D-Case Modeling Environment Integration. Demonstration. Cruise Control System Specification

D-Case Modeling Environment Integration Demonstration Cruise Control System Specification /6

Table of Contents Scope...4. Objective...4.2 Definition of words...4 2 System Architecture...4 2. System Architecture Outline...4 2.2 Main Elements of the System...4 3 Function...5 4 Constraints...5 4. Constraints for Development Process...5 4.2 Architecture and Constraints of the System...5 4.3 Circumference System, Hardware, or Software...5 5 Use Case...6 6 Detail Function...7 6. Requirements about Functions...7 6.2 Requirements about Performance, Quality...7 6.3 Requirements about Functional Safety...8 7 Hazard Analysis...8 7. Hazard Analysis by HAZOP...8 7.2 Hazard Analysis by FTA...8 7.3 Influence Analysis by FMEA...9 8 Function Block Outline...0 8. Block Definition Diagram...0 8.2 Functional Block Consisting of the System...0 8.3 Relation of Use Case and Function Block...2 8.4 Relation of Constraints...3 8.5 State Machine Diagram...6 2/6

Revision History Revised Date Description 204/0/27 Created 3/6

Scope. Objective This document describes the specification of the cruise control system development used for demonstration of D-Case and SysML collaboration..2 Definition of words ID Abbreviation Word Meaning CC Cruise Control The function to maintain the speed without continuing stepping on an accelerator. 2 PCS Pre-Crash Safety The function which supports collision evasion with an obstacle. 2 System Architecture 2. System Architecture Outline Operation UI Cruise Set Accel Decel Resume Break PCS Op. signal Stop signal Cruise Control (CC) Break signal Monitor circuit Controller Speed control Throttle Figure System architecture 2.2 Main Elements of the System Element ID Element Description C_0 Operation UI UI which arranges the button for a driver to direct cruise control C_02 Break Brake mechanism for a driver to slow down or stop a car 4/6

C_03 The controller for judging the control scheme of cruise control C_04 Throttle Actuator to control speed C_05 Monitor circuit The circuit which CC operates as operation of a driver intention and supervises that acceleration is proper within the limits 3 Function Cruise Control (CC) system controls speed set by driver. 4 Constraints 4. Constraints for Development Process [CY_0] Derivation development is adopted. Next system has functional safety based on ISO 26262. [CY_02] CC is safe. 4.2 Architecture and Constraints of the System [CY_] CC has 5 buttons on UI: Cruise, Set, Accel, Decel, and Resume. [CY_2] Driver controls CC via UI and brake pedal. [CY_3] Driver can always set CC in driving the car. 4.3 Circumference System, Hardware, or Software Type Name Version OS which is used. xxx.23 5/6

5 Use Case uc [ パッケージ ] Design [UC_CC] CC CC boot CC stop Speed monitor Target speed setting Driver Target speed-up Speed control Target speed-down CC pause CC condition monitor Throttle CC resume CC emergency stop PCS Figure 2 Use Case Diagram Use Case ID Name Description UC_0 CC boot CC is booted. UC_02 CC stop Return controls to the driver UC_03 Target speed setting Set the target speed. UC_04 Target speed-up Raise the target speed. UC_05 Target speed-down Lower the target speed. UC_06 CC pause Temporarily return controls to the driver. UC_08 CC resume Resume CC which has been paused. UC_09 Speed control Control speed of the vehicle. UC_0 CC condition monitor Monitor the CC condition. UC_ CC emergency stop Emergently stop CC if some abnormity is detected. UC_2 Speed monitor Monitor the speed of the vehicle. 6/6

6 Detail Function CC is requested to realize the following functions by CC program which is developed. req [ パッケージ ] Design [REQ_CC] ID = REQ_0 CC Vehicle has cruise control features that support a driver. CC boot (Cruise) ID = REQ_02 Target speed setting (Set) Target speed-down (Decel) Target speed-up (Accel) CC pause CC resume (Resume) CC stop (Cruise) ID = REQ_03 ID = REQ_04 ID = REQ_05 ID = REQ_06 ID = REQ_07 ID = REQ_08 CC stop (PCS) ID = REQ_09 Acceleration suppression control ID = REQ_2 Speed monitor ID = REQ_22 CC emergency stop ID = REQ_23 CC condition monitor ID = REQ_24 If a driver pushes the Cruise button when CC stops, CC should boot. If a driver pushes the Set button when CC boots, CC should set the current speed as a target speed. If a driver pushes the Decel button when CC boots, the target speed should decrease. If a driver pushes Accel button when CC boots, the target speed should increase. If a driver puts on the break when CC runs, CC should pause. If a driver pushes Resume button when CC pauses, CC should resume with the same setting as before pause. If a driver pushes Cruise button when CC runs, CC should stop. If a stop request is received from PCS when CC runs, CC should stop. Acceleration suppression control is performed so that acceleration is less than threshold. Speed is monitored. CC urgently stops when trouble is detected. CC condition is monitored. Operability Quick response to operation Acceleration performance Continuous duty Priority of driver operation Config Integrity Speed limit Acceleration limit ID = REQ_ ID = REQ_2 ID = REQ_4 ID = REQ_5 ID = REQ_6 ID = REQ_7 ID = REQ_8 ID = REQ_3 CC can be operated by one-touch. CC responds within ms when driver operates. When the difference of speed and target speed is more than 20km/h, acceleration should be more than 0.080G. Continuous duty of CC is carried out for more than 00 hours. Top priority is given to the driver operation : accelerator operation, brake operation, and steering operation. Configurati on data should not be changed unjustly. Target speed is restricted from 50 km/h to 00km/h. Acceleration is less than 0.35G. Figure 3 Requirement Diagram 6. Requirements about Functions [REQ_0] Vehicle has cruise control features that support a driver. [REQ_02] If a driver pushes the Cruise button when CC stops, CC should boot. [REQ_03] If a driver pushes the Set button when CC boots, CC should set the current speed as a target speed. [REQ_04] If a driver pushes the Decel button when CC boots, the target speed should decrease. [REQ_05] If a driver pushes Accel button when CC boots, the target speed should increase. [REQ_06] If a driver puts on the break when CC runs, CC should pause. [REQ_07] If a driver pushes Resume button when CC pauses, CC should resume with the same setting as before pause. [REQ_08] If a driver pushes Cruise button when CC runs, CC should stop. [REQ_09] If a stop request is received from PCS when CC runs, CC should stop. 6.2 Requirements about Performance, Quality [REQ_] CC can be operated by one-touch. [REQ_2] CC responds within ms when driver operates. [REQ_3] Acceleration is less than 0.35G. [REQ_4] When the difference of speed and target speed is more than 20km/h, acceleration should be more than 0.080G. [REQ_5] Continuous duty of CC is carried out for more than 00 hours. [REQ_6] Top priority is given to the driver operation : accelerator operation, brake operation, and steering operation. 7/6

[REQ_7] Configuration data should not be changed unjustly. [REQ_8] Target speed is restricted from 50 km/h to 00km/h. 6.3 Requirements about Functional Safety [REQ_2] Acceleration suppression control is performed so that acceleration is less than threshold. [REQ_22] Speed is monitored. [REQ_23] CC urgently stops when trouble is detected. [REQ_24] CC condition is monitored. 7 Hazard Analysis 7. Hazard Analysis by HAZOP ID Output Guide Word Situation Hazard H _0 CC More After CC boots Excessive acceleration Controller from driver's intention H_02 CC No or not Break is stepped Different CC condition Controller on after CC bots from driver's intention 7.2 Hazard Analysis by FTA [H_0] Excessive acceleration from driver's intention after CC boots. Acceleration request is excessive. [F_0] Operation failure of acceleration request by CC controller. Target speed directed by operation UI is excessive. Value of speed sensor is too small. [F_02] Operation failure of target speed by. [F_03] Failure of speed sensor. Figure 4 FTA Diagram () 8/6

[H_02] Different CC condition from driver's intention when a break is stepped on after CC boots. Break signal is not transmitted. [F_04] Operation failure of control by. [F_05] Failure by signal route. [F_06] Signal send failure by break. [F_07] Receive failure by CC controller. Figure 5 FTA Diagram (2) ID 7.3 Influence Analysis by FMEA F_0 CC Controller F_02 CC Controller Operation failure (acceleration request) Operation failure (target speed) Program bug 6 (M) (L) 5 (M) 30 Program bug 3 (L) (L) (L) 3 F_03 Speed sensor Abnormal value Breakdown 9 (H) 5 (M) (L) 45 F_04 CC Operation failure Program bug 9 (H) (L) (L) 9 Controller (control) F_05 Transmission route F_06 Brak Component Failure mode Factor F_07 CC Controller Severity of influence Frequen cy Difficulty of detection Risk priority Abnormal value Breakdown 9 (H) 5 (M) (L) 45 Operation failure (send) Breaking of wire 9 (H) (L) (L) 9 Operation failure Breaking of (receive) wire 9 (H) (L) 5 (M) 45 S/W [A_0] Acceleration suppression control [A_03] CC emergency stop Provision H/W [A_02] Speed monitor circuit [A_04] CC condition monitor circuit 9/6

8 Function Block Outline 8. Block Definition Diagram bdd [ パッケージ ] Design [ ] Vehicle Acceleration Break PCS controller Front obstacle detection S p eed sensor Electronic throttle Throttle actuator CC User I/F S p eed control Electronic break Break actuator Speed monitor circuit Vehicle dy namics controller CC condition monitor circuit Figure 6 Block Definition Diagram 8.2 Functional Block Consisting of the System Block ID Block Name Description Role Related Allotment Block ID BL_0 Control cruise. S/W BL_02 BL_08 BL_02 PCS controller Control PCS. S/W BL_0 BL_03 Break Transmit break signals to Trans: S/W BL_0 CC. BL_04 Front obstacle Detect front obstacles Trans: S/W BL_03 detection sensor and transmit to PCS. BL_05 Speed sensor Transmit speed to CC Trans: S/W BL_0 controller. BL_06 Electronic Transmit acceleration Trans: S/W BL_07 throttle requests to actuator. BL_07 Throttle Actuate throttle. Trans: S/W BL_06 actuator 0/6

BL_08 Vehicle A vehicle including CC. S/W and BL_0 H/W BL_09 CC User I/F Transmit operation User UI: BL_03 signals directed by driver to CC. H/W, Trans: S/W BL_0 Speed monitor Monitor acceleration that Trans: S/W, BL_ circuit speed is proper within Circuit : the limits. H/W BL_ Speed control Calculate acceleration S/W BL_0 request based on condition of acceleration, break, and. BL_2 Vehicle dynamics controller Simulate vehicle speed and acceleration. S/W BL_05 BL_07 BL_3 Acceleration Transmit acceleration Trans: S/W BL_0 signals to CC. BL_4 CC condition Monitor that CC operates Trans: S/W, BL_ monitor circuit as operation of a driver Circuit : intention and supervises H/W that acceleration is proper within the limits. BL_5 Electronic Transmit break request Trans: S/W BL_6 break to actuator. BL_6 Break actuator Drive a break. Trans: S/W BL_5 /6

ibd [Block] Speed monitor circuit [IBD_Speed monitor circuit] Read speed Judge Send failure message speed speed Attributes Speed Speed Attributes Result Result Attributes poweroff poweroff <<flow>> <<flow>> Figure 7 Internal Block Diagram 8.3 Relation of Use Case and Function Block Use Case ID Use Case Name Block ID Block Name UC_0 CC boot BL_0 BL_09 UC_02 CC stop BL_0 BL_09 UC_03 Target speed BL_0 setting BL_05 BL_09 UC_04 Target speed-up BL_0 BL_09 UC_05 Target BL_0 speed-down BL_09 UC_06 CC pause BL_0 BL_03 UC_08 CC resume BL_0 BL_09 CC User I/F CC User I/F Speed sensor CC User I/F CC User I/F CC User I/F Break CC User I/F 2/6

UC_09 Speed control BL_ Speed control UC_0 CC condition BL_4 CC condition monitor monitor circuit UC_ CC emergency BL_0 stop UC_2 Speed monitor BL_0 Speed monitor circuit 8.4 Relation of Constraints par [ パッケージ ] Design [PAR_Vehicle ] Target speed limit : 50km/h <= vt <= 00km/h. pwr = Kp ( Vp - Vt ) + Ki (Vp - Vt ) dt Acceleration Break Speed sensor Electronic throttle Throttle actuator CC User I/F accelpower breakpower accelpowertarget breakpowertarget poweroff ccpower ccbtn speed speed throttletorque pwr pwr ccbtn ccpower Speed control breakpowertarget throttletorque Electronic break Break actuator breakpower breaktorque breaktorque pwr pwr accelpowertarget accelpower poweroff CC condition monitor circuit speed ccbtn poweroff speed Speed monitor circuit Acceleration limit : a < 0.35G. speed pwr Vehicle dynamics controller Acceleration performance : a > 0.080G. Cd = 0.44 Cd = 0.50 A =.8 m^2 A = 2.0 m^2 mass = 700 kg mass = 2500 kg densityofair =.2 kg/m^3 thrust = pwr / actualspeed drag = -/2 * Cd * A * densityofair * actualspeed^2 a = (thrust + drag) / mass actualspeed = a dt + v0 Figure 8 Parametric Diagram 3/6

par [ パッケージ ] Design [PAR_relations] Restriction or requirement about acceleration Acceleration limit : a < 0.35G. Acceleration performance : a > 0.080G. Target speed limit : 50km/h <= vt <= 00km/h. pwr = Kp ( Vp - Vt ) + Ki (Vp - Vt ) dt Restriction about system architecture Cd = 0.44 Cd = 0.50 A =.8 m^2 A = 2.0 m^2 mass = 700 kg mass = 2500 kg Requirement about other subsystem densityofair =.2 kg/m^3 thrust = pwr / actualspeed drag = -/2 * Cd * A * densityofair * actualspeed^2 a = (thrust + drag) / mass actualspeed = a dt + v0 Figure 9 Parametric Diagram (relations) Constraint Block ID Constraint Block Name Description PAR_0 Restriction of acceleration limit PAR_02 Restriction of acceleration performance PAR_03 Restriction of speed limit PAR_04 Restriction of PI control PAR_05 Restriction of projected area Acceleration limit : a < 0.35G. Acceleration performance : a > 0.080G. Target speed limit : 50km/h <= vt <= 00km/h. pwr = Kp ( Vp - Vt ) + Ki (Vp - Vt ) dt A =.8 m^2 4/6

A = 2.0 m^2 PAR_06 Restriction of vehicle mass mass = 700 kg mass = 2500 kg PAR_07 Restriction of Cd value Cd = 0.44 Cd = 0.50 PAR_08 Restriction of air densityofair =.2 kg/m^3 density PAR_09 Restriction of thrust thrust = pwr / actualspeed PAR_0 Restriction of drag drag = -/2 * Cd * A * densityofair * actualspeed^2 PAR_ Restriction of equation of motion a = (thrust + drag) / mass PAR_2 Restriction of speed actualspeed = a dt + v0 5/6

8.5 State Machine Diagram stm [Block] CcController [statechart_0] running init cyclems tm()/ if (this->isworking) { double diffvelocity = (this->targetvelocity - this->velocity) / 3.6; // [m/s] this->sumdvelocity += diffvelocity; this->power += Kp * diffvelocity + Ki * this->sumdvelocity; if(this->power > this->maxpower) this->power = this->maxpower; if(this->power < -this->maxpower) this->power = -this->maxpower; } else { this->power = 0.0; } evpoweroff evaccpowerrequest(this->power) to itsarbitrationcontroller Off evacccruisebtn evacccruisebtn Unset On evaccoff evaccsetbtn[valid(this->velocity)]/ set(this->velocity); Working evaccbreakpedal evaccresumebtn Sleeping evaccsetbtn/ set(this->velocity); evaccaccelbtn/ evaccdecelbtn/ accel(); decel(); evaccsetbtn/ set(this->velocity); evaccaccelbtn/ accel(); evaccdecelbtn/ decel(); sensoring evspeedchanged/ this->velocity = params->velocity; Figure 0 State Machine Diagram 6/6