AL Partitioning (1) – Physical Domain

1. Application Layer Application Layer App R App S App P App Q R 3 R P Q R S P 1 1 1 1 1 1 P Q R S 2 2 2 2 R P 2 2 P Q R S 3 3 3 3 P 3 Q 3 Q Q 1 2 P Q R S n n n n AL Partitioning (1) – Physical Domain CELL: All the inter-cell interactions are via the architecture 18/04/07

2. AL Partitioning (2) – Safety Domain Regions: Blocks: Block High High High Assurance Assurance Low Change High Change Region Cell Assurance Low Low Assurance Assurance Low Change High Change Block Interactions – Contracted Behaviour Low Extensible Core Low Susceptibility to Change High 18/04/07

3. AL Partitioning (3) – Logical Partitioning Rationale Assurance Assurance Assurance Change Change Change Too many blocks - Very Extensible - Expensive to set-up contracts between blocks Compromise - Extensible in HC/HA - Some extensibility in HC/LA & LA/HC Too Coarse - Limited Extensibility - Reduced set-up costs 18/04/07

4. AL Partitioning (4) – Partitioning Guidelines • Assurance • Each LA cell, map to block in LA regions • HA/mixed assurance cells, map to blocks in HA regions • Susceptibility to Change • Each LC cell, map to block in LC regions • HC/mixed susceptibility to change cells, map to blocks in HC regions • All cells that are LC & LA, map to one Block in LCLA region • Example considerations for grouping cells into Blocks • Impact of Change Scenario • Isolate sets of cells that are affected by groups of changes • Likelihood of future change in assurance • Impact of future change uncertain • Synergy 18/04/07

5. HCHA1 HCLA2 HCHA4 HCHA3 HCHA2 HCLA1 HCHA6 HCLA4 HCLA3 HCHA5 HCHA{N} AL Partitioning (5) – Example Partitioning Assurance LCHA1 LCHA3 LCHA2 Susceptibility To Change LCLA1 18/04/07