Making
the Car Move

Over­view

Five work products, fourth unit #

The pow­er­train pushes, the driv­ing re­sis­tances hold back, the brakes slow down. This unit adds the three forces up and turns them into mo­tion. It has two states, speed and dis­tance, three places where it lim­its a value, and the most de­mand­ing test of the se­ries: a drive of ten kilo­me­tres that touches every limit of the in­ter­face. Same work­flow, same five work prod­ucts.

All re­ports are self-con­tained HTML files. They open off­line, with­out MATLAB, and are the files that doc­u­ment the test en­vi­ron­ment in the safety case.

The physics

From forces to motion #

New­ton’s sec­ond law, one step at a time. Every 20 ms the unit takes the three forces, works out the ac­cel­er­a­tion, and moves the speed and the dis­tance on by one step. Three lim­its keep the re­sult phys­i­cal.

With this unit the car model is com­plete, and the num­bers of the ear­lier pages fi­nally add up to driv­ing:

• The road de­cides, not the en­gine. On a dry road the en­gine is the limit: 12 kN, 8 m/s², 0–100 km/h in 3.5 s. On a wet road the tyres cap the push at 10.3 kN, on snow at 4.4 kN: 4.1 and 9.4 s.
• The brakes are capped too. The brakes de­liver 15 kN, but even a dry road passes on only 14.7 kN. From 100 km/h the car stops in 40 m on a dry road, 57 m on a wet one and 131 m on snow.
• Every limit of the in­ter­face is reach­able. Full drive down a 15 % hill gives the high­est ac­cel­er­a­tion, 9.47 m/s². Full brak­ing against the high­est re­sis­tance gives the low­est, −13.33 m/s². Both are cor­ners of the input ranges, and a test drives into both.

Fig­ure 1 · Com­puted from the spec­i­fi­ca­tion: the same car on three roads, flat, with­out air drag. Left: full drive to 100 km/h, then full brake. Right: the stop­ping dis­tance.

Why a plain sum. The unit uses the sim­plest in­te­gra­tion there is: the new speed is the old speed plus ac­cel­er­a­tion times 20 ms, and the dis­tance grows by the speed at the start of the cycle. After one sec­ond of full drive that gives 3.92 m, where the exact for­mula gives 4.00 m. The spec­i­fi­ca­tion states this dif­fer­ence, so the test can ex­pect it in­stead of tol­er­at­ing it.

The plan. The car was built in steps, and each step was ver­i­fied be­fore the next one was added: the pow­er­train, the driv­ing re­sis­tances, the brakes and the lon­gi­tu­di­nal mo­tion (this page). Next the loop is closed with the cruise con­troller.

Why · ISO 26262-8

Why verify the motion of a test tool #

The cruise con­troller only ever sees one num­ber from the car: the speed. Every other unit reaches the con­troller through this one. A car that rolls back­wards on a hill, that brakes harder than its tyres allow, or that loses a metre per kilo­me­tre would test the con­troller against a car that does not exist. The con­troller would pass, and the road would find the prob­lem.

The unit has two states, and both run for the whole drive. An error in a state does not show in one step; it adds up. That is why the tests here run up to two min­utes of sim­u­lated time and look at the speed and the dis­tance in every cycle, and why the spec­i­fi­ca­tion says how large the round­ing of sin­gle pre­ci­sion may get over ten kilo­me­tres.

ISO 26262-8 asks for a spec­i­fied ver­i­fi­ca­tion en­vi­ron­ment (Clause 9) and for con­fi­dence in every tool whose error could let a fault go un­de­tected (Clause 11). The pow­er­train page ex­plains the ar­gu­ment in full. The full run for this unit takes about fif­teen sec­onds.

Step 1 · Spec­i­fi­ca­tion

Unit Specification #

Three pages in the same lay­out as for the other units: the in­ter­face table, six re­quire­ments, and the six test cases with the val­ues a re­viewer can check by hand.

• LON-1 · Start at rest. In the first cycle the speed is V_INIT and the dis­tance is 0 m.
• LON-2 · New­ton’s law. In every cycle the speed changes by the net force di­vided by VEH_MASS, times TS. The net force is the tyre force minus fRes.
• LON-3 · Grip of the road. The tyre force fDrive − fBrake is lim­ited to plus and minus MU_ROAD × VEH_MASS × G.
• LON-4 · No rolling back. The speed is never neg­a­tive. When a cycle would take it below 0, it is 0, and accLong re­ports the ac­cel­er­a­tion ac­tu­ally ap­plied in that cycle.
• LON-5 · Dis­tance. In every cycle the dis­tance grows by the speed times TS. It never de­creases.
• LON-6 · Al­ways within lim­its. For all in­puts and pa­ram­e­ters within their ranges, speed, ac­cel­er­a­tion and dis­tance stay within theirs in every cycle.

What mat­ters: the input ranges are the out­put ranges of the three units that feed this one, so the in­ter­faces of the car model fit to­gether by con­struc­tion. MU_ROAD is the only pa­ram­e­ter with a range: one car, tested on dry, wet and snowy roads. Speed and dis­tance have no phys­i­cal limit in­side this unit; 85 m/s (just above the 300 km/h lim­iter of the pow­er­train) and 10 km (longer than any test) are de­sign as­sump­tions, and the spec­i­fi­ca­tion says so.

Step 2 · EverView

Model view for the design review #

Twenty-six blocks, read from left to right. The shaded area on the left is the grip of the road: drive minus brake force, cut at plus and minus MU_ROAD × VEH_MASS × G by a min and a max. Then the re­sis­tance is sub­tracted, the re­sult di­vided by the mass and mul­ti­plied by the sam­ple time. A sum and a max make the new speed, never below 0, and a unit delay holds it. The bot­tom line adds up the dis­tance in a sec­ond unit delay.

Fig­ure 2 · The unit in EverView. Sig­nal names, types and ranges on every line; one REQ tag per re­quire­ment on the block that im­ple­ments it.

• Re­quire­ment tags on blocks. REQ: LON-3 on the max that closes the grip limit, LON-2 on the di­vi­sion by the mass, LON-4 on the max that stops the car at 0, LON-1 on the speed state with its ini­tial value V_INIT, LON-5 on the dis­tance sum, LON-6 on the ac­cel­er­a­tion out­put. EverCheck and EverTest read the same tags.
• The ac­cel­er­a­tion is mea­sured, not as­sumed. accLong is the change of speed in the cycle di­vided by TS, not the force di­vided by the mass. In the cycle in which the car stops the two dif­fer, and only the mea­sured value is true: that is what LON-4 asks for.
• Three lim­its, three de­ci­sions. Two for the grip, one for the speed. No switch, no logic, no lookup table: ev­ery­thing else is arith­metic.

Open WEB_LON.html →

Step 3 · EverCheck

Static analysis #

The same 54 checks as for the other units, run be­fore any test ef­fort is spent: in­ter­face com­plete and con­sis­tent, only ap­proved block types, ex­plicit ini­tial­iza­tion, di­vi­sions safe against zero, unique re­quire­ment IDs, re­quire­ment trace­abil­ity, model con­fig­u­ra­tion, no warn­ings dur­ing model up­date. Re­sult: 54 of 54 passed.

Fig­ure 3 · EverCheck sum­mary: 26 blocks, op­er­a­tor com­plex­ity 15, 54 / 54.

• Di­vi­sion by a con­stant. The ac­cel­er­a­tion di­vides by the mass and the speed change by the sam­ple time. The di­vi­sion check traces both di­vi­sors back to their pa­ram­e­ters and con­firms that their ranges ex­clude zero.
• Two states, both ini­tial­ized. The speed starts at V_INIT, the dis­tance at 0, both writ­ten in the model. With­out them LON-1 would de­pend on the sim­u­la­tor’s de­faults.
• En­vi­ron­ment record. Model ver­sion, li­brary ver­sion, MATLAB re­lease, EverCheck ver­sion, check-set file. The re­port is re­pro­ducible.

Open SMA_LON.html →

Step 4 · EverTest

One test case per requirement #

Each test is a short drive: ac­cel­er­ate, hold, brake, stop. Six test cases, one per re­quire­ment, 6967 time steps in total, and an ex­pected value in every one of them, com­puted from the spec­i­fi­ca­tion be­fore the first run.

• The stop within a cycle. TC4 brakes from 4 m/s. In the cycle in which the car stops it has only 0.017 m/s left, so the mea­sured ac­cel­er­a­tion is −0.857 m/s², not the −6.867 m/s² of the brake force. The ref­er­ence has the smaller num­ber. A model that re­ported the force in­stead of the mo­tion would fail here.
• Three roads in one test set. TC3 runs on snow, TC4 on a wet road, the oth­ers on a dry one. MU_ROAD takes both ends of its range and a value in be­tween, and the upper grip limit, which a dry road never reaches, is reached at all.
• Ready for re­view. Every input change is a phase marker in the test data, such as > brake 15000 N, with the ex­pected num­bers after //. The goal of each case states the val­ues to look for, so a re­viewer can read the plot against the spec­i­fi­ca­tion with­out open­ing the model.

The test harness, live

This is the EverView ex­port of the test har­ness it­self, live in the frame: the lon­gi­tu­di­nal mo­tion unit be­tween the EverTest source and sink, with the sig­nal names and ranges of the in­ter­face. Dou­ble-click into LON to walk the model, click a block for its prop­er­ties. Ex­actly what a re­viewer does, with no li­cence.

Open full screen in a new tab ↗

Open the live har­nessFull screen in a new tab. Walk into the unit, click a block for its prop­er­ties. Best on a tablet or desk­top.Open live ex­port ↗

LIVE EVERVIEW EXPORT · LON_har­ness · NAVIGATE · SEARCH · PROPERTIES

Open LON_har­ness.html →

Step 5 · EverTest

Test results and traceability #

One run ex­e­cutes the six cases in the har­ness and writes the ver­i­fi­ca­tion re­port. Re­sult: 6 of 6 passed, all six re­quire­ments cov­ered, all eleven de­sign ranges reached.

Fig­ure 4 · Re­quire­ments trace­abil­ity ma­trix: one test case per re­quire­ment, all passed.

Fig­ure 5 · TC4_NoReverse in the re­port: up to 4 m/s, braked to 0, held on the hill with and with­out brake, never below 0, then rolling for­ward down­hill.

Fig­ure 6 · The test data of TC1: the hand-com­puted ref­er­ence next to the recorded value in every cycle, with the phase marker, the goal and the plot com­mands in the de­scrip­tion col­umn.

• Record, judge, ac­cept. The first run recorded the out­puts with ? as ref­er­ence. Each recorded value was com­pared with the hand-com­puted one; only then were the ref­er­ences writ­ten. Largest dif­fer­ence: 0.0064 m/s², the round­ing of sin­gle pre­ci­sion. The al­lowed dif­fer­ence is 0.01.
• Ten kilo­me­tres in sin­gle pre­ci­sion. The dis­tance is a sum of more than 6000 small steps. In sin­gle pre­ci­sion it drifts by 0.58 m against the exact value over 10 km. The spec­i­fi­ca­tion states this, and TC6 checks the dis­tance with a rel­a­tive tol­er­ance of 0.01 %: 1 m at 10 km, and the ab­so­lute 0.01 below 100 m.
• En­vi­ron­ment and ver­sions. Har­ness re­vi­sion, li­brary ver­sion, spec­i­fi­ca­tion ver­sion, MATLAB, EverTest, EverCheck, Excel. Start and end time per case.

What the first runs found

Three things did not pass on the first at­tempt. None of them was a mod­el­ling error, all three were gaps be­tween the spec­i­fi­ca­tion and the arith­metic, and each was closed in the spec­i­fi­ca­tion first:

• A limit 0.00001 too tight. The high­est ac­cel­er­a­tion is (12 000 + 2207.25) / 1500 = 9.4715 m/s² ex­actly. In sin­gle pre­ci­sion the model com­putes 9.47151, and the range check stopped the sim­u­la­tion. The de­sign limit is now 9.4716, with the rea­son writ­ten next to it.
• Lim­its must be reached, not ap­proached. The de­sign-range check wants each limit in the ref­er­ences. The first TC6 stopped at 84.86 m/s and 9999 m. One cycle with 7937.08 N now lands the car on ex­actly 85 m/s, and one cycle with 3550.06 N sets the stop­ping point to ex­actly 10 000 m.
• A range needs a mid­dle. MU_ROAD was tested at 0.3 and 1.0 only. The check asks for a value in be­tween, so TC4 now runs on a wet road at 0.7.

Fig­ure 7 · TC6_Range: ac­cel­er­a­tion, dis­tance and speed over 125 s. Every limit of the in­ter­face reached, none passed.

Open VER_LON.html →

Step 6 · Cov­er­age

Structural coverage: three limits, both ways #

Each of the three lim­its is a min or max block, and each is a de­ci­sion with two out­comes: the limit is ac­tive or it is not. The cov­er­age re­port shows all six out­comes, cy­clo­matic com­plex­ity 4.

Fig­ure 8 · COV_LON: de­ci­sion 6 / 6 on the two grip lim­its and the no-rolling-back limit.

Fig­ure 9 · TC3_Grip on snow: both grip lim­its ac­tive, one after the other. With­out the lim­its the plot would show +8 and −10 m/s².

• Cov­er­age fol­lows the re­quire­ments. No test was added for cov­er­age. TC3 takes both grip lim­its, TC4 the stop at 0, and TC6 takes the brake limit on a dry road.
• The rare out­come counts. The upper grip limit is ac­tive in only 100 of 13 934 counted eval­u­a­tions. It is rare be­cause a dry road never reaches it. Cov­er­age shows that it was reached at all; TC3 shows that it gave the right num­ber.
• What cov­er­age does not say. The two states are not de­ci­sions. Whether the speed starts at V_INIT and whether the dis­tance adds up is the job of TC1, TC5 and their ref­er­ences.

Open COV_LON.html →

Step 7 · Tool con­fi­dence

Four units of one test tool #

The ar­gu­ment is the same as for the pow­er­train, the re­sis­tances and the brakes. EverCheck and EverTest bring their own TCL 3 qual­i­fi­ca­tion kit. The plant model is a tool we build our­selves, and its con­fi­dence comes from the work shown here: a spec­i­fi­ca­tion, a model that passed the prod­uct’s static checks, tests against val­ues com­puted in ad­vance, cov­er­age of every de­ci­sion, and re­ports that record every ver­sion. With this page all four plant units have that record, and the in­ter­faces be­tween them were spec­i­fied to fit.

How ISO 26262 tool qual­i­fi­ca­tion works →

Ef­fort

What it took #

• Spec­i­fi­ca­tion: three pages, six re­quire­ments, the test val­ues for three roads writ­ten down be­fore the model ran.
• Tests: six test cases, 6967 time steps, every ex­pected value com­puted be­fore it was ac­cepted.
• Run: static anal­y­sis, tests, cov­er­age, re­ports and EverView ex­port in about fif­teen sec­onds. Re-run on every change to the model or the spec­i­fi­ca­tion.
• Re­view: all five files open in a browser; noth­ing to in­stall on the re­viewer’s side.