This document shows a system architecture
and software architecture for a mouse droid.
This is a small repair droid similar to the MSE-6 used on death star 1.
The document follows the arc42.org template
proposed by Gernot Starke and Peter Hruschka,
Copyright 2020-2023 Andreas Warnke
License:
Choose either Apache-2.0
or Creative Commons Attribution (BY) Licence
Introduction C0001
The mouse droid is a repair droid.
When programmed,
it autonomously drives to the destination location,
selects spare parts and tools
and exchanges damaged parts.
It is easily reprogrammable and can therefore also be used for
- cleaning tasks
- spying and surveillance tasks
- message delivery
Scope C0141
This document describes system and software architecture for engineering generation 5 of the mouse droid, denoted by the term MoD5G.
This section gives a short overview on the project goals (Problem Space, System Level L1)
Primary purpose of the MoD5G is to autonomously repair mechanical things.
Mouse Droid MoD5G C0004
The Mouse Droid (MoD5G) is a repair droid that can be instructed to perform a mission and which then autonomously selects tactics to achieve the mission goals.
--> Perform a 1-day Mission R0001
--> Drive to Location R0003
--> Use Tools R0004
Commander C0005
The commander instructs the MoD5G on the mission to perform.
plan mission --> Perform a 1-day Mission R0002
provide mission goals and high-level strategy
Perform a 1-day Mission C0006
The mouse droid is able to perform a mission that takes several hours. The energy resources of the MoD5G last for up to one terrestrial day.
- The commander programs a mission
- The mouse droid drives to the first location
- The mouse droid uses tools to remove a defective part
- The mouse droid installes a spare part
- Above steps are repeated for other goals
- The mouse droid returns to its base location (see Glossary)
--> Drive to Location R0005
--> Use Tools R0006
Drive to Location C0007
The mouse droid can explore its environment and calculate a route from its actual position to the target location.
- The mouse droid explores its environment
- The mouse droid enriches an internally memorized map
- The mouse droid calculates a route
- The mouse droid drives along the calculated route
- The mouse droid re-caclulates the route in case of new environment data
- The mouse droid reaches the target location
Use Tools C0008
The mouse droid has a couple of tools inside its chassis.
- The mouse droid uses a screw diver to untighten damaged parts
- The mouse droid uses a gripper to move the damaged part out of the way
- The mouse droid uses a gripper to put a spare part from its internal cargo bin to the target place
- The mouse droid uses a screw diver to tighten replaced parts
- The mouse droid uses a gripper to move the damaged part into its internal cargo bin.
(see Mechanics)
This diagram shows examples of system level L1 requirements.
Drive to Location C0007
The mouse droid can explore its environment and calculate a route from its actual position to the target location.
- The mouse droid explores its environment
- The mouse droid enriches an internally memorized map
- The mouse droid calculates a route
- The mouse droid drives along the calculated route
- The mouse droid re-caclulates the route in case of new environment data
- The mouse droid reaches the target location
Use Tools C0008
The mouse droid has a couple of tools inside its chassis.
- The mouse droid uses a screw diver to untighten damaged parts
- The mouse droid uses a gripper to move the damaged part out of the way
- The mouse droid uses a gripper to put a spare part from its internal cargo bin to the target place
- The mouse droid uses a screw diver to tighten replaced parts
- The mouse droid uses a gripper to move the damaged part into its internal cargo bin.
(see Mechanics)
L1Req: Recognize paths C0149
The MoDG5 shall use redundant sensor data to calculate paths that it can drive along.
--> Drive to Location R0244
L1Req: Position screw driver C0150
The MoDG5 shall bring the screw driver into a given 3D position.
--> Use Tools R0245
This section explains the major obstacles that need to be considered when designing a solution that addresses the project goals. (Problem Space, System Level L1)
Operating Temperatures C0003
The droid shall be fully functional in the range 240K..360K, it shall survive temperatures from 200K to 400K.
Cosmic Rays C0002
The droid shall ensure data and program integrity.
It shall continue operation after cosmic rays have interfered with data storage or program execution.
Corrupted data must not be stored permanently.
constraint: environment: F0030
Environmental Constraints C0144
This package lists technical/physical constraints imposed by the environment in which to operate.
--> Cosmic Rays R0221
--> Operating Temperatures R0222
Group of constratins imposed by the operation environment
This section shows the organizational contexts of development and operational environments. (Problem Space, System Level L1)
Development and Production Context C0088
This boundary encompasses the topics that are in scope during development and production.
--> Electrical Engineering R0188
--> Design Hardware R0187
--> Develop Software R0125
--> Build Droids R0124
Operational Context C0089
This boundary encompasses the topics that are in scope during operation and maintenance.
--> Repair Droid R0127
--> Operate Droid R0126
Build Droids C0090
At the factory, workers assemble hardware and electronic parts to mouse droids and integrate control logic and data.
Develop Software C0091
A team of engineers designs, produces and tests the control logic and factory data of the droids.
Operate Droid C0092
An operator/commander instructs the mouse droid which mission to perform. The logic of the mouse droid translates this mission into driving maneuvers and actions of the integrated tools.
Repair Droid C0093
A service mechanic analyzes the health state of a mouse droid. Depending on the outcome, oil is refilled, logic is updated, parts are exchanged or the whole droid is disintegrated.
Design Hardware C0135
A team of engineers designs, produces and tests the mechanical hardware parts of the droids.
Electrical Engineering C0136
A team of engineers designs, produces and tests the electrical and electronic parts of the droids.
This section shows the fundamental base principle of the system design. (Solution Space, System Level L1)
Electrical Parts and Electronics C0019
The main components of the electric parts are:
- a set of cables and connectors
- a set of sensors and actuators
- the energy cell
- two printed circuit boards (PCB) containing the electronic parts
--> Base Logic Board R0048
--> Main Logic Board R0047
Base Logic Board C0048
The base logic board consists of several electronic parts shown in Base Logic Board.
Main Logic Board C0047
The main logic board consists of several electronic parts shown in Main Board Logic.
Base Board Connector: F0008
Camera: LVDS: F0001
Mic-Connector: I2S: F0002
Outer World C0094
The main logic
addresses the following tasks:
- calculating movement actions
to be performed by base logic (tactics)
- evaluating sensor signals
from microphone and camera
--> Main Logic Board R0184
Guiding Main Principles C0116
The functions of the MoD5G are divided
onto two logic boards.
The base logic
gets local sensor information
and controls things within
the system boundary of the MoD5G.
The main logic
gets sensor data of the environment
and calculates movement actions
to efficiently fulfill the mission
(that was programmed before).
Inner World C0117
The base logic addresses the following tasks:
- charging
- programming
- steering the motors
- self-check
If a list of actions is available,
this logic board can steer the MoD6G
without the help of the main logic board.
--> Base Logic Board R0183
This section shows the parts of the MoD5G system (Solution Space, System Level L1)
Mechanical Parts C0018
The mechanical parts encompass all parts of which the mouse droid consists.
From outside, the chassis and wheels are the most obvious parts.
Inside, a skeleton frame provides stability of the assembly.
Important charactereistics are weight, operating temperature range, durability, stability.
--> Electrical Parts and Electronics R0013
Electrical Parts and Electronics C0019
The main components of the electric parts are:
- a set of cables and connectors
- a set of sensors and actuators
- the energy cell
- two printed circuit boards (PCB) containing the electronic parts
Software Parts C0020
The software consists of control logic, initial data that was integrated at the factory and learned data that is aggregated during operation.
These software items are split over two logical boards and subdivided into independent execution partitions.
--> Electrical Parts and Electronics R0243
This section shows the mechanical parts of the MoD5G system (Solution Space, System Level L2)
Chassis C0035
--> Skeleton Frame R0228
--> Tool-Window (2) R0065
--> Gripper R0064
--> Cargo Bin R0034
--> Microphone R0040
--> Energy Cell R0044
--> Programming and Diagnostic Connector R0042
--> Motors R0038
--> Loud Speaker R0041
--> Charging Connector R0043
--> Camera R0039
--> Wheels (4) R0036
--> Fan R0037
--> Screw Driver R0035
--> Electrical Parts and Electronics R0046
Cargo Bin C0036
protected by --> Tool-Window (2) R0224
Screw Driver C0037
protected by --> Tool-Window (2) R0225
Wheels (4) C0038
Fan C0039
A fan prevents overheating in hot environment conditions.
Motors C0040
Camera C0041
Microphone C0042
Loud Speaker C0043
Programming and Diagnostic Connector C0044
protected by --> Tool-Window (2) R0226
Charging Connector C0045
Energy Cell C0046
Mechanical Parts C0018
The mechanical parts encompass all parts of which the mouse droid consists.
From outside, the chassis and wheels are the most obvious parts.
Inside, a skeleton frame provides stability of the assembly.
Important charactereistics are weight, operating temperature range, durability, stability.
--> Electrical Parts and Electronics R0013
--> Chassis R0045
Electrical Parts and Electronics C0019
The main components of the electric parts are:
- a set of cables and connectors
- a set of sensors and actuators
- the energy cell
- two printed circuit boards (PCB) containing the electronic parts
Gripper C0054
A tool that allows to grab objects and move them.
protected by --> Tool-Window (2) R0223
Tool-Window (2) C0055
A tool window is a flap in the chassis that protects screw driver, gripper and cargo bin when unused. It can be opened and closed by a motor.
Skeleton Frame C0146
The skeleton frame provides stability to the assembly of parts. Anchorage points latch the assembled parts at their positions.
This section shows the electric parts and electronics of the MoD5G system (Solution Space, System Level L2)
Electrical Parts and Electronics C0019
The main components of the electric parts are:
- a set of cables and connectors
- a set of sensors and actuators
- the energy cell
- two printed circuit boards (PCB) containing the electronic parts
--> Base Logic Board R0048
--> Main Logic Board R0047
Energy Cell C0046
power --> PMIC R0050
Loud Speaker C0043
Camera C0041
--> Main Logic Board R0051
Microphone C0042
audio --> Main Logic Board R0056
Motors C0040
Charging Connector C0045
--> PMIC R0057
Programming and Diagnostic Connector C0044
service ctrl --> Base Micro Controller R0061
Main Logic Board C0047
The main logic board consists of several electronic parts shown in Main Board Logic.
Base Board Connector: F0008
Camera: LVDS: F0001
Mic-Connector: I2S: F0002
status and control --> Base Micro Controller R0068
Base Logic Board C0048
The base logic board consists of several electronic parts shown in Base Logic Board.
--> Base Micro Controller R0053
--> PMIC R0049
PMIC C0049
Power Management Integrated Circuit
power --> Main Logic Board R0063
Base Micro Controller C0051
The base micro controller consists of
- logic unit
- data storage
- persistent data+logic storage
- self supervision (by ECC and lockstep-cores)
- HW watchdog
- clock
- temperature sensor
- io ports
This block is optimized for providing a reliable execution of algorithms, see Quality Requirements.
Temperature: sensor: F0010
clock comm: I2C: F0007
Speaker: I2S: F0004
Main Board Connector: F0009
reset cmd: F0006
Motor Control: I2C: F0003
Diag: JTAG: F0005
--> Motors R0059
--> Loud Speaker R0060
--> PMIC R0062
This section shows the base board logic of the MoD5G system (Solution Space, System Level L3)
Base Logic Board C0048
The base logic board consists of several electronic parts shown in Base Logic Board.
--> Base Micro Controller R0053
--> Clock R0055
--> PMIC R0049
--> Temperature Sensor R0095
Base Micro Controller C0051
The base micro controller consists of
- logic unit
- data storage
- persistent data+logic storage
- self supervision (by ECC and lockstep-cores)
- HW watchdog
- clock
- temperature sensor
- io ports
This block is optimized for providing a reliable execution of algorithms, see Quality Requirements.
Temperature: sensor: F0010
clock comm: I2C: F0007
Speaker: I2S: F0004
Main Board Connector: F0009
reset cmd: F0006
Motor Control: I2C: F0003
Diag: JTAG: F0005
--> PMIC R0062
--> Clock R0066
Clock C0053
wakeup --> PMIC R0067
PMIC C0049
Power Management Integrated Circuit
Temperature Sensor C0071
--> Base Micro Controller R0096
This section shows the main board logic of the MoD5G system (Solution Space, System Level L3)
Main Logic Board C0047
The main logic board consists of several electronic parts shown in Main Board Logic.
Base Board Connector: F0008
Camera: LVDS: F0001
Mic-Connector: I2S: F0002
--> RAM R0070
--> ROM R0071
--> High Performance SoC R0069
--> Motivator R0077
--> High Performance SoC R0074
--> High Performance SoC R0076
High Performance SoC C0056
This block provides an execution environment for algorithms that is optimized for high performance.
--> RAM R0072
--> ROM R0073
--> Main Logic Board R0075
RAM C0057
ROM C0058
Motivator C0059
A motivator is a basic component needed to keep going on.
triggers --> High Performance SoC R0078
This diagram shows the virtual machines and specialized (non-versatile) execution environments (Solution Space, System Level L2)
These are deployed onto the logic boards shown in Electric Parts and Electronics.
In this section, this view is further detailed to software elements, their relations and interactions.
High Performance SoC C0056
This block provides an execution environment for algorithms that is optimized for high performance.
--> Real Time Video Processing Chip R0079
--> General Purpose Partition 1 R0081
--> General Purpose Partition 2 R0082
Base Micro Controller C0051
The base micro controller consists of
- logic unit
- data storage
- persistent data+logic storage
- self supervision (by ECC and lockstep-cores)
- HW watchdog
- clock
- temperature sensor
- io ports
This block is optimized for providing a reliable execution of algorithms, see Quality Requirements.
Temperature: sensor: F0010
clock comm: I2C: F0007
Speaker: I2S: F0004
Main Board Connector: F0009
reset cmd: F0006
Motor Control: I2C: F0003
Diag: JTAG: F0005
--> Base Logic SW Partition R0083
--> Watchdog Execution Environment R0080
Real Time Video Processing Chip C0060
Watchdog Execution Environment C0061
General Purpose Partition 1 C0062
General Purpose Partition 2 C0063
Base Logic SW Partition C0064
This section shows the goals of the software development for the MoD5G (Problem Space, Software Level L3)
In gray, the use cases on system level L1 are repeated from Requirements and Goals to show the refinement to software-only use cases shown in black.
Mouse Droid MoD5G C0004
The Mouse Droid (MoD5G) is a repair droid that can be instructed to perform a mission and which then autonomously selects tactics to achieve the mission goals.
--> Drive to Location R0003
--> Use Tools R0004
Drive to Location C0007
The mouse droid can explore its environment and calculate a route from its actual position to the target location.
- The mouse droid explores its environment
- The mouse droid enriches an internally memorized map
- The mouse droid calculates a route
- The mouse droid drives along the calculated route
- The mouse droid re-caclulates the route in case of new environment data
- The mouse droid reaches the target location
--> Plan tasks R0091
--> Explore Environment R0234
--> Perform Movement R0235
Use Tools C0008
The mouse droid has a couple of tools inside its chassis.
- The mouse droid uses a screw diver to untighten damaged parts
- The mouse droid uses a gripper to move the damaged part out of the way
- The mouse droid uses a gripper to put a spare part from its internal cargo bin to the target place
- The mouse droid uses a screw diver to tighten replaced parts
- The mouse droid uses a gripper to move the damaged part into its internal cargo bin.
(see Mechanics)
--> Plan tasks R0090
--> Steer motors of tools R0233
Explore Environment C0067
When the mouse droid is missing relevant data on the environment, it plans a list of actions that suits the purpose of gaining the missing knowledge.
Perform Movement C0068
Steer motors of tools C0069
--> Base Micro Controller R0255
Plan tasks C0070
The mouse droid creates a list of actions to fulfill the given mission. If data on the environment is missing, it plans an explortion task and re-plans the action list later.
High Performance SoC C0056
This block provides an execution environment for algorithms that is optimized for high performance.
--> Explore Environment R0258
--> Plan tasks R0259
Base Micro Controller C0051
The base micro controller consists of
- logic unit
- data storage
- persistent data+logic storage
- self supervision (by ECC and lockstep-cores)
- HW watchdog
- clock
- temperature sensor
- io ports
This block is optimized for providing a reliable execution of algorithms, see Quality Requirements.
Temperature: sensor: F0010
clock comm: I2C: F0007
Speaker: I2S: F0004
Main Board Connector: F0009
reset cmd: F0006
Motor Control: I2C: F0003
Diag: JTAG: F0005
--> Steer motors of tools R0256
--> Perform Movement R0257
This diagram shows examples of system level L3 requirements.
L1Req: Recognize paths C0149
The MoDG5 shall use redundant sensor data to calculate paths that it can drive along.
L1Req: Position screw driver C0150
The MoDG5 shall bring the screw driver into a given 3D position.
Explore Environment C0067
When the mouse droid is missing relevant data on the environment, it plans a list of actions that suits the purpose of gaining the missing knowledge.
Steer motors of tools C0069
L3Req: Calc 3D scene from 2 cameras C0151
The Main Logic Board shall create a 3D model of the environment based on 2 camera images.
--> Explore Environment R0248
--> L1Req: Recognize paths R0249
Base Logic Board C0048
The base logic board consists of several electronic parts shown in Base Logic Board.
--> L1Req: Position screw driver R0247
--> Screw Driver R0252
Main Logic Board C0047
The main logic board consists of several electronic parts shown in Main Board Logic.
Base Board Connector: F0008
Camera: LVDS: F0001
Mic-Connector: I2S: F0002
--> L1Req: Recognize paths R0246
L3Req: Operate motors of tool-arm C0152
The Base Logic Board shall steer the motors of the tool-arm to a given 3D position.
--> L1Req: Position screw driver R0250
--> Steer motors of tools R0251
Screw Driver C0037
Camera C0041
--> Main Logic Board R0051
This section explains the major obstacles, that need to be considered when designing a solution to reach the project goals. (Problem Space, Software Level L3)
Self-Preservation C0081
In case a wookiee growls at the MoD5G, it shall flee for self-preservation
Interoperability C0123
The programming and charging interfaces
of the MoD5G shall be compatible to
- old republic terminals
- imperial terminals
This section shows the organizational contexts of development and operational environments. (Problem Space, Software Level L3)
Imperial Operator C0082
program --> Mouse Droid MoD5G R0113
Operator of the old republic C0083
program --> Mouse Droid MoD5G R0112
Mouse Droid MoD5G C0004
The Mouse Droid (MoD5G) is a repair droid that can be instructed to perform a mission and which then autonomously selects tactics to achieve the mission goals.
This section shows the most fundamental principles of the software design. (Solution Space, Software Level L3)
Environment Capture C0118
Tactics Calculator C0108
Calculate tactics based on given strategy and current situation model
System Control C0119
Base Software Structure C0121
The software is basically structured into three parts:
- environment model generation
- calculating actions
- controlling execution of actions
Software Parts C0020
The software consists of control logic, initial data that was integrated at the factory and learned data that is aggregated during operation.
These software items are split over two logical boards and subdivided into independent execution partitions.
--> Tactics Calculator R0236
--> Environment Capture R0241
--> System Control R0242
This section shows the parts of the MoD5G software (Solution Space, Software Level L3)
Video Capture C0106
actual scene --> Environment Model Composer R0155
Audio Capture C0107
actual scene --> Environment Model Composer R0154
Tactics Calculator C0108
Calculate tactics based on given strategy and current situation model
Motor Controller C0109
Move motors according to calculated tactics
movement info --> Environment Model Composer R0153
Environment Capture C0118
--> Environment Model Composer R0152
--> Video Capture R0148
--> Audio Capture R0149
System Control C0119
--> SW Watchdog R0174
--> Motor Controller R0151
Environment Model Composer C0120
--> Tactics Calculator R0156
SW Watchdog C0129
The SW Watchdog shall check
- validity of data as well as
- validity of sequence of checkpoints
received from software components
on the Main Logic Board.
See also Crosscutting Concepts.
Software Parts C0020
The software consists of control logic, initial data that was integrated at the factory and learned data that is aggregated during operation.
These software items are split over two logical boards and subdivided into independent execution partitions.
--> Tactics Calculator R0236
--> Environment Capture R0241
--> System Control R0242
This diagram shows the software components that perceive the the outer environment and create a model from this data.
L3Req: Calc 3D scene from 2 cameras C0151
The Main Logic Board shall create a 3D model of the environment based on 2 camera images.
Audio Capture C0107
actual scene --> Environment Model Composer R0154
Environment Capture C0118
--> Environment Model Composer R0152
--> Video Capture R0148
--> Audio Capture R0149
--> Environment Model R0261
Video Capture C0106
actual scene --> Environment Model Composer R0155
Environment Model Composer C0120
--> L3Req: Calc 3D scene from 2 cameras R0254
creates --> Environment Model R0260
Environment Model C0111
The enironment model refers to the (limited) knowledge of the software on the real environment.
This diagram shows the software components that perceive MoD5G internal sensor data and steer the actuators of the MoD5G.
L3Req: Operate motors of tool-arm C0152
The Base Logic Board shall steer the motors of the tool-arm to a given 3D position.
System Control C0119
--> SW Watchdog R0174
--> Motor Controller R0151
Motor Controller C0109
Move motors according to calculated tactics
--> L3Req: Operate motors of tool-arm R0253
SW Watchdog C0129
The SW Watchdog shall check
- validity of data as well as
- validity of sequence of checkpoints
received from software components
on the Main Logic Board.
See also Crosscutting Concepts.
This section shows the dynamic behavior of the software (Solution Space, Software Level L3)
This diagram shows the software states embedded in the system states. See Power Modes.
power::booting C0024
--> sw::sync R0107
--> sw::start R0099
--> sw::par R0100
--> sw::boot_main_board R0098
--> sw::booted R0110
--> sw::boot_base_board R0097
ready --> power::full_operation R0016
power::full_operation C0025
While the MoD5G is in full_operation state, all software parts are running and able to react on input data.
--> sw::op_sync R0117
--> sw::op_end R0115
--> sw::op_par R0116
--> sw::op_start R0114
--> sw::run_base R0105
--> sw::run_main R0104
next steps are planned --> power::energy_saving R0017
mission tactics are planned, no need to adapt
supervision fault --> power::booting R0033
power::energy_saving C0026
--> sw::run_base_only R0106
external event --> power::full_operation R0018
external event causes re-evaluating tactics
supervision fault --> power::booting R0032
sw::boot_base_board C0072
--> sw::sync R0109
sw::boot_main_board C0073
--> sw::sync R0108
sw::start C0074
--> sw::par R0101
sw::par C0075
--> sw::boot_main_board R0102
--> sw::boot_base_board R0103
sw::run_main C0076
--> sw::op_sync R0123
sw::run_base C0077
--> sw::op_sync R0122
sw::run_base_only C0078
sw::sync C0079
--> sw::booted R0111
sw::booted C0080
sw::op_start C0084
--> sw::op_par R0119
sw::op_end C0085
sw::op_par C0086
--> sw::run_main R0120
--> sw::run_base R0121
sw::op_sync C0087
--> sw::op_end R0118
This diagram shows the typical communication sequence to compose the environment model.
Motor Controller C0109
Move motors according to calculated tactics
step count of movement motors --> Environment Model Composer R0166
step count of steering and movement motors
Tactics Calculator C0108
Calculate tactics based on given strategy and current situation model
calculate action list --> Tactics Calculator R0172
calculate action list to follow the given strategy
provide list of next actions --> Motor Controller R0167
update limp home action list (for emergency) --> Motor Controller R0168
For the emergency case, update the limp home action list
Environment Model Composer C0120
create 3D scene --> Environment Model Composer R0171
create 3D scene based on sensors, status and history.
composed 3D scene --> Tactics Calculator R0165
Audio Capture C0107
analyze audio signal --> Audio Capture R0169
list of detected audio sources --> Environment Model Composer R0164
Video Capture C0106
analyze video signal --> Video Capture R0170
3D scene of visible environment --> Environment Model Composer R0163
Persist List C0142
the action list shall be persisted, so that after a sudden reboot, the next actions are immediately available.
--> Tactics Calculator R0220
This section shows the deployment of the solution into the environment. (Solution Space, Software Level L3)
Motor Controller C0109
Move motors according to calculated tactics
movement info --> Environment Model Composer R0153
--> Base Logic SW Partition R0200
Base Logic SW Partition C0064
General Purpose Partition 2 C0063
Tactics Calculator C0108
Calculate tactics based on given strategy and current situation model
--> General Purpose Partition 2 R0202
Audio Capture C0107
actual scene --> Environment Model Composer R0154
--> General Purpose Partition 1 R0204
General Purpose Partition 1 C0062
Real Time Video Processing Chip C0060
Video Capture C0106
actual scene --> Environment Model Composer R0155
--> Real Time Video Processing Chip R0201
Environment Model Composer C0120
--> Tactics Calculator R0156
--> General Purpose Partition 1 R0203
Environment Capture C0118
--> Environment Model Composer R0152
--> Video Capture R0148
--> Audio Capture R0149
System Control C0119
--> Motor Controller R0151
This section shows the recurring concepts within the the designed solution. (Solution Space, Software Level L3)
Fault Detection (main logic) C0127
Logic and data is supervised
by the SW Watchdog
located on the Base Micro Controller.
Every software component
on the Main Logic Board
shall check processed data
and report its health to the SW Watchdog
as well as passed checkpoints in the logic.
--> SW Watchdog R0175
Fault Detection (base logic) C0128
The hardware of the Base Micro Controller enables logic and data supervision. Therefore no extra software solution is implemented to monitor the base logic.
--> SW Watchdog R0198
SW Watchdog C0129
The SW Watchdog shall check
- validity of data as well as
- validity of sequence of checkpoints
received from software components
on the Main Logic Board.
See also Crosscutting Concepts.
This section documents the major design decisions. (Solution Space, Software Level L3)
Wookiee Detection C0131
Challenge: Detect presense of a Wookiee
Alt-1: Detect a growling wookie only by
analyzing the audio spectrum
recorded from the microphone.
- pro: simple to implement
- con: may produce false alarms
Alt-2: Combine the Video and the Audio
sensor data to better distinguish
a growling wookie from a shouting officer.
- pro: better recognize wookiees
- con: dependency on video processing
Decision: Alt-1
Rationale: Reacting on a false alarm
is not mission-critical.
--> Self-Preservation R0177
Self-Preservation C0081
In case a wookiee growls at the MoD5G, it shall flee for self-preservation
This section shows the major quality scenarios. (Problem Space, Software Level L3)
Similar to Quality Requirements for system level L1, this section shows quality expectations: The WHAT shall be implemented, not the HOW.
Compatibility C0122
Compatibility defines a set of attributes that measures how well data and messages can be exchanged with other programs and/or versions.
Interoperability C0123
The programming and charging interfaces
of the MoD5G shall be compatible to
- old republic terminals
- imperial terminals
--> Compatibility R0158
When specifying quality requirements, these are categorized by two dimensions:
1) Which characteristic do they affect
2) Which use case do they serve
Thich chapter lists the quality requirements ordered by their main characteristic.
Old Republic Programming IF C0124
The old republic protocol for programming a droid shall be supported.
--> Interoperability R0159
Imperial Programming IF C0125
The imperial protocol for programming a droid shall be supported.
--> Interoperability R0160
Universial Charging IF C0126
The intergalactic standard protocol for power charging shall be supported.
--> Interoperability R0161
Interoperability C0123
The programming and charging interfaces
of the MoD5G shall be compatible to
- old republic terminals
- imperial terminals
--> Compatibility R0158
Compatibility C0122
Compatibility defines a set of attributes that measures how well data and messages can be exchanged with other programs and/or versions.
When specifying quality requirements, these are categorized by two dimensions:
1) Which characteristic do they affect
2) Which use case do they serve
Thich chapter lists the use cases which have special importance for quality requirements.
Mixed standards of terminals C0145
precondition:
- The MoD5G operates in an environment
providing mixed terminal standards
trigger:
- The MoD5G drives to a charging or programming terminal
which complied to either old republic or imperial standard.
scenario:
- The MoD5G determines the applicable standard
- The MoD5G uses the terminal for programming or charging
--> Interoperability R0227
Interoperability C0123
The programming and charging interfaces
of the MoD5G shall be compatible to
- old republic terminals
- imperial terminals
This section lists the risks and not-yet-addressed requirements. (Solution Space, Software Level L3)
Fault Detection Strategy may fail C0130
The fault detection strategy for
logic and data on the Main Logic Board
allows for unnoticed faults:
Not every error in logic can be detected
by checkpoints only.
--> Risk: Wrong tactic is calculated R0181
Fault Detection (main logic) C0127
Logic and data is supervised
by the SW Watchdog
located on the Base Micro Controller.
Every software component
on the Main Logic Board
shall check processed data
and report its health to the SW Watchdog
as well as passed checkpoints in the logic.
--> Risk: Wrong tactic is calculated R0199
Risk: Wrong tactic is calculated C0134
- cause/fault: Due to cosmic rays,
the main logic board performs a miscalculation
that goes unnoticed by control flow supervision
- risk/failure: the MoD5G calculates a tactic that
results in falling off a cliff
This section explains the used terms. (Domain and Solution Space, Software Level L3)
Situation Model C0110
The situation model refers to the (limited/erroneous) knowledge of the software on environment and status.
--> Status Model R0142
--> Environment Model R0143
Environment Model C0111
The enironment model refers to the (limited) knowledge of the software on the real environment.
observe by sensors --> Real Environment R0146
Sensor data is the basis for assuming an environment model.
Status Model C0112
The status model refers to the (limited) knowledge of the software on the real status.
observe --> Real Status R0147
Sensor data is the basis for assuming a status model. The algorithm for deriving a status model shall take into account that a sensor may be defect and/or a measured value may indicate a defect (which again may have several causes).
Real Situation C0113
The real situation refers to the reality of system status and environment.
--> Real Status R0144
--> Real Environment R0145
Real Environment C0114
The real environment refers to the physical environment of the system.
Real Status C0115
The real status refers to the real system status. This may differ from what the sensors report.
This section shows the dynamic behavior of the system (Solution Space, System Level L1)
Power Modes C0021
refers to Power Modes
Health States C0022
refers to Health States
start operation C0153
--> orthogonal R0262
orthogonal C0154
--> Health States R0263
--> Power Modes R0264
This diagram shows the power states that are globally valid to all parts of the system.
power::startup C0023
external trigger or timer wakeup --> power::booting R0015
power::booting C0024
ready --> power::full_operation R0016
power::full_operation C0025
While the MoD5G is in full_operation state, all software parts are running and able to react on input data.
next steps are planned --> power::energy_saving R0017
mission tactics are planned, no need to adapt
stop operation --> power::off R0019
stop operation, set wakeup time
supervision fault --> power::booting R0033
power::energy_saving C0026
external event --> power::full_operation R0018
external event causes re-evaluating tactics
supervision fault --> power::booting R0032
power::off C0027
power::all C0138
The statemachine of all power states
--> power::booting R0192
--> power::energy_saving R0193
--> power::full_operation R0194
--> power::startup R0195
--> power::off R0196
This diagram shows the expected startup and shutdown timings.
power::off C0027
--> power::startup R0209
power::full_operation C0025
While the MoD5G is in full_operation state, all software parts are running and able to react on input data.
sleep --> power::energy_saving R0212
shutdown --> power::off R0215
power::startup C0023
wakeup (0 ms) --> power::booting R0210
power::booting C0024
run (2300 ms) --> power::full_operation R0211
power::energy_saving C0026
wakeup (0 ms) --> power::energy_saving R0213
run (500 ms) --> power::full_operation R0214
max 2300 msec C0139
a --> power::booting R0218
b --> power::full_operation R0216
max 500 msec C0140
c --> power::energy_saving R0219
d --> power::full_operation R0217
This diagram shows the health states of the MoD5G system.
health::factory C0028
factory initial test --> health::operation R0207
health::disassembly C0029
health::healthy C0030
accident or ageing --> health::slightly_damaged R0021
severe accident --> health::damaged R0029
severe accident --> health::limp_home R0030
health::slightly_damaged C0031
accident --> health::limp_home R0022
severe accident --> health::damaged R0031
health::limp_home C0032
In case the full operation is not possible anymore, the MoD5G shall drive back to the home charging station.
accident --> health::damaged R0023
health::damaged C0033
decision for termination --> health::operation R0206
health::operation C0034
op_start: F0019
no_op: F0018
--> health::limp_home R0024
--> health::slightly_damaged R0025
--> health::healthy R0026
--> health::damaged R0027
--> health::disassembly R0205
--> health::healthy R0208
health::all C0137
The statemachine of all health states
--> health::factory R0189
--> health::operation R0190
--> health::disassembly R0191
This section shows the deployment of the solution into the environment. (Solution Space, System Level L1)
Space Station C0095
--> Programming Terminal R0129
--> Charging Terminal R0130
--> Maintenance Booth R0131
--> Mouse Droid MoD5G R0128
Mouse Droid MoD5G C0004
The Mouse Droid (MoD5G) is a repair droid that can be instructed to perform a mission and which then autonomously selects tactics to achieve the mission goals.
Programming Terminal C0096
Charging Terminal C0097
Maintenance Booth C0098
This section shows the recurring concepts within the the designed solution. (Solution Space, System Level L1)
Motor Type C0099
All motors are electrical step motors.
Step motors can be controlled
to move a defined number of steps
forward or backwards.
Note that there are conditions
when the actual number of steps
is not equal to the previously requested
number of steps, e.g. when accellerating
or slowing down too fast.
This section documents the major design decisions. (Solution Space, System Level L1)
Cosmic Rays C0002
The droid shall ensure data and program integrity.
It shall continue operation after cosmic rays have interfered with data storage or program execution.
Corrupted data must not be stored permanently.
constraint: environment: F0030
2 of 3 Voter C0100
In order to support integrity of the system, the logic boards and the data storages are deployed three times as three identical parts.
All three parts shall produce the same outcomes given the same input.
If one deviates, it's result is ignored and the part is rebooted.
rejected alternative --> Cosmic Rays R0135
Cosmic Rays Information C0101
When a cosmic ray interferes with the system, the logic or the processed data gets corrupted.
provides background --> Cosmic Rays R0132
Watchdog Supervision C0102
In order to support integrity of the logic and data,
a multi-stage hierarchy supervision shall be implemented.
Software watchdogs shall supervise the running software parts
in a way that logic errors and corrupted data can be detected.
A hardware watchdog shall supervise the software watchdogs.
In case of a failure in the supervised logic/data, the system shall reboot.
In case of a failure in the monitors, the system may reboot
or it shall fall back to a valid supervision mode.
--> Cosmic Rays R0134
Decision: Watchdog C0103
Arguments:
- The 2 of 3 voter is easier to implement but causes higher hardware costs.
- The watchdog supervision requires higher engineering efforts but is cheaper in production.
The watchdog supervision shall be implemented.
selected solution --> Watchdog Supervision R0133
This section shows the major quality requrements and scenarios. (Problem Space, System Level L1)
In the following, requirements and scenarios are selected that show the quality expectations: The WHAT shall be implemented, not the HOW.
Usability C0009
Usability defines a set of attributes that measures how easy to learn and use the program is.
Maintainability C0010
Maintainability defines a set of attributes that influence how to analyze and mitigate defects that occur during operation.
Reliability C0011
Reliability defines a set of attributes that measures how mature and fault-tolerant the software is.
Compatibility C0122
Compatibility defines a set of attributes that measures how well data and messages can be exchanged with other programs and/or versions.
This section shows the quality requirements ordered by quality characteristics.
Maintainability C0010
Maintainability defines a set of attributes that influence how to analyze and mitigate defects that occur during operation.
Analyzability C0014
The MoD5G shall allow to analyze faults that occurred during operation.
--> Maintainability R0009
Repairability C0012
The MoD5 hardware parts shall be exchangeable in case they are damaged.
--> Maintainability R0007
This diagram shows the quality requirements related to the characteristic "Maintainability".
Maintainability C0010
Maintainability defines a set of attributes that influence how to analyze and mitigate defects that occur during operation.
Repairability C0012
The MoD5 hardware parts shall be exchangeable in case they are damaged.
--> Maintainability R0007
30 years spare-parts supply C0013
The mechanical and electrical/electronics parts of the MoD5 shall be produceable in identical or similar form and quality for 30 years after production of the unit.
--> Repairability R0008
Analyzability C0014
The MoD5G shall allow to analyze faults that occurred during operation.
--> Maintainability R0009
Self-Diagnosis C0015
At the maintenance booth, the MoD5G shall provide an error log. This error log contains detected errors from operation and related environment conditions. It also lists possible causes(faults).
--> Analyzability R0010
This section shows the quality-related scenarios in which the quality requirements shown in Quality Tree are of special importance.
Spare Parts Supply C0017
pre-condition:
- the stock of MoD5G spare parts is empty
trigger:
- 20 years after production,
a MoD5G needs a spare part that is not available anymore
scenario:
- a service mechanic orders a batch of parts
- a factory creates the parts that fit in form, function and quality to the MoD5G
- spare parts are delivered
--> Repairability R0012
Motor defect C0016
pre-condition:
- the MoD5G is performing a 1-day mission autonomously
trigger:
- a motor fails to operate
- the goals of the 1-day mission cannot be accomplished anymore
scenario:
- the MoD5G cancels the mission and returns to the service point
- a service mechanic reads out the error log
- the MoD5G proposes to replace the suspicious motor
- the service mechanic replaces the motor
--> Analyzability R0197
Repairability C0012
The MoD5 hardware parts shall be exchangeable in case they are damaged.
Analyzability C0014
The MoD5G shall allow to analyze faults that occurred during operation.
This section lists the risks and not-yet-addressed requirements. (Solution Space, System Level L1)
Limp home mode may fail C0105
In case of a single fault, the MoD5G shall return
to the charging station.
The current design does not address the cases:
- the base logic board is damaged
- the energy cell is damaged
- the movement/steering motors are defect
comments --> health::limp_home R0136
explains --> Risk: MoD5G does not drive back (logic board) R0179
explains --> Risk: MoD5G does not drive back (motors) R0229
explains --> Risk: MoD5G does not drive back (energy) R0230
health::limp_home C0032
In case the full operation is not possible anymore, the MoD5G shall drive back to the home charging station.
Risk: MoD5G does not drive back (logic board) C0133
- cause/fault: the base logic board is damaged
- risk/failure: the MoD5G cannot drive anymore
fault not handled --> health::limp_home R0180
Risk: MoD5G does not drive back (energy) C0147
- cause/fault: the energy cell is damaged
- risk/failure: the MoD5G cannot drive anymore
fault not handled --> health::limp_home R0232
Risk: MoD5G does not drive back (motors) C0148
- cause/fault: the ,ovement/steering motors are damaged
- risk/failure: the MoD5G cannot drive anymore
fault not handled --> health::limp_home R0231
This section explains the used terms. (Domain and Solution Space, System Level L1)
See also Glossary for software terms.
Maintenance booth C0104
A room in a star ship or on a planet
where the following tasks are performed:
- check operability of droids
- oil refill service
- repair of droids
- disintegration of old droids
Base location C0143
The location where the MoD5G droid returns to when its mission is finished. This location typically provides a charging and programming terminal. This location can be re-programmed.
Stereotypes allow a classification of elements into project-specific categories.
UML:Component C0155
env-perception C0156
<path fill="#ffcc66" d=" M 0.8,0 a 0.8,0.8 0 1 0 -1.6,0 a 0.8,0.8 0 1 0 1.6,0 " /> <path d=" M 1,0 A 1,0.5 22 1 1 0.707,0.707 A 1,0.5 67 1 1 0,1 A 1,0.5 112 1 1 -0.707,0.707 A 1,0.5 157 1 1 -1,0 A 1,0.5 202 1 1 -0.707,-0.707 A 1,0.5 247 1 1 0,-1 A 1,0.5 -68 1 1 0.707,-0.707 A 1,0.5 -23 1 1 1,0 " />
--> UML:Component R0265
--> env-image R0266
env-image C0157
UML:Class C0158
decision C0159
<path d=" M 5,5 l -3,5 1,1 4,0 1,-1 -3,-5 L 10,2 16,2 l -3,5 1,1 4,0 1,-1 -3,-5 "/> <path d=" M 9.2,0 10,2 M 10,5 L 10,15 "/>
--> UML:Class R0267
--> decision-img R0268
decision-img C0160
data C0161
<path d="m 0,1 c 0,-0.55 1.35,-1 3,-1 c 1.65,0 3,0.45 3,1 c 0,0.55, -1.35,1 -3,1 c -1.65,0 -3,-0.45, -3,-1 l 0,5 c 0,0.55 1.35,1 3,1 c 1.65,0 3,-0.45 3,-1 l 0,-5"/>
--> UML:Class R0269
--> data-img R0270
data-img C0162
mouse-droid C0163
<path d=" c 3, -0.8 4.5, 0.5 4.5, 2.5 l -8, 0 c 1, -2, 2, -3, 3, -3 c 0.5, 0 0.5, 1 0, 1 m -1, 0.1 l -0.2, 0.2 " fill="#bb9977" />
--> mouse-img R0271
--> UML:Node R0272
mouse-img C0164
UML:Node C0165