Mouse Droid

This document shows a system architecture and software architecture for a mouse droid. This is a small repair droid similar to the MSE-6 used on death star 1.
The document follows the arc42.org template proposed by Gernot Starke and Peter Hruschka,
Copyright 2020-2023 Andreas Warnke License: Choose either Apache-2.0 or Creative Commons Attribution (BY) Licence

Introduction C0001

The mouse droid is a repair droid. When programmed, it autonomously drives to the destination location, selects spare parts and tools and exchanges damaged parts.
It is easily reprogrammable and can therefore also be used for
- cleaning tasks
- spying and surveillance tasks
- message delivery

Scope C0141

This document describes system and software architecture for engineering generation 5 of the mouse droid, denoted by the term MoD5G.

C0173

Requirements and Goals

This section gives a short overview on the project goals (Problem Space, System Level L1)
Primary purpose of the MoD5G is to autonomously repair mechanical things.

Mouse Droid MoD5G C0004

The Mouse Droid (MoD5G) is a repair droid that can be instructed to perform a mission and which then autonomously selects tactics to achieve the mission goals.

--> Perform a 1-day mission R0001

--> Return to base location R0283

--> Drive to location R0003

--> Repair using tools R0004

Commander C0005

The commander instructs the MoD5G on the mission to perform.

plan mission --> Perform a 1-day mission R0002

provide mission goals and high-level strategy

Perform a 1-day mission C0006

The mouse droid is able to perform a mission that takes several hours. The energy resources of the MoD5G last for up to one terrestrial day.

- The commander programs a mission
- The mouse droid drives to the first location
- The mouse droid uses tools to remove a defective part
- The mouse droid installes a spare part
- Above steps are repeated for other goals
- The mouse droid returns to its base location (see Glossary)

post: MoD5G is at base location: F0034

1.) --> Drive to location R0005

2.) --> Repair using tools R0006

3.) --> Return to base location R0284

Drive to location C0007

The mouse droid can explore its environment and calculate a route from its actual position to the target location.

- The mouse droid explores its environment
- The mouse droid enriches an internally memorized map
- The mouse droid calculates a route
- The mouse droid drives along the calculated route
- The mouse droid re-caclulates the route in case of new environment data
- The mouse droid reaches the target location

pre: defined mission: F0032

Repair using tools C0008

The mouse droid has a couple of tools inside its chassis.

- The mouse droid uses a screw diver to untighten damaged parts
- The mouse droid uses a gripper to move the damaged part out of the way
- The mouse droid uses a gripper to put a spare part from its internal cargo bin to the target place
- The mouse droid uses a screw diver to tighten replaced parts
- The mouse droid uses a gripper to move the damaged part into its internal cargo bin.
(see L2 Mechanics)

Return to base location C0177

see Glossary.

post: MoD5G is at base location: F0033

L1 Requirements View

This diagram shows examples of system level L1 requirements.

Drive to location C0007

The mouse droid can explore its environment and calculate a route from its actual position to the target location.

- The mouse droid explores its environment
- The mouse droid enriches an internally memorized map
- The mouse droid calculates a route
- The mouse droid drives along the calculated route
- The mouse droid re-caclulates the route in case of new environment data
- The mouse droid reaches the target location

pre: defined mission: F0032

Repair using tools C0008

The mouse droid has a couple of tools inside its chassis.

- The mouse droid uses a screw diver to untighten damaged parts
- The mouse droid uses a gripper to move the damaged part out of the way
- The mouse droid uses a gripper to put a spare part from its internal cargo bin to the target place
- The mouse droid uses a screw diver to tighten replaced parts
- The mouse droid uses a gripper to move the damaged part into its internal cargo bin.
(see L2 Mechanics)

L1Req: Recognize paths C0149

The MoDG5 shall use redundant sensor data to calculate paths that it can drive along.

--> Drive to location R0244

--> Return to base location R0285

L1Req: Position screw driver C0150

The MoDG5 shall bring the screw driver into a given 3D position.

--> Repair using tools R0245

Return to base location C0177

see Glossary.

post: MoD5G is at base location: F0033

Constraints

This section explains the major obstacles that need to be considered when designing a solution that addresses the project goals. (Problem Space, System Level L1)

Operating Temperatures C0003

The droid shall be fully functional in the range 240K..360K, it shall survive temperatures from 200K to 400K.

Cosmic Rays C0002

The droid shall ensure data and program integrity.
It shall continue operation after cosmic rays have interfered with data storage or program execution.
Corrupted data must not be stored permanently.

Environmental Constraints C0144

This package lists technical/physical constraints imposed by the environment in which to operate.

--> Cosmic Rays R0221

--> Operating Temperatures R0222

Group of constratins imposed by the operation environment

Scope and Context

This section shows the organizational contexts of development and operational environments. (Problem Space, System Level L1)

Development and Production Context C0088

This boundary encompasses the topics that are in scope during development and production.

--> Electrical Engineering R0188

--> Design Hardware R0187

--> Develop Software R0125

--> Build Droids R0124

Operational Context C0089

This boundary encompasses the topics that are in scope during operation and maintenance.

--> Repair Droid R0127

--> Operate Droid R0126

Build Droids C0090

At the factory, workers assemble hardware and electronic parts to mouse droids and integrate control logic and data.

Develop Software C0091

A team of engineers designs, produces and tests the control logic and factory data of the droids.

Operate Droid C0092

An operator/commander instructs the mouse droid which mission to perform. The logic of the mouse droid translates this mission into driving maneuvers and actions of the integrated tools.

Repair Droid C0093

A service mechanic analyzes the health state of a mouse droid. Depending on the outcome, oil is refilled, logic is updated, parts are exchanged or the whole droid is disintegrated.

Design Hardware C0135

A team of engineers designs, produces and tests the mechanical hardware parts of the droids.

Electrical Engineering C0136

A team of engineers designs, produces and tests the electrical and electronic parts of the droids.

Solution Strategy

This section shows the fundamental base principle of the system design. (Solution Space, System Level L1)

Electrical Parts and Electronics C0019

The main components of the electric parts are:
- a set of cables and connectors
- a set of sensors and actuators
- the energy cell
- two printed circuit boards (PCB) containing the electronic parts

--> Base Logic Board R0048

--> Main Logic Board R0047

Base Logic Board C0048

The base logic board consists of several electronic parts shown in Base Logic Board.

Main Board Connector: F0031

Main Logic Board C0047

The main logic board consists of several electronic parts shown in Main Board Logic.

Base Board Connector: F0008

Mic-Connector: I2S: F0002

Camera: LVDS: F0001

status and control --> Base Logic Board R0280

Outer World C0094

The main logic addresses the following tasks:
- evaluating sensor signals from microphone and camera
- calculating movement actions to be performed by base logic (tactics)

--> Main Logic Board R0184

Guiding Main Principles C0116

The functions of the MoD5G are divided onto two logic boards.
The base logic gets local sensor information and controls things within the system boundary of the MoD5G.
The main logic gets sensor data of the environment and calculates movement actions to efficiently fulfill the mission (that was programmed before).

Inner World C0117

The base logic addresses the following tasks:
- charging
- programming
- steering the motors
- self-check
If a list of actions is available, this logic board can steer the MoD6G without the help of the main logic board.

--> Base Logic Board R0183

L1 Functional View

Motors to move the MoD5G (L1-Fct) C0178

ctrl: F0041

Recognize paths (L1-Fkt) C0179

paths: F0035

--> Plan movement strategy (L1-Fct) R0286

Recognize objects to repair (L1-Fct) C0180

objects: F0037

--> Plan repair strategy (L1-Fct) R0287

Plan movement strategy (L1-Fct) C0181

paths: F0036

--> Perform movement tactic (L1-Fct) R0288

Plan repair strategy (L1-Fct) C0182

objects: F0038

--> Perform repair tactic (L1-Fct) R0289

Perform movement tactic (L1-Fct) C0183

ctrl: F0042

--> Motors to move the MoD5G (L1-Fct) R0290

Perform repair tactic (L1-Fct) C0184

ctrl: F0039

--> Tools to repair R0291

Tools to repair C0185

ctrl: F0040

L1 Logical View

This view maps the functions to a form.

Plan movement strategy (L1-Fct) C0181

paths: F0036

--> Perform movement tactic (L1-Fct) R0288

Plan repair strategy (L1-Fct) C0182

objects: F0038

--> Perform repair tactic (L1-Fct) R0289

Perform repair tactic (L1-Fct) C0184

ctrl: F0039

Perform movement tactic (L1-Fct) C0183

ctrl: F0042

Strategy planning (L1) C0186

--> Plan movement strategy (L1-Fct) R0292

--> Plan repair strategy (L1-Fct) R0293

Tactic execution (L1) C0187

--> Perform movement tactic (L1-Fct) R0294

--> Perform repair tactic (L1-Fct) R0295

L1 Physical View

This view maps the logical form to physical artifacts.

Electrical Parts and Electronics C0019

The main components of the electric parts are:
- a set of cables and connectors
- a set of sensors and actuators
- the energy cell
- two printed circuit boards (PCB) containing the electronic parts

--> Base Logic Board R0048

--> Main Logic Board R0047

Base Logic Board C0048

The base logic board consists of several electronic parts shown in Base Logic Board.

Main Board Connector: F0031

--> Tactic execution (L1) R0297

Main Logic Board C0047

The main logic board consists of several electronic parts shown in Main Board Logic.

Base Board Connector: F0008

Mic-Connector: I2S: F0002

Camera: LVDS: F0001

status and control --> Base Logic Board R0280

--> Strategy planning (L1) R0296

Tactic execution (L1) C0187

Strategy planning (L1) C0186

Building Block View

This section shows the parts of the MoD5G system (Solution Space, System Level L1)

Mechanical Parts C0018

The mechanical parts encompass all parts of which the mouse droid consists. From outside, the chassis and wheels are the most obvious parts. Inside, a skeleton frame provides stability of the assembly.
Important charactereistics are weight, operating temperature range, durability, stability.

--> Electrical Parts and Electronics R0013

Electrical Parts and Electronics C0019

The main components of the electric parts are:
- a set of cables and connectors
- a set of sensors and actuators
- the energy cell
- two printed circuit boards (PCB) containing the electronic parts

Software Parts C0020

The software consists of control logic, initial data that was integrated at the factory and learned data that is aggregated during operation.
These software items are split over two logical boards and subdivided into independent execution partitions.

--> Electrical Parts and Electronics R0243

L2 Mechanics

This section shows the mechanical parts of the MoD5G system (Solution Space, System Level L2)

Chassis C0035

--> Skeleton Frame R0228

--> Tool-Window (2) R0065

--> Gripper R0064

--> Cargo Bin R0034

--> Microphone R0040

--> Energy Cell R0044

--> Programming and Diagnostic Connector R0042

--> Motors R0038

--> Loud Speaker R0041

--> Charging Connector R0043

--> Camera R0039

--> Wheels (4) R0036

--> Fan R0037

--> Screw Driver R0035

--> Electrical Parts and Electronics R0046

Cargo Bin C0036

protected by --> Tool-Window (2) R0224

Screw Driver C0037

protected by --> Tool-Window (2) R0225

Wheels (4) C0038

Fan C0039

A fan prevents overheating in hot environment conditions.

Motors C0040

Camera C0041

Microphone C0042

Loud Speaker C0043

Programming and Diagnostic Connector C0044

protected by --> Tool-Window (2) R0226

Charging Connector C0045

Energy Cell C0046

Mechanical Parts C0018

The mechanical parts encompass all parts of which the mouse droid consists. From outside, the chassis and wheels are the most obvious parts. Inside, a skeleton frame provides stability of the assembly.
Important charactereistics are weight, operating temperature range, durability, stability.

--> Electrical Parts and Electronics R0013

--> Chassis R0045

Electrical Parts and Electronics C0019

The main components of the electric parts are:
- a set of cables and connectors
- a set of sensors and actuators
- the energy cell
- two printed circuit boards (PCB) containing the electronic parts

Gripper C0054

A tool that allows to grab objects and move them.

protected by --> Tool-Window (2) R0223

Tool-Window (2) C0055

A tool window is a flap in the chassis that protects screw driver, gripper and cargo bin when unused. It can be opened and closed by a motor.

Skeleton Frame C0146

The skeleton frame provides stability to the assembly of parts. Anchorage points latch the assembled parts at their positions.

L2 Electric Parts and Electronics

This section shows the electric parts and electronics of the MoD5G system (Solution Space, System Level L2)

Electrical Parts and Electronics C0019

The main components of the electric parts are:
- a set of cables and connectors
- a set of sensors and actuators
- the energy cell
- two printed circuit boards (PCB) containing the electronic parts

--> Base Logic Board R0048

--> Main Logic Board R0047

Energy Cell C0046

power --> PMIC R0050

Loud Speaker C0043

Camera C0041

--> Main Logic Board R0051

Microphone C0042

audio --> Main Logic Board R0056

Motors C0040

Charging Connector C0045

--> PMIC R0057

Programming and Diagnostic Connector C0044

service ctrl --> Base Micro Controller R0061

Main Logic Board C0047

The main logic board consists of several electronic parts shown in Main Board Logic.

Base Board Connector: F0008

Mic-Connector: I2S: F0002

Camera: LVDS: F0001

status and control --> Base Logic Board R0280

Base Logic Board C0048

The base logic board consists of several electronic parts shown in Base Logic Board.

Main Board Connector: F0031

--> Base Micro Controller R0053

--> PMIC R0049

--> Base Micro Controller R0279

PMIC C0049

Power Management Integrated Circuit

power --> Main Logic Board R0063

Base Micro Controller C0051

The base micro controller consists of
- logic unit
- data storage
- persistent data+logic storage
- self supervision (by ECC and lockstep-cores)
- HW watchdog
- clock
- temperature sensor
- io ports
This block is optimized for providing a reliable execution of algorithms, see Quality Requirements.

Temperature: sensor: F0010

clock comm: I2C: F0007

Main Board Connector: F0009

Speaker: I2S: F0004

Motor Control: I2C: F0003

Diag: JTAG: F0005

reset cmd: F0006

--> Motors R0059

--> Loud Speaker R0060

--> PMIC R0062

Base Logic Board

This section shows the base board logic of the MoD5G system (Solution Space, System Level L3)

Base Logic Board C0048

The base logic board consists of several electronic parts shown in Base Logic Board.

Main Board Connector: F0031

--> Base Micro Controller R0053

--> Clock R0055

--> PMIC R0049

--> Temperature Sensor R0095

--> Base Micro Controller R0279

Base Micro Controller C0051

The base micro controller consists of
- logic unit
- data storage
- persistent data+logic storage
- self supervision (by ECC and lockstep-cores)
- HW watchdog
- clock
- temperature sensor
- io ports
This block is optimized for providing a reliable execution of algorithms, see Quality Requirements.

Temperature: sensor: F0010

clock comm: I2C: F0007

Main Board Connector: F0009

Speaker: I2S: F0004

Motor Control: I2C: F0003

Diag: JTAG: F0005

reset cmd: F0006

--> PMIC R0062

--> Clock R0066

Clock C0053

wakeup --> PMIC R0067

PMIC C0049

Power Management Integrated Circuit

Temperature Sensor C0071

--> Base Micro Controller R0096

Main Board Logic

This section shows the main board logic of the MoD5G system (Solution Space, System Level L3)

Main Logic Board C0047

The main logic board consists of several electronic parts shown in Main Board Logic.

Base Board Connector: F0008

Mic-Connector: I2S: F0002

Camera: LVDS: F0001

--> RAM R0070

--> ROM R0071

--> High Performance SoC R0069

--> Motivator R0077

--> High Performance SoC R0074

--> High Performance SoC R0076

High Performance SoC C0056

This block provides an execution environment for algorithms that is optimized for high performance.

--> RAM R0072

--> ROM R0073

--> Main Logic Board R0075

RAM C0057

ROM C0058

Motivator C0059

A motivator is a basic component needed to keep going on.

triggers --> High Performance SoC R0078

L2 Software [subsystem]

This diagram shows the virtual machines and specialized (non-versatile) execution environments (Solution Space, System Level L2)
These are deployed onto the logic boards shown in L2 Electric Parts and Electronics.
In this section, this view is further detailed to software elements, their relations and interactions.

High Performance SoC C0056

This block provides an execution environment for algorithms that is optimized for high performance.

--> Real Time Video Processing Chip R0079

--> General Purpose Partition 1 R0081

--> General Purpose Partition 2 R0082

Base Micro Controller C0051

The base micro controller consists of
- logic unit
- data storage
- persistent data+logic storage
- self supervision (by ECC and lockstep-cores)
- HW watchdog
- clock
- temperature sensor
- io ports
This block is optimized for providing a reliable execution of algorithms, see Quality Requirements.

Temperature: sensor: F0010

clock comm: I2C: F0007

Main Board Connector: F0009

Speaker: I2S: F0004

Motor Control: I2C: F0003

Diag: JTAG: F0005

reset cmd: F0006

--> Base Logic SW Partition R0083

--> Watchdog Execution Environment R0080

Real Time Video Processing Chip C0060

Watchdog Execution Environment C0061

General Purpose Partition 1 C0062

General Purpose Partition 2 C0063

Base Logic SW Partition C0064

Requirements and Goals

This section shows the goals of the software development for the MoD5G (Problem Space, Software Level L3)
In gray, the use cases on system level L1 are repeated from Requirements and Goals to show the refinement to software-only use cases shown in black.

Mouse Droid MoD5G C0004

The Mouse Droid (MoD5G) is a repair droid that can be instructed to perform a mission and which then autonomously selects tactics to achieve the mission goals.

--> Drive to location R0003

--> Repair using tools R0004

Drive to location C0007

The mouse droid can explore its environment and calculate a route from its actual position to the target location.

- The mouse droid explores its environment
- The mouse droid enriches an internally memorized map
- The mouse droid calculates a route
- The mouse droid drives along the calculated route
- The mouse droid re-caclulates the route in case of new environment data
- The mouse droid reaches the target location

pre: defined mission: F0032

--> Plan tasks R0091

--> Explore Environment R0234

--> Perform Movement R0235

Repair using tools C0008

The mouse droid has a couple of tools inside its chassis.

- The mouse droid uses a screw diver to untighten damaged parts
- The mouse droid uses a gripper to move the damaged part out of the way
- The mouse droid uses a gripper to put a spare part from its internal cargo bin to the target place
- The mouse droid uses a screw diver to tighten replaced parts
- The mouse droid uses a gripper to move the damaged part into its internal cargo bin.
(see L2 Mechanics)

--> Plan tasks R0090

--> Steer motors of tools R0233

Explore Environment C0067

When the mouse droid is missing relevant data on the environment, it plans a list of actions that suits the purpose of gaining the missing knowledge.

Perform Movement C0068

Steer motors of tools C0069

--> Base Micro Controller R0255

Plan tasks C0070

The mouse droid creates a list of actions to fulfill the given mission. If data on the environment is missing, it plans an explortion task and re-plans the action list later.

High Performance SoC C0056

This block provides an execution environment for algorithms that is optimized for high performance.

--> Explore Environment R0258

--> Plan tasks R0259

Base Micro Controller C0051

The base micro controller consists of
- logic unit
- data storage
- persistent data+logic storage
- self supervision (by ECC and lockstep-cores)
- HW watchdog
- clock
- temperature sensor
- io ports
This block is optimized for providing a reliable execution of algorithms, see Quality Requirements.

Temperature: sensor: F0010

clock comm: I2C: F0007

Main Board Connector: F0009

Speaker: I2S: F0004

Motor Control: I2C: F0003

Diag: JTAG: F0005

reset cmd: F0006

--> Steer motors of tools R0256

--> Perform Movement R0257

L3 Requirements

This diagram shows examples of system level L3 requirements.

L1Req: Recognize paths C0149

The MoDG5 shall use redundant sensor data to calculate paths that it can drive along.

L1Req: Position screw driver C0150

The MoDG5 shall bring the screw driver into a given 3D position.

Explore Environment C0067

When the mouse droid is missing relevant data on the environment, it plans a list of actions that suits the purpose of gaining the missing knowledge.

Steer motors of tools C0069

L3Req: Calc 3D scene from 2 cameras C0151

The Main Logic Board shall create a 3D model of the environment based on 2 camera images.

--> Explore Environment R0248

--> L1Req: Recognize paths R0249

Base Logic Board C0048

The base logic board consists of several electronic parts shown in Base Logic Board.

Main Board Connector: F0031

--> L1Req: Position screw driver R0247

--> Screw Driver R0252

Main Logic Board C0047

The main logic board consists of several electronic parts shown in Main Board Logic.

Base Board Connector: F0008

Mic-Connector: I2S: F0002

Camera: LVDS: F0001

--> L1Req: Recognize paths R0246

status and control --> Base Logic Board R0280

L3Req: Operate motors of tool-arm C0152

The Base Logic Board shall steer the motors of the tool-arm to a given 3D position.

--> L1Req: Position screw driver R0250

--> Steer motors of tools R0251

Screw Driver C0037

Camera C0041

--> Main Logic Board R0051

Constraints

This section explains the major obstacles, that need to be considered when designing a solution to reach the project goals. (Problem Space, Software Level L3)

Self-Preservation C0081

In case a wookiee growls at the MoD5G, it shall flee for self-preservation

Interoperability C0123

The programming and charging interfaces of the MoD5G shall be compatible to
- old republic terminals
- imperial terminals

Scope and Context

This section shows the organizational contexts of development and operational environments. (Problem Space, Software Level L3)

Imperial Operator C0082

program --> Mouse Droid MoD5G R0113

Operator of the old republic C0083

program --> Mouse Droid MoD5G R0112

Mouse Droid MoD5G C0004

The Mouse Droid (MoD5G) is a repair droid that can be instructed to perform a mission and which then autonomously selects tactics to achieve the mission goals.

Solution Strategy

This section shows the most fundamental principles of the software design. (Solution Space, Software Level L3)

Environment Capture C0118

Tactics Calculator C0108

Calculate tactics based on given strategy and current situation model

System Control C0119

Base Software Structure C0121

The software is basically structured into three parts:
- environment model generation
- calculating actions
- controlling execution of actions

Software Parts C0020

The software consists of control logic, initial data that was integrated at the factory and learned data that is aggregated during operation.
These software items are split over two logical boards and subdivided into independent execution partitions.

--> Tactics Calculator R0236

--> Environment Capture R0241

--> System Control R0242

Building Block View

This section shows the parts of the MoD5G software (Solution Space, Software Level L3)

Video Capture C0106

actual scene --> Environment Model Composer R0155

Audio Capture C0107

actual scene --> Environment Model Composer R0154

Tactics Calculator C0108

Calculate tactics based on given strategy and current situation model

Motor Controller C0109

Move motors according to calculated tactics

movement info --> Environment Model Composer R0153

Environment Capture C0118

--> Environment Model Composer R0152

--> Video Capture R0148

--> Audio Capture R0149

System Control C0119

--> SW Watchdog R0174

--> Motor Controller R0151

Environment Model Composer C0120

--> Tactics Calculator R0156

SW Watchdog C0129

The SW Watchdog shall check

- validity of data as well as
- validity of sequence of checkpoints
received from software components on the Main Logic Board.
See also Crosscutting Concepts.

Software Parts C0020

The software consists of control logic, initial data that was integrated at the factory and learned data that is aggregated during operation.
These software items are split over two logical boards and subdivided into independent execution partitions.

--> Tactics Calculator R0236

--> Environment Capture R0241

--> System Control R0242

Environment Capture

This diagram shows the software components that perceive the the outer environment and create a model from this data.

L3Req: Calc 3D scene from 2 cameras C0151

The Main Logic Board shall create a 3D model of the environment based on 2 camera images.

Audio Capture C0107

actual scene --> Environment Model Composer R0154

Environment Capture C0118

--> Environment Model Composer R0152

--> Video Capture R0148

--> Audio Capture R0149

--> Environment Model R0261

Video Capture C0106

actual scene --> Environment Model Composer R0155

Environment Model Composer C0120

--> L3Req: Calc 3D scene from 2 cameras R0254

creates --> Environment Model R0260

Environment Model C0111

The enironment model refers to the (limited) knowledge of the software on the real environment.

System Control

This diagram shows the software components that perceive MoD5G internal sensor data and steer the actuators of the MoD5G.

L3Req: Operate motors of tool-arm C0152

The Base Logic Board shall steer the motors of the tool-arm to a given 3D position.

System Control C0119

--> SW Watchdog R0174

--> Motor Controller R0151

Motor Controller C0109

Move motors according to calculated tactics

--> L3Req: Operate motors of tool-arm R0253

SW Watchdog C0129

The SW Watchdog shall check

- validity of data as well as
- validity of sequence of checkpoints
received from software components on the Main Logic Board.
See also Crosscutting Concepts.

Runtime View

This section shows the dynamic behavior of the software (Solution Space, Software Level L3)
This diagram shows the software states embedded in the system states. See Power Modes.

power::booting C0024

--> sw::sync R0107

--> sw::start R0099

--> sw::par R0100

--> sw::boot_main_board R0098

--> sw::booted R0110

--> sw::boot_base_board R0097

ready --> power::full_operation R0016

power::full_operation C0025

While the MoD5G is in full_operation state, all software parts are running and able to react on input data.

--> sw::op_sync R0117

--> sw::op_end R0115

--> sw::op_par R0116

--> sw::op_start R0114

--> sw::run_base R0105

--> sw::run_main R0104

next steps are planned --> power::energy_saving R0017

mission tactics are planned, no need to adapt

supervision fault --> power::booting R0033

power::energy_saving C0026

--> sw::run_base_only R0106

external event --> power::full_operation R0018

external event causes re-evaluating tactics

supervision fault --> power::booting R0032

sw::boot_base_board C0072

--> sw::sync R0109

sw::boot_main_board C0073

--> sw::sync R0108

sw::start C0074

--> sw::par R0101

sw::par C0075

--> sw::boot_main_board R0102

--> sw::boot_base_board R0103

sw::run_main C0076

--> sw::op_sync R0123

sw::run_base C0077

--> sw::op_sync R0122

sw::run_base_only C0078

sw::sync C0079

--> sw::booted R0111

sw::booted C0080

sw::op_start C0084

--> sw::op_par R0119

sw::op_end C0085

sw::op_par C0086

--> sw::run_main R0120

--> sw::run_base R0121

sw::op_sync C0087

--> sw::op_end R0118

Environment Model Composer Sequence

This diagram shows the typical communication sequence to compose the environment model.

Motor Controller C0109

Move motors according to calculated tactics

step count of movement motors --> Environment Model Composer R0166

step count of steering and movement motors

Tactics Calculator C0108

Calculate tactics based on given strategy and current situation model

calculate action list --> Tactics Calculator R0172

calculate action list to follow the given strategy

provide list of next actions --> Motor Controller R0167

update limp home action list (for emergency) --> Motor Controller R0168

For the emergency case, update the limp home action list

Environment Model Composer C0120

create 3D scene --> Environment Model Composer R0171

create 3D scene based on sensors, status and history.

composed 3D scene --> Tactics Calculator R0165

Audio Capture C0107

analyze audio signal --> Audio Capture R0169

list of detected audio sources --> Environment Model Composer R0164

Video Capture C0106

analyze video signal --> Video Capture R0170

3D scene of visible environment --> Environment Model Composer R0163

Persist List C0142

the action list shall be persisted, so that after a sudden reboot, the next actions are immediately available.

--> Tactics Calculator R0220

Deployment View

This section shows the deployment of the solution into the environment. (Solution Space, Software Level L3)

Motor Controller C0109

Move motors according to calculated tactics

movement info --> Environment Model Composer R0153

--> Base Logic SW Partition R0200

Base Logic SW Partition C0064

General Purpose Partition 2 C0063

Tactics Calculator C0108

Calculate tactics based on given strategy and current situation model

--> General Purpose Partition 2 R0202

Audio Capture C0107

actual scene --> Environment Model Composer R0154

--> General Purpose Partition 1 R0204

General Purpose Partition 1 C0062

Real Time Video Processing Chip C0060

Video Capture C0106

actual scene --> Environment Model Composer R0155

--> Real Time Video Processing Chip R0201

Environment Model Composer C0120

--> Tactics Calculator R0156

--> General Purpose Partition 1 R0203

Environment Capture C0118

--> Environment Model Composer R0152

--> Video Capture R0148

--> Audio Capture R0149

System Control C0119

--> Motor Controller R0151

Crosscutting Concepts

This section shows the recurring concepts within the the designed solution. (Solution Space, Software Level L3)

Fault Detection (main logic) C0127

Logic and data is supervised by the SW Watchdog located on the Base Micro Controller.
Every software component on the Main Logic Board shall check processed data and report its health to the SW Watchdog as well as passed checkpoints in the logic.

--> SW Watchdog R0175

Fault Detection (base logic) C0128

The hardware of the Base Micro Controller enables logic and data supervision. Therefore no extra software solution is implemented to monitor the base logic.

--> SW Watchdog R0198

SW Watchdog C0129

The SW Watchdog shall check

- validity of data as well as
- validity of sequence of checkpoints
received from software components on the Main Logic Board.
See also Crosscutting Concepts.

Architecture Decisions

This section documents the major design decisions. (Solution Space, Software Level L3)

Wookiee Detection C0131

Challenge: Detect presense of a Wookiee
Alt-1: Detect a growling wookie only by analyzing the audio spectrum recorded from the microphone.
- pro: simple to implement
- con: may produce false alarms
Alt-2: Combine the Video and the Audio sensor data to better distinguish a growling wookie from a shouting officer.
- pro: better recognize wookiees
- con: dependency on video processing
Decision: Alt-1
Rationale: Reacting on a false alarm is not mission-critical.

--> Self-Preservation R0177

Self-Preservation C0081

In case a wookiee growls at the MoD5G, it shall flee for self-preservation

Quality Requirements

This section shows the major quality scenarios. (Problem Space, Software Level L3)
Similar to Quality Requirements for system level L1, this section shows quality expectations: The WHAT shall be implemented, not the HOW.

Compatibility C0122

Compatibility defines a set of attributes that measures how well data and messages can be exchanged with other programs and/or versions.

Interoperability C0123

The programming and charging interfaces of the MoD5G shall be compatible to
- old republic terminals
- imperial terminals

--> Compatibility R0158

Quality Tree

When specifying quality requirements, these are categorized by two dimensions:

1) Which characteristic do they affect

2) Which use case do they serve
Thich chapter lists the quality requirements ordered by their main characteristic.

Old Republic Programming IF C0124

The old republic protocol for programming a droid shall be supported.

--> Interoperability R0159

Imperial Programming IF C0125

The imperial protocol for programming a droid shall be supported.

--> Interoperability R0160

Universial Charging IF C0126

The intergalactic standard protocol for power charging shall be supported.

--> Interoperability R0161

Interoperability C0123

The programming and charging interfaces of the MoD5G shall be compatible to
- old republic terminals
- imperial terminals

--> Compatibility R0158

Compatibility C0122

Compatibility defines a set of attributes that measures how well data and messages can be exchanged with other programs and/or versions.

Quality Scenarios

When specifying quality requirements, these are categorized by two dimensions:

1) Which characteristic do they affect

2) Which use case do they serve
Thich chapter lists the use cases which have special importance for quality requirements.

Mixed standards of terminals C0145

precondition:
- The MoD5G operates in an environment providing mixed terminal standards
trigger:
- The MoD5G drives to a charging or programming terminal which complied to either old republic or imperial standard.
scenario:
- The MoD5G determines the applicable standard
- The MoD5G uses the terminal for programming or charging

--> Interoperability R0227

Interoperability C0123

The programming and charging interfaces of the MoD5G shall be compatible to
- old republic terminals
- imperial terminals

Risks and Technical Debts

This section lists the risks and not-yet-addressed requirements. (Solution Space, Software Level L3)

Fault Detection Strategy may fail C0130

The fault detection strategy for logic and data on the Main Logic Board allows for unnoticed faults:
Not every error in logic can be detected by checkpoints only.

--> Risk: Wrong tactic is calculated R0181

Fault Detection (main logic) C0127

Logic and data is supervised by the SW Watchdog located on the Base Micro Controller.
Every software component on the Main Logic Board shall check processed data and report its health to the SW Watchdog as well as passed checkpoints in the logic.

--> Risk: Wrong tactic is calculated R0199

Risk: Wrong tactic is calculated C0134

- cause/fault: Due to cosmic rays, the main logic board performs a miscalculation that goes unnoticed by control flow supervision
- risk/failure: the MoD5G calculates a tactic that results in falling off a cliff

Glossary

This section explains the used terms. (Domain and Solution Space, Software Level L3)

Situation Model C0110

The situation model refers to the (limited/erroneous) knowledge of the software on environment and status.

--> MoD5G-Status Model R0142

--> Environment Model R0143

Environment Model C0111

The enironment model refers to the (limited) knowledge of the software on the real environment.

observe by sensors --> Real Environment R0146

Sensor data is the basis for assuming an environment model.

MoD5G-Status Model C0112

The status model refers to the (limited) knowledge of the software on the real status.

observe --> MoD5G Real Status R0147

Sensor data is the basis for assuming a status model. The algorithm for deriving a status model shall take into account that a sensor may be defect and/or a measured value may indicate a defect (which again may have several causes).

Real Situation C0113

The real situation refers to the reality of system status and environment.

--> MoD5G Real Status R0144

--> Real Environment R0145

Real Environment C0114

The real environment refers to the physical environment of the system.

MoD5G Real Status C0115

The real status refers to the real system status of the MoD5G. This may differ from what the sensors report.

Runtime View

This section shows the dynamic behavior of the system (Solution Space, System Level L1)

Power Modes C0021

refers to Power Modes

Health States C0022

refers to Health States

start operation C0153

--> orthogonal R0262

orthogonal C0154

--> Health States R0263

--> Power Modes R0264

Power Modes

This diagram shows the power states that are globally valid to all parts of the system.

power::startup C0023

external trigger or timer wakeup --> power::booting R0015

power::booting C0024

ready --> power::full_operation R0016

power::full_operation C0025

While the MoD5G is in full_operation state, all software parts are running and able to react on input data.

next steps are planned --> power::energy_saving R0017

mission tactics are planned, no need to adapt

stop operation --> power::off R0019

stop operation, set wakeup time

supervision fault --> power::booting R0033

power::energy_saving C0026

external event --> power::full_operation R0018

external event causes re-evaluating tactics

supervision fault --> power::booting R0032

power::off C0027

power::all C0138

The statemachine of all power states

--> power::booting R0192

--> power::energy_saving R0193

--> power::full_operation R0194

--> power::startup R0195

--> power::off R0196

Power Mode Timings

This diagram shows the expected startup and shutdown timings.

power::off C0027

--> power::startup R0209

power::full_operation C0025

While the MoD5G is in full_operation state, all software parts are running and able to react on input data.

sleep --> power::energy_saving R0212

shutdown --> power::off R0215

power::startup C0023

wakeup (0 ms) --> power::booting R0210

power::booting C0024

run (2300 ms) --> power::full_operation R0211

power::energy_saving C0026

wakeup (0 ms) --> power::energy_saving R0213

run (500 ms) --> power::full_operation R0214

max 2300 msec C0139

a --> power::booting R0218

b --> power::full_operation R0216

max 500 msec C0140

c --> power::energy_saving R0219

d --> power::full_operation R0217

Health States

This diagram shows the health states of the MoD5G system.

health::factory C0028

factory initial test --> health::operation R0207

health::disassembly C0029

health::healthy C0030

accident or ageing --> health::slightly_damaged R0021

severe accident --> health::damaged R0029

severe accident --> health::limp_home R0030

health::slightly_damaged C0031

accident --> health::limp_home R0022

severe accident --> health::damaged R0031

health::limp_home C0032

In case the full operation is not possible anymore, the MoD5G shall drive back to the home charging station.

accident --> health::damaged R0023

health::damaged C0033

decision for termination --> health::operation R0206

health::operation C0034

op_start: F0019

no_op: F0018

--> health::limp_home R0024

--> health::slightly_damaged R0025

--> health::healthy R0026

--> health::damaged R0027

--> health::disassembly R0205

--> health::healthy R0208

health::all C0137

The statemachine of all health states

--> health::factory R0189

--> health::operation R0190

--> health::disassembly R0191

Deployment View

This section shows the deployment of the solution into the environment. (Solution Space, System Level L1)

Space Station C0095

--> Programming Terminal R0129

--> Charging Terminal R0130

--> Maintenance Booth R0131

--> Mouse Droid MoD5G R0128

Mouse Droid MoD5G C0004

The Mouse Droid (MoD5G) is a repair droid that can be instructed to perform a mission and which then autonomously selects tactics to achieve the mission goals.

Programming Terminal C0096

Charging Terminal C0097

Maintenance Booth C0098

Crosscutting Concepts

This section shows the recurring concepts within the the designed solution. (Solution Space, System Level L1)

Motor Type C0099

All motors are electrical step motors.
Step motors can be controlled to move a defined number of steps forward or backwards.
Note that there are conditions when the actual number of steps is not equal to the previously requested number of steps, e.g. when accellerating or slowing down too fast.

Architecture Decisions

This section documents the major design decisions. (Solution Space, System Level L1)

Cosmic Rays C0002

The droid shall ensure data and program integrity.
It shall continue operation after cosmic rays have interfered with data storage or program execution.
Corrupted data must not be stored permanently.

2 of 3 Voter C0100

In order to support integrity of the system, the logic boards and the data storages are deployed three times as three identical parts.
All three parts shall produce the same outcomes given the same input.
If one deviates, it's result is ignored and the part is rebooted.

rejected alternative --> Cosmic Rays R0135

Cosmic Rays Information C0101

When a cosmic ray interferes with the system, the logic or the processed data gets corrupted.

provides background --> Cosmic Rays R0132

Watchdog Supervision C0102

In order to support integrity of the logic and data, a multi-stage hierarchy supervision shall be implemented.
Software watchdogs shall supervise the running software parts in a way that logic errors and corrupted data can be detected.
A hardware watchdog shall supervise the software watchdogs.
In case of a failure in the supervised logic/data, the system shall reboot. In case of a failure in the monitors, the system may reboot or it shall fall back to a valid supervision mode.

--> Cosmic Rays R0134

Decision: Watchdog C0103

Arguments:

- The 2 of 3 voter is easier to implement but causes higher hardware costs.
- The watchdog supervision requires higher engineering efforts but is cheaper in production.
The watchdog supervision shall be implemented.

selected solution --> Watchdog Supervision R0133

Quality Requirements

This section shows the major quality requrements and scenarios. (Problem Space, System Level L1)
In the following, requirements and scenarios are selected that show the quality expectations: The WHAT shall be implemented, not the HOW.

Usability C0009

Usability defines a set of attributes that measures how easy to learn and use the program is.

Maintainability C0010

Maintainability defines a set of attributes that influence how to analyze and mitigate defects that occur during operation.

Reliability C0011

Reliability defines a set of attributes that measures how mature and fault-tolerant the software is.

Compatibility C0122

Compatibility defines a set of attributes that measures how well data and messages can be exchanged with other programs and/or versions.

Quality Tree

This section shows the quality requirements ordered by quality characteristics.

Maintainability C0010

Maintainability defines a set of attributes that influence how to analyze and mitigate defects that occur during operation.

Analyzability C0014

The MoD5G shall allow to analyze faults that occurred during operation.

--> Maintainability R0009

Repairability C0012

The MoD5 hardware parts shall be exchangeable in case they are damaged.

--> Maintainability R0007

Maintainability

This diagram shows the quality requirements related to the characteristic "Maintainability".

Maintainability C0010

Maintainability defines a set of attributes that influence how to analyze and mitigate defects that occur during operation.

Repairability C0012

The MoD5 hardware parts shall be exchangeable in case they are damaged.

--> Maintainability R0007

30 years spare-parts supply C0013

The mechanical and electrical/electronics parts of the MoD5 shall be produceable in identical or similar form and quality for 30 years after production of the unit.

--> Repairability R0008

Analyzability C0014

The MoD5G shall allow to analyze faults that occurred during operation.

--> Maintainability R0009

Self-Diagnosis C0015

At the maintenance booth, the MoD5G shall provide an error log. This error log contains detected errors from operation and related environment conditions. It also lists possible causes(faults).

--> Analyzability R0010

Quality Scenarios

This section shows the quality-related scenarios in which the quality requirements shown in Quality Tree are of special importance.

Spare Parts Supply C0017

pre-condition:
- the stock of MoD5G spare parts is empty
trigger:
- 20 years after production, a MoD5G needs a spare part that is not available anymore
scenario:
- a service mechanic orders a batch of parts
- a factory creates the parts that fit in form, function and quality to the MoD5G
- spare parts are delivered

--> Repairability R0012

Motor defect C0016

pre-condition:
- the MoD5G is performing a 1-day mission autonomously
trigger:
- a motor fails to operate
- the goals of the 1-day mission cannot be accomplished anymore
scenario:
- the MoD5G cancels the mission and returns to the service point
- a service mechanic reads out the error log
- the MoD5G proposes to replace the suspicious motor
- the service mechanic replaces the motor

--> Analyzability R0197

Repairability C0012

The MoD5 hardware parts shall be exchangeable in case they are damaged.

Analyzability C0014

The MoD5G shall allow to analyze faults that occurred during operation.

Risks and Technical Debts

This section lists the risks and not-yet-addressed requirements. (Solution Space, System Level L1)

Limp home mode may fail C0105

In case of a single fault, the MoD5G shall return to the charging station.
The current design does not address the cases:
- the base logic board is damaged
- the energy cell is damaged
- the movement/steering motors are defect

comments --> health::limp_home R0136

explains --> Risk: MoD5G does not drive back (logic board) R0179

explains --> Risk: MoD5G does not drive back (motors) R0229

explains --> Risk: MoD5G does not drive back (energy) R0230

health::limp_home C0032

In case the full operation is not possible anymore, the MoD5G shall drive back to the home charging station.

Risk: MoD5G does not drive back (logic board) C0133

- cause/fault: the base logic board is damaged
- risk/failure: the MoD5G cannot drive anymore

fault not handled --> health::limp_home R0180

Risk: MoD5G does not drive back (energy) C0147

- cause/fault: the energy cell is damaged
- risk/failure: the MoD5G cannot drive anymore

fault not handled --> health::limp_home R0232

Risk: MoD5G does not drive back (motors) C0148

- cause/fault: the ,ovement/steering motors are damaged
- risk/failure: the MoD5G cannot drive anymore

fault not handled --> health::limp_home R0231

Glossary

This section explains the used terms. (Domain and Solution Space, System Level L1)
See also Glossary for software terms.

Maintenance booth C0104

A room in a star ship or on a planet where the following tasks are performed:
- check operability of droids
- oil refill service
- repair of droids
- disintegration of old droids

Base location C0143

The location where the MoD5G droid returns to when its mission is finished. This location typically provides a charging and programming terminal. This location can be re-programmed.

Stereotypes on "What to build"

UML:Node C0165

mouse-droid C0163

<path d=" c 3, -0.8 4.5, 0.5 4.5, 2.5 l -8, 0 c 1, -2, 2, -3, 3, -3 c 0.5, 0 0.5, 1 0, 1 m -1.1, 0.3 l -0.2, 0.2 " fill="#bb9977" />

--> mouse-img R0271

--> UML:Node R0272

mouse-img C0164

UML:UseCase C0170

goal C0171

<path fill="#aaeeff" d=" M 5,9 L 5,1 1,2.5 5,4 "/>

--> UML:UseCase R0277

--> flag R0278

flag C0172

UML:Actor C0174

environment C0175

<path fill="#eeff88" d=" M 1,0 C 1,0.55 0.55,1 0,1 C -0.55,1 -1,0.55, -1,0 C -1,-0.55 -0.55,-1 0,-1 C 0.55,-1, 1,-0.55, 1,0 "/> <path d=" M 2,0 L 4,0 M 1.73,1 L 3.46,2 M 1,1.72 L 2,3.46 M 0,2 L 0,4 M -1,1.72 L -2,3.46 M -1.73,1 L -3.46,2 M -2,0 L -4,0 M -1.73,-1 L -3.46,-2 M -1,-1.72 L -2,-3.46 M 0,-2 L 0,-4 M 1,-1.72 L 2,-3.46 M 1.73,-1 L 3.46,-2 "/>

--> UML:Actor R0281

--> env-img R0282

env-img C0176

Stereotypes on "How to achieve the goal"

Stereotypes allow a classification of elements into project-specific categories.

UML:Component C0155

env-perception C0156

<path fill="#ffcc66" d=" M 0.8,0 a 0.8,0.8 0 1 0 -1.6,0 a 0.8,0.8 0 1 0 1.6,0 " /> <path d=" M 1,0 A 1,0.5 22 1 1 0.707,0.707 A 1,0.5 67 1 1 0,1 A 1,0.5 112 1 1 -0.707,0.707 A 1,0.5 157 1 1 -1,0 A 1,0.5 202 1 1 -0.707,-0.707 A 1,0.5 247 1 1 0,-1 A 1,0.5 -68 1 1 0.707,-0.707 A 1,0.5 -23 1 1 1,0 " />

--> UML:Component R0265

--> env-image R0266

env-image C0157

UML:Class C0158

decision C0159

<path d="m 8,12 l -4,7 1,1 6,0 1,-1 -4,-7 l 8,-4 9,0 l -4,7 1,1 6,0 1,-1 -4,-7 " /><path d="m 15,5 l 1,3 m 0,2 l 0,17 " />

--> UML:Class R0267

--> decision-img R0268

decision-img C0160

data C0161

<path d="m 4,5 l 0,22 c 0,2.25 5.25,4 12,4 s 12,-1.75 12,-4 l 0,-22 " /><path d="m 4,5 c 0,-2.25 5.25,-4 12,-4 s 12,1.75
12,4 s -5.25,4 -12,4 s -12,-1.75 -12,-4 " />

--> UML:Class R0269

--> data-img R0270

data-img C0162

rejected_alternative C0166

<path d="m 1,24 4,4 22,0 4,-4 " /><path stroke="#cc0000" d="m 8,17 c 0,-4.4 3.6,-8 8,-8 s 8,3.6 8,8 s -3.6,8 -8,8 s
-8,-3.6 -8,-8 " /><path stroke="#cc0000" d="m 11,17 l 10,0 " />

--> rejected R0273

--> UML:Class R0274

rejected C0167

chosen_alternative C0168

<path d="m 1,24 4,4 22,0 4,-4 " /><path stroke="#00aa00" d="m 8,17 c 0,-4.4 3.6,-8 8,-8 s 8,3.6 8,8 s -3.6,8 -8,8 s
-8,-3.6 -8,-8 " /><path stroke="#00aa00" d="m 11,17 l 10,0 m -5,-5 l 0,10 " />

--> chosen R0275

--> UML:Class R0276

chosen C0169