An element that can be defined stand-alone, i.e. without being part of another element (except for packages of course). Root element of an AUTOSAR description, also the root element in corresponding XML documents. Root element of an AUTOSAR description, also the root element in corresponding XML documents. Root element of an AUTOSAR description, also the root element in corresponding XML documents. An AUTOSAREvent instance refers to an event of the form defined by AUTOSAR. An AUTOSAREvent instance refers to an event of the form defined by AUTOSAR. Actor represents a type of role played by an entity that interacts with the UseCase, e.g. by exchanging signals and data, but which is external to the subject, i.e., in the sense that an instance of an Actor is not a part of the instance of its corresponding subject. Actors may represent roles played by human users, external hardware, or other subjects. Note that an Actor does not necessarily represent a specific physical entity but merely a particular facet (i.e., "role") of some entity that is relevant to the specification of its associated UseCases. Thus, a single physical instance may play the role of several different Actors and, conversely, a given Actor may be played by multiple different instances. Since an Actor is external to the subject, it is typically defined in the same classifier or package that incorporates the subject classifier. Semantics: The Actor element represents entities that interacts with a UseCase. Actor represents a type of role played by an entity that interacts with the UseCase, e.g. by exchanging signals and data, but which is external to the subject, i.e., in the sense that an instance of an Actor is not a part of the instance of its corresponding subject. Actors may represent roles played by human users, external hardware, or other subjects. Note that an Actor does not necessarily represent a specific physical entity but merely a particular facet (i.e., "role") of some entity that is relevant to the specification of its associated UseCases. Thus, a single physical instance may play the role of several different Actors and, conversely, a given Actor may be played by multiple different instances. Since an Actor is external to the subject, it is typically defined in the same classifier or package that incorporates the subject classifier. Semantics: The Actor element represents entities that interacts with a UseCase. The Actuator is the element that represents electrical actuators, such as valves, motors, lamps, brake units, etc. Non-electrical actuators such as the engine, hydraulics, etc. are considered part of the plant model (environment). Plant models are not part of the Hardware Design Architecture. Semantics: The Actuator metaclass represents the physical and electrical aspects of actuator hardware. The logical aspect is represented by a HardwareFunctionType associated with the Actuator. Notation: Actuator is shown as a solid-outline rectangle with double vertical borders. The rectangle contains the name, and its ports or port groups on the perimeter. atpType The Actuator is the element that represents electrical actuators, such as valves, motors, lamps, brake units, etc. Non-electrical actuators such as the engine, hydraulics, etc. are considered part of the plant model (environment). Plant models are not part of the Hardware Design Architecture. Semantics: The Actuator metaclass represents the physical and electrical aspects of actuator hardware. The logical aspect is represented by a HardwareFunctionType associated with the Actuator. Notation: Actuator is shown as a solid-outline rectangle with double vertical borders. The rectangle contains the name, and its ports or port groups on the perimeter. atpType An AgeConstraint defines how long before each response a corresponding stimulus must have occurred. This constraint provides an alternative to the ordinary DelayConstraint for situations where the causal relation between event occurrences must be taken into account. It differs from the DelayConstraint in that it applies to an event chain, and only looks at the stimulus occurrences that have the same color as each particular response occurrence. It is the latest of these stimulus occurrences that is required to lie within the prescribed time bounds. If the roles of stimulus and response are swapped, and the time bounds negated, a ReactionConstraint is obtained. Semantics: A system behavior satisfies an AgeConstraint c if and only if for each occurrence y in c.scope.response, there is an occurrence x in c.scope.stimulus such that x.color = y.color and x is maximal in c.scope.stimulus with that color and c.minimum <= y - x <= c.maximum An AgeConstraint defines how long before each response a corresponding stimulus must have occurred. This constraint provides an alternative to the ordinary DelayConstraint for situations where the causal relation between event occurrences must be taken into account. It differs from the DelayConstraint in that it applies to an event chain, and only looks at the stimulus occurrences that have the same color as each particular response occurrence. It is the latest of these stimulus occurrences that is required to lie within the prescribed time bounds. If the roles of stimulus and response are swapped, and the time bounds negated, a ReactionConstraint is obtained. Semantics: A system behavior satisfies an AgeConstraint c if and only if for each occurrence y in c.scope.response, there is an occurrence x in c.scope.stimulus such that x.color = y.color and x is maximal in c.scope.stimulus with that color and c.minimum <= y - x <= c.maximum The AllocateableElement is an abstract superclass for elements that are allocateable. Semantics: The AllocateableElement abstracts all elements that are allocateable. Subclasses of the abstract class AllocateableElement add their own semantics. Extension: abstract, no extension The Allocation element contains function allocations. It can bundle function allocations that belong together, e.g., all function allocations for a simulation. Semantics: The Allocation element contains function allocations, i.e., it can bundle function allocations that belong together. Extension: Class The Allocation element contains function allocations. It can bundle function allocations that belong together, e.g., all function allocations for a simulation. Semantics: The Allocation element contains function allocations, i.e., it can bundle function allocations that belong together. Extension: Class The AllocationTarget is a superclass for elements to which AllocateableElements can be allocated. Semantics: An AllocationTarget is a resource element in the Hardware Design Architecture which may host functional behaviors in the Functional Design Architecture. Extension: abstract, no extension The AnalysisFunctionPrototype represents references to the occurrence of the AnalysisFunctionType that types it when it acts as a part. The AnalysisFunctionPrototype is typed by an AnalysisFunctionType. Semantics: The AnalysisFunctionPrototype represents an occurrence of the AnalysisFunctionType that types it. Extension: UML Property, specialization of SysML::BlockProperty atpPrototype isOfType The AnalysisFunctionPrototype represents references to the occurrence of the AnalysisFunctionType that types it when it acts as a part. The AnalysisFunctionPrototype is typed by an AnalysisFunctionType. Semantics: The AnalysisFunctionPrototype represents an occurrence of the AnalysisFunctionType that types it. Extension: UML Property, specialization of SysML::BlockProperty atpPrototype The AnalysisFunctionType is a concrete FunctionType and therefore inherits the elementary function properties from the abstract metaclass FunctionType. The AnalysisFunctionType is used to model the functional structure on AnalysisLevel. The syntax of AnalysisFunctionTypes is inspired from the type-prototype pattern used by AUTOSAR. The AnalysisFunctions may interact with other AnalysisFunctions (i.e., also FunctionalDevices) through their FunctionPorts. Furthermore, an AnalysisFunction may be decomposed into contained parts that are AnalysisFunctionPrototypes. This allows the functionalities provided by the parent AnalysisFunction to be broken up hierarchically into subfunctionalities. A FunctionBehavior may be associated with each AnalysisFunction. In the case where the AnalysisFunction is decomposed, the behavior is a specification for the composed behavior of the parts. Semantics: The AnalysisFunctionType represents a node in a tree structure corresponding to the functional decomposition of a top level AnalysisFunction. The AnalysisFunction represents the analysis function used to describe the functionalities provided by a vehicle on the AnalysisLevel. At the AnalysisLevel, AnalysisFunctions are defined and structured according to the functional requirements, i.e., the functionalities provided to the user. Constraints: [1] AnalysisFunctionTypes may only be used on AnalysisLevel. Extension: UML Class, specialization of SysML::Block atpType The AnalysisFunctionType is a concrete FunctionType and therefore inherits the elementary function properties from the abstract metaclass FunctionType. The AnalysisFunctionType is used to model the functional structure on AnalysisLevel. The syntax of AnalysisFunctionTypes is inspired from the type-prototype pattern used by AUTOSAR. The AnalysisFunctions may interact with other AnalysisFunctions (i.e., also FunctionalDevices) through their FunctionPorts. Furthermore, an AnalysisFunction may be decomposed into contained parts that are AnalysisFunctionPrototypes. This allows the functionalities provided by the parent AnalysisFunction to be broken up hierarchically into subfunctionalities. A FunctionBehavior may be associated with each AnalysisFunction. In the case where the AnalysisFunction is decomposed, the behavior is a specification for the composed behavior of the parts. Semantics: The AnalysisFunctionType represents a node in a tree structure corresponding to the functional decomposition of a top level AnalysisFunction. The AnalysisFunction represents the analysis function used to describe the functionalities provided by a vehicle on the AnalysisLevel. At the AnalysisLevel, AnalysisFunctions are defined and structured according to the functional requirements, i.e., the functionalities provided to the user. Constraints: [1] AnalysisFunctionTypes may only be used on AnalysisLevel. Extension: UML Class, specialization of SysML::Block atpType The AnalysisLevel represents the vehicle electrical/electronic system in terms of its abstract functional definition. It includes the functional analysis architecture (FAA), which represents the functional structure. Semantics: AnalysisLevel represents the vehicle electrical/electronic system in terms of its abstract functional definition. It defines the logical functionality and a logical decomposition of functionality down to the appropriate granularity. Notation: The Analysis Architecture is shown as a solid-outline rectangle containing the name, with its ports or port groups on the perimeter. Contained entities may be shown with their connectors (White-box view). Extension: Class atpStructureElement The AnalysisLevel represents the vehicle electrical/electronic system in terms of its abstract functional definition. It includes the functional analysis architecture (FAA), which represents the functional structure. Semantics: AnalysisLevel represents the vehicle electrical/electronic system in terms of its abstract functional definition. It defines the logical functionality and a logical decomposition of functionality down to the appropriate granularity. Notation: The Analysis Architecture is shown as a solid-outline rectangle containing the name, with its ports or port groups on the perimeter. Contained entities may be shown with their connectors (White-box view). Extension: Class atpStructureElement The Anomaly metaclass represents a Fault that may occur internally in an ErrorModel or be propagated to it, or a Failure that is propagated out of an Error Model. The anomaly may represent different Faults or Failures depending on the range of its EADatatype. Typically, the EADatatype is an Enumeration, for example: BrakeAnomaly: - BrakePressureTooLow Semantics="brake pressure is below 20% of requested value" - Omission Semantics="brake pressure is below 10% of maximal brake pressure" - Comission Semantics="brake pressure exceeds requested value with more than 10% of maximal brake pressure" Semantics may also be a more formal expression defining in the type of the nominal datatype what value range is considered a fault. This depends on the user and tooling available. Semantics: An anomaly refers to a condition that deviates from expectations based on requirements specifications, design documents, user documents, standards, etc., or from someone's perceptions or experiences (ISO26262). The set of available faults or failures represented by the Anomaly is defined by its EADatatype, typically an enumeration type like {omission, commission}. It is an abstract class further specialized with metaclasses for different types of fault/failure. Extension: (UML::Part) atpPrototype isOfType An ArbitraryConstraint describes an event that occurs irregularly. An ArbitraryConstraint is equivalent to a combination of Repeat constraints, each one constraining sequences of i+1 occurrences (that is, i repetition spans), with i ranging from 1 to some given n. Constraints: [1] The number of elements in minimum and maximum must be equal. Semantics: A system behavior satisfies an AribtraryConstraint c if and only if for each c.minimum index i, the same system behavior satisfies RepeatConstraint { event = c.event, lower = c.minimum(i), upper = c.maximum(i), span = i } An ArbitraryConstraint describes an event that occurs irregularly. An ArbitraryConstraint is equivalent to a combination of Repeat constraints, each one constraining sequences of i+1 occurrences (that is, i repetition spans), with i ranging from 1 to some given n. Constraints: [1] The number of elements in minimum and maximum must be equal. Semantics: A system behavior satisfies an AribtraryConstraint c if and only if for each c.minimum index i, the same system behavior satisfies RepeatConstraint { event = c.event, lower = c.minimum(i), upper = c.maximum(i), span = i } A collection of products to document an architecture. [IEEE 1471] A collection of products to document an architecture. [IEEE 1471] A view may consist of one or more architectural models. Each such architectural model is developed using the methods established by its associated architectural viewpoint. An architectural model may participate in more than one view. [IEEE 1471] A view may consist of one or more architectural models. Each such architectural model is developed using the methods established by its associated architectural viewpoint. An architectural model may participate in more than one view. [IEEE 1471] The fundamental organization of a system embodied by its components, their relationships to each other, and to the environment, and the principles guiding its design and evolution. [IEEE 1471] The fundamental organization of a system embodied by its components, their relationships to each other, and to the environment, and the principles guiding its design and evolution. [IEEE 1471] Specification of an array of the typing EADatatype. All elements of the ArrayDatatype have the same datatype. Semantics: ArrayDatatype is a datatype for an array of datatypes of the same type. Notation: The datatype ArrayDatatype is denoted using the rectangle symbol with keyword «Datatype ArrayDatatype». atpType The maximum number of values in this array. Unbounded if not provided. The minimum number of values in this array. Specification of an array of the typing EADatatype. All elements of the ArrayDatatype have the same datatype. Semantics: ArrayDatatype is a datatype for an array of datatypes of the same type. Notation: The datatype ArrayDatatype is denoted using the rectangle symbol with keyword «Datatype ArrayDatatype». atpType A classifier classifies M0 instances according to their features. Or: a classifier is something that has instances - an M1 classifier has M0 instances. Features are properties via which a classifier classifies instances. Or: a classifier has features and every M0 instance of it will have those features. An M0 instance of a classifier may be represented as a tree rooted at that instance, where under each node come the subrtees representing the instances which act as features under that node. An instance ref specifies a navigation path from any M0 tree-instance of the base (which is a classifier) to a leaf (which is an instance of the target). instanceRef A prototype is a typed feature. A prorotype in a classifier indicates that instances of that classifier will have a feature, and the structure of that feature is given by the its type. An instance of that type will play the role indicated by the feature in the owning classifier. A feature is not an instance but an indication of an instance-to-be. A structure element is both a classifier and a feature. As a feature, its structure is given by the feature it owns as a classifier. A type is a calssifier that may serve to type prototypes. It is a reusable classifier. The attribute (Attribute) denotes a parameter or argument of a behavior constraint specification. An attribute can be a constant, simple, or complex data, given by the corresponding EAST-ADL data types (EADataType) for the related meta-information like unit, valid range, required accuracy, etc. An attribute can represent an in-, out-, or local-quantity to be processed. If an attribute is externally visible (isExternVisble = true), it denotes an input or output variable and has associated structural ports given by the function ports for the external accesses. Attributes are instantiation parameters (BehaviorInstantiationParameter), to which certain values can be assigned when a behavior constraint type is instantiated as behavior constraint instances (i.e. prototypes) in certain specification contexts. Constraint: An attribute must be typed by EADataType. Semantics: The attributes of a behavior constraint specification is a subset of elements in the vector space of R^n, where R is the real number and n is a natural number defining the dimension of vector space. atpPrototype isOfType The attribute (Attribute) denotes a parameter or argument of a behavior constraint specification. An attribute can be a constant, simple, or complex data, given by the corresponding EAST-ADL data types (EADataType) for the related meta-information like unit, valid range, required accuracy, etc. An attribute can represent an in-, out-, or local-quantity to be processed. If an attribute is externally visible (isExternVisble = true), it denotes an input or output variable and has associated structural ports given by the function ports for the external accesses. Attributes are instantiation parameters (BehaviorInstantiationParameter), to which certain values can be assigned when a behavior constraint type is instantiated as behavior constraint instances (i.e. prototypes) in certain specification contexts. Constraint: An attribute must be typed by EADataType. Semantics: The attributes of a behavior constraint specification is a subset of elements in the vector space of R^n, where R is the real number and n is a natural number defining the dimension of vector space. atpPrototype Attribute quantification constraints (AttributeQuantificationConstraint) are concerned with the value conditions of attributes underlying a behavior on a timeline. They are useful for declaring the variables (e.g. the input-, output- and internal variables of a function), their expected values and logical relations. An attribute quantification constraint can be expressed either by simple equations like F = m*a, V >= 90, or dynamics models. When necessary, the straints on computational operations for data transformations and value assignment can be declared through the computation constraints (ComputationConstraint). Semantics: The attribute quantification constraint specification is a pair/tuple of two sets: 1. the set of attributes for the behavior being specified; 2. the set of quantification statements over the attributes. Attribute quantification constraints (AttributeQuantificationConstraint) are concerned with the value conditions of attributes underlying a behavior on a timeline. They are useful for declaring the variables (e.g. the input-, output- and internal variables of a function), their expected values and logical relations. An attribute quantification constraint can be expressed either by simple equations like F = m*a, V >= 90, or dynamics models. When necessary, the straints on computational operations for data transformations and value assignment can be declared through the computation constraints (ComputationConstraint). Semantics: The attribute quantification constraint specification is a pair/tuple of two sets: 1. the set of attributes for the behavior being specified; 2. the set of quantification statements over the attributes. The BasicSoftwareFunctionType allow for the representation of a layered architecture of functionality on the DesignLevel. A BasicSoftwareFunctionType then represents a function in the service layer. Semantics: The BasicSoftwareFunctionType is an abstraction of the middleware. Extension: UML Class, specialization of SysML::Block atpType The BasicSoftwareFunctionType allow for the representation of a layered architecture of functionality on the DesignLevel. A BasicSoftwareFunctionType then represents a function in the service layer. Semantics: The BasicSoftwareFunctionType is an abstraction of the middleware. Extension: UML Class, specialization of SysML::Block atpType Behavior is a container of FunctionBehaviors. It enables grouping of the behaviors assigned to functions in a particular context on which TraceableSpecifications can be applied. This can take any appropriate form depending on the language implementation (for instance in a UML implementation it could be a Package). The collection of functional behaviors can be performed across the EAST-ADL abstraction levels. Semantics: This element has the same role and semantics as Context, but for behavioral aspects. Behavior is a container of FunctionBehaviors. It enables grouping of the behaviors assigned to functions in a particular context on which TraceableSpecifications can be applied. This can take any appropriate form depending on the language implementation (for instance in a UML implementation it could be a Package). The collection of functional behaviors can be performed across the EAST-ADL abstraction levels. Semantics: This element has the same role and semantics as Context, but for behavioral aspects. BehaviorConstraintBindingEvent is a specialization of BehaviorConstraintBindingParameter. It allows a behavior constraint type to declare the value attributes to be shared of its prototypes. See also BehaviorConstraintBindingParameter. atpPrototype BehaviorConstraintBindingEvent is a specialization of BehaviorConstraintBindingParameter. It allows a behavior constraint type to declare the value attributes to be shared of its prototypes. See also BehaviorConstraintBindingParameter. atpPrototype BehaviorConstraintBindingEvent is a specialization of BehaviorConstraintBindingParameter. It allows a behavior constraint type to declare the discrete events to be shared by its prototypes. See also BehaviorConstraintBindingParameter. BehaviorConstraintBindingEvent is a specialization of BehaviorConstraintBindingParameter. It allows a behavior constraint type to declare the discrete events to be shared by its prototypes. See also BehaviorConstraintBindingParameter. BehaviorConstraintInternalBinding is the modeling construct for the declaration of parameters to be shared by the parts (i.e. behavior constraint prototypes) of a behavior constraint type. In other words, a behavior constraint type uses such parameters to bind the parameters of its parts (BehaviorConstraintType.part:BehaviorConstraintPrototype.instantiationVariable). For such a binding, the declarations of prototype instantiation (BehaviorConstraintType.part:BehaviorConstraintPrototype.instantiationVariable) refer directly to the part binding parameters of the instantiation context (BehaviorConstraintType.partBindingParameter) Each binding parameter can have a structural correspondence (bindingThroughFunctionConnector, bindingThroughClampConnector, bindingThrough-LogicalBus, or bindingThrough-HardwareConnector), stating the structural channels through which the binding takes place. In the meta-model, the abstract binding parameter is further specialized into * BehaviorConstraintBindingAttribute - the contextual parameters that are value attributes. * BehaviorConstraintBindingEvent - the contextual parameters that are discrete events. Constraints: When a binding of behavior constraint prototypes go across different system functions or components, there should be at least one corresponding structural communication connector through which such bindings can take place (i.e. bindingThroughFunctionConnector, bindingThroughClampConnector, bindingThrough-LogicalBus, or bindingThrough-HardwareConnector). Semantics: A BehaviorConstraintBindingParameter is an event- or data- channel connecting behaviors. See also Attribute and TransitionEvent. instanceRef instanceRef.target instanceRef.context instanceRef instanceRef instanceRef.context instanceRef.target instanceRef BehaviorConstraintParameter is the modeling construct for the declarations of the parameters that a behavior constraint type offer for its instantiations. During the instantiation, a behavior constraint prototype declares the particular contextual parameters to be bound (BehaviorConstraintPrototype.BehaviorinstantiatedWithParameter) with the parameters of its corresponding behavior constraint types (BehaviorConstraintPrototype.type:BehaviorConstraintType.parameter). This allows thereby the values of those contextual parameters to be assigned to the parameters of prototypes. Constraints: See Attribute and TransitionEvent. Semantics: See Attribute and TransitionEvent. BehaviorConstraintPrototype is the modeling construct for declaring the instantiated occurrence(s) of a behavior constraint type (BehaviorConstraintPrototype.type) in particular behavior specification context where the behavior constraint type acts as part. BehaviorConstraintPrototype.instantiationVariable {ordered} is declared by BehaviorConstraintPrototype.type.interfaceVariable {ordered} Constraint: [1] A BehaviorConstraintPrototype must has a type (BehaviorConstraintPrototype.type) and a context where it acts as part (BehaviorConstraintType.part). BehaviorConstraintType.part:BehaviorConstraintPrototype.instantiationVariable can only be a subset of the BehaviorConstraintType.interfaceVariable. Semantics: See BehaviorConstraintType. Extension: TraceableSpecification. atpPrototype isOfType BehaviorConstraintPrototype is the modeling construct for declaring the instantiated occurrence(s) of a behavior constraint type (BehaviorConstraintPrototype.type) in particular behavior specification context where the behavior constraint type acts as part. BehaviorConstraintPrototype.instantiationVariable {ordered} is declared by BehaviorConstraintPrototype.type.interfaceVariable {ordered} Constraint: [1] A BehaviorConstraintPrototype must has a type (BehaviorConstraintPrototype.type) and a context where it acts as part (BehaviorConstraintType.part). BehaviorConstraintType.part:BehaviorConstraintPrototype.instantiationVariable can only be a subset of the BehaviorConstraintType.interfaceVariable. Semantics: See BehaviorConstraintType. Extension: TraceableSpecification. atpPrototype instanceRef instanceRef.context instanceRef.target instanceRef instanceRef instanceRef.context instanceRef.target instanceRef instanceRef instanceRef.context instanceRef.target instanceRef The specification of behavior constraints provides the modeling support for formalizing, integrating, and managing various behavioral concerns in a common context of system architecture design. A behavior constraint can be annotated either for refining requirements or for precisely defining the behavioral properties of design and analysis artifacts. According to the fundamental needs of system design and analysis, an EAST-ADL behavior constraint specification is subdivided into three categories (i.e. AttributeQuantificationConstraint, TemporalConstraint, and ComputationConstraint). It is up to the users of EAST-ADL language, according to their particular design and analysis contexts, to decide the exact types and degree of constraints to be applied. A behavior constraint specification has both type and prototype(s) based on a type-prototype pattern for composition. The behavior constraint type specification establishes a template for a range of behavioral concerns that share some common declarations and semantics. A behavior constraint type can have parameters (i.e. events and data) for its instantiations in particular contexts. A behavior constraint type can also have internal parameters shareable by its own prototypes. The behavior constraint prototype specifications declare the particular instantiations of the type. During an instantiation, the parameters of behavior constraint type are bound to some parameters of the contexts (which are the partBindingParameter of the contextual behavior constraint types). Through such binding declarations, the prototypes of behavior constraint types (i.e. their instantiations) are connected to the contextual parameters. EAST-ADL associates behavior constraints to the requirements, design or analysis artifacts. Due to such associations, a behavior constraint specification can get many different roles in system development and thereby be composed with or related to other behavior constraints in many different ways. 1. When associated to requirements with a Refine relationship, a behavior constraint specification refines the textual requirement descriptions. 2. When associated to functions and function behaviors, a behavior constraint specification defines the behavioral properties that have to be satisfied for the reasoning of system design (i.e. the compositionality and composability) and realizations. 3. When associated to modes, a behavior constraint specification defines the behavioral concerns of system modes, including their relations to other system application and execution behaviors. 4. When associated to error models, a behavior constraint specification refines the definitions of estimated failure modes by providing a precise specification of faulty conditions in value and time and constitutes a basis for capturing the transitions between nominal states and errors. Constraints: [1] A behavior constraint references at least one requirement, vehicle feature, mode, function type, function behavior, function trigger, or error behavior definition. Semantics: The EAST-ADL support for explicit behavior description is fundamentally a Hybrid-System Model, i.e. an aggregation of AttributeQuantificationConstraint, TemporalConstraint, and ComputationConstraint. A behavior constraint type is instantiated with prototypes. atpType The specification of behavior constraints provides the modeling support for formalizing, integrating, and managing various behavioral concerns in a common context of system architecture design. A behavior constraint can be annotated either for refining requirements or for precisely defining the behavioral properties of design and analysis artifacts. According to the fundamental needs of system design and analysis, an EAST-ADL behavior constraint specification is subdivided into three categories (i.e. AttributeQuantificationConstraint, TemporalConstraint, and ComputationConstraint). It is up to the users of EAST-ADL language, according to their particular design and analysis contexts, to decide the exact types and degree of constraints to be applied. A behavior constraint specification has both type and prototype(s) based on a type-prototype pattern for composition. The behavior constraint type specification establishes a template for a range of behavioral concerns that share some common declarations and semantics. A behavior constraint type can have parameters (i.e. events and data) for its instantiations in particular contexts. A behavior constraint type can also have internal parameters shareable by its own prototypes. The behavior constraint prototype specifications declare the particular instantiations of the type. During an instantiation, the parameters of behavior constraint type are bound to some parameters of the contexts (which are the partBindingParameter of the contextual behavior constraint types). Through such binding declarations, the prototypes of behavior constraint types (i.e. their instantiations) are connected to the contextual parameters. EAST-ADL associates behavior constraints to the requirements, design or analysis artifacts. Due to such associations, a behavior constraint specification can get many different roles in system development and thereby be composed with or related to other behavior constraints in many different ways. 1. When associated to requirements with a Refine relationship, a behavior constraint specification refines the textual requirement descriptions. 2. When associated to functions and function behaviors, a behavior constraint specification defines the behavioral properties that have to be satisfied for the reasoning of system design (i.e. the compositionality and composability) and realizations. 3. When associated to modes, a behavior constraint specification defines the behavioral concerns of system modes, including their relations to other system application and execution behaviors. 4. When associated to error models, a behavior constraint specification refines the definitions of estimated failure modes by providing a precise specification of faulty conditions in value and time and constitutes a basis for capturing the transitions between nominal states and errors. Constraints: [1] A behavior constraint references at least one requirement, vehicle feature, mode, function type, function behavior, function trigger, or error behavior definition. Semantics: The EAST-ADL support for explicit behavior description is fundamentally a Hybrid-System Model, i.e. an aggregation of AttributeQuantificationConstraint, TemporalConstraint, and ComputationConstraint. A behavior constraint type is instantiated with prototypes. atpType The motivation for attributing features and variable elements with binding times is that binding times encapsulate important information about the variability under view. Variability that must be bound (determined, decided) very early in the system development may not be visible in one single feature model but only in comparison with different feature models in the context of multi-level feature trees; late bound variability is variability providing the driver with choices for current equipment configuration. Binding times are important because they describe if the variability must be decided during system development or if the variability is determined by a customer or if the variability itself is part of the product features that are sold to the customer. Possible binding times are: - SystemDesignTime - CodeGenerationTime - PreCompileTime - LinkTime - PostBuild - Runtime Note that a binding time is never a particular point in time such as April 2nd, 2011, but always a certain stage in the overall development, production and shipment process as represented by the above values. Each feature must have a binding time (association requiredBindingTime) and may have one further binding time (association actualBindingTime). The required binding time describes the binding time that the feature is intended to have. But due to technical conditions it may occur that the actually realized binding time of the feature differs from the originally intended binding time. In this case one has to provide information about the actual binding time. In the rationale it must be described by what the required binding time is motivated by and what the reasons are for a (different) actual binding time. Semantics: See description. Extension: Class. The kind of the binding time, see enumeration BindingTimeKind for specification of binding times. The motivation for attributing features and variable elements with binding times is that binding times encapsulate important information about the variability under view. Variability that must be bound (determined, decided) very early in the system development may not be visible in one single feature model but only in comparison with different feature models in the context of multi-level feature trees; late bound variability is variability providing the driver with choices for current equipment configuration. Binding times are important because they describe if the variability must be decided during system development or if the variability is determined by a customer or if the variability itself is part of the product features that are sold to the customer. Possible binding times are: - SystemDesignTime - CodeGenerationTime - PreCompileTime - LinkTime - PostBuild - Runtime Note that a binding time is never a particular point in time such as April 2nd, 2011, but always a certain stage in the overall development, production and shipment process as represented by the above values. Each feature must have a binding time (association requiredBindingTime) and may have one further binding time (association actualBindingTime). The required binding time describes the binding time that the feature is intended to have. But due to technical conditions it may occur that the actually realized binding time of the feature differs from the originally intended binding time. In this case one has to provide information about the actual binding time. In the rationale it must be described by what the required binding time is motivated by and what the reasons are for a (different) actual binding time. Semantics: See description. Extension: Class. A BurstConstraint describes an event that occurs in semi-regular bursts. A BurstConstraint expresses the maximum number of event occurrences that may appear in any interval of a given length, which is equivalent to constraining the same number of repeat spans (which count one extra occurrence at the end) to have a minimum width of length. Semantics: A system behavior satisfies a BurstConstraint c if and only if the same system behavior concurrently satisfies RepeatConstraint { event = c.event, lower = c.length, upper = infinity, span = c.maxOccurrences } and RepeatConstraint { event = c.event, lower = c.minimum } A BurstConstraint describes an event that occurs in semi-regular bursts. A BurstConstraint expresses the maximum number of event occurrences that may appear in any interval of a given length, which is equivalent to constraining the same number of repeat spans (which count one extra occurrence at the end) to have a minimum width of length. Semantics: A system behavior satisfies a BurstConstraint c if and only if the same system behavior concurrently satisfies RepeatConstraint { event = c.event, lower = c.length, upper = infinity, span = c.maxOccurrences } and RepeatConstraint { event = c.event, lower = c.minimum } The business opportunity represents a brief description of the business opportunity being met by developing the electrical/electronic system which establishes traceability from artifacts created later, for example to provide rationales to design decisions or trade-off analysis. This attribute holds a brief description of the business opportunity being met by developing the electrical/electronic system. This redefines the text attribute in TraceableSpecification. The business opportunity represents a brief description of the business opportunity being met by developing the electrical/electronic system which establishes traceability from artifacts created later, for example to provide rationales to design decisions or trade-off analysis. Claim represents a statement, the truth of which needs to be confirmed. Claim has associations to the strategy for goal decomposition and to supported arguments. It also holds associations to the evidences for the SafetyCase. Semantics: Goal-based development provides the claim what should be achieved. Goal is what the argument must show to be true. Claim represents a statement, the truth of which needs to be confirmed. Claim has associations to the strategy for goal decomposition and to supported arguments. It also holds associations to the evidences for the SafetyCase. Semantics: Goal-based development provides the claim what should be achieved. Goal is what the argument must show to be true. The clamp connector connects ports across function boundaries and containment hierarchies. It is used to connect from an EnvironmentModel to the FunctionalAnalysisArchitecture, the FunctionalDesignArchitecture, the autosarSystem or another EnvironmentModel. Typically, the EnvironmentModel contains physical ports, which restrict the valid ports in the FunctionalAnalysisArchitecture to those on FunctionalDevices and in the FunctionalDesignArchitecture to those on HardwareFunctions. In case the connection concerns logical interaction, this restriction does not apply. The ClampConnector is always an assembly connector, never a delegation connector. Semantics: ClampConnectors represents the interaction link between a functional model of the EE Architecture and the functional model of the plant. Constraints: [1] Can connect two FunctionFlowPorts of different direction. [2] Can connect two FunctionClientServerPorts of different clientServerType. [3] Can connect two FunctionFlowPorts with direction inout. [4] Cannot connect ports in the same SystemModel. atpStructureElement The clamp connector connects ports across function boundaries and containment hierarchies. It is used to connect from an EnvironmentModel to the FunctionalAnalysisArchitecture, the FunctionalDesignArchitecture, the autosarSystem or another EnvironmentModel. Typically, the EnvironmentModel contains physical ports, which restrict the valid ports in the FunctionalAnalysisArchitecture to those on FunctionalDevices and in the FunctionalDesignArchitecture to those on HardwareFunctions. In case the connection concerns logical interaction, this restriction does not apply. The ClampConnector is always an assembly connector, never a delegation connector. Semantics: ClampConnectors represents the interaction link between a functional model of the EE Architecture and the functional model of the plant. Constraints: [1] Can connect two FunctionFlowPorts of different direction. [2] Can connect two FunctionClientServerPorts of different clientServerType. [3] Can connect two FunctionFlowPorts with direction inout. [4] Cannot connect ports in the same SystemModel. atpStructureElement instanceRef instanceRef.target instanceRef.context instanceRef Comment represents a textual annotation. Semantics: Comment represents a textual annotation that applies to the containing or associated element. Extension: Comment Specifies a string that is the comment. Comment represents a textual annotation. Semantics: Comment represents a textual annotation that applies to the containing or associated element. Extension: Comment CommunicationHardwarePin represents an electrical connection point that can be used to define how the wire harness is logically defined. Semantics: The CommunicationHardwarePin represents the hardware connection point of a communication bus. Depending on modeling style, one or two pins may be defined for a dual-wire bus. Notation: CommunicationHardwarePin is shown as a solid square with a C inside. Its name may appear outside the square. atpStructureElement CommunicationHardwarePin represents an electrical connection point that can be used to define how the wire harness is logically defined. Semantics: The CommunicationHardwarePin represents the hardware connection point of a communication bus. Depending on modeling style, one or two pins may be defined for a dual-wire bus. Notation: CommunicationHardwarePin is shown as a solid square with a C inside. Its name may appear outside the square. atpStructureElement A ComparisonConstraint states that a certain ordering relation must exist between two timing expressions. This constraint is special in that it does not reference any events. Its main purpose is to express relations between arithmetic variables used in other constraint; for example, stating that the sum of the variables denoting segment delays in a time-budgeting scenario must be less than the maximum end-to-end deadline allowed. Semantics: A system behavior satisfies a ComparisonConstraint c if and only if c.leftOperand and c.rightOperand are related according to the ordering relation given by c.operator. A ComparisonConstraint states that a certain ordering relation must exist between two timing expressions. This constraint is special in that it does not reference any events. Its main purpose is to express relations between arithmetic variables used in other constraint; for example, stating that the sum of the variables denoting segment delays in a time-budgeting scenario must be less than the maximum end-to-end deadline allowed. Semantics: A system behavior satisfies a ComparisonConstraint c if and only if c.leftOperand and c.rightOperand are related according to the ordering relation given by c.operator. A CompositeDatatype represents a non-scalar datatype. Take as an example a CompositeDatatype "MyCountries" that can refer, e.g., to an Enumeration "CountryEnumeration" {USA, Canada, Japan, EU} via two EADatatypePrototypes (record variables): FirstCountry and SecondCountry. Then an attribute typed by this CompositeDatatype "MyCountries" may have a value like: (EU (identified as FirstCountry), Japan (identified as SecondCountry)). Semantics: A CompositeDatatype represents a non-scalar datatype. The contained datatypePrototypes act as record variables to identify the ordered datatype instances of the tuple (the CompositeDatatype). Notation: The datatype CompositeDatatype is denoted using the rectangle symbol with keyword «Datatype CompositeDatatype». Extension: UML Datatype atpType A CompositeDatatype represents a non-scalar datatype. Take as an example a CompositeDatatype "MyCountries" that can refer, e.g., to an Enumeration "CountryEnumeration" {USA, Canada, Japan, EU} via two EADatatypePrototypes (record variables): FirstCountry and SecondCountry. Then an attribute typed by this CompositeDatatype "MyCountries" may have a value like: (EU (identified as FirstCountry), Japan (identified as SecondCountry)). Semantics: A CompositeDatatype represents a non-scalar datatype. The contained datatypePrototypes act as record variables to identify the ordered datatype instances of the tuple (the CompositeDatatype). Notation: The datatype CompositeDatatype is denoted using the rectangle symbol with keyword «Datatype CompositeDatatype». Extension: UML Datatype atpType Computation constraints (ComputationConstraint) provide the language support for specifying the restrictions on data processing, especially when the details of design are not available (e.g. for the reasons of software component IP-protection). The descriptions can be related both to the expected logical transformations of data and to the expected cause-effect flow of events. Constraints: [1] A computation constraint contains at least one transformation or one flow definition. Semantics: The EAST-ADL computation constraint is a pair/tuple of: 1. a set of restrictions on the logical transformations of data, 2. a set of restrictions on the cause-effect paths logical transformations. Computation constraints (ComputationConstraint) provide the language support for specifying the restrictions on data processing, especially when the details of design are not available (e.g. for the reasons of software component IP-protection). The descriptions can be related both to the expected logical transformations of data and to the expected cause-effect flow of events. Constraints: [1] A computation constraint contains at least one transformation or one flow definition. Semantics: The EAST-ADL computation constraint is a pair/tuple of: 1. a set of restrictions on the logical transformations of data, 2. a set of restrictions on the cause-effect paths logical transformations. An abstract or general idea inferred or derived from specific instances. [Webster] ConfigurableContainer is a marker class that marks an element identified by association configurableElement as a configurable container of some variable content, i.e. VariableElements and other, lower-level ConfigurableContainers. In order to describe the contained variability to the outside world and to allow configuration of it, the ConfigurableContainer can have a public feature model and an internal configuration decision model not visible from the outside, called "internal binding". In addition, the ConfigurableContainer can be used to extend the EAST-ADL variability approach to other languages and standards by pointing from the ConfigurableContainer to the respective (non EAST-ADL) element with association configurableElement. This provides the public feature model and the ConfigurationDecisionModel to that non EAST-ADL element. The variable content of a ConfigurableContainer is defined as all VariableElements and all other ConfigurableContainers that are directly or indirectly contained in the Identifiable denoted by association configurableElement. Instead of 'variable content' the term 'internal variability' may be used. Note that, according to this rule, the containment between a ConfigurableContainer and its variable content, i.e. its contained VariableElements and lower-level ConfigurableContainers, is not directly defined between these meta-classes. Instead, the containment is defined by the Identifiable pointed to by association configurableElement. For example, consider a FunctionType "WiperSystem" containing two FunctionPrototypes "front" and "rear" both typed by FunctionType "WiperMotor"; to make the wiper system configurable and the rear wiper motor optional, a ConfigurableContainer is created that points to FunctionType "WiperSystem" (with association configurableElement) and a VariableElement is created that points to FunctionPrototype "rear" (with association optionalElement); the containment between the ConfigurableContainer and the VariableElement is therefore not explicitly defined between these classes but instead only between FunctionType "WiperSystem" and "FunctionPrototype" rear. In addition, the variability-related visibility of "rear" can be changed with PrivateContent: by default the variability of "rear" will be public and visible for direct configuration from the outside of its containing ConfigurableContainer, i.e. "WiperSystem"; by defining a PrivateContent marker object pointing to the FunctionPrototype "rear", this can be changed to private and this variability will not be visible from the outside of "WiperSystem". Constraints: [1] Identifies one FunctionType or one HardwareComponentType. [2] The publicFeatureModel is only allowed to contain Features (no VehicleFeatures). Semantics: Marks the element identified by association configurableElement as a configurable container of variable content (i.e. it contains VariableElements and/or other, lower-level ConfigurableContainers) and optionally provides a public feature model and an internal configuration decision model for it, thus providing configurability support for them. Extension: Class ConfigurableContainer is a marker class that marks an element identified by association configurableElement as a configurable container of some variable content, i.e. VariableElements and other, lower-level ConfigurableContainers. In order to describe the contained variability to the outside world and to allow configuration of it, the ConfigurableContainer can have a public feature model and an internal configuration decision model not visible from the outside, called "internal binding". In addition, the ConfigurableContainer can be used to extend the EAST-ADL variability approach to other languages and standards by pointing from the ConfigurableContainer to the respective (non EAST-ADL) element with association configurableElement. This provides the public feature model and the ConfigurationDecisionModel to that non EAST-ADL element. The variable content of a ConfigurableContainer is defined as all VariableElements and all other ConfigurableContainers that are directly or indirectly contained in the Identifiable denoted by association configurableElement. Instead of 'variable content' the term 'internal variability' may be used. Note that, according to this rule, the containment between a ConfigurableContainer and its variable content, i.e. its contained VariableElements and lower-level ConfigurableContainers, is not directly defined between these meta-classes. Instead, the containment is defined by the Identifiable pointed to by association configurableElement. For example, consider a FunctionType "WiperSystem" containing two FunctionPrototypes "front" and "rear" both typed by FunctionType "WiperMotor"; to make the wiper system configurable and the rear wiper motor optional, a ConfigurableContainer is created that points to FunctionType "WiperSystem" (with association configurableElement) and a VariableElement is created that points to FunctionPrototype "rear" (with association optionalElement); the containment between the ConfigurableContainer and the VariableElement is therefore not explicitly defined between these classes but instead only between FunctionType "WiperSystem" and "FunctionPrototype" rear. In addition, the variability-related visibility of "rear" can be changed with PrivateContent: by default the variability of "rear" will be public and visible for direct configuration from the outside of its containing ConfigurableContainer, i.e. "WiperSystem"; by defining a PrivateContent marker object pointing to the FunctionPrototype "rear", this can be changed to private and this variability will not be visible from the outside of "WiperSystem". Constraints: [1] Identifies one FunctionType or one HardwareComponentType. [2] The publicFeatureModel is only allowed to contain Features (no VehicleFeatures). Semantics: Marks the element identified by association configurableElement as a configurable container of variable content (i.e. it contains VariableElements and/or other, lower-level ConfigurableContainers) and optionally provides a public feature model and an internal configuration decision model for it, thus providing configurability support for them. Extension: Class ConfigurationDecision represents a single, atomized rule on how to configure the target feature model(s) of the containing ConfigurationDecisionModel, depending on a given configuration of the source feature model(s). Two examples are: "all North American (USA+Canada) cars except A-Class have cruise control" (one ConfigurationDecision) or "all Canadian cars have adaptive cruise control" (another ConfigurationDecision). All ConfigurationDecisions within a single ConfigurationDecisionModel then specify how the target feature model(s) are to be configured depending on the configuration of the source feature model(s). Example: Lets assume we have two FeatureModels: FM1 and FM2. FM1 has possible end-customer decisions like USA, Canada, EU, Japan and A-Class, C-Class, etc. FM2 has another possible end-customer decision such as CruiseControl, AdaptiveCruiseControl, RearWiper, RainSensor. End-customer decisions in FM2 describe possible technical features of the delivered products. By way of a set of ConfigurationDecisions it is now possible to define the configuration of FM2 (i.e. if there is a RainSensor, etc.) dependent on a configuration of FM1. In other words, with a ConfigurationDecision we can express something like: "If USA is selected in FM1 AND A-Class is not selected in FM1, then CruiseControl will be selected in FM2". The two most important constituents of a ConfigurationDecision are its 'criterion' and 'effect'. The effect is a list of things to select and deselect in the target configuration(s), whereas the criterion formulates a condition on the source configuration(s) under which this ConfigurationDecision's effect will actually be applied to the target configuration(s). In the first example above, the criterion would be "USA & not A-Class" and the effect would be "CruiseControl[+]". Semantics: The ConfigurationDecision excludes or includes Features based on a given criterion. The elements of the criterion and effect attributes may be identified through the target and the source in the selectionCriterion. The criterion and effect attributes can contain a VSL expression with qualified names of the identified elements. Constraints: [1] Attribute "criterion" or association "selectionCriterion" (or both) must be defined. Extension: Class The criterion is a logical expression on the source configuration(s) that states under which condition the 'effect' will be applied to the target configuration(s). This attribute adheres to the syntax and semantics of the VSL language. Note that association "selectionCriterion" provides an alternative means for defining such an expression in the form of an AUTOSAR mixed string expression. If both "criterion" and "selectionCriterion" are defined, they are assumed to be semantically equivalent and a tool may choose which one to use for variability and configuration management. States which Features are included/selected by the ConfigurationDecision in case the logical expression in 'criterion' evaluates to true. Each of these Features needs to be defined in one of the target feature models of the containing ConfigurationDecisionModel. This attribute adheres to the syntax and semantics of the VSL language. The Features are documented as a comma-separated list of strings. Each string has the form <Name of FeatureModel>#<Name of Feature>. If a string is unique in all the source and target FeatureModels of the ConfigurationDecisionModel containing this ConfigurationDecision, then the first part (the FeatureModel name and the #-separator) can be omitted. If a Feature name is not unique in a single FeatureModel, then a dot-notation may be used to prepend the name(s) of predecessors in order to identify the Feature. Configuring a cloned feature does not mean selecting or deselecting it but instead instances of the cloned feature are created. Each such instance is provided with a name, which thus becomes a part of the configuration (not the feature model). If several instances are created for a single cloned feature, then the name is used to identify these instances. For example, consider a cloned feature Wiper with cardinality [*]. A first configuration decision might create an instance called "front" and a second might create another named "rear"; a third configuration decision creating or otherwise referring to an instance called "front" will denote the same instance as the first configuration decision. The name space for these instance names is a particular feature configuration. As an example for the syntax and semantics of the effect attribute, assume there are two FeatureModels called FMa and FMb and they both contain the Features Wiper and ClimateControl. In FMa (but not in FMb), Wiper and ClimateControl are both refined into the child features Simple and Advanced. In addition, the wiper in FMa has a RainSensor. To denote the RainSensor in FMa you can state: FMa#Wiper.RainSensor or simply write: RainSensor This is sufficient here, because the name of Feature RainSensor is unique within FMa and within all FeatureModels referenced by the ConfigurationDecisionModel. In contrast, to denote the advanced version of the climate control in FMa you can specify: FMa#ClimateControl.Advanced or simply: ClimateControl.Advanced but merely stating "Advanced" would not suffice because there are two features with that name. Finally, to denote the wiper of feature model FMb you write: FMb#Wiper Setting the attribute isEquivalence to true means that the features referred to in the ConfigurationDecision's effect are exclusively configured by this ConfigurationDecision (i.e. no other ConfigurationDecision in the same ConfigurationDecisionModel may refer to these features). This means that this ConfigurationDecision is the ONLY way in which these features can be selected and therefore the usual logical implication that a ConfigurationDecision represents is turned into a logical equivalence, hence the name: the effect is applied to the target configurations if and only if the specified criterion holds. When setting this attribute to true, the modeler can state that the target-side features in this ConfigurationDecision's effect are exclusively configured by this ConfigurationDecision, i.e. no other ConfigurationDecision may influence these target-side features. ConfigurationDecision represents a single, atomized rule on how to configure the target feature model(s) of the containing ConfigurationDecisionModel, depending on a given configuration of the source feature model(s). Two examples are: "all North American (USA+Canada) cars except A-Class have cruise control" (one ConfigurationDecision) or "all Canadian cars have adaptive cruise control" (another ConfigurationDecision). All ConfigurationDecisions within a single ConfigurationDecisionModel then specify how the target feature model(s) are to be configured depending on the configuration of the source feature model(s). Example: Lets assume we have two FeatureModels: FM1 and FM2. FM1 has possible end-customer decisions like USA, Canada, EU, Japan and A-Class, C-Class, etc. FM2 has another possible end-customer decision such as CruiseControl, AdaptiveCruiseControl, RearWiper, RainSensor. End-customer decisions in FM2 describe possible technical features of the delivered products. By way of a set of ConfigurationDecisions it is now possible to define the configuration of FM2 (i.e. if there is a RainSensor, etc.) dependent on a configuration of FM1. In other words, with a ConfigurationDecision we can express something like: "If USA is selected in FM1 AND A-Class is not selected in FM1, then CruiseControl will be selected in FM2". The two most important constituents of a ConfigurationDecision are its 'criterion' and 'effect'. The effect is a list of things to select and deselect in the target configuration(s), whereas the criterion formulates a condition on the source configuration(s) under which this ConfigurationDecision's effect will actually be applied to the target configuration(s). In the first example above, the criterion would be "USA & not A-Class" and the effect would be "CruiseControl[+]". Semantics: The ConfigurationDecision excludes or includes Features based on a given criterion. The elements of the criterion and effect attributes may be identified through the target and the source in the selectionCriterion. The criterion and effect attributes can contain a VSL expression with qualified names of the identified elements. Constraints: [1] Attribute "criterion" or association "selectionCriterion" (or both) must be defined. Extension: Class ConfigurationDecisionFolder represents a grouping for ConfigurationDecisions. Semantics: ConfigurationDecisionFolder is a grouping entity for ConfigurationDecisions. Extension: Class ConfigurationDecisionFolder represents a grouping for ConfigurationDecisions. Semantics: ConfigurationDecisionFolder is a grouping entity for ConfigurationDecisions. Extension: Class A ConfigurationDecisionModel defines how to configure m target feature models, depending on a given configuration of n source feature models, thus establishing a configuration-related link from the n source feature models to the m target feature models (also called configuration link). With the information captured in a ConfigurationDecisionModel it is then possible to transform a given set of source configurations (one for every source feature model) into corresponding target configurations (one for every target feature model). For example, a ConfigurationDecisionModel can capture information such as "if feature 'S-Class' is selected in the source feature model, then select feature 'RainSensor' in the target feature model" or "if feature 'USA' is selected in the source feature model, then select feature 'CupHolder' in the target feature model". Note that in principle all ConfigurationDecisionModels have source / target feature models. However, they are only defined explicitly for those used on vehicle level; for ConfigurationDecisionModels used as an internal binding on FunctionTypes, the source and target feature models are defined implicitly (cf. metaclass InternalBinding). In addition, in the special case of FeatureConfiguration there is by definition no source and only a single target feature model, which is defined explicitly (cf. metaclass FeatureConfiguration). The configuration information captured in a ConfigurationDecisionModel is represented by ConfigurationDecisions, each of which captures a single, atomized rule on how to configure the target feature model(s) depending on a given configuration of the source feature model(s). Semantics: See description. Extension: Class ConfigurationDecisionModelEntry is the abstract base class for all content of a ConfigurationDecisionModel. Semantics: See description. Extension: Class If active==TRUE then the ConfigurationDecisionModelEntry is actually applied when transforming source into target configurations; otherwise it will be ignored. With this attribute, configuration decisions can (temporarily) be disabled without having to delete them from the model. If this is set to FALSE for a ConfigurationDecisionFolder, then the entire contents of this folder are deactivated, no matter to what value their isActive-attribute is set. ContainerConfiguration defines an actual configuration of the variable content of a ConfigurableContainer, in particular the selection or deselection of contained VariableElements and the configuration of the public feature models of other contained ConfigurableContainers. For more details on the variable content of a ConfigurableContainer refer to the documentation of meta-class ConfigurableContainer. The ContainerConfiguration inherits from ConfigurationDecisionModel even though it does not define a configuration link between feature models, similar to FeatureConfiguration. For more information on this, refer to the documentation of meta-class FeatureConfiguration. The source and target feature models of a ContainerConfiguration are defined implicitly: it always has zero source feature models (as explained for FeatureConfiguration) and its target feature models can be deduced from the ConfigurableContainer being configured by applying the same rules as defined for InternalBinding. Semantics: The ContainerConfiguration specifies a concrete configuration of the variable content of a ConfigurableContainer. Extension: Class ContainerConfiguration defines an actual configuration of the variable content of a ConfigurableContainer, in particular the selection or deselection of contained VariableElements and the configuration of the public feature models of other contained ConfigurableContainers. For more details on the variable content of a ConfigurableContainer refer to the documentation of meta-class ConfigurableContainer. The ContainerConfiguration inherits from ConfigurationDecisionModel even though it does not define a configuration link between feature models, similar to FeatureConfiguration. For more information on this, refer to the documentation of meta-class FeatureConfiguration. The source and target feature models of a ContainerConfiguration are defined implicitly: it always has zero source feature models (as explained for FeatureConfiguration) and its target feature models can be deduced from the ConfigurableContainer being configured by applying the same rules as defined for InternalBinding. Semantics: The ContainerConfiguration specifies a concrete configuration of the variable content of a ConfigurableContainer. Extension: Class Context represents a simple and practical way to allocate TraceableSpecifications to a specific EAST-ADL model context, and to let this specific model context own Relationships. Semantics: See Relationship and TraceableSpecification. Extension: The ADLContext stereotype is an abstract stereotype which extends UML2 metaclass Element A DelayConstraint imposes limits between the occurrences of an event called source and an event called target. This notion of delay is entirely based on the distance between source and target occurrences; whether a matching target occurrence is actually caused by the corresponding source occurrence is of no importance. This means that one-to-many and many-to-one source-target patterns are allowed, and so are stray target occurrences that are not within the prescribed distance of any source occurrence. Semantics: A system behavior satisfies a DelayConstraint c if and only if for each occurrence x of c.source, there is an occurrence y of c.target such that c.lower <= y - x <= c.upper A DelayConstraint imposes limits between the occurrences of an event called source and an event called target. This notion of delay is entirely based on the distance between source and target occurrences; whether a matching target occurrence is actually caused by the corresponding source occurrence is of no importance. This means that one-to-many and many-to-one source-target patterns are allowed, and so are stray target occurrences that are not within the prescribed distance of any source occurrence. Semantics: A system behavior satisfies a DelayConstraint c if and only if for each occurrence x of c.source, there is an occurrence y of c.target such that c.lower <= y - x <= c.upper The collection of dependability related information. This includes safety requirements, safety cases, safety constraints, and error modeling. This collection can be used across the EAST-ADL abstraction levels. Semantics: Dependability is a container element that collects elements related to dependabilty. It is possible to have several Dependability elements to organize related dependability information in dedicated containers. The collection of dependability related information. This includes safety requirements, safety cases, safety constraints, and error modeling. This collection can be used across the EAST-ADL abstraction levels. Semantics: Dependability is a container element that collects elements related to dependabilty. It is possible to have several Dependability elements to organize related dependability information in dedicated containers. The DeriveRequirement is a relationship metaclass, which signifies a dependency relationship between two sets of Requirements, showing the relationship when a set of derived client Requirement (client requirement) is derived from a set of Requirements (supplier requirement). Semantics: The DeriveRequirement metaclass signifies a derived/derived by relationship between Requirements, where the modification of the supplier Requirement may impact the derived client Requirement. Notation: A DeriveRequirement relationship is shown as a dashed arrow between two Requirements. The Requirement at the tail of the arrow (the derived Requirement) depends on the Requirement at the arrowhead (the Requirement derived from). Extension: To specialize SysML DeriveReqt, which specializes UML2 stereotype Trace, which extends Dependency. Temporary change in the profile (to overcome bug in Eclipse/UML2 concerning standard stereotypes) - added extension towards Dependency - removed generalization link towards SysML::DeriveReqt TODO: Move to Requirement package The DeriveRequirement is a relationship metaclass, which signifies a dependency relationship between two sets of Requirements, showing the relationship when a set of derived client Requirement (client requirement) is derived from a set of Requirements (supplier requirement). Semantics: The DeriveRequirement metaclass signifies a derived/derived by relationship between Requirements, where the modification of the supplier Requirement may impact the derived client Requirement. Notation: A DeriveRequirement relationship is shown as a dashed arrow between two Requirements. The Requirement at the tail of the arrow (the derived Requirement) depends on the Requirement at the arrowhead (the Requirement derived from). Extension: To specialize SysML DeriveReqt, which specializes UML2 stereotype Trace, which extends Dependency. Temporary change in the profile (to overcome bug in Eclipse/UML2 concerning standard stereotypes) - added extension towards Dependency - removed generalization link towards SysML::DeriveReqt TODO: Move to Requirement package The DesignFunctionPrototype represents references to the occurrence of the DesignFunctionType that types it when it acts as a part. The DesignFunctionPrototype is typed by a DesignFunctionType . Semantics: The DesignFunctionPrototype represents an occurrence of the DesignFunctionType that types it. Extension: UML Property, specialization of SysML::BlockProperty atpPrototype isOfType The DesignFunctionPrototype represents references to the occurrence of the DesignFunctionType that types it when it acts as a part. The DesignFunctionPrototype is typed by a DesignFunctionType . Semantics: The DesignFunctionPrototype represents an occurrence of the DesignFunctionType that types it. Extension: UML Property, specialization of SysML::BlockProperty atpPrototype The DesignFunctionType is a concrete FunctionType and therefore inherits the elementary function properties from the abstract metaclass FunctionType. The DesignFunctionType is used to model the functional structure on DesignLevel. The syntax of DesignFunctionTypes is inspired by the type-prototype pattern used by AUTOSAR. The DesignFunctions may interact with other DesignFunctions (i.e., also BasicSoftwareFunctions, HardwareFunctions, and LocalDeviceManagers) through their FunctionPorts. Furthermore, a DesignFunction may be decomposed into the contained parts that are DesignFunctionPrototypes. This allows the functionalities provided by the parent DesignFunction to be broken up hierarchically into subfunctionalities. Execution time constraints on the DesignFunctionType can be expressed by ExecutionTimeConstraints, see the Timing package. If two or more occurrences of an elementary Function are allocated on the same ECU, the code will be placed on the ECU only once (so these occurrences will use the same code but separate memory areas for data). Semantics: The DesignFunctionType represents a node in a tree structure corresponding to the functional decomposition of a top level DesignFunction. The DesignFunction represents the design function used to describe the functionalities provided by a vehicle on the DesignLevel. At the DesignLevel, DesignFunctions are defined and structured according to the functional and hardware system design. Constraints: [1] DesignFunctionTypes may only be used on DesignLevel. Extension: UML Class, specialization of SysML::Block atpType The DesignFunctionType is a concrete FunctionType and therefore inherits the elementary function properties from the abstract metaclass FunctionType. The DesignFunctionType is used to model the functional structure on DesignLevel. The syntax of DesignFunctionTypes is inspired by the type-prototype pattern used by AUTOSAR. The DesignFunctions may interact with other DesignFunctions (i.e., also BasicSoftwareFunctions, HardwareFunctions, and LocalDeviceManagers) through their FunctionPorts. Furthermore, a DesignFunction may be decomposed into the contained parts that are DesignFunctionPrototypes. This allows the functionalities provided by the parent DesignFunction to be broken up hierarchically into subfunctionalities. Execution time constraints on the DesignFunctionType can be expressed by ExecutionTimeConstraints, see the Timing package. If two or more occurrences of an elementary Function are allocated on the same ECU, the code will be placed on the ECU only once (so these occurrences will use the same code but separate memory areas for data). Semantics: The DesignFunctionType represents a node in a tree structure corresponding to the functional decomposition of a top level DesignFunction. The DesignFunction represents the design function used to describe the functionalities provided by a vehicle on the DesignLevel. At the DesignLevel, DesignFunctions are defined and structured according to the functional and hardware system design. Constraints: [1] DesignFunctionTypes may only be used on DesignLevel. Extension: UML Class, specialization of SysML::Block atpType The DesignLevel represents the vehicle electrical/electronic system on the design abstraction level. It includes primarily the Functional Design Architecture (FDA), and the HardwareDesignArchitecture (HDA). FDA represents a top level Function. It is supposed to implement all the functionalities of a vehicle, as specified by a FAA or a Vehicle level (if no FAA has been defined during the process). The design level in EAST-ADL includes the design architecture containing the functional specification and hardware architecture of the vehicle electrical/electronic system. The design architecture includes the FDA representing a decomposition of functionalities analyzed on the analysis level. The decomposition has the purpose of making it possible to meet constraints regarding non-functional properties such as allocation, efficiency, reuse, or supplier concerns. There is an n-to-m mapping between entities of the design level and the ones on the analysis level. Non-transparent infrastructure functionality such as mode changes and error handling are also represented at the design level, such that their impact on applications' behaviors can be estimated. The FDA parts are typed by DesignFunctionTypes and e.g. LocalDeviceManagers. The view of the HardwareArchitecture facilitates the realization of LocalDeviceManager as sensor/actuator HW elements. The HDA is the hardware design from a system perspective. The HDA has two purposes: 1) It shows the physical entities and how they are connected. 2) It is an allocation target for the Functions of the FDA. The HDA represents the hardware architecture of the embedded system. Its contained HW elements represent the physical aspects of the hardware entities and how they are connected. HardwareFunctionTypes associated to HW components represent the logical behavior of the contained HW elements. Semantics: The DesignLevel is the representation of the vehicle electrical/electronic system on the design abstraction level. It corresponds to the design of logical functions and boundaries extended in regards to resource commitment. Notation: The DesignLevel is shown as a solid-outline rectangle containing the name, with its ports or port groups on the perimeter. Contained entities may be shown with their connectors and allocations (White-box view). Extension: Class atpStructureElement The DesignLevel represents the vehicle electrical/electronic system on the design abstraction level. It includes primarily the Functional Design Architecture (FDA), and the HardwareDesignArchitecture (HDA). FDA represents a top level Function. It is supposed to implement all the functionalities of a vehicle, as specified by a FAA or a Vehicle level (if no FAA has been defined during the process). The design level in EAST-ADL includes the design architecture containing the functional specification and hardware architecture of the vehicle electrical/electronic system. The design architecture includes the FDA representing a decomposition of functionalities analyzed on the analysis level. The decomposition has the purpose of making it possible to meet constraints regarding non-functional properties such as allocation, efficiency, reuse, or supplier concerns. There is an n-to-m mapping between entities of the design level and the ones on the analysis level. Non-transparent infrastructure functionality such as mode changes and error handling are also represented at the design level, such that their impact on applications' behaviors can be estimated. The FDA parts are typed by DesignFunctionTypes and e.g. LocalDeviceManagers. The view of the HardwareArchitecture facilitates the realization of LocalDeviceManager as sensor/actuator HW elements. The HDA is the hardware design from a system perspective. The HDA has two purposes: 1) It shows the physical entities and how they are connected. 2) It is an allocation target for the Functions of the FDA. The HDA represents the hardware architecture of the embedded system. Its contained HW elements represent the physical aspects of the hardware entities and how they are connected. HardwareFunctionTypes associated to HW components represent the logical behavior of the contained HW elements. Semantics: The DesignLevel is the representation of the vehicle electrical/electronic system on the design abstraction level. It corresponds to the design of logical functions and boundaries extended in regards to resource commitment. Notation: The DesignLevel is shown as a solid-outline rectangle containing the name, with its ports or port groups on the perimeter. Contained entities may be shown with their connectors and allocations (White-box view). Extension: Class atpStructureElement DeviationAttributeSet specifies the set of rules of allowed deviations from the reference model in a referring model. These rules are important, because they make sure that the different FeatureModels, referring to one reference model, follow specific rules for deviation, so a later integration into one FeatureModel may be possible. Semantics: See description. Extension: DataType This rule sets whether and how the VehicleFeature attributes may be changed. Allowed values: no, append, yes. This rule sets whether and how the VehicleFeature cardinality (i.e. variability of the VehicleFeature) may be changed. Allowed values: no, subset, yes. This rule sets whether and how the VehicleFeature description may be changed. Allowed values: no, append, yes. This rule sets whether and how the VehicleFeature name may be changed. Allowed values: no, append, yes. This rule sets whether and how the VehicleFeature may be moved to another place in the feature diagram. Allowed values: no, subtree, yes. This rule sets if the reference feature may have a child without a corresponding referring feature among the children of the referring feature. Allowed values: no, subtree, yes. This rule sets whether and how adding may be done of a child feature (without a corresponding feature in the reference model). Allowed values: no, yes. This rule sets whether and how the immediate child features of the VehicleFeature are allowed to be regrouped (i.e. creation or deletion of FeatureGroups below the respective VehicleFeature). Allowed values: no, widen, yes. This rule sets if the feature in the referring model (compared to the reference model) may be deleted. Allowed values: no, yes. DeviationAttributeSet specifies the set of rules of allowed deviations from the reference model in a referring model. These rules are important, because they make sure that the different FeatureModels, referring to one reference model, follow specific rules for deviation, so a later integration into one FeatureModel may be possible. Semantics: See description. Extension: DataType Used to hold the values in an array. Constraints: [1] Shall be typed by an ArrayDatatype. Extension: UML2:LiteralSpecification atpPrototype Used to hold the values in an array. Constraints: [1] Shall be typed by an ArrayDatatype. Extension: UML2:LiteralSpecification atpPrototype A EABoolean value denotes a logical condition that is either 'true' or 'false'. Semantics: EABoolean is the primitive type that holds two literals: true, false. Notation: The datatype EABoolean is denoted using the rectangle symbol with keyword «Datatype Boolean». Extension: UML Boolean atpType A EABoolean value denotes a logical condition that is either 'true' or 'false'. Semantics: EABoolean is the primitive type that holds two literals: true, false. Notation: The datatype EABoolean is denoted using the rectangle symbol with keyword «Datatype Boolean». Extension: UML Boolean atpType Used to model a boolean value. Constraints: [1] Shall be typed by an EABoolean. Semantics: The semantics of this value is defined by the element typed by the typing EABoolean. Extension: UML2:LiteralBoolean atpPrototype Used to model a boolean value. Constraints: [1] Shall be typed by an EABoolean. Semantics: The semantics of this value is defined by the element typed by the typing EABoolean. Extension: UML2:LiteralBoolean atpPrototype Used to model values in a record. Constraints: [1] Shall be typed by an CompositeDatatype. [2] The values in this EACompositeValue shall be typed and ordered in the same way as the EADatatypePrototypes in the typing CompositeDatatype. Semantics: The semantics of this value is defined by the element typed by the typing CompositeDatatype. Extension: UML2:LiteralSpecification atpPrototype Used to model values in a record. Constraints: [1] Shall be typed by an CompositeDatatype. [2] The values in this EACompositeValue shall be typed and ordered in the same way as the EADatatypePrototypes in the typing CompositeDatatype. Semantics: The semantics of this value is defined by the element typed by the typing CompositeDatatype. Extension: UML2:LiteralSpecification atpPrototype The EADatatype is a metaclass, which signifies a type whose instances are identified only by their value. The EADatatype metaclass represents the description of the value set for some variable, parameter etc. without a description of how these possible values are represented at implementation level. The implementation representation is defined at implementation level by the AUTOSAR concept PrimitiveTypeWithSemantics, and the implemented datatype shall be associated with a Realization relationship. The realizing datatype must match the EADatatype regarding range, resolution, unit, and dimension. Semantics: EADatatype metaclass is a special kind of classifier, similar to a class. It differs from the class in that instances of a data type are identified only by their value. Constraints: [1] In the case of an AR implementation, an EADatatype is realized generally by PrimitiveTypeWithSemantics, which has to be consistent w.r.t. range, resolution, etc. Notation: The EADatatype is denoted using the rectangle symbol with keyword «Datatype». atpType The EADatatypePrototype represents a typed variable. An example is a composite datatype ColorValue with parts R, G, and B of type integer. ColorValue would contain three prototypes only to be able to reference the record parts by name. Semantics: The EADatatypePrototype represents a typed variable. It acts as an appearance of a datatype. Extension: Class atpPrototype isOfType The EADatatypePrototype represents a typed variable. An example is a composite datatype ColorValue with parts R, G, and B of type integer. ColorValue would contain three prototypes only to be able to reference the record parts by name. Semantics: The EADatatypePrototype represents a typed variable. It acts as an appearance of a datatype. Extension: Class atpPrototype The EAElement is an abstract metaclass that represents an arbitrary named entity in the domain model. It specializes AUTOSAR Identifiable which has the shortName attribute used for identification of the element within the namespace in which it is defined. The abbreviation EA in the name of this metaclass is short for EAST-ADL. Semantics: Also the EAElement can be used to extend the EAST-ADL approach to other languages and standards by adding a generalize relation from the respective (non EAST-ADL) element to the EAElement. Extension: The ADLEntity stereotype is an abstract stereotype which extends UML2 metaclass NamedElement. The ADLEntity stereotype thus includes the name property from UML2 metaclass:NamedElement. The stereotype representation of this metaclass may be concrete to allow for application on instances from other domain models. Optional descriptive name of the EAElement, this name does not have the length restrictions as found for the AUTOSAR Identfiable shortName. Used to model a value for an Enumeration or several values in a multivalued EnumerationValueType . Constraints: [1] Shall be typed by an Enumeration or an EnumerationValueType. Semantics: The semantics of this value is defined by the element typed by the typing Enumeration or the semantics defined in the EnumerationValueType. Extension: UML:InstanceSpecification atpPrototype Used to model a value for an Enumeration or several values in a multivalued EnumerationValueType . Constraints: [1] Shall be typed by an Enumeration or an EnumerationValueType. Semantics: The semantics of this value is defined by the element typed by the typing Enumeration or the semantics defined in the EnumerationValueType. Extension: UML:InstanceSpecification atpPrototype The mixed string EAExpression allow for modeling of expressions with references to elements in the model. Specializations within the metamodel define their syntax and the referred metaclasses used in the expressions. Semantics: Used for modeling of expressions with references to model elements. Different typing of the expression is possible, if e.g. typed by an EABooleanDatatype the evaluated expression results in a boolean value. atpMixedString,atpPrototype The mixed string EAExpression allow for modeling of expressions with references to elements in the model. Specializations within the metamodel define their syntax and the referred metaclasses used in the expressions. Semantics: Used for modeling of expressions with references to model elements. Different typing of the expression is possible, if e.g. typed by an EABooleanDatatype the evaluated expression results in a boolean value. atpMixedString,atpPrototype Datatype for numerical values. Semantics: EANumerical has attributes for modeling of the allowed range. Notation: The datatype EANumerical is denoted using the rectangle symbol with keyword «Datatype Numerical». Extension: UML Datatype atpType The maximal value of the range. The minimum value of the range. Datatype for numerical values. Semantics: EANumerical has attributes for modeling of the allowed range. Notation: The datatype EANumerical is denoted using the rectangle symbol with keyword «Datatype Numerical». Extension: UML Datatype atpType Used to model a numerical value. Constraints: [1] Shall be typed by an EANumerical or a RangeableValueType. Semantics: The semantics of this value is defined by the element typed by the type EADatatype. Extension: UML2:LiteralSpecification atpPrototype Used to model a numerical value. Constraints: [1] Shall be typed by an EANumerical or a RangeableValueType. Semantics: The semantics of this value is defined by the element typed by the type EADatatype. Extension: UML2:LiteralSpecification atpPrototype Used for organization of the packageable elements in the model. Semantics: EAPackages can be organized hierarchically, where each level may contain a number of EAPackageableElements. splitable splitable Used for organization of the packageable elements in the model. Semantics: EAPackages can be organized hierarchically, where each level may contain a number of EAPackageableElements. Elements that are packageable may be directly contained in a package. Semantics: Elements specializing EAPackageableElement can be created directly within an EAPackage. A string is a sequence of characters in some suitable character set used to display information about the model. Character sets may include non-Roman alphabets and characters. An instance of EAString defines a piece of text. The semantics of the string itself depends on its purpose. It can be a comment, computational language expression, OCL expression, etc. It is used for String attributes and String expressions in the metamodel. Semantics: EAString is the primitive type that defines a sequence of characters in some suitable character set used to display information. Notation: The datatype EAString is denoted using the rectangle symbol with keyword «Datatype String». Extension: UML String atpType A string is a sequence of characters in some suitable character set used to display information about the model. Character sets may include non-Roman alphabets and characters. An instance of EAString defines a piece of text. The semantics of the string itself depends on its purpose. It can be a comment, computational language expression, OCL expression, etc. It is used for String attributes and String expressions in the metamodel. Semantics: EAString is the primitive type that defines a sequence of characters in some suitable character set used to display information. Notation: The datatype EAString is denoted using the rectangle symbol with keyword «Datatype String». Extension: UML String atpType Used to model a string value. Constraints: [1] Shall be typed by an EAString. Semantics: The semantics of this value is defined by the element typed by the typing EAString. Extension: UML2:LiteralString atpPrototype Used to model a string value. Constraints: [1] Shall be typed by an EAString. Semantics: The semantics of this value is defined by the element typed by the typing EAString. Extension: UML2:LiteralString atpPrototype EAValue is an abstract element with concrete elements used to store typed values in the model. Some of the specializations correspond to UML2 literal specifications EAValue corresponds to UML2 Value Specification which is a typed element. The EAValue does not have a name and is contained where a value is modeled. Semantics: The semantics of this element is defined by the element typed by the corresponding EADatatype. Extension: UML2:ValueSpecification atpPrototype isOfType The root element of an exchanged XML file which contains an EAST-ADL model. Semantics: EAXML represents the root element of an EAST-ADL XML file. splitable The root element of an exchanged XML file which contains an EAST-ADL model. Semantics: EAXML represents the root element of an EAST-ADL XML file. The root element of an exchanged XML file which contains an EAST-ADL model. Semantics: EAXML represents the root element of an EAST-ADL XML file. ElectricalComponent represents a hardware element as e.g. relays, batteries, capacitors and other non-computational, non-interactional (with plant) elements. Semantics: ElectricalComponent may be active (e.g., a battery) or passive (main relay). Notation: ElectricalComponent is shown as a solid-outline rectangle. The rectangle contains the name, and its ports or port groups on the perimeter. atpType Indicates if the PowerSupply is active or passive. ElectricalComponent represents a hardware element as e.g. relays, batteries, capacitors and other non-computational, non-interactional (with plant) elements. Semantics: ElectricalComponent may be active (e.g., a battery) or passive (main relay). Notation: ElectricalComponent is shown as a solid-outline rectangle. The rectangle contains the name, and its ports or port groups on the perimeter. atpType An enumeration is a datatype whose values are enumerated in the model as enumeration literals. Enumeration is a kind of datatype, whose instances may be any of a number of user-defined enumeration literals. Semantics: Enumeration is a kind of datatype, whose instances may be any number > 1 of user-defined enumeration literals. Enumerations contain at least two literals, otherwise it would be a constant. The contained literals need to be ordered. Notation: The datatype Enumeration is denoted using the rectangle symbol with keyword «Datatype Enumeration». Extension: UML Enumeration atpType This boolean attribute is true, if multiple enumeration values can be selected. It is false, if only one enumeration value is allowed to be selected. An enumeration is a datatype whose values are enumerated in the model as enumeration literals. Enumeration is a kind of datatype, whose instances may be any of a number of user-defined enumeration literals. Semantics: Enumeration is a kind of datatype, whose instances may be any number > 1 of user-defined enumeration literals. Enumerations contain at least two literals, otherwise it would be a constant. The contained literals need to be ordered. Notation: The datatype Enumeration is denoted using the rectangle symbol with keyword «Datatype Enumeration». Extension: UML Enumeration atpType An enumeration literal is a user-defined data value for an enumeration. Semantics: An EnumerationLiteral defines an element of the run-time extension of an enumeration data type. An EnumerationLiteral has a name (inherited from EAElement) that can be used to identify it within its Enumeration datatype. The EnumerationLiteral name is scoped and must therefore be unique within its Enumeration. The run-time values corresponding to EnumerationLiterals can be compared for equality. Notation: An EnumerationLiteral is typically shown as a name, one per line, in the compartment of the Enumeration notation. Extension: UML EnumerationLiteral An enumeration literal is a user-defined data value for an enumeration. Semantics: An EnumerationLiteral defines an element of the run-time extension of an enumeration data type. An EnumerationLiteral has a name (inherited from EAElement) that can be used to identify it within its Enumeration datatype. The EnumerationLiteral name is scoped and must therefore be unique within its Enumeration. The run-time values corresponding to EnumerationLiterals can be compared for equality. Notation: An EnumerationLiteral is typically shown as a name, one per line, in the compartment of the Enumeration notation. Extension: UML EnumerationLiteral The collection of the environment functional descriptions. This collection can be done across the EAST-ADL abstraction levels. An environment model can contain functionPrototypes given by either AnalysisFunction or DesignFunction. The environment model does not have abstraction levels as in the system model (e.g., analysisLevel, designLevel). A functionPrototype of the environment model can have interactions with FAA FunctionalDevice and an FDA HardwareFunction through the ClampConnector. Semantics: Environment is a container element for the entities surrounding the EE architecture and their connections to the EE architecture. The function hierarchy of the Environment interacts with the EE System through Clamp Connectors connected to the SystemModel's functions. The collection of the environment functional descriptions. This collection can be done across the EAST-ADL abstraction levels. An environment model can contain functionPrototypes given by either AnalysisFunction or DesignFunction. The environment model does not have abstraction levels as in the system model (e.g., analysisLevel, designLevel). A functionPrototype of the environment model can have interactions with FAA FunctionalDevice and an FDA HardwareFunction through the ClampConnector. Semantics: Environment is a container element for the entities surrounding the EE architecture and their connections to the EE architecture. The function hierarchy of the Environment interacts with the EE System through Clamp Connectors connected to the SystemModel's functions. ErrorBehavior represents the descriptions of failure logics or semantics that the target element identified by the ErrorModelType exhibits. Typically the target is a system, a function, a software component, or a hardware device. Each ErrorBehavior description relates the occurrences of internal faults and incoming external faults to failures. The faults and failures that the errorBehavior propagates to and from the target element are declared through the ports of the error model. Semantics: ErrorBehavior defines the error propagation logic of its containing ErrorModelType. The ErrorBehavior description represents the error propagations from internal faults or incoming faults to external failures. Faults are identified by the internalFault and externalFault associations respectively. The propagated failures are identified by the externalFailure association. The ErrorBehavior is defined in the failureLogic string, either directly or as a URL referencing an external specification. The failureLogic can be based on different formalisms, depending on the analysis techniques and tools available. This is indicated by its type:ErrorBehaviorKind attribute. The failureLogic attribute contains the actual failure propagation logic. Extension: UML:Behavior The specification of error behavior based on an external formalism or the path to the file containing the external specification. The type of formalism applied for the error behavior description. ErrorBehavior represents the descriptions of failure logics or semantics that the target element identified by the ErrorModelType exhibits. Typically the target is a system, a function, a software component, or a hardware device. Each ErrorBehavior description relates the occurrences of internal faults and incoming external faults to failures. The faults and failures that the errorBehavior propagates to and from the target element are declared through the ports of the error model. Semantics: ErrorBehavior defines the error propagation logic of its containing ErrorModelType. The ErrorBehavior description represents the error propagations from internal faults or incoming faults to external failures. Faults are identified by the internalFault and externalFault associations respectively. The propagated failures are identified by the externalFailure association. The ErrorBehavior is defined in the failureLogic string, either directly or as a URL referencing an external specification. The failureLogic can be based on different formalisms, depending on the analysis techniques and tools available. This is indicated by its type:ErrorBehaviorKind attribute. The failureLogic attribute contains the actual failure propagation logic. Extension: UML:Behavior The ErrorModelPrototype is used to define hierarchical error models allowing additional detail or structure to be described in the error model of a particular target. A hierarchal structure can also be defined when several ErrorModels are integrated into a larger ErrorModel representing a system integrated from several targets. Typically the target is a system/subsystem, a function, a software component, or a hardware device. Semantics: An ErrorModelPrototype represents an occurrence of the ErrorModelType that types it. Extension: (See ADLFunctionPrototype) atpPrototype isOfType The ErrorModelPrototype is used to define hierarchical error models allowing additional detail or structure to be described in the error model of a particular target. A hierarchal structure can also be defined when several ErrorModels are integrated into a larger ErrorModel representing a system integrated from several targets. Typically the target is a system/subsystem, a function, a software component, or a hardware device. Semantics: An ErrorModelPrototype represents an occurrence of the ErrorModelType that types it. Extension: (See ADLFunctionPrototype) atpPrototype instanceRef instanceRef.target instanceRef.context instanceRef instanceRef instanceRef.target instanceRef.context instanceRef ErrorModelType and ErrorModelPrototype support the hierarchical composition of error models based on the type-prototype pattern also adopted for the nominal architecture composition. The purpose of the error models is to represent information relating to the anomalies of a nominal model element. An ErrorModelType represents the internal faults and fault propagations of the nominal element that it targets. Typically the target is a system/subsystem, a function, a software component, or a hardware device. ErrorModelType inherits the abstract metaclass TraceableSpecification, allowing the ErrorModelType to be referenced from its design context in a similar way as requirements, test cases and other specifications. Constraints: [1] An ErrorModelType without part shall have one errorBehaviorDescription. Semantics: The ErrorModelType represents a specification of the faults and fault propagations of its target element. Both types and prototypes may be targets, and the following cases are relevant: - One nominal type: The ErrorModelType represents the identified nominal type wherever this nominal type is instantiated. - Several nominal types: The ErrorModelType represents the identified nominal types individually, i.e. the same error model applies to all nominal types and is reused. - One nominal prototype: The ErrorModelType represents the identified nominal prototype whenever its context, i.e. its top-level composition is instantiated. - Several nominal prototypes with instanceref: The ErrorModelType represents the identified set of nominal prototypes (together) whenever their context, i.e. their top-level composition, is instantiated. The fault propagation of an errorModelType is defined by its contained parts, the ErrorModelPrototypes and their connections. In case it contains both parts and an errorBehaviorDescription, the errorBehaviorDescription shall be consistent with the parts. FaultFailurePropagationLinks define valid propagation paths in the ErrorModelType. In case the contained FaultInPorts and FailureOutPorts reference nominal ports, the connectivity of the nominal model may serve as a pattern for connecting ports in the ErrorModelType. The ErrorModelType contains internalFaults and externalFaults, representing faults that are either propagated to externalFailures or masked, according to the definition of its fault propagation. A processFault represents a flaw introduced during design, and may lead to any of the failures represented by the ErrorModelType. A processFault therefore has a direct propagation to all failures and cannot be masked. Extension: (see ADLTraceableSpecfication) atpType ErrorModelType and ErrorModelPrototype support the hierarchical composition of error models based on the type-prototype pattern also adopted for the nominal architecture composition. The purpose of the error models is to represent information relating to the anomalies of a nominal model element. An ErrorModelType represents the internal faults and fault propagations of the nominal element that it targets. Typically the target is a system/subsystem, a function, a software component, or a hardware device. ErrorModelType inherits the abstract metaclass TraceableSpecification, allowing the ErrorModelType to be referenced from its design context in a similar way as requirements, test cases and other specifications. Constraints: [1] An ErrorModelType without part shall have one errorBehaviorDescription. Semantics: The ErrorModelType represents a specification of the faults and fault propagations of its target element. Both types and prototypes may be targets, and the following cases are relevant: - One nominal type: The ErrorModelType represents the identified nominal type wherever this nominal type is instantiated. - Several nominal types: The ErrorModelType represents the identified nominal types individually, i.e. the same error model applies to all nominal types and is reused. - One nominal prototype: The ErrorModelType represents the identified nominal prototype whenever its context, i.e. its top-level composition is instantiated. - Several nominal prototypes with instanceref: The ErrorModelType represents the identified set of nominal prototypes (together) whenever their context, i.e. their top-level composition, is instantiated. The fault propagation of an errorModelType is defined by its contained parts, the ErrorModelPrototypes and their connections. In case it contains both parts and an errorBehaviorDescription, the errorBehaviorDescription shall be consistent with the parts. FaultFailurePropagationLinks define valid propagation paths in the ErrorModelType. In case the contained FaultInPorts and FailureOutPorts reference nominal ports, the connectivity of the nominal model may serve as a pattern for connecting ports in the ErrorModelType. The ErrorModelType contains internalFaults and externalFaults, representing faults that are either propagated to externalFailures or masked, according to the definition of its fault propagation. A processFault represents a flaw introduced during design, and may lead to any of the failures represented by the ErrorModelType. A processFault therefore has a direct propagation to all failures and cannot be masked. Extension: (see ADLTraceableSpecfication) atpType The Event class stands for all the forms of identifiable state changes that are possible to constrain with respect to timing using TADL2. Semantics: An event denotes a distinct form of state change in a running system, taking place at distinct points in time called occurrence of the event. That is, a running system can be observed by identifying certain forms of state changes to watch for, and for each such observation point, noting the times when changes occur. This notion of observation also applies to a hypothetical predicted run of a system or a system model - from a timing perspective, the only information that needs to be in the output of such a prediction is a sequence of times for each observation point, indicating the times that each event is predicted to occur. In system models, events appear syntactically as names indicating the state changes of interest. Semantically, an event name is a variable standing for some statically unknown set of occurrences. Note that this connection is purely conceptual; occurrences never exist concretely in any system model as they are a purely semantic notion representing the state changes that can be observed when a system is executed, or simulated, or perhaps only mathematically predicted. TADL2 assumes that occurrences are characterized by two pieces of information: a timestamp indicating when the corresponding state change occurred, and a color that partitions different event occurrences into groups that should be understood as being causally related. The timestamp is a real value of SI unit seconds, whereas the color value is drawn from some abstract, possibly infinite type whose only restriction is that must support an equality test on its values. An EventChain is a container for a pair of events that must be causally related. Semantics: A system behavior is consistent with respect to an event chain ec if and only if for each occurrence x in ec.stimulus, for each occurrence y in ec.response, if x.color = y.color then x < y An EventChain is a container for a pair of events that must be causally related. Semantics: A system behavior is consistent with respect to an event chain ec if and only if for each occurrence x in ec.stimulus, for each occurrence y in ec.response, if x.color = y.color then x < y An event of a Function refers to the triggering of the Function, i.e., when the input data is consumed. It can be used in conjunction with FunctionTrigger to define a time-driven triggering for a function. In this case the FunctionTrigger points to the EventFunction of the function and defines a triggerPolicy set to TIME. The timing constraint associated to the EventFunction provides information about the period. Compare categories of AUTOSAR runnables: 1a triggering only on start and finish (this type of event) 1b triggering allowed anytime during the execution (events on ports, see EventFunctionFlowPort). Semantics: The EventFunction refers to the triggering event of a referenced functionType or function (prototype). Triggering is the time when the function consumes data. Constraints: [1] An EventFunction either identifies a FunctionType or a FunctionPrototype as its target function. An event of a Function refers to the triggering of the Function, i.e., when the input data is consumed. It can be used in conjunction with FunctionTrigger to define a time-driven triggering for a function. In this case the FunctionTrigger points to the EventFunction of the function and defines a triggerPolicy set to TIME. The timing constraint associated to the EventFunction provides information about the period. Compare categories of AUTOSAR runnables: 1a triggering only on start and finish (this type of event) 1b triggering allowed anytime during the execution (events on ports, see EventFunctionFlowPort). Semantics: The EventFunction refers to the triggering event of a referenced functionType or function (prototype). Triggering is the time when the function consumes data. Constraints: [1] An EventFunction either identifies a FunctionType or a FunctionPrototype as its target function. Event that refers to the triggering of the Function at a client/server port, i.e., when the input data is sent / received, or when the output data is produced / received. Constraints: [1] eventKind is sentRequest or receivedResponse for a FunctionClientServerPort of type client. Rationale: Only these values make sense for client ports. [2] eventKind is receivedRequest or sentResponse for a FunctionClientServerPort of type server. Rationale: Only these values make sense for server ports. Semantics: EventFunctionClientServerPort refers to the time when data is sent or received at the ClientServerPort. atpMixedString,atpPrototype Event that refers to the triggering of the Function at a client/server port, i.e., when the input data is sent / received, or when the output data is produced / received. Constraints: [1] eventKind is sentRequest or receivedResponse for a FunctionClientServerPort of type client. Rationale: Only these values make sense for client ports. [2] eventKind is receivedRequest or sentResponse for a FunctionClientServerPort of type server. Rationale: Only these values make sense for server ports. Semantics: EventFunctionClientServerPort refers to the time when data is sent or received at the ClientServerPort. atpMixedString,atpPrototype instanceRef instanceRef.target instanceRef.context instanceRef Event that refers to the triggering of the Function at a flow port, i.e., when data is sent or received. Semantics: EventFunctionFlowPort refers to the time when data is sent or received at the FunctionFlowPort. atpMixedString,atpPrototype Event that refers to the triggering of the Function at a flow port, i.e., when data is sent or received. Semantics: EventFunctionFlowPort refers to the time when data is sent or received at the FunctionFlowPort. atpMixedString,atpPrototype instanceRef instanceRef.target instanceRef.context instanceRef instanceRef instanceRef.context instanceRef.target instanceRef An ExecutionTimeConstraint limits the time between the starting and stopping of an executable entity (function), not counting the intervals when the execution of such an executable entity (function) has been interrupted. Semantics: A system behavior satisfies an ExecutionTimeConstraint c if and only if for each occurrence x of event c.start, E is the set of times between x and the next c.stop occurrence, excluding the times between any c.preempt occurrence and its next c.resume occurrence, and c.lower <= length of all continuous intervals in E <= c.upper An ExecutionTimeConstraint limits the time between the starting and stopping of an executable entity (function), not counting the intervals when the execution of such an executable entity (function) has been interrupted. Semantics: A system behavior satisfies an ExecutionTimeConstraint c if and only if for each occurrence x of event c.start, E is the set of times between x and the next c.stop occurrence, excluding the times between any c.preempt occurrence and its next c.resume occurrence, and c.lower <= length of all continuous intervals in E <= c.upper Extend represents the specification that the behavior of a UseCase may be extended by the behavior of another (usually supplementary) UseCase. The extension takes place at one or more specific ExtensionPoints defined in the extended UseCase. Note, however, that the extended UseCase is defined independently of the extending UseCase and is meaningful independently of the extending UseCase. On the other hand, the extending UseCase typically defines behavior that may not necessarily be meaningful by itself. Instead, the extending UseCase defines a set of modular behavior increments that augment an execution of the extended UseCase under specific conditions. Note that the same extending UseCase can extend more than one UseCases. Furthermore, an extending UseCase may itself be extended. Semantics: An Extension relation identifies an extension UseCase which extends an extendedCase UseCase. Extend represents the specification that the behavior of a UseCase may be extended by the behavior of another (usually supplementary) UseCase. The extension takes place at one or more specific ExtensionPoints defined in the extended UseCase. Note, however, that the extended UseCase is defined independently of the extending UseCase and is meaningful independently of the extending UseCase. On the other hand, the extending UseCase typically defines behavior that may not necessarily be meaningful by itself. Instead, the extending UseCase defines a set of modular behavior increments that augment an execution of the extended UseCase under specific conditions. Note that the same extending UseCase can extend more than one UseCases. Furthermore, an extending UseCase may itself be extended. Semantics: An Extension relation identifies an extension UseCase which extends an extendedCase UseCase. ExtensionPoint represents a feature of a UseCase that identifies a point where the behavior of a UseCase can be augmented with elements of another (extending) UseCase. Semantics: ExtensionPoint identifies the point where the useCase UseCase ca be extended. ExtensionPoint represents a feature of a UseCase that identifies a point where the behavior of a UseCase can be augmented with elements of another (extending) UseCase. Semantics: ExtensionPoint identifies the point where the useCase UseCase ca be extended. An ExternalEvent instance stands for some particular form of state change. It is implied that the attribute description uniquely identifies the intended form of state change. It is also assumed that a description string is sufficiently informative to determine an unambiguous set of occurrences for each observation. An ExternalEvent instance stands for some particular form of state change. It is implied that the attribute description uniquely identifies the intended form of state change. It is also assumed that a description string is sufficiently informative to determine an unambiguous set of occurrences for each observation. The FailureOutPort represents a propagation point for failures that propagate out from the containing ErrorModelType.The EADatatype of the FailureOutPort defines the range of valid failures. Constraints: [1] The direction of the nominal port must be 'out'. Semantics: The value range of a FailureOutPort represents failures that can propagate to FaultInPorts in other ErrorModels. The value range is defined by the FailureOutPort's EADatatype. If nominal Ports HWTargets or FunctionTargets are referenced, the failures of the FailureOutPort correspond to data on these nominal ports. Extension: UML::Port atpPrototype The FailureOutPort represents a propagation point for failures that propagate out from the containing ErrorModelType.The EADatatype of the FailureOutPort defines the range of valid failures. Constraints: [1] The direction of the nominal port must be 'out'. Semantics: The value range of a FailureOutPort represents failures that can propagate to FaultInPorts in other ErrorModels. The value range is defined by the FailureOutPort's EADatatype. If nominal Ports HWTargets or FunctionTargets are referenced, the failures of the FailureOutPort correspond to data on these nominal ports. Extension: UML::Port atpPrototype The FaultFailure represents a certain fault or failure on its referenced Anomal(ies). The faultFailureValue specifies the value of the Anomaly that corresponds to the condition represented by the FaultFailure. Alternatively, a boolean expression over the referenced anomalies defines the condition represented by the FaultFailure. Semantics: A FaultFailure represents a fault or failure on the referenced Anomal(ies). The Faultfailure condition is satisfied when a) faultFailureValue is an EAValue and at least one of the referenced anomal(ies) is equal to this value or b) when faultFailureValue is a boolean EAExpression and the referenced anomal(ies) satisfies the expression, i.e. it evaluates to true. Constraints: [1] faultFailureValue shall have the same datatype as the referenced Anomal(ies) or be of type EABoolean. The FaultFailure represents a certain fault or failure on its referenced Anomal(ies). The faultFailureValue specifies the value of the Anomaly that corresponds to the condition represented by the FaultFailure. Alternatively, a boolean expression over the referenced anomalies defines the condition represented by the FaultFailure. Semantics: A FaultFailure represents a fault or failure on the referenced Anomal(ies). The Faultfailure condition is satisfied when a) faultFailureValue is an EAValue and at least one of the referenced anomal(ies) is equal to this value or b) when faultFailureValue is a boolean EAExpression and the referenced anomal(ies) satisfies the expression, i.e. it evaluates to true. Constraints: [1] faultFailureValue shall have the same datatype as the referenced Anomal(ies) or be of type EABoolean. Abstract port for Faults and Failures. Semantics: FaultFailurePort is abstract. Semantics is defined on its specializations. atpPrototype instanceRef instanceRef.target instanceRef.context instanceRef instanceRef instanceRef.context instanceRef.target instanceRef The FaultFailurePropagationLink metaclass represents the links for the propagations of faults/failures across system elements. In particular, it defines that one error model provides the faults/failures that another error model receives. A fault/failure link can only be applied to compatible ports, either for fault/failure delegation within an error model or for fault/failure transmission across two error models. A FaultFailurePropagationLink can only connect fault/failure ports that have compatible types. Constraints: [1] Only compatible fromPort-toPort pairs may be connected. [2] Two fault/failure ports are compatible if the EADatatype of the fromPort represents a subset of the Fault/Failure set represented by the toPort’s EADatatype. Semantics: The FaultFailurePropagationLink defines a Failure propagation path, from the fromPort on one error model to the toPort of another error model. Extension: UML::Connector The FaultFailurePropagationLink metaclass represents the links for the propagations of faults/failures across system elements. In particular, it defines that one error model provides the faults/failures that another error model receives. A fault/failure link can only be applied to compatible ports, either for fault/failure delegation within an error model or for fault/failure transmission across two error models. A FaultFailurePropagationLink can only connect fault/failure ports that have compatible types. Constraints: [1] Only compatible fromPort-toPort pairs may be connected. [2] Two fault/failure ports are compatible if the EADatatype of the fromPort represents a subset of the Fault/Failure set represented by the toPort’s EADatatype. Semantics: The FaultFailurePropagationLink defines a Failure propagation path, from the fromPort on one error model to the toPort of another error model. Extension: UML::Connector instanceRef instanceRef.context instanceRef.target instanceRef instanceRef instanceRef.context instanceRef.target instanceRef instanceRef instanceRef.target instanceRef.context instanceRef The FaultInPort represents a propagation point for faults that propagate to the containing ErrorModelType. The EADatatype of the FaultInPort defines the range of valid failures. Constraints: [1] The direction of the nominal port must be 'in'. Semantics: The value range of a FaultInPort represents faults propagated from a FailureOutPort in another ErrorModel. The value range is defined by the FaultInPort's EADatatype. If nominal Ports HWTarget or FunctionTarget are referenced, the faults on the FaultInPort correspond to data on these nominal ports. Extension: UML::Port atpPrototype The FaultInPort represents a propagation point for faults that propagate to the containing ErrorModelType. The EADatatype of the FaultInPort defines the range of valid failures. Constraints: [1] The direction of the nominal port must be 'in'. Semantics: The value range of a FaultInPort represents faults propagated from a FailureOutPort in another ErrorModel. The value range is defined by the FaultInPort's EADatatype. If nominal Ports HWTarget or FunctionTarget are referenced, the faults on the FaultInPort correspond to data on these nominal ports. Extension: UML::Port atpPrototype A Feature represents a characteristic or trait of some object of consideration. The actual object of consideration depends on the particular purpose of the feature's containing feature model. Example 1: The core technical feature model on vehicle level defines the technical properties of the complete system, i.e., vehicle. So its object of consideration is the vehicle as a whole and therefore its features represent characteristics or traits of the vehicle as a whole. Example 2: The public feature model of some function F in the FDA defines the features of this particular software function. So its object of consideration is function F and therefore its features represent characteristics or traits of this function F. Semantics: Feature is a (non)functional characteristic, constraint or property that can be present or not in a (vehicle) product line. Extension: Class atpStructureElement Specifies the Feature's cardinality stating how often this feature may be selected during configuration. Typical cardinalities include: - A cardinality of 0..1 means that this Feature is optional, i.e. it can be selected or deselected during configuration. - A cardinality of 1 means that this Feature is mandatory, i.e. it cannot be deselected but is always present in a configuration if its parent feature is present; mandatory root features are present in all configurations. - A cardinality of 0 means that this Feature is abstract, i.e. it cannot be selected and is never present in any configuration. This can be used to completely disable a feature and, in the case of non-leaf features, the whole subtree below it, for example to tentatively remove a subtree without (yet) deleting it completely from the model. - A cardinality with an upper bound greater than 1 or * (infinite), such as [0..2], [1..*], or [2..8], means that this Feature is cloned, i.e. it may be selected more than once during configuration. If such a feature is actually selected more than once in a particular configuration, then its entire subtree may be configured differently for each selection. Cloned features are in fact instantiated during configuration and each instance is provided with a name. Note that using cloned features, i.e. features with cardinality having an upper bound greater than 1, has far-reaching consequences for how Features are applied. If this is not desired/needed in a certain project, cardinalities >1 can be prohibited by specifying an appropriate complianceLevel in the FeatureModel. As a general guideline, cloned features should be avoided as far as possible. In some situations, however, they can prove extremely useful and elegant. For example, consider the feature model of a wiper system; in order to allow for an extremely flexible configuration of the interval modes, a single parameterized cloned feature can be used: "IntervalMode[2..*] : Float". With this single cloned feature, any number of intervals can be created (but at least 2) and for each interval a precise duration in sec can be configured; without cloned features, this degree of flexibility could not easily be achieved. A Feature represents a characteristic or trait of some object of consideration. The actual object of consideration depends on the particular purpose of the feature's containing feature model. Example 1: The core technical feature model on vehicle level defines the technical properties of the complete system, i.e., vehicle. So its object of consideration is the vehicle as a whole and therefore its features represent characteristics or traits of the vehicle as a whole. Example 2: The public feature model of some function F in the FDA defines the features of this particular software function. So its object of consideration is function F and therefore its features represent characteristics or traits of this function F. Semantics: Feature is a (non)functional characteristic, constraint or property that can be present or not in a (vehicle) product line. Extension: Class atpStructureElement FeatureConfiguration defines an actual configuration of a FeatureModel, in particular the selection or deselection of optional features, values for selected parameterized features, and instance creations for cloned features. Note that configurations of feature models are realized as a specialization of metaclass ConfigurationDecisionModel. This is possible because a ConfigurationDecisionModel also captures the configuration, i.e., of its target feature model(s); while in the standard case of ConfigurationDecisionModel this target-side configuration depends on a given configuration of source feature model(s), here we simply define a "constant" target-side configuration without considering any source configurations. Therefore, the FeatureConfiguration meta-class has additional constraints compared to the super-class ConfigurationDecisionModel: the FeatureConfiguration has no source FeatureModel and only a single target FeatureModel, which serves as the FeatureModel being configured, explicitly defined through association 'configuredFeatureModel'. And since there is no source feature model to which the criterion can refer, all ConfigurationDecisions in a FeatureConfiguration must have "true" as their criterion. Semantics: The FeatureConfiguration specifies a concrete configuration of a feature model, in particular which Features of this FeatureModel are selected or deselected. Extension: Class Constraint: [1] Attribute criterion of all ConfigurationDecisions in a FeatureConfiguration must be set to "true". FeatureConfiguration defines an actual configuration of a FeatureModel, in particular the selection or deselection of optional features, values for selected parameterized features, and instance creations for cloned features. Note that configurations of feature models are realized as a specialization of metaclass ConfigurationDecisionModel. This is possible because a ConfigurationDecisionModel also captures the configuration, i.e., of its target feature model(s); while in the standard case of ConfigurationDecisionModel this target-side configuration depends on a given configuration of source feature model(s), here we simply define a "constant" target-side configuration without considering any source configurations. Therefore, the FeatureConfiguration meta-class has additional constraints compared to the super-class ConfigurationDecisionModel: the FeatureConfiguration has no source FeatureModel and only a single target FeatureModel, which serves as the FeatureModel being configured, explicitly defined through association 'configuredFeatureModel'. And since there is no source feature model to which the criterion can refer, all ConfigurationDecisions in a FeatureConfiguration must have "true" as their criterion. Semantics: The FeatureConfiguration specifies a concrete configuration of a feature model, in particular which Features of this FeatureModel are selected or deselected. Extension: Class Constraint: [1] Attribute criterion of all ConfigurationDecisions in a FeatureConfiguration must be set to "true". Captures a constraint on the containing feature model's configuration which is too complex to be expressed by way of a FeatureLink. In general, all constraints that can be expressed by a FeatureLink can also be expressed by a FeatureConstraint, but not vice versa. Semantics: See description. The actual constraint. This is a logic expression in VSL like the criterion of a ConfigurationDecision. For the constraint to be met this expression always has to evaluate to true. For example, to express a mutual exclusion of two features, use the expression "! (Radar & RainSensor)". However, note that this particular constraint could also be formulated as a FeatureLink with type "excludes". Captures a constraint on the containing feature model's configuration which is too complex to be expressed by way of a FeatureLink. In general, all constraints that can be expressed by a FeatureLink can also be expressed by a FeatureConstraint, but not vice versa. Semantics: See description. FeatureFlaw denotes an abstract failure of a set of items, i.e. an inability to fulfill one or several of its requirements. Semantics: FeatureFlaw represents functional anomalies derivable from each foreseeable source. nonFulfilledRequirements identifies those requirements that correspond to the FeatureFlaw. Extension: UML::Class FeatureFlaw denotes an abstract failure of a set of items, i.e. an inability to fulfill one or several of its requirements. Semantics: FeatureFlaw represents functional anomalies derivable from each foreseeable source. nonFulfilledRequirements identifies those requirements that correspond to the FeatureFlaw. Extension: UML::Class FeatureGroup is a specialization of the FeatureTreeNode, enabling grouping of several Features. Semantics: FeatureGroup is a grouping entity for sibling Features to reflect variability for a set of Features. Extension: Class The cardinality of the FeatureGroup, specifies how the grouped features, in featureGroup, can be combined. For example, a FeatureGroup owning the two Features A and B, and with a cardinality of [1], means that A and B are alternatives, but only one of them can be chosen. Mandatory features among the child features count as 1 and for cloned features all instances created in the configuration count. FeatureGroup is a specialization of the FeatureTreeNode, enabling grouping of several Features. Semantics: FeatureGroup is a grouping entity for sibling Features to reflect variability for a set of Features. Extension: Class A FeatureLink resembles a Relationship between two Features referred to as 'start' and 'end' feature (such as "feature S requires feature E" or "S excludes E"). The type of the FeatureLink specifies the precise semantics of the relationship. There are several predefined types, for example "needs" states that S requires E. In addition, user-defined types are allowed as well. For user-defined types, attribute 'customType' provides a unique identifier of the custom link type and attribute 'isBidirectional' states whether the link is uni- or bidirectional. FeatureLinks are similar to FeatureConstraints but much more restricted. The rationale for having FeatureLinks in addition to FeatureConstraints is that in many cases FeatureLinks are sufficient and tools can deal with them more easily and appropriately (e.g. they can easily be presented visually as arrows in a diagram). Semantics: The FeatureLink is a relationship between Features that may constrain the selection of Features involved in the relationship. Constraints: [1] The start and end Features of a FeatureLink must be contained in the FeatureModel that contains the FeatureLink. Extension: AssociationClass The custom type of this FeatureLink identified by a String value. This attribute's value is ignored if attribute 'kind' is set to some other value than 'custom'. Each company or project can decide to use additional link types by defining unique key-words for them. In cases where FeatureModels are shared with third parties (other departments, companies, etc.) a globally unique type string must be used. Follow the instructions for finding globally unique keys for user attributes (cf. documentation of metaclass UserAttributeValue). Tells whether the FeatureLink is bidirectional or unidirectional. For predefined kinds, such as "needs", "mandatoryAlternative", etc., this attribute will be ignored and the kind determines whether the link is bidirectional or not (as defined in the documentation of attribute 'type', below). For custom kinds, this attribute may be provided to explicitly state the link's direction. If this attribute is not provided in case of a custom link type, then the link is assumed to be unidirectional. The kind determines the precise semantics of the relation between the FeatureLink's start and end feature. There are 5 predefined kinds as defined by enumeration VariabilityDependencyKind and in the case of kind 'custom' the attribute customType can be used to define a custom feature link type. A FeatureLink resembles a Relationship between two Features referred to as 'start' and 'end' feature (such as "feature S requires feature E" or "S excludes E"). The type of the FeatureLink specifies the precise semantics of the relationship. There are several predefined types, for example "needs" states that S requires E. In addition, user-defined types are allowed as well. For user-defined types, attribute 'customType' provides a unique identifier of the custom link type and attribute 'isBidirectional' states whether the link is uni- or bidirectional. FeatureLinks are similar to FeatureConstraints but much more restricted. The rationale for having FeatureLinks in addition to FeatureConstraints is that in many cases FeatureLinks are sufficient and tools can deal with them more easily and appropriately (e.g. they can easily be presented visually as arrows in a diagram). Semantics: The FeatureLink is a relationship between Features that may constrain the selection of Features involved in the relationship. Constraints: [1] The start and end Features of a FeatureLink must be contained in the FeatureModel that contains the FeatureLink. Extension: AssociationClass FeatureModel denotes a model owning Features. The FeatureModel can be used to describe variability and commonality of a specified electrical/electronic system at any abstraction level in the SystemModel. The FeatureModel can be used either to describe the variability within a particular Function or to describe the overall variability of a vehicle (cf. VehicleLevel). The FeatureModel describing internal variability of a FunctionType refers to the VehicleLevel by a «realizes» link (informative). Note, however, that a FeatureModel per definition does not always have to define variability. If a feature model contains only mandatory features, then its purpose is completely unrelated to variability. The features in such a FeatureModel could serve, for example, as invariant "coarse-grained requirements". The most important example is the core technical feature model on vehicle level which is also used for SystemModels that do not contain any variability at all. However, most uses of feature models in EAST-ADL are primarily motivated by variability definition and management. A public, local FeatureModel of an artifact element realizes a VehicleFeature of the VehicleLevel. Semantics: The FeatureModel has no specific semantics. Further subclasses of FeatureModel will add semantics appropriate to the concept they represent. Extension: Package atpStructureElement FeatureModel denotes a model owning Features. The FeatureModel can be used to describe variability and commonality of a specified electrical/electronic system at any abstraction level in the SystemModel. The FeatureModel can be used either to describe the variability within a particular Function or to describe the overall variability of a vehicle (cf. VehicleLevel). The FeatureModel describing internal variability of a FunctionType refers to the VehicleLevel by a «realizes» link (informative). Note, however, that a FeatureModel per definition does not always have to define variability. If a feature model contains only mandatory features, then its purpose is completely unrelated to variability. The features in such a FeatureModel could serve, for example, as invariant "coarse-grained requirements". The most important example is the core technical feature model on vehicle level which is also used for SystemModels that do not contain any variability at all. However, most uses of feature models in EAST-ADL are primarily motivated by variability definition and management. A public, local FeatureModel of an artifact element realizes a VehicleFeature of the VehicleLevel. Semantics: The FeatureModel has no specific semantics. Further subclasses of FeatureModel will add semantics appropriate to the concept they represent. Extension: Package atpStructureElement The abstract base class for all nodes in a feature tree. Semantics: FeatureTreeNode has no specific semantics. Further subclasses of FeatureTreeNode will add semantics appropriate to the concept they represent. Extension: abstract, no extension This class represents the syntax of the formula language. The class is modeled as an abstract class in order to be specialized into particular usecases. For each usecase the referrable objects might be specified in the specialization. atpMixedString FunctionAllocation represents an allocation constraint binding an AllocateableElement (computation functions or communication connectors) on an AllocationTarget (computation or communication resource). Semantics: AllocationTarget is specialized by HardwareComponentPrototype in the HardwareModeling package and AllocateableElement is specialized by the concrete elements DesignFunctionPrototype and FunctionConnector in the FunctionModeling package. Notation: A FunctionAllocation is shown as a dependency (dashed line) with an "allocation" keyword attached to it. Extension: Class, specializesDesignConstraint target to AUTOSAR::ECUResourceTemplate::ECU allocatedAutosarComponent to AUTOSAR::Components::ClientPort ToDo: Cf. AUTOSAR SWMapping::MappingConstraint FunctionAllocation represents an allocation constraint binding an AllocateableElement (computation functions or communication connectors) on an AllocationTarget (computation or communication resource). Semantics: AllocationTarget is specialized by HardwareComponentPrototype in the HardwareModeling package and AllocateableElement is specialized by the concrete elements DesignFunctionPrototype and FunctionConnector in the FunctionModeling package. Notation: A FunctionAllocation is shown as a dependency (dashed line) with an "allocation" keyword attached to it. Extension: Class, specializesDesignConstraint target to AUTOSAR::ECUResourceTemplate::ECU allocatedAutosarComponent to AUTOSAR::Components::ClientPort ToDo: Cf. AUTOSAR SWMapping::MappingConstraint instanceRef instanceRef.target instanceRef.context instanceRef instanceRef instanceRef.target instanceRef.context instanceRef FunctionBehavior represents the behavior of a particular FunctionType - referred to by the association to FunctionType. What is meant by behavior is a transfer function performing some data computation (in case of FlowPort interaction) or an operation that can be called by another function (in case of ClientServer interaction). The representation property indicates the kind of representation used to describe the behavior (see FunctionBehaviorKind). The representation itself (e.g., defined in an external model file) is identified by a URL String in the path property. If the representation is provided in the same model file as the system itself, the path property is not used. It is merely a placeholder for the purpose of containing information about and links to the external behavioral model. FunctionBehavior may refer to execution modes by the association to the element Mode. This is not mandatory; however, when provided, the relation indicates the list of execution Modes in which the FunctionBehavior can potentially be executed (see element Mode). The triggering of a FunctionBehavior is unknown to the behavior. It is defined by FunctionTriggers (see this element). Note that the association between FunctionBehavior and FunctionType is specified as a one-way navigable link from FunctionBehavior to FunctionType: what this means is that the EAST-ADL language specification does not require a FunctionType be aware of the FunctionBehavior it is assigned to. Only the navigation from behavior to function is mandatory; the implementation of a reverse link might however be provided depending on the tool support. Although each FunctionBehavior can refer to at most one FunctionType, note that several FunctionBehaviors can refer to the same FunctionType. In this case, when a FunctionType has several behaviors, only one behavior shall be active at any given time instant, i.e., no concurrent behaviors are allowed in EAST-ADL functions. For instance we cannot have one active behavior in Simulink and one in Modelica. Both can be referenced in the same function, but at any given time, only one is executable. Conditions such as modes and variability must prevent two behaviors being potentially active at the same time. Note also that FunctionBehaviors are assigned to FunctionTypes and not to FunctionPrototypes. This means that among a set of FunctionPrototypes, which share the same type, behaviors are also shared. However when a FunctionBehavior refer to Modes, which are referred to by different FunctionTriggers, different triggering conditions can be provided among a set of FunctionPrototypes for the same set of behaviors - see FunctionTrigger. In the case where the identified FunctionType is decomposed into parts, the behavior is a specification for the composed behavior of the FunctionType. Semantics: The semantics of FunctionBehavior follows the semantics of the behavioral representation/tool used (for instance SIMULINK, ASCET, etc.). However, in relation to the EAST-ADL model, the FunctionBehavior has synchronous execution semantics: 1. Read inputs from input ports 2. Execute behavior with fixed inputs (run to completion) 3. Provide outputs to output ports The data transfer between the EAST-ADL ports and the FunctionBehavior is representation/tool-specific and considered part of the execution of the FunctionBehavior. Notation: FunctionBehavior appears as a solid-outline rectangle with "Behavior" at the top right. The rectangle contains the name. Extension: Behavior The path to the file or model entity containing the behavior. The type of representation used to describe the behavior. FunctionBehavior represents the behavior of a particular FunctionType - referred to by the association to FunctionType. What is meant by behavior is a transfer function performing some data computation (in case of FlowPort interaction) or an operation that can be called by another function (in case of ClientServer interaction). The representation property indicates the kind of representation used to describe the behavior (see FunctionBehaviorKind). The representation itself (e.g., defined in an external model file) is identified by a URL String in the path property. If the representation is provided in the same model file as the system itself, the path property is not used. It is merely a placeholder for the purpose of containing information about and links to the external behavioral model. FunctionBehavior may refer to execution modes by the association to the element Mode. This is not mandatory; however, when provided, the relation indicates the list of execution Modes in which the FunctionBehavior can potentially be executed (see element Mode). The triggering of a FunctionBehavior is unknown to the behavior. It is defined by FunctionTriggers (see this element). Note that the association between FunctionBehavior and FunctionType is specified as a one-way navigable link from FunctionBehavior to FunctionType: what this means is that the EAST-ADL language specification does not require a FunctionType be aware of the FunctionBehavior it is assigned to. Only the navigation from behavior to function is mandatory; the implementation of a reverse link might however be provided depending on the tool support. Although each FunctionBehavior can refer to at most one FunctionType, note that several FunctionBehaviors can refer to the same FunctionType. In this case, when a FunctionType has several behaviors, only one behavior shall be active at any given time instant, i.e., no concurrent behaviors are allowed in EAST-ADL functions. For instance we cannot have one active behavior in Simulink and one in Modelica. Both can be referenced in the same function, but at any given time, only one is executable. Conditions such as modes and variability must prevent two behaviors being potentially active at the same time. Note also that FunctionBehaviors are assigned to FunctionTypes and not to FunctionPrototypes. This means that among a set of FunctionPrototypes, which share the same type, behaviors are also shared. However when a FunctionBehavior refer to Modes, which are referred to by different FunctionTriggers, different triggering conditions can be provided among a set of FunctionPrototypes for the same set of behaviors - see FunctionTrigger. In the case where the identified FunctionType is decomposed into parts, the behavior is a specification for the composed behavior of the FunctionType. Semantics: The semantics of FunctionBehavior follows the semantics of the behavioral representation/tool used (for instance SIMULINK, ASCET, etc.). However, in relation to the EAST-ADL model, the FunctionBehavior has synchronous execution semantics: 1. Read inputs from input ports 2. Execute behavior with fixed inputs (run to completion) 3. Provide outputs to output ports The data transfer between the EAST-ADL ports and the FunctionBehavior is representation/tool-specific and considered part of the execution of the FunctionBehavior. Notation: FunctionBehavior appears as a solid-outline rectangle with "Behavior" at the top right. The rectangle contains the name. Extension: Behavior The FunctionClientServerInterface is used to specify the operations in FunctionClientServerPorts. Semantics: The operations of the FunctionClientServerInterface are required or provided through the FunctionClientServerPorts typed by the FunctionClientServerInterface. Extension: UML Interface atpType The FunctionClientServerInterface is used to specify the operations in FunctionClientServerPorts. Semantics: The operations of the FunctionClientServerInterface are required or provided through the FunctionClientServerPorts typed by the FunctionClientServerInterface. Extension: UML Interface atpType The FunctionClientServerPort is a FunctionPort for client-server interaction. A number of FunctionClientServerPorts of clientServerType "client" can be connected to one FunctionClientServerPort of clientServerType "server", i.e. when connected the multiplicity for the connection is n to 1 for client and server. Semantics: The FunctionClientServerPort is a FunctionPort for client-server interaction. FunctionClientServerPorts are single buffer overwrite and nonconsumable. Constraints: [1] A FunctionClientServerPort of clientServerType "client" can only be connected to one FunctionClientServerPort of clientServerType "server". Extension: UML Port atpPrototype isOfType The FunctionClientServerPort is a FunctionPort for client-server interaction. A number of FunctionClientServerPorts of clientServerType "client" can be connected to one FunctionClientServerPort of clientServerType "server", i.e. when connected the multiplicity for the connection is n to 1 for client and server. Semantics: The FunctionClientServerPort is a FunctionPort for client-server interaction. FunctionClientServerPorts are single buffer overwrite and nonconsumable. Constraints: [1] A FunctionClientServerPort of clientServerType "client" can only be connected to one FunctionClientServerPort of clientServerType "server". Extension: UML Port atpPrototype The FunctionConnector indicates that the connected FunctionPorts exchange signals or client-server requests/responses. A FunctionConnector used to connect ports of parts within a FunctionType are called assembly connecors. A FunctionConnector between a port of a part and a port of the FunctionType itself is called a delegation connector. Semantics: The FunctionConnector connects a pair of FunctionFlowPorts or FunctionClientServerPorts. If two FunctionFlowPorts are connected, data elements of the type of the output FunctionFlowPort flow from the output FunctionFlowPort to the input FunctionFlowPort. If FunctionClientServerPorts are connected, the client calls the server according to the operations of the interfaces. The FunctionPrototype with the connected port has to be identified by the FunctionConnector as well. The FunctionConnector is normally routed according to the hardware topology and the allocation of source and destination. If there are redundant paths, a FunctionAllocation may be used to prescribe allocation. Constraints: [1] Can connect two FunctionFlowPorts of different directions when this is an assembly FunctionConnector. [2] Can connect two FunctionFlowPorts of the same direction when this is a delegation FunctionConnector. [3] Can connect two ClientServerPorts of different kinds when this is an assembly FunctionConnector. [4] Can connect two ClientServerPorts of the same kind when this is a delegation FunctionConnector. [5] Can connect two FunctionFlowPorts with direction inout. Notation: FunctionConnector is shown as a solid line Extension: UML Connector atpStructureElement The FunctionConnector indicates that the connected FunctionPorts exchange signals or client-server requests/responses. A FunctionConnector used to connect ports of parts within a FunctionType are called assembly connecors. A FunctionConnector between a port of a part and a port of the FunctionType itself is called a delegation connector. Semantics: The FunctionConnector connects a pair of FunctionFlowPorts or FunctionClientServerPorts. If two FunctionFlowPorts are connected, data elements of the type of the output FunctionFlowPort flow from the output FunctionFlowPort to the input FunctionFlowPort. If FunctionClientServerPorts are connected, the client calls the server according to the operations of the interfaces. The FunctionPrototype with the connected port has to be identified by the FunctionConnector as well. The FunctionConnector is normally routed according to the hardware topology and the allocation of source and destination. If there are redundant paths, a FunctionAllocation may be used to prescribe allocation. Constraints: [1] Can connect two FunctionFlowPorts of different directions when this is an assembly FunctionConnector. [2] Can connect two FunctionFlowPorts of the same direction when this is a delegation FunctionConnector. [3] Can connect two ClientServerPorts of different kinds when this is an assembly FunctionConnector. [4] Can connect two ClientServerPorts of the same kind when this is a delegation FunctionConnector. [5] Can connect two FunctionFlowPorts with direction inout. Notation: FunctionConnector is shown as a solid line Extension: UML Connector atpStructureElement instanceRef instanceRef.target instanceRef.context instanceRef The FunctionFlowPort is a metaclass for flowports, inspired by the SysML FlowPort. Semantics: FunctionFlowPorts are single buffer overwrite and nonconsumable. FunctionFlowPorts can be connected if their FunctionPort signatures match; i.e.: EADatatypes that are ValueTypes are compatible if * They have the same "dimension". * They have the same "unit". EADatatypes that are RangeableValueTypes are compatible if * The source EADatatype has the same or better "accuracy". * They have the same baseRangeable. * The source EADatatype has the same or smaller "maxValue". * The source EADatatype has the same or higher "minValue". * The source EADatatype has the same or higher "resolution". * They have the same "significantDigits". EADatatypes that are EnumerationValueTypes are compatible if * They have the same baseEnumeration. A FunctionFlowPort with direction=in is called an input FunctionFlowPort: The input FunctionFlowPort indicates that the containing Function requires input data. The EADatatype of this data is defined by the associated EADatatype. The data is sampled at the invocation of the containing entity for discrete Functions. For continuous Functions, the input FunctionFlowPort represents a continuous input connection point. The input FunctionFlowPort declares a reception point of data. It represents a single element buffer, which is overridden with the latest data. The type of the data is defined by the associated EADatatype. A FunctionFlowPort with direction=out is called an output FunctionFlowPort: The output FunctionFlowPort indicates that the containing Function provides output data. The EADatatype of this data is defined by the associated EADatatype. The data is sent at the completion of the containing entity for discrete Functions. For continuous Functions, the output FunctionFlowPort represents a (time-)continuous output connection point. The output FunctionFlowPort declares a transmission point of data. The type of the data is defined by the associated EADatatype. Extension: UML Port, specialization of SysML::FlowPort atpPrototype isOfType The FunctionFlowPort is a metaclass for flowports, inspired by the SysML FlowPort. Semantics: FunctionFlowPorts are single buffer overwrite and nonconsumable. FunctionFlowPorts can be connected if their FunctionPort signatures match; i.e.: EADatatypes that are ValueTypes are compatible if * They have the same "dimension". * They have the same "unit". EADatatypes that are RangeableValueTypes are compatible if * The source EADatatype has the same or better "accuracy". * They have the same baseRangeable. * The source EADatatype has the same or smaller "maxValue". * The source EADatatype has the same or higher "minValue". * The source EADatatype has the same or higher "resolution". * They have the same "significantDigits". EADatatypes that are EnumerationValueTypes are compatible if * They have the same baseEnumeration. A FunctionFlowPort with direction=in is called an input FunctionFlowPort: The input FunctionFlowPort indicates that the containing Function requires input data. The EADatatype of this data is defined by the associated EADatatype. The data is sampled at the invocation of the containing entity for discrete Functions. For continuous Functions, the input FunctionFlowPort represents a continuous input connection point. The input FunctionFlowPort declares a reception point of data. It represents a single element buffer, which is overridden with the latest data. The type of the data is defined by the associated EADatatype. A FunctionFlowPort with direction=out is called an output FunctionFlowPort: The output FunctionFlowPort indicates that the containing Function provides output data. The EADatatype of this data is defined by the associated EADatatype. The data is sent at the completion of the containing entity for discrete Functions. For continuous Functions, the output FunctionFlowPort represents a (time-)continuous output connection point. The output FunctionFlowPort declares a transmission point of data. The type of the data is defined by the associated EADatatype. Extension: UML Port, specialization of SysML::FlowPort atpPrototype The ports conserve variables for component interaction. Semantics: Subclasses of the abstract class FunctionPort add their own semantics. atpPrototype The FunctionPowerPort is a FunctionPort for denoting the physical interactions between environment and sensing/actuation functions. Semantics: The FunctionPowerPort conserves physical variables in a dynamic process. The typing CompositeDatatype owns two EADatatypePrototypes called Across and Through, representing the exchanged physical variables of the FunctionPowerPort. In two or more directly connected function power ports, the Across variables always get the same value and the Through variables always sum up to zero. Constraints: [1] The owner of a FunctionPowerPort is either a FunctionalDevice, a HardwareFunctionType, or a FunctionType for environment [2] Two connected FunctionPowerPort must have the same Datatype. [3] The typing Datatype shall have two datatypePrototypes called Across and Through, with Datatypes that are consistent and representing the variables of the PowerPort. Extension: UML Port atpPrototype isOfType The FunctionPowerPort is a FunctionPort for denoting the physical interactions between environment and sensing/actuation functions. Semantics: The FunctionPowerPort conserves physical variables in a dynamic process. The typing CompositeDatatype owns two EADatatypePrototypes called Across and Through, representing the exchanged physical variables of the FunctionPowerPort. In two or more directly connected function power ports, the Across variables always get the same value and the Through variables always sum up to zero. Constraints: [1] The owner of a FunctionPowerPort is either a FunctionalDevice, a HardwareFunctionType, or a FunctionType for environment [2] Two connected FunctionPowerPort must have the same Datatype. [3] The typing Datatype shall have two datatypePrototypes called Across and Through, with Datatypes that are consistent and representing the variables of the PowerPort. Extension: UML Port atpPrototype FunctionPrototype represents a reference to the occurrence of a FunctionType when it acts as a part. A concrete specialization of the FunctionPrototype is typed by a concrete specialization of FunctionType. FunctionTrigger in the Behavior package is associated with a FunctionPrototype. Semantics: The FunctionPrototype is an abstract concept with concrete specializations for the use on the AnalysisLevel and DesignLevel. Notation: Shall be shown in the same style as the class specified as type, however it shall be clear that this is a part. Extension: To specialize SysML::BlockProperty, which extends Property atpPrototype FunctionTrigger represents the triggering parameters necessary to define the execution of an identified FunctionType or FunctionPrototype. When referring to a FunctionType, a FunctionTrigger applies to all FunctionPrototypes of the given type. When referring to a FunctionPrototype, the trigger is only valid for this particular FunctionPrototype. Triggering is defined either as event-driven or time-driven - depending on the property triggerPolicy. If set to TIME, the timing constraint is defined with an event constraint associated with the Function's or FunctionPrototype's EventFunction. The function event refers to the activation of the function. If set to EVENT the referenced ports trigger the function using AND semantics, i.e., activate the function. In addition, a FunctionTrigger may refer to a list of Modes in which the trigger will be considered as potentially active. As of FunctionBehaviors may also refer to Modes, it is possible to arrange various function configurations for which different sets of triggers and behaviors are active. And this, at various levels of granularity, either with a type-wise scope (by referring to a FunctionType) or specifically at prototype level (by referring to a FunctionPrototype). Note that several FunctionTriggers may be assigned to the same Function (Type or Prototype), for instance to define alternative trigger conditions and/or timing constraints. Semantics: Association Mode defines in which modes the trigger is active. The FunctionBehavior referenced by the FunctionTrigger is invoked when the FunctionTrigger is active. If multiple ports are referenced, this implies an AND semantics. It is possible to have multiple triggers on a function, e.g., a slow period complemented with an event trigger allows fast response when needed but a minimal execution rate. Constraints: [1] The port association must not be empty when triggerPolicy is EVENT. [2] The port association is empty when triggerPolicy is TIME. [3] Function and functionPrototype are mutually exclusive associations. A FunctionTrigger either identifies a FunctionType or a FunctionPrototype as its target function, but not both. [4] Only FunctionFlowPort of FlowDirection=in shall be referred to in the association port. Extension: Class atpMixedString,atpPrototype Defines the triggering policy, either EVENT or TIME. The function event refers to the activation of the function. If set to EVENT, one or several ports of the Function triggers the function, i.e., activates the function. FunctionTrigger represents the triggering parameters necessary to define the execution of an identified FunctionType or FunctionPrototype. When referring to a FunctionType, a FunctionTrigger applies to all FunctionPrototypes of the given type. When referring to a FunctionPrototype, the trigger is only valid for this particular FunctionPrototype. Triggering is defined either as event-driven or time-driven - depending on the property triggerPolicy. If set to TIME, the timing constraint is defined with an event constraint associated with the Function's or FunctionPrototype's EventFunction. The function event refers to the activation of the function. If set to EVENT the referenced ports trigger the function using AND semantics, i.e., activate the function. In addition, a FunctionTrigger may refer to a list of Modes in which the trigger will be considered as potentially active. As of FunctionBehaviors may also refer to Modes, it is possible to arrange various function configurations for which different sets of triggers and behaviors are active. And this, at various levels of granularity, either with a type-wise scope (by referring to a FunctionType) or specifically at prototype level (by referring to a FunctionPrototype). Note that several FunctionTriggers may be assigned to the same Function (Type or Prototype), for instance to define alternative trigger conditions and/or timing constraints. Semantics: Association Mode defines in which modes the trigger is active. The FunctionBehavior referenced by the FunctionTrigger is invoked when the FunctionTrigger is active. If multiple ports are referenced, this implies an AND semantics. It is possible to have multiple triggers on a function, e.g., a slow period complemented with an event trigger allows fast response when needed but a minimal execution rate. Constraints: [1] The port association must not be empty when triggerPolicy is EVENT. [2] The port association is empty when triggerPolicy is TIME. [3] Function and functionPrototype are mutually exclusive associations. A FunctionTrigger either identifies a FunctionType or a FunctionPrototype as its target function, but not both. [4] Only FunctionFlowPort of FlowDirection=in shall be referred to in the association port. Extension: Class atpMixedString,atpPrototype The abstract metaclass FunctionType abstracts the function component types that are used to model the functional structure, which is distinguished from the implementation of component types using AUTOSAR. The syntax of FunctionTypes is inspired from the concept of Block from SysML. FunctionBehavior and FunctionTrigger in the Behavior package are associated to a FunctionType. Semantics: The FunctionType abstracts the function component types that are used to model the functional structure on AnalysisLevel and DesignLevel. Leaf functions of an EAST-ADL function hierarchy are called elementary Functions. Elementary Functions have synchronous execution semantics: 1. Read inputs 2. Execute (duration: Execution time) 3. Write outputs Execution is defined by a behavior that acts as a transfer function. Subclasses of the abstract class FunctionType add their own semantics. If a behavior is attached to the FunctionType, the execution semantic for a discrete elementary FunctionType complies with the run-to-completion semantic. This has the following implications: 1. Input that arrives at the input FunctionPorts after execution begins will be ignored until the next execution cycle. 2. If more than one input value arrives per FunctionPort before execution begins, the last value will override all previous ones in the public part of the input FunctionPort (single element buffers for input). 3. The local part of a FunctionPort does not change its value during execution of the behavior. 4. During an execution cycle, only one output value can be sent per FunctionPort. If consecutive output values are produced on the same FunctionPort during a single execution cycle, the last value will override all previous ones on the output FunctionPort (single element buffers for output). 5. Output will not be available at an output FunctionPort before execution ends. 6. Elementary FunctionTypes may not produce any side effects (i.e., all data passes the FunctionPorts). Constraints: [1] Elementary FunctionTypes shall not have parts. Notation: The FunctionType is shown as a solid-outline rectangle containing the name, with its FunctionPorts or PortGroups on the perimeter. Contained entities may be shown with their FunctionConnectors (White-box view). Extension: UML Class, specialization of SysML::Block atpType True, when this type must not have any parts. The FunctionalDevice represents an abstract sensor or actuator that encapsulates sensor/actuator dynamics and the interfacing software. The FunctionalDevice is the interface between the electronic architecture and the environment (connected by ClampConnectors, see the Environment chapter). As such, it is a transfer function between the AnalysisFunction and the physical entity that it measures or actuates. A Realization dependency can be used for traceability from LocalDeviceManagers in the DesignLevel and Sensors/Actuators in the hardware design architecture that are represented by the FunctionalDevice. Semantics: The behavior associated with the FunctionalDevice is the transfer function between the environment model representing the environment and an AnalysisFunction. The transfer function represents the sensor or actuator and its interfacing hardware and software (connectors, electronics, in/out interface, driver software, and application software). Constraints: No additional constraints. Extension: Class, specialization of SysML::Block atpType The FunctionalDevice represents an abstract sensor or actuator that encapsulates sensor/actuator dynamics and the interfacing software. The FunctionalDevice is the interface between the electronic architecture and the environment (connected by ClampConnectors, see the Environment chapter). As such, it is a transfer function between the AnalysisFunction and the physical entity that it measures or actuates. A Realization dependency can be used for traceability from LocalDeviceManagers in the DesignLevel and Sensors/Actuators in the hardware design architecture that are represented by the FunctionalDevice. Semantics: The behavior associated with the FunctionalDevice is the transfer function between the environment model representing the environment and an AnalysisFunction. The transfer function represents the sensor or actuator and its interfacing hardware and software (connectors, electronics, in/out interface, driver software, and application software). Constraints: No additional constraints. Extension: Class, specialization of SysML::Block atpType FunctionalSafetyConcept represents the set of functional safety requirements that together fulfils a SafetyGoal in accordance with ISO 26262. To comply with the SafetyGoals, the FunctionalSafetyConcept specifies the basic safety mechanisms and safety measures in the form of functional safety requirements. Constraints: [1] Contained functionalSafetyRequirements shall not be of type SafetyGoal. Semantics: The collection of requirements in the FunctionalSafetyConcept defines the requirements necessary to make the Item safe. The requirements are abstract and do not specify technical details. FunctionalSafetyConcept represents the set of functional safety requirements that together fulfils a SafetyGoal in accordance with ISO 26262. To comply with the SafetyGoals, the FunctionalSafetyConcept specifies the basic safety mechanisms and safety measures in the form of functional safety requirements. Constraints: [1] Contained functionalSafetyRequirements shall not be of type SafetyGoal. Semantics: The collection of requirements in the FunctionalSafetyConcept defines the requirements necessary to make the Item safe. The requirements are abstract and do not specify technical details. The GenericConstraint denotes a property, requirement, or a validation result for the identified element of the model. The kind of GenericConstraint is described as one of the GenericConstraintKind literals. Example: If the attribute genericConstraintType is cableLength, the value could be "5 meters" (value of a numerical datatype with unit "meters"). Semantics: The GenericConstraint does not describe what is classically referred to as a "design" constraint but has the role of a property, requirement, or a validation result. It is a requirement if this GenericConstraint refines a Requirement (by the Refine relationship). The GenericConstraint is a validation result if it realizes a VVActualOutcome, it is an intended validation result if it realizes a VVIntendedOutcome, and in other cases it denotes a property. Extension: Class The type of the GenericConstraint, see GenericConstraintKind. The GenericConstraint denotes a property, requirement, or a validation result for the identified element of the model. The kind of GenericConstraint is described as one of the GenericConstraintKind literals. Example: If the attribute genericConstraintType is cableLength, the value could be "5 meters" (value of a numerical datatype with unit "meters"). Semantics: The GenericConstraint does not describe what is classically referred to as a "design" constraint but has the role of a property, requirement, or a validation result. It is a requirement if this GenericConstraint refines a Requirement (by the Refine relationship). The GenericConstraint is a validation result if it realizes a VVActualOutcome, it is an intended validation result if it realizes a VVIntendedOutcome, and in other cases it denotes a property. Extension: Class The collection of generic constraints. This collection can be used across the EAST-ADL abstraction levels. Semantics: GenericConstraintSet is a container element for GenericConstraints and has no specific semantics. The collection of generic constraints. This collection can be used across the EAST-ADL abstraction levels. Semantics: GenericConstraintSet is a container element for GenericConstraints and has no specific semantics. Claim is based on Grounds (evidences) - specific facts about a precise situation that clarify and make good the Claim. Ground represents statements that explain how the SafetyCase Ground clarifies and make good the Claim. Ground has associations to the entities that are the evidences in the SafetyCase. Semantics: Ground (evidence) is information that supports the Claim that the safety requirements and objectives are met i.e. used as the basis of the safety argument. Solution is evidence that the sub-goals have been met. This can be achieved by decomposing all goal claims to a level where direct reference to evidences was considered possible. The evidences address different aspects of the goal. It always has to be ensured that each of them is defensible enough to confirm the underlying statement. Claim is based on Grounds (evidences) - specific facts about a precise situation that clarify and make good the Claim. Ground represents statements that explain how the SafetyCase Ground clarifies and make good the Claim. Ground has associations to the entities that are the evidences in the SafetyCase. Semantics: Ground (evidence) is information that supports the Claim that the safety requirements and objectives are met i.e. used as the basis of the safety argument. Solution is evidence that the sub-goals have been met. This can be achieved by decomposing all goal claims to a level where direct reference to evidences was considered possible. The evidences address different aspects of the goal. It always has to be ensured that each of them is defensible enough to confirm the underlying statement. Appears as part of a HardwareComponentType and is itself typed by a HardwareComponentType. This allows for a reference to the occurrence of a HardwareComponentType when it acts as a part. The purpose is to support the definition of hierarchical structures, and to reuse the same type of Hardware at several places. For example, a wheel speed sensor may occur at all four wheels, but it has a single definition. Semantics: The HardwareComponentPrototype represents an occurrence of a hardware element, according to the type of the HardwareComponentPrototype. Notation: Shall be shown in the same style as the class specified as type, however it shall be clear that this is a part. Extension: Property atpPrototype isOfType Appears as part of a HardwareComponentType and is itself typed by a HardwareComponentType. This allows for a reference to the occurrence of a HardwareComponentType when it acts as a part. The purpose is to support the definition of hierarchical structures, and to reuse the same type of Hardware at several places. For example, a wheel speed sensor may occur at all four wheels, but it has a single definition. Semantics: The HardwareComponentPrototype represents an occurrence of a hardware element, according to the type of the HardwareComponentPrototype. Notation: Shall be shown in the same style as the class specified as type, however it shall be clear that this is a part. Extension: Property atpPrototype The HardwareComponentType represents a hardware element on an abstract level, allowing preliminary engineering activities related to hardware. Semantics: The HardwareComponentType is a structural entity that defines a part of an electrical architecture. Through its ports it can be connected to electrical sources and sinks. Its logical behavior, the transfer function, may be defined in a HardwareFunctionType referencing the HardwareComponentType. This is typically connected through its ports to the environment model to participate in the end-to-end behavioral definition of a function. Extension: Class atpType The HardwareComponentType represents a hardware element on an abstract level, allowing preliminary engineering activities related to hardware. Semantics: The HardwareComponentType is a structural entity that defines a part of an electrical architecture. Through its ports it can be connected to electrical sources and sinks. Its logical behavior, the transfer function, may be defined in a HardwareFunctionType referencing the HardwareComponentType. This is typically connected through its ports to the environment model to participate in the end-to-end behavioral definition of a function. Extension: Class atpType Hardware connectors represent wires that electrically connect the hardware components through its pins. Semantics: The connector joins the two referenced pins electrically. Extension: Connector atpStructureElement Hardware connectors represent wires that electrically connect the hardware components through its pins. Semantics: The connector joins the two referenced pins electrically. Extension: Connector atpStructureElement instanceRef instanceRef.context instanceRef.target instanceRef The HardwareFunctionType is the transfer function for the identified HardwareComponentType or a specification of an intended transfer function. HardwareFunctionType types DesignFunctionPrototypes in the FunctionalDesignArchitecture. The ports of such DesignFunctionPrototypes are typically connected to a plant model with ClampConnectors. DesignFunctionPrototypes typed by HardwareFunctionType may be allocated to HardwareComponents in which case the HardwareFunctionType must match the HardwareFunctionType of the target HardwareComponent. Typically, the same HardwareFunctionType types the prototype that is allocated to its target HardwareComponent. HardwareFunctionTypes are typically transfer functions of sensors, actuators, amplifiers and other peripherals with a fixed transfer function. Thus, HardwareFunctionTypes are generally not defined for ECUNodes. Constraints: [1] A DesignFunctionPrototype typed by a HardwareFunctionType shall be connected to the EnvironmentModel via ClampConnectors and to BSWFunctions via FunctionConnectors. [2] A DesignFunctionPrototype typed by a HardwareFunctionType may only contain prototypes typed by HardwareFunctionType. Semantics: The HardwareFunctionType is the transfer function for the associated hardware components such as sensors, actuators, amplifiers, etc or a specification of an intended transfer function. A DesignFunctionPrototype typed by a HardwareFunctionType allocated to Sensors or Actuators is the interfacing element to the plant model. Extension: UML Class, specialization of SysML::Block atpType The HardwareFunctionType is the transfer function for the identified HardwareComponentType or a specification of an intended transfer function. HardwareFunctionType types DesignFunctionPrototypes in the FunctionalDesignArchitecture. The ports of such DesignFunctionPrototypes are typically connected to a plant model with ClampConnectors. DesignFunctionPrototypes typed by HardwareFunctionType may be allocated to HardwareComponents in which case the HardwareFunctionType must match the HardwareFunctionType of the target HardwareComponent. Typically, the same HardwareFunctionType types the prototype that is allocated to its target HardwareComponent. HardwareFunctionTypes are typically transfer functions of sensors, actuators, amplifiers and other peripherals with a fixed transfer function. Thus, HardwareFunctionTypes are generally not defined for ECUNodes. Constraints: [1] A DesignFunctionPrototype typed by a HardwareFunctionType shall be connected to the EnvironmentModel via ClampConnectors and to BSWFunctions via FunctionConnectors. [2] A DesignFunctionPrototype typed by a HardwareFunctionType may only contain prototypes typed by HardwareFunctionType. Semantics: The HardwareFunctionType is the transfer function for the associated hardware components such as sensors, actuators, amplifiers, etc or a specification of an intended transfer function. A DesignFunctionPrototype typed by a HardwareFunctionType allocated to Sensors or Actuators is the interfacing element to the plant model. Extension: UML Class, specialization of SysML::Block atpType HardwarePin represents electrical connection points in the hardware architecture. Depending on modeling style, the actual wire or a logical connection can be considered. Semantics: Hardware pin represents an electrical connection point. Extension: Port atpStructureElement The direction of current through the pin. Indicates that the pin is connected to ground. atpStructureElement True if this port is representing the shield. atpStructureElement atpStructureElement atpStructureElement instanceRef instanceRef.context instanceRef.target instanceRef The Hazard metaclass represents a condition or state in the system that may contribute to accidents. The Hazard is caused by malfunctioning behavior of E/E safety-related systems including interaction of these systems. The Hazard does not address hazards such as electric shock, fire, smoke, heat, radiation, toxicity, flammability, reactivity, corrosion, release of energy, and similar hazards unless directly caused by malfunctioning behavior of safety related electrical/electronic systems. Semantics: The Hazard element represents a condition or state in the system that may contribute to accidents. The associated malfunction identifies the FeatureFlaw that corresponds to the Hazard. Notation: The Hazard is shown as a solid-outline rectangle with "Haz" at the top right. It contains the name of the Hazard and optionally the name of the source entity. Extension: UML::Class The Hazard metaclass represents a condition or state in the system that may contribute to accidents. The Hazard is caused by malfunctioning behavior of E/E safety-related systems including interaction of these systems. The Hazard does not address hazards such as electric shock, fire, smoke, heat, radiation, toxicity, flammability, reactivity, corrosion, release of energy, and similar hazards unless directly caused by malfunctioning behavior of safety related electrical/electronic systems. Semantics: The Hazard element represents a condition or state in the system that may contribute to accidents. The associated malfunction identifies the FeatureFlaw that corresponds to the Hazard. Notation: The Hazard is shown as a solid-outline rectangle with "Haz" at the top right. It contains the name of the Hazard and optionally the name of the source entity. Extension: UML::Class The HazardousEvent metaclass represents a combination of a Hazard and a specific situation, the latter being characterized by operating mode and operational situation in terms of a particular use case, environment and traffic. Semantics: The HazardousEvent denotes a combination of a Hazard and an operational situation. The controllability and severity attributes shall be consistent with the operational situation and operational scenario, and the Exposure shall reflect the likelihood of the operational situation and scenario. Notation: The HazardousEvent is shown as a solid-outline rectangle with "Haz" at the top right. It contains the name of the HazardousEvent and optionally the name of the source entity. Extension: UML::Class The classificationAssumptions attribute denotes assumptions concerning the classification of the Hazard. The controllability by the driver or other traffic participants defined by the enumeration C0, C1, C2 or C3 in accordance with ISO26262. The probability of exposure of the operational situations defined by the probability attributes E1, E2, E3 or E4 in accordance with ISO26262. The ASIL-Level shall be determined for each hazardous event using the estimation parameters in accordance with ISO26262. The severity of potential harm defined by the severity attributes S0, S1, S2 or S3 in accordance with ISO26262. The HazardousEvent metaclass represents a combination of a Hazard and a specific situation, the latter being characterized by operating mode and operational situation in terms of a particular use case, environment and traffic. Semantics: The HazardousEvent denotes a combination of a Hazard and an operational situation. The controllability and severity attributes shall be consistent with the operational situation and operational scenario, and the Exposure shall reflect the likelihood of the operational situation and scenario. Notation: The HazardousEvent is shown as a solid-outline rectangle with "Haz" at the top right. It contains the name of the HazardousEvent and optionally the name of the source entity. Extension: UML::Class IOHardwarePin represents an electrical connection point for digital or analog I/O. Semantics: The IOHardwarePin represents an electrical pin or connection point. Notation: IOHardwarePin is shown as a solid square with an IO inside. Its name may appear outside the square. atpStructureElement kind defines whether the IOHardwarePort is digital, analog or PWM (Pulse Width Modulated). IOHardwarePin represents an electrical connection point for digital or analog I/O. Semantics: The IOHardwarePin represents an electrical pin or connection point. Notation: IOHardwarePin is shown as a solid square with an IO inside. Its name may appear outside the square. atpStructureElement Instances of this class can be referred to by their identifier (within the namespace borders). In addition to this, Identifiables are objects which contribute significantly to the overall structure of an AUTOSAR description. In particular, Identifiables might contain Identifiables. This element assigns a category to the parent element. The category is intended to specialize the usage and/or the content identifiable object. Such a specialization may also impose particular semantic constraints on the entire substructure (not only the identifiable itself). Instances of this class can be referred to by their identifier (within the namespace borders). In addition to this, Identifiables are objects which contribute significantly to the overall structure of an AUTOSAR description. In particular, Identifiables might contain Identifiables. The purpose of this attribute is to provide a globally unique identifier for an instance of a metaclass. The values of this attribute should be globally unique strings prefixed by the type of identifier. For example, to include a DCE UUID as defined by The Open Group, the UUID would be preceded by "DCE:". The values of this attribute may be used to support merging of different AUTOSAR models. The form of the UUID (Universally Unique Identifier) is taken from a standard defined by the Open Group (was Open Software Foundation). This standard is widely used, including by Microsoft for COM (GUIDs) and by many companies for DCE, which is based on CORBA. The method for generating these 128-bit IDs is published in the standard and the effectiveness and uniqueness of the IDs is not in practice disputed. If the id namespace is omitted, DCE is assumed. An example is "DCE:2fac1234-31f8-11b4-a222-08002b34c003". The ImplementationLevel represents the software architecture and the hardware architecture of the electrical/electronic system in the vehicle. The ImplementationLevel is defined by the AUTOSAR SystemArchitecture and SoftwareArchitecture. For example, functions of the FDA will be realized by AUTOSAR SW-Components in the ImplementationLevel. Traceability is supported from implementation level elements (AUTOSAR) to upper level elements by Realization relationships. Semantics: The ImplementationLevel is the representation of the vehicle electrical/electronic system on the implementation abstraction level. It corresponds to the system implementation in Software and Hardware. Notation: The ImplementationLevel is shown as a solid-outline rectangle containing the name. Extension: Class atpStructureElement The ImplementationLevel represents the software architecture and the hardware architecture of the electrical/electronic system in the vehicle. The ImplementationLevel is defined by the AUTOSAR SystemArchitecture and SoftwareArchitecture. For example, functions of the FDA will be realized by AUTOSAR SW-Components in the ImplementationLevel. Traceability is supported from implementation level elements (AUTOSAR) to upper level elements by Realization relationships. Semantics: The ImplementationLevel is the representation of the vehicle electrical/electronic system on the implementation abstraction level. It corresponds to the system implementation in Software and Hardware. Notation: The ImplementationLevel is shown as a solid-outline rectangle containing the name. Extension: Class atpStructureElement Include is a specialization of the Relationship and represents a relationship between two UseCases, implying that the behavior of the included UseCase is inserted into the behavior of the including UseCase. The including UseCase may only depend on the result (value) of the included UseCase. This value is obtained as a result of the execution of the included UseCase. Note that the included UseCase is not optional and is always required for the including UseCase to execute correctly. Semantics: The Include relationship identifies an addition UseCase, which is inserted in the including UseCase. Include is a specialization of the Relationship and represents a relationship between two UseCases, implying that the behavior of the included UseCase is inserted into the behavior of the including UseCase. The including UseCase may only depend on the result (value) of the included UseCase. This value is obtained as a result of the execution of the included UseCase. Note that the included UseCase is not optional and is always required for the including UseCase to execute correctly. Semantics: The Include relationship identifies an addition UseCase, which is inserted in the including UseCase. An InputSynchronizationConstraint defines how far apart the responses that belong to a certain stimulus may occur. This constraint provides an alternative to the ordinary SynchronizationConstraint for situations where the causal relation between event occurrences must be taken into account. It differs from the SynchronizationConstraint in that it applies to a set of event chains, and only looks at the stimulus occurrences that have the same color as each particular response occurrence. It is the latest of these stimulus occurrences for each chain that are required to lie no more than tolerance time units apart. If the roles of stimuli and responses are swapped, an OutputSynchronizationConstraint is obtained. Constraints: [1] All scopes must reference one common response event. Semantics: A system behavior satisfies an InputSynchronizationConstraint c if and only if for each occurrence y in c.scope(1).response, there is a time t such that for each c.scope index i, there is an occurrence x in c.scope(i).stimulus such that y.color = x.color and x is maximal in c.scope(i).stimulus with that color and 0 <= x - t <= c.tolerance An InputSynchronizationConstraint defines how far apart the responses that belong to a certain stimulus may occur. This constraint provides an alternative to the ordinary SynchronizationConstraint for situations where the causal relation between event occurrences must be taken into account. It differs from the SynchronizationConstraint in that it applies to a set of event chains, and only looks at the stimulus occurrences that have the same color as each particular response occurrence. It is the latest of these stimulus occurrences for each chain that are required to lie no more than tolerance time units apart. If the roles of stimuli and responses are swapped, an OutputSynchronizationConstraint is obtained. Constraints: [1] All scopes must reference one common response event. Semantics: A system behavior satisfies an InputSynchronizationConstraint c if and only if for each occurrence y in c.scope(1).response, there is a time t such that for each c.scope index i, there is an occurrence x in c.scope(i).stimulus such that y.color = x.color and x is maximal in c.scope(i).stimulus with that color and 0 <= x - t <= c.tolerance The InternalBinding is the private, internal ConfigurationDecisionModel of the ConfigurableContainer. It defines how the internal, lower-level variability of the ConfigurableContainer is bound, i.e. configured, depending on a given configuration of the ConfigurableContainer's public feature model. This way, the binding of this internal variability is encapsulated and hidden behind the public feature model, which serves as a variability-related interface. Note that for this use case, the source and target feature models need not be defined explicitly because they are deduced implicitly: the ConfigurableContainer's public feature model serves as the (single) target feature model, and the source feature models are deduced from the ConfigurableContainer's internal variability (esp. other, lower-level ConfigurableContainers which are contained). For a definition of the precise meaning of 'internal variability' (also called variable content) refer to the documentation of meta-class ConfigurableContainer. Semantics: See description. The InternalBinding is the private, internal ConfigurationDecisionModel of the ConfigurableContainer. It defines how the internal, lower-level variability of the ConfigurableContainer is bound, i.e. configured, depending on a given configuration of the ConfigurableContainer's public feature model. This way, the binding of this internal variability is encapsulated and hidden behind the public feature model, which serves as a variability-related interface. Note that for this use case, the source and target feature models need not be defined explicitly because they are deduced implicitly: the ConfigurableContainer's public feature model serves as the (single) target feature model, and the source feature models are deduced from the ConfigurableContainer's internal variability (esp. other, lower-level ConfigurableContainers which are contained). For a definition of the precise meaning of 'internal variability' (also called variable content) refer to the documentation of meta-class ConfigurableContainer. Semantics: See description. The InternalFault metaclass represents the particular internal conditions of the target component/system that are of particular concern for its fault/failure definition. Semantics: The system anomaly represented by an InternalFault, which when activated, can cause errors and failures of the target element. Extension: UML::Part / UML::Event atpPrototype The InternalFault metaclass represents the particular internal conditions of the target component/system that are of particular concern for its fault/failure definition. Semantics: The system anomaly represented by an InternalFault, which when activated, can cause errors and failures of the target element. Extension: UML::Part / UML::Event atpPrototype The Item entity identifies the scope of safety information and the safety assessment, i.e. the part of the system onto which the ISO26262 related information applies. Safety analyses are carried out on the basis of an item definition and the safety concepts are derived from it. Semantics: Item represents the scope of safety information and the safety assessment through its reference to one or several Features. Extension: UML::Class The Item entity identifies the scope of safety information and the safety assessment, i.e. the part of the system onto which the ISO26262 related information applies. Safety analyses are carried out on the basis of an item definition and the safety concepts are derived from it. The Item entity identifies the scope of safety information and the safety assessment, i.e. the part of the system onto which the ISO26262 related information applies. Safety analyses are carried out on the basis of an item definition and the safety concepts are derived from it. Semantics: Item represents the scope of safety information and the safety assessment through its reference to one or several Features. Extension: UML::Class The LocalDeviceManager represents a DesignFunction that act as a manager or functional interface to Sensors, Actuators and other devices. It is responsible for translating between the electrical/logical interface of the device, as provided by a BasicSoftwareFunction, and the physical interface of the device. For example, consider a temperature sensor with voltage output. The HardwareFunctionType defines the transfer from temperature to voltage. A BasicSoftwareFunction relays the voltage from the microcontroller's I/O. The role of the LocalDeviceManager is now to translate from voltage to temperature value, taking into account the sensor's characteristics such as nonlinearities, calibration, etc. The resulting temperature is available to the other DesignFunctions. By separating the device specific part from the middleware and ECU specific parts, it is possible to systematically change interface function together with the device. The role of the LocalDeviceManager is to act as an interface between the electrical output of Sensors or electrical input of Actuators and the physical quantity of those devices. Semantics: The LocalDeviceManager encapsulates the device-specific or functional parts of a Sensor or Actuator, device, etc. interface. Constraints: [1] A DesignFunctionPrototype typed by a LocalDeviceManager shall be allocated to the same ECU node as the device that it manages is connected to. [2] A LocalDeviceManager shall interface BSWFunctions and DesignFunctions. Extension: Class, specialization of SysML::Block atpType The LocalDeviceManager represents a DesignFunction that act as a manager or functional interface to Sensors, Actuators and other devices. It is responsible for translating between the electrical/logical interface of the device, as provided by a BasicSoftwareFunction, and the physical interface of the device. For example, consider a temperature sensor with voltage output. The HardwareFunctionType defines the transfer from temperature to voltage. A BasicSoftwareFunction relays the voltage from the microcontroller's I/O. The role of the LocalDeviceManager is now to translate from voltage to temperature value, taking into account the sensor's characteristics such as nonlinearities, calibration, etc. The resulting temperature is available to the other DesignFunctions. By separating the device specific part from the middleware and ECU specific parts, it is possible to systematically change interface function together with the device. The role of the LocalDeviceManager is to act as an interface between the electrical output of Sensors or electrical input of Actuators and the physical quantity of those devices. Semantics: The LocalDeviceManager encapsulates the device-specific or functional parts of a Sensor or Actuator, device, etc. interface. Constraints: [1] A DesignFunctionPrototype typed by a LocalDeviceManager shall be allocated to the same ECU node as the device that it manages is connected to. [2] A LocalDeviceManager shall interface BSWFunctions and DesignFunctions. Extension: Class, specialization of SysML::Block atpType Logical Event is the modeling construct for the declarations of the value conditions that, when fulfilled, may trigger state transitions. If a logical event is externally visible (isExternVisble == true), it is disseminated through function ports. Constraint: see Quantification. Semantics: see Quantification. atpMixedString,atpPrototype Logical Event is the modeling construct for the declarations of the value conditions that, when fulfilled, may trigger state transitions. If a logical event is externally visible (isExternVisble == true), it is disseminated through function ports. Constraint: see Quantification. Semantics: see Quantification. atpMixedString,atpPrototype The EAST-ADL logical path (LogicalPath) is a set of restrictions on the cause-effect flows of some observable logical and executional events. It provides the modeling support for annotating the expected cause-effect traces across a system or a component. A logical path specifies the overall causality of computation by relating execution events with logical transformations and logical events. An execution event can be the triggering of function, port reading or writing, which constitutes the basis for the description of execution control using timing event chains (Timing::EventChain). Compared to such execution events, the logical transformation and logical events are only concerned with the computational logic. The specification of logical path allows the internal causality of the computations of a function/component to be captured and merged explicitly with the related external execution events. Logical paths can be combined in parallel (strand) or in sequence (segment). Semantics: A logical path is a set of restrictions on the cause-effect flows of computation. When applied to a function/component, a logical path defines the correspondence from a triple of logical stimulus (logicalStimulus), logical transformation (transformationOccurrance), and logical response (logicalResponse), to a triple of preceding execution event chains (precedingEventChain), the corresponding execution event chains (correspondingExecutionEventChain), and the succeeding execution event chains (succeedingEventChain). By describing the internal causality of a function/component, a logical path may refine an execution event chain (correspondingExecutionEventChain), which is primarily used to capture the causality of triggering, port reading and writing events. The EAST-ADL logical path (LogicalPath) is a set of restrictions on the cause-effect flows of some observable logical and executional events. It provides the modeling support for annotating the expected cause-effect traces across a system or a component. A logical path specifies the overall causality of computation by relating execution events with logical transformations and logical events. An execution event can be the triggering of function, port reading or writing, which constitutes the basis for the description of execution control using timing event chains (Timing::EventChain). Compared to such execution events, the logical transformation and logical events are only concerned with the computational logic. The specification of logical path allows the internal causality of the computations of a function/component to be captured and merged explicitly with the related external execution events. Logical paths can be combined in parallel (strand) or in sequence (segment). Semantics: A logical path is a set of restrictions on the cause-effect flows of computation. When applied to a function/component, a logical path defines the correspondence from a triple of logical stimulus (logicalStimulus), logical transformation (transformationOccurrance), and logical response (logicalResponse), to a triple of preceding execution event chains (precedingEventChain), the corresponding execution event chains (correspondingExecutionEventChain), and the succeeding execution event chains (succeedingEventChain). By describing the internal causality of a function/component, a logical path may refine an execution event chain (correspondingExecutionEventChain), which is primarily used to capture the causality of triggering, port reading and writing events. The logical time condition is an abstract notion of time for the descriptions of behavior constraints. Declarations of such time conditions can be used to define the time basis of continuous- and discrete-time dynamics or the timing concerns in statemachine or data-processing related behaviors. The semantics of logical time conditions can be further refined by associating such conditions to the occurrences of execution events (TransitionEvents), such as for defining the change of an environmental condition or the triggering of a function. This makes it possible to precisely define the reference points of a time interval (i.e. startPointReference and endPointReference). A time condition can have a consecutive time condition on the same time line. E.g. if condition1=[t1, t2], then the consecutive time condition is condition2=[t2, t3]. With EAST-ADL, the expression of the value of a logical time condition is based on the Timing::TimeDuration in the format of CseCode as in AUTOSAR and MSR/ASAM. For descriptions where the notion of time proceeding is not of interest, a time condition with isLogicalTimeSuspended=true has to be explicitly declared and used. Constraint: Semantics: A logical time condition (LTC) is an infinite sequence of time intervals Extension: EAElement. The logical time condition is an abstract notion of time for the descriptions of behavior constraints. Declarations of such time conditions can be used to define the time basis of continuous- and discrete-time dynamics or the timing concerns in statemachine or data-processing related behaviors. The semantics of logical time conditions can be further refined by associating such conditions to the occurrences of execution events (TransitionEvents), such as for defining the change of an environmental condition or the triggering of a function. This makes it possible to precisely define the reference points of a time interval (i.e. startPointReference and endPointReference). A time condition can have a consecutive time condition on the same time line. E.g. if condition1=[t1, t2], then the consecutive time condition is condition2=[t2, t3]. With EAST-ADL, the expression of the value of a logical time condition is based on the Timing::TimeDuration in the format of CseCode as in AUTOSAR and MSR/ASAM. For descriptions where the notion of time proceeding is not of interest, a time condition with isLogicalTimeSuspended=true has to be explicitly declared and used. Constraint: Semantics: A logical time condition (LTC) is an infinite sequence of time intervals Extension: EAElement. A logical transformation (LogicalTransformation) is a set of restrictions on the computation activity for some data. That is, given some in-&local-data that meet certain preconditions, such a computation activity always maps such data to some out-data that meet the related postconditions if the time-&value-invariants are not violated during the computation. Each computation activity executes some functions for the mapping of quantities, which can be based on arithmetic, Boolean- or string-related calculations. The expressions (Expression) for any further lower level details of a transformation can be based on an external language, such as the MISRA-C. A logical transformation can define the following conditions of computation activity: 1. The pre-conditions, i.e. the quantifications that must be satisfied just prior to data-processing, 2. The value-invariants, i.e. the value conditions that must be satisfied throughout the execution of data-processing, 3. The time-invariants, i.e. the time conditions that must be satisfied throughout the execution of data-processing, 4. The post-conditions, i.e. the quantifications that must be satisfied just after the execution of data-processing. Constraints: [1] If a logical transformation description is applied to a client-server interface (isClientServerInterface=true), it has at least one corresponding operation specified in a client-server interface definition (FunctionModelling::Operation). Semantics: The computation activity of a logical transformation can be activated in logical paths or in state transitions. The execution follows the run-to-completion assumption. This means that the execution is only possible when the previous execution instance of the same transformation is fully completed. For a system function, the amount of time to execute its transformations is constrained by the EAST-ADL function event in the timing package. Extension: EAElement. A logical transformation (LogicalTransformation) is a set of restrictions on the computation activity for some data. That is, given some in-&local-data that meet certain preconditions, such a computation activity always maps such data to some out-data that meet the related postconditions if the time-&value-invariants are not violated during the computation. Each computation activity executes some functions for the mapping of quantities, which can be based on arithmetic, Boolean- or string-related calculations. The expressions (Expression) for any further lower level details of a transformation can be based on an external language, such as the MISRA-C. A logical transformation can define the following conditions of computation activity: 1. The pre-conditions, i.e. the quantifications that must be satisfied just prior to data-processing, 2. The value-invariants, i.e. the value conditions that must be satisfied throughout the execution of data-processing, 3. The time-invariants, i.e. the time conditions that must be satisfied throughout the execution of data-processing, 4. The post-conditions, i.e. the quantifications that must be satisfied just after the execution of data-processing. Constraints: [1] If a logical transformation description is applied to a client-server interface (isClientServerInterface=true), it has at least one corresponding operation specified in a client-server interface definition (FunctionModelling::Operation). Semantics: The computation activity of a logical transformation can be activated in logical paths or in state transitions. The execution follows the run-to-completion assumption. This means that the execution is only possible when the previous execution instance of the same transformation is fully completed. For a system function, the amount of time to execute its transformations is constrained by the EAST-ADL function event in the timing package. Extension: EAElement. A mission is a use or operation for which a system is intended by one or more stakeholders to meet some set of objectives. [IEEE 1471] A mission is a use or operation for which a system is intended by one or more stakeholders to meet some set of objectives. [IEEE 1471] Modes are a way to introduce various configurations in the system to account for different states of the system, or of a hardware entity, or an application. The use of modes can be used to filter different views of the model. Modes are characterized by a Boolean condition provided as a String, which evaluates to true when the Mode is active. As far as behavior is concerned, Modes enable the logical organisation of a set of triggers and behaviors over a set of functions. Modes are referred to by both FunctionTriggers and FunctionBehaviors (see FunctionTrigger and FunctionBehavior). Modes can be further organized in mutually exclusive sets with ModeGroups (see that element). Semantics: The Mode is active if and only if the condition is true. A Boolean expression that characterizes the Mode, it evaluates to true when the Mode is active. The syntax and grammar of this expression is unspecified. Modes are a way to introduce various configurations in the system to account for different states of the system, or of a hardware entity, or an application. The use of modes can be used to filter different views of the model. Modes are characterized by a Boolean condition provided as a String, which evaluates to true when the Mode is active. As far as behavior is concerned, Modes enable the logical organisation of a set of triggers and behaviors over a set of functions. Modes are referred to by both FunctionTriggers and FunctionBehaviors (see FunctionTrigger and FunctionBehavior). Modes can be further organized in mutually exclusive sets with ModeGroups (see that element). Semantics: The Mode is active if and only if the condition is true. A mode that identifies when the mode starts or ends. A mode that identifies when the mode starts or ends. ModeGroups serve as containers of Modes. The Modes in a ModeGroup are mutually exclusive. This means that only one Mode of a ModeGroup is active at any point in time. A precondition in the form of a Boolean expression is assigned to the ModeGroup so that ModeGroups can be switched on and off as a whole. Semantics: The ModeGroup defines a set of modes of which exactly one is active if precondition is true and otherwise none is active. A Boolean expression that evaluates to true when the ModeGroup is active. ModeGroups serve as containers of Modes. The Modes in a ModeGroup are mutually exclusive. This means that only one Mode of a ModeGroup is active at any point in time. A precondition in the form of a Boolean expression is assigned to the ModeGroup so that ModeGroups can be switched on and off as a whole. Semantics: The ModeGroup defines a set of modes of which exactly one is active if precondition is true and otherwise none is active. Node represents the computer nodes of the embedded electrical/electronic system. Nodes consist of processor(s) and may be connected to sensors, actuators and other ECUs via a BusConnector. Node denotes an electronic control unit that acts as a computing element executing Functions. In case a single CPU ECU is represented, it is sufficient to have a single, non-hierarchical Node. Semantics: The Node element represents an ECU, i.e. an Electronic Control Unit, and an allocation target of FunctionPrototypes. The Node executes its allocated FunctionPrototypes at the specified executionRate. The executionRate denotes how many execution seconds of an allocated functionPrototype´s execution time are processed in each real-time second. Actual execution time is thus found by dividing the parameters of the ExecutionTimeConstraint with executionRate. Example: If an ECU is 25% faster than a standard ECU (e.g., in a certain context, execution times are given assuming a nominal speed of 100 MHz; our CPU is then 125 MHz), the executionRate is 1.25. An execution time of 5 ms would then become 4 ms on this ECU. Notation: Node is shown as a solid-outline rectangle with Node at the top right. The rectangle contains the name, and its ports or port groups on the perimeter. atpType ExecutionRate is used to compute an approximate execution time. A nominal execution time divided by executionRate provides the actual execution time to be used e.g. for timing analysis in feasibility studies. Node represents the computer nodes of the embedded electrical/electronic system. Nodes consist of processor(s) and may be connected to sensors, actuators and other ECUs via a BusConnector. Node denotes an electronic control unit that acts as a computing element executing Functions. In case a single CPU ECU is represented, it is sufficient to have a single, non-hierarchical Node. Semantics: The Node element represents an ECU, i.e. an Electronic Control Unit, and an allocation target of FunctionPrototypes. The Node executes its allocated FunctionPrototypes at the specified executionRate. The executionRate denotes how many execution seconds of an allocated functionPrototype´s execution time are processed in each real-time second. Actual execution time is thus found by dividing the parameters of the ExecutionTimeConstraint with executionRate. Example: If an ECU is 25% faster than a standard ECU (e.g., in a certain context, execution times are given assuming a nominal speed of 100 MHz; our CPU is then 125 MHz), the executionRate is 1.25. An execution time of 5 ms would then become 4 ms on this ECU. Notation: Node is shown as a solid-outline rectangle with Node at the top right. The rectangle contains the name, and its ports or port groups on the perimeter. atpType The Operation is the provided/required operation of a FunctionClientServerInterface. It can specify its return values and arguments by EADatatypePrototypes. Semantics: The Operation is the provided/required operation of a FunctionClientServerInterface. Extension: UML Operation The Operation is the provided/required operation of a FunctionClientServerInterface. It can specify its return values and arguments by EADatatypePrototypes. Semantics: The Operation is the provided/required operation of a FunctionClientServerInterface. Extension: UML Operation An operational situation is a state, condition or scenario in the environment that may influence the vehicle. The Operational Situation may be further detailed by a functional definition in the EnvironmentModel. Semantics: OperationalSituation represent a state, condition or scenario that is external to the vehicle. An operational situation is a state, condition or scenario in the environment that may influence the vehicle. The Operational Situation may be further detailed by a functional definition in the EnvironmentModel. Semantics: OperationalSituation represent a state, condition or scenario that is external to the vehicle. An OrderConstraint imposes an order between the occurrences of an event called source and an event called target. The OrderConstraint is a minor variant of an application of StrongDelayConstraint with lower set to 0 and upper to infinity; the difference being that the OrderConstraint does not allow matching target and source occurrences to coincide. Semantics: A system behavior satisfies an OrderConstraint c if and only if c.source and c.target have the same number of occurrences, and for each index i, if there is an i:th occurrence of c.source at time x, there is also an i:th occurrence of c.target at time y such that x < y An OrderConstraint imposes an order between the occurrences of an event called source and an event called target. The OrderConstraint is a minor variant of an application of StrongDelayConstraint with lower set to 0 and upper to infinity; the difference being that the OrderConstraint does not allow matching target and source occurrences to coincide. Semantics: A system behavior satisfies an OrderConstraint c if and only if c.source and c.target have the same number of occurrences, and for each index i, if there is an i:th occurrence of c.source at time x, there is also an i:th occurrence of c.target at time y such that x < y An OutputSynchronizationConstraint defines how far apart the responses that belong to a certain stimulus may occur. This constraint provides an alternative to the ordinary SynchronizationConstraint for situations where the causal relation between event occurrences must be taken into account. It differs from the SynchronizationConstraint in that it applies to a set of event chains, and only looks at the response occurrences that have the same color as each particular stimulus occurrence. It is the earliest of these response occurrences for each chain that are required to lie no more than tolerance time units apart. If the roles of stimuli and responses are swapped, an InputSynchronizationConstraint is obtained. Constraints: [1] All scopes must reference one common stimulus event. Semantics: A system behavior satisfies an OutputSynchronizationConstraint c if and only if for each occurrence x in c.scope(1).stimulus, there is a time t such that for each c.scope index i, there is an occurrence y in c.scope(i).response such that y.color = x.color and y is minimal in c.scope(i).response with that color and 0 <= y - t <= c.tolerance An OutputSynchronizationConstraint defines how far apart the responses that belong to a certain stimulus may occur. This constraint provides an alternative to the ordinary SynchronizationConstraint for situations where the causal relation between event occurrences must be taken into account. It differs from the SynchronizationConstraint in that it applies to a set of event chains, and only looks at the response occurrences that have the same color as each particular stimulus occurrence. It is the earliest of these response occurrences for each chain that are required to lie no more than tolerance time units apart. If the roles of stimuli and responses are swapped, an InputSynchronizationConstraint is obtained. Constraints: [1] All scopes must reference one common stimulus event. Semantics: A system behavior satisfies an OutputSynchronizationConstraint c if and only if for each occurrence x in c.scope(1).stimulus, there is a time t such that for each c.scope index i, there is an occurrence y in c.scope(i).response such that y.color = x.color and y is minimal in c.scope(i).response with that color and 0 <= y - t <= c.tolerance This Metaclass specifies the ability to be a member of an AUTOSAR package. A PatternConstraint describes an event that exhibits a known pattern relative to the occurrences of an imaginary event. A PatternConstraint requires the constrained event occurrences to appear at a predetermined series of offsets from a sequence of reference points in time that are strictly periodic. The exact placement of these reference points is irrelevant; if one placement exists that is periodic and allows the event occurrences to be reached at the desired offsets, the constraint is satisfied. Semantics: A system behavior satisfies a PatternConstraint c if and only if there is a set of times X such that the same system behavior concurrently satisfies PeriodicConstraint { event = X, period = c.period } and for each c.offset index i, DelayConstraint { source = X, target = c.event, lower = c.offset(i), upper = c.offset(i) + c.jitter } and RepeatConstraint { event = c.event, lower = c.minimum } A PatternConstraint describes an event that exhibits a known pattern relative to the occurrences of an imaginary event. A PatternConstraint requires the constrained event occurrences to appear at a predetermined series of offsets from a sequence of reference points in time that are strictly periodic. The exact placement of these reference points is irrelevant; if one placement exists that is periodic and allows the event occurrences to be reached at the desired offsets, the constraint is satisfied. Semantics: A system behavior satisfies a PatternConstraint c if and only if there is a set of times X such that the same system behavior concurrently satisfies PeriodicConstraint { event = X, period = c.period } and for each c.offset index i, DelayConstraint { source = X, target = c.event, lower = c.offset(i), upper = c.offset(i) + c.jitter } and RepeatConstraint { event = c.event, lower = c.minimum } A PeriodicConstraint describes an event that occurs periodically. Semantics: A system behavior satisfies a PeriodicConstraint c if and only if the same system behavior satisfies SporadicConstraint { event = c.event, lower = c.period, upper = c.period, jitter = c.jitter, minimum = c.minimum } A PeriodicConstraint describes an event that occurs periodically. Semantics: A system behavior satisfies a PeriodicConstraint c if and only if the same system behavior satisfies SporadicConstraint { event = c.event, lower = c.period, upper = c.period, jitter = c.jitter, minimum = c.minimum } The PortGroup represents several FunctionPorts grouped into one. All FunctionPorts that are part of a PortGroup are graphically represented as a single FunctionPort. The PortGroup has no semantic meaning except that it makes graphical representation of the connected FunctionPorts easier to read, and provides a means to logically organize several FunctionPorts into one group. Connectors are still connected to the contained FunctionPorts, but tool support may simplify connections by allowing semiautomatic or automatic connection to all FunctionPorts of a PortGroup. Note that the term "PortGroup" is also used by AADL. Semantics: The PortGroup provides the means to organize FunctionPorts and FunctionConnectors. It does not add semantics. In the model, the FunctionPorts contained in the PortGroup are connected as individual FunctionPorts. Constraints: [1] The FunctionPorts in a PortGroup must all be of the same component; all FunctionPorts in a PortGroup must be of the same kind (FunctionFlowPort with same EADirectionKind or FunctionClientServerPort with same ClientServerKind). Notation: FunctionConnectors connected to FunctionPorts of a PortGroup are graphically collapsed into a single line. The PortGroup is rendered as its contained ports, but with a double outline. Extension: Class The PortGroup represents several FunctionPorts grouped into one. All FunctionPorts that are part of a PortGroup are graphically represented as a single FunctionPort. The PortGroup has no semantic meaning except that it makes graphical representation of the connected FunctionPorts easier to read, and provides a means to logically organize several FunctionPorts into one group. Connectors are still connected to the contained FunctionPorts, but tool support may simplify connections by allowing semiautomatic or automatic connection to all FunctionPorts of a PortGroup. Note that the term "PortGroup" is also used by AADL. Semantics: The PortGroup provides the means to organize FunctionPorts and FunctionConnectors. It does not add semantics. In the model, the FunctionPorts contained in the PortGroup are connected as individual FunctionPorts. Constraints: [1] The FunctionPorts in a PortGroup must all be of the same component; all FunctionPorts in a PortGroup must be of the same kind (FunctionFlowPort with same EADirectionKind or FunctionClientServerPort with same ClientServerKind). Notation: FunctionConnectors connected to FunctionPorts of a PortGroup are graphically collapsed into a single line. The PortGroup is rendered as its contained ports, but with a double outline. Extension: Class PowerHardwarePin represents a pin that is primarily intended for power supply, either providing or consuming energy. Semantics: A PowerHardwarePin is primarily intended to be a power supply. The direction attribute of the pin defines whether it is providing or consuming energy. Notation: PowerHardwarePin is shown as a solid square with PWR inside. Its name may appear outside the square. atpStructureElement PowerHardwarePin represents a pin that is primarily intended for power supply, either providing or consuming energy. Semantics: A PowerHardwarePin is primarily intended to be a power supply. The direction attribute of the pin defines whether it is providing or consuming energy. Notation: PowerHardwarePin is shown as a solid square with PWR inside. Its name may appear outside the square. atpStructureElement The PrecedenceConstraint represents a particular constraint applied on the execution sequence of functions. Semantics: The semantics for the PrecedenceConstraint metaclass is to define an association relationship between Functions, indicating the association relationship such that all predecessors have completed before the successors are started. Note: Without a precedence relation, Functions are executed according to their data dependencies, if these are uni-directional. For bi-directional data dependencies, execution order is not defined unless the PrecedenceDependency relationship is used. Notation: PrecedenceConstraint is shown as a dashed arrow with "Precedes" next to it. It points from preceeding to the successive entity. Extension: The PrecedenceConstraint extends UML2 metaclass Class and Dependency. The PrecedenceConstraint represents a particular constraint applied on the execution sequence of functions. Semantics: The semantics for the PrecedenceConstraint metaclass is to define an association relationship between Functions, indicating the association relationship such that all predecessors have completed before the successors are started. Note: Without a precedence relation, Functions are executed according to their data dependencies, if these are uni-directional. For bi-directional data dependencies, execution order is not defined unless the PrecedenceDependency relationship is used. Notation: PrecedenceConstraint is shown as a dashed arrow with "Precedes" next to it. It points from preceeding to the successive entity. Extension: The PrecedenceConstraint extends UML2 metaclass Class and Dependency. instanceRef instanceRef.context instanceRef.target instanceRef instanceRef instanceRef.context instanceRef.target instanceRef PrivateContent is a marker class that marks the artifact element denoted by association privateElement as private, i.e., it will not be presented to the outside of the containing ConfigurableContainer. Refer to the documentation of meta-class ConfigurableContainer for a detailed explanation of how ConfigurableContainer and PrivateContent work together. Constraints: [1] Identifies either one FunctionPrototype or one FunctionPort or one FunctionConnector or one HardwareComponentPrototype or one HardwarePort or one ClampConnector. Semantics: Marks the element identified by association privateElement as private. Otherwise the elements visibility defaults to public. Extension: Class PrivateContent is a marker class that marks the artifact element denoted by association privateElement as private, i.e., it will not be presented to the outside of the containing ConfigurableContainer. Refer to the documentation of meta-class ConfigurableContainer for a detailed explanation of how ConfigurableContainer and PrivateContent work together. Constraints: [1] Identifies either one FunctionPrototype or one FunctionPort or one FunctionConnector or one HardwareComponentPrototype or one HardwarePort or one ClampConnector. Semantics: Marks the element identified by association privateElement as private. Otherwise the elements visibility defaults to public. Extension: Class The problem statement represents a brief statement summarizing the problem being solved which gives the opportunity to establish traceability from artifacts created later, for example to provide rationales to design decisions or trade-off analysis. The problem statement could be extended with further modeling of dependencies between different problems and deduction of root problems The impact of the problem The brief problem statement. This redefines the text attribute in TraceableSpecification. Lists some key benefits of a successful solution. The problem statement represents a brief statement summarizing the problem being solved which gives the opportunity to establish traceability from artifacts created later, for example to provide rationales to design decisions or trade-off analysis. The problem statement could be extended with further modeling of dependencies between different problems and deduction of root problems The ProcessFaultPrototype metaclass represents the anomalies that the target component/system can have due to design or implementation flaws (e.g., incorrect requirements, buffer size configuration, scheduling, etc.). Semantics: The ProcessFaultPrototype represent general internal anomalies of a component that are introduced during design and implementation. Extension: UML::Part / UML::Event atpPrototype The ProcessFaultPrototype metaclass represents the anomalies that the target component/system can have due to design or implementation flaws (e.g., incorrect requirements, buffer size configuration, scheduling, etc.). Semantics: The ProcessFaultPrototype represent general internal anomalies of a component that are introduced during design and implementation. Extension: UML::Part / UML::Event atpPrototype The problem positioning represents an overall brief statement summarizing, at the highest level, the unique position the product intends to fill in the marketplace which gives the opportunity to establish traceability from artifacts created later, for example to provide rationales to design decisions or trade-off analysis. Positioning is assumed to belong to a particular context, typically a system, but also for a smaller part of a system. Brief statement of key benefit; that is, the compelling need for the product. Brief statement of the key capabilities Brief statement of primary competitive alternative Brief statement of primary differentiation Brief statement of target customers. The problem positioning represents an overall brief statement summarizing, at the highest level, the unique position the product intends to fill in the marketplace which gives the opportunity to establish traceability from artifacts created later, for example to provide rationales to design decisions or trade-off analysis. Positioning is assumed to belong to a particular context, typically a system, but also for a smaller part of a system. QualityRequirements or non-functional requirements are used to introduce externally visible properties of the system considered as a whole. They specify criteria that can be used to judge the operation of a system. As opposed to a functional requirement specifying what a system is supposed to do, the non-functional requirements define how a system is supposed to be. The attribute qualityRequirementType allows a more specific classification. Semantics: QualityRequirement element represent a requirement which is non-functional. Extension: Class, specializes Requirement QualityRequirements or non-functional requirements are used to introduce externally visible properties of the system considered as a whole. They specify criteria that can be used to judge the operation of a system. As opposed to a functional requirement specifying what a system is supposed to do, the non-functional requirements define how a system is supposed to be. The attribute qualityRequirementType allows a more specific classification. Semantics: QualityRequirement element represent a requirement which is non-functional. Extension: Class, specializes Requirement A quantification is a statement over the attributes about their value condition or relation. Together with the attribute definitions, it also provides the support for annotating acausal dynamic behavior constraints in terms of continuous-time and discrete-time dynamics models. In the development of embedded systems, such acausal specifications of behaviors are necessary for the definitions of system environments (e.g. the physical plants), electrical and electronics devices (e.g. the transfer functions of actuators) Constraints: [1] A quantification is applied to at least one attribute. Semantics: The quantification is a tuple of: 1. the operands of quantification expressions given by attributes; 2. the time conditions of concern; 3. the actual expressions of properties over single or multiple attributes. EAST-ADL does not define logic and arithmetic operators for the expressions of parameter conditions but would support the definitions in future extensions. Extension: EAElement. atpMixedString,atpPrototype A quantification is a statement over the attributes about their value condition or relation. Together with the attribute definitions, it also provides the support for annotating acausal dynamic behavior constraints in terms of continuous-time and discrete-time dynamics models. In the development of embedded systems, such acausal specifications of behaviors are necessary for the definitions of system environments (e.g. the physical plants), electrical and electronics devices (e.g. the transfer functions of actuators) Constraints: [1] A quantification is applied to at least one attribute. Semantics: The quantification is a tuple of: 1. the operands of quantification expressions given by attributes; 2. the time conditions of concern; 3. the actual expressions of properties over single or multiple attributes. EAST-ADL does not define logic and arithmetic operators for the expressions of parameter conditions but would support the definitions in future extensions. Extension: EAElement. atpMixedString,atpPrototype The QuantitativeSafetyConstraint metaclass represents the quantitative integrity constraints on a fault or failure. Thus, the system has the same or better performance with respect to the constrained fault or failure, and depending on the role this is either a requirement or a property. Semantics: A QuantitativeSafetyConstraint provides information about the probabilistic estimates of target faults/failures, further specified by the failureRate and repairRate attribute. Extension: (see ADLTraceableSpecification) failureRate denotes the number of failures per unit time, i.e. the density of probability of failure divided by probability of survival for a hardware element (ISO26262 definition). For exponential failure distributions it is often denoted by lambda. repairRate denotes the number of repairs per unit time. For exponential repair distributions it is often denoted by mu. The QuantitativeSafetyConstraint metaclass represents the quantitative integrity constraints on a fault or failure. Thus, the system has the same or better performance with respect to the constrained fault or failure, and depending on the role this is either a requirement or a property. Semantics: A QuantitativeSafetyConstraint provides information about the probabilistic estimates of target faults/failures, further specified by the failureRate and repairRate attribute. Extension: (see ADLTraceableSpecification) A Quantity describes a physical dimension by exponents of the available attributes. Some examples of Quantity are: name = "Length" and lengthExp = "1" name = "Angle" and all attribues = 0, i.e. angle is without dimension. name = "Acceleration" and lengthExp = 1 and timeExp =-2. Semantics: The Quantity describes a physical dimension for use in numerical datatypes and expressions to facilitate dimension consistency and control. A Quantity describes a physical dimension by exponents of the available attributes. Some examples of Quantity are: name = "Length" and lengthExp = "1" name = "Angle" and all attribues = 0, i.e. angle is without dimension. name = "Acceleration" and lengthExp = 1 and timeExp =-2. Semantics: The Quantity describes a physical dimension for use in numerical datatypes and expressions to facilitate dimension consistency and control. The RangeableValueType is a specific datatype applicable for numerical datatypes. It describes the accuracy, resolution, and the significant digits of the baseRangeable datatype. Semantics: The RangeableValueType adds the ability to describe the accuracy, resolution, and the significant digits of the baseRangeable datatype. Notation: The datatype RangeableValueType is denoted using the rectangle symbol with keyword «Datatype RangeableValueType». Extension: UML Datatype, SysML ValueType atpType The accuracy of the data (e.g., the FunctionFlowports input or output). Example: An accuracy of 0.5 of the temperature means a communicated value of 19 represents an actual temperature of 19 +/- 0.5 degrees. The resolution of the data expressed as the size of the minimum difference between data values. Example: A resolution of 0.1 means that temperature may be represented in increments of 0.1 degrees. The number of significant digits, e.g., for the speed case: if the speed is a one digit number (e.g., 5 km/h), then this digit is significant, if the speed is a two digits number (e.g., 15 km/h), then the first digit is significant (here: 1), if the speed is a three digits number (e.g., 215 km/h), then the first two digits are significant (here: 21). Significant means here, that the respective digits are reliable. The RangeableValueType is a specific datatype applicable for numerical datatypes. It describes the accuracy, resolution, and the significant digits of the baseRangeable datatype. Semantics: The RangeableValueType adds the ability to describe the accuracy, resolution, and the significant digits of the baseRangeable datatype. Notation: The datatype RangeableValueType is denoted using the rectangle symbol with keyword «Datatype RangeableValueType». Extension: UML Datatype, SysML ValueType atpType Rationale represents a justification to any model element. Semantics: Rationale represents a justification to any model element. Rationale represents a justification to any model element. Semantics: Rationale represents a justification to any model element. A ReactionConstraint defines how long after the occurrence of a stimulus a corresponding response must occur. This constraint provides an alternative to the ordinary DelayConstraint for situations where the causal relation between event occurrences must be taken into account. It differs from the DelayConstraint in that it applies to an event chain, and only looks at the response occurrences that have the same color as each particular stimulus occurrence. It is the earliest of these response occurrences that is required to lie within the prescribed time bounds. If the roles of stimulus and response are swapped, and the time bounds negated, an AgeConstraint is obtained. Semantics: A system behavior satisfies a ReactionConstraint c if and only if for each occurrence x in c.scope.stimulus, there is an occurrence y in c.scope.response such that y.color = x.color and y is minimal in c.scope.response with that color and c.minimum <= y - x <= c.maximum A ReactionConstraint defines how long after the occurrence of a stimulus a corresponding response must occur. This constraint provides an alternative to the ordinary DelayConstraint for situations where the causal relation between event occurrences must be taken into account. It differs from the DelayConstraint in that it applies to an event chain, and only looks at the response occurrences that have the same color as each particular stimulus occurrence. It is the earliest of these response occurrences that is required to lie within the prescribed time bounds. If the roles of stimulus and response are swapped, and the time bounds negated, an AgeConstraint is obtained. Semantics: A system behavior satisfies a ReactionConstraint c if and only if for each occurrence x in c.scope.stimulus, there is an occurrence y in c.scope.response such that y.color = x.color and y is minimal in c.scope.response with that color and c.minimum <= y - x <= c.maximum The Realization is a relationship which relates two or more elements across boundaries of the EAST-ADL abstraction levels. It identifies an element that serves as a specification within this realization relationship and on the other side it identifies an element that is supposed to realize this specification on a lower abstraction level or an implementation. Constraints: [1] The realizedBy elements shall be on a lower abstraction level than the realized relements. [2] The realizedBy or realized elements shall be structural or behavioral. Semantics: The Realization is a relationship which identifies one or several abstract elements that are realized by one or several concrete elements. The realizedBy elements together represents a realization of the group of realized elements and is collectively responsible for meeting the specification of the realized elements, including (derivations of) its requirements. Notation: A Realization relationship is shown as a dashed line with a triangular arrowhead at the end that corresponds to the realized entity. The entity at the tail of the arrow (the realizing EAElement or the realizing ARElement) depends on the entity at the arrowhead (the realized EAElement). Extension: Realization Temporary change in the profile (to overcome Papyrus current limitation): - added extension towards Dependency The Realization is a relationship which relates two or more elements across boundaries of the EAST-ADL abstraction levels. It identifies an element that serves as a specification within this realization relationship and on the other side it identifies an element that is supposed to realize this specification on a lower abstraction level or an implementation. Constraints: [1] The realizedBy elements shall be on a lower abstraction level than the realized relements. [2] The realizedBy or realized elements shall be structural or behavioral. Semantics: The Realization is a relationship which identifies one or several abstract elements that are realized by one or several concrete elements. The realizedBy elements together represents a realization of the group of realized elements and is collectively responsible for meeting the specification of the realized elements, including (derivations of) its requirements. Notation: A Realization relationship is shown as a dashed line with a triangular arrowhead at the end that corresponds to the realized entity. The entity at the tail of the arrow (the realizing EAElement or the realizing ARElement) depends on the entity at the arrowhead (the realized EAElement). Extension: Realization Temporary change in the profile (to overcome Papyrus current limitation): - added extension towards Dependency instanceRef instanceRef.context instanceRef.target instanceRef instanceRef instanceRef.context instanceRef.target instanceRef RedefinableElement represents an element that, when defined in the context of a classifier, can be redefined more specifically or differently in the context of another classifier that specializes (directly or indirectly) the context classifier A redefinable element is a named element that can be redefined in the context of a generalization. The RedefinableElement is an abstract metaclass. Semantics: RedefinableElementrepresents an element that can be redefined in the context of another classifier. Semantics is given by its specializations. Instances of this class can be referred to by their identifier (while adhering to namespace borders). This specifies an identifying shortName for the object. It needs to be unique within its context and is intended for humans but even more for technical reference. The Refine is a relationship metaclass, which signifies a dependency relationship between Requirements and EAElements, showing the relationship when a client EAElement refines the supplier Requirement. Semantics: The Refine metaclass signifies a refined requirement/refined by relationship between a Requirement and an EAElement, where the modification of the supplier Requirement may impact the refining client EAElement. The Refine metaclass implies the semantics that the refining client EAElement is not complete, without the supplier Requirement. Constraints: [1] The property refinedBy must not have the types Requirement or RequirementContainer. Notation: A Refine relationship is shown as a dashed arrow between the Requirements and EAElement. The entity at the tail of the arrow (the refining EAElement) depends on the Requirement at the arrowhead (the refined Requirement). Extension: specializes UML2 stereotype Refine, which extends Dependency. Temporary change in the profile (to overcome bug in Eclipse/UML2 concerning standard stereotypes) - added extension towards Dependency The Refine is a relationship metaclass, which signifies a dependency relationship between Requirements and EAElements, showing the relationship when a client EAElement refines the supplier Requirement. Semantics: The Refine metaclass signifies a refined requirement/refined by relationship between a Requirement and an EAElement, where the modification of the supplier Requirement may impact the refining client EAElement. The Refine metaclass implies the semantics that the refining client EAElement is not complete, without the supplier Requirement. Constraints: [1] The property refinedBy must not have the types Requirement or RequirementContainer. Notation: A Refine relationship is shown as a dashed arrow between the Requirements and EAElement. The entity at the tail of the arrow (the refining EAElement) depends on the Requirement at the arrowhead (the refined Requirement). Extension: specializes UML2 stereotype Refine, which extends Dependency. Temporary change in the profile (to overcome bug in Eclipse/UML2 concerning standard stereotypes) - added extension towards Dependency instanceRef instanceRef.context instanceRef.target instanceRef The Relationship is an abstract metaclass which represents a relationship between arbitrary elements. Semantics: In many cases, Contexts such as functions and sensors need to have requirements and other specification elements allocated to them. In other cases, the relationship between an element and the related specification element is specific for a certain Context: for example a Requirement on a sensor is only applicable in certain hardware architectures. These relationships are modeled by concrete specializations of Relationship. See Context and TraceableSpecification. Extension: The ADLRelationship stereotype is a relationship stereotype that specializes UML2 stereotype Relationship, which extends UML2 metaclass Dependency A RepetitionConstraint describes the distribution of the occurrences of a single event, including the allowance for jitter. The RepetitionConstraint extends the basic notion of repeated occurrences by allowing local devitions from the ideal repetitive pattern described by a RepeatConstraint. Its jitter, lower and upper attributes all contribute to the width of the window in which occurrence number N is accepted, according to the formula N(upper-lower) + jitter. That is, with lower = upper, the uncertainty of where occurrence N may be found does not grow with an increasing N, unlike the case when lower differs from upper by a similar amount and jitter is 0. By adjusting all three attributes, a desired balance between accumulating and non-accumulating uncertainties can be obtained. Semantics: A system behavior satisfies a RepetitionConstraint c if and only if the same system behavior concurrently satisfies RepeatConstraint { event = X, lower = c.lower, upper = c.upper, span = c.span } and StrongDelayConstraint { source = X, target = c.event, lower = 0, upper = c.jitter } A RepetitionConstraint describes the distribution of the occurrences of a single event, including the allowance for jitter. The RepetitionConstraint extends the basic notion of repeated occurrences by allowing local devitions from the ideal repetitive pattern described by a RepeatConstraint. Its jitter, lower and upper attributes all contribute to the width of the window in which occurrence number N is accepted, according to the formula N(upper-lower) + jitter. That is, with lower = upper, the uncertainty of where occurrence N may be found does not grow with an increasing N, unlike the case when lower differs from upper by a similar amount and jitter is 0. By adjusting all three attributes, a desired balance between accumulating and non-accumulating uncertainties can be obtained. Semantics: A system behavior satisfies a RepetitionConstraint c if and only if the same system behavior concurrently satisfies RepeatConstraint { event = X, lower = c.lower, upper = c.upper, span = c.span } and StrongDelayConstraint { source = X, target = c.event, lower = 0, upper = c.jitter } The Requirement represents a capability or condition that must (or should) be satisfied. A Requirement can also specify an informal constraint, e.g. "The development of the component X must be according to the standard Y", or "The realization of this function as a software component must adhere to the scope and external interface as specified by this function". It will be used to unite the common properties of specific requirement types. A Requirement may either be directly associated with a Context (by inheriting from TraceableSpecification) or it may be included in a RequirementsHierarchy, which represents a larger unit or module of specification information. The traceability between Requirement entities and other specification or design entities will be ensured by the relationship dependencies described in the Infrastructure part of this specification. Semantics: The string in the text attribute inherited from TraceableSpecification is the capability or condition that applies to the Identifiable that is associated to the Requirement through the Satisfy relation. Notation: Requirement is shown as a solid rectangle with Req top right and its name. Extension: To specialize SysML::Requirement, which extends Class Specifies the language used for the requirement statement. Reference to possible external file containing the requirement statement. The Requirement represents a capability or condition that must (or should) be satisfied. A Requirement can also specify an informal constraint, e.g. "The development of the component X must be according to the standard Y", or "The realization of this function as a software component must adhere to the scope and external interface as specified by this function". It will be used to unite the common properties of specific requirement types. A Requirement may either be directly associated with a Context (by inheriting from TraceableSpecification) or it may be included in a RequirementsHierarchy, which represents a larger unit or module of specification information. The traceability between Requirement entities and other specification or design entities will be ensured by the relationship dependencies described in the Infrastructure part of this specification. Semantics: The string in the text attribute inherited from TraceableSpecification is the capability or condition that applies to the Identifiable that is associated to the Requirement through the Satisfy relation. Notation: Requirement is shown as a solid rectangle with Req top right and its name. Extension: To specialize SysML::Requirement, which extends Class RequirementsHierarchy represents a larger unit or module of specification information. It is used to bundle several Requirements which are semantically related to each other. Thus, to preserve the ordering of requirement specification objects, the order of child hierarchies is very important here. The RequirementsHierarchy with its reference to Requirement is the basic element for structuring requirement information into a forest structure. RequirementsHierarchy correponds to ReqIF SpecHierarchy. Constraints: [1] Only non-root RequirementsHierarchy which is contained in another RequirementHierarchy are allowed to reference a Requirement. Semantics: RequirementsHierarchy organizes Requirements in groups. The semantics of the group is user-defined. Notation: RequirementsHierarchy is shown as a solid-outline rectangle containing the name. Contained entities may also be shown inside (White-box view) Extension: Package RequirementsHierarchy represents a larger unit or module of specification information. It is used to bundle several Requirements which are semantically related to each other. Thus, to preserve the ordering of requirement specification objects, the order of child hierarchies is very important here. The RequirementsHierarchy with its reference to Requirement is the basic element for structuring requirement information into a forest structure. RequirementsHierarchy correponds to ReqIF SpecHierarchy. Constraints: [1] Only non-root RequirementsHierarchy which is contained in another RequirementHierarchy are allowed to reference a Requirement. Semantics: RequirementsHierarchy organizes Requirements in groups. The semantics of the group is user-defined. Notation: RequirementsHierarchy is shown as a solid-outline rectangle containing the name. Contained entities may also be shown inside (White-box view) Extension: Package RequirementsLink represents a relation between two or more Requirements. Source and target Requirements of the relation are distinguished, which means that the relation is directed (from source to target). If such a distinction does not make sense, then use a RequirementsRelationGroup instead. The standard case will be a relation with one source and one target Requirement. However, it is possible to have several source and/or several target Requirements so that general relations can be expressed with instances of this metaclass. The semantic of a concrete Requirement relation can be provided by the modeler. In particular, three ways are conceivable: (1) The user attributes of the relation can be used to specify its meaning, for example with a user attribute called "relationType" which is set to values such as "needs" or "excludes". (2) The UserAttributeElementType can be used. Certain types will be used for certain relation semantics. (3) RequirementsRelationGroups can be used, i.e. all relations with an "excludes" meaning are put in one relation group and all with a "needs" meaning are put in another. Semantics: The RequirementsLink defines a relation from a set of source and target requirements. The isBidirectional attribute defines whether the relation is bidirectional. The semantics of the relation is user-defined. When set to true, the semantic relation represented by this instance of RequirementRelation does not only apply to the direction from source to target (as always) but also in the opposite direction. Note that this means that the relation becomes directed in both directions but NOT undirected. To express an undirected association use a RequirementsRelationGroup. RequirementsLink represents a relation between two or more Requirements. Source and target Requirements of the relation are distinguished, which means that the relation is directed (from source to target). If such a distinction does not make sense, then use a RequirementsRelationGroup instead. The standard case will be a relation with one source and one target Requirement. However, it is possible to have several source and/or several target Requirements so that general relations can be expressed with instances of this metaclass. The semantic of a concrete Requirement relation can be provided by the modeler. In particular, three ways are conceivable: (1) The user attributes of the relation can be used to specify its meaning, for example with a user attribute called "relationType" which is set to values such as "needs" or "excludes". (2) The UserAttributeElementType can be used. Certain types will be used for certain relation semantics. (3) RequirementsRelationGroups can be used, i.e. all relations with an "excludes" meaning are put in one relation group and all with a "needs" meaning are put in another. Semantics: The RequirementsLink defines a relation from a set of source and target requirements. The isBidirectional attribute defines whether the relation is bidirectional. The semantics of the relation is user-defined. The collection of requirements, their relationships, and use cases. This collection can be done across the EAST-ADL abstraction levels. Semantics: The RequirementsModel is a container element for requirement-related elements. Constraints: [1] The validFor attribute of the UserElementType shall be "Requirement". The collection of requirements, their relationships, and use cases. This collection can be done across the EAST-ADL abstraction levels. Semantics: The RequirementsModel is a container element for requirement-related elements. Constraints: [1] The validFor attribute of the UserElementType shall be "Requirement". Semantics: RequirementsRelationship is an abstract association. The semantics is defined by its specializations. RequirementsRelationGroup represents a group of relations between Requirements. RequirementsRelationGroup correponds to ReqIF RelationGroup. Semantics: RequirementsRelationGroup represents a group of RequirementsRelations. The semantics of this grouping is defined by the user. RequirementsRelationGroup represents a group of relations between Requirements. RequirementsRelationGroup correponds to ReqIF RelationGroup. Semantics: RequirementsRelationGroup represents a group of RequirementsRelations. The semantics of this grouping is defined by the user. ReuseMetaInformation represents the description information needed in the context of reuse. For example a specific entity is only a short-time solution that is not intended to be reused. Also a specific entity can only be reused for specific model ranges (that are not reflected in the product model). Semantics: The ReuseMetaInformation represents information that explains if and how the respective entity can be reused. Extension: Class The reuse information is stored in this attribute. This Boolean attributes just says whether the owning VariableElement itself can essentially be reused or not. Specific information or constraints on reuse are in the information attribute. ReuseMetaInformation represents the description information needed in the context of reuse. For example a specific entity is only a short-time solution that is not intended to be reused. Also a specific entity can only be reused for specific model ranges (that are not reflected in the product model). Semantics: The ReuseMetaInformation represents information that explains if and how the respective entity can be reused. Extension: Class SafetyCase represents a safety case that communicates a clear, comprehensive and defensible argument that a system is acceptably safe to operate in a given context. Safety Cases are used in safety related systems, where failures can lead to catastrophic or at least dangerous consequences. Semantics: The SafetyCase element is a container element for warrant, type and claim that together represent evidence of safety for the system or item in its context. Description of how the SafetyCase Warrant (argument) relates to, and depends upon, information from other viewpoints. Safety case life cycle stage (preliminary, interim or operational) SafetyCase represents a safety case that communicates a clear, comprehensive and defensible argument that a system is acceptably safe to operate in a given context. Safety Cases are used in safety related systems, where failures can lead to catastrophic or at least dangerous consequences. Semantics: The SafetyCase element is a container element for warrant, type and claim that together represent evidence of safety for the system or item in its context. The SafetyConstraint metaclass represents the qualitative integrity constraints on a fault or failure. Thus, the system has the same or better performance with respect to the constrained fault or failure, and depending on the role this is either a requirement or a property. Semantics: A SafetyConstraint defines qualitative bounds on the constrainedFaultFailure in terms of safety integrity level, asilValue. Depending on role, the SafetyConstraint may define a required or an actual safety integrity level. Extension: (see ADLTraceableSpecification) The ASIL level of the target fault or failure. The SafetyConstraint metaclass represents the qualitative integrity constraints on a fault or failure. Thus, the system has the same or better performance with respect to the constrained fault or failure, and depending on the role this is either a requirement or a property. Semantics: A SafetyConstraint defines qualitative bounds on the constrainedFaultFailure in terms of safety integrity level, asilValue. Depending on role, the SafetyConstraint may define a required or an actual safety integrity level. Extension: (see ADLTraceableSpecification) SafetyGoal represents the top-level safety requirement defined in ISO26262. Its purpose is to define how to avoid its associated HazardousEvents, or reduce the risk associated with the hazardous event to an acceptable level. The SafetyGoal is defined through one or several associated requirement elements. An ASIL shall be assigned to each SafetyGoal, to represent the integrity level at which the SafetyGoal must be met. Similar SafetyGoals can be combined into one SafetyGoal. If different ASILs are assigned to similar SafetyGoals, the highest ASIL shall be assigned to the combined SafetyGoal. For every SafetyGoal, a safe state should be defined, either textually or by referencing a specific mode. The safe state is a system state to be maintained or to be reached when a potential source of its hazardous event is detected. Semantics: SafetyGoal represents a safety Goal according to ISO26262. Requirements define the SafetyGoal, and HazardousEvents identify the responsibility of each SafetyGoal. hazardClassification defines the integrity classification of the SafetyGoal, and safeStates may be defined by a string or formalized through associated Modes. Notation: SafetyGoal is a box with text SafetyGoal at the top left. Extension: Class For every SafetyGoal, a safe state should be defined, in order to declare a system state to be maintained or to be reached when the failure is detected and so to allow a failure mitigation action without any violation of the associated SafetyGoal. SafetyGoal represents the top-level safety requirement defined in ISO26262. Its purpose is to define how to avoid its associated HazardousEvents, or reduce the risk associated with the hazardous event to an acceptable level. The SafetyGoal is defined through one or several associated requirement elements. An ASIL shall be assigned to each SafetyGoal, to represent the integrity level at which the SafetyGoal must be met. Similar SafetyGoals can be combined into one SafetyGoal. If different ASILs are assigned to similar SafetyGoals, the highest ASIL shall be assigned to the combined SafetyGoal. For every SafetyGoal, a safe state should be defined, either textually or by referencing a specific mode. The safe state is a system state to be maintained or to be reached when a potential source of its hazardous event is detected. Semantics: SafetyGoal represents a safety Goal according to ISO26262. Requirements define the SafetyGoal, and HazardousEvents identify the responsibility of each SafetyGoal. hazardClassification defines the integrity classification of the SafetyGoal, and safeStates may be defined by a string or formalized through associated Modes. Notation: SafetyGoal is a box with text SafetyGoal at the top left. Extension: Class The Satisfy is a relationship metaclass, which signifies the relationship between a Requirement and an element intended to satisfy the Requirement. Semantics: The Satisfy metaclass signifies a satisfied requirement/satisfied by relationship between a set of Requirements and a set of satisfying entities, where the modification of the supplier Requirements may impact the satisfying client entities. The Satisfy metaclass implies the semantics that the satisfying client entities are not complete without the supplier Requirement. Constraints: [1] The EAElement in the association satisfiedBy may not be a Requirement or RequirementContainer. [2] An element of type Satisfy is only allowed to have associations to either elements of type UseCase (see satisfiedUseCase) or elements of type Requirement (see satisfiedRequirement). Not both at the same time! Notation: A Satisfy relationship is shown as a dashed line with an arrowhead at the end that corresponds to the satisfied Requirement or UseCaseUseCase. The entity at the tail of the arrow (the satisfying EAElement or the satisfying ARElement) depends on the entity at the arrowhead (the satisfied Requirement or UseCaseUseCase). Extension: To specialize SysML::Satisfy, which extends Realization. Temporary change in the profile (to overcome Papyrus current limitation): - added extension towards Dependency The Satisfy is a relationship metaclass, which signifies the relationship between a Requirement and an element intended to satisfy the Requirement. Semantics: The Satisfy metaclass signifies a satisfied requirement/satisfied by relationship between a set of Requirements and a set of satisfying entities, where the modification of the supplier Requirements may impact the satisfying client entities. The Satisfy metaclass implies the semantics that the satisfying client entities are not complete without the supplier Requirement. Constraints: [1] The EAElement in the association satisfiedBy may not be a Requirement or RequirementContainer. [2] An element of type Satisfy is only allowed to have associations to either elements of type UseCase (see satisfiedUseCase) or elements of type Requirement (see satisfiedRequirement). Not both at the same time! Notation: A Satisfy relationship is shown as a dashed line with an arrowhead at the end that corresponds to the satisfied Requirement or UseCaseUseCase. The entity at the tail of the arrow (the satisfying EAElement or the satisfying ARElement) depends on the entity at the arrowhead (the satisfied Requirement or UseCaseUseCase). Extension: To specialize SysML::Satisfy, which extends Realization. Temporary change in the profile (to overcome Papyrus current limitation): - added extension towards Dependency instanceRef instanceRef.context instanceRef.target instanceRef A mixed string description, identifying the source elements. This means that the SelectionCriterion could evaluate to True or False if a optional identifiable (feature or artefact) is referenced as target. Or evaluate to a numerical if a FeatureParameter is referenced as target. Semantics: See description. atpMixedString,atpPrototype A mixed string description, identifying the source elements. This means that the SelectionCriterion could evaluate to True or False if a optional identifiable (feature or artefact) is referenced as target. Or evaluate to a numerical if a FeatureParameter is referenced as target. Semantics: See description. atpMixedString,atpPrototype Sensor represents a hardware entity for digital or analog sensor elements. The Sensor is connected electrically to the electrical entities of the Hardware Design Architecture. Semantics: Sensor denotes an electrical sensor. The Sensor represents the physical and electrical aspects of sensor hardware. The logical aspect is represented by a HardwareFunctionType associated with the Sensor. Notation: Sensor is shown as an oval. The circle contains the name, and its ports or port groups on the perimeter. atpType Sensor represents a hardware entity for digital or analog sensor elements. The Sensor is connected electrically to the electrical entities of the Hardware Design Architecture. Semantics: Sensor denotes an electrical sensor. The Sensor represents the physical and electrical aspects of sensor hardware. The logical aspect is represented by a HardwareFunctionType associated with the Sensor. Notation: Sensor is shown as an oval. The circle contains the name, and its ports or port groups on the perimeter. atpType A SporadicConstraint describes an event that occurs sporadically. The SporadicConstraint is just an application of the RepetitionConstraint with a default span attribute of 1, combined with an additional requirement that the effective minimum distance between any two occurrences must be at least the value given by minimum (even if lower-jitter would suggest a smaller value). Semantics: A system behavior satisfies a SporadicConstraint c if and only if the same system behavior concurrently satisfies RepetitionConstraint { event = c.event, lower = c.lower, upper = c.upper, jitter = c.jitter } and RepeatConstraint { event = c.event, lower = c.minimum } A SporadicConstraint describes an event that occurs sporadically. The SporadicConstraint is just an application of the RepetitionConstraint with a default span attribute of 1, combined with an additional requirement that the effective minimum distance between any two occurrences must be at least the value given by minimum (even if lower-jitter would suggest a smaller value). Semantics: A system behavior satisfies a SporadicConstraint c if and only if the same system behavior concurrently satisfies RepetitionConstraint { event = c.event, lower = c.lower, upper = c.upper, jitter = c.jitter } and RepeatConstraint { event = c.event, lower = c.minimum } The stakeholder represents various roles with regard to the creation and use of architectural descriptions. Stakeholders include clients, users, the architect, developers, and evaluators. [IEEE 1471] Summarize the Stakeholder's key responsibilities with regard to the electrical/electronic system being developed; that is, their interest as a Stakeholder. Describes how the Stakeholder defines success. The stakeholder represents various roles with regard to the creation and use of architectural descriptions. Stakeholders include clients, users, the architect, developers, and evaluators. [IEEE 1471] Stakeholder needs represent a list of the key problems as perceived by the stakeholder, and it gives the opportunity to establish traceability from artifacts created later, for example to provide rationales to design decisions or trade-off analysis. The brief need statement. Redefines text. The priority of the need. Stakeholder needs represent a list of the key problems as perceived by the stakeholder, and it gives the opportunity to establish traceability from artifacts created later, for example to provide rationales to design decisions or trade-off analysis. A system or component can have a finite set of discrete states. Each state defines a situation where certain value invariant (quantificationInvariant) and/or time invariant (timeInvariant) hold. A state s is an initial state when isInitState=true. In the context of system design, a state s can represent one or multiple operation modes when isMode=true; or one or multiple errors in the system when isError=true, or hazards when isHazard=true. Semantics: Each state defines a situation where certain value- and/or time-conditions in terms of state invariants hold. Indicating an initial state when the value is true. A system or component can have a finite set of discrete states. Each state defines a situation where certain value invariant (quantificationInvariant) and/or time invariant (timeInvariant) hold. A state s is an initial state when isInitState=true. In the context of system design, a state s can represent one or multiple operation modes when isMode=true; or one or multiple errors in the system when isError=true, or hazards when isHazard=true. Semantics: Each state defines a situation where certain value- and/or time-conditions in terms of state invariants hold. A StrongDelayConstraint imposes limits between each indexed occurrence of an event called source and the identically indexed occurrence of an event called target. The strong delay notion requires source and target occurrences to appear in lock-step. Only one-to-one source-target patterns are allowed, and no stray target occurrences are accepted. Strong synchronization differs from the ordinary form of SynchronizationConstraint by grouping event occurrences into synchronization clusters strictly according to their index. This means that multiple occurrences of a single event cannot belong to a single cluster, and clusters may not share occurrences. Strong synchronization tightens the requirements compared to ordinary synchronization in much the same way as StrongDelayConstraint refines the ordinary DelayConstraint. Semantics: A system behavior satisfies a StrongDelayConstraint c if and only if c.source and c.target have the same number of occurrences, and for each index i, if there is an i:th occurrence of c.source at time x there is also an i:th occurrence of c.target at time y such that c.lower <= y - x <= c.upper A StrongDelayConstraint imposes limits between each indexed occurrence of an event called source and the identically indexed occurrence of an event called target. The strong delay notion requires source and target occurrences to appear in lock-step. Only one-to-one source-target patterns are allowed, and no stray target occurrences are accepted. Strong synchronization differs from the ordinary form of SynchronizationConstraint by grouping event occurrences into synchronization clusters strictly according to their index. This means that multiple occurrences of a single event cannot belong to a single cluster, and clusters may not share occurrences. Strong synchronization tightens the requirements compared to ordinary synchronization in much the same way as StrongDelayConstraint refines the ordinary DelayConstraint. Semantics: A system behavior satisfies a StrongDelayConstraint c if and only if c.source and c.target have the same number of occurrences, and for each index i, if there is an i:th occurrence of c.source at time x there is also an i:th occurrence of c.target at time y such that c.lower <= y - x <= c.upper A StrongSynchronizationConstraint describes how tightly the occurrences of a group of events follow each other. Semantics: A system behavior satisfies a StrongSynchronizationConstraint c if and only if there is a set of times X such that for each c.event index i, the same system behavior satisfies StrongDelayConstraint { source = X, target = c.event(i), lower = 0, upper = c.tolerance } A StrongSynchronizationConstraint describes how tightly the occurrences of a group of events follow each other. Semantics: A system behavior satisfies a StrongSynchronizationConstraint c if and only if there is a set of times X such that for each c.event index i, the same system behavior satisfies StrongDelayConstraint { source = X, target = c.event(i), lower = 0, upper = c.tolerance } A SynchronizationConstraint describes how tightly the occurrences of a group of events follow each other. This form of synchronization only takes the width and completeness of each occurrence cluster into account; it does not care whether som events occur multiple times within a cluster or whether some clusters overlap and share occurrences. In particular, event occurrences are not partitioned into clusters according to their role or what has caused them. Stray occurrences of single events are not allowed, though, since these would just count as incomplete clusters according to this constraint. Semantics: A system behavior satisfies a SynchronizationConstraint c if and only if there is a set of times X such that for each c.event index i, the same system behavior concurrently satisfies DelayConstraint { source = X, target = c.event(i), lower = 0, upper = c.tolerance } and DelayConstraint { source = c.event(i), target = X, lower = -c.tolerance, upper = 0} A SynchronizationConstraint describes how tightly the occurrences of a group of events follow each other. This form of synchronization only takes the width and completeness of each occurrence cluster into account; it does not care whether som events occur multiple times within a cluster or whether some clusters overlap and share occurrences. In particular, event occurrences are not partitioned into clusters according to their role or what has caused them. Stray occurrences of single events are not allowed, though, since these would just count as incomplete clusters according to this constraint. Semantics: A system behavior satisfies a SynchronizationConstraint c if and only if there is a set of times X such that for each c.event index i, the same system behavior concurrently satisfies DelayConstraint { source = X, target = c.event(i), lower = 0, upper = c.tolerance } and DelayConstraint { source = c.event(i), target = X, lower = -c.tolerance, upper = 0} SynchronousTransition denotes a specialization of discrete transitions (Transition) of which the firing can be synchronized by explicit rendezvous events. Constraint For behavior constraint descriptions that target application software functions, SynchronousTransition should not be applied. Semantics: When all the given guard conditions are met, a transition will be fired to respond to the occurrence of an event (which is indicated by the role readEventOccurrences?) or to signal the occurrence of an event (which is indicated by the role writeEventOccurrance!). A transition, when fired, will lead to the exit of the associated "from" state and an entrance to the associated "to" state, while invoking one or more logical transformations (TransformationOccurrance!) as the effects of the transition. SynchronousTransition denotes a specialization of discrete transitions (Transition) of which the firing can be synchronized by explicit rendezvous events. Constraint For behavior constraint descriptions that target application software functions, SynchronousTransition should not be applied. Semantics: When all the given guard conditions are met, a transition will be fired to respond to the occurrence of an event (which is indicated by the role readEventOccurrences?) or to signal the occurrence of an event (which is indicated by the role writeEventOccurrance!). A transition, when fired, will lead to the exit of the associated "from" state and an entrance to the associated "to" state, while invoking one or more logical transformations (TransformationOccurrance!) as the effects of the transition. The top level element of the System Description. The System description defines five major elements: Topology, Software, Communication, Mapping and Mapping Constraints. The System element directly aggregates the elements describing the Software, Mapping and Mapping Constraints; it contains a reference to an ASAM FIBEX description specifying Communication and Topology. Version number of the Ecu Extract. Version number of the System Description. The top level element of the System Description. The System description defines five major elements: Topology, Software, Communication, Mapping and Mapping Constraints. The System element directly aggregates the elements describing the Software, Mapping and Mapping Constraints; it contains a reference to an ASAM FIBEX description specifying Communication and Topology. The SystemModel is used to organize models/architectures according to their abstraction level; it can also hold with relationships between the different levels. Semantics: The SystemModel represents the electrical/electronic system of the vehicle, and concepts related to the various abstraction levels. Notation: The default notation for a SystemModel is a solid-outline rectangle containing the SystemModel's name, and with compartments separating by horizontal lines containing features or other members of the SystemModel. Contained entities may also be shown with their connectors (White-box view). Extension: Class atpStructureElement The SystemModel is used to organize models/architectures according to their abstraction level; it can also hold with relationships between the different levels. Semantics: The SystemModel represents the electrical/electronic system of the vehicle, and concepts related to the various abstraction levels. Notation: The default notation for a SystemModel is a solid-outline rectangle containing the SystemModel's name, and with compartments separating by horizontal lines containing features or other members of the SystemModel. Contained entities may also be shown with their connectors (White-box view). Extension: Class atpStructureElement The TakeRateConstraint defines the ratio between the number of configurations that includes the target elements and the number of configurations that include the source. If several source elements are referenced, it would be the configurations in which all these exist. TakeRateConstraint complements configuration decisions, as the latter defines the rules for actual configuration. TakeRateConstraint defines expected rates of configurations and the set of constraints should be consistent with the configuration decisions. Also, the set of TakeRateConstraints shall be consistent among themselves. Constraints: [1] The cardinality of target is > 0 Semantics: The TakeRate constraint defines frequency of configurations. Let sourceamount and targetamount be the number of system configurations where all source and target elements, respectively, are included. takeRate= targetamount/sourceamount. If no source is associated, takeRate=targetamount. The rate of target compared with source configurations. The TakeRateConstraint defines the ratio between the number of configurations that includes the target elements and the number of configurations that include the source. If several source elements are referenced, it would be the configurations in which all these exist. TakeRateConstraint complements configuration decisions, as the latter defines the rules for actual configuration. TakeRateConstraint defines expected rates of configurations and the set of constraints should be consistent with the configuration decisions. Also, the set of TakeRateConstraints shall be consistent among themselves. Constraints: [1] The cardinality of target is > 0 Semantics: The TakeRate constraint defines frequency of configurations. Let sourceamount and targetamount be the number of system configurations where all source and target elements, respectively, are included. takeRate= targetamount/sourceamount. If no source is associated, takeRate=targetamount. TechnicalSafetyConcept represents the set of technical safety requirements that together fulfils a FunctionalSafetyConcept and SafetyGoal in accordance with ISO 26262. These are derived from FunctionalSafetyConcepts i.e. TechnicalSafetyRequirements are derived from FunctionalSafetyRequirements. Semantics: The TechnicalSafetyConcept consists of the technical safety requirements and details the functional safety concept considering the functional concept and the preliminary architectural design. It corresponds to the Technical Safety Concept of ISO26262. TechnicalSafetyConcept represents the set of technical safety requirements that together fulfils a FunctionalSafetyConcept and SafetyGoal in accordance with ISO 26262. These are derived from FunctionalSafetyConcepts i.e. TechnicalSafetyRequirements are derived from FunctionalSafetyRequirements. Semantics: The TechnicalSafetyConcept consists of the technical safety requirements and details the functional safety concept considering the functional concept and the preliminary architectural design. It corresponds to the Technical Safety Concept of ISO26262. Temporal constraints (TemporalConstraint) provide the language support for capturing the concerns relating to discrete behavior, which emphasizes the dependency that a behavior has in regard to its own history and other behaviors on a timeline. They are useful for precisely defining requirements or design solutions. A temporal constraint consists of a set of states of discrete behavior, a set of occurrences of discrete events, a set of discrete transitions; and a set of time intervals that constitute the logical time basis of discrete behavior Constraint: A Temporal constraint has a single initial state. Semantics: The definition of temporal constraint is based on a generic definition of automata. That is, a temporal constraint is a tuple of: 1. a set of states of discrete behavior; 2. a set of occurrences of discrete events; 3. a set of discrete transitions; and 4. a set of time intervals that constitute the logical time basis of discrete behavior. The execution has the following pattern: In one state, read certain parameter, upon certain parameter condition(s) and event occurrence(s), do certain transitions(s) to go to another state. Only one state is active during the operation. Temporal constraints (TemporalConstraint) provide the language support for capturing the concerns relating to discrete behavior, which emphasizes the dependency that a behavior has in regard to its own history and other behaviors on a timeline. They are useful for precisely defining requirements or design solutions. A temporal constraint consists of a set of states of discrete behavior, a set of occurrences of discrete events, a set of discrete transitions; and a set of time intervals that constitute the logical time basis of discrete behavior Constraint: A Temporal constraint has a single initial state. Semantics: The definition of temporal constraint is based on a generic definition of automata. That is, a temporal constraint is a tuple of: 1. a set of states of discrete behavior; 2. a set of occurrences of discrete events; 3. a set of discrete transitions; and 4. a set of time intervals that constitute the logical time basis of discrete behavior. The execution has the following pattern: In one state, read certain parameter, upon certain parameter condition(s) and event occurrence(s), do certain transitions(s) to go to another state. Only one state is active during the operation. This is used to specify a time value based on ASAM CSE codes. It is specified by a code which defined the basis of the time and a scaling factor which finally determines the time value. If for example the the cseCode is 100 and the cseCodeFactor is 360, it represents 360 angular degrees. If the cseCode is 2 and the cseCodeFactor is 50 it represents 50 microseconds Specifies the time base by means of CSE codes. The scaling factor for the time value based on the specified CSE code. This is used to specify a time value based on ASAM CSE codes. It is specified by a code which defined the basis of the time and a scaling factor which finally determines the time value. If for example the the cseCode is 100 and the cseCodeFactor is 360, it represents 360 angular degrees. If the cseCode is 2 and the cseCodeFactor is 50 it represents 50 microseconds The collection of timing descriptions, namely events and event chains, and the timing constraints imposed on these events and event chains. This collection can be done across the EAST-ADL abstraction levels. The collection of timing descriptions, namely events and event chains, and the timing constraints imposed on these events and event chains. This collection can be done across the EAST-ADL abstraction levels. This abstract element references a mode in order to indicate that the corresponding TimingConstraint is only valid when the specified mode is active. Semantics: The TimingConstraint does not describe what is classically referred to as a "design" constraint but has the role of a property, requirement, or a validation result. It is a requirement if this TimingConstraint refines a Requirement (by the Refine relationship). The TimingConstraint is a validation result if it realizes a VVActualOutcome, it is an intended validation result if it realizes a VVIntendedOutcome, and in other cases it denotes a property. An abstract metaclass describing the timing events and their relations by event chains within the timing model. A timing event is the abstract representation of a specific system behavior -- that can be observed at runtime -- in the AUTOSAR specification. Timing events are used to define the scope for timing constraints. Depending on the specific scope, the view on the system, and the level of abstraction different types of events are defined. In order to avoid confusion with existing event descriptions in the AUTOSAR templates the timing specific event types use the prefix TD. A Timing Expression, denoted by texp, is a term built from an arithmetic expression by applying an optional unit and referencing an optional time base. It stands for a value in the real number system extended with positive and negative infinity. Grammar: texp ::= aexp | aexp UN | aexp on TB | aexp UN on TB Semantics: Given a particular variable assignment, the meaning of a timing expression texp in that assignment is a value in the real number system extended with positive and negative infinity. Depending on the form of texp, this value is defined as follows: - If texp is of the form aexp, its meaning is the meaning of aexp in the given variable assignment. - If texp is of the form aexp UN, its meaning is r * k, where r is the meaning of aexp in the given variable assignment, and k is the factor of UN in the Universal time base. - If texp is of the form aexp on TB, its meaning is f (r), where f is the meaning of TB in the given variable assignment, and r is the meaning of aexp in the same assignment. - If texp is of the form aexp UN on TB, its meaning is f (r * k), where f is the meaning of TB in the given variable assignment, r is the meaning of aexp in the same assignment, k is the factor of UN in DI, and DI is the dimension of TB. atpMixedString,atpPrototype A Timing Expression, denoted by texp, is a term built from an arithmetic expression by applying an optional unit and referencing an optional time base. It stands for a value in the real number system extended with positive and negative infinity. Grammar: texp ::= aexp | aexp UN | aexp on TB | aexp UN on TB Semantics: Given a particular variable assignment, the meaning of a timing expression texp in that assignment is a value in the real number system extended with positive and negative infinity. Depending on the form of texp, this value is defined as follows: - If texp is of the form aexp, its meaning is the meaning of aexp in the given variable assignment. - If texp is of the form aexp UN, its meaning is r * k, where r is the meaning of aexp in the given variable assignment, and k is the factor of UN in the Universal time base. - If texp is of the form aexp on TB, its meaning is f (r), where f is the meaning of TB in the given variable assignment, and r is the meaning of aexp in the same assignment. - If texp is of the form aexp UN on TB, its meaning is f (r * k), where f is the meaning of TB in the given variable assignment, r is the meaning of aexp in the same assignment, k is the factor of UN in DI, and DI is the dimension of TB. atpMixedString,atpPrototype The TraceableSpecification is an abstract metaclass which is used to allow its specializations to be allocated to a Context. Semantics: TraceableSpecification is specialized by requirements, test cases and other specifications, that can be allocated to a Context, for example to a sensor or to an entire HW architecture. See Context and Relationship. Extension: The ADLTraceableSpecification is a specification stereotype which extends UML2 metaclass Element An optional description attribute that provides textual representation, or a reference to the textual representation, of the Traceable Specification in a specific formalism. A transformation occurrence (TransformationOccurrence) denotes the activations of logical transformations due to state transitions or logical paths. A transformation occurrence can also have a time condition (timeCondition), stating the time instances when the invocation happens. If a logical transformation is invoked, its in-data will be assigned with particular values by the invocation context (inQuantification). As the consequence of transformation, the out-data will also be assigned with particular value (outQuantification). Constraint: N/A Semantics: A logical transformation can only occur in a state transition or a logical path. In such an occurrence, a set of logical transformations are invoked. Given some particular quantifications of in-data (inQuantification) and time conditions (timeCondition), some the particular quantifications of out-data will be satisfied after the invocation. Extension: EAElement. A transformation occurrence (TransformationOccurrence) denotes the activations of logical transformations due to state transitions or logical paths. A transformation occurrence can also have a time condition (timeCondition), stating the time instances when the invocation happens. If a logical transformation is invoked, its in-data will be assigned with particular values by the invocation context (inQuantification). As the consequence of transformation, the out-data will also be assigned with particular value (outQuantification). Constraint: N/A Semantics: A logical transformation can only occur in a state transition or a logical path. In such an occurrence, a set of logical transformations are invoked. Given some particular quantifications of in-data (inQuantification) and time conditions (timeCondition), some the particular quantifications of out-data will be satisfied after the invocation. Extension: EAElement. Discrete transitions (Transition) describe the possible switches between discrete states due to the occurrences of discrete events or due to the violations of a state invariant in time or in value quantification. See also Transition. Constraint A transition connects one or two states. This means that the from and to roles can be applied to two distinct states or a single state. Semantics: When all the given guard conditions are met, a transition will be fired. A transition, when fired, will lead to the exit of the associated "from" state and an entrance to the associated "to" state, while invoking one or more logical transformations (TransformationOccurrance! ) as the effects of the transition. Discrete transitions (Transition) describe the possible switches between discrete states due to the occurrences of discrete events or due to the violations of a state invariant in time or in value quantification. See also Transition. Constraint A transition connects one or two states. This means that the from and to roles can be applied to two distinct states or a single state. Semantics: When all the given guard conditions are met, a transition will be fired. A transition, when fired, will lead to the exit of the associated "from" state and an entrance to the associated "to" state, while invoking one or more logical transformations (TransformationOccurrance! ) as the effects of the transition. A transition event denotes the occurrence, i.e. the actual happening, of certain logical, execution specific, and erroneous conditions, that fires the transitions of discrete behavior. * An occurred logical event (occurredLogicalEvent) denotes a logical condition (e.g. when the measured value of vehicle speed is below 30 km/h) that takes place at a particular time instance and becomes valid in a certain time interval according to the definition of corresponding quantification. Logical events of input or output variables (defined through Attribute) can be communicated through the corresponding ports. * An occurred execution specific event (occurredExecutionEvent) denotes a distinct form of condition change in system execution at distinct points in time, such as at the triggering of a function, or at the receiving/sending of data from/to ports. * The occurrence of a fault, a failure, or a hazard (occurredFeatureFlaw, occurredHazardousEvent, or occurredFaultFailure) denotes a distinct form of deviation from nominal behaviors in certain time condition, of which the estimated existences are expressed by the corresponding anomaly or hazard definition. Constraint: The set of occurred erroneous events ((occurredFeatureFlaw, occurredHazardousEvent, or occurredAnomaly) is a symmetric set difference of feature flaws (Dependability::FeatureFlaw), system hazards (Dependability::HazardeousEvent, and system faults/failures (ErrorModel::Anomaly) as such concepts only differ in scope or in abstraction level. Semantics: A transition between two states of discrete behavior can be fired to respond to the occurrence of an event (which is indicated by the role readEventOccurrences?) or to signal the occurrence of an event (which is indicated by the role writeEventOccurrance!). A transition event denotes the occurrence, i.e. the actual happening, of certain logical, execution specific, and erroneous conditions, that fires the transitions of discrete behavior. * An occurred logical event (occurredLogicalEvent) denotes a logical condition (e.g. when the measured value of vehicle speed is below 30 km/h) that takes place at a particular time instance and becomes valid in a certain time interval according to the definition of corresponding quantification. Logical events of input or output variables (defined through Attribute) can be communicated through the corresponding ports. * An occurred execution specific event (occurredExecutionEvent) denotes a distinct form of condition change in system execution at distinct points in time, such as at the triggering of a function, or at the receiving/sending of data from/to ports. * The occurrence of a fault, a failure, or a hazard (occurredFeatureFlaw, occurredHazardousEvent, or occurredFaultFailure) denotes a distinct form of deviation from nominal behaviors in certain time condition, of which the estimated existences are expressed by the corresponding anomaly or hazard definition. Constraint: The set of occurred erroneous events ((occurredFeatureFlaw, occurredHazardousEvent, or occurredAnomaly) is a symmetric set difference of feature flaws (Dependability::FeatureFlaw), system hazards (Dependability::HazardeousEvent, and system faults/failures (ErrorModel::Anomaly) as such concepts only differ in scope or in abstraction level. Semantics: A transition between two states of discrete behavior can be fired to respond to the occurrence of an event (which is indicated by the role readEventOccurrences?) or to signal the occurrence of an event (which is indicated by the role writeEventOccurrance!). A Unit describes a unit used for numerical values of a datatype. It may relate to another unit to enable conversions. It may also reference a quantity to give a dimension of the unit. As a unit conversion example: The Unit with name Second has the factor 1000, and the reference Millisecond, i.e.: second = 1000 * millisecond Moreover the Unit may be given a symbol and an offset, for example: The Unit Fahrenheit with factor 1.8 and offset 32 gives with the reference to Celsius the definition of Fahrenheit: F = C*9/5 + 32 Semantics: Unit descibes the unit of typed numerical values. A Unit describes a unit used for numerical values of a datatype. It may relate to another unit to enable conversions. It may also reference a quantity to give a dimension of the unit. As a unit conversion example: The Unit with name Second has the factor 1000, and the reference Millisecond, i.e.: second = 1000 * millisecond Moreover the Unit may be given a symbol and an offset, for example: The Unit Fahrenheit with factor 1.8 and offset 32 gives with the reference to Celsius the definition of Fahrenheit: F = C*9/5 + 32 Semantics: Unit descibes the unit of typed numerical values. A UseCase specifies a usage of a system. Typically, they are used to capture the functionality of a system, that is, what a system is supposed to do. Semantics: A UseCase identifies a usage of its corresponding system. extensionPoint identifies where the use case can be extended with extend UseCases and include identifies UseCases inserted in the including UseCase. A UseCase specifies a usage of a system. Typically, they are used to capture the functionality of a system, that is, what a system is supposed to do. Semantics: A UseCase identifies a usage of its corresponding system. extensionPoint identifies where the use case can be extended with extend UseCases and include identifies UseCases inserted in the including UseCase. UserAttributeDefinition defines a certain user attribute. The name of a UserAttributeDefinition should be used in editing tools as a label for the input field representing the user attribute and its description should be presented to the user to explain the meaning of this user attribute. To identify a user attribute in a universally unique way, its short name is appended to the key of the containing UserElementType after appending a "." character (dot) as a separator. For example, if a UserAttributeDefinition with short name "MyStatus" is contained in a UserElementType with key "com.myCompany.myDepartment.myProject.MyPort", then the user attribute represented by this UserAttributeDefinition has the key "com.myCompany.myDepartment.myProject.MyPort.MyStatus". Semantics: UserAttributeDefinition defines a user defined attribute. Extension: Class UserAttributeDefinition defines a certain user attribute. The name of a UserAttributeDefinition should be used in editing tools as a label for the input field representing the user attribute and its description should be presented to the user to explain the meaning of this user attribute. To identify a user attribute in a universally unique way, its short name is appended to the key of the containing UserElementType after appending a "." character (dot) as a separator. For example, if a UserAttributeDefinition with short name "MyStatus" is contained in a UserElementType with key "com.myCompany.myDepartment.myProject.MyPort", then the user attribute represented by this UserAttributeDefinition has the key "com.myCompany.myDepartment.myProject.MyPort.MyStatus". Semantics: UserAttributeDefinition defines a user defined attribute. Extension: Class UserAttributedElement is used to attach user attribute values to any EAST-ADL or AUTOSAR element, i.e. all instances of all subclasses of Identifiable. What user attributes a certain element should be supplied with can be defined beforehand with UserElementTypes. According to a common EAST-ADL meta-modeling pattern, the meta-classes that are attributable, i.e. to which user attributes may be attached, do not inherit from meta-class UserAttributedElement but instead UserAttributedElement points to these meta-classes via association "attributedElement" (for example, to allow attaching user attributes to AUTOSAR Identifiable that cannot inherit from EAST-ADL infrastructure meta-classes). The actual values are given as a contained instance of EAValue and are provided with a definition through the UserAttributeDefinitions in the UserElementType. If more than one value is contained, then the same number of UserElementTypes/UserAttributeDefinitions must be referenced and the order of values and definitions must be consistent (see constraint no. 2 below). Example: let us assume that a DesignFunctionType "WiperSystem" should be provided with the value "OK" for a user attribute "Status". This is achieved by creating an instance of UserAttributedElement pointing via association "attributedElement" to instance "WiperSystem", pointing via instance "uaType" to the UserElementType with a UserAttributeDefinition "Status" and containing via containment association "uaValue" an EAStringValue "OK". Semantics: UserAttributedElement can be annotated with user attributes. Constraints: [1] The associations "uaValue" and the uaDefinitions of all "uaType"s must refer to the same number of elements. [2] The order of associations "uaValue" and "uaType" / "uaDefinition" must be consistent, i.e. the n-th EAValue must correspond to the n-th UserAttributeDefinition when listing all UserElementTypes' definitions in depth-first order. Extension: Class UserAttributedElement is used to attach user attribute values to any EAST-ADL or AUTOSAR element, i.e. all instances of all subclasses of Identifiable. What user attributes a certain element should be supplied with can be defined beforehand with UserElementTypes. According to a common EAST-ADL meta-modeling pattern, the meta-classes that are attributable, i.e. to which user attributes may be attached, do not inherit from meta-class UserAttributedElement but instead UserAttributedElement points to these meta-classes via association "attributedElement" (for example, to allow attaching user attributes to AUTOSAR Identifiable that cannot inherit from EAST-ADL infrastructure meta-classes). The actual values are given as a contained instance of EAValue and are provided with a definition through the UserAttributeDefinitions in the UserElementType. If more than one value is contained, then the same number of UserElementTypes/UserAttributeDefinitions must be referenced and the order of values and definitions must be consistent (see constraint no. 2 below). Example: let us assume that a DesignFunctionType "WiperSystem" should be provided with the value "OK" for a user attribute "Status". This is achieved by creating an instance of UserAttributedElement pointing via association "attributedElement" to instance "WiperSystem", pointing via instance "uaType" to the UserElementType with a UserAttributeDefinition "Status" and containing via containment association "uaValue" an EAStringValue "OK". Semantics: UserAttributedElement can be annotated with user attributes. Constraints: [1] The associations "uaValue" and the uaDefinitions of all "uaType"s must refer to the same number of elements. [2] The order of associations "uaValue" and "uaType" / "uaDefinition" must be consistent, i.e. the n-th EAValue must correspond to the n-th UserAttributeDefinition when listing all UserElementTypes' definitions in depth-first order. Extension: Class UserElementType defines a certain set of user attributes, i.e. it states that all Identifiables of a certain kind (c.f. the validFor attribute) may be provided with a user attribute value of some datatype. For example, it can be specified that all AnalysisFunctionPrototypes may be amended with an attribute "Status". The name of a UserElementType should be used in editing tools as a label for the input field representing the user attribute and its description should be presented to the user to explain the meaning of this user attribute. Semantics: UserElementType represents a user defined type of the specified EAST-ADL or AUTOSAR metaclass. Constraints: [1] The short names of all UserAttributeDefinitions (i.e. value of attribute "shortName" in UserAttributeDefinition, which is inherited from meta-class Referrable) referred to by association "uaDefinition" must be unique within this UserElementType. In other words, no two UserAttributeDefinitions referred to by association "uaDefinition" must have the same short name. Extension: Class The globally unique identifier of the user element type. Any string may be used as key as long as it is globally unique. However, there is a recommended procedure for building globally unique keys for user attributes, similar to package naming conventions in the Java programming language: (1) use an internet domain name which is sufficiently specific so that you have control over who will use it for user attribute key generation (e.g. "myDepartment.myCompany.com") (2) reverse it as in Java package names (e.g. "com.myCompany.myDepartment") (3) optionally append additional, dot-separated names for the specific context in which the user attribute is to be used (e.g. "myProject" which results in "com.myCompany.myDepartment.myProject") (4) add a last segment that names the user element type and is sufficiently descriptive to explain its purpose (e.g. "MyPort"). In this example, the key of our status attribute would be "com.myCompany.myDepartment.myProject.MyPort". In general, the last segment of the key, i.e. everything following the last dot, should be sufficient to identify the attribute in its usual, most specific context of use. Therefore, implementations may use this last segment as an abbreviated name of the user attribute, e.g. for presenting it in a GUI. But note that the name of the UserElementType should usually be used (if defined). Comma-separated list of metaclass names this user element type is applicable to. If undefined, then this type is applicable to all subclasses of metaclass Identifiable. White-space may appear before and after metaclass names and commas. Example: If UserElementType 'MyFunction' has its validFor attribute set to "FunctionalDevice, LocalDeviceManager", then the contained UserAttributeDefinitions are only applicable to functional devices and local device managers, i.e. only instances of FunctionalDevice and LocalDeviceManager may be adorned with the 'MyFunction' user element type. UserElementType defines a certain set of user attributes, i.e. it states that all Identifiables of a certain kind (c.f. the validFor attribute) may be provided with a user attribute value of some datatype. For example, it can be specified that all AnalysisFunctionPrototypes may be amended with an attribute "Status". The name of a UserElementType should be used in editing tools as a label for the input field representing the user attribute and its description should be presented to the user to explain the meaning of this user attribute. Semantics: UserElementType represents a user defined type of the specified EAST-ADL or AUTOSAR metaclass. Constraints: [1] The short names of all UserAttributeDefinitions (i.e. value of attribute "shortName" in UserAttributeDefinition, which is inherited from meta-class Referrable) referred to by association "uaDefinition" must be unique within this UserElementType. In other words, no two UserAttributeDefinitions referred to by association "uaDefinition" must have the same short name. Extension: Class VVActualOutcome represents the actual output of the testing environment as represented by VVTarget when triggered by the VVStimuli of the concrete VVProcedure. This is defined by the association 'performedVVProcedure' of the containing VVLog. It should be equivalent to the VVIntendedOutcome defined by the association 'intendedOutcome'. Semantics: VVActualOutcome represents the actual output of a verification effort as defined by the V&V elements. Extension: Class VVActualOutcome represents the actual output of the testing environment as represented by VVTarget when triggered by the VVStimuli of the concrete VVProcedure. This is defined by the association 'performedVVProcedure' of the containing VVLog. It should be equivalent to the VVIntendedOutcome defined by the association 'intendedOutcome'. Semantics: VVActualOutcome represents the actual output of a verification effort as defined by the V&V elements. Extension: Class VVCase represents a V&V effort, i.e. it specifies concrete test subjects and targets and provides stimuli and the expected outcome on a concrete technical level. Semantics: VVCase is a grouping element for a set of VVProcedures that together makes up a concrete Verification/Validation effort. Constraints: [1] Only a concrete VVCase can have vvLog. [2] Only a concrete VVCase can have vvTarget. [3] Only a concrete VVCase can have an abstractVVCase. VVCase represents a V&V effort, i.e. it specifies concrete test subjects and targets and provides stimuli and the expected outcome on a concrete technical level. Semantics: VVCase is a grouping element for a set of VVProcedures that together makes up a concrete Verification/Validation effort. Constraints: [1] Only a concrete VVCase can have vvLog. [2] Only a concrete VVCase can have vvTarget. [3] Only a concrete VVCase can have an abstractVVCase. instanceRef instanceRef.context instanceRef.target instanceRef VVIntendedOutcome represents the expected output of the testing environment represented by VVTarget when triggered by the corresponding VVStimuli of the containing concrete VVProcedure. Since this entity only occurs on the concrete level (i.e. within the context of a concrete VVCase), the output must be provided in a form that can be directly compared to the output of the VVTarget(s) defined for the containing concrete VVCase. Semantics: VVIntendedOutcome represents the expected output of a Verification/Validation effort. Extension: Class VVIntendedOutcome represents the expected output of the testing environment represented by VVTarget when triggered by the corresponding VVStimuli of the containing concrete VVProcedure. Since this entity only occurs on the concrete level (i.e. within the context of a concrete VVCase), the output must be provided in a form that can be directly compared to the output of the VVTarget(s) defined for the containing concrete VVCase. Semantics: VVIntendedOutcome represents the expected output of a Verification/Validation effort. Extension: Class Concrete VVCase represents the precise description of a V&V effort on a concrete technical level and thus provides all necessary information to actually perform this V&V effort. However, it does not represent the actual execution of the effort. This is the purpose of the VVLog. Each VVLog metaclass represents an execution of a concrete VVCase. For example, if the HIL test of the wiper system with a certain set of stimuli was performed on Friday afternoon and, for checkup, again on Monday, then there will be one ConcreteVVCase describing the HIL test and two VVLogs describing the test results from Friday and Monday respectively. Semantics: VVLog captures an execution of a ConcreteVVCase. Extension: Class Date and time when this log was captured. Concrete VVCase represents the precise description of a V&V effort on a concrete technical level and thus provides all necessary information to actually perform this V&V effort. However, it does not represent the actual execution of the effort. This is the purpose of the VVLog. Each VVLog metaclass represents an execution of a concrete VVCase. For example, if the HIL test of the wiper system with a certain set of stimuli was performed on Friday afternoon and, for checkup, again on Monday, then there will be one ConcreteVVCase describing the HIL test and two VVLogs describing the test results from Friday and Monday respectively. Semantics: VVLog captures an execution of a ConcreteVVCase. Extension: Class VVProcedure represents an individual task in a V&V effort (represented by a VVCase), which has to be performed in order to achieve that effort's overall objective. As with VVCases, the definition of VVProcedures is separated in to two levels: an abstract and a concrete level. The concrete VVProcedure represents such a task on a concrete level It is defined with a concrete testing environment in mind and provides stimuli and the expected outcome of the procedure in a form which is directly applicable to this testing environment. Semantics: VVProcedure represents an individual task in a Verifcation/Validation effort. Constraints: [1] Only a concrete VVProcedure can have vvStimuli. [2] Only a concrete VVProcedure can have vvIntendedOutcome. [3] Only a concrete VVProcedure can have an abstractVVProcedure . Extension: Class VVProcedure represents an individual task in a V&V effort (represented by a VVCase), which has to be performed in order to achieve that effort's overall objective. As with VVCases, the definition of VVProcedures is separated in to two levels: an abstract and a concrete level. The concrete VVProcedure represents such a task on a concrete level It is defined with a concrete testing environment in mind and provides stimuli and the expected outcome of the procedure in a form which is directly applicable to this testing environment. Semantics: VVProcedure represents an individual task in a Verifcation/Validation effort. Constraints: [1] Only a concrete VVProcedure can have vvStimuli. [2] Only a concrete VVProcedure can have vvIntendedOutcome. [3] Only a concrete VVProcedure can have an abstractVVProcedure . Extension: Class VVStimuli represents the input values of the testing environment represented by VVTarget in order to perform the corresponding VVProcedure. Since this entity only occurs on the concrete level (i.e. within the context of a concrete VVCase), the input values must be provided in a form that is directly applicable to the VVTarget(s) defined for the containing concrete VVCase. Semantics: VVStimuli represents the concrete input values used for a VVProcedure during a Verification/Validation effort of a VVTarget. Extension: Class VVStimuli represents the input values of the testing environment represented by VVTarget in order to perform the corresponding VVProcedure. Since this entity only occurs on the concrete level (i.e. within the context of a concrete VVCase), the input values must be provided in a form that is directly applicable to the VVTarget(s) defined for the containing concrete VVCase. Semantics: VVStimuli represents the concrete input values used for a VVProcedure during a Verification/Validation effort of a VVTarget. Extension: Class VVTarget represents a concrete testing environment in which a particular V&V activity can be performed. This can be physical hardware or it can be pure software in case of a test by way of design level simulations. Usually, a VVTarget will identify one or more elements. However, there are cases in which this is not true, for example when a VVTarget represents parts of the system's environment. Therefore the association to element has a minimum cardinality of 0. VVTargets can be reused across several concrete VVCases. Semantics: VVTarget represents a concrete testing environment in which a particular Verifcation/Validation activity is performed. VVTarget represents a concrete testing environment in which a particular V&V activity can be performed. This can be physical hardware or it can be pure software in case of a test by way of design level simulations. Usually, a VVTarget will identify one or more elements. However, there are cases in which this is not true, for example when a VVTarget represents parts of the system's environment. Therefore the association to element has a minimum cardinality of 0. VVTargets can be reused across several concrete VVCases. Semantics: VVTarget represents a concrete testing environment in which a particular Verifcation/Validation activity is performed. instanceRef instanceRef.context instanceRef.target instanceRef The collection of variability descriptions, related feature models, and decision models. This collection can be done across the EAST-ADL abstraction levels. Semantics: See description. The collection of variability descriptions, related feature models, and decision models. This collection can be done across the EAST-ADL abstraction levels. Semantics: See description. VariableElement is a marker class that marks an artifact element denoted by association optionalElement as being optional, i.e. it will not be present in all configurations of the complete system. A typical example is an optional FunctionPrototype. In addition, the VariableElement can be used to extend the EAST-ADL variability approach to other languages and standards by pointing from the VariableElement to the respective (non EAST-ADL) element with association optionalElement, thus marking the non EAST-ADL element as optional and providing configuration support within its containing ConfigurableContainer. Refer to the documentation of meta-class ConfigurableContainer for a detailed explanation of how ConfigurableContainer and VariableElement work together. Constraints: [1] Identifies either one FunctionPrototype or one FunctionPort or one FunctionConnector or one HardwareComponentPrototype or one HardwarePin or one ClampConnector. Semantics: Marks the element identified by association optionalElement as optional. Extension: Class VariableElement is a marker class that marks an artifact element denoted by association optionalElement as being optional, i.e. it will not be present in all configurations of the complete system. A typical example is an optional FunctionPrototype. In addition, the VariableElement can be used to extend the EAST-ADL variability approach to other languages and standards by pointing from the VariableElement to the respective (non EAST-ADL) element with association optionalElement, thus marking the non EAST-ADL element as optional and providing configuration support within its containing ConfigurableContainer. Refer to the documentation of meta-class ConfigurableContainer for a detailed explanation of how ConfigurableContainer and VariableElement work together. Constraints: [1] Identifies either one FunctionPrototype or one FunctionPort or one FunctionConnector or one HardwareComponentPrototype or one HardwarePin or one ClampConnector. Semantics: Marks the element identified by association optionalElement as optional. Extension: Class A VariationGroup defines a relation between an arbitrary number of VariableElements. It is primarily intended for defining how these VariableElements may be combined (e.g. one requires the other, alternative, etc.). Semantics: Defines a dependency or constraint between the variable elements denoted by association variableElement. The actual constraint is specified by attribute kind. Extension: Class Only defined iff kind=="custom". A constraint specifying how the VariableElements in the variation group can be combined. This attribute adheres to the syntax and semantics of the VSL language. The kind of the variation group (see enumeration VariationGroupKind). A VariationGroup defines a relation between an arbitrary number of VariableElements. It is primarily intended for defining how these VariableElements may be combined (e.g. one requires the other, alternative, etc.). Semantics: Defines a dependency or constraint between the variable elements denoted by association variableElement. The actual constraint is specified by attribute kind. Extension: Class VehicleFeature represents a special kind of feature intended for use on Vehicle Level. The main difference to features in general is that they provide support for the multi-level concept (via their DeviationAttributeSet) and several additional attributes with meta-information specific to the vehicle level viewpoint. Constraints: [1] VehicleFeatures can only be contained in FeatureModels on VehicleLevel. Semantics: A VehicleFeature is a functional or non-functional characteristic, constraint or property that can be present or not in a vehicle product line on the level of the complete system, i.e. vehicle. Extension: Class atpStructureElement This attribute states whether the VehicleFeature is customer visible (in contrast to a VehicleFeature that is e.g. technically driven). VehicleFeatures describe the system's characteristics on the level of the complete system and on a high abstraction level but they can still have a strong technical viewpoint. Therefore, they are usually not suitable for being directly presented to the end-customer. There are two approaches to deal with this situation. (1) The simple approach uses this attribute to denote those VehicleFeatures that are suitable for immediate end-customer configuration: if this attribute is set to true, then the feature will be directly presented to the end-customer for selection or deselection; if set to false, then the feature will be hidden from the end-customer and is thus reserved for internal configuration. (2) The more sophisticated approach is to define a dedicated product feature model to capture the customer viewpoint (available in the variability extension) in addition to the technical feature model on Vehicle Level and to provide a configuration decision model that maps configurations of this end-customer-oriented product feature model to the core technical feature model on Vehicle Level. This approach is much more flexible because the customer-view on the product line's variability can be structured freely and independently from the core technical feature model; furthermore, this approach can cope much better with evolution because the end-customer-oriented feature model can be evolved independently of the core technical feature model (and vice versa). When applying this second approach, this attribute isCustomerVisible will no longer be used, i.e., its value will be ignored. The simple approach #1 is suitable for simple product line scenarios. Approach #2 should be used for complex scenarios with large core technical feature models and/or longer evolution periods of the overall product line infrastructure. A VehicleFeature marked as a design variability rationale captures a variant showing up on a concrete artifact level that needs to be modeled on the Vehicle Level as well, in order to be directly available for immediate configuration on Vehicle Level. It is, from the abstraction layer's point of view, not a true Vehicle Level feature. If true, then isCustomerVisible is usually false but there may be rare exceptions. This attribute describes if the VehicleFeature is removed (but kept in the database for tracking of evolution, which is required by the multi-level concept). VehicleFeature represents a special kind of feature intended for use on Vehicle Level. The main difference to features in general is that they provide support for the multi-level concept (via their DeviationAttributeSet) and several additional attributes with meta-information specific to the vehicle level viewpoint. Constraints: [1] VehicleFeatures can only be contained in FeatureModels on VehicleLevel. Semantics: A VehicleFeature is a functional or non-functional characteristic, constraint or property that can be present or not in a vehicle product line on the level of the complete system, i.e. vehicle. Extension: Class atpStructureElement The VehicleLevel represents the vehicle content from an external perspective through an arbitrary set of feature models. These contain VehicleFeatures that are organized to reflect the vehicle configuration and that have associated requirements, use cases, etc. for its definition. Constraints: [1] All contained feature models are FeatureModels that only contain VehicleFeatures. Semantics: The VehicleLevel represents the vehicle content through solution-independent features. Notation: The VehicleLevel is shown as a solid-outline rectangle containing the name. Contained entities may be shown (White-box view). Extension: class. atpStructureElement The VehicleLevel represents the vehicle content from an external perspective through an arbitrary set of feature models. These contain VehicleFeatures that are organized to reflect the vehicle configuration and that have associated requirements, use cases, etc. for its definition. Constraints: [1] All contained feature models are FeatureModels that only contain VehicleFeatures. Semantics: The VehicleLevel represents the vehicle content through solution-independent features. Notation: The VehicleLevel is shown as a solid-outline rectangle containing the name. Contained entities may be shown (White-box view). Extension: class. atpStructureElement This class represents a binding on the vehicle level or coming from the vehicle level with explicitly defined source and target feature models. The source feature models must be on vehicle level, but the target feature models may be located on artifact level, e.g. the public feature model of the top-level FunctionType in the FDA. This way, a VehicleLevelBinding may be used to bridge the gap from vehicle level variability management to that on the artifact level. Source feature models may be either the core technical feature model (as defined by association technicalFeatureModel of meta-class VehicleLevel) or one of the optional product feature models (as defined by association productFeatureModel of meta-class Variability in the variability extension). Constraints: [1] The sourceVehicleFeatureModels shall only contain VehicleFeatures. [2] The sourceVehicleFeatureModels shall be different from the targetFeatureModels. Semantics: See description. This class represents a binding on the vehicle level or coming from the vehicle level with explicitly defined source and target feature models. The source feature models must be on vehicle level, but the target feature models may be located on artifact level, e.g. the public feature model of the top-level FunctionType in the FDA. This way, a VehicleLevelBinding may be used to bridge the gap from vehicle level variability management to that on the artifact level. Source feature models may be either the core technical feature model (as defined by association technicalFeatureModel of meta-class VehicleLevel) or one of the optional product feature models (as defined by association productFeatureModel of meta-class Variability in the variability extension). Constraints: [1] The sourceVehicleFeatureModels shall only contain VehicleFeatures. [2] The sourceVehicleFeatureModels shall be different from the targetFeatureModels. Semantics: See description. A collection of components organized to accomplish a specific function or set of functions. [IEEE 1471] A collection of components organized to accomplish a specific function or set of functions. [IEEE 1471] The collection of verification and validation elements. This collection can be used across the EAST-ADL abstraction levels. Semantics: VerificationValidation is a container element for a set of related vvTarget and vvCase elements and verify relationships. The collection of verification and validation elements. This collection can be used across the EAST-ADL abstraction levels. Semantics: VerificationValidation is a container element for a set of related vvTarget and vvCase elements and verify relationships. Verify is a relationship metaclass, which signifies a dependency relationship between a Requirement and a VVCase. It shows the relationship when a client VVCase and an optional abstract VVProcedure verifies the supplier Requirement. Semantics: The Verify metaclass signifies a refined requirement/verified by relationship between a Requirement and a VVCase, where the modification of the supplier Requirement may impact the verifying client VVCase and optional abstract VVProcedure. The Verify metaclass implies that the semantics of the verifying client VVCase is not complete, without the supplier Requirement. Notation: A Verify relationship is shown as a dashed arrow between the Requirements and VVCase. Extension: To specializes SysML::Verify, which specializes the UML stereotype Trace, which extends Dependency. Temporary change in the profile (to overcome bug in Eclipse/UML2 concerning standard stereotypes) - added extension towards Dependency - removed generalization link towards SysML::Verify Verify is a relationship metaclass, which signifies a dependency relationship between a Requirement and a VVCase. It shows the relationship when a client VVCase and an optional abstract VVProcedure verifies the supplier Requirement. Semantics: The Verify metaclass signifies a refined requirement/verified by relationship between a Requirement and a VVCase, where the modification of the supplier Requirement may impact the verifying client VVCase and optional abstract VVProcedure. The Verify metaclass implies that the semantics of the verifying client VVCase is not complete, without the supplier Requirement. Notation: A Verify relationship is shown as a dashed arrow between the Requirements and VVCase. Extension: To specializes SysML::Verify, which specializes the UML stereotype Trace, which extends Dependency. Temporary change in the profile (to overcome bug in Eclipse/UML2 concerning standard stereotypes) - added extension towards Dependency - removed generalization link towards SysML::Verify Warrant represents argumentation of the facts to the Claim in general ways. The Warrant entity has associations with the decomposed goals and with the evidences for the SafetyCase. Semantics: The overall objective of an argument is to lead the evidence to the claim. Arguments are actions of inferring a conclusion from premised propositions. An argument is considered valid if the conclusion can be logically derived from its premises. An argument is considered sound if it is valid and all premises are true. A goal decomposition strategy breaks down a goal into a number of sub-goals. It is recommended that the strategies are of specific form. Warrant represents argumentation of the facts to the Claim in general ways. The Warrant entity has associations with the decomposed goals and with the evidences for the SafetyCase. Semantics: The overall objective of an argument is to lead the evidence to the claim. Arguments are actions of inferring a conclusion from premised propositions. An argument is considered valid if the conclusion can be logically derived from its premises. An argument is considered sound if it is valid and all premises are true. A goal decomposition strategy breaks down a goal into a number of sub-goals. It is recommended that the strategies are of specific form. The ASILKind is an enumeration metaclass with enumeration literals indicating the level of safety integrity in accordance with ISO26262. Semantics: The semantics is defined at each enumeration literal and fully defined in the ISO26262 standard. Extension: Enumeration, no extension. enumeration This is used to specify an address within the cpu. primitive BindingTimeKind represents the set of possible binding times. Semantics: See description. enumeration A Boolean value denotes a logical condition that is either 'true' or 'false'. It can be one of "0", "1", "true", "false" primitive When more than one byte is stored in the memory the order of those bytes may differ depending on the architecture of the processing unit. If the least significant byte is stored at the lowest address, this architecture is called little endian and otherwise it is called big endian. ByteOrder is very important in case of communication between different PUs or ECUs. enumeration This datatype represents a string, that follows the rules of C-identifiers. primitive This element is an enumeration for the kind of the FunctionClientServerPort, which can either be a "client" or a "server". Semantics: The ClientServerKind is an enumeration with literals that are used to distinguish between client and server. Extension: Enumeration, no extension. enumeration enumeration The ControllabilityClassKind is an enumeration metaclass with enumeration literals indicating controllability attributes C0, C1, C2 or C3 in accordance with ISO26262. Semantics: The semantics are defined at each enumeration literal and fully defined in the ISO26262 standard. Extension: Enumeration, no extension. enumeration A datatype representing a timestamp. The smallest granularity is 1 second. This datatype represents a timestamp in the format yyyy-mm-dd followed by an optional time. The lead-in character for the time is "T" and the format is hh:mm:ss. In additin, a time zone designator must be specified. The time zone designator can either be "Z" (for UTC) or the time offset to UTC, i.e. (+|-)hh:mm. Examples: 2009-07-23 2009-07-23T14:38:00+01:00 2009-07-23T13:38:00Z primitive DevelopmentCategoryKind is an enumeration with enumeration literals indicating whether the item is a modification of an existing item or if it is a new development. Semantics: The semantics are defined at each enumeration literal and fully defined in the ISO26262 standard. Extension: Enumeration, no extension. enumeration The DeviationPermissionKind is an enumeration with enumeration literals defining possible values for deviation attributes. Semantics: See description. Extension: Enumeration, no extension. enumeration This is a display format specifier for the display of values e.g. in documents or in measurement and calibration systems. The display format specifier is a subset of the ANSI C printf specifiers with the following form: % [flags] [width] [.prec] type character For more details refer to "ASAM-HarmonizedDataObjects-V1.1.pdf" chapter 13.3.2 DISPLAY OF DATA. Due to the numerical nature of value settings, only the following type characters are allowed: * d: Signed decimal integer * i: Signed decimal integer * o: Unsigned octal integer * u: Unsigned decimal integer * x: Unsigned hexadecimal integer, using "abcdef" * X: Unsigned hexadecimal integer, using "ABCDEF" * e: Signed value having the form [-]d.dddd e [sign]ddd where d is a single decimal digit, dddd is one or more decimal digits, ddd is exactly three decimal digits, and sign is + or - * E: Identical to the e format except that E rather than e introduces the exponent * f: Signed value having the form [-]dddd.dddd, where dddd is one or more decimal digits; the number of digits before the decimal point depends on the magnitude of the number, and the number of digits after the decimal point depends on the requested precision * g: Signed value printed in f or e format, whichever is more compact for the given value and precision; trailing zeros are truncated, and the decimal point appears only if one or more digits follow it * G: Identical to the g format, except that E, rather than e, introduces the exponent (where appropriate) primitive This element is an enumeration for the direction of a Port, which can either be "in", "out", or "inout". Semantics: The EADirectionKind is an enumeration with literals describing the direction of ports. Extension: Enumeration, no extension. enumeration The ErrorBehaviorKind metaclass represents an enumeration of literals describing various types of formalisms used for specifying error behavior. Semantics: ErrorBehaviorKind represents different formalisms for ErrorBehavior. The semantics are defined at each enumeration literal. Extension: Enumeration, no extension. enumeration Possible values of eventKind. Semantics: See each literal. Extension: Enumeration, no extension. enumeration The ExposureClassKind is an enumeration metaclass with enumeration literals indicating the probability attributes E1, E2, E3 or E4 in accordance with ISO26262. Semantics: The semantics are defined at each enumeration literal and fully defined in the ISO26262 standard. Extension: Enumeration, no extension. enumeration FunctionBehaviorKind is an enumeration, which lists the various standards or tools used to describe a FunctionBehavior. It is used as a property of a FunctionBehavior. Several standards or tools are listed; however, one can always extend this list by using the literal OTHER. Semantics: Distinction between UML and MARTE comes from the slight differences in the behavioral definitions (namely concerning data-flow oriented behaviors). It should be noted that though one can use several languages to provide a representation of a FunctionBehavior, the semantics shall remain compliant with the overall EAST-ADL execution semantics, see FunctionBehavior. Extension: Enumeration, no extension. enumeration Enumeration for different type of constraints. Semantics: The semantics is defined on each literal. enumeration HardwareBusKind is an enumeration type representing different kinds of busses. Semantics: HardwareBusKind represents the kind of a hardware connector as given by the definition of the respective Enumeration Literal. Extension: Enumeration, no extension. enumeration IOHardwarePinKind is an enumeration type representing different kinds of I/O Hardware Ports. Semantics: IOHardwarePinKind represents the kind of IOHardwarePin as given by the definition of the respective Enumeration Literal. Extension: Enumeration, no extension. enumeration An Identifier is a string with a number of constraints on its appearance, satisfying the requirements typical programming languages define for their Identifiers. This datatype represents a string, that can be used as a c-Identifier. It needs to start with a letter, mayconsist of letters, digits and underscore. It must not have two consecutive underscores (to support subsequent name mangling based on "__"). primitive An instance of Integer is an element in the set of integer numbers ( ..., -2, -1, 0, 1, 2, ...). The value can be expressed in decimal, octal, hexadecimal and binary representation. Negative numbers can only be expressed in decimal notation Range is from -2147483648 and 2147483647. primitive The SafetyCase should be initiated at the earliest possible stage in the safety program so that hazards are identified and dealt with while the opportunities for their exclusion exist. The LifecycleStageKind is an enumeration metaclass with enumeration literals indicating safety case life cycle stage. Semantics: The safety case is one incremental safety case, rather than several complete new ones. The safety case lifecycle stage has the following meanings: - The preliminary safety case is started when development of the system is started. After this stage discussions with the customer can commence about possible safety issues (hazards). - The interim safety case is situated after the first system design and tests. - The operational safety case is prior to in-service use. Extension: Enumeration, no extension. enumeration This enumerator denotes the values for specification of monotony for e.g. curves. enumeration This string contains a native data declaration of a data type in a programming language. It is basically a string, but whitespace must be preserved. primitive This primitive specifies a numerical value. It can be denoted in different formats such as Decimal, Octal, Hexadecimal, Float. See the xsd pattern for details. primitive This is a positive integer which can be denoted in Decimal, octal and hexadecimal. the value is between 0 and 4294967295. primitive QualityRequirementKind represents an enumeration with enumeration literals describing various types of quality requirements. Semantics: QualityRequirementKind represents the kind of QualityRequirement given by the definition of the respective Enumeration Literal. Extension: Enumeration, no extension. enumeration This primitive denotes a name based reference. For detailed syntax see the xsd.pattern. - first slash (relative or absolute reference) [optional] - Identifier [required] - a sequence of slashes and Identifiers [optional] This primitve is used by the metamodel tools to create the references. primitive This primitive represents a revision label which identifies an engineering object. It represents a pattern which * requires three integers representing from left to right MajorVersion, MinorVersion, PatchVersion. * may add an application specific suffix separated by one of ".", "_", ";". Legal patterns are for example: 4.0.0 4.0.0.1234565 4.0.0_vendor specific;13 4.0.0;12 primitive The SeverityClassKind is an enumeration metaclass with enumeration literals indicating the severity attributes S0, S1, S2 or S3 in accordance with ISO26262. Semantics: The semantics are defined at each enumeration literal and fully defined in the ISO26262 standard. Extension: Enumeration, no extension. enumeration TriggerPolicyKind represents an enumeration for triggering policies. Semantics: The TriggerPolicyKind contains EVENT and TIME as possible triggering policies. Extension: Enumeration, no extension. enumeration An instance of UnlimitedInteger is an element in the set of integer numbers ( ..., -2, -1, 0, 1, 2, ...). The range is limited by constraint 2534. The value can be expressed in decimal, octal, hexadecimal and binary representation. Negative numbers can only be expressed in decimal notation. primitive This enumeration encapsulates the available types of constraints that can be applied to a FeatureLink or VariationGroup (the latter is applicable only if the variability extension is used). Semantics: Predefined kinds of constraints that can be associated to a FeatureLink or VariationGroup. Extension: Enumeration, no extension. enumeration This primitive represents a string in which whitespace needs to be preserved. primitive