Software Requirements Specification (SRS) Cooperative Adaptive Cruise Control : Team 2

Transcription

1 Software Requirements Specification (SRS) Cooperative Adaptive Cruise Control : Team 2 Authors: Alex Crimin, Project Manager Joseph Hollopter, Customer Liaison Roy Barnes, Artifacts Manager Chengzhu Jin, Project Facilitator Jimmy Mkude, Security Engineer Customer: Mr. Bill Wilam, Ford Motor Company Instructor: Dr. Betty Cheng 1 Introduction Cooperative Adaptive Cruise Control (CACC) is a system that Ford Motor Company will be utilizing in their commercial vehicles to provide increased convenience and safety for drivers. This SRS serves to address the functionality of the system with detailed diagrams and textual descriptions, providing a complete and consistent solution for the CACC feature. This introduction will start by communicating the central ideas, benefits, and overall direction of the CACC system. The overall description subsection will build upon the introduction and introduce the scope, constraints, perspectives, and function of the system. The specific requirements subsection will enumerate the specific functional and nonfunctional requirements of the system, organized by subsystem and function. These requirements will be thoroughly illustrated with many modeling diagrams. The use-case diagram will model the observable functionality of the system, the class diagram will model the objects of the system, their attributes, and their relation to one another, the sequence diagrams will model the sequential behavior of many scenarios for the system, and the state diagram will abstract these scenarios to provide the general system behavior. The system s executable prototype will also be discussed, and the informative references used to accumulate appropriate system research will be documented as well. 1.1 Purpose To clearly communicate with the customer all requirements that need to be satisfied for the embedded CACC system to operate as intended. This SRS will show a clear indication of how the different subsystems of the CACC should 1

2 interact with one another. This will give Ford Motor Company developers a point of reference to begin designing and building the CACC system. 1.2 Scope CACC assists the driver of the vehicle it is embedded in by supplying information about impending road conditions, and taking autonomous actions in response to these conditions. CACC is an embedded automotive system, which allows for the system to make real-time decisions and control the vehicle in a timely fashion. The GPS Network System of CACC is used to collect information from and transmit information to other vehicles on the road that are near. The radar sensing, radio communication, and forward looking camera are sensors that the system uses to absorb information about the surrounding environment. An electronic throttle and vehicle brakes are the actuators used to maintain the speed of the vehicle, as well as slow or stop the vehicle in emergency situations. The vehicle controller will coordinate these subsystems, retrieving input from the sensors, processing the information, and sending appropriate signals to the actuators. 1.3 Definitions, Acronyms, and Abbreviations The table below includes descriptions of keywords and acronyms used in this document. Table 1 : Definitions Name CACC ACC OS IMF VC Target Vehicle Definition Cooperative Adaptive Cruise Control. This is the embedded automotive system being described by this document. Adaptive Cruise Control. This is a subsystem of CACC that allows the vehicle to autonomously adjust its speed when obstacles are detected using radar and camera sensors. Operating System. For more information on Operating Systems visit, ctures.html. Independent Monitoring Function. This is function of the CACC system vehicle controller that monitors the successful completion of OS tasks. Vehicle Controller. This is the system controller. It is composed of the main, speed, and platoon controllers. This refers to the vehicle directly in front of the vehicle that the CACC system detects. 2

3 Platoon Leading Vehicle Following Vehicle BER BSM CAM ehsm V2X Standards ABS mph UI GPS A collection of 2-8 vehicles that are all communicating using the CACC system. This is a vehicle at the front of a platoon. This is a CACC enabled vehicle directly behind the vehicle. Bit Error Ratio. For more information on BER testing visit, R-How_Many_Bits_18Mar2003.pdf Basic Safety Message. A type of message that may be transmitted from vehicle-to-vehicle between embedded CACC network transmitters in the form of an identification key. This type of message key is used to notify following vehicles of impending safety issues. See [8] in section 6 (References) for more information. Cooperative Awareness Message. A type of message that may be transmitted from vehicle-to-vehicle between embedded CACC network transmitters in the form of an identification key. This type of message key is used as general communication between vehicles. See [8] in section 6 (References) for more information. embedded Hardware Security Module. This module verifies the authenticity of incoming network message keys. See [8] in section 6 (References) for more information. Standardized methods for secure vehicle-to-vehicle communication. See [8] in section 6 (References) for more information. Anti-Lock Brake System. This is a pre-existing subsystem in the vehicle that actuates the brakes when there is a dangerous loss of wheel traction. Miles-per-hour. All relative speeds in the system will be in units of mph. User Interface Global Positioning System. For more information about GPS visit, 3

4 DSRC standards Dedicated Short Range Communications standards. See [7] in section 6 (References) for more information. 1.4 Organization 2 Overall......Page Product Perspective Page Product Functions...Page User Characteristics...Page Constraints...Page Assumptions and Dependencies..Page 6 3 Specific Requirements....Page 6-13 Functional Requirements...Page 6 Nonfunctional Requirements.Page 12 4 Modeling Requirements..Page 13 Use Case Diagram..Page Domain Model (Class Diagram)....Page Scenarios and Sequence Diagrams.Page State Diagram.....Page Prototype Page 43 References.....Page 44 Contacts......Page 44 2 Overall In this section, certain background information that is needed to understand the functionality of the CACC system will be outlined. The context of the product, the goal of product functions, expectations for users, possible constraints, assumptions about the environment, and potential future features will all be addressed. 2.1 Product Perspective The CACC system will be embedded in certain automotive vehicles. It is a standalone system, although it is part of the vehicle as a whole. It comprises various subsystems, such as an existing ACC system, and an array of sensors and actuators that may be used by other systems in the vehicle, such as the rain sensing wipers. It is not a system that can be retroactively added to a vehicle that was previously unequipped with CACC. The CACC system is to be used at speeds greater than or equal to 25 mph, and it is meant to be used in the presence of other vehicles, where not much lateral control is required. As such, the CACC system is most well-suited for usage on main highways and freeways. 4

5 2.2 Product Functions Maintain a constant forward speed, as specified by the driver. [2] Detect vehicles or objects ahead, and adjust the forward speed accordingly. Effectively communicate with other CACC-equipped vehicles. Join or create a new platoons. Leave or disband platoons. 2.3 User Characteristics Users are expected to be licensed drivers. Users are expected to be able to effectively operate their own vehicle without the use of CACC. Users are expected to know how to communicate with and use the CACC system, so they must have a knowledge of the dashboard display output, and input methods, such as steering wheel buttons. Users are not expected to have any sort of knowledge about the internal workings of the CACC system. Users do not need to possess any specialized skills for the operation of the CACC system. 2.4 Constraints The platoon size will not exceed eight vehicles. A platoon must contain at least two vehicles. CACC will not be enabled at speeds less than 25 mph. If there is a subsystem failure, the full system will be disabled (see section 3, Specific Requirements, for more details). All local traffic laws must be obeyed, except for speed limits. The speed will be commanded by the vehicle driver. The system may not cause the vehicle to behave in a reckless or dangerous manner, which could possibly cause harm to the driver, or others on the road. Braking and acceleration force will not exceed the vehicle limits as defined in its performance envelope. Damage must be mitigated in the event of an impending collision. (see section 3, Specific Requirements, for more details). The system must be able to effectively communicate messages to the driver through the dashboard screen, never sending ambiguous messages. The driver must be able to effectively communicate with the CACC system through user input. The system must retain user privacy, but still effectively communicate necessary information. Transmitted message keys must always be anonymous. Fuel must be conserved whenever possible. Coasting is always preferable over acceleration or braking. GPS Data transmission will be operating on radio frequencies in the 5.8 GHz Short Range Devices frequency band. [7] The radio receiver degradation limit is a maximum allowed BER of for a wanted radio signal. [7] 5

6 The relative radio frequency error for GPS communication is +/- 5 ppm. [7] The electrical field strength limit is 0.21 V/m near the radio antenna. [7] The power density limit is -129 dbm/mhz near the radio antenna. [ 7 ] The safe vehicle-to-vehicle following distance must be a length of 1, 2, or 3 car lengths. The vehicle s braking and acceleration limits will be stored in units of G, for Gravity. 2.5 Assumptions and Dependencies The vehicle should be fully functional, with a working throttle and braking system. When in perfect factory condition, the CACC system will function as intended. Sensors will be able to effectively gather information that is relevant to the CACC system. Actuators will effectively be able to execute their required functions. The hardware should possess enough memory to properly allow the software function. Memory will not be dynamically allocated. [2] The CACC system will be embedded in the vehicle, and will therefore continue to work without network access. Operations will be able to be completed in real-time. 3 Specific Requirements Below are the enumerated specific requirements for the CACC system. The requirements are first organized by functional requirements, and then by nonfunctional requirements. Functional requirements are organized by how to collect environmental information, activate and control the system, autonomously adjust the vehicle speed, handle the vehicle-to-vehicle GPS communication, maintain a safe following distance, handle performance envelopes, form a platoon, divert the driver, and handle adverse road conditions. I. Functional Requirements FR0. Collect Environmental Information FR0 describes how information about the vehicle s physical environment or surroundings is collected and how this information is handled. FR0.1 Camera Sensor Visually identify the target vehicle, determine current distance from the target vehicle, and estimate the relative speed to the target vehicle. There is one camera sensor on the front of the vehicle. FR0.2 Radar Sensors There are three radars in the system, one in the front of the vehicle, and one on each side of the vehicle. The radars detect physical obstacles that may be in the path of the moving vehicle. The side radars are only 6

7 used when the system is urging the driver to divert to an adjacent lane and must ensure that the maneuver is safe for the driver. FR0.3 Dashboard Screen Sensor/Actuator There is one dashboard screen in the vehicle, which is used to communicate with the driver. Messages will be prompted on the screen for the driver to review. The screen will actuate the VC s message communication, as well as sense for driver input. FR0.4 Monitor Sensor Information The VC shall receive the information collected from the camera and radar sensors to be interpreted. FR0.5 Independent Monitoring Function The VC s independent monitoring function will always be monitoring OS tasks, especially in association with the camera, radar, and dashboard screen input handling, and brake, throttle, and dashboard screen actuation. If any task fails to start, fails to end, or consistently extends its intended timestamp, then the system will need to deactivate and reactivate the system. If this reset does not fix the issue, then the system will be disabled and the driver will be notified. FR1. Activation and Control of the System FR1 describes how the driver is able to activate, enable, and control the system. FR1.1 Activate System The CACC system will be activated when the vehicle is turned on by the driver. The system will be able to collect data from radars and the camera, and maintain this information in the VC.The system will not be able to command the vehicle until the driver enables CACC. FR1.2 CACC Lower Speed Limit The CACC system will not be eligible to be enabled until it is moving faster than its lower speed limit. The lower speed limit is 25 mph. FR1.3 Enable System The CACC system will be enabled when the vehicle is turned on, it is moving faster than 25 mph, and the driver selects Enable on the vehicle s steering wheel. When the system is enabled, the speed of the vehicle at that time will be saved as the commanded cruising speed in the VC. FR1.4 Cancel System The driver may always override the enabled CACC system by either selecting the cancel button on the steering wheel, or by putting pressure on the brake pedal. If either of these two actions are taken, the CACC system will be disabled. If the system is canceled with the brake, the previous cruise speed will be kept in the VC. FR1.5 Resume System If CACC has been enabled since the last system activation, and then disabled with the brake, the driver may resume the previous cruising speed by selecting the Resume button on the steering wheel.this will enable the CACC with the previous cruise speed. FR1.6 Increase Cruise Speed 7

8 If CACC is enabled, the driver may increase the commanded cruising speed by holding down the Acceleration button on the steering wheel until the vehicle has reached their desired speed. FR1.7 Decrease Cruise Speed If CACC is enabled, the driver may decrease the commanded cruising speed by holding down the Deceleration button on the steering wheel until the vehicle has reached their desired speed over 25 mph. Commanded cruise deceleration will stop at 25 mph. FR2. Adjust Vehicle Speed FR2 describes how the system adjusts the vehicle s speed to maintain the commanded cruising speed or maintain a safe vehicle-to-vehicle following distance behind a target vehicle. FR2.1 Electronic Throttle Deceleration Regulate vehicle speed by removing power from the existing vehicle throttle system, in order to slow down the vehicle smoothly. The VC must send a signal to the throttle system. FR2.2 Electronic Throttle Acceleration Regulate vehicle speed by adding power to the throttle system to bring the vehicle to the speed commanded by the driver, if there are no vehicles or other fixed objects in the way. The VC must send a signal to the throttle system. FR2.3 Brake by Wire Regulate vehicle speed by applying force to the existing braking system in order to avoid a crash with another vehicle or fixed target in front of the vehicle. Braking will be used when deceleration of the vehicle is not efficient enough to slow the vehicle to a safe speed in time. The VC must send a signal to the braking system. FR2.4 Emergency Brake If the VC determines that a crash is imminent and the vehicle will not be able to properly slow down in time to avoid it, the VC will max out the vehicle s braking force in order to mitigate the crash as best it possibly can. FR2.5 Software Fault Tolerance Architecture VC logic that determines the arbitration between opposing vehicle commands. Uses current vehicle state, environmental inputs, and the system context to prioritize these commands and determine which action is the most appropriate. FR3. Handle GPS Communication FR3 describes how the system receives, sends, and processes the GPS/radio communication information. FR3.1 Maintain Vehicle Information The VC shall maintain accurate vehicle location, speed, directional information, and information about the state of other vehicle systems 8

9 (tire pressure, rain-sensing wiper activation, ABS wheel speed differentials etc.) at all times. FR3.2 Receive GPS Information Using DSRC standards, the network receiver shall receive information about the current location, speed, and directional information of CACC vehicles ahead. This information will be maintained in the VC. FR3.3 Broadcast GPS Information Using DSRC standards, the network transmitter will send information from the VC about the current vehicle location, speed, and directional information to other CACC vehicles that are near. FR3.4 Form the Vehicle Platoon Using the GPS information from surrounding vehicles, establish a functional platoon. There will be a lead vehicle, and safe spacing between each successive vehicle in the platoon. FR3.5 Communicate with Infrastructure The GPS system will need to communication with VC, so that radio communication information can be safely stored. FR3.6 DSRC Radio Communication Standards All vehicle-to-vehicle GPS/radio communication will be using Dedicated Short-Term Communications standards as developed by the European Committee for Standardization. Data transmission will be operating on radio frequencies in the 5.8 GHz Short Range Devices frequency band. [ 7 ] FR3.7 Monitor Relative Radio Frequency Error The VC will monitor the relative frequency error to detect issues with network receivers and transmitters. As defined by DSRC standards, the relative frequency error is measured as, the difference between the frequency at which the transmitter outputs its largest carrier signal level in its unmodulated mode of operation and the corresponding nominal carrier frequency. If the error exceeds +/- 5 ppm, the radio communication will be considered compromised, and the system will be disabled. [ 7 ] FR3.8 Blocking Unwanted Radio Signals The network receiver has the capability to receive wanted signal input without exceeding degradation limits under DSRC standards. The degradation limit is defined by the maximum allowed BER of for a wanted radio signal. If this limit is exceeded then unwanted signals may pose a buffer overflow threat, so the CACC system will be disabled due to radio subsystem failure. [ 7 ] FR3.9 Signal Interference Detection Continuous interference signals will be harmful to signal receiving if the electrical field strength exceeds 0.11 V/m. Continuous linear polarized interfering signals will be considered harmful to signal transmission if the electrical field strength exceeds 0.21 V/m near the radio antenna, and the power density does not exceed -129 dbm/mhz. If any of these levels are exceeded the CACC system will be disabled due to radio subsystem failure. [ 7 ] FR3.10 Vehicle-to-Vehicle Message Verification 9

10 In order to increase security in vehicle message verification, without compromising on system performance, an ehsm will be used to ensure that message keys longer than the standard 256 bits can be interpreted in real-time. CAM and BSM messages will be sent and received with complete anonymity using the cryptographic agility of standardized V2X methods. [ 8 ] FR4. Maintain a Safe Vehicle-to-Vehicle Distance FR4 describes how the VC determines and adjusts to the safe vehicle-to-vehicle following distance. FR4.1 Determine Speed Differential The VC shall combine GPS information from the vehicle ahead (if the target is a CACC equipped vehicle), as well as information collected from the radar and camera sensors to determine the speed differential between the target and the vehicle. FR4.2 Command Throttle and Brakes The VC will command the vehicle s throttle and brakes to appropriately slow down the vehicle to match the previously determined speed differential. FR4.3 Efficiency Management Architecture The VC will need to determine if slowing the vehicle by throttle deceleration will be sufficient enough, or if brake pressure will need to be applied. It will also need to determine if coasting is efficient enough to speed up the vehicle while going down a hill, or if acceleration will be required. This is important because deceleration and coasting are much more energy efficient than braking and acceleration. FR4.4 Setting Safe Following Distance The driver may set the preferred safe vehicle-to-vehicle following distance by accessing the system configuration settings through the dashboard screen. The driver may set this distance to increments of 1, 2, or 3 car lengths. FR4.5 Divert the Driver When Necessary If the VC determines that a crash is imminent based on the information provided from the front radar and camera, and the vehicle cannot slow down fast enough to avoid it, the VC will use the side radars to determine if it is safe for the driver to move to an adjacent lane. If an adjacent lane is empty, the driver will be prompted on the dashboard screen to move in that direction. FR5. Performance Envelope Sharing FR5 describes the GPS-shared vehicle performance envelope, and how this envelope is handled. FR5.1 Maintain Performance Envelope The VC shall keep a detailed description of the vehicle s braking and acceleration capabilities to be shared with other platoon vehicles. Both 10

11 will be in units of G for Gravity.This performance envelope will be included in the VC s operating environment information. FR5.2 Determine Braking and Acceleration Maneuvers The VC should consider the performance envelopes for all platoon vehicles to coordinate the braking and acceleration maneuvers that the platoon can perform. These maneuvers will determine the timing and strength of deceleration, acceleration, and braking force for each vehicle during the maneuvers. FR6. Forming A Platoon FR6 describes how a platoon is formed and handled. FR6.1 Forming Potential Platoon If the vehicle comes within close proximity to another CACC enabled vehicle in front of it, and the vehicle is not already in a platoon of max capacity, at eight vehicles, then the VC will ask the driver if they would like to join in a platoon with this vehicle. FR7. Diverting the Driver FR7 describes how and when a driver should be diverted while driving with CACC enabled. FR7.1 Ensuring Diversion Safety If the VC determines that a crash is imminent based on the information provided from the front radar and camera, and the vehicle cannot slow down fast enough to avoid it, the VC will use the side radars to determine if it is safe for the driver to move to an adjacent lane or the side of the road. Side radars will only be activated and used under this emergency situation. FR7.2 Warning the Driver of Diversion If the VC determines that the vehicle can safely be diverted to an empty adjacent lane, the driver will be notified of this on the dashboard screen. A message will appear, along with a right arrow or a left arrow to communicate the direction the driver should move. FR7.3 Communicating with Lane Keeping/Lane Centering If the VC is alerting the driver to change lanes or pull over on the side of the road, the Lane Keeping/Lane Centering must be disabled so that vehicle is not pushed back in the lane when they attempt to quickly move over. FR8. Adverse Road Conditions FR8 describes how the system monitors road conditions, and actions that may be taken in the case of adverse road conditions. FR8.1 Monitor ABS The Main Controller of the system will monitor wheel speed differentials that are being measured by the vehicle s pre-existing ABS system. A 11

12 dangerous wheel speed differential may be a sign of poor road conditions FR8.2 Monitor Rain-Sensing Wipers The Main Controller will monitor the vehicle s pre-existing Rain-Sensing Wipers that will determine if there is precipitation coming down, which may be a sign of poor road conditions. FR8.3 Monitor Tire Pressure The Main Controller will monitor the tire pressures being measured by the vehicle s pre-existing Tire Pressure Sensors. A drastic drop in tire pressure may signal the vehicle has a flat tire. FR8.4 Regain Wheel Traction If ABS determines there is a dangerous wheel speed differential due to poor road conditions, the Speed Controller will slow down the vehicle until the wheel speed differential nears zero. FR8.5 When to Retest Wheel Speed Differential If the Rain-Sensing Wipers were activated when the Speed Controller slowed the system due to loss of wheel traction, the Speed Controller will begin testing the traction when the wipers deactivate. If the wipers were not activated, then the wheel traction will be tested every thirty seconds. FR8.6 How to Retest Wheel Speed Differential The wheel speed differential needs to be tested by increasing the speed by one mph at a time, and monitoring the ABS system s wheel speed differential measurements. If the differential increases again, then the vehicle should slow back down, if it does not then the system can continue to increase the speed and test the differential until the vehicle returns to the commanded cruising speed. II. Nonfunctional Requirements NR1. Consistency The system should always be striving to maintain a steady and constant forward driving speed. NR1.1 Maintain Vehicle Speed Maintain a constant forward vehicle speed at all times. The vehicle speed will be provided by the driver. NR1.2 Consistent Acceleration, Deceleration, and Braking When the VC must command the throttle and brakes, it should be done so at a consistent rate. NR3. Safety Requirements The system should always be operating as safely as possible. NR3.1 Differentiate Vehicle Targets and Fixed Objects Always be able to determine if a target is a moving vehicle. It is crucial for safety that vehicles never target fixed objects. If the speed 12

13 differential information retrieved from the camera is equivalent to the vehicle speed, then the target is not moving, and the vehicle may need to come to an emergency stop. NR3.2 Prioritize Feature Actions When two different features of the CACC system are attempting to contradict each other with their vehicle control, the VC must be able to use the software fault tolerance architecture to prioritize which action is more appropriate, and command it to the brake and throttle actuators. This logic must be accurate every time to maintain driver safety. NR3.3 Do Not Exceed Performance Envelope Never brake or accelerate the vehicle more than the performance envelope has allowed. This could result in unexpected and potentially dangerous behavior from the vehicle. NR3.4 Avoid Crashes The system must be able to accurately predict an imminent crash with the vehicle controller, and be able to take appropriate actions to avoid it. If it is not possible to lower the vehicle s speed fast enough to avoid the collision then the driver will need to be advised to divert the vehicle to the left or the right based on road conditions. If this is not possible, then max out the braking force to NR3.5 Diverting the Driver Safely The system will never attempt to divert a driver into an adjacent lane if there is anything in the way that may endanger the driver or anyone else around the vehicle. 4 Modeling Requirements These are the modeling diagrams for the system. The use-case, class, sequence, and state diagrams cohesively represent the behavior of the system and the objects involved. 13

14 Use-Case Diagram Cooperative Adaptive Cruise Control Below is the use-case diagram for the CACC2 system. This diagram represents the observable functionality of the system. The textual description is below the diagram. 14

15 Use-Case Diagram Documentation Cooperative Adaptive Cruise Control Below is the use-case diagram documentation for the CACC2 system. This documentation describes the use-cases of the system, their interaction with entities outside the system, and their cross-references with the specific requirements section of this document (see section 3). : Activate the Vehicle Driver In order to activate the system, the vehicle must be turned on by the driver. This will turn on all sensors, the camera, the dashboard screen, and the system controller, though no actions will be taken for the system to control the vehicle yet (not until the CACC system is enabled). Primary, Essential FR1.1, FR0.1, FR0.2, FR0.3, FR0.4 : Type Includes: Use-Cases: Change Cruise Speed Driver If the driver has already enabled the cruise control, the driver may change the commanded cruising speed. The driver may increase the speed, or decrease the speed down to as low as 25 mph. Secondary Increase Cruise Speed, Decrease Cruise Speed FR1.6, FR1.7, FR1.2 Must perform Activate System and Enable Cruise use-cases first. : Increase Cruise Speed Driver If the driver has already enabled the cruise control, the driver may increase the commanded cruising speed by holding down the Accelerate button on the steering wheel until the desired speed is reached. 15

16 Type Cross-refs Use Cases Secondary FR1.6 Must perform Activate System and Enable Cruise use-cases. : Decrease Cruise Speed Driver If the driver has already enabled the cruise control, the driver may decrease the commanded cruising speed by holding down the Decelerate cruise button on the steering wheel until the desired speed is reached. The speed will only decrease to a minimum of 25 mph. Secondary Use Cases: FR1.7, FR1.2 Must perform Activate System and Enable Cruise use-cases first. : Use Cases: Set Safe Distance Driver The driver may access the CACC configuration settings through the dashboard screen, and set the safe vehicle-to-vehicle following distance to increments of 1, 2, or 3 car lengths. This will be the safe following distance the system will use when the CACC system is enabled. Secondary FR4.4 Must perform Activate System first to access the dashboard screen. : Resume Cruise Driver If the driver has activated the system, enabled cruise control, and disabled the cruise control by using the vehicle s brake, the driver may resume their previous cruising speed by selecting the Resume button on the steering wheel. Secondary 16

17 Use Cases: FR1.5 Must perform Activate System, Enable Cruise, and Disable Cruise with Brake first. : Use Cases: Enable Cruise Driver When the driver selects the Enable button on the vehicle s steering wheel, the vehicle controller will determine if the current vehicle speed is above 25 mph. If this is true, then the CACC system will be fully activated, and the vehicle s current speed will be the commanded cruising speed to be maintained. Primary FR1.2, FR1.3 Must perform Activate System use-case first. : Type Includes: Use Cases: Disable Cruise Driver The driver always has the option to manually override by disabling the CACC system with the cancel button on the steering wheel, or by pressing down on the vehicle s brake pedal. Primary Disable Cruise With Brake, Disable Cruise With Button FR1.4 Must perform Activate System and Enable Cruise first. : Disable Cruise With Button Driver If the driver has activated the system and enabled cruise control, they may disable CACC by pressing down on the Cancel button on the steering wheel. Primary FR1.4 17

18 Use Cases: Must perform Activate System and Enable Cruise first. : Use Cases: Disable Cruise With Brake Driver, Vehicle Braking System If the driver has activated the system and enabled cruise control, they may disable CACC by pressing down on the vehicle s brake pedal. Primary FR1.4 Must perform Activate System and Enable Cruise first. : Includes: Use Cases: Adjust Speed When the system controller determines that a speed adjustment is needed to maintain the commanded cruising speed, the controller will command either the throttle to accelerate or decelerate the vehicle smoothly, or the brakes to decelerate the vehicle quicker. Primary and Essential Decrease Speed, Accelerate Throttle FR2.1, FR2.2, FR2.3, FR2.4, FR2.5, FR4.1, FR4.2, FR4.3 Must perform Activate System and Enable Cruise first. : Includes: Use Cases: Decrease Speed When a decrease in the vehicle s speed is required to maintain the driver s commanded speed or to avoid colliding with an obstacle in front of the vehicle, the controller must determine if deceleration of the throttle is sufficient in slowing the vehicle fast enough, or if the braking system must be used to slow the vehicle faster. Primary, Essential Decelerate Throttle, Apply Brakes FR2.1, FR2.3 Must perform Activate System, Enable Cruise, and Adjust Speed first. 18

19 : Use Cases: Apply Brakes Vehicle Braking System If braking deceleration is required to decrease the vehicle s speed, the vehicle controller will send a signal to the Vehicle Braking System to apply the brakes smoothly. Primary, Essential FR2.3, NR1.1, NR1.2 Must perform Activate System, Enable Cruise, and Decrease Speed first. Emergency Brake extends this use-case. : Extends: Use Cases: Emergency Brake Vehicle Braking System If a collision is imminent, the vehicle controller will send a signal to the Vehicle Braking System to max out the braking force in order to mitigate the crash as best as possible. Primary Apply Brakes FR2.4 Must perform Activate System, Enable Cruise, and Decrease Speed first. : Use Cases: Accelerate Throttle Vehicle Throttle System When an increase in the vehicle s speed is required to maintain the driver s commanded speed, the controller must send a signal to the vehicle s throttle actuating system. Primary, Essential FR2.2 Must perform Activate System, Enable Cruise, and Adjust Speed first. 19

20 : Use Cases: Decelerate Throttle Vehicle Throttle System If throttle deceleration is required to decrease the vehicle s speed, the vehicle controller will send a signal to the Vehicle Throttle System. Primary, Essential FR2.1 Must perform Activate System, Enable Cruise, and Decrease Speed first. : Use-Cases: Display Message Driver If the driver must be communicated with, a clear and appropriate message will be displayed on the dashboard screen for them to review. Secondary FR0.3 Activate System must occur first. : Includes: Use-Cases: Disable System If the IMF determines that there is an issue with a system task, while tasks are being monitored, and the controller determines that the system is too unstable to maintain functionality safely, then the full CACC system will be disabled until the issue can be resolved and the driver will be warned of this issue with a message displayed on the dashboard screen. Primary Display Message FR3.8, FR3.9, FR3.7, FR0.5 Activate System must be performed first. Invite to Platoon Driver 20

21 : Includes: Use Cases: If the VC determines that there is a target vehicle in front of the vehicle, while CACC is enabled, then the controller will invite the driver to either join the target vehicle s platoon, or form a new platoon with this vehicle if it is alone. The controller will negotiate a speed between the two vehicles and send a message to the driver on the dashboard screen. Primary, Essential Display Message, Accept Platoon, Reject Platoon FR3.4, FR6.1 Must perform Activate System and Enable Cruise first. : Use Cases: Accept Platoon Driver If the VC invites the driver to join a platoon, and the driver selects Accept on the dashboard screen, then the vehicle will join the platoon. Primary FR5.2 Must perform Activate System, Enable Cruise, and Invite to Platoon first. : Use Cases: Reject Platoon Driver If the VC invites the driver to join a platoon, and the driver selects Reject on the dashboard screen, then the driver will not join a platoon but will continue driving with CACC. Secondary FR0.1, FR0.2 Must perform Activate System, Enable Cruise, and Invite to Platoon first. Exit Platoon Vehicle Turn Signal, Lane Keeping/Centering System 21

22 : If the driver is currently in a platoon, and decides to leave the platoon they must select the cancel platoon button on the dashboard screen, and/or turn on their turn signal to leave the formation. If the turn signal is engaged, then the lane keeping/lane centering system will allow the driver to exit the lane of the platoon without pushing them back. Secondary FR 1.3 Use Cases: Must perform Activate System, Enable Cruise, and Accept Platoon first. : Includes: Use-Cases: Divert Driver Lane Keeping/Centering System While the system is monitoring the vehicle s surroundings, if it determines that a crash is imminent, the system will attempt to mitigate the situation by diverting the driver to adjacent lanes or the side of the road. The system will communicate this suggestion to the driver on the dashboard screen. If the system is attempting to divert the driver, it will need to communicate with the existing lane keeping/lane centering system as well to ensure that the vehicle is not pushed backed into the lane while the driver is getting over. Primary Display Message FR4.5, FR6.1, FR7.2, FR7.3 Activate System must be performed first. : Adverse Conditions Vehicle Rain Sensing Wiper System, Vehicle Anti-Lock Brake System, Vehicle Tire Pressure Sensors If any of the monitored systems show signs of adverse road conditions, the vehicle will slow down, alert the driver, and alert the driver of the following CACC vehicle, if there is one. If the ABS system detects a speed differential between vehicle wheels, the controller will slow the vehicle until this differential nears zero. If the rain-sensing wipers are activated, then the system will note that precipitation is falling. And if the tire-pressure sensors show a fast drop in tire-pressure, then the system will know that the vehicle has a flat tire. Secondary 22

23 Includes: Use Cases: Display Message, Warn Following Vehicle FR1.1,FR1.2 Activate System and Enable Cruise must occur first. : Use Cases: Warn Following Vehicle Following Vehicle If the vehicle is facing adverse road conditions, or experiences a malfunction, if there is a following CACC vehicle, the following driver will be alerted of these issues. The VC will use radio communication to send this message Secondary FR1.2 Must perform Activate System and Adverse Conditions first. : Use Cases: Receive GPS Information Following Vehicle, Target Vehicle The radio receiver will receive GPS information from other CACC vehicles that are near. This information will be maintained in the VC. Primary, essential FR3.2, FR3.6, FR3.5, FR3.7, FR3.8, FR3.9, FR3.10 Must perform Activate System and Enable Cruise first. : Use Cases: Send GPS Information Following Vehicle, Target Vehicle The radio transmitter will send GPS information to other CACC vehicles that are near. Primary, essential FR3.1, FR3.3, FR3.6, FR3.5, FR5.1 Must perform Activate System and Enable Cruise first. 23

24 Class Diagram - Domain Model Cooperative Adaptive Cruise Control Below is the class diagram for the CACC2 system. This diagram represents the physical objects of the system and the different relationships between them. The main components of embedded automotive systems are actuators, controllers, and sensors. The textual description is below the diagram in the form of a data dictionary. 24

25 Class Diagram Data Dictionary Cooperative Adaptive Cruise Control Below is the use-case diagram for the CACC2 system. This diagram represents the observable functionality of the system. The textual description is below the diagram. Element Name CACC System Relationships This is the Cooperative Adaptive Cruise Control system that allows a driver to enable the cruise control in their vehicle, and it will autonomously adjust the vehicle speed to maintain vehicle and driver safety. It is composed of Sensors in the form of buttons, radars, a camera, dashboard screen and a network receiver, Controllers in the form of a Main Controllers, Platoon Controller, or a Speed Controller, and Actuators in the form of brakes, the throttle, a dashboard screen, and a network transmitter. Composed of Actuators, Controllers, and Sensors. Associated with a Driver. Element Name Sensors Relationships These are the mode of input for the system. They enable the system to perceive essential parts of the environment around the vehicle and make intelligent decisions based on this information. They route the input sensor signals to the Controllers. Aggregated by a Camera, a Front Radar, two Side Radars, Screen Buttons, a Network Receiver, and Steering Buttons. Element Name Camera This is the camera sensor placed at the front of the vehicle to detect the distance and speed differential between the vehicle and obstacles surrounding the vehicle. It constantly sends signals to the Main Controller, notifying the system of the state of the environment in that point in time. Operations cameraon( ) : void Activate the camera. measuredifferential( ) : int Measure the speed differential between the vehicle and the obstacle in front of it. Relationships Aggregates the Sensors 25

26 Element Name Front Radar Relationships These is a radar sensor placed at the front of the vehicle in order to detect obstacles in front of the vehicle. It constantly sends signals to the Main Controller, notifying the system of the state of the environment in that point in time. This is a subclass of Radar, that aggregates Sensors. Element Name Side Radar Relationships These are the two radars placed on the left and right sides of the vehicle, that detect obstacles that may be to the sides of the vehicle while the driver is being diverted from the current road lane. They constantly send signals to the Main Controller, notifying the system of the state of the environment in that point in time. This is a subclass of Radar, that aggregates Sensors. Element Name Radar This is the superclass of radar sensors that are placed around the vehicle in order to detect obstacles surrounding the vehicle. They constantly sends signals to the Main Controller, notifying the system of the state of the environment in that point in time. radaron( ) : void Activates the radar Relationships Superclass of Front Radar and Side Radar classes. Element Name Screen Button These are sensors that are on the dashboard screen as buttons that the driver may select to appropriate an intended system action. Operations selected( ) : bool Will sense when the screen button has been selected or not, and return yes or no as an indication. 26

27 Relationships Aggregates Sensors, and is associated to Driver, who may select these buttons. Element Name Steering Buttons Relationships These are the sensors of the system that are buttons on the steering wheel that may be pressed by the driver Aggregates Sensors, and is aggregated by Accelerate Button, Decelerate Button, Cancel Button, and Enable Button. Element Name Vehicle Switch This is the button that the driver may press to start the vehicle. This button acts as a sensor to detect when CACC should be activated. Attributes vehicleon : bool Indicates whether the vehicle is on or not Operations vehicleon( ) : void Indicates the vehicle should be turned on. vehicleoff( ) : void Indicates the vehicle should be turned off Relationships Aggregates Sensors, and is a subclass of Button. Element Name Enable Button Relationships This is a button on the steering wheel that may be pressed by the driver, and acts as a sensor to detect when CACC should be enabled. Aggregates Steering Buttons, and is a subclass of button Element Name Accelerate Button This is a button on the steering wheel that may be held by the driver, and acts as a sensor to detect how much the driver would like to increase the commanded cruising speed. Attributes 27

28 increaseamount : int Amount the driver intends to increase the cruising speed, information will be sent to the Speed Controller. Operations increasecruise() : int Total the amount the cruising speed should be increased based on the amount of time the driver has held the button down, will return the total amount. Relationships Aggregates Steering Buttons, and is a subclass of Button Element Name Cancel Button Relationships This is a button on the steering wheel that may be pressed by the driver, and acts as a sensor to detect when the CACC System should be disabled. Aggregates Steering Buttons, and is a subclass of Button. Element Name Button These are sensors in the system that are physical buttons that may be pressed or held down by the driver of the vehicle to signal an intended action. Operations pressed( ) : bool Will detect if the driver has pressed the button or not, will return yes or no to indicate this. Relationships Superclass for Vehicle Switch, Accelerate Button, Enable Button, Cancel Button, Decelerate Button. Associated with Driver, who may press these buttons. Element Name Network Receiver This is the network component of the system that receives information, in the form of message keys, from other CACC vehicles to enable communication between vehicles. The keys are verified by the security module, and then the network receiver sensor forwards the secure information to the Platoon Controller to be processed. 28

29 Operations receiveinfo( int key ) : bool Receive the message key that is being sent from an outside CACC enabled vehicle. Relationship s Aggregates Sensors. Element Name Security Module This is an embedded Hardware Security Module (ehsm) that takes the message keys sent by other vehicles and are received by the Network Receiver and determines their validity. Operations verifykey( int key ) : bool Determine if the received message key from another vehicle is valid and secure. Relationship s Aggregates the Network Receiver. Element Name Controllers Relationships This is the brain of the system. It takes in information about the environment from all the sensors, processes that information with either the Main Controller, Platoon Controller, or Speed Controller, decides on the right course of action to take, and sends the signals to the vehicle actuators. Association with Actuators, which is actuates, and Sensors, which it receives informative input from. Composed of a Main Controller, Speed Controller, and Platoon Controller Element Name Main Controller This is the controller that will maintain the operating environment information. This controller will constantly be monitoring for system and subsystem failure based on input from the radars, camera, network receiver, braking and acceleration performance. This controller will also monitor other vehicle systems, such as the ABS, for signs of adverse road conditions. The controller will determine vehicle actuation limits based on this 29

30 information. Operations checkspeed( ) : int checktasks() : bool Return the current speed of the vehicle, which is maintained under operating environment information. Monitor all running and queued tasks. Detect failures to start and end tasks. If there are no failures, return false. Relationships Composes Controllers, and is a subclass of Controller. Element Name Speed Controller This controller will take input from the radars, camera, and Steering Buttons to maintain a safe vehicle speed by actuating the vehicle s brakes and throttle. Attributes cruisespeed : int The commanded cruising speed, as set by the driver. Determined based on input from the Enable button and the current vehicle speed. Operations accelerate( int speed ) : void decelerate( int speed ) : void Send a signal to the throttle to accelerate the amount of input speed. Send a signal to the throttle to decelerate the amount of input speed Relationships Composes Controllers, and is a subclass of Controller. Element Name Platoon Controller This is the controller that takes input from the radar, camera, and network receiver, and actuates the network transmitter, and dashboard screen. The platoon controller will determine if there are nearby CACC enabled vehicles, it will form potential platoons with these vehicles and determine braking and acceleration maneuvers. 30

31 Attributes keys : int array Array of vehicle keys for every vehicle in the current platoon. Operations vehiclenear( ) : bool brakemaneuver(keys) : void accelmaneuver(keys) : void Determines if there is a vehicle near based on input from the network receiver, radars, and camera. Determine the platoon braking maneuver with the array of keys for every vehicle in the platoon. Determine the platoon acceleration maneuver with the array of keys for every vehicle in the platoon. Relationships Composes Controllers, and is a subclass of Controller. Element Name Controller This is the brain of the system. It takes in information about the environment from sensors, processes that information, decides on the right course of action, and sends the signals to the actuators. Attributes Speed : int The current speed of the vehicle. Operations enable() : void Enable to controller to begin processing information and sending signals to the actuators. Relationships Superclass of Main Controller, Speed Controller, and Platoon Controller. Element Name Actuators These are the components of the system that can affect the environment. They all take signals/commands from the Controllers and carry out their tasks as specified by the controller. These have the most visible effects of the system as they affect the environment directly. 31

32 Relationships Association with Controllers. Element Name Brakes The vehicle s primary brakes, and they are crucial in stopping and slowing down the vehicle. The Speed Controller sends signals to this actuator in the event that the vehicle needs to slow down or stop quickly due to obstacle(s) ahead, in order to avoid a collision. Operations brake( int force ) : void emergencybrake() : void Brake the vehicle with the amount of force indicated by the Speed Controller. Brake the vehicle with the max force. Relationships Aggregates the Actuators Element Name Network Transmitter This is the system s network component that enables the vehicle to be able to communicate with another vehicle in the platoon. It enables the vehicle to send GPS information to their respective trailing and leading vehicles. This actuator is sent signals and information from the Platoon Controller. Operations sendinfo( ) : void Send information from the Platoon Controller to nearby CACC equipped vehicles. Relationships Aggregates the Actuators Element Name Throttle This actuator is used to adjust the speed of the car electronically. It controls how fast the vehicle accelerates or decelerates within the vehicle s capability. It receives input from the Speed Controller, after the controller has processed input from the Sensors, and accelerates or decelerates the vehicle as specified by the controller. Operations accelerate( int speed ) : void Accelerates the throttle as much as the input speed. 32

33 decelerate( int speed ) : void Decelerates the throttle as much as the input speed. Relationships Aggregates the Actuators. Element Name Dashboard Screen This is the dashboard screen actuator that is embedded in the vehicle. This screen allows the system to communicate with the driver by displaying messages. Operations screenon( ) : void Activates the dashboard screen. displaymessage ( string ) : void Displays the input string on the dashboard screen. Relationships Aggregates the Actuators Element Name Driver Relationships The operator of the vehicle that is equipping the system. Association with CACC System, Screen Button, and Button. 33

34 Sequence Diagrams Cooperative Adaptive Cruise Control Below are the sequence diagrams for the CACC2 system. This diagrams represent the sequential behavior of the system. The sequence diagrams are modeled after system scenarios. 1. Scenario 1: The driver activates the vehicle, and increases their speed manually until they reach 66 mph. The driver presses the enable button on the steering wheel, enabling cruise. The vehicle s cruising speed is set to the current vehicle speed. The driver holds the accelerate button to increase the cruising speed to 70 mph. There is a platoon ahead of the vehicle going slower. The system decelerates the throttle to match their speed, which is currently 65 mph. A message is displayed on the dashboard screen to invite the driver to join the platoon. The driver selects accept platoon on the dashboard screen. The driver decides to exit the platoon, selecting cancel platoon on the dashboard screen, and maneuvering to an adjacent lane. The system accelerates the throttle to return to the commanded speed of 70 mph, which was set before the driver joined the platoon. 34

35 2. Scenario 2: The driver is driving down a highway, and engages CACC. This sets the ACC speed of the vehicle to the current speed. As the vehicle continues, it approaches a different vehicle, which is moving at a slower speed. The slower vehicle is not equipped with a CACC system, so neither vehicle is prompted to join a platoon. Instead, the normal ACC system of the faster vehicle decelerates the vehicle to the speed of the slower vehicle in front. The speed of the vehicle in front will be matched by the trailing vehicle, unless it exceeds the set speed of the trailing vehicle s ACC system. 3. Scenario 3: The driver s vehicle is in a platoon of four vehicles, being second to last in line. The vehicle in front of the driver engages its turn signal, and leaves the platoon, breaking the platoon into two smaller parts. The driver is now the lead vehicle of a smaller platoon, consisting of the driver s vehicle, and the vehicle behind. If this platoon catches up to the original lead vehicle, then the driver is prompted to join a platoon with the vehicle in front. If both vehicles have agreed, then the original lead vehicle once again becomes the lead vehicle, and the driver s vehicle, and the vehicle behind the driver are integrated into the platoon. 35

36 4. Scenario 4: The driver is driving down a highway with CACC engaged, without being part of a platoon. The driver is approaching a slower vehicle in front. There is another vehicle in an adjacent lane that is moving closer to the driver s set speed, so the driver changes lanes to be behind that vehicle instead. The vehicle in front also has CACC, so the driver is prompted to join a platoon. The driver was not prompted to join a platoon with this vehicle before, because the vehicles were in different lanes. The driver declines. After passing the original slower vehicle, both the driver and the vehicle in front move back into the other lane. Both drivers are now prompted to join a platoon again, due to the lane change. 5. Scenario 5: The driver s vehicle is in a platoon of four vehicles, being second to last in line. A vehicle suddenly and dangerously cuts in front of the driver s vehicle. The original platoon of four vehicles is split into two separate platoons of two vehicles by the intrusion. The platoon of two vehicles in front of the incident continues on normally. However, the platoon of two vehicles behind the incident needs to take emergency action. If the driver s vehicle detects that any adjacent lanes are clear, it will prompt the driver to change lanes. If a lane change is not possible, the vehicle will automatically hard-brake to mitigate damage from the impending collision. 36

37 State Diagram Cooperative Adaptive Cruise Control Below is the state diagram for the CACC2 system. This diagram represents the functional states of the system, and the appropriate events that cause transitions between these states. The textual description is below the diagram. 37