![](bg5.png)
Context and/or system state changes are used as
triggers to evaluate conditions of adaptation.
Management layer uses specific adaptation strategies
to establish relations between context level and
functional level in an abstract manner. On the fly
strategies are generated automatically from
interpreting context actions which represent system
reaction to contextual change and are applied on
functional system state.
To achieve the required reconfiguration on the
considered system according to context changes,
management layer first accesses to context
declaration module to obtain the set of adaptation
actions to be performed on system configuration.
checkCtx and checkValue operations take as
arguments context tuple and context specification
module (CTXs-Maude module) and check if the
newly introduced context identifier and the
corresponding context value exist in the context
module declaration. If the verification succeeds, the
corresponding context actions declarations of
context state clause are returned.
After interpreting context actions and based on
system state, an on the fly adaptation strategy to be
applied on functional system state is generated. This
is the role of ActionProcessing action. It takes
as arguments context actions declaration and system
state. It recursively applies adaptation actions on the
current system state to accomplish the desired
adaptation operations. The newly obtained system
state and outputs are raised to the Context-Loop and
placed in the corresponding slots.
As an example of on the fly strategies generation
and execution, we consider the situation where the
vehicle is actually traveling on sharp bends. As soon
as sensing layer detects a road shape modification
(bends), context interpreter layer transmits a pair of
values, context identifier and its value, to the
management layer in the following format:
’Context:’RoadStat ’/Value:’Sharp-bends
The management layer generates the corresponding
on the fly strategy that invokes the ACC
ReduceSpeed service. The later systematically
reduces vehicle speed (see Figure 2).
Figure 2: A strategy application result.
Whenever a break is applied, the ACC
component might be disengaged regardless its
current state allowing the driver to take full control
on its vehicle. However, the controller might be
reactivated automatically if VitalSafety context is
reached to maintain safety purposes (see Figure 3).
Figure 3: CTRL component deactivation and resume
strategies.
4 CONTEXT-AWARE SYSTEMS
VERIFICATION
Model Checking (Gagnon et al, 2008) is a formal
verification technique to be applied on a system
abstract model to determine whether a series of
properties are satisfied by the considered system.
According to Gallardo & al (Gallardo and al, 2002),
model checking is one of the most useful results of
research in formal methods to increase software
quality. A model checker is an automatic tool that
confronts two descriptions of system behaviour, one
being considered as the required behaviour and the
other the actual design (Gallardo et al, 2002). The
main usefulness of such a technique is the fact that
the automatic tool, upon encountering an error state,
returns a counterexample illustrating the path taken
to reach that state.
In the present work, we deal with reachability,
safety and liveness properties verification through
the modelling of the ACC system.
Intuitively, reachability property verifies whether a
certain system state is reachable from a given initial
state. Safety properties (
Tran et al., 2012) ensure that
nothing bad will ever occur, whereas liveness
properties stipulate that something good will
eventually happen. The Maude search command is
used to check that our ACC formal model satisfies
the considered properties, or violates them by
furnishing a useful counterexample.
The Maude search command (Clavel et al, 2008)
allows exploring system state space, following a
breadth-first strategy in different ways, to verify
whether the given property is violated or not. The
model checking result is either no state violates the
considered invariant or a state violating it together
with the sequence of rewrites being executed from
the initial state to attain such state that is a
counterexample. The search command syntax
conforms to the following general scheme:
Maude>...
Maude> Start vehicle decelerating to
avoid vehicle deviation
Maude> Instance ctrl Stopped
Maude> ...
Maude> Instance ctrl Resumed
Maude> ctrl maintain save relative
peed between vehicles
OnSpecifyingandVerifyingContext-awareSystems
185