availability f Services as Cmpnent instances are initialized and started. The set f Services in the system are defined by the Assembly Schema (see sectin 10.2), which may r may nt be available at any given time Assembly Schema The pssible cnnectins between the prvided and required Services f Applicatin Sftware Cmpnents in an ECOA system are determined by the Assembly Schema. This prvides details f the Service Links (called Wires in the Assembly Schema) between Services. Service discvery may be: Static: where there is a single Prvider f a Service. The links between prviders and requirers f such Services are statically pre-determined by the Assembly Schema and are established at system start up. Dynamic: where there is mre than ne Prvider f the Service and which is the active Prvider is determined at run-time, when the Service Request is made. All f the pssible cnnectins are statically defined in the Assembly Schema. An ECOA system may cntain a mix f static and dynamic cnnectins between its Services Service Links and Ranks The links between Services are described by the Wires in the Final Assembly Schema. Each Wire has a single Requirer f a Service (identified as a surce in the schema), a single Prvider f the Service (identified as a target in the schema), and a Rank. There may be multiple Prviders and Requirers f the same Service; the cnnectins between them are determined by the Wires in the Assembly Schema. Where multiple Prviders (targets) are cnnected t the same Requirer (surce) in the case f Versined Data r Request Respnse, each Wire that is cnnected must have a unique Rank, which is used t chse a single Prvider. The Prvider with an available service which is cnnected by a Wire with the lwest Rank value is chsen in preference t the thers (i.e. Active Prvider). The behaviur f Events is dependent upn whether the Service Link is specified t multicast Events. If multicast is nt enabled, the Active Prvider cncept is used. Further detail n Rank and Service Link behaviur can be fund in sectin Dynamic Service Availability The Active Prvider fr Events, Versined Data and Request-Respnse may be decided dynamically at run-time frm the pssible cnnectins defined in the Final Assembly Schema. The current Prvider may becme unavailable due t the lss f the Supervisin Mdule r due t internal decisin which sets the prvided service t unavailable. In the case f a Supervisin Mdule lss, i.e. as sn the Supervisin Mdule leaves the RUNNING state, all prvided services are set autmatically by the platfrm t unavailable and assciated mdules are shutdwn. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 43

50 Where the current Prvider f a Service (the available Prvider with the lwest Rank value) becmes unavailable, the ECOA Sftware Platfrm will arrange fr the Prvider cnnected by a Wire with the next lwest Rank value (if the Service is available) t be chsen as: the sender in the case f an Event Sent By Prvider (unless multicast is enabled), the receiver in the case f an Event Received By Prvider (unless multicast is enabled), the respnder in the case f a Request-Respnse, the writer in the case f Versined Data Any change t the Prvider f a Service is ntified t the Requirer. If there is n available Prvider the Requirer will be ntified that the Service is n lnger available. Optinally, the Quality-f-Service prvided by any Prvider may be mnitred at run-time t ensure it is within the required QS f the Requirer. If this is nt the case, then a fault may be generated and reprted t the Fault Management. In additin an alternative Prvider may be used if ne is available. 11 Service Link Behaviur 11.1 Intrductin A Service Link cnnects Applicatin Sftware Cmpnents tgether 1. Each Service Link cnnects ne Prvided Service t ne Required Service which refers t the same Service Definitin (which cnsists f peratins i.e. Events, Request Respnse and Versined Data). This is shwn in Figure 30. Figure 30 Service Links It is necessary t specify the behaviur f each peratin acrss the Service Links. This is because it is different fr each type f peratin Active Prvider Cmpnent The term Active Prvider is intrduced t describe the Applicatin Sftware Cmpnent selected by the Infrastructure accrding t the fllwing plicy: it s prvided Service is set as available and its Service Link has the lwest value f Wire Rank. (The value f the Rank attribute can be cmputed accrding t the deplyment, fr example t reflect a ntin f "bnding" between Requirer and Prvider). Rank is expressed as a psitive integer value, whereby a lw integer value represents a high ranking Service Link. 1 The wiring f Applicatin Sftware Cmpnents thrugh Service Links may lead t cyclic dependencies between them: the crrectness and the cnsistency f the resulted Assembly Schema is the respnsibility f the System Designer. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 44

51 11.3 Summary f Behaviur When a Service Definitin includes an Event Sent By Prvider peratin, the Event (and its assciated typed data) sent by any Prvider is received by all Requirers linked t the Prvider (the Event data is distributed frm the Prvider t many Requirers). If there are multiple prviders, the requirer nly receives Events frm the Active Prvider, unless the Service Link is specified t multicast Events. Similarly, when a Service Definitin includes an Event Received By Prvider peratin, the assciated typed data sent by any Requirer is received by the Active Prvider, unless the Service Link is specified t multicast Events. When a Service Definitin includes a Versined Data peratin, each prviding Applicatin Sftware Cmpnent that is linked t the Prvided Service may supply that data. Applicatin Sftware Cmpnents that are linked t the Required Service read the mst recent value f the data prvided by the Active Prvider. When the Active Service Prvider is changed t anther ne, Readers read the instance f the new Prvider. The Cntainers hide the switch between instances. Fr a Request-Respnse peratin referenced in a Service Link, the Request frm the Client is addressed (directed) t the Active Prvider (Server). In ther wrds, in the case f multiple eligible Prviders, the Infrastructure will select ne f the Prviders t prvide a Respnse. These behaviurs are summarized in Table 3. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 45

52 Table 3 Behaviur acrss a Service Link Operatin Prvider Requirer Event Operatins sent_by_prvider The Event and its assciated typed data is sent t all Requirers Receives the Event and its assciated typed data frm the Active Prvider selected frm set f eligible Prviders (Servers) as determined by the Infrastructure accrding t the Rank attribute 2. received_by_prvider Receives the Event and its assciated typed data frm all Requirers if the Prvider is the Active Prvider 3. The Event and its assciated typed data is sent t all Prviders Request-Respnse Operatins Receives Requests frm all Requirers (Clients) Active Prvider selected frm set f eligible Prviders (Servers) as determined by the Infrastructure accrding t the Rank attribute. Versined Data Operatins Updates data fr all Requirers (Readers) Active Prvider (Writer) selected by Infrastructure accrding t the Rank attribute 4. The behaviur abve is true when the assciated service is defined as available. When the service is defined as unavailable, the fllwing behaviur is then applied: Event The event is discarded n server side in case f lcal cmmunicatin The event is discarded n server and client sides in case f ELI-based cmmunicatins Request-Respnse NO_RESPONSE returned n the client side as sn as pssible 2 This behaviur is the default ne when the flag AllEventsMulticasted is set t False (default value). When this flag is set t True, Requirers receive all events sent by the Prviders fr which the flag is set t True. 3 This behaviur is the default ne when the flag AllEventsMulticasted is set t False (default value). When this flag is set t True, all Prviders receive all events sent by the Requirers fr which the flag is set t True. 4 Prviders maintain their wn instance f the data: when a Prvider accesses the data, it gets the value it wrte previusly. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 46

53 The request is discarded n server side The respnse is always returned when the request has been handled befre the setting f the service t unavailable Versined data The versined data is always accessible by the writer but the publish actin des nt actually push the data. The platfrm is required t republish data when the service becmes available again The versined data is always accessible by the reader, but the versined data may becme stale Examples Figure 31 Example Assembly Schema In the abve Assembly Schema, three Applicatin Sftware Cmpnents R1, R2 and R3 are cnnected, via Service Links, t tw Applicatin Sftware Cmpnents P1 and P2. P1 is cnsidered as the Active Service Prvider fr R1 and R2, while P2 is cnsidered as the Active Service Prvider fr R3. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 47

54 "Sent by Prvider" Events Figure 32 Generatin f an Event An Event e Sent by Prvider in Service S translates t: An Event queue (q1,q2,q3) is created fr each Requiring Cmpnent (R1, R2, R3); An Event sent by an Active Service Prvider (P1 r P2) is received by all its Requirers (R1 and R2 fr P1, R3 fr P2). An Event sent by a nn-active Prvider is discarded by the Infrastructure except if the alleventsmulticasted flag is set t true. Therefre, an Event sent by P2 is nly received by R2 if the alleventsmulticasted flag is set t true, therwise, it des nt reach R2. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 48

55 "Received by Prvider" Events Figure 33 Cnsumptin f an Event An Event received by Prvider in a Service translates t: An Event queue (q1,q2) is created fr each prviding Cmpnent (P1 and P2); An Event sent by a Requirer (R1, R2, R3) is received by the Active Service Prvider (P1 fr R1, P1 fr R2, P2 fr R3) An Event sent by a Requirer is received by its nn-active Prviders if the alleventsmulticasted flag is set t true (P2 fr R2). Otherwise, the Event des nt reach nn-active Prviders. All Requirers are allwed t send the Event. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 49

56 Request-Respnse S Service Definitin rr : requestrepnse Synchrnus Case request respnse nn active link Requiring Cmpnent R1 Requiring Cmpnent R2 Requiring Cmpnent R3 qp1 qp2 Prviding Cmpnent P1 Prviding Cmpnent P2 Figure 34 Synchrnus Request-Respnse Operatin S Service Definitin rr : requestrepnse Asynchrnus Case request respnse nn active link Requiring Cmpnent R1 Requiring Cmpnent R2 qr1 qr2 qp1 Prviding Cmpnent P1 Requiring Cmpnent R3 qr3 qp2 Prviding Cmpnent P2 Figure 35 Asynchrnus Request-Respnse Operatin In Figure 34 and Figure 35, Service definitin S defines a single Request-Respnse peratin (rr). This translates t: Service Requirers (R1, R2 and R3) issue a Request t their current Active Prvider (P1 fr R1 and R2, P2 fr R3). This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 50

57 Based n the Rank attribute f the Service Links, the Infrastructure will determine the Active Prvider fr Cmpnent R2. In this example the Active Prvider fr R2 is P1. The Service Prviders (P1, P2) respnd t the received Requests. Fr Synchrnus Request-Respnse peratins, the Requiring Cmpnent is blcked until the Respnse is received. Fr Asynchrnus Request-Respnse peratins, the Requiring Cmpnent is nt blcked. The Respnse is received at sme later time and prcessed by a callback functin. Requests int a Prvider are queued (qp1 and qp2) until the relevant Request_Received API callback functin is called by the Prvider Cmpnent's Cntainer. This will cause additinal blcking delays t Requirers f Synchrnus Request-Respnse peratins. Respnses t Asynchrnus Request-Respnse peratins are queued in the Requiring Cmpnent s queue (qr1, qr2, qr3) until the relevant Respnse_Received API callback functin is called by the Requirer Cmpnent's Cntainer. Respnses t Synchrnus Request-Respnse peratins are nt queued in the Requiring Cmpnent which will be blcked waiting in the Request_Sync API functin fr the Respnse. Versined Data Figure 36 Selectin f Versined Data In Figure 36 Service definitin S defines ne Versined Data peratin (d). This translates t: Tw instances f data 5 (d1 and d2) created ne per prviding Cmpnents (P1 and P2) Based n the Rank attribute f the Service Links, the Infrastructure will determine the Active Prvider fr the data Reader Cmpnent R2. In this example the Active Prvider fr R2 is P1 (hence R2 accesses data instance d1). Each Versined Data instance is written by nly ne Applicatin Sftware Cmpnent and can be read by many Applicatin Sftware Cmpnents. In this example, even if P1 is the active Prvider fr R2, 5 This is a lgical view frm the pint-f-view f the Cmpnent. In an actual platfrm implementatin, the data may be physically distributed and synchrnized acrss the prcessing ndes in different ways. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 51

58 P2 nly accesses data instance d2. That means there is n underlying synchrnisatin between d1 and d2. 12 Mdule Operatin Link Behaviur This sectin shws the relatinships between Service Operatins and Mdule Operatins. Figure 37 shws pssible interactins between Service Operatins and Mdule Operatins. This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 52

59 Figure 37 Interactins between Service Operatins and Mdule Operatins This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 53

60 The fllwing give mre details n each f these: The Grey bxes are the Services which are cllectins f Service Operatins and are described by Service Definitins. Required and Prvided Services are cnnected tgether using Service Links / Wires which are in Blue. The Yellw bxes are Service Operatins. The Purple bxes are Mdule Operatins which are entries nt Executable Entities which are in Green. The Orange bxes are Cntainer Operatins which are called frm an entry pint f a Mdule Instance. Incming Service Operatins are cnnected t Mdule Operatins using Mdule Operatin Links. Cntainer Operatins can be cnnected t utging Service Operatins using Mdule Operatin Links. Cntainer Operatins can be cnnected t Mdule Operatins using Mdule Operatin Links. Service Operatins cannt be mapped t ther Service Operatins using Mdule Operatin Links. All Mdule Operatin Links require Cntainer cde. The names f Service Operatins and Mdule Operatins which are cnnected tgether dn t have t match. A Request Respnse Service Operatin can nly be mapped t a single Mdule Operatin. Multiple Event Service Operatins can be mapped t the same Mdule Operatin. One Cntainer Operatin can be mapped t multiple Event Service Operatins. Versined Data is always Read r Written by an entry pint f a Mdule Instance using a Cntainer Operatin. 13 Utilities An ECOA Sftware Platfrm prvides utility functins fr acquiring time and fr generating lgs. The Architecture Specificatin Part 4 cntains mre detail regarding these functins. One f the ECOA Sftware Platfrm prvided functins is a methd fr allwing access t glbal time. It is a system specific decisin hw this glbal time is synchrnised, and at what precisin, hwever ECOA assumes that time values acquired thrugh these functins are synchrnised acrss the system. 14 Inter Platfrm Interactins In rder t prvide interperability between ECOA Sftware Platfrms, a message prtcl, termed ECOA Lgical Interface (ELI), has been defined. This message prtcl requires an underlying transprt prtcl fr its implementatin. The chice f the underlying transprt prtcl is left t the system designer depending n system-level requirements (perfrmance, security, etc.). As an example, a binding t the UDP transprt layer has been defined. These can be fund in the Architecture Specificatin Part Cmpsites ECOA is fully cmpliant with the SCA Cmpsite cncept. A cmpsite is described by its definitin, the list f its Applicatin Sftware Cmpnents and the assciated Assembly Schema f these Applicatin Sftware Cmpnents. The Cmpsite will prvide several Services, each ne linked t ne r several Services r prvided by its Applicatin Sftware Cmpnents. This kind f Service Link is called a Prmtin Link. The Cmpsite will require several Services required by internal Applicatin Sftware Cmpnents. The link used here is als called a prmtin link. An Applicatin Sftware Cmpnent external t the Cmpsite is nly cnnected t This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 54

61 Services prvided r required at Cmpsite level and has n knwledge f the internal Applicatin Sftware Cmpnents. ECOA allws specifying an Initial Assembly Schema made f hierarchical cmpsites cntaining ECOA cmpnents in rder t help with design abstractins. Hwever, the Final Assembly Schema is a flattened single cmpsite cntaining all wired ECOA cmpnents. Figure 38 shws an example Cmpsite cnstructed with fur Cmpnents. Figure 38 A Cmpsite This specificatin is develped by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd and the cpyright is wned by BAE Systems (Operatins) Limited, Dassault Aviatin, Bull SAS, Thales Systèmes Aérprtés, AgustaWestland Limited, GE Aviatin Systems Limited, General Dynamics United Kingdm Limited and Selex ES Ltd. The infrmatin set ut in this dcument is prvided slely n an as is basis and c-develpers f this specificatin make n warranties expressed r implied, including n warranties as t cmpleteness, accuracy r fitness fr purpse, with respect t any f the infrmatin. DGT E/IAWG-ECOA-TR-007 Issue 5 55