This package contains elements to express variability in the analysis architecture, design architecture and implementation architecture. These abstraction levels in EAST-ADL2 will sometimes be called the artifact levels.
A VariationGroup defines a relation between an arbitrary number of VariableElements. It is primarily intended for defining how these VariableElements may be combined (e.g. one requires the other, alternative, etc.).
Semantics:
Defines a dependency or constraint between the variable elements denoted by association variableElement. The actual constraint is specified by attribute kind.
Extension:
Class
Only defined iff kind=="custom". An OCL constraint specifying how the VariableElements in the variation group can be combined.
The kind of the variation group (see enumeration VariationGroupKind).
ReuseMetaInformation represents the description information needed in the context of reuse. For example a specific entity is only a short-time solution that is not intended to be reused. Also a specific entity can only be reused for specific model ranges (that are not reflected in the product model). This kind of information can be stored in this information.
Semantics:
The ReuseMetaInformation represents information that explains if and how the respective entity can be reused.
Extension: Class
The reuse information is stored in this attribute.
This Boolean attributes just says if the entity itself can essentially be reused or not. Specific information or constraints on reuse are in the information attribute. Default value is TRUE.
ConfigurableContainer is a marker class that marks an element identified by association configurableElement as a configurable container of some variable content, i.e. VariableElements and other, lower-level ConfigurableContainers. In order to describe the contained variability to the outside world and to allow configuration of it, the ConfigurableContainer can have a public feature model and an internal configuration decision model not visible from the outside, called "internal binding".
In addition, the ConfigurableContainer can be used to extend the EAST-ADL2 variability approach to other languages and standards by pointing from the ConfigurableContainer to the respective (non EAST-ADL2) element with association configurableElement. This provides the public feature model and the ConfigurationDecisionModel to that non EAST-ADL2 element.
The variable content of a ConfigurableContainer is defined as all VariableElements and all other ConfigurableContainers that are directly or indirectly contained in the Identifiable denoted by association configurableElement. Instead of 'variable content' the term 'internal variability' may be used.
Note that, according to this rule, the containment between a ConfigurableContainer and its variable content, i.e. its contained VariableElements and lower-level ConfigurableContainers, is not(!) directly defined between these meta-classes. Instead, the containment is defined by the Identifiable pointed to by association configurableElement. For example, consider a FunctionType "WiperSystem" containing two FunctionPrototypes "front" and "rear" both typed by FunctionType "WiperMotor"; to make the wiper system configurable and the rear wiper motor optional, a ConfigurableContainer is created that points to FunctionType "WiperSystem" (with association configurableElement) and a VariableElement is created that points to FunctionPrototype "rear" (with association optionalElement); the containment between the ConfigurableContainer and the VariableElement is therefore not explicitly defined between these classes but instead only between FunctionType "WiperSystem" and "FunctionPrototype" rear. In addition, the variability-related visibility of "rear" can be changed with PrivateContent: by default the variability of "rear" will be public and visible for direct configuration from the outside of its containing ConfigurableContainer, i.e. "WiperSystem"; by defining a PrivateContent marker object pointing to the FunctionPrototype "rear" this can be changed to private and this variability will not be visible from the outside of "WiperSystem".
Constraints:
[1] Identifies one FunctionType or one HardwareComponentType.
[2] The publicFeatureModel is only allowed to contain Features (no VehicleFeatures).
Semantics:
Marks the element identified by association configurableElement as a configurable container of variable content (i.e. it contains VariableElements and/or other, lower-level ConfigurableContainers) and optionally provides a public feature model and an internal configuration decision model for it, thus providing configurability support for them.
Extension:
Class
The PDM of the configurable container.
The variation groups that define certain constraints between this ADLVariableContainer's variable elements.
The local feature model of the configurable container.
VariableElement is a marker class that marks an artifact element denoted by association optionalElement as being optional, i.e. it will not be present in all configurations of the complete system. A typical example is an optional FunctionPrototype.
In addition, the VariableElement can be used to extend the EAST-ADL2 variability approach to other languages and standards by pointing from the VariableElement to the respective (non EAST-ADL2) element with association optionalElement, by that marking the non EAST-ADL2 element as optional and providing configuration support within its containing ConfigurableContainer.
Refer to the documentation of meta-class ConfigurableContainer for a detailed explanation of how ConfigurableContainer and VariableElement play together.
Constraints:
[1] Identifies either one FunctionPrototype or one FunctionPort or one FunctionConnector or one HardwareComponentPrototype or one HardwarePort or one ClampConnector.
Semantics:
Marks the element identified by association optionalElement as optional.
Extension:
Class
The collection of variability descriptions, related feature models, and decision models. This collection can be done across the EAST-ADL2 abstraction levels.
ConfigurationDecision represents a single, atomized rule on how to configure the target feature model(s) of the containing ConfigurationDecisionModel, depending on a given configuration of the source feature model(s). Two examples are: "all North American (USA+Canada) cars except A-Class have cruise control" (one ConfigurationDecision) or "all Canadian cars have adaptive cruise control" (another ConfigurationDecision). All ConfigurationDecisions within a single ConfigurationDecisionModel then specify how the target feature model(s) are to be configured depending on the configuration of the source feature model(s).
Example: Lets assume we have two FeatureModels: FM1 and FM2. FM1 has possible end-customer decisions like USA, Canada, EU, Japan and A-Class, C-Class, etc. FM2 has another possible end-customer decision such as CruiseControl, AdaptiveCruiseControl, RearWiper, RainSensor. End-customer decisions in FM2 describe possible technical features of the delivered products. By way of a set of ConfigurationDecisions it is now possible to define the configuration of FM2 (i.e. if there is a RainSensor, etc.) in dependency of a configuration of FM1. In other words, with a ConfigurationDecision we can express something like: "If USA is selected in FM1 AND A-Class is not selected in FM1, then CruiseControl will be selected in FM2".
The two most important constituents of a ConfigurationDecision are its 'criterion' and 'effect'. The effect is a list of things to select and deselect in the target(!) configuration(s), whereas the criterion formulates a condition on the source(!) configuration(s) under which this ConfigurationDecision's effect will actually be applied to the target configuration(s). In the first example above, the criterion would be "USA & not A-Class" and the effect would be "CruiseControl[+]".
Semantics:
The ConfigurationDecision excludes or includes Features based on a given criterion.
The elements of the criterion and effect attributes may be identified through the target and the source in the selectionCriterion. The criterion and effect attributes can contain a VSL expression with qualified names of the identified elements.
Extension:
Class
The rationale gives the reason for the specified product decision, especially for the inclusion criterion and the selection of included and excluded features.
The inclusionCriterion gives the criterion to select the respective products (e.g. Northern American cars).
Means that the included and excluded features are selected if and only if the specified inclusion criterion holds.
A ConfigurationDecisionModel defines how to configure m so-called target feature models, depending on a given configuration of n so-called source feature models, thus establishing a configuration-related link from the n source feature models to the m target feature models (also called configuration link). With the information captured in a ConfigurationDecisionModel it is then possible to transform a given set of source configurations (one for every source feature model) into corresponding target configurations (one for every target feature model).
For example, a ConfigurationDecisionModel can capture information such as "if feature 'S-Class' is selected in the source feature model, then select feature 'RainSensor' in the target feature model" or "if feature 'USA' is selected in the source feature model, then select feature 'CupHolder' in the target feature model".
Note that in principle all ConfigurationDecisionModels have source / target feature models. However, only for those used on vehicle level they are defined explicitly; for ConfigurationDecisionModels used as an internal binding on FunctionTypes the source and target feature models are defined implicitly (cf. metaclass InternalBinding). In addition, in the special case of FeatureConfiguration there is by definition no source and only a single target feature model, which is defined explicitly (cf. metaclass FeatureConfiguration).
The configuration information captured in a ConfigurationDecisionModel is represented by ConfigurationDecisions, each of which captures a single, atomized rule on how to configure the target feature model(s) depending on a given configuration of the source feature model(s).
Extension:
Class
ConfigurationDecisionModelEntry is the abstract base class for all content of a ConfigurationDecisionModel.
Extension:
Class
If active==TRUE then the entry is selected for the ProductDecisionModel.
ConfigurationDecisionFolder represents a grouping for ConfigurationDecisions.
Semantics:
ConfigurationDecisionFolder is a grouping entity for ConfigurationDecisions.
Extension:
Class
The InternalBinding is the private, internal ConfigurationDecisionModel of the ConfigurableContainer. It defines how the internal, lower-level variability of the ConfigurableContainer is bound, i.e. configured, depending on a given configuration of the ConfigurableContainer's public feature model. This way, the binding of this internal variability is encapsulated and hidden behind the public feature model, which serves as a variability-related interface.
Note that for this use case, the source and target feature models need not be defined explicitly because they are deduced implicitly: the ConfigurableContainer's public feature model serves as the (single) target feature model, and the source feature models are deduced from the ConfigurableContainer's internal variability (esp. other, lower-level ConfigurableContainers which are contained).
For a definition of the precise meaning of 'internal variability' in the above sense (also called variable content) refer to the documentation of meta-class ConfigurableContainer.
A mixed string description, identifying the source elements.
ContainerConfiguration defines an actual configuration of the variable content of a ConfigurableContainer, in particular the selection or deselection of contained VariableElements and the configuration of the public feature models of contained other ConfigurableContainers. For more details on the variable content of a ConfigurableContainer refer to the documentation of meta-class ConfigurableContainer.
The ContainerConfiguration inherits from ConfigurationDecisionModel even though it does not define a configuration link between feature models, similar as FeatureConfiguration. For more information on this refer to the documentation of meta-class FeatureConfiguration.
The source and target feature models of a ContainerConfiguration are defined implicitly: it always has zero source feature models (as explained for FeatureConfiguration) and its target feature models can be deduced from the ConfigurableContainer being configured by applying the same rules as defined for InternalBinding.
Semantics:
The ContainerConfiguration specifies a concrete configuration of the variable content of a ConfigurableContainer.
Extension:
Class
This class represents a ConfigurationDecisionModel on vehicle level with explicitly defined source and target feature models. The source feature models must be on vehicle level, but the target feature models may be located on artifact level, e.g. the public feature model of the top-level FunctionType in the FDA. This way, a VehicleLevelConfigurationDecisionModel may be used to bridge the gap from vehicle level variability management to that on artifact level.
Source feature models may be either the core technical feature model (as defined by association technicalFeatureModel of meta-class VehicleLevel) or one of the optional product feature models (as defined by association productFeatureModel of meta-class Variability in the variability extension).
Constraints:
[1] The sourceVehicleFeatureModels shall only contain VehicleFeatures.
[2] The sourceVehicleFeatureModels shall be different from the targetFeatureModels
FeatureConfiguration defines an actual configuration of a FeatureModel, in particular the selection or deselection of optional features, values for selected parameterized features, and instance creations for cloned features.
Note that configurations of feature models are realized as a specialization of metaclass ConfigurationDecisionModel. This is possible because a ConfigurationDecisionModel also captures configuration, i.e. of its target feature model(s) ; while in the standard case of ConfigurationDecisionModel this target-side configuration depends on a given configuration of source feature model(s), we here simply define a "constant" target-side configuration without considering any source configurations. Therefore, the FeatureConfiguration meta-class has additional constraints compared to the super-class ConfigurationDecisionModel: the FeatureConfiguration has no source FeatureModel and only a single target FeatureModel, which serves as the FeatureModel being configured, explicitly defined through association 'configuredFeatureModel'. And since there are no source feature model to which the criterion can refer, all ConfigurationDecisions in a FeatureConfiguration must have "true" as their criterion.
Semantics:
The FeatureConfiguration specifies a concrete configuration of a feature model, in particular which Features of this FeatureModel are selected or deselected.
Extension:
Class
Constraint:
[1] Attribute criterion of all ConfigurationDecisions in a FeatureConfiguration must be set to "true".
PrivateContent is a marker class that marks the artifact element denoted by association privateElement as private, i.e. it will not be presented to the outside of the containing ConfigurableContainer.
Refer to the documentation of meta-class ConfigurableContainer for a detailed explanation of how ConfigurableContainer and PrivateContent play together.
Constraint:
[1] Identifies either one FunctionPrototype or one FunctionPort or one FunctionConnector or one HardwareComponentPrototype or one HardwarePort or one ClampConnector.
Semantics:
Marks the element identified by association privateElement as private. Otherwise the elements visibility defaults to public.
Extension:
Class
This chapter describes the behavioral constructs of the EAST-ADL2 language. What we mean by behavior here is either a function performing some computation on provided data (FlowPort interaction) or the execution of a service called upon by another function (in a ClientServer interaction).
The execution of the behavior assumes a strict run-to-completion, single buffer-overwrite management of data. That is each execution starts with the reading of data, which are not stored locally and are constantly replaced by fresher data arriving on ports. The function then performs some calculation and finally outputs some data on the output ports. The execution is non-concurrent: only one behavior is active at any point in time and not preemptable.
A FunctionBehavior in EAST-ADL2 is mainly a reference point to some description provided else where in a tool-dependent format, as depicted in the Diagram for FunctionBehavior below. This enables to re-use current behavior descriptions contained in the tools currently used by automotive companies and suppliers. Given that, requirement and traceability information can be provided for behavior in relation to the rest of the EAST-ADL2 model. A list of typical tool format is provided as an enumeration, FunctionBehaviorKind. Depending on the EAST-ADL2 language implementation such a behavior description can be provided in the model itself, for instance when using a UML-implementation of the EAST-ADL2, UML behaviors can be used. Yet it shall be noted that the behavior described shall be compliant with the execution semantics of an EAST-ADL2 function.
The rest of the behavioral constructs (see the first following Diagram of the behavior of a function) relate to the organization of the triggering of behaviors attached to functions. At a high level one can define activation Modes which may span across the whole architecture. Such Modes can be regrouped in exclusive sets. Whenever a FunctionTrigger or a FunctionBehavior refers to a Mode, this means its activation is dependent on the Mode being active or not. Thus different execution configurations can be defined.
The triggering of behavior itself, defined by FunctionTrigger, can be either time or event-based and be either type-wise or prototype-wise to allow further adjustments of functions in a particular context. Events and timing constraint that are defined in separate sections of the language (see Events, Time and TimingConstraints sections).
FunctionBehavior represents the behavior of a particular FunctionType - referred to by the association to FunctionType. What is meant by behavior is a transfer function performing some data computation (in case of FlowPort interaction) or an operation that can be called by another function (in case of ClientServer interaction). The representation property indicates the kind of representation used to describe the behavior (see FunctionBehaviorKind). The representation itself (e.g defined in an external model file) is identified by a URL String in the path property. If the representation is provided in the same model file as the system itself, the path property is not used. It is merely a placeholder with the purpose of containing information about and links to the external behavioral model.
FunctionBehavior may refer to execution modes - by the association to the element Mode. This is not mandatory, however when provided, the relation indicates the list of execution Modes in which the FunctionBehavior can potentially be executed (see element Mode).
The triggering of a FunctionBehavior is unknown to the behavior. It is defined by FunctionTriggers (see this element).
Note that the association between FunctionBehavior and FunctionType is specified as a one-way navigable link from FunctionBehavior to FunctionType: what this means is that the EAST-ADL2 language specification does not require that a FunctionType be aware of the FunctionBehavior it is assigned to. Only the navigation from behavior to function is mandatory, the implementation of a reverse link might however be provided depending on the tool support.
Although each FunctionBehavior can refer to at most one FunctionType, note that several FunctionBehaviors can be referring to the same FunctionType. In this case when a FunctionType has several behaviors, only one behavior shall be active at any given time instant, i.e. no concurrent behaviors are allowed in EAST-ADL2 functions. For instance we cannot have one active behavior in Simulink and one in Modelica. Both can be referenced in the same function but at any given time, only one is executable. Conditions such as modes, etc. must prevent two behaviors being potentially active.
Note also that FunctionBehaviors are assigned to FunctionTypes and not to FunctionPrototypes. This means that among a set of FunctionPrototypes, which share the same type, behaviors are also shared. However when a FunctionBehavior refer to Modes, which are referred to by different FunctionTriggers, different triggering conditions can be provided among a set of FunctionPrototypes for the same set of behaviors - see FunctionTrigger.
In the case where the identified FunctionType is decomposed in parts, the behavior is a specification for the composed behavior of the FunctionType.
Semantics:
Though the representation provided to a FunctionBehavior follows the semantics of the behavioral representation used (for instance SIMULINK, ASCET, etc.). Externally, in relation to the EAST-ADL2 model, however, the FunctionBehavior has synchronous execution semantics:
1. Read inputs from input ports
2. Execute Behavior with fixed inputs (run to completion)
3. Provide outputs to output ports
The data transfer between the EAST-ADL2 ports and the FunctionBehavior is representation specific and considered part of the execution of the FunctionBehavior.
Notation:
FunctionBehavior appears, if shown in a diagram, as a solid-outline rectangle with "Behavior" at the top right. The rectangle contains the name.
Extension: Behavior
The path to the file or model entity containing the ExternalBehavior
The type of behavior that the ExternalBehavior represents.
FunctionBehaviorKind is an enumeration which lists the various representations, used to describe a FunctionBehavior. It is used as a property of a FunctionBehavior. Several representations are listed; however one can always extend this list by using the literal OTHER.
Semantics:
Distinction between UML and MARTE comes from the slight differences in the behavioral definitions (namely concerning data-flow oriented behaviors).
It shall be noted that though one can use several languages to provide a representation of a FunctionBehavior, the semantics shall remain compliant with the overall EAST-ADL2 execution semantics.
Extension:
Enumeration, no extension.
Behavior is a container of FunctionBehaviors, it enables to regroup the behaviors assigned to functions in a particular context on which TraceableSpecifications can be applied. This can take any appropriate form depending on the language implementation (for instance in a UML implementation it could be a Package).
The collection of functional behaviors can be done across the EAST-ADL2 abstraction levels.
Semantics:
This element has the same role and semantics as Context, but for behavioral aspects.
Extension: BehavioredClassifier
FunctionTrigger represents the triggering parameters necessary to define the execution of an identified FunctionType or FunctionPrototype. When referring to a FunctionType, a FunctionTrigger applies to all FunctionPrototypes of the given type. When referring to a FunctionPrototype, the trigger is only valid for this particular FunctionPrototype.
Triggering is defined either as event-driven or time-driven - depending on the property triggerPolicy. If set to TIME, the timing constraint is defined with an event constraint associated with the Function’s or FunctionPrototype’s EventFunction. The function event refers to the activation of the function. If set to EVENT, one or several ports of the Function triggers the function, i.e. activates the function. In both cases, a triggerCondition is provided in the form of a Boolean expression that must evaluate to true for the function to execute. The triggerCondition syntax and grammar is unspecified.
In addition a FunctionTrigger may refer to a list of Modes in which the trigger will be considered as potentially active. Because of FunctionBehaviors may also refer to Modes, it is thus possible to arrange various function configurations for which different sets of triggers and behaviors are active. And this, at various level of granularity, either with a type-wise scope (by referring to a FunctionType) or specifically at prototype level (by referring to a FunctionPrototype).
Note that several FunctionTriggers may be assigned to the same Function (Type or Prototype), for instance to define alternative trigger conditions and/or timing constraints.
Semantics:
Association Mode defines in which modes the trigger is active
It is possible to have multiple triggers on a function, e.g. a slow period complemented with an event trigger allows fast response when needed but a minimal execution rate.
Constraints:
[1] The port association must not be empty when triggerPolicy is EVENT.
[2] The port association is empty when triggerPolicy is TIME.
[3] Function and functionPrototype are mutually exclusive associations. A FunctionTrigger either identifies a FunctionType or a FunctionPrototype as its target function, but not both.
[4] Only FunctionFlowPort of FlowDirection=in shall be referred to in the association port and at least one of them shall trigger the function
Extension:
Class
Defines whether time or trigger events on ports makes the Function execute
TriggerPolicyKind represents an enumeration for triggering policies.
Semantics:
The TriggerPolicyKind contains EVENT and TIME as possible triggering policies.
Extension:
Enumeration, no extension.
Triggering by event.
Triggering by time.
Modes are a way to introduce various configurations in the system to account for different states of the system, or of a hardware entity, or an application. The use of modes can be used to filter different views of the model.
Modes are characterized by a Boolean condition provided as a String which evaluates to true when the Mode is active.
As far as behavior is concerned, Modes enable to logically organize a set of triggers and behaviors over a set of functions. Modes are both referred to by FunctionTriggers and FunctionBehaviors, thus capturing this organization (see FunctionTrigger and FunctionBehavior).
Modes can be further organized in mutually exclusive sets with ModeGroups (see that element).
Semantics:
The Mode is active if and only if the condition is true.
ModeGroups serve as container of Modes. The set of Modes in a ModeGroup are mutually exclusive. This means that only one Mode of a ModeGroup is active at any point in time. A precondition in the form of a Boolean expression is assigned to the ModeGroup so that ModeGroups can be switched on and off as a whole.
A requirement expresses a condition or capability that must be met or possessed by a system or system component to satisfy a contract, standard, specification or other formally imposed properties.
Requirements can be introduced in different phases of the development process for different reasons. They could be introduced by marketing people, control engineers, system engineers, software engineers, Driver/OS developers, basic software developers or hardware engineers. This leads to the fact that requirements have many sources, and requirements are of many types (at different level of detail) and have several relations between them. Under these conditions the number of requirements can become quickly unmanageable if appropriate management does not exist. Note that, requirements can change during the project development and the changes should be taken into account. Requirements are organized hierarchically through several kinds of refinement relations.
EAST-ADL2 has constructs that deal with these problems. Some of these constructs deals with general issues in software development and have been already addressed in the past by general processes. As done for the structure part of EAST-ADL2, the requirements part will be compliant with UML2. The EAST-ADL2 adapts existing concepts whenever possible and develops new ones otherwise. Support for requirements modeling is provided by the EAST-ADL2 on two levels: a generic level and specializing levels (e.g. Dependability.SafetyRequirement) where specialized requirement entities are provided which are intended for certain special uses.
Elements inspired by SysML are Requirement, Satisfy, Refine, DeriveRequirement, (Verify)
RequirementsLink represents a relation between two or more Requirements. Source and target Requirements of the relation are distinguished, which means that the relation is directed (from source to target). If such a distinction does not make sense, then use a RequirementsGroup instead.
The standard case will be a relation with one source and one target Requirement. However, it is possible to have several source and/or several target Requirements so that general relations can be expressed with instances of this metaclass.
The semantic of a concrete Requirement relation can be provided by the modeler. In particular, three ways are conceivable:
(1) The user attributes of the relation can be used to specify its meaning, for example with a user attribute called "relationType" which is set to values such as "needs" or "excludes".
(2) The UserAttributeElementType can be used. Certain types will be used for certain relation semantics.
(3) RequirementsRelationGroups can be used, i.e. all relations with an "excludes" meaning are put in one relation group and all with a "needs" meaning are put in another.
The collection of requirements, their relationships, and usecases. This collection can be done across the EAST-ADL2 abstraction levels.
The Satisfy is a relationship metaclass, which signifies relationship between Requirements and an element intended to satisfy the Requirement.
Semantics:
The Satisfy metaclass signifies a satisfied requirement/satisfied by relationship between a set of Requirements and a set of satisfying entities, where the modification of the supplier Requirements may impact the satisfying client entities. The Satisfy metaclass implies the semantics that the satisfying client entities are not complete, without the supplier Requirement.
Constraints:
[1] The EAElement in the association satisfiedBy may not be a Requirement or RequirementContainer.
[2] An element of type Satisfy is only allowed to have associations to either elements of type UseCase (see satisfiedUseCase) or elements of type Requirement (see satisfiedRequirement). Not both at the same time!
Notation:
A Satisfy relationship is shown as a dashed line with a arrowhead at the end that corresponds to the satisfied Requirement or UseCaseUseCase. The entity at the tail of the arrow (the satisfying EAElement or the satisfying ARElement) depends on the entity at the arrowhead (the satisfied Requirement or UseCaseUseCase).
Extension:
To specialize SysML::Satisfy, which extends Realization.
List of satisfied ADL requirements, which are satisfied by the client ADL entities.
{derived from UML::DirectedRelationship::target}
The Refine is a relationship metaclass, which signifies a dependency relationship in-between Requirements and EAElements, showing the relationship when a client EAElement refines the supplier Requirement.
Semantics:
The Refine metaclass signifies a refined requirement/refined by relationship between a Requirement and an EAElement, where the modification of the supplier Requirement may impact the refining client EAElement. The Refine metaclass implies the semantics that the refining client EAElement is not complete, without the supplier Requirement.
Constraints:
[1] The property refinedBy must not have the types Requirement or RequirementContainer.
Notation:
A Refine relationship is shown as a dashed arrow between the Requirements and EAElement. The entity at the tail of the arrow (the refining EAElement) depends on the Requirement at the arrowhead (the refined Requirement).
Extension: specializes UML2 stereotype Refine, which extends Dependency.
List of refined requirements.
{derived from UML::DirectedRelationship::target}
ADLDeriveReqt signifies a dependency relationship in-between two sets of ADL requirements, showing the relationship when a set of derived client ADL requirement (client requirement) is derived from a set of ADL requirements (supplier requirement). It inherits from SysML::DeriveReqt which extends Dependency.
Semantics:
ADLDeriveReqt signifies a derived/derived by relationship between ADLRequirements, where the modification of the supplierADLRequirement may impact the derived client ADLRequirement. ADLDeriveReqt implies the semantics that the derived client ADLRequirement is not complete, without the supplier ADLRequirement.
The set of ADL requirements derived from the supplier ADL requirement.
{derived from UML::DirectedRelationship::target}
The set of ADL requirements that the client ADL requirement are derived from.
{derived from UML::DirectedRelationship::source}
A relation between two or more requirements. Source and target requirements of the relation are distinguished, which means that the relation is directed (from source to target). If such a distinction does not make sense, then use a ReqGroup instead.
The standard case will be a relation with one source and one target requirement. However, it is possible to have several source and-or several target requirements so that general n:m relations can be expressed with instances of this class.
The semantic of a concrete requirement relation is not defined by the EAST-ADL2 and therefore needs to be provided by the modeler. In particular, three ways are conceivable:
1) The user attributes of the relation can be used to specify its meaning, for example with a user attribute called relationType which is set to values such as needs or excludes.
2) The uaType (user attributeable element type) can be used. Certain types will be used for certain relation semantics.
3) ReqRelationGroups can be used, i.e. all relations with an excludes meaning are put in one relation group and all with a needs meaning are put in another
RequirementsRelationGroup represents a group of relations between Requirements.
The relations that are grouped by this relation group. Note that this is not a containment association, i.e. a single relation may be grouped by several ReqRelationGroups.
In general it is a standard practice (e.g. using IBM Rational DOORS) to define requirements and also rationals, explanations and other requirement related information as direct successors or predeccessors of an appropriate requirement. Thus, requirements and requirement related informations are generalized to ADLRequirementSpecificationObject which in turn can be referenced by the structuring container structure (ADLRequirementContainer).
QualityRequirements are the kind of requirements that are used to introduce externally visible properties of the system considered as a whole.
The attribute qualityRequirementType allows a more specific classification.
Extension:
Class, specializes Requirement
The specific type of quality requirement
RequirementContainer represents a larger unit or module of specification information. It is used to share several Requirements which are semantically related to each other. Also, a RequirementContainer structure will be used for structuring requirement specification objects (Requirements, Rationals etc.). Thus, to preserve the ordering of requirement specification objects the ordering of child containers is very important here.
In addition to sharing related Requirements, the RequirementContainer allows to define relations between its contained Requirements and also a grouping of them.
Furthermore, the RequirementContainer allows introducing additional user attribute definitions by way of UserAttributeElementTypes or UserAttributeTemplates which are valid only locally inside this RequirementContainer. These are additional in that they are used in addition to the user attribute definitions which are provided globally for the entire EAST-ADL2 repository.
An EAST-ADL2 system model may contain a forest of RequirementContainer (see parent child relationship). Only non root RequirementContainer which have a parentContainer are allowed to reference a RequirementSpecificationObject.
The RequirementContainer with its parent child containment relationship and the reference to RequirementSpecificationObject is the basis element for structuring requirement information into a forest structure.
Constraints:
[1] Only non root RequirementContainer (parentContainer must be set) which have a parentContainer are allowed to reference a RequirementSpecificationObject.
Notation:
RequirementContainer is shown as a solid-outline rectangle containing the name. Contained entities may also be shown inside (White-box view)
Extension: Package
Sub hierarchy of a requirement hierarchy.
The Requirement represents a capability or condition that must (or should) be satisfied. A Requirement can also specify an informal constraint, e.g. "The development of the component X must be according to the standard Y", or "The realization of this function as a software component must adhere to the scope and external interface as specified by this function". It will be used to unite the common properties of specific requirement types. A Requirement may either be directly associated to a Context (by inheriting from TraceableSpecification or it may be included in a RequirementContainer, which represents a larger unit or module of specification information.
The traceability between Requirement entities, and other specification or design entities, will be ensured by the relationship dependencies described in the Infrastructure part of this specification.
Semantics:
The Requirement metaclass applies to the EAElement that is associated to the Requirement through the Satisfy relation.
Notation:
Requirement is shown as a solid rectangle with Req top right and its name.
Changes:
Renamed from Requirement, name clash with SysML
ToDo:
Check the attributes specified in EAST.
Extension:
To specialize SysML::Requirement, which extends Class
Specifies the language used for the requirement statement.
Reference to possible external file containing the requirement statement.
QualityRequirementKind represents an enumeration with enumeration literals describing various types of quality requirements.
Extension:
Enumeration, no extension.
A multitude of different verification and validation (V&V) techniques, methods and tools are applied during the development of EE-Systems. Different techniques are applicable at different abstraction levels. Also, the technique of choice depends on the properties to validate and/or verify. Furthermore, each partner in a project may develop and employ his own V&V processes and activities. Hence it is impossible to introduce in the EAST-ADL2 a way to model all the objects that can be required by all the possible V&V techniques. As a consequence, EAST-ADL2 furnishes just the means for planning, organizing and describing V&V activities on a fairly abstract level, and for defining the links between those V&V activities, the satisfied and verified requirements, and the objects modeling the system (Functional Analysis Architecture, Functional components, Logical Tasks, etc.). The common parts of all V&V techniques are described by the EAST-ADL2, which includes: the results expected from the V&V activities, the actual results which were obtained when applying the V&V techniques, how the V&V activities are constrained. Information that is specific to an individual V&V technique is not described in EAST-ADL2, but a place for storing this information is provided.
Single V&V techniques may be used only once or at several stages during an overall V&V effort. Some of them are specific to one modeling design stage; others can be applied at various design stages.
A set of V&V techniques and activities is necessary in order to achieve a complete verification and validation of a given system. Often these techniques and activities are employed and performed by many different teams and departments, frequently even by different companies. This raises the demand for an overall planning and organization of all V&V related information.
A very important notion of V&V support in EAST-ADL2 is the distinction of abstract and concrete V&V information:
(1) On the abstract level, verification and validation information is defined without referring to a concrete testing environment and without specifying stimuli and the expected outcome of a particular VVProcedure on a detailed technical level.
(2) On the concrete level, verification and validation information specifies a concrete testing environment and provides all necessary details for testing, e.g. stimuli and expected outcomes, on a concrete technical level applicable to that testing environment.
In accordance to the "what vs. how" definition of requirements one could say: the abstract level defines what needs to be done to verify and validate a certain system, but not precisely how this is done. Conversely, the concrete level defines the precise technical details for particular testing environments. So all abstract VVCases and VVProcedures for a certain system together form sort of a "to-do"-list, which describes what needs to be done when actually testing the system with a concrete testing environment, but in a form applicable to all conceivable testing environments to all conceivable testing environments.
VVStimuli represents the input values to the testing environment represented by VVTarget in order to perform the corresponding VVProcedure.
Since this entity only occurs on the concrete level (i.e. within the context of a ConcreteVVCase), the input values must be provided in a form such that they are directly applicable to the VVTarget(s) defined for the containing ConcreteVVCase.
Extension: Class
Expected output of the testing environment represented by VVTarget when triggered by the corresponding VVStimuli of the containing ConcreteVVProcedure.
Since this entity only occurs on the concrete level (i.e. within the context of a ConcreteVVCase), the output must be provided in a form such that it can directly be compared to the output of the VVTarget(s) defined for the containing ConcreteVVCase.
VVActualOutcome represents the actual output of the testing environment represented by VVTarget when triggered by the VVStimuli of the ConcreteVVProcedure which is defined by the association 'performedVVProcedure' of the containing VVLog. It should be equivalent to the VVIntendedOutcome defined by association 'intendedOutcome'
Extension: Class
Denotes the VVIntendedOutcome that must be matched by this actual outcome.
VVCase represents a V&V effort, i.e. it specifies concrete test subjects and targets and provides stimuli and the expected outcome on a concrete technical level.
The abstract VV procedures for this AbstractVVCase.
VVProcedure represents an individual task in the context of an overall V&V effort (represented by a VVCase), which has to be performed in order to achieve that effort's overall objective. Just as is the case for VVCases, the definition of VVProcedures is separated in two levels: an abstract and a concrete level represented by the entities AbstractVVProcedure and ConcreteVVProcedure.
The concreteVVProcedure metaclass represents such a task on a concrete level, i.e. it is defined with a concrete testing environment in mind and provides stimuli and an expected outcome of the procedure in a form which is directly applicable to this testing environment.
Extension: Class
VVTarget represents a concrete testing environment in which or on which a particular V&V activity can be performed. This can be physical hardware or it can be pure software in case of a test by way of design level simulations.
Usually, a VVTarget will be a realization of one or more elements. However, there are cases in which this is not true, for example when a VVTarget represents parts of the system's environment. Therefore the association to element has a minimum cardinality of 0.
VVTargets can be reused across several ConcreteVVCases.
ConcreteVVCase represents the precise description of a V&V effort on a concrete technical level and thus provides all necessary information to actually perform this V&V effort. However, it does not represent the actual execution of the effort.
This is the purpose of the VVLog. Each VVLog metaclass represents a certain execution of a ConcreteVVCase.
For example, if the HIL test of the wiper system with a certain set of stimuli was performed on Friday afternoon and, for checkup, again on Monday, then there will be one ConcreteVVCase describing the HIL test and two VVLogs describing the test result from Friday and Monday respectively.
Extension: Class
Date and time when this log was captured.
Set of outcome results.
The collection of verification and validation elements. This collection can be done across the EAST-ADL2 abstraction levels.
The Verify is a relationship metaclass, which signifies a dependency relationship between a Requirement and a VVCase, showing the relationship when a client VVCase verifies the supplier Requirement.
Semantics:
The Verify metaclass signifies a refined requirement/verified by relationship between a Requirement and a VVCase, where the modification of the supplier Requirement may impact the verifying client VVCase. The Verify metaclass implies the semantics that the verifying client VVCase is not complete, without the supplier Requirement.
Notation:
A Verify relationship is shown as a dashed arrow between the Requirements and VVCase.
Extension:
To specializes SysML::Verify, which specializes the UML stereotype Trace, which extends Dependency.
The procedures used to verify the requirements.
The verification that verifies the supplier requirement(s).
{derived from UML::DirectedRelationship::source}
The set of ADL requirements which the client VV cases verify.
{derived from UML::DirectedRelationship::target}
The function modeling is performed in the FunctionalAnalysisArchitecture (in the AnalysisLevel) and the FunctionalDesignArchitecture (in the DesignLevel). The root component of the function compositional hierarchy on AnalysisLevel is the FunctionalAnalysisArchitecture (FAA); the root component of the function compositional hierarchy on DesignLevel is the FunctionalDesignArchitecture (FDA), see the diagram for SystemModeling.
The main modeling concept applied here is functional component modeling: Functions interact with one another via ports that are connected by connectors owned by the composing function. Occurrences of functions are modeled by typed prototypes in the composing function. These occurrences are typed by types. This naming convention of the type-prototype pattern is from AUTOSAR, however the concept of types and typed elements is also available in e.g. UML2.
The LocalDeviceManager represents a DesignFunction that act as a manager or functional interface to Sensors, Actuators and other devices. It is responsible fort translating between the electrical/logical interface of the device, as provided by a BasicSoftwareFunction, and the physical interface of the device. For example, consider a temperature sensor with voltage output. The HardwareFunctionType defines the transfer from temperature to voltage. A BasicSoftwareFunction relays the voltage from the microcontroller’s I/O. The role of the LocalDeviceManager is now to translate from voltage to temperature value, taking into account the sensor’s characteristics such as nonlinearities, calibration, etc. The resulting temperature is available to the other DesignFunctions. By separating the device specific part from the middleware and ECU specific parts, it is possible to systematically change interface function together with the device.
Semantics:
The LocalDeviceManager encapsulates the device-specific or functional parts of a Sensor or, Actuator, device, etc. interface.
Constraints:
[1] A DesignFunctionPrototype typed by a LocalDeviceManager shall be allocated to the same ECU node as the device that it manages is connected to.
[2] A LocalDeviceManager may only interface either Sensors or Actuators.
[3] A LocalDeviceManager shall interface BSWFunctions and DesignFunctions.
Extension: Class, specialization of SysML::Block
The FunctionalDevice represents an abstract sensor or actuator that encapsulates sensor/actuator dynamics and the interfacing software. The FunctionalDevice is the interface between the electronic architecture and the environment (connected by ClampConnectors). As such, it is a transfer function between the AnalysisFunction and the physical entity that it measures or actuates.
A Realization dependency can be used for traceability between LocalDeviceManagers and Sensors/Actuators that are represented by the FunctionalDevice.
Semantics:
The behavior associated with the FunctionalDevice is the transfer function between the environment model representing the environment and an AnalysisFunction. The transfer function represents the sensor or actuator and its interfacing hardware and software (connectors, electronics, in/out interface, driver software, and application software).
Constraints:
No additional constraints.
Changes:
Now specializes AnalysisFunctionType.
Extension: Class, specialization of SysML::Block
The ADLPortGroup metaclass is used to collapse several ports to one. All ports that are part of a port group are graphically represented as a single port. Connectors connected to ports of a port group pair are graphically collapsed to a single line.
The ADLPortGroup has no semantic meaning except that it makes graphical representation of the connected ports easier to read, and provides a means to logically organize several ports to one group.
Connectors are still connected to the contained ports, but tool support may simplify connections by allowing semi-automatic or automatic connection to all ports of a port group.
Semantics:
The ADLPortGroup provides a means to organize ports and connectors. It does not add semantics. In the model, the ports contained in the port group are connected as individual ports.
The grouped ports.
{derived from UML::EncapsulatedClassifier::ownedPort} when this stereotype is applied on a Class. When the stereotype is applied on a Port the value is derived from the ports in the type.
The FunctionFlowPort is a metaclass for flowports, inspired by the SysML FlowPort.
Semantics:
FunctionFlowPorts are single buffer overwrite and nonconsumable.
FunctionFlowPorts can be connected if their FunctionPort signatures match; i.e.:
EADatatypes that are ValueTypes are compatible if
* They have the same "dimension".
* They have the same "unit".
EADatatypes that are RangeableValueTypes are compatible if
* The source EADatatype has the same or better "accuracy".
* They have the same baseRangeable.
* The source EADatatype has the same or smaller "maxValue".
* The source EADatatype has the same or higher "minValue".
* The source EADatatype has the same or higher "resolution".
* They have the same "significantDigits".
EADatatypes that are EnumerationValueTypes are compatible if
* They have the same baseEnumeration.
FunctionFlowPort with direction=in, is called an input FunctionFlowPort:
The input FunctionFlowPort indicates that the containing Function requires input data. The EADatatype of this data is defined by the associated EADatatype. The data is sampled at the invocation of the containing entity for discrete Functions. For continuous Functions, the input FunctionFlowPort represents a continuous input connection point.
The input FunctionFlowPort declares a reception point of data. It represents a single element buffer, which is overridden with the latest data. The type of the data is defined by the associated EADatatype.
FunctionFlowPort with direction=out, is called an output FunctionFlowPort:
The output FunctionFlowPort indicates that the containing Function provides output data. The EADatatype of this data is defined by the associated EADatatype. The data is sent at the completion of the containing entity for discrete Functions. For continuous Functions, the output FunctionFlowPort represents a (time-)continuous output connection point.
The output FunctionFlowPort declares a transmission point of data. The type of the data is defined by the associated EADatatype.
Extension: UML Port, specialization of SysML::FlowPort
The abstract metaclass FunctionType abstracts the function component types that are used to model the functional structure, which is distinguished from the implementation of component types using AUTOSAR. The syntax of FunctionTypes is inspired from the concept of Block from SysML.
FunctionBehavior and FunctionTrigger in the Behavior package are associated to a FunctionType.
Semantics:
The FunctionType abstracts the function component types that are used to model the functional structure on AnalysisLevel and DesignLevel.
Leaf functions of an EAST-ADL2 function hierarchy are called elementary Functions.
Elementary Functions have synchronous execution semantics:
1. Read inputs
2. Execute (duration: Execution time)
3. Write outputs
Execution is defined by a behavior that acts as a transfer function.
Subclasses of the abstract class FunctionType add their own semantics.
If a behavior is attached to the FunctionType, the execution semantic for a discrete elementary FunctionType complies with the run-to-completion semantic. This has the following implications:
1. Input that arrives at the input FunctionPorts after execution begins will be ignored until the next execution cycle.
2. If more than one input value arrives per FunctionPort before execution begins the last value will override all previous ones in the public part of the input FunctionPort (single element buffers for input).
3. The local part of a FunctionPort does not change its value during execution of the behavior.
4. During an execution cycle only one output value can be sent per FunctionPort. If consecutive output values are produced on the same FunctionPort during a single execution cycle, the last value will override all previous ones on the output FunctionPort (single element buffers for output).
5. Output will not be available at an output FunctionPort before execution ends.
6. Elementary FunctionTypes may not produce any side effects (i.e., all data passes the FunctionPorts).
Constraints:
[1] Elementary FunctionTypes shall not have parts.
Notation:
The FunctionType is shown as a solid-outline rectangle containing the name, with its FunctionPorts or PortGroups on the perimeter. Contained entities may be shown with its FunctionConnectors (White-box view)
Extension: UML Class, specialization of SysML::Block
True, when this type does not have any parts.
Derived from size of UML::StructuredClassifier::ownedConnector and UML::EncapsulatedClassifier::ownedPort
Owned in- and out-flow ports.
{derived from UML::EncapsulatedClassifier::ownedPort}
Grouping of ports owned by this element.
{derived from UML::Class::nestedClassifier}
FunctionPrototype represents a reference to the occurrence of a FunctionType when it acts as a part.
The FunctionPrototype is typed by a FunctionType.
FunctionTrigger in the Behavior package is associated to a FunctionPrototype.
Semantics:
The FunctionPrototype represents an occurrence of the FunctionType that types it.
Notation:
Shall be shown in the same style as the class specified as type, however it shall be clear that this is a part.
Changes:
Renamed from ADLFunctionPart
Extension:
To specialize SysML::BlockProperty, which extends Property
The ports conserve variables for component interaction.
The FunctionConnector indicates that the connected FunctionPorts exchange signals or client-server requests/responses.
Semantics:
The FunctionConnector connects a pair of FunctionFlowPorts or FunctionClientServerPorts. If two FunctionFlowPorts are connected, data elements of the type of the output FunctionFlowPort flow from the output FunctionFlowPort to the input FunctionFlowPort. If FunctionClientServerPorts are connected, the client calls the server according to the operations of the interfaces. The occurrence of the FunctionType that specifies the occurrence of the FunctionPrototype has to be identified by the FunctionConnector as well.
The FunctionConnector is normally routed according to the hardware topology and the allocation of source and destination. If there are redundant paths, a FunctionAllocation may be used to prescribe allocation.
Constraints:
[1] Can connect two FunctionFlowPorts of different direction when this is an assembly FunctionConnector.
[2] Can connect two FunctionFlowPorts of the same direction when this is a delegation FunctionConnector.
[3] Can connect two ClientServerPorts of different kind when this is an assembly FunctionConnector.
[4] Can connect two ClientServerPorts of the same kind when this is a delegation FunctionConnector.
[5] Can connect two FunctionFlowPorts with direction inout.
Notation: FunctionConnector is shown as a solid line
Extension: UML Connector
The FunctionClientServerPort is a FunctionPort for client-server interaction. A number of FunctionClientServerPorts of clientServerType "client" can be connected to one FunctionClientServerPort of clientServerType "server", i.e. when connected the multiplicity for the connection is n to 1 for client and server.
Semantics:
The FunctionClientServerPort is a FunctionPort for client-server interaction.
FunctionClientServerPorts are single buffer overwrite and nonconsumable.
Constraints:
[1] A FunctionClientServerPort of clientServerType "client" can only be connected to one FunctionClientServerPort of clientServerType "server".
Extension: UML Port
The interface of this port.
{derived from UML::TypedElement::type}
The FunctionClientServerInterface is used to specify the operations in FunctionClientServerPorts.
Semantics:
The operations of the FunctionClientServerInterface are required or provided through the FunctionClientServerPorts typed by the FunctionClientServerInterface.
Extension: UML Interface
This element is an enumeration for the direction of a Port, which can either be "in", "out", or "inout".
Semantics:
The EADirectionKind is an enumeration with the three literals "in", "out", and "inout".
Extension:
Enumeration, no extension.
This element is an enumeration for the kind of the FunctionClientServerPort, which can either be a "client" or a "server".
Semantics:
The ClientServerKind is an enumeration with the two literals "client" and "server".
Extension:
Enumeration, no extension.
The DesignFunctionType is a concrete FunctionType and therefore inherits the elementary function properties from the abstract metaclass FunctionType. The DesignFunctionType is used to model the functional structure on DesignLevel. The syntax of DesignFunctionTypes is inspired from the type-prototype pattern used by AUTOSAR.
The DesignFunctions may interact with other DesignFunctions (i.e., also BasicSoftwareFunctions, HardwareFunctions, and LocalDeviceManager) through their FunctionPorts.
Furthermore, a DesignFunction may be decomposed into (sub-)DesignFunctions. This allows breaking up hierarchically the functionalities provided by the parent DesignFunction into subfunctionalities.
Execution time constraints on the DesignFunctionType can be expressed by ExecutionTimeConstraints, see the Timing package.
If two or more occurrences of an elementary Function are allocated on the same ECU, the code will be placed on the ECU only once (so these occurrences will use the same code but separate memory areas for data).
Semantics:
The DesignFunctionType represents a node in a tree structure corresponding to the functional decomposition of a top level DesignFunction. The DesignFunction is representing the design function used to describe the functionalities provided by a vehicle on the DesignLevel. At the DesignLevel, DesignFunctions are defined and structured according to the functional and hardware system design.
Constraints:
[1] DesignFunctionTypes may only be used on DesignLevel.
Extension: UML Class, specialization of SysML::Block
The AnalysisFunctionType is a concrete FunctionType and therefore inherits the elementary function properties from the abstract metaclass FunctionType. The AnalysisFunctionType is used to model the functional structure on AnalysisLevel. The syntax of AnalysisFunctionTypes is inspired from the type-prototype pattern used by AUTOSAR.
The AnalysisFunctions may interact with other AnalysisFunctions (i.e., also FunctionalDevices) through their FunctionPorts.
Furthermore, an AnalysisFunction may be decomposed into (sub-)AnalysisFunctions. This allows breaking up hierarchically the functionalities provided by the parent AnalysisFunction into subfunctionalities.
A FunctionBehavior may be associated with each AnalysisFunction. In the case where the AnalysisFunction is decomposed, the behavior is a specification for the composed behavior of the subAnalysisFunction. If the AnalysisFunction is not decomposed (i.e., if the AnalysisFunction is elementary), then the behavior is describing the behavior of the subAnalysisFunction, which is to be used when building the global behavior of the FunctionalAnalysisArchitecture by composition of the leaf behaviors.
Semantics:
The AnalysisFunctionType represents a node in a tree structure corresponding to the functional decomposition of a top level AnalysisFunction. The AnalysisFunction is representing the analysis function used to describe the functionalities provided by a vehicle on the AnalysisLevel. At the AnalysisLevel, AnalysisFunctions are defined and structured according to the functional requirements, i.e., the functionalities provided to the user.
Constraints:
[1] AnalysisFunctionTypes may only be used on AnalysisLevel.
Extension: UML Class, specialization of SysML::Block
The BasicSoftwareFunctionType is an abstraction of middleware functionality.
Semantics:
The BasicSoftwareFunctionType is an abstraction of the middleware.
Extension:
UML Class, specialization of SysML::Block
The HardwareFunctionType is the transfer function for the identified HardwareComponentType or a specification of an intended transfer function. HardwareFunctionType types DesignFunctionPrototypes in the FunctionalDesignArchitecture. The DesignFunctionPrototype is typically the end of the ClampConnector on DesignLevel.
Prototypes typed by HardwareComponentType may be allocated to HardwareComponents in which case the HardwareFunctionType must match the HardwareFunctionType of the target HardwareComponent.
DesignFunctionPrototypes typed by HardwareFunctionType may be allocated to HardwareComponents in which case the HardwareFunctionType must match the HardwareFunctionType of the target HardwareComponent.
Constraints:
[1] A DesignFunctionPrototype typed by a HardwareFunctionType shall be connected to the EnvironmentModel via ClampConnectors and to BSWFunctions via FunctionConnectors.
Semantics:
The HardwareFunctionHardwareFunctionType is the transfer function for hardware components such as sensors, actuators, amplifiers, etc or a specification of an intended transfer function.
HardwareFunctions can be allocated to Sensors or Actuators, i.e. the interfacing element to the plant model.
Extension:
UML Class, specialization of SysML::Block
The AnalysisFunctionPrototype represents references to the occurrence of the AnalysisFunctionType that types it when it acts as a part.
The AnalysisFunctionPrototype is typed by an AnalysisFunctionType.
Semantics:
The AnalysisFunctionPrototype represents an occurrence of the AnalysisFunctionType that types it.
Extension:
UML Property, specialization of SysML::BlockProperty
The DesignFunctionPrototype represents references to the occurrence of the DesignFunctionType that types it when it acts as a part.
The DesignFunctionPrototype is typed by a DesignFunctionType .
Semantics:
The DesignFunctionPrototype represents an occurrence of the DesignFunctionType that types it.
Extension:
UML Property, specialization of SysML::BlockProperty
The AllocateableElement is an abstract superclass for elements that are allocateable.
Semantics:
The AllocateableElement abstracts all elements that are allocateable.
Subclasses of the abstract class AllocateableElement add their own semantics.
Extension: abstract, no extension
FunctionAllocation represents an allocation constraint binding an AllocateableElement on an AllocationTarget.
The same constraint could be expressed in a textual design constraint.
Semantics:
AllocationTarget is specialized by HardwareComponentPrototype in the HardwareModeling package and AllocateableElement is specialized by the concrete elements DesignFunctionPrototype and FunctionConnector in the FunctionModeling package.
Notation:
A FunctionAllocation is shown as a dependency (dashed line) with an "allocation" keyword attached to it.
Extension: Class, specializesDesignConstraint
target to AUTOSAR::ECUResourceTemplate::ECU
allocatedAutosarComponent to AUTOSAR::Components::ClientPort
ToDo:
Cf. AUTOSAR SWMapping::MappingConstraint
The Allocation element contains functionAllocations. It can bundle functionAllocations that belong together, e.g., all functionAllocations for a simulation.
Semantics:
The Allocation element contains functionAllocations, i.e., it can bundle functionAllocations that belong together.
Extension: Class
The FunctionPowerPort is a FunctionPort for denoting the physical interactions between environment and sensing/actuation functions.
Semantics:
The FunctionPowerPort conserves physical variables in a dynamic process.
The typing Datatype owns two datatypePrototypes called Across and Through, representing the exchanged physical variables of the FunctionPowerPort. In two or more directly connected function power ports, the Across variables always get the same value and the Through variables always sum up to zero.
Constraints:
[1] The owner of a FunctionPowerPort is either a FunctionalDevice, a HardwareFunctionType, or a FunctionType for environment
[2] Two connected FunctionPowerPort must have the same Datatype.
[3] The typing Datatype shall have two datatypePrototypes called Across and Through, with Datatypes that are consistent and representing the variables of the PowerPort.
Extension: UML Port
The Operation is the provided/required operation of a FunctionClientServerInterface. It can specify its return values and arguments by EADatatypePrototypes.
Semantics:
The Operation is the provided/required operation of a FunctionClientServerInterface.
Extension: UML Operation
This package describes the basic feature modeling that is employed on the vehicle level as well as on the artifact levels, i.e. on AnalysisLevel and below. Details of feature modeling that are specific to the vehicle level are factored out and documented separately in the package VehicleFeatureModeling.
The abstract base class for all nodes in a feature tree.
Semantics:
FeatureTreeNode has no specific semantics. Further subclasses of FeatureTreeNode will add semantics appropriate to the concept they represent.
Extension:
abstract, no extension
FeatureModel denotes a model owning Features. The FeatureModel can be used to describe variability and commonality of a specified EE-System at any abstraction level in the SystemModel.
The FeatureModel can be used either to describe the variability within a particular Function or to describe the overall variability of a vehicle (cf. VehicleLevel). The FeatureModel describing internal variability of a FunctionType refers to the VehicleLevel by a «realizes» link (informative).
Note, however, that a FeatureModel per definition does not always have to define variability. If a feature model contains only mandatory features, then its purpose is completely unrelated to variability. The features in such a FeatureModel could serve, for example, as invariant "coarse-grained requirements". The most important example is the core technical feature model on vehicle level which is also used for SystemModels that do not contain any variability at all. However, most uses of feature models in EAST-ADL2 are primarily motivated by variability definition and management.
A public, local FeatureModel of an artifact element realizes a VehicleFeature of the VehicleLevel.
Semantics:
The FeatureModel has no specific semantics. Further subclasses of FeatureModel will add semantics appropriate to the concept they represent.
Extension:
Package
A FeatureLink resembles a Relationship between two Features referred to as 'start' and 'end' feature (such as "feature S requires feature E" or "S excludes E").
The type of the FeatureLink specifies the precise semantics of the relationship. There are several predefined types, for example "needs" states that S requires E. In addition, user-defined types are allowed as well. For user-defined types, attribute 'customType' provides a unique identifier of the custom link type and attribute 'isBidirectional' states whether the link is uni- or bidirectional.
FeatureLinks are similar to FeatureConstraints but much more restricted. The rationale for having FeatureLinks in addition to FeatureConstraints is that in many cases FeatureLinks are sufficient and tools can deal with them more easily and appropriately (e.g. they can easily be presented visually as arrows in a diagram).
Semantics:
The FeatureLink is a relationship between Features that may constraint the selection of Features involved in the relationship.
Constraints:
[1] The start and end Features of a FeatureLink must be contained in the FeatureModel that contains the FeatureLink.
Extension:
AssociationClass
It must be stated if the link is bidirectional: It exists either unidirectional or bidirectional includes. Also in the case of excludes there exists the unidirectional case (e.g. if the time of exclusion plays a role), whereas the bidirectional case is more common.
The type of this feature link identified by a String value. The type determines the precise semantics of the relation. There are four predefined types (given a link that starts at feature A and ends at feature B):
"excludes":
A and B can never be both selected in a single configuration (always bidirectional).
"includes":
if A is selected, then also B must be selected (unidirectional or bidirectional).
"impedes":
A and B can usually(!) not be selected in a single configuration, or: you can select A and B but you should have a good reason
to do so (always bidirectional).
"suggests":
if A is selected, then usually(!) also B must be selected, or: you can select A without B but you should have a good reason to do so (unidirectional or bidirectional).
In addition, each project can decide to use additional link types by defining unique key-words for them. In cases where feature models are shared with third parties (other departments, companies, etc.) a URL name scheme must be used to produce globally unique names, e.g. as for packages in the Java programming language.
FeatureGroup is a specialization of the FeatureTreeNode, enabling grouping of several Features. It specifies with its cardinality how these grouped features can be combined. For example, a FeatureGroup owning the two Features A and B, with a cardinality of [1] means that A and B are alternative.
Semantics:
FeatureGroup is a grouping entity for sibling Features to reflect variability for a set of Features.
Extension:
Class
The Cardinality describes for a feature group its cardinality. It describes the variability behavior of the group (e.g. a cardinality of 1 in a feature group means that one of the child features has to be selected).
A Feature represents a characteristic or trait of some object of consideration. The actual object of consideration depends on the particular purpose of the feature's containing feature model.
Example 1: The core technical feature model on vehicle level defines the technical properties of the complete-system, i.e. vehicle. So its object of consideration is the vehicle as a whole and therefore its features represent characteristics or traits of the vehicle as a whole.
Example 2: The public feature model of some function F in the FDA defines the features of this particular software function. So its object of consideration is function F and therefore its features represent characteristics or traits of this function F.
Semantics:
Feature is a (non)functional characteristic, constraint or property that can be present or not in a (vehicle) product line.
Extension:
Class
The Cardinality describes for a feature its cardinality. In the context of a feature group it describes the variability behavior of the group (e.g. a cardinality of 1 in a feature group means that one of the child features has to be selected). Cardinalities for features: A cardinality of 0..1 at a feature means that this feature is optional. A cardinality of 1 means that this feature is mandatory and a cardinality of 0..n with n>1 means that this feature may be instantiated more than once in the product to be realized.
Note that allowing cardinalities >1 has far-reaching consequences for how features are applied. If this is not desired-needed in a certain project, cardinalities >1 can be prohibited by specifying a complianceLevel in FeatureModel.
The required binding time could possibly deviate from the actual binding time but reflects the intended binding time and actual binding time can be later adapted to the required binding time, if surrounding constraints allow a change.
The actual binding time, independent of the required binding time.
The motivation for attributing features and variable elements with binding times is that binding times encapsulate important information about the variability under view:
Variability that must be bound (determined, decided) very early in the system development may not be visible in one single feature model but only in comparison with different feature models in the context of multi-level feature trees; late bound variability is variability providing the driver with choices for current equipment configuration.
Binding times are important because they describe if the variability must be decided during system development or if the variability is determined by a customer or if the variability itself is part of the product features that are sold to the customer. Possible binding times are:
- SystemDesignTime
- CodeGenerationTime
- PreCompileTime
- LinkTime
- PostBuild
- Runtime
Note that a binding time is never a particular point in time such as April 2nd, 2011, but always a certain stage in the overall development, production and shipment process as represented by the above values.
Each feature must have a binding time (association requiredBindingTime) and may have one further binding time (association actualBindingTime).
The required binding time describes the binding time that the feature is intended to have. But due to technical conditions it may occur that the actually realized binding time of the feature differs from the originally intended binding time. In this case one has to provide information about the actual binding time. In the rationale it must be described by what the required binding time is motivated and what the reasons are for a (different) actual binding time.
Extension:
Class.
The kind of the binding time, see enumeration of binding times.
BindingTimeKind represents the set of possible binding times.
Variability will be bound during development of the EE-System.
From AUTOSAR:
* Designing the VFB.
* Software Component types (portinterfaces).
* SWC Prototypes and the Connections between SWCprototypes.
* Designing the Topology
* ECUs and interconnecting Networks
* Designing the Communication Matrix and Data Mapping
Variability will be bound during code generation.
From AUTOSAR:
* Coding by hand, based on requirements document.
* Tool based code generation, e.g. from a model.
* The model may contain variants.
* Only code for the selected variant(s) is actually generated.
Variability will be bound during or immediately prior to code compilation.
From AUTOSAR:
This is typically the C-Preprocessor. Exclude parts of the code from the compilation process, e.g., because they are not required for the selected variant, because they are incompatible with the selected variant, because they require resources that are not present in the selected variant. Object code is only generated for the selected variant(s). The code that is excluded at this stage code will not be available at later stages.
Variability will be bound during linking.
From AUTOSAR:
Configure what is included in object code, and what is omitted
Based on which variant(s) are selected
E.g. for modules that are delivered as object code (as opposed to those that are delivered as source code)
Variability will be bound at certain occasions after shipment, for example when the vehicle is in a workshop.
Variability will be bound by the customer after shipment by way of vehicle configuration.
Variability with such a late binding time can also be seen as a special functionality of the system which is not documented as variability at all. However, it is sometimes advantageous to represent such cases as variability in order to be able to seamlessly include them in the overall variability management activities.
This enumeration encapsulates the available types of constraints that can be applied to a FeatureLink or VariationGroup (the latter is applicable only if the variability extension is used).
Semantics:
Predefined kinds of constraints that can be associated to a FeatureLink or VariationGroup.
Extension:
Enumeration, no extension.
When used in a FeatureLink: if the FeatureLink's start feature S is selected, then also its end feature E must be selected: not (S and not E). Always unidirectional.
When used in a VariationGroup: assuming the ordered association variableElement in meta-class VariationGroup refers to elements VE1, VE2, ..., VEn, this kind states that VE1 requires (i.e. may not appear without) all other elements VE2, VE3, ..., VEn.
When used in a FeatureLink: the FeatureLink's start feature S and end feature E are incompatible and must never be both selected in a single configuration: not (S and E). Always bidirectional.
When used in a VariationGroup: this kind states that at most(!) one element of the elements denoted by association variableElement of the VariationGroup must be selected in any valid final system configuration.
When used in a FeatureLink: the attribute customType in the FeatureLink defines the custom feature link type as explained there.
When used in a VariationGroup: this kind states that the dependency between the elements denoted by association variableElement of the VariationGroup will be defined by a logical expression in attribute 'constraint' of the VariationGroup.
When used in a FeatureLink: either the FeatureLink's start feature S or its end feature E must be selected in any configuration: S xor E. Always bidirectional.
When used in a VariationGroup: this kind states that exactly(!) one element of the elements denoted by association variableElement of the VariationGroup must be selected in any valid final system configuration.
Weak form of "needs".
When used in a FeatureLink: if the FeatureLink's start feature S is selected, then usually(!) also its end feature E must be selected. You can select S without E but you should have a good reason to do so. Always unidirectional.
When used in a VariationGroup: accordingly as above.
Weak from of "excludes".
When used in a FeatureLink: the FeatureLink's start feature S and its end feature E must usually(!) not be selected in a single configuration. You can select S together with E but you should have a good reason to do so. Always bidirectional.
When used in a VariationGroup: accordingly as above.
Captures a constraint on the containing feature model's configuration which is too complex to be expressed by way of a FeatureLink. In general, all constraints that can be expressed by a FeatureLink can also be expressed by a FeatureConstraint, but not vice versa.
The ADLSystemModel is the top level container of an EAST-ADL2 model. It represents the electronics & software of the vehicle, and its environment, and concepts related to the various abstraction level of models used in EAST-ADL2. It is mainly based on both concepts: Models and architectures.
VehicleFeatureModel represents the features of the vehicle, i.e. the externally visible properties
The AnalysisArchitecture is the abstract functional description of the vehicle electronics
The DesignArchitecture contains the functional specification and hardware architecture of the vehicle electronics
The Implementation Architecture contains the software architecture and components and the hardware architecture of the vehicle
The Operational Architecture represents the actual software and electronics in the manufactured vehicle
The word model vs. architecture is chosen rather informally. Architecture is used where this term is often used in practice, and where the construct is a complete (in some sense) reflection of the aspects that it captures. Model is used in other cases.
These models/architectures contain further elements in a hierarchy.. Relations between these elements over the boundaries between the models/architectures are contained in the ADLSystemModel. This is possible because the SystemModel is a specialization of the ADLContext, and is thus able to contain relations. Typical relations are described in the sub-package CoreConstructs (see definition of ADLRelationship, ADLRealization and ADLSatisfy).
Overview:
The ADLSystemModel is the top level container of an EAST-ADL2 model. It represents the electronics & software of the vehicle, and its environment, and concepts related to the various abstraction level of models used in EAST-ADL2. It is mainly based on both concepts: Models and architectures.
SystemModel is used to organize models/architectures according to their abstraction level; it can also hold with relationships between the different levels.
Semantics:
The SystemModel represents the EE system of the vehicle, and concepts related to the various abstraction levels.
Notation:
The default notation for a SystemModel is a solid-outline rectangle containing the SystemModel's name, and with compartments separating by horizontal lines containing features or other members of the SystemModel. Contained entities may also be shown with its connectors (White-box view).
Changes: New class in EAST-ADL2
Extension: Class
The Implementation Architecture abstraction level.
The AnalysisArchitecture contained in the SystemModel and connected to the EnvironmentModel through ports-connectors
The designArchitecture contained in the SystemModel and connected to the EnvironmentModel through ports-connectors
The Vehicle Feature Model contained in the SystemModel.
AnalysisLevel represents the vehicle EE system in terms of its abstract functional definition. It includes the functional analysis architecture (FAA) which represents the abstract functional structure.
Semantics:
AnalysisLevel represents the vehicle EE system in terms of its abstract functional definition. It defines the logical functionality and a logical decomposition of functionality down to the appropriate granularity.
Notation:
The Analysis Architecture is shown as a solid-outline rectangle containing the name, with its ports or port groups on the perimeter. Contained entities may be shown with its connectors (White-box view).
Extension:
Class
DesignLevel represents the vehicle EE system on the design abstraction level. It includes primarily the Functional Design Architecture (FDA), and the HardwareDesignArchitecture (HDA).
FDA represents a top level Function. It is supposed to implement all the functionalities of a vehicle, as specified by a Functional Analysis Architecture or a Vehicle level (if no Functional Analysis Architecture has been defined during the process).
The design level in EAST-ADL2 includes the design architecture containing the functional specification and hardware architecture of the vehicle EE system. The design architecture includes the Functional Design Architecture representing a decomposition of functionalities analyzed on the analysis level. The decomposition has the purpose of making it possible to meet constraints regarding non-functional properties such as allocation, efficiency, reuse, or supplier concerns. There is an n-to-m mapping between entities of the design- and the ones on the analysis level.
Non-transparent infrastructure functionality such as mode changes and error handling are also represented at the design level, such that their impact on applications' behaviors can be estimated.
The Functional Design Architecture parts are typed by FunctionTypes and LocalDeviceManagers. The view of the HardwareArchitecture facilitates the realization of LocalDeviceManager as sensor/actuator HW elements.
The HDA is the hardware design from a system perspective. The HDA has two purposes:
1) It shows the physical entities and how they are connected.
2) It is an allocation target for the Functions of the Functional Design Architecture.
The HDA represents the hardware architecture of the embedded system. Its contained HW elements represent the physical aspects of the hardware entities and how they are connected. HardwareFunctionTypes associated to HW components represent the logical behavior of the contained HW elements.
Semantics:
The DesignLevel is the representation of the vehicle EE system on the design abstraction level. It corresponds to the design of logical functions and boundaries extended in regards to resource commitment.
Notation:
The DesignLevel is shown as a solid-outline rectangle containing the name, with its ports or port groups on the perimeter. Contained entities may be shown with its connectors (White-box view).
Extension: Class
ImplementationLevel represents the software architecture and components, and the hardware architecture of the EE system in the vehicle. The ImplementationLevel is defined by the AUTOSAR System- and SoftwareArchitecture. For example, functions of the Functional Design Architecture will be realized by AUTOSAR SW-Components in the ImplementationLevel. Traceability is supported from implementation level elements (AUTOSAR) to upper level elements by Realization relationships.
Extension: Class
VehicleLevel represents an arbitrary set of feature models containing only VehicleFeatures.
Constraints:
[1] All contained feature models are FeatureModels that only contain VehicleFeatures.
Semantics:
The VehicleLevel contains the technical feature models.
Extension: class.
The package HardwareModeling contains the elements to model physical entities of the embedded EE system. These elements allow capturing the hardware in sufficient detail to allow preliminary allocation decisions.
The allocation decisions are based on requirements on timing, storage, data throughput, processing power, etc. that are defined in the Functional Analysis Architecture and the Functional Design Architecture.
Conversely, the Functional Analysis Architecture and the Functional Design Architecture may be revised based on analysis using information from the Hardware Design Architecture. An example is control law design, where algorithms may be modified for expected computational and communication delays. Thus, the Hardware Design Architecture contains information about properties in order to support, e.g., timing analysis and performance in these respects.
Hardware connectors represent wires that electrically connect the hardware components through its ports.
Semantics:
The connector joins the two referenced ports electrically, with a resistance defined by the resistance attribute.
Extension:
Connector
IOHardwarePin represents an electrical connection point for digital or analog I/O.
Semantics:
The IOHardwarePin represents an electrical pin or connection point.
Notation:
IOHardwarePin is shown as a solid square with an IO inside. Its name may appear outside the square.
kind defines whether the IOHardwarePort is digital, analog or PWM (Pulse Width Modulated).
PowerHardwarePin represents a pin that is primarily intended for power supply, either providing or consuming energy.
Semantics:
A PowerHardwarePin is primarily intended to be a power supply. The direction attribute of the pin defines whether it is providing or consuming energy
Notation:
PowerHardwarePin is shown as a solid square with PWR inside. Its name may appear outside the square.
The HardwareComponentType represents hardware element on an abstract level, allowing preliminary engineering activities related to hardware.
Semantics:
The HardwareElementType is a structural entity that defines a part of an electrical architecture. Through its ports it can be connected to electrical sources and sinks. Its logical behavior, the transfer function, may be defined in an HWFunctionType referencing the HardwareElementType. This is typically connected through its ports to the environment model to participate in the end-to-end behavioral definition of a function.
Extension:
Class
The HWConnectors.
{derived from UML::StructuredClassifier::ownedConnector}
The Ports.
{derived from UML::EncapsulatedClassifier::ownedPort}
The HWElementPrototypes.
{derived from UML::Classifier::attribute}
CommunicationHardwarePin represents an electrical connection point that can be used to define how the wire harness is logically defined.
Semantics:
The CommunicationHardwarePin represents the hardware connection point of a communication bus.
Depending on modeling style, one or two pins may be defined for a dual-wire bus.
Notation:
CommunicationHardwarePin is shown as a solid square with a C inside. Its name may appear outside the square.
HardwarePin represents electrical connection points in the hardware architecture. Depending on modeling style, the actual wire or a logical connection can be considered.
Semantics
Hardware pin represents an electrical connection point.
Extension:
Port
Indicates that the pin is connected to ground.
The direction of current through the pin.
Node represents the computer nodes of the embedded EE system. Nodes consist of processor(s) and may be connected to sensors, actuators and other ECUs via a BusConnector.
Node denotes an electronic control unit that acts as a computing element executing Functions. In case a single CPU-single core ECU is represented, it is sufficient to have a single, non-hierarchical Node.
Semantics:
The Node element represents an ECU, i.e. an Electronic Control Unit and an allocation target of FunctionPrototypes.
The Node executes its allocated FunctionPrototypes at the specified executionRate. The executionRate denotes how many execution seconds of an allocated functionPrototype´s execution time that is processed each real-time second. Actual execution time is thus found by dividing the parameters of the ExecutionTimeConstraint with executionRate.
Example: If an ECU is 25% faster than a standard ECU (e.g., in a certain context, execution times are given assuming a nominal speed of 100 MHz; Our CPU is then 125 MHz), the executionRate is 1.25. An execution time of 5 ms would then become 4 ms on this ECU.
Notation:
Node is shown as a solid-outline rectangle with Node at the top right. The rectangle contains the name, and its ports or port groups on the perimeter.
ExecutionRate is used to compute an approximate execution time. A nominal execution time divided by executionRate provides the actual execution time to be used e.g. for timing analysis in feasibility studies.
Electrical component represents a hardware element as e.g. relays, batteries, capacitors and other non-computational, non-interactional (with plant) elements.
Semantics:
Electrical component may be active (e.g., a battery) or passive (main relay).
Notation:
ElectricalComponentis shown as a solid-outline rectangle. The rectangle contains the name, and its ports or port groups on the perimeter.
Indicates if the PowerSupply is active or passive.
Sensor represents a hardware entity for digital or analog sensor elements. The Sensor is connected electrically to the electrical entities of the Hardware Design Architecture.
Semantics:
Sensor denotes an electrical sensor. The Sensor represents the physical and electrical aspects of sensor hardware. The logical aspect is represented by an HWFunctionType associated to the Sensor.
Notation:
Sensor is shown as a Circle or oval. The circle contains the name, and its ports or port groups on the perimeter.
The Actuator is the element that represents electrical actuators, such as valves, motors, lamps, brake units, etc. Non-electrical actuators such as the engine, hydraulics, etc. are considered part of the plant model (environment). Plant models are not part of the Hardware Design Architecture.
Semantics:
The Actuator metaclass represents the physical and electrical aspects of actuator hardware. The logical aspect is represented by a HWFunctionType associated to the Actuator.
Notation:
Actuator is shown as a solid-outline rectangle with double vertical borders. The rectangle contains the name, and its ports or port groups on the perimeter.
Appear as parts of a HardwareComponentType and is itself typed by a HardwareComponentType. This allows for a reference to the occurrence of a HardwareComponentType when it acts as a part.
The purpose is to support the definition of hierarchical structures, and to reuse the same type of Hardware at several places. For example, a wheel speed sensor may occur at all four wheels, but it has a single definition.
Semantics:
The HardwareComponentPrototype represents an occurrence of a hardware element, according to the type of the HardwareComponentPrototype.
Notation:
Shall be shown in the same style as the class specified as type, however it shall be clear that this is a part.
Extension: Property
The type of the HWElement.
{derived from UML::TypedElement::type}
The AllocationTarget is a superclass for elements to which AllocateableElements can be allocated.
Semantics:
An AllocationTarget is a resource element in the Hardware Design Architecture which may host functional behaviors in the Functional Design Architecture.
Extension: abstract, no extension
The HardwarePortConnector represents a logical connector. It serves as an allocation target for connectors, i.e. the data exchanged between functions in the FunctionalDesignArchitecture.
Semantics:
The HardwarePortConnectors represents a logical connection that carries data from any sender to all receivers. Senders and receivers are identified by the connectors of the HardwarePortConnector, i.e. the associated HardwareConnectors. The available busSpeed represents the maximum amount of useful data that can be carried. The busSpeed has already deducted speed reduction resulting from frame overhead, timing effects, etc.
Extension:
Class
LogicalBusKind is an enumeration type representing different kinds of busses.
Extension:
Enumeration, no extension.
Bus is time-triggered
Bus is event-triggered
Bus is both time and event-triggered
Another type of bus communication
IOHardwarePinKind is an enumeration type representing different kinds of I/O Hardware Ports.
Extension:
Enumeration, no extension.
I/O with fixed amplitude.
I/O with varying amplitude.
PWM (Pulse Width Modulated) modulated I/O, i.e. a signal with fixed frequency and amplitude but varying duty cycle.
Another type of I/O port.
At the highest abstraction level, i.e. the vehicle level, EAST-ADL2 provides support for classification and definition of product lines (the entire vehicle for a car maker or some of its sub-systems for suppliers). The different possible configurations of the embedded electronic architecture are captured on a high abstraction level in terms of features. A feature in this sense is a characteristic or trait that individual variants of the vehicle may or may not have.
The specification of the features themselves, together with their forms of realization, the dependencies between them and the requirements to be respected for their realization is performed at the vehicle level and it should be done independently of any product line. This would be the basis for a consistent reuse of features in different product lines and projects. At this level, a feature represents particular high level requirements to be realized in all product line members that respect some conditions, e.g., US cars with elegance trim and engine size higher than 2.4.
DeviationAttributeSet specifies the set of rules of allowed deviations from the reference model in a referring model. These rules are important, because they make sure that the different FeatureModels, referring to one reference model, follow specific rules for deviation, so a later integration into one FeatureModel might be possible.
Extension:
DataType
Allows change of feature attributes.
Allows change of feature cardinality (i.e. variabilability of the feature).
Allows change of the feature description.
Allows change of the feature name.
Allows moving of the feature to another place in the feature diagram.
Reference feature fR has a child without a corresponding referring feature among the children of f.
Allows adding of a child feature (without a corresponding feature in the reference model).
Allows to regroup the respective features.
Allows the deletion of the feature in the referring model (compared to the reference model).
VehicleFeature represents a special kind of feature intended for use on the vehicle level. The main difference to features in general is that they provide support for the multi-level concept (with their DeviationAttributeSet) and several additional attributes with meta-information specific to the vehicle level viewpoint.
Constraints:
[1] VehicleFeatures can only be contained in FeatureModels on VehicleLevel.
Semantics:
A VehicleFeature is a functional or non-functional characteristic, constraint or property that can be present or not in a vehicle product line on the level of the complete system, i.e. vehicle.
Extension:
Class
A feature being a designVariabilityRationale is from the point of abstraction no real VFM feature but rather captures a variant coming up on a concrete artifact level that needs to be described on the VFM in order to be configured correctly.
If true, then isCustomerVisible = false
This attribute describes if the feature is customer visible (in contrast to a feature that is e.g. technically driven).
This attribute describes if the VFMFeature is removed (but kept in the database for tracking of evolution).
The deviation attributes belong to vehicle features that are part of a reference feature model in the context of multi-level feature models. The attribute can constrain the allowed deviation for the respective referring features.
Possible values for deviation attributes.
Semantics:
DeviationPermissionKind has no specific semantics. Further subclasses of DeviationPermissionKind will add semantics appropriate to the concept they represent.
The deviation is allowed.
The deviation is not allowed.
In case of deviation attribute "allowMove": the parent of the VehicleFeature may be changed, but the original parent must remain a predecessor (i.e. moving the VehicleFeature itself is allowed but it may only be moved further down within the same subtree).
In case of deviation attribute "allowReduction": the children of the VehicleFeature may be moved elsewhere, but they must remain successors of the VehicleFeature (i.e. moving them away is allowed but they may only be moved further down within the same subtree).
This kind is only applicable to deviation attributes "allowMove" and "allowReduction".
The name, description or other attribute may only be changed by appending text without changing the original text. This kind is only applicable to deviation attributes "allowChangeName", "allowChangeDescription" and "allowChangeAttribute".
The cardinality may only be changed such that the new cardinality is a subset of the original cardinality. This kind is only applicable to deviation attribute "allowChangeCardinality".
Feature groups may only be widened, i.e. it is only legal to add features into a feature group that were not grouped before, but not to ungroup features. This kind is only applicable to deviation attribute 'allowRegrouping'.
Dummy DataType, just added for code generation purpose.
In other words, this data type for EMF generation of SysmlPackage and SysmlFactory
java classes in the model code.
Do not remove this !!!
This section contains the UML-profile specification, specifying stereotypes in the UML-profile, defined from the metaclasses in the ADLCoreConstructs package. It includes specification details for each stereotype. If the stereotype has properties, which may be referred to as tag definitions, or if the stereotype has constraints, this section also includes specification details for these properties and constraints.
Overview:
This subprofile defines a set of abstract stereotypes which provide basic constructs to the other subprofiles. Two subprofiles are also defined, ADLTypes and ADLRelationshipModeling which are described in the following sections.
The InstanceRef DataType will be used to type attributes of type <<instanceRef>> (FaultFailure, ErrorModelPrototype, etc).
The Datatypes subpackage of EAST-ADL2 defines EAST-ADL2 general-purpose datatypes that may be used to type structural constructs in several different modeling diagrams.
The purpose of the metaclasses in the Datatypes subpackage is to specify the concepts for the specific domain.
The EADatatype is a metaclass, which signifies a type whose instances are identified only by their value. The EADatatype metaclass represents the description of the value set for some variable, parameter etc. without a description of how these possible values are represented on implementation level. The implementation representation is defined on implementation level by the AUTOSAR concept PrimitiveTypeWithSemantics, and the implemented datatype shall be associated with a Realization relationship. The realizing datatype must match the EADatatype regarding range, resolution, unit, and dimension.
Semantics:
EADatatype metaclass is a special kind of classifier, similar to a class. It differs from the class in that instances of a data type are identified only by their value.
Constraints:
[1] In the case of an AR implementation, an EADatatype is realized generally by PrimitiveTypeWithSemantics, which has to be consistent w.r.t. range, resolution, etc.
Notation:
The EADatatype is denoted using the rectangle symbol with keyword «Datatype».
The EADatatypePrototype represents a typed variable. An example is a composite datatype ColorValue with parts R, G, and B of type integer. ColorValue would contain three prototypes only to be able to reference the record parts by name. The EADatatypePrototype is also used to represent argument and return values of operations or to represent a parameter.
Semantics:
The EADatatypePrototype represents a typed variable. It acts as an occurrence of a datatype.
Extension: Property
Datatype for numerical values.
Extension: UML Datatype
The RangeableValueType is a specific datatype applicable for numerical datatypes. It describes the accuracy, resolution, and the significant digits of the baseRangeable datatypes.
Semantics:
The RangeableValueType adds the ability to describe the accuracy, resolution, and the significant digits of the baseRangeable datatype.
Notation:
The datatype RangeableValueType is denoted using the rectangle symbol with keyword «Datatype RangeableValueType».
Extension: UML Datatype
An instance of Float is an element from the set of real numbers. The value must comply with IEEE 754 and is limited to what can be expressed by a 64 bit binary representation.
Semantics:
Float has the semantics of the Float datatype as defined by IEEE Standard for Floating-Point Arithmetic (IEEE 754).
Notation:
The datatype Float is denoted using the rectangle symbol with keyword «Datatype Float».
Extension: UML PrimitiveType
A CompositeDatatype represents a non-scalar datatype. Take as an example a CompositeDatatype "MyCountries" that can refer, e.g., to an Enumeration "CountryEnumeration" {USA, Canada, Japan, EU} via two EADatatypePrototypes (record variables): FirstCountry and SecondCountry. Then an attribute typed by this CompositeDatatype "MyCountries" may have a value like: (EU (identified as FirstCountry), Japan (identified as SecondCountry)).
Semantics:
A CompositeDatatype represents a non-scalar datatype. The contained datatypePrototypes act as record variables to identify the ordered datatype instances of the tuple (the CompositeDatatype).
Notation:
The datatype CompositeDatatype is denoted using the rectangle symbol with keyword «Datatype CompositeDatatype».
Extension: UML Datatype
This section contains the UML-profile specification, specifying stereotypes in the UML-profile, defined from the metaclasses in the Infrastructure::Elements subprofile. It includes specification details for each stereotype. If the stereotype has properties, which may be referred to as tag definitions, or if the stereotype has constraints, this section also includes specification details for these properties and constraints.
Overview:
The Infrastructure::Elements subprofile of EAST-ADL2 defines general-purpose relationship constructs that may be used to model dependencies between structural constructs.
The purpose of the stereotypes in this subprofile is to specify rigorously ("formally") the various relationships that may exist between basic constructs.
The Realization is a relationship which relates two or more elements across boundaries of the EAST-ADL2 abstraction levels.
It identifies an element that serves as a specification within this realization relationship and on the other side it identifies an element that is supposed to realize this specification on a lower abstraction level or an implementation.
Semantics:
The modification of the supplier realized element impact the realizing client entity. The Realization metaclass implies the semantics that the realizing client is not complete, without the supplier.
Notation:
A Realization relationship is shown as a dashed line with a triangular arrowhead at the end that corresponds to the realized entity. The entity at the tail of the arrow (the realizing EAElement or the realizing ARElement) depends on the entity at the arrowhead (the realized EAElement).
Changes:
Renamed from Realization.
Extension: Realization
Context represents a simple and practical way to allocate TraceableSpecifications to a specific EAST-ADL2 model context, and to let this specific model context own Relationships.
Semantics:
See Relationship and TraceableSpecification.
Changes:
New class in EAST-ADL2
Extension:
The Context stereotype is an abstract stereotype which extends UML2 PackageableElement
Traceable specification(s) allocated to this context.
Relationship(s) associated to this context.
The EAElement is an abstract metaclass that represents an arbitrary named entity in the domain model. It specializes AUTOSAR Identifiable which has the shortName attribute used for identification of the element within the namespace in which it is defined.
The abbreviation EA in the name of this metaclass is short for EAST-ADL.
Semantics:
Also the EAElement can be used to extend the EAST-ADL2 approach to other languages and standards by adding a generalize relation from the respective (non EAST-ADL2) element to the EAElement.
Changes:
New class in EAST-ADL2
Extension:
The EAElement stereotype is an abstract stereotype
The Relationship is an abstract metaclass which represents a relationship between arbitrary elements.
Semantics:
In many cases, Contexts such as functions and sensors need to have requirements and other specification elements allocated them. In other cases, the relation between an element and the related specification element is specific for a certain Context: for example a Requirement on a sensor is only applicable in certain hardware architecture. These relationships are modeled by concrete specializations of Relationship.
See Context and TraceableSpecification.
Changes:
New class in EAST-ADL2
Extension:
The Relationship stereotype is abstract
The TraceableSpecification is an abstract metaclass which is used to allow its specializations to be allocated to a Context.
Semantics:
TraceableSpecification is specialized by requirements, test cases and other specifications, that there by can be allocated to a Context, for example to a sensor or to an entire HW architecture.
See Context and Relationship.
Changes:
New class in EAST-ADL2
Extension:
TraceableSpecification is a specification stereotype which extends UML2 PackageableElement
User attributes in EAST-ADL2 are primarily intended to provide a mechanism for augmenting the elements of an EAST-ADL2 model with customized meta-information. All instances of metaclass ADLEntity can have user attributes attached to them. The scope and structuring of this meta-information can be defined on a per-project basis by defining user attributes for certain types of EAST-ADL2 elements within UATemplates.
Since EAST-ADL2 requirements are in their most general form simple objects with all information contained in user-customized, project-specific attributes, the concept of user attributes is also perfectly suitable to define those attributes of requirements. In that sense, basic requirements in EAST-ADL2 can be seen as "empty" elements which only provide a node to which user attributes can be attached in order to supply the requirement with all necessary information, including its main textual description. However, in case of requirements the context in which the available user attributes are defined is different: here the container of the requirements is the point where user attribute definitions are store and these are then applicable only within this container.
The role of user attributes within the overall EAST-ADL2 is thus twofold: they (1) provide a means to customize the language to specific company and project needs and (2) constitute an important part of the requirements support of the language.
The mechanism of user attributes was optimized for flexibility and simplicity. In particular, the actual attributes attached to an element and/or their values may well conflict the attribute definitions in effect for this element. For example, it is perfectly legal to not provide an attribute value if an attribute definition was specified or, the other way round, to provide a value for an undefined attribute. The attribute definitions are merely meant as a guideline for the engineer and as a basis for optionally checking if all attribute values are correct with respect to attribute definitions (by way of appropriate tool support). With this conception of attribute values and definitions, many intricacies and difficult situations during the creation and evolution of a model are circumvented and complex interdependencies between parts of the model are avoided. For example, it is made sure that a model and all its user attribute values can be safely viewed and edited even if the attribute definitions (i.e. UATemplates) for the model are temporarily unavailable or permanently lost.
Overview:
The stereotypes defined in this subprofile provide a set of constructs to help user define their own attributes. The core construct in EAST-ADL2, the ADLEntity, inherits from UserAttributableElement stereotype so that virtually any types of EAST-ADL2 entities might be enhanced with user-defined attributes. Of course in a UML model one is allowed to add attributes to the classes and UML elements on which stereotypes are applied, yet this mechanism enables to distinguish between attributes meant to be interpreted as compliant with EASt-ADL2 language and other if any.
UserAttributeElementType represents a certain, user-defined type of user attributeable elements. With such a type, one or more user attributes can be defined for all user attributeable elements of that type.
For example, engineers at Volkswagen could create a UserAttributeElementType called "VWFunction" with a single user attribute definition. That way, all FunctionTypes for which "VWFunction" is defined as the UserAttributeElementType via association uaType will have the corresponding user attribute.
User attribute element types can be compared to stereotypes in UML2, but are less rigidly defined.
Extension:
Class
The UAElementTypes this type is inheriting from.
When UAElementType ET2 inherits from type ET1, then this means that all attributes defined for ET1 by way of UserAttributeDefinitions are available whenever ET2 is specified as the type of a user attributeable element (in addition to those directly defined in ET2). This includes UserAttributeDefinitions which ET1 itself may inherit from other types.
The attributes defined for this type.
Note that also inherited attribute definitions need to be taken into account.
UserAttributeDefinition represents a user attribute, i.e. it states that all UserAttributeableElements of a certain UserAttributeElementType are to be attached with an attribute identified by 'key'. For example, it can be specified that certain elements should be amended with an attribute "Status".
Extension:
Class, Property
UserAttributableElement represents an element to which user attributes can be attached. This is done by way of UserAttributeValues (see association 'uaValues'). What user attributes a certain element should be supplied with can be defined beforehand with UserAttributeDefinitions which are organized in UserAttributeElementTypes (see association 'uaTypes').
IMPORTANT: It is technically possible and legal to attach any key/value pair, even if this is in conflict with the attribute definitions of the UserAttributeElementTypes of this UserAttributeableElement (as defined by association 'uaTypes'). All implementations of this information model must expect such attribute definition violations. The reason for this is that (1) the attribute definitions and the types they define for the attributes are only meant as a guideline for working with user attributes on the modeling level, not as an implementation level type system and (2) this convention avoids a multitude of intricate problems when editing a model's user attribute definitions or values, which significantly simplifies implementation.
Extension:
NamedElement
The user attribute values, i.e. key-value pairs, which are attached to this element.
The UAElementTypes of this user attirbuteable element.
It is possible to provide more than one type. In that case, the UserAttributeDefinitions of all UAElementTypes apply. If there are several attribute definitions with an identical 'key', then the corresponding user attribute will be applied only once.
UserAttributeValue represents a specific value for a certain user attribute. User attributes are simple key/value pairs which can be attached to all UserAttributeableElements. Each user attribute is identified by a globally unique key.
In principle, there is no restriction which user attributes, i.e. keys, may be attached to a particular element and what strings may be used as value (cf. class UserAttributeableElement). However, user attribute definitions can be used to define a set of legal values for a particular key (see class UserAttributeDefinition) and user attribute element types can be used to state what attributes, i.e. keys, may or should be attached to elements of certain types (cf. class UserAttributeElementType).
The actual value is captured in attribute 'value' and is always represented as a string.
Extension:
Class, Property
Dummy DataType, just added for code generation purpose.
In other words, this data type for EMF generation of SysmlPackage and SysmlFactory
java classes in the model code.
Do not remove this !!!
An abstract metaclass describing the timing events and their relations within the model.
An abstract metaclass describing the timing events and their relations within the model.
TimingConstraint is an abstract entity that identifies a mode.
Constraints:
[1] upper shall be greater or equal to lower.
Semantics:
The TimingConstraint does not describe what is classically referred to as a design constraint but has the role of a property, requirement, or a validation result. It is a requirement if this TimingConstraint refines a Requirement (by the Refine relationship). The TimingConstraint is a validation result if it realizes a VVActualOutcome, it is an intended validation result if it realizes a VVIntendedOutcome, and in other cases it denotes a property.
The mode where the TimingConstraint is valid.
The collection of timing constraints and their descriptions in the form of events and event chains. This collection can be done across the EAST-ADL2 abstraction levels.
The purpose of event chains is to describe the temporal behavior of a number of steps to be taken to respond to one or more events accordingly. [An event chain is also used to express that a temporal requirement/constraint is imposed on a number of steps to respond to one or more events accordingly (-> requirement).] Such events could be observed in a given system and are categorized into stimuli and responses.
Event chains can refer to other event chains which are then called event chain segments or strands. Segments are sequential event chains refining an EventChain, while strands define parallel event chains that refine an EventChain. An EventChain can be both a segment and a strand at the same time. An event chain respectively event chain segment can be atomic which means it is not refined to other event chains.
Constraints:
[1] The cardinality of strand shall be either 0 or greater than 1. Rationale: Only values > 1 express true parallelism.
Semantics:
An EventChain references two groups of events: stimulus and response. The semantics is that each event in the stimulus group somehow causes, or at least affects the value of all events in the response group. However, since questions about causality and value influence clearly involve the semantics of the underlying structural model, this aspect of an EventChain is semantically outside its scope. Instead, delay constraint semantics are defined solely in terms of the times at which the stimulus and response events occur, independently of whether there actually exists a causal connection between these events in the structural model.
Referred EventChains that are not parallel and in sequence refines this EventChain.
The Response element is the entity to describe an event that is a response to a stimulus that occurred before.
The Stimulus element is the entity to describe an event that stimulates the steps to be taken to respond to this event.
An Event (E) is supposed to denote a distinct form of state change in a running system, taking place at distinct points in time called occurrences of the event. An event may also report a [current] state. In that case, the event occurs periodically. For example, the "driver door has been opened" is an event indicating a state change; whereas the "driver door is open" is an event reporting a state.
A running system can be observed by identifying certain forms of state changes to watch for, and for each such observation point, noting the times when changes occur. This notion of observation also applies to a hypothetical predicted run of a system or a system model from a timing perspective, the only information that needs to be in the output of such a prediction is a sequence of times for each observation point, indicating the times that each event is predicted to occur.
The occurrence of an event either stimulates an execution, or is caused by an execution [as a response to another event that occurred before]. In the first case the event is called Stimulus (S) and in the latter case it is called Response (R). Stimuli always precede responses; and responses in turn always succeed stimuli.
An event occurs instantaneously, which means that an event occurs at a time instant without any duration. In addition, an event can appear any number of times and the subsequent occurrences may follow a specific pattern, like periodic, sporadic, or in sudden bursts. Each of these occurrences has a unique time instant.
The distinction between an event and its occurrence is usually obvious from the considered context (causal and temporal). The event is not defined by its occurrences, but rather by a description expressing its purpose.
Constraints:
[1] In the case that the event reports a [current] state (isStateChange is FALSE), the event must have a periodic event model [or a pattern model]. Rationale: The [current] state shall be reported consistently and periodically.
This section describes the timing constraints.
DelayConstraints give bounds on system timing attributes, i.e. end-to-end delays, periods, etc.
A DelayConstraint can specify one or several of an upper bound, a lower bound or a nominal value and jitter. The jitter is evenly distributed around the nominal (nominal - jitter/2 .. nominal + jitter/2). The bound will be measured in a given unit.
Constraints:
[1] At least Upper or Nominal must be specified. Rationale: At least one value is needed to work with.
Semantics:
Lower (from TimingConstraint) denotes the minimum value of the given bound.
Upper (from TimingConstraint) denotes the maximum value of the given bound.
Variation around the nominal value can be expressed by means of an upper and lower bound, or by means of a jitter value.
For example, [lower=10, upper=20, nominal=15] is equal to [nominal=15, jitter=10].
Extension:
abstract, no extension
Different tolerances on over-/undersampling can be identified when the solution has been modeled.
An age constraint is of interest in control engineering when looking back through the system.
In case of over- or undersampling, there is no one-to-one relation possible between the occurrences of stimuli and responses of the associated event chain. Thus, the age constraint defines the semantic of which delay must be constrained.
The attribute upper is applicable in worst-case analysis.
The attribute lower is applicable in best-case analysis.
InputSynchronizationConstraint is a language entity that expresses a timing constraint on the input synchronization among the set of stimulus events.
Semantics:
The parameters of InputSynchronizationConstraint, see TimingConstraint, constrain the time from the first stimulus until last stimulus (i.e., maximum skew between these stimuli). A join point is identified by the response event in the scope EventChain.
Constraints:
[1] The set of FunctionFlowPorts referenced by the events should contain only FlowPorts with direction = in. The rationale for this is that the events shall relate to data on FunctionFlowPorts which is considered (or shall be) temporally consistent.
[2] The scope EventChain shall contain exactly one response Event.
[3] The semantics of this constraint requires that there is more than one stimulus Event in the scope EventChain (each refering to a different FlowPort with direction = in).
Extension: Class
The width of the sliding window.
OutputSynchronizationConstraint is a language entity that expresses a timing constraint on the output synchronization among the set of response events.
Semantics:
The parameters of OutputSynchronizationConstraint, see TimingConstraints, constrain the time from the first response until last response (i.e., maximum skew between these responses). A fork point is identified by the stimulus event in the scope EventChain.
Constraints:
[1] The set of FunctionFlowPorts referenced by the events should contain only OutFlowPorts. The rationale for this is that the events shall relate to data on FunctionFlowPorts which is considered (or shall be) temporally consistent.
[2] The scope EventChain shall contain exactly one stimulus Event.
[3] The semantics of this constraint require that there is more than one response Events in the scope EventChain.
Extension: Class
ReactionConstraint is used to impose a timing constraint on an event chain in order to specify bounds for reacting on the occurrence of a stimulus or stimuli. The intention of this constraint is to look forward in time.
Compare AgeTimingConstraint.
The Sporadic Event Constraint describes that an event occurs occasionally. In general it is supposed that the event eventually occurs. Indeed, it is also known that some of the events do not occur for whatsoever reasons.
Note! The parameters minimum inter-arrival time and maximum inter-arrival time must reference the same point in time. Typically, this is the point in time that specifies the beginning of the period subject to consideration.
The PeriodicEventConstraint describes that an event occurs periodically.
The jitter specifies the maximal possible time interval the occurrence of an event can vary (formerly: be delayed).
The period specifies the ideal time interval between two subsequent occurrences of the event.
The minimum inter-arrival time specifies the minimal possible time interval between two consecutive occurrences of an event.
The [Concrete] Pattern Event Constraint describes that an event occurs following a known pattern. The pattern event model is characterized by the following parameters:
The period specifies the time interval within the event occurs any number of times following a pattern.
The minimum inter-arrival time specifies the minimal possible time interval between two consecutive occurrences of the event within the given period.
The set occurrence (1..n) specifies the offset for each occurrence of the event in the specified period. Each occurrence is specified from the beginning of the period
The jitter specifies maximal possible time interval the occurrence of the events within the given period can vary (formerly: can be delayed).
The Arbitrary Event Model describes that an event occurs occasionally, singly, irregular or randomly. The primary purpose of this event model is to abstract event occurrences captured by data acquisition tools (background debugger, trace analyzer, etc.) during the operation of a system.
Constraints:
[1] The number of elements in the sets minimum inter-arrival time and maximum inter-arrival time must be the same. Rationale: Consistent specification of arrival times.
The set of minimum inter-arrival times specifies the minimum inter-arrival time between two and more subsequent occurrences of the event. The first element in the set specifies the minimum inter-arrival time between two subsequent occurrences of the event among the given occurrences. The second element in the set specifies the minimum inter-arrival time between three subsequent occurrences of the event among the given occurrences; and so forth.
The set of maximum inter-arrival times specifies the maximum inter-arrival time between two and more subsequent occurrences of the event. The first element in the set specifies the maximum inter-arrival time between two subsequent occurrences of the event among the given occurrences. The second element in the set specifies the maximum inter-arrival time between three subsequent occurrences of the event among the given occurrences; and so forth.
ExecutionTimeConstraint expresses the execution time of a function under the assumption of a nominal CPU that executes 1 "function second" per second. Function allocation will decide the actual execution time by multiplication with the relative speed of the host CPU.
Example:
The ECU is 20% faster than a standard ECU (e.g. in a certain context, execution times are given assuming a nominal speed of 100 MHz; Our CPU is then 120 MHz)
The function is activated by a time trigger or a port trigger. The function starts execution some time after activation, depending on e.g. interference and blocking from other functions on the same resource
Immediately on start, the function reads input data on all ports. Functions write data at the latest when the execution time has elapsed (which is after the execution time plus any blocking and interference time).
Constraints:
[1] An ExecutionTimeConstraint either identifies a FunctionType or a FunctionPrototype as its target function.
[2] variation shall be a value between 0 and upper-lower.
Semantics:
lower (from TimingConstraint) denotes the minimal best case execution time.
upper (from TimingConstraint) denotes the maximal worst case execution time.
variation denotes the allowed variation in execution time, i.e. maximal minimal execution time.
Example:
lower=5
upper=10
variation=2
best case execution time of 6 and worst case of 7 is within this constraint
best case execution time of 6 and worst case of 9 violates this constraint
If a measured value is characterized, variation is not used, as it is always upper-lower, e.g. lower=6 and upper=9 above. In this example, the ExecutionTimeConstraint would be a Realization of a VVActualOutcome.
This section describes the concept of events for EAST-ADL2.
Event that refers to the triggering of the Function at a flow port, i.e., when data is sent or received.
Event that refers to the triggering of the Function at a client/server port, i.e., when the input data is sent / received, or when the output data is produced / received.
Constraints:
[1] eventKind is sentRequest or receivedResponse for a FunctionClientServerPort of type client. Rationale: Only these values make sense for client ports.
[2] eventKind is receivedRequest or sentResponse for a FunctionClientServerPort of type server. Rationale: Only these values make sense for server ports.
Possible values of eventKind.
Extension:
Enumeration, no extension.
An event of a Function refers to the triggering of the Function, i.e., when the input data is consumed, data transformation is performed on that input data by the function, and output data is produced. It is used in conjunction with FunctionTrigger (see that concept) to define a time-driven triggering for a function. In this case the FunctionTrigger points to the EventFunction of the function and defines a triggerPolicy set to TIME. The timing constraint associated to the EventFunction provides information about the period.
Compare categories of AUTOSAR runnables:
1a triggering only on start and finish (this type of event)
1b triggering allowed anytime during the execution (events on ports, see EventInFlowPort)
Constraints:
[1] An EventFunction either identifies a FunctionType or a FunctionPrototype as its target function.
The Environment model is used to describe the environment of the vehicle electric and electronic architecture. It is modeled by continuous functions representing the system environment.
The collection of the environment functional description. This collection can be done across the EAST-ADL2 abstraction levels.
An environment model can contain functionPrototypes given by either AnalysisFunction or DesignFunction. The environment model does not have abstraction levels as in the system model (e.g., analysisLevel, designLevel).
A functionPrototype of the environment model can have interactions with FAA FunctionalDevice and an FDA HardwareFunction through the ClampConnector.
The clamp connector connects ports across function boundaries and containment hierarchies. It is used to connect from an EnvironmentModel to the FunctionalAnalysisArchitecture, the FunctionalDesignArchitecture, the autosarSystem or another EnvironmentModel. Typically, the EnvironmentModel contains physical ports, which restrict the valid ports in the FunctionalAnalysisArchitecture to those on FunctionalDevices and in the FunctionalDesignArchitecture to those on HardwareFunctions. In case the connection concerns logical interaction, this restriction does not apply. The ClampConnector is always an assembly connector, never a delegation connector.
Constraints:
[1] Can connect two FunctionFlowPorts of different direction.
[2] Can connect two ClientServerPorts of different kind.
[3] Can connect two FunctionFlowPorts with direction inout.
[4] Cannot connect ports in the same SystemModel.
Dependability of a system is the ability to avoid service failures that are more frequent and more severe than is acceptable. Dependability includes several aspects, namely Availability, Reliability, Safety, Integrity and Maintainability. The Dependability package includes support for defining and classifying safety requirements through preliminary Hazard Analysis Risk Assessment, tracing and categorizing safety requirements according to role in safety life-cycle, formalizing safety requirements using safety constraints, formalizing and assessing fault propagation through error models and organizing evidence of safety in a Safety Case.
The support for safety is designed to support the automotive standard for Functional Safety, ISO/DIS 26262.
The EAST-ADL2 sub-package for error modeling provides support for safety engineering by representing possible, incorrect behaviors of a system in its operation (e.g., component errors and their propagations).
Abnormal behaviors of architectural elements as well as their instantiations in a particular product context can be represented, forming a basis for safety analysis through external techniques and tools. Through the integration with other language constructs, definitions of error behaviors and hazards can be traced to the specifications of safety requirements, and further to the subsequent functional and non-functional requirements on error handing and hazard mitigations as well as to the necessary V&V efforts.
Error behaviors are treated as a separated view, orthogonal to the nominal architecture model. This separation of concern in modeling is considered necessary in order to avoid some undesired effects of error modeling, such as the risk of mixing nominal and erroneous behavior in regards to the comprehension, reuse, and system synthesis (e.g., code generation).
ErrorBehavior represents the descriptions of failure logics or semantics that the target element identified by the ErrorModelType exhibits. Typically the target is a system, a function, a software component, or a hardware device.
Each ErrorBehavior description relates the occurrences of internal faults and incoming external faults to failures. The faults and failures that the errorBehavior propagated to and from the target element are declared through the ports of the error model.
Semantics:
ErrorBehavior defines the error propagation logic of its containing ErrorModelType.
The ErrorBehavior description represents the error propagations from internal faults or incoming faults to external failures. Faults are identified by the internalFault and externalFault associations respectively. The propagated failures are identified by the externalFailure association.
The ErrorBehavior is defined in the failureLogic string, either directly or as a url referencing an external specification.
The failureLogic can be based on different formalisms, depending on the analysis techniques and tools available. This is indicated by its type:ErrorBehaviorKind attribute. The failureLogic attribute contains the actual failure propagation logic.
Extension:
UML:Behavior
The error logic description based on an external formalism or the path to the file or model entity containing the external error logic description.
The type of formalism applied for the error behavior description.
The occurrences of internal faults.
The ErrorBehaviorKind metaclass represents an enumeration of literals describing various types of formalisms used for specifying error behavior.
Semantics:
ErrorBehaviorKind represents different formalisms for ErrorBehavior. The semantics is defined at each enumeration literal.
Extension:
Enumeration, no extension.
The InternalFault metaclass represents the particular internal conditions of the target component/system that are of particular concern for its fault/failure definition.
Semantics:
The system anomaly represented by an InternalFault, which when activated, can cause errors and failures of the target element.
Extension:
UML::Part / UML::Event
The FaultFailurePropagationLink metaclass represents the links for the propagations of faults/failures across system elements. In particular, it defines that one error model provides the faults/failures that another error model receives.
A fault/failure link can only be applied to compatible ports, either for fault/failure delegation within an error model or for fault/failure transmission across two error models. A FaultFailurePropagationLink can only connect fault/failure ports that have compatible types.
Constraints:
[1] Only compatible fromPort-toPort pairs may be connectedNo additional constraints
[2] Two fault/failure ports are compatible if the EADatatype of the fromPort represents a subset of the Fault/Failure set represented by the toPort’s EADatatype.
Semantics:
The FaultFailurePropagationLink defines a Failure propagation path, from the fromPort on one error model to the toPort of another error model.
Extension:
UML::Connector
ErrorModelType and ErrorModelPrototype support the hierarchical composition of error models based on the type-prototype pattern also adopted for the nominal architecture composition. The purpose of the error models is to represent information relating to the anomalies of a nominal model element.
An ErrorModelType represents the internal faults and fault propagations of the nominal element that it targets.
Typically the target is a system/subsystem, a function, a software component, or a hardware device.
ErrorModelType inherits the abstract metaclass TraceableSpecification, allowing the ErrorModelType to be referenced from its design context in a similar way as requirements, test cases and other specifications.
Constraints:
An ErrorModelType without part shall have one errorBehaviorDescription
Semantics:
The ErrorModelType represents a specification of the faults and fault propagations of its target element.
Both types and prototypes may be targets, and the following cases are relevant:
- One nominal type:
The ErrorModelType represents the identified nominal type wherever this nominal type is instantiated.
- Several nominal types:
The ErrorModelType represents the identified nominal types individually, i.e. the same error model applies to all nominal types and is reused.
- One nominal prototype:
The ErrorModelType represents the identified nominal prototype whenever its context, i.e. its top-level composition is instantiated.
- Several nominal prototypes with instanceref:
The ErrorModelType represents the identified set of nominal prototypes (together) whenever their context, i.e. their top-level composition is instantiated.
The fault propagation of an errorModelType is defined by its contained parts, the ErrorModelPrototypes and their connections. In case it contains both parts and an errorBehaviorDescription, the errorBehaviorDescription shall be consistent with the parts.
FaultFailurePropagationLinks define valid propagation paths in the ErrorModelType. In case the contained FaultInPorts and FailureOutPorts reference nominal ports, the connectivity of the nominal model may serve as a pattern for connecting ports in the ErrorModelType.
The ErrorModelType contains internalFaults and externalFaults, representing faults that are either propagated to externalFailures or masked, according to the definition of its fault propagation.
A processFault represents a flaw introduced during design, and may lead to any of the failures represented by the ErrorModelType. A processFault thus has a direct propagation to all externalFailures and cannot be masked.
Extension:
(see ADLTraceableSpecfication)
The links for the error propagations between subordinate error models.
{derived from UML::StructuredClassifier::ownedConnector}
{derived from UML::Classifier::attribute}
ErrorModelType and ErrorModelPrototype support the hierarchical composition of error models based on the type-prototype pattern also adopted for the nominal architecture composition. The purpose of the error models is to represent information relating to the anomalies of a nominal model element.
The ErrorModelPrototype is used to define hierarchical error models allowing additional detail or structure to the error model of a particular target. A hierarchal structure can also be defined when several ErrorModels are integrated to a larger ErrorModel representing a system integrated from several targets.
Typically the target is a system/subsystem, a function, a software component, or a hardware device.
Semantics:
An ErrorModelPrototype represents a unique compositional occurrence of the ErrorModelType that types it in the containing ErrorModelType.
Extension:
(See ADLFunctionPrototype)
{derived from UML::TypedElement::type}
The FailureOutPort represents a propagation point for failures that propagate out from the containing ErrorModelType.The EADatatype of the FailureOutPort defines the range of valid failures.
Constraints:
[1] The direction of the nominal port must be out.
Semantics:
The value range of a FailureOutPort represents failures that can propagate to FaultInPorts in other ErrorModels. The value range is defined by the FailureOutPort’s EADatatype.
If nominal Ports HWTargets or FunctionTargets are referenced, the failures of the FailureOutPort correspond to data on these nominal ports.
Extension:
UML::Port
The FaultInPort represents a propagation point for faults that propagate to the containing ErrorModelType. The EADatatype of the FaultInPort defines the range of valid failures.
Constraints:
[1] The direction of the nominal port must be in.
Semantics:
The value range of a FaultInPort represents faults propagated from a FailureOutPort in another ErrorModel. The value range is defined by the FaultInPort’s EADatatype.
If nominal Ports HWTarget or FunctionTarget are referenced, the faults on the FaultInPort.
Extension:
UML::Port
The Anomaly metaclass represents a Fault that may occur internally in an ErrorModel or being propagated to it, or a failure that is propagated out of an Error Model. The anomaly may represent different faults or failures depending on the range of its EADatatype. Typically, the EADatatype is an Enumeration, for example:
BrakeAnomaly:
- BrakePressureTooLow
Semantics="brake pressure is below 20% of requested value"
- Omission
Semantics="brake pressure is below 10% of maximal brake pressure"
- Comission
Semantics="brake pressure exceeds requested value with more than 10% of maximal brake pressure"
Semantics may also be a more formal expression defining in the type of the nominal datatype what value range is considered a fault. This depends on the user and tooling available.
Semantics:
An anomaly refers to a condition that deviates from expectations based on requirements specifications, design documents, user documents, standards, etc., or from someone's perceptions or experiences (ISO26262). The set of available faults or failures represented by the Anomaly is defined by its EADatatype, typically an enumeration type like {omission, commission}. It is an abstract class further specialized with metaclasses for different types of fault/failure.
Extension:
(UML::Part)
The ProcessFaultPrototype metaclass represents the anomalies that the target component/system can have due to design or implementation flaws (e.g., incorrect requirements, buffer size configuration, scheduling, etc.).
Semantics:
The ProcessFaultPrototype metaclass represents the anomalies that the target component/system can have due to design or implementation flaws (e.g., incorrect requirements, buffer size configuration, scheduling, etc.).
Extension:
UML::Part / UML::Event
This subprofile defines a set of stereotypes concerning the definition of safety requirements inked to ISO26262 norm.
Overview:
This subprofile defines a set of stereotypes concerning the definition of safety requirements linked to the ISO26262 norm.
FunctionalSafetyConcept represents the set of functional safety requirements that together fulfils a SafetyGoal in accordance with ISO 26262.
To comply with the SafetyGoals, the FunctionalSafetyConcept specifies the basic safety mechanisms and safety measures in the form of functional safety requirements.
Constraints:
[1] Contained functionalSafetyRequirements shall not be of type SafetyGoal.
Semantics:
The collection of requirements in the FunctionalSafetyConcept defines the requirements necessary to make the Item safe. The requirements are abstract and do not specify technical details.
SafetyGoal represents the top-level safety requirement defined in ISO26262. Its purpose is to define how to avoid its associated HazardousEvents, or reduce the risk associated with the hazardous event to an acceptable level.
The SafetyGoal is defined through one or several associated requirement elements.
An ASIL shall be assigned to each SafetyGoal, to represent the integrity level at which the SafetyGoal must be met.
Similar SafetyGoals can be combined into one SafetyGoal. If different ASILs are assigned to similar SafetyGoals, the highest ASIL shall be assigned to the combined SafetyGoal.
For every SafetyGoal, a safe state should be defined, either textually or by referencing a specific mode. The safe state is a system state to be maintained or to be reached when a potential source of its hazardous event is detected.
Semantics:
SafetyGoal represents a safety Goal according to ISO26262. Requirements define the SafetyGoal and HazardousEvents identify the responsibility of each SafetyGoal. hazardClassification defines the integrity classification of the SafetyGoal and safeStates may be defined by a string or formalized through associated Modes.
Notation:
SafetyGoal is a box with text SafetyGoal at the top left.
Extension:
Class
TechnicalSafetyConcept represents the set of technical safety requirements that together fulfils a FunctionalSafetyConcept and SafetyGoal in accordance with ISO 26262.
These are derived from FunctionalSafetyConcepts i.e. TechnicalSafetyRequirements are derived from FunctionalSafetyRequirements.
Semantics:
The TechnicalSafetyConcept consists of the technical safety requirements and details the functional safety concept considering the functional concept and the preliminary architectural design. It corresponds to the Technical Safety Concept of ISO26262.
technicalSafety Requirements.
Safety is a property of a system that is difficult to verify quantitatively since no clear measurement method exists that can be applied during the development. Not even exhaustive testing is feasible, as faults in electronics can have an intensity of 10^-9 faults/hour and still pose an unacceptable risk. Hence, it is only when enough field data have been collected from a system used in a particular context that it can be said to be safe enough. Nonetheless, safety must be addressed and assessed during development; restricted to qualitative reasoning about the safety of a product. A structured engineering method is thus needed to approach this problem. One such method is the so called safety case, which came originally from the nuclear industry.
SafetyCase represents a safety case that communicates a clear, comprehensive and defensible argument that a system is acceptable safe to operate in a given context.
Safety Cases are used in safety related systems, where failures can lead to catastrophic or at least dangerous consequences.
Attached SafetyCases
The SafetyCase should be initiated at the earliest possible stage in the safety program so that hazards are identified and dealt with while the opportunities for their exclusion exist.
The LifecycleStageKind is an enumeration metaclass with enumeration literals indicating safety case life cycle stage.
Semantics:
The safety case is one incremental safety case, rather than several complete new ones. The safety case lifecycle stage has the following meanings:
- The preliminary safety case is started when development of the system is started. After this stage discussions with the customer can commence about possible safety issues (hazards).
- The interim safety case is situated after the first system design and tests.
- The operational safety case is prior to in-service use.
Extension:
Enumeration, no extension.
Claim is based on Grounds (evidences) - specific facts about a precise situation that clarify and make good the Claim.
Ground represents statements that explain how the SafetyCase Ground clarifies and make good the Claim.
Ground has associations to the entities that are the evidences in the SafetyCase.
Semantics:
Ground (evidence) is information that supports the Claim that the safety requirements and objectives are met i.e. used as the basis of the safety argument.
Solution is evidence that the sub-goals have been met. This can be achieved by decomposing all goal claims to a level where direct reference to evidences was felt possible.
The evidences address different aspects of the goal. It always has to be ensured that each of them is defensible enough to confirm the underlying statement.
Safety evidence in system model.
Warrant represents argumentation of the facts to the Claim in general ways.
The Warrant entity has associations to the decomposed goals and to the evidences for the SafetyCase.
Semantics:
The overall objective of an argument is to lead the evidence to the claim.
Arguments are actions of inferring a conclusion from premised propositions. An argument is considered valid if the conclusion can be logically derived from its premises. An argument is considered sound if it is valid and all premises are true.
A goal decomposition strategy breaks down a goal into a number of sub-goals. It is recommended that the strategies are of specific form.
Claim represents a statement the truth of which needs to be confirmed.
Claim has associations to the strategy for goal decomposition and to supported arguments. It also holds associations to the evidences for the SafetyCase.
Semantics:
Goal-based development provides the claim what should be achieved.
Goal is what the argument must show to be true.
Safety requirements and objectives in system model.
The ASILKind is an enumeration metaclass with enumeration literals indicating the level of safety integrity in accordance with ISO26262.
Semantics:
The semantics is defined at each enumeration literal and fully defined in the ISO26262 standard.
Extension:
Enumeration, no extension.
ASIL A, Lowest Safety Integrity Level.
ASIL D, Highest Safety Integrity Level.
ASIL C, second highest Safety Integrity Level.
ASIL B, second lowest Safety Integrity Level.
Quality Management only, no requirement according to ISO 26262.
The FaultFailure represents a certain fault or failure on its referenced Anomaly. The faultFailureValue specifies the value of the Anomaly that the FaultFailure corresponds to, i.e. one of the possible values of the Anomaly.
Semantics:
A FaultFailure is defined as a certain value, faultFailureValue, occurring at the referenced Anomaly.
The SafetyConstraint metaclass represents the qualitative integrity constraints on a fault or failure. Thus, the system has same or better performance with respect to the constrained fault or failure, and depending on the role this is either a requirement or a property.
Semantics:
A SafetyConstraint defines qualitative bounds on the constrainedFaultFailure in terms of safety integrity level, asilValue.
Depending on role, the SafetyConstraint may define a required or an actual safety integrity level.
Extension:
(see ADLTraceableSpecification)
The QuantitativeSafetyConstraint metaclass represents the quantitative integrity constraints on a fault or failure. Thus, the system has same or better performance with respect to the constrained fault or failure, and depending on the role this is either a requirement or a property.
Semantics:
A QuantitativeSafetyConstraint provides information about the probabilistic estimates of target faults/failures, further specified by the failureRate and repairRate attribute.
Extension:
(see ADLTraceableSpecification)
The SeverityClassKind is an enumeration metaclass with enumeration literals indicating the severity attributes S0, S1, S2 or S3 in accordance with ISO26262.
Semantics:
The semantics is defined at each enumeration literal and fully defined in the ISO26262 standard.
Extension:
Enumeration, no extension.
No injuries.
Light and moderate injuries
Severe and life-threatening injuries (survival probable)
Life-threatening injuries (survival uncertain), fatal injuries
The ExposureClassKind is an enumeration metaclass with enumeration literals indicating the probability attributes E1, E2, E3 or E4 in accordance with ISO26262.
Semantics:
The semantics is defined at each enumeration literal and fully defined in the ISO26262 standard.
Extension:
Enumeration, no extension.
Rare events
Situations that occur less often yhan once a year for the great majority of drivers
Sometimes
Situations that occur a few times a year for the great majority of drivers
Quite often
Situations that occur once a month or more often for an average driver
Often
All situations that occur during almost every drive on average
The ControllabilityClassKind is an enumeration metaclass with enumeration literals indicating controllability attributes C0, C1, C2 or C3 in accordance with ISO26262.
Semantics:
The semantics is defined at each enumeration literal and fully defined in the ISO26262 standard.
Extension:
Enumeration, no extension.
Simply controllable
Normally controllable
Difficult to control or uncontrollable
Controllable in general
DevelopmentCategoryKind in an enumeration with enumeration literals indicating whether the item is a modification of an existing item or if it is a new development.
Semantics:
The semantics is defined at each enumeration literal and fully defined in the ISO26262 standard.
Extension:
Enumeration, no extension.
In case of a modification the relevant lifecycle sub-phases and activities shall be determined.
In case of a new development, the entire lifecycle shall be passed through.
The Item entity identifies the scope of safety information and the safety assessment, i.e. the part of the system onto which the ISO26262 related information applies. Safety analyses are carried out on the basis of an item definition and the safety concepts are derived from it.
Semantics:
Item represents the scope of safety information and the safety assessment trough its reference to one or several Features.
Extension:
UML::Class
It shall be determined whether the item is a modification of an existing item or if it is a new development.
FeatureFlaw denotes an abstract failure of a set of items, i.e. an inability to fulfill one or several of its requirements.
Semantics:
FeatureFlaw represents functional anomalies derivable from each foreseeable source. nonFulfilledRequirements identifies those requirements that corresponds to the FeatureFlaw.
Extension:
UML::Class
The Hazard represents a condition or state in the system that may contribute to accidents. It is usually a failure of some kind, but may also be a result of nominal operation.
The Hazard does not address hazards as electric shock, fire, smoke, heat, radiation, toxicity, flammability, reactivity, corrosion, release of energy, and similar hazards unless directly caused by malfunctioning behaviour of E/E safety related systems..
The Hazard metaclass is contained in the context, as Hazard specializes ADLTraceableSpecification. The context describes the element of the system where this hazard occur.
The HazardousEvent metaclass represents a combination of a Hazard and a specific situation, the latter being characterized by operating mode and operational situation in terms of a particular use case, environment and traffic.
Semantics:
The HazardousEvent denotes a combination of a Hazard and an operational situation. The controllability and severity attributes shall be consistent with the operational situation and operational scenario, and the Exposure shall reflect the likelihood of the operational situation and scenario.
Notation:
The Hazard is shown as a solid-outline rectangle with "Haz" at the top right. It contains the name of the Hazard and optionally the name of the source entity.
Extension:
UML::Class
Dummy DataType, just added for code generation purpose.
In other words, this data type for EMF generation of SysmlPackage and SysmlFactory
java classes in the model code.
Do not remove this !!!
The stakeholder represents various roles with regard to the creation and use of architectural descriptions. Stakeholders include clients, users, the architect, developers, and evaluators. [IEEE 1471]
Stakeholder needs represent a list of the key problems as perceived by the stakeholder, and it gives the opportunity to establish traceability from artifacts created later, for example to provide rationales to design decisions or trade-off analysis.
The problem statement represents a brief statement summarizing the problem being solved which gives the opportunity to establish traceability from artifacts created later, for example to provide rationales to design decisions or trade-off analysis.
The problem statement could be extended with further modeling of dependencies between different problems and deduction of root problems
The problem positioning represents an overall brief statement summarizing, at the highest level, the unique position the product intends to fill in the marketplace which gives the opportunity to establish traceability from artifacts created later, for example to provide rationales to design decisions or trade-off analysis.
Positioning is assumed to belong to a particular context, typically a system, but also for a smaller part of a system.
The business opportunity represents a brief description of the business opportunity being met by developing the EE-System which establishes traceability from artifacts created later, for example to provide rationales to design decisions or trade-off analysis.
An abstract or general idea inferred or derived from specific instances. [Webster]
A mission is a use or operation for which a system is intended by one or more stakeholders to meet some set of objectives. [IEEE 1471]
A collection of components organized to accomplish a specific function or set of functions. [IEEE 1471]
The fundamental organization of a system embodied in its components, their relationships to each other, and to the environment, and the principles guiding its design and evolution. [IEEE 1471]
A collection of products to document an architecture. [IEEE 1471]
A view may consist of one or more architectural models. Each such architectural model is developed using the methods established by its associated architectural viewpoint. An architectural model may participate in more than one view. [IEEE 1471]
The GenericConstraint denotes a property, requirement, or a validation result for the identified element of the model. The kind of GenericConstraint is described as one of the GenericConstraintKind literals.
Example: If the attribute genericConstraintType is cableLength, the genericConstraintValue could be "5 meters" (value of a numerical datatype with unit "meters").
Semantics:
The GenericConstraint does not describe what is classically referred to as a design constraint but has the role of a property, requirement, or a validation result. It is a requirement if this GenericConstraint refines a Requirement (by the Refine relationship). The GenericConstraint is a validation result if it realizes a VVActualOutcome, it is an intended validation result if it realizes a VVIntendedOutcome, and in other cases it denotes a property.
Extension: Class, Constraint
The specific type of design constraint.
Enumeration for different type of constraints.
The collection of generic constraints. This collection can be done across the EAST-ADL2 abstraction levels.