Challenging Encapsulation in the Design of High-Risk Control Systems

In the hardwarelsoftware design of control systems it is almost an article of faith to decompose a system into loosely coupled subsystems, with state variables encapsulated in device and subsystem objects. The engineering advantages of such an approach are so attractive that it is sometimes applied inappropriately, yielding a design that hides a tangle of special-case subsystem-to-subsystem couplings behind a faGade of modular decomposition. The limitations of a device/subsystem architecture become apparent in the design of high-risk control systems-such as nuclear power plants and planetary rovers-where the world is full of physical side-effects that have little “respect” for conventional subsystem boundaries. Here, the very notion of decomposition by subsystem, and its attendant state encapsulation, actually complicates the design. Fundamentally, there is a clash between a device-subsystem-object metaphor and the laws of physics. A more appropriate architectural approach is to acknowledge the underlying physics and to elevate the concepts of state and models to first-class design elements that are nor encapsulated within subsystem objects.