industrial case study u pp aal e-mail · industrial case study using u pp aal? magn us lindahl 1 p...

Formal Design and Analysis of a Gear Controller:

an Industrial Case Study using UPPAAL?

Magnus Lindahl1 Paul Pettersson2 Wang Yi2

1 Mecel AB, G�oteborg, Sweden. E-mail: [email protected] Department of Computer Systems, Uppsala University, Sweden.

E-mail: fpaupet,[email protected]

Abstract. In this paper we report on an application of the validation and

veri�cation tool-kit Uppaal in the design and analysis of a prototype gear

controller, carried out in a joint project between industry and academia.

? This work has been supported by ASTEC (Advanced Software TEChnology), NUTEK

(Swedish Board for Technical Development) and TFR (Swedish Technical Research

Council)

Table of Contents

1 Introduction : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 3

2 The Gear Controller : : : : : : : : : : : : : : : : : : : : : : : : : : : : 4

2.1 Functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

2.2 Environment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

2.3 Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

3 Formal Description of the System : : : : : : : : : : : : : : : : : : : 6

3.1 Environment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

3.2 Functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

4 Formal Validation and Veri�cation : : : : : : : : : : : : : : : : : : : 9

4.1 System Decoration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

4.2 Requirement Speci�cation . . . . . . . . . . . . . . . . . . . . . . . . 10

4.3 Time Bound Derivation . . . . . . . . . . . . . . . . . . . . . . . . . 10

4.4 Veri�cation Results . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

5 Conclusion : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 11

A The Requirement Speci�cation : : : : : : : : : : : : : : : : : : : : : 13

B The System Description : : : : : : : : : : : : : : : : : : : : : : : : : : 20

2

1 Introduction

Over the past few years, a number of modeling and veri�cation tools for real-time

systems [HHWT95, DOTY95, BLL+96] have been developed based on the theory

of timed automata [AD94]. They have been successfully applied in various case-

studies [BGK+96, JLS96, SMF97]. However, the tools have been mainly used in

the academic community, namely by the tool developers. It has been a challenge

to apply these tools to real-sized industrial case-studies. In this paper we report

on an application of the veri�cation tool-kit Uppaal to a prototype gear controller

developed in a joint project between industry and academia. The project has been

carried out in collaboration between Mecel AB and Uppsala University.

The gear controller is a component in the real-time embedded system that operates

in a modern vehicle. The gear-requests from the driver are delivered over a commu-

nication network to the gear controller. The controller implements the actual gear

change by actuating the lower level components of the system, such as the clutch,

the engine and the gear-box. Obviously, the behavior of the gear controller is critical

to the safety of the vehicle. Simulation and testing have been the traditional ways

to ensure that the behavior of the controller satis�es certain safety requirements.

However these methods are by no means complete in �nding errors though they are

useful and practical. As a complement, formal techniques have been a promising

approach to ensuring the correctness of embedded systems. The project is to use

formal modeling techniques in the early design stages to describe design sketches,

and to use symbolic simulators and model checkers as debugging and veri�cation

tools to ensure that the predicted behavior of the designed controller at each design

phase, satis�es certain requirements under given assumptions on the environment

where the gear controller is supposed to operate. The requirements on the controller

and assumptions on the environment have been described �rst by Mecel AB in an

informal document, and then formalized in the Uppaal logic and model to deduce

the design of the gear controller.

Uppaal3 is a tool suite for validation and symbolic model-checking of real-time sys-

tems. Uppaal consists of a number of tools including a graphical editor for system

descriptions (based on Autograph), a graphical simulator, and a symbolic veri�er

for real-time systems described in the textual or the graphical format. Uppaal is

developed in collaboration between Department of Computer Systems at Uppsala

University, Sweden and BRICS4 at Aalborg University, Denmark.

In the design phase the symbolic simulator of Uppaal is applied intensively to val-

idate the dynamic behavior of each design sketch, in particular for fault detection,

derivation of time constraints (e.g. the time bounds for which a gear change is guar-

anteed) and later also for debugging using diagnostic traces (i.e. counter examples)

generated in the veri�er. The correctness of the gear controller design has been es-

tablished by automatic proofs of 46 properties (i.e. logical formulae) derived from

the requirements speci�ed by Mecel AB. The veri�cation was performed in a few

seconds on a Pentium PC5 running Uppaal version 2.12.2.

The paper is organised as follows: In Section 2 and 3 the gear controller system and

its requirements are informally and formally described. In Section 4 the formal de-

scription of the system and its requirements are veri�ed using the tool-kit Uppaal.

Section 5 provides some concluding remarks.

3 Installation and documentation is obtainable at the Uppaal home page

http://www.docs.uu.se/docs/rtmv/uppaal/.4 Basic Research in Computer Science, Center of Danish National Research Foundation5 2.99 seconds on a Pentium 75MHz equipped with 24 MB of primary memory.

3

2 The Gear Controller

In this section we informally describe the functionality and the requirements of

the gear controller proposed by Mecel AB, as well as the abstract behavior of the

environment where the controller is supposed to operate.

2.1 Functionality

The gear controller changes gears by requesting services provided by the components

in its environment: the gear-box, the clutch, and the engine. The interaction with

these components is through the vehicles communication network. Similarly, the

gear controller provides services to its users through its interface. A description of

the gear controller and its interface is as follows.

Interface The interface receives service requests and keeps information about the

current status of the gear controller, which is either changing gear or idling.

The user of this service is either the driver using the gear stick or a dedicated

component implementing a gear change algorithm. The interface is assumed to

respond when the service is completed.

Gear Controller The only user of the gear controller is its interface. The controller

performs a gear change in �ve steps beginning when a gear change request is

received from the interface. The �rst step is to accomplish a zero torque trans-

mission, making it possible to release the currently set gear. Secondly the gear is

released. The controller then achieves synchronous speed over the transmission

and sets the new gear. Once the gear is set the engine torque is increased so

that the same wheel torque level as before the gear change is achieved.

Under di�cult driving conditions the engine may not be able to accomplish zero

torque or synchronous speed over the transmission. It is then possible to change

gear using the clutch. By opening the clutch, and consequently the transmission,

the connection between the engine and the wheels is broken. The gear-box is at

this state able to release and set the new gear, as zero torque and synchronous

speed is no longer required. When the clutch closes it safely bridges the speed

and torque di�erences between the engine and the wheels. We refer to these

exceptional cases as recoverable errors.

2.2 Environment

The environment of the gear controller consists of the following three components:

Gear-Box It is an electrically controlled gear-box with control electronics. It pro-

vides services to set a gear in 100 to 300 ms and release a gear in 100 to 200 ms.

If a setting or releasing-operation of a gear takes more than 300 ms or 200 ms

respectively, the gear-box will indicate this and stop in a speci�c error state.

Clutch It is an electrically controlled clutch that has the same sort of basic services

as the gear-box. The clutch can open or close within 100 to 150 ms. If a opening

or closing does not accomplish with the time bounds, the clutch will indicate

this and reach a speci�c error state.

Engine It o�ers three modes of control: normal torque, zero torque, and syn-

chronous speed. The normal mode of operation is normal torque mode where the

engine gives the requested engine torque. In zero torque mode the engine will try

to �nd a zero torque di�erence over the transmission. Similarly, in synchronous

4

speed mode the engine searches zero speed di�erence between the engine and

the wheels6.

The engine have an angular acceleration without load that can reach 10000

rpm/s and is controlled twice per lap though it is a four cylinder engine. The

decrease of the angular velocity is achieved by removing the fuel, ignition and

air. As a result, the engine retards through its friction. The decrease of the

angular velocity is generally 4 to 5 times less than the angular acceleration and

has a linear dependability on the friction. This asymmetric di�erence between

acceleration and retardation of the angular velocity is di�cult to control espe-

cially when the engine is running without load, because the di�erence then is

maximal. Due to these circumstances the maximum time bound searching for

zero torque is limited to 400 ms within which a safe state is entered. Further-

more, the maximum time bound for synchronous speed control is limited to 500

ms. If 500 ms elapses the engine enters an error state.

We will refer the error states in the gear-box, the clutch and the engine as unre-

coverable errors since it is impossible for the gear controller alone to recover from

these errors.

2.3 Requirements

In this section we list the informal requirements and desired functionality on the gear

controller, provided by Mecel AB. The requirements are to ensure the correctness

of the gear controller. A few operations, such as gear shifts and error detections, are

crucial to the correctness. They must be guaranteed within certain time bounds. In

addition, there are also requirements on the controller to ensure desired qualities of

the vehicle, such as: good comfort, low fuel consumption, and low emission.

1. Predictability. The predictability requirements are to ensure strict synchro-

nisation and control between components.

(a) There should not be dead-locks or live-locks in the system.

(b) When the engine is regulating torque, the clutch should be closed.

(c) The gear has to be set in the gear-box when the engine is regulating torque.

2. Performance. These requirements limit the maximum time to perform a gear

shift when no unrecoverable errors occurs.

(a) A gear shift should be completed within 1.5 seconds.

(b) A gear shift, under normal operation conditions, should be performed within

1 second.

3. Functionality. The following requirements are to ensure the desired function-

ality of the gear controller.

(a) It has one reverse gear, �ve forward gears and one neutral gear.

(b) It is able to use all gears.

(c) It uses the engine to enhance zero torque and synchronous speed over the

transmission.

(d) It uses the gear-box to set and release gears.

(e) It is allowed to use the clutch in di�cult conditions.

(f) It does not request zero torque when shifting from neutral gear.

(g) The gear controller does not request synchronous speed when shifting to

neutral gear.

6 Synchronous speed mode is used only when the clutch is opened or no gear is set.

5

GearSet

Gearneu

ReqSet

ReqNeu CloseClutch

OpenClutch

ClutchIsClosed

ClutchIsOpen TorqueZero

SpeedSet

(ToGear)

(FromGear)

(ToGear)

ReqZeroTorque

ReqSpeed

ReqTorque

NewGear

GBTimer

GCTimer

ETimer

(ErrStat)

CTimer

GearBox Clutch

GearControl

Interface

Engine

ReqNewGear

(UseCase)(ErrStat)

Fig. 1. A Flow-Graph of the Gear-Box System.

4. Error Detection. The gear controller detects and indicates error only when:

(a) the clutch is not opened in time,

(b) the clutch is not closed in time,

(c) the gear-box is not able to set a gear in time,

(d) the gear-box is not able to release a gear in time.

3 Formal Description of the System

To design and analyze the gear controller we model the controller and its environ-

ment in the Uppaal model. The Uppaal model is networks of timed automata

extended with integer variables. A timed automaton [AD90] is a non-deterministic

�nite state automata extended with real-valued clocks. A network of such automata

is a collection of automata connected with synchronization channels which allows

for pairwise synchronizations (i.e. handshaking) between automata. For a detailed

description of the Uppaal model and tool we refer to [LPY97].

The modeling phase has been separated in two steps. First a model of the environ-

ment is created, as its behavior is speci�ed in advance as assumptions (see Section

2.2). Secondly, the controller itself and its interface are designed to be functionally

correct in the given environment. Figure 1 shows a ow-graph of the resulting model

where nodes represent automata and edges represent synchronization channels or

shared variables (enclosed within parenthesis). The gear controller and its interface

are modeled by the automata GearControl (GC) and Interface (I). The environment

is modeled by the three automata: Clutch (C), Engine (E), and GearBox (GB).

The system uses six variables. Four are timers (i.e. real-valued clocks) that measure

1=1000 of seconds (ms): GCTimer, GBTimer, CTimer and ETimer. The two other

variables, named FromGear and ToGear, are used at gear change requests7. In the

following we describe the �ve automata of the system. The refered �gures (3 to 6)

can be found in appendix B.

7 The domains of FromGear and ToGear are bounded to f0; :::; 6g, where 1 to 5 represent

gear 1 to gear 5, 0 represents gear N, and 6 is the reverse gear.

6

3.1 Environment

The three automata of the environment model the basic functionality and time

behavior of the components in the environment. The components have two channels

associated with each service: one for requests and one to respond when service have

been performed.

Gear-Box In automaton GearBox, shown in Figure 3, inputs on channel ReqSet

requests a gear set and the corresponding response on GearSet is output if the

gear is successfully set. Similarly, the channel ReqNeu requests the neutral gear

and the response GearNeu signals if the gear is successfully released. If the gear-

box fails to set or release a gear the locations named ErrorSet and ErrorNeu are

entered respectively.

Clutch The automaton Clutch is shown in Figure 4. Inputs on channels OpenClutch

and CloseClutch instruct the clutch to open and close respectively. The cor-

responding response channels are ClutchIsOpen and ClutchIsClosed. If the

clutch fails to open or close it enters the location named ErrorOpen and Error-

Close respectively.

Engine The automaton Engine, shown in Figure 6, accepts incoming requests for

synchronous speed, a speci�ed torque level or zero torque on the channels

ReqSpeed, ReqTorque and ReqZeroTorque respectively. The actual torque level

or speed being requested is not modeled since it does not a�ect the design

of the gear controller8. The engine responds to the requests on the channels

TorqueZero and SpeedSetwhen the services have been completed. Requests for

speci�c torque levels (i.e. signal ReqTorque) are not answered, instead torque

is assumed to increase immediately after the request.

The engine may fail to deliver zero torque or synchronous speed in time as

described in Section 2.2. It will then enter a location named CluthOpen without

responding to the request. A more dangerous scenario will occur if the engine

regulates on synchronous speed in too long time. To avoid damage a timeout

interrupts the engine after 500 ms of regulation and a location named ErrorSpeed

is entered.

3.2 Functionality

In this section we describe the model of the designed gear controller and its in-

terface. Given the formal model of the environment, the gear controller have been

designed both to satisfy the correctness requirements given in Section 2.3, and the

functionality requirements in Section 2.1.

Gear Controller The GearControl automaton is shown in Figure 2. Each main

loop implements a gear change by interacting with the components of the envi-

ronment.

The designed controller measures response times (using the timer GCTimer)

from the components to detect errors (as failures are not signaled). The reac-

tion of the controller depends on how serious the occurred error is. It either

recovers the system from the error, or terminates in a pre-speci�ed location

that points out the (unrecoverable) error: COpenError, CCloseError, GNeuError

or GSetError. Recoverable errors are detected in the locations CheckTorque and

CheckSyncSpeed.

8 Hence, the time bound for �nding zero torque (i.e. 400 ms) should hold when decreasing

from an arbitrary torque level.

7

GearControlGearControlGearControlGearControlGearControlGearControlGearControlGearControlGearControlGearControlGearControlGearControlGearControlGearControlGearControlGearControlGearControl

GNeuErrorGNeuErrorGNeuErrorGNeuErrorGNeuErrorGNeuErrorGNeuErrorGNeuErrorGNeuErrorGNeuErrorGNeuErrorGNeuErrorGNeuErrorGNeuErrorGNeuErrorGNeuErrorGNeuError

GSetErrorGSetErrorGSetErrorGSetErrorGSetErrorGSetErrorGSetErrorGSetErrorGSetErrorGSetErrorGSetErrorGSetErrorGSetErrorGSetErrorGSetErrorGSetErrorGSetError

COpenErrorCOpenErrorCOpenErrorCOpenErrorCOpenErrorCOpenErrorCOpenErrorCOpenErrorCOpenErrorCOpenErrorCOpenErrorCOpenErrorCOpenErrorCOpenErrorCOpenErrorCOpenErrorCOpenError

CCloseErrorCCloseErrorCCloseErrorCCloseErrorCCloseErrorCCloseErrorCCloseErrorCCloseErrorCCloseErrorCCloseErrorCCloseErrorCCloseErrorCCloseErrorCCloseErrorCCloseErrorCCloseErrorCCloseError

CheckClutchClosed2CheckClutchClosed2CheckClutchClosed2CheckClutchClosed2CheckClutchClosed2CheckClutchClosed2CheckClutchClosed2CheckClutchClosed2CheckClutchClosed2CheckClutchClosed2CheckClutchClosed2CheckClutchClosed2CheckClutchClosed2CheckClutchClosed2CheckClutchClosed2CheckClutchClosed2CheckClutchClosed2( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )

c:ClutchClosec:ClutchClosec:ClutchClosec:ClutchClosec:ClutchClosec:ClutchClosec:ClutchClosec:ClutchClosec:ClutchClosec:ClutchClosec:ClutchClosec:ClutchClosec:ClutchClosec:ClutchClosec:ClutchClosec:ClutchClosec:ClutchClose

c:ReqSetGearc:ReqSetGearc:ReqSetGearc:ReqSetGearc:ReqSetGearc:ReqSetGearc:ReqSetGearc:ReqSetGearc:ReqSetGearc:ReqSetGearc:ReqSetGearc:ReqSetGearc:ReqSetGearc:ReqSetGearc:ReqSetGearc:ReqSetGearc:ReqSetGear

c:Initiatec:Initiatec:Initiatec:Initiatec:Initiatec:Initiatec:Initiatec:Initiatec:Initiatec:Initiatec:Initiatec:Initiatec:Initiatec:Initiatec:Initiatec:Initiatec:Initiate

CheckClutch2CheckClutch2CheckClutch2CheckClutch2CheckClutch2CheckClutch2CheckClutch2CheckClutch2CheckClutch2CheckClutch2CheckClutch2CheckClutch2CheckClutch2CheckClutch2CheckClutch2CheckClutch2CheckClutch2( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )

CheckGearNeuCheckGearNeuCheckGearNeuCheckGearNeuCheckGearNeuCheckGearNeuCheckGearNeuCheckGearNeuCheckGearNeuCheckGearNeuCheckGearNeuCheckGearNeuCheckGearNeuCheckGearNeuCheckGearNeuCheckGearNeuCheckGearNeu( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )

c:ReqNeuGearc:ReqNeuGearc:ReqNeuGearc:ReqNeuGearc:ReqNeuGearc:ReqNeuGearc:ReqNeuGearc:ReqNeuGearc:ReqNeuGearc:ReqNeuGearc:ReqNeuGearc:ReqNeuGearc:ReqNeuGearc:ReqNeuGearc:ReqNeuGearc:ReqNeuGearc:ReqNeuGear

CheckTorqueCheckTorqueCheckTorqueCheckTorqueCheckTorqueCheckTorqueCheckTorqueCheckTorqueCheckTorqueCheckTorqueCheckTorqueCheckTorqueCheckTorqueCheckTorqueCheckTorqueCheckTorqueCheckTorque( GCTimer<=255 )( GCTimer<=255 )( GCTimer<=255 )( GCTimer<=255 )( GCTimer<=255 )( GCTimer<=255 )( GCTimer<=255 )( GCTimer<=255 )( GCTimer<=255 )( GCTimer<=255 )( GCTimer<=255 )( GCTimer<=255 )( GCTimer<=255 )( GCTimer<=255 )( GCTimer<=255 )( GCTimer<=255 )( GCTimer<=255 )

CheckClutchClosedCheckClutchClosedCheckClutchClosedCheckClutchClosedCheckClutchClosedCheckClutchClosedCheckClutchClosedCheckClutchClosedCheckClutchClosedCheckClutchClosedCheckClutchClosedCheckClutchClosedCheckClutchClosedCheckClutchClosedCheckClutchClosedCheckClutchClosedCheckClutchClosed( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )

c:GearChangedc:GearChangedc:GearChangedc:GearChangedc:GearChangedc:GearChangedc:GearChangedc:GearChangedc:GearChangedc:GearChangedc:GearChangedc:GearChangedc:GearChangedc:GearChangedc:GearChangedc:GearChangedc:GearChanged

c:ReqTorqueCc:ReqTorqueCc:ReqTorqueCc:ReqTorqueCc:ReqTorqueCc:ReqTorqueCc:ReqTorqueCc:ReqTorqueCc:ReqTorqueCc:ReqTorqueCc:ReqTorqueCc:ReqTorqueCc:ReqTorqueCc:ReqTorqueCc:ReqTorqueCc:ReqTorqueCc:ReqTorqueC

CheckGearSet1CheckGearSet1CheckGearSet1CheckGearSet1CheckGearSet1CheckGearSet1CheckGearSet1CheckGearSet1CheckGearSet1CheckGearSet1CheckGearSet1CheckGearSet1CheckGearSet1CheckGearSet1CheckGearSet1CheckGearSet1CheckGearSet1( GCTimer<=350 )( GCTimer<=350 )( GCTimer<=350 )( GCTimer<=350 )( GCTimer<=350 )( GCTimer<=350 )( GCTimer<=350 )( GCTimer<=350 )( GCTimer<=350 )( GCTimer<=350 )( GCTimer<=350 )( GCTimer<=350 )( GCTimer<=350 )( GCTimer<=350 )( GCTimer<=350 )( GCTimer<=350 )( GCTimer<=350 )

c:ReqSyncSpeedc:ReqSyncSpeedc:ReqSyncSpeedc:ReqSyncSpeedc:ReqSyncSpeedc:ReqSyncSpeedc:ReqSyncSpeedc:ReqSyncSpeedc:ReqSyncSpeedc:ReqSyncSpeedc:ReqSyncSpeedc:ReqSyncSpeedc:ReqSyncSpeedc:ReqSyncSpeedc:ReqSyncSpeedc:ReqSyncSpeedc:ReqSyncSpeed

GearGearGearGearGearGearGearGearGearGearGearGearGearGearGearGearGear


c:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpen

CheckClutchCheckClutchCheckClutchCheckClutchCheckClutchCheckClutchCheckClutchCheckClutchCheckClutchCheckClutchCheckClutchCheckClutchCheckClutchCheckClutchCheckClutchCheckClutchCheckClutch( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )

CheckSyncSpeedCheckSyncSpeedCheckSyncSpeedCheckSyncSpeedCheckSyncSpeedCheckSyncSpeedCheckSyncSpeedCheckSyncSpeedCheckSyncSpeedCheckSyncSpeedCheckSyncSpeedCheckSyncSpeedCheckSyncSpeedCheckSyncSpeedCheckSyncSpeedCheckSyncSpeedCheckSyncSpeed( GCTimer<=155 )( GCTimer<=155 )( GCTimer<=155 )( GCTimer<=155 )( GCTimer<=155 )( GCTimer<=155 )( GCTimer<=155 )( GCTimer<=155 )( GCTimer<=155 )( GCTimer<=155 )( GCTimer<=155 )( GCTimer<=155 )( GCTimer<=155 )( GCTimer<=155 )( GCTimer<=155 )( GCTimer<=155 )( GCTimer<=155 )

CheckGearNeu2CheckGearNeu2CheckGearNeu2CheckGearNeu2CheckGearNeu2CheckGearNeu2CheckGearNeu2CheckGearNeu2CheckGearNeu2CheckGearNeu2CheckGearNeu2CheckGearNeu2CheckGearNeu2CheckGearNeu2CheckGearNeu2CheckGearNeu2CheckGearNeu2( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )

c:ReqSetGear2c:ReqSetGear2c:ReqSetGear2c:ReqSetGear2c:ReqSetGear2c:ReqSetGear2c:ReqSetGear2c:ReqSetGear2c:ReqSetGear2c:ReqSetGear2c:ReqSetGear2c:ReqSetGear2c:ReqSetGear2c:ReqSetGear2c:ReqSetGear2c:ReqSetGear2c:ReqSetGear2

c:ClutchOpen2c:ClutchOpen2c:ClutchOpen2c:ClutchOpen2c:ClutchOpen2c:ClutchOpen2c:ClutchOpen2c:ClutchOpen2c:ClutchOpen2c:ClutchOpen2c:ClutchOpen2c:ClutchOpen2c:ClutchOpen2c:ClutchOpen2c:ClutchOpen2c:ClutchOpen2c:ClutchOpen2

ClutchIsClosed?ClutchIsClosed?ClutchIsClosed?ClutchIsClosed?ClutchIsClosed?ClutchIsClosed?ClutchIsClosed?ClutchIsClosed?ClutchIsClosed?ClutchIsClosed?ClutchIsClosed?ClutchIsClosed?ClutchIsClosed?ClutchIsClosed?ClutchIsClosed?ClutchIsClosed?ClutchIsClosed?

GCTimer>150GCTimer>150GCTimer>150GCTimer>150GCTimer>150GCTimer>150GCTimer>150GCTimer>150GCTimer>150GCTimer>150GCTimer>150GCTimer>150GCTimer>150GCTimer>150GCTimer>150GCTimer>150GCTimer>150GCTimer<=200GCTimer<=200GCTimer<=200GCTimer<=200GCTimer<=200GCTimer<=200GCTimer<=200GCTimer<=200GCTimer<=200GCTimer<=200GCTimer<=200GCTimer<=200GCTimer<=200GCTimer<=200GCTimer<=200GCTimer<=200GCTimer<=200

CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0

ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0

ReqZeroTorque!ReqZeroTorque!ReqZeroTorque!ReqZeroTorque!ReqZeroTorque!ReqZeroTorque!ReqZeroTorque!ReqZeroTorque!ReqZeroTorque!ReqZeroTorque!ReqZeroTorque!ReqZeroTorque!ReqZeroTorque!ReqZeroTorque!ReqZeroTorque!ReqZeroTorque!ReqZeroTorque!GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0FromGear>0FromGear>0FromGear>0FromGear>0FromGear>0FromGear>0FromGear>0FromGear>0FromGear>0FromGear>0FromGear>0FromGear>0FromGear>0FromGear>0FromGear>0FromGear>0FromGear>0

FromGear<=0FromGear<=0FromGear<=0FromGear<=0FromGear<=0FromGear<=0FromGear<=0FromGear<=0FromGear<=0FromGear<=0FromGear<=0FromGear<=0FromGear<=0FromGear<=0FromGear<=0FromGear<=0FromGear<=0

ClutchIsOpen?ClutchIsOpen?ClutchIsOpen?ClutchIsOpen?ClutchIsOpen?ClutchIsOpen?ClutchIsOpen?ClutchIsOpen?ClutchIsOpen?ClutchIsOpen?ClutchIsOpen?ClutchIsOpen?ClutchIsOpen?ClutchIsOpen?ClutchIsOpen?ClutchIsOpen?ClutchIsOpen?


GearNeu?GearNeu?GearNeu?GearNeu?GearNeu?GearNeu?GearNeu?GearNeu?GearNeu?GearNeu?GearNeu?GearNeu?GearNeu?GearNeu?GearNeu?GearNeu?GearNeu?


ReqNeu!ReqNeu!ReqNeu!ReqNeu!ReqNeu!ReqNeu!ReqNeu!ReqNeu!ReqNeu!ReqNeu!ReqNeu!ReqNeu!ReqNeu!ReqNeu!ReqNeu!ReqNeu!ReqNeu!GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0

TorqueZero?TorqueZero?TorqueZero?TorqueZero?TorqueZero?TorqueZero?TorqueZero?TorqueZero?TorqueZero?TorqueZero?TorqueZero?TorqueZero?TorqueZero?TorqueZero?TorqueZero?TorqueZero?TorqueZero?GCTimer<250GCTimer<250GCTimer<250GCTimer<250GCTimer<250GCTimer<250GCTimer<250GCTimer<250GCTimer<250GCTimer<250GCTimer<250GCTimer<250GCTimer<250GCTimer<250GCTimer<250GCTimer<250GCTimer<250

OpenClutch!OpenClutch!OpenClutch!OpenClutch!OpenClutch!OpenClutch!OpenClutch!OpenClutch!OpenClutch!OpenClutch!OpenClutch!OpenClutch!OpenClutch!OpenClutch!OpenClutch!OpenClutch!OpenClutch!GCTimer>=250GCTimer>=250GCTimer>=250GCTimer>=250GCTimer>=250GCTimer>=250GCTimer>=250GCTimer>=250GCTimer>=250GCTimer>=250GCTimer>=250GCTimer>=250GCTimer>=250GCTimer>=250GCTimer>=250GCTimer>=250GCTimer>=250GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0



NewGear!NewGear!NewGear!NewGear!NewGear!NewGear!NewGear!NewGear!NewGear!NewGear!NewGear!NewGear!NewGear!NewGear!NewGear!NewGear!NewGear!

ReqTorque!ReqTorque!ReqTorque!ReqTorque!ReqTorque!ReqTorque!ReqTorque!ReqTorque!ReqTorque!ReqTorque!ReqTorque!ReqTorque!ReqTorque!ReqTorque!ReqTorque!ReqTorque!ReqTorque!

GearSet?GearSet?GearSet?GearSet?GearSet?GearSet?GearSet?GearSet?GearSet?GearSet?GearSet?GearSet?GearSet?GearSet?GearSet?GearSet?GearSet?


ReqSpeed!ReqSpeed!ReqSpeed!ReqSpeed!ReqSpeed!ReqSpeed!ReqSpeed!ReqSpeed!ReqSpeed!ReqSpeed!ReqSpeed!ReqSpeed!ReqSpeed!ReqSpeed!ReqSpeed!ReqSpeed!ReqSpeed!GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0

ToGear<=0ToGear<=0ToGear<=0ToGear<=0ToGear<=0ToGear<=0ToGear<=0ToGear<=0ToGear<=0ToGear<=0ToGear<=0ToGear<=0ToGear<=0ToGear<=0ToGear<=0ToGear<=0ToGear<=0

ReqNewGear?ReqNewGear?ReqNewGear?ReqNewGear?ReqNewGear?ReqNewGear?ReqNewGear?ReqNewGear?ReqNewGear?ReqNewGear?ReqNewGear?ReqNewGear?ReqNewGear?ReqNewGear?ReqNewGear?ReqNewGear?ReqNewGear?SysTimer:=0SysTimer:=0SysTimer:=0SysTimer:=0SysTimer:=0SysTimer:=0SysTimer:=0SysTimer:=0SysTimer:=0SysTimer:=0SysTimer:=0SysTimer:=0SysTimer:=0SysTimer:=0SysTimer:=0SysTimer:=0SysTimer:=0







GCTimer<150GCTimer<150GCTimer<150GCTimer<150GCTimer<150GCTimer<150GCTimer<150GCTimer<150GCTimer<150GCTimer<150GCTimer<150GCTimer<150GCTimer<150GCTimer<150GCTimer<150GCTimer<150GCTimer<150SpeedSet?SpeedSet?SpeedSet?SpeedSet?SpeedSet?SpeedSet?SpeedSet?SpeedSet?SpeedSet?SpeedSet?SpeedSet?SpeedSet?SpeedSet?SpeedSet?SpeedSet?SpeedSet?SpeedSet?



ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0

ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0


Fig. 2. The Gear Box Controller Automaton.

Interface The automaton Interface requests gears, i.e. R, N, 1, ..., 5, from the

gear controller. A change from gear 1 to gear 2 is shown in Figure 5. Requests

and responses are sent through channel ReqNewGear and channel NewGear re-

spectively. When a request is sent the shared variables FromGear and ToGear

are assigned values corresponding to the current and the requested new gear

respectively.

8

82 ( ( ErrStat = 0 ^ SysTimer > 1500 ))

( GearControl:GearChanged _ GearControl:Gear ) ) (1)

82 ( ( ErrStat = 0 ^ UseCase = 0 ^ SysTimer > 1000 ))


82 ( ( Clutch:ErrorClose ^ GCTimer > 200 ) ) GearControl:CCloseError ) (3)

82 ( ( Clutch:ErrorOpen ^ GCTimer > 200 ) ) GearControl:COpenError ) (4)

82 ( ( GearBox:ErrorIdle ^ GCTimer > 350 ) ) GearControl:GSetError ) (5)

82 ( ( GearBox:ErrorNeu ^ GCTimer > 200 ) ) GearControl:GNeuError ) (6)

82 ( GearControl:CCloseError ) Clutch:ErrorClose ) (7)

82 ( GearControl:COpenError ) Clutch:ErrorOpen ) (8)

82 ( GearControl:GSetError ) GearBox:ErrorIdle ) (9)

82 ( GearControl:GNeuError ) GearBox:ErrorNeu ) (10)

82 ( Engine:ErrorSpeed ) ErrStat = 0 ) (11)

8i2fR;N;1;:::;5g 93 ( Gear:Geari ) (12)

82 ( Engine:Torque ) Clutch:Closed ) (13)

8i2fR;1;:::;5g 82 ( ( GearControl:Gear ^ Gear:Geari ) ) Engine:Torque ) (14)

Table 1. Requirement Speci�cation

4 Formal Validation and Veri�cation

In this section we formalize the informal requirements given in Section 2.3 by dec-

orating the system model with auxiliary variables, which enables that all the re-

quirements can be speci�ed as reachability properties and veri�ed by the symbolic

model-checker of Uppaal.

4.1 System Decoration

To enable formalization (and veri�cation) of requirements, we decorate the system

description with three auxiliary variables.

Two integer variables ErrStat and UseCase are assigned values at the occurrence of

errors in the environment. The variable ErrStat is assigned the following values at

unrecoverable errors: 1 if Clutch fails to close, 2 if Clutch fails to open, 3 if GearBox

fails to set a gear, and 4 if GearBox fails to release a gear.

The variable UseCase is assigned 1 or 2 whenever a recoverable error occurs in

Engine: 1 if it fail to deliver zero torque, and 2 if it is not able to �nd synchronous

speed.

The auxiliary variable SysTimer is a timer which is reset at the edge

GearReqNewGear?�! Initiate

in the gear controller (see Figure 2). In this way SysTimer is reset at every gear

change request accepted by the gear controller (and nowhere else). It is therefore

guaranteed to always hold the time elapsed since the last gear change request.

9

4.2 Requirement Speci�cation

The �rst performance requirement 2a, i.e. that a gear change must be completed

within 1.5 seconds given that no unrecoverable errors occur, is speci�ed in prop-

erty 1. It requires the location GearChanged in automaton GearControl to be reached

within 1.5 seconds after location Initiate has been entered. Only scenarios without

unrecoverable errors are considered as the value of the variable ErrStat is speci�ed

to be zero9. To consider scenarios with normal operation we restrict also the value

of variable UseCase to zero (i.e. no recoverable errors occurs). Property 2 requires

gear changes to be completed within one second given that the system is operating

normally.

The properties 3 to 6 requires the system to terminate in known error-locations that

point out the speci�c error when errors occurs in the clutch or the gear (requirements

4a to 4d). Up to 350 ms is needed between the occurrence of the errors and that the

error is indicated in the gear controller. The properties 7 to 10 restricts the controller

design to indicate an error only when the corresponding error has arised in the

components. Observe that no speci�c location in the gear controller is dedicated to

indicate the unrecoverable error that may occur when the engines speed-regulation

is interrupted (i.e. when location ErrorSpeed is reached). Property 11 requires that

no such location is needed since this error is always a consequence of a preceding

unrecoverable error in the clutch or in the gear.

Property 12 holds if the system is able to use all gears (requirement 3a). Further-

more, for full functionality and predictability, the system is required to be dead-lock

and live-lock free (requirement 1a). In this report dead-lock and live-lock proper-

ties are not speci�ed 10. However, property 1 (and 2) guarantees progress within

bounded time if no unrecoverable error causes the system to terminate. The prop-

erties 13 and 14 speci�es the informal predictability requirements 1b and 1c.

A number of functionality requirements specify how the gear controller should in-

teract with the environment (e.g. 3a and 3c to 3g). These requirements have been

used to give the gear control the desired design. They have later been validated

using the simulator in Uppaal and have not been formally speci�ed and veri�ed.

4.3 Time Bound Derivation

Property 1 requires that a gear change should be performed within one second.

Even though this is an interesting property in itself one may ask for the lowest

time bound for which a gear change is guaranteed. We show that this time bound

is 900 ms for error-free scenarios by proving that the change is guaranteed at 900

ms (property 15), and that the change is possibly not completed in the interval

(899; 900) (property 16). Similarly, for scenarios where the engine fails to deliver

zero torque we derive the bound 1055 ms and if synchronous speed is not delivered

in the engine the time bound is 1205 ms.

We have shown the shortest time for which a gear change is possible in the three

scenarios to be: 150 ms, 550 ms, and 450 ms. However, gear changes involving

neutral gear may be faster as the gear does not have to be released (when changing

from gear neutral) or set (when changing to gear neutral). Finally we consider the

9 Recall that the variable Errstat is assigned a positive value (i.e. greater than zero)

whenever an unrecoverable error occurs.10 The system have found dead-lock free using a prototype dead-lock detection algorithm

implemented in Uppaal version 2.03 (and higher).

10

82 ( ( ErrStat = 0 ^ UseCase = 0 ^ SysTimer � 900 ))


93 ( ErrStat = 0 ^ UseCase = 0 ^ SysTimer > 899 ^ SysTimer < 900 ^

:( GearControl:GearChanged _ GearControl:Gear ) ) (16)

Table 2. Time Bounds

same (three) scenarios but without involving neutral gear by constraining the values

of the variables FromGear and ToGear. The derived time bounds are: 400 ms, 700

ms and 750.

4.4 Veri�cation Results

We have veri�ed totally 46 properties of the system11 using Uppaal installed on a

75 MHz Pentium PC equipped with 24 MB of primary memory. The veri�cation of

all the properties consumed 2.99 second.

5 Conclusion

In this paper, we have reported an industrial case study in applying formal tech-

niques for the design and analysis of control systems for vehicles. The main out-

put of the case-study is a formally described gear controller and a set of formal

requirements. The designed controller have been validated and veri�ed using the

tool Uppaal to satisfy the safety and functionality requirements on the controller,

provided by Mecel AB. It may be considered as one piece of evidence that the vali-

dation and veri�cation tools of today are mature enough to be applied in industrial

projects.

11 A complete list of the veri�ed properties can in Appendix A.

11

References

[AD90] R. Alur and D. Dill. Automata for Modelling Real-Time Systems. In Proc. of

ICALP'90, volume 443 of Lecture Notes in Computer Science, 1990.

[AD94] R. Alur and D. Dill. Automata for Modelling Real-Time Systems. Theoretical

Computer Science, 126(2):183{236, April 1994.

[BGK+96] Johan Bengtsson, David Gri�oen, K�are Kristo�ersen, Kim G. Larsen, Fredrik

Larsson, Paul Pettersson, and Wang Yi. Veri�cation of an Audio Protocol

with Bus Collision Using Uppaal. In Rajeev Alur and Thomas A. Henzinger,

editors, Proc. of 8th Int. Conf. on Computer Aided Veri�cation, number 1102

in Lecture Notes in Computer Science, pages 244{256. Springer{Verlag, July

1996.

[BLL+96] Johan Bengtsson, Kim G. Larsen, Fredrik Larsson, Paul Pettersson, and Wang

Yi. Uppaal in 1995. In Proc. of the 2nd Workshop on Tools and Algorithms

for the Construction and Analysis of Systems, number 1055 in Lecture Notes

in Computer Science, pages 431{434. Springer{Verlag, Mars 1996.

[DOTY95] C. Daws, A. Olivero, S. Tripakis, and S. Yovine. The tool kronos. In Ra-

jeev Alur, Thomas A. Henzinger, and Eduardo D. Sontag, editors, Proc. of

Workshop on Veri�cation and Control of Hybrid Systems III, Lecture Notes in

Computer Science, pages 208{219. Springer{Verlag, October 1995.

[HHWT95] Thomas A. Henzinger, Pei-Hsin Ho, and Howard Wong-Toi. HyTech: The

Next Generation. In Proc. of the 16th IEEE Real-Time Systems Symposium,

pages 56{65, December 1995.

[JLS96] H.E. Jensen, K.G. Larsen, and A. Skou. Modelling and Analysis of a Collision

Avoidance Protocol Using SPIN and Uppaal. In Proc. of 2nd International

Workshop on the SPIN Veri�cation System, pages 1{20, August 1996.

[LPY97] Kim G. Larsen, Paul Pettersson, and Wang Yi. Uppaal in a Nutshell. Aval-

able at http://www.docs.uu.se/docs/rtmv/uppaal, 1997.

[SMF97] Thomas Stauner, Olaf M�uller, and Max Fuchs. Using hytech to verify an au-

tomotive control system. In Proc. Hybrid and Real-Time Systems, Grenoble,

March 26-28, 1997. Technische Universit�at M�unchen, Lecture Notes in Com-

puter Science, Springer, 1997.

12

A The Requirement Speci�cation

///////////////////////////////////////////////////////////////////////////////

// 1996-11-20, 1997-02-20--27, and 1997-07-31 @ Uppsala University

// Paul Pettersson, DoCS and Magnus Lindahl, Mecel AB.

///////////////////////////////////////////////////////////////////////////////

//

// OVERVIEW

//

// This specification file (engine.q) comply with UPPAALs q-format. It is the

// actual input file used to check properties of the gear box controller. The

// system is modelled in the file engine.atg. To verify the system run:

// 'atg2ta engine.atg engine.ta' and 'verifyta -sT engine.ta eninge.q'.

//

// E1 to E11 are requirements on the environment of the gear box controller,

// R1 to R9 are requirements on the gear box controller design given by

// Mecel AB. P1 to P15 are properties that holds for the gear box controller.

// P1 to P16 proves R1 to R8 (given that E1 to E11 holds).

//

//

// REQUIREMENTS ON THE ENVIRONMENT OF GEAR BOX CONTROLLER DESIGN

//

// E1 to E11 are requirements that the environment of the gear box controller

// design should satisfy to guarantee the behavior of the controller. Ie.

// if any of the requirements E1 to E11 are not true for the environment then

// P1 to P15 are *not* guaranteed to hold:

//

// E1. Initially the clutch is closed.

//

// E2. To open the clutch (a) at least 100 ms and (b) at most 150 ms is needed.

//

// E3. To close the clutch (a) at least 100 ms and (b) at most 150 ms is

// needed.

//

// E4. Initially the gear box is neutral.

//

// E5. To release the gear (a) at least 100 ms and (b) at most 200 ms is

// needed.

//

// E6. To set a gear (a) at least 100 ms and (b) at most 300 ms is needed.

//

// E7. The engine is always in a predefined state called Initial

// (a) initially and (b) when no gear is set.

//

// E8. To find zero torque (a) at least 150 ms and (b) at most 400 ms is

// needed. (c) At 400 ms the engine will enter an error state or find zero

// torque.

//

// E9. To find synchronous speed (a) at least 50 ms and (b) at most 200 ms is

// needed. (c) At 200 ms the engine will enter an error state or find

// synchronous speed.

//

// E10. The engine may regulate on synchronous speed at most 500 ms.

//

// E11. When in error state the engine will regulate on synchronous speed

// at least 50 ms ( and at most 500 ms ).

//

//

13

// REQUIREMENTS ON THE GEAR BOX CONTROLLER DESIGN

//

// The Gear Box Controller should satisfy the following (informal)

// requirements. The number within parentheses refers to the properties

// that ensures that the requirement is satisfied:

//

// R1. A gear change is performed in 1 second (P6 - P8, P3) (*).

//

// R2. When an specific error arise the system will end in a known error

// state that points out the specific error (P9 - P11).

//

// R3. The system should be able to use all gears (P2-P3).

//

// R4. There will be no dead-locks or live-locks in the system. (R1).

//

// R5. When the system indicate gear neutral the engine will indicate

// initial state (P12).

//

// R6. When the system indicate a gear the engine will indicate torque

// regulation (P13).

//

// R7. The gear box controller will never indicate open or closed clutch

// when the clutch is closed or open respectively (P14).

//

// R8. The gear box controller will never indicate gear set or gear neutral

// when the gear is not idle or not set respectively (P15).

//

// R9. When the engine is regulating on torque, then the clutch is closed

// (P16).

//

// (*) If an ideal gear change is considered the change is guaranteed

// within 900 ms and will consume at least 150 ms. If a gear change not

// involving gear N is considered the change will consume at least

// 400 ms. A gear change may take up to 1205 ms when successful but

// less ideal scenarios are considered.

//

//

// FORMALIZING THE REQUIREMENT

//

// The requirement above have been formalized using variables and locations

// of automata. System variables are variables used by the components of the

// system, auxiliary variables are decorations to the system used in the

// formulae only. In the system the auxiliary variables appears only in

// assingments (not in guards). This ensures that the system behavior is not

// changed when the auxiliary variables are introduced (or removed).

//

// Furthermore, the auxiliary variables appears only in the components

// modeling the environment of the gear box controller. This will make it

// easier to implement a gear box controller from the design model.

//

// The variables ErrStat and UseCase are used to trace errors. ErrStat

// records unrecoverable errors, UseCase records recoverable errors solved

// by the gear box controller.

//

// The systems component locations can be found in the file engine.{atg|ta}.

//

// System Variables:

//

14

// o GCTimer - gear box controller timer,

// o ETimer - engine timer,

// o GBTimer - gear box timer,

// o CTimer - clutch timer,

// o FromGear - selected gear before gear change (0=N, 1=1, ..., 6=R),

// o ToGear - selected gear after gear change (0=N, 1=1, ..., 6=R).

//

// Auxiliary Variables:

//

// o SysTimer - system timer, reset at each request for new gear

// (in the gear box controller),

// o ErrStat - 0 = no errors,

// 1 = close clutch error,

// 2 = open clutch error,

// 3 = set gear failure,

// 4 = error releasing gear.

// o UseCase - 0 = ideal scenario, no problems occurred,

// 1 = engine was not able to deliver zero torque,

// 2 = engine was not able to find synchronous speed.

//

//

///////////////////////////////////////////////////////////////////////////////

// ----------------------------------------------------------------------------

// P1. It is possible to change gear.

// ----------------------------------------------------------------------------

E<> GearControl.GearChanged

// ----------------------------------------------------------------------------

// P2. It is possible to switch to gear nr 5 and to reverse (=R) gear.

// ----------------------------------------------------------------------------

// a)

E<> Gear.Gear5

// b)

E<> Gear.GearR

// ----------------------------------------------------------------------------

// P3. It is possible to switch gear in 1000 ms (not very interesting).

// ----------------------------------------------------------------------------

E<> ( GearControl.GearChanged and ( SysTimer<=1000 ) )

// ----------------------------------------------------------------------------

// P4. When the gear box is in position N the gear is not in position 1-5 or R.

// ----------------------------------------------------------------------------

A[] not ( GearBox.Neutral and \

( Gear.Gear1 or Gear.Gear2 or Gear.Gear3 or \

Gear.Gear4 or Gear.Gear5 or Gear.GearR ) )

// ----------------------------------------------------------------------------

// P5. The gear is never N when the gear box is idle (expected to be neutral).

// ----------------------------------------------------------------------------

// a)

A[] not ( GearBox.Idle and Gear.GearN )

// b)

A[] ( Gear.GearN imply GearBox.Neutral )

// ----------------------------------------------------------------------------

// P6. If no errors (in gear and clutch) and ideal (engine) scenario:

15

// a) a gear switch is guaranteed in (including) 900 ms,

// a') a gear switch is not guaranteed in less than 900 ms,

// b) it is impossible to switch gear in less than 150 ms,

// b') it is possible to switch gear at 150 ms,

// c) it is impossible to switch gear in less than 400 ms if the switch is

// not from/to gear N.

// c') it is possible to switch gear at 400 ms if the switch is not from/to

// gear N.

// ----------------------------------------------------------------------------

// a)

A[] ( ( ErrStat==0 and UseCase==0 and SysTimer>=900 ) imply \

( GearControl.GearChanged or GearControl.Gear ) )

// a')

E<> ( ErrStat==0 and UseCase==0 and SysTimer>899 and SysTimer<900 and \

not ( GearControl.GearChanged or GearControl.Gear ) )

// b)

A[] ( ( ErrStat==0 and UseCase==0 and ( SysTimer<150 ) ) imply \

not ( GearControl.GearChanged ) )

// (In (b) GearControl.Gear is not implied since the property is then

// satsified by the systems initial state.)

// b')

E<> ( ErrStat==0 and UseCase==0 and GearControl.GearChanged and \

( SysTimer==150 ) )

// c)

A[] ( ( ErrStat==0 and UseCase==0 and FromGear>0 and ToGear>0 and \

( SysTimer<400 ) ) imply \

not ( GearControl.GearChanged ) )

// c')

E<> ( ErrStat==0 and UseCase==0 and FromGear>0 and ToGear>0 and \

GearControl.GearChanged and ( SysTimer==400 ) )

// ----------------------------------------------------------------------------

// P7. If no errors (in gear and clutch) but engine fails to deliver zero

// torque:

// a) a gear switch is guaranteed after (not including) 1055 ms,

// a') it is impossible to switch gear in 1055 ms,

// b) it is impossible to switch gear in less than 550 ms,





// gear N.

// ----------------------------------------------------------------------------

// a)

A[] ( ( ErrStat==0 and UseCase==1 and SysTimer>1055 ) imply \


// a')

E<> ( ErrStat==0 and UseCase==1 and SysTimer==1055 and \


// b)

A[] ( ( ErrStat==0 and UseCase==1 and SysTimer<550 ) imply \


// b')

E<> ( ErrStat==0 and UseCase==1 and GearControl.GearChanged and \

( SysTimer==550 ) )

// c)


SysTimer<700 ) imply \

16

not ( GearControl.GearChanged and GearControl.Gear ) )

// c')


GearControl.GearChanged and \

( SysTimer==700 ) )

// ----------------------------------------------------------------------------

// P8. If no errors but engine fails to find synchronous speed:

// a) a gear switch is guaranteed in (including) 1205 ms,

// a') a gear switch is not guaranteed at less than 1205 ms,

// b) t is impossible to switch gear in less than 450 ms,





// gear N.

// ----------------------------------------------------------------------------

// a)

A[] ( ( ErrStat==0 and UseCase==2 and SysTimer>=1205 ) imply \


// a')

E<> ( ErrStat==0 and UseCase==2 and SysTimer>1204 and SysTimer<1205 and \


// b)

A[] ( ( UseCase==2 and ( SysTimer<450 ) ) imply \


// b')

E<> ( UseCase==2 and GearControl.GearChanged and \

( SysTimer==450 ) )

// c)


SysTimer<750 ) imply \

not ( GearControl.GearChanged and GearControl.Gear ) )

// c')


GearControl.GearChanged and \

( SysTimer==750 ) )

// ----------------------------------------------------------------------------

// P9. Clutch Errors.

// a) If the clutch is not closed properly (timeout) the gear box controller

// will enter the location CCloseError within 200 ms.

// b) When the gear box controller enters location CCloseError there is a

// problem with closing the clutch (in the clutch).

// ----------------------------------------------------------------------------

// a)

A[] ( ( Clutch.ErrorClose and ( GCTimer>200 ) ) imply \

GearControl.CCloseError )

// b)

A[] ( GearControl.CCloseError imply Clutch.ErrorClose )

// ----------------------------------------------------------------------------

// P9. Clutch Errors (cont.)

// c) If the clutch is not opened properly (timeout) the gear box controller

// will enter the location COpenError within 200 ms.

// d) When the gear box controller enters location COpenError there is a

// problem with opening the clutch (in the clutch).

// ----------------------------------------------------------------------------

17

// c)

A[] ( ( Clutch.ErrorOpen and ( GCTimer>200 ) ) imply GearControl.COpenError )

// d)

A[] ( ( GearControl.COpenError ) imply Clutch.ErrorOpen )

// ----------------------------------------------------------------------------

// P10. Gear Box Errors.

// a) If the gear box can not set the new gear (timeout) the gear box

// controller will enter the location GSetError within 350 ms.

// b) When the gear box controller enters location GSetError there is a

// problem with setting the gear (in the gear box).

// ----------------------------------------------------------------------------

// a)

A[] ( ( GearBox.ErrorIdle and ( GCTimer>350 ) ) imply GearControl.GSetError )

// b)

A[] ( ( GearControl.GSetError ) imply GearBox.ErrorIdle )

// ----------------------------------------------------------------------------

// P10. Gear Box Errors (cont).

// c) If the gear box can not switch to neutral gear (timeout) the gear box

// controller will enter the location GNeuError within 200 ms.

// d) When the gear box controller enters location GNeuError there is a

// problem with switching to neutral gear (in the gear box).

// ----------------------------------------------------------------------------

// c)

A[] ( ( GearBox.ErrorNeu and ( GCTimer>200 ) ) imply GearControl.GNeuError )

// d)

A[] ( ( GearControl.GNeuError ) imply GearBox.ErrorNeu )

// ----------------------------------------------------------------------------

// P11. No Synchronous Speed failure (engine) if no errors occures.

// ----------------------------------------------------------------------------

A[] not ( ErrStat==0 and Engine.ErrorSpeed )

//

// ----------------------------------------------------------------------------

// P12. When gear N then engine is initial or on its way to initial (ie.

// ToGear==0 and engine in zero).

// ----------------------------------------------------------------------------

A[] ( Gear.GearN imply \

( ( ToGear==0 and Engine.Zero ) or Engine.Initial ) )

// ----------------------------------------------------------------------------

// P13. When the gear controller have a gear set, torque regulation is

// indicated in the engine.

// ----------------------------------------------------------------------------

// a)

A[] ( ( GearControl.Gear and Gear.GearR ) imply Engine.Torque )

// b)

A[] ( ( GearControl.Gear and Gear.Gear1 ) imply Engine.Torque )

// c)


// d)


// e)


// f)


18

// ----------------------------------------------------------------------------

// P14. a) If clutch is open then gear box controller is in location...

// b) If clutch is closed then gear box controller is in location...

// ----------------------------------------------------------------------------

// a)

A[] ( Clutch.Open imply \

( GearControl.ClutchOpen or GearControl.ClutchOpen2 or \

GearControl.CheckGearSet2 or GearControl.ReqSetGear2 or \

GearControl.GNeuError or \

GearControl.ClutchClose or GearControl.CheckClutchClosed or \

GearControl.CheckClutchClosed2 or GearControl.CCloseError or \

GearControl.GSetError or GearControl.CheckGearNeu2 ) )

// b)

A[] ( Clutch.Closed imply \

( GearControl.ReqTorqueC or GearControl.GearChanged or \

GearControl.Gear or GearControl.Initiate or \

GearControl.CheckTorque or GearControl.ReqNeuGear or \

GearControl.CheckGearNeu or GearControl.GNeuError or \

GearControl.ReqSyncSpeed or GearControl.CheckSyncSpeed or \

GearControl.ReqSetGear or GearControl.CheckGearSet1 or \

GearControl.GSetError ) )

// ----------------------------------------------------------------------------

// P15. a) If gear is set then the gear box controller is in location...

// b) If gear is neutral then the gear box controller is in location...

// ----------------------------------------------------------------------------

// a)

A[] ( GearBox.Idle imply \

( GearControl.ClutchClose or \

GearControl.CheckClutchClosed or GearControl.CCloseError or \

GearControl.ReqTorqueC or GearControl.GearChanged or \

GearControl.Gear or GearControl.Initiate or \

GearControl.CheckTorque or GearControl.ReqNeuGear or \

GearControl.CheckClutch2 or GearControl.COpenError \

or GearControl.ClutchOpen2 ) )

// b)

A[] ( GearBox.Neutral imply \

( GearControl.ReqSetGear or GearControl.CheckClutchClosed2 or \

GearControl.CCloseError or GearControl.ReqTorqueC or \

GearControl.GearChanged or GearControl.Gear or \

GearControl.Initiate or GearControl.ReqSyncSpeed or \

GearControl.CheckSyncSpeed or GearControl.ReqSetGear or \

GearControl.CheckClutch or GearControl.COpenError or \

GearControl.ClutchOpen or GearControl.ReqSetGear2 ) )

// ----------------------------------------------------------------------------

// P16. If engine regulates on torque, then the clutch is closed.

// ----------------------------------------------------------------------------

A[] ( Engine.Torque imply Clutch.Closed )

////////////////////////////////// - end - ////////////////////////////////////

19

B The System Description

GearBoxGearBoxGearBoxGearBoxGearBoxGearBoxGearBoxGearBoxGearBoxGearBoxGearBoxGearBoxGearBoxGearBoxGearBoxGearBoxGearBox

ErrorIdleErrorIdleErrorIdleErrorIdleErrorIdleErrorIdleErrorIdleErrorIdleErrorIdleErrorIdleErrorIdleErrorIdleErrorIdleErrorIdleErrorIdleErrorIdleErrorIdle

ErrorNeuErrorNeuErrorNeuErrorNeuErrorNeuErrorNeuErrorNeuErrorNeuErrorNeuErrorNeuErrorNeuErrorNeuErrorNeuErrorNeuErrorNeuErrorNeuErrorNeu

ClosingClosingClosingClosingClosingClosingClosingClosingClosingClosingClosingClosingClosingClosingClosingClosingClosing( GBTimer<=300 )( GBTimer<=300 )( GBTimer<=300 )( GBTimer<=300 )( GBTimer<=300 )( GBTimer<=300 )( GBTimer<=300 )( GBTimer<=300 )( GBTimer<=300 )( GBTimer<=300 )( GBTimer<=300 )( GBTimer<=300 )( GBTimer<=300 )( GBTimer<=300 )( GBTimer<=300 )( GBTimer<=300 )( GBTimer<=300 )

OpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpening( GBTimer<=200 )( GBTimer<=200 )( GBTimer<=200 )( GBTimer<=200 )( GBTimer<=200 )( GBTimer<=200 )( GBTimer<=200 )( GBTimer<=200 )( GBTimer<=200 )( GBTimer<=200 )( GBTimer<=200 )( GBTimer<=200 )( GBTimer<=200 )( GBTimer<=200 )( GBTimer<=200 )( GBTimer<=200 )( GBTimer<=200 )

NeutralNeutralNeutralNeutralNeutralNeutralNeutralNeutralNeutralNeutralNeutralNeutralNeutralNeutralNeutralNeutralNeutral

IdleIdleIdleIdleIdleIdleIdleIdleIdleIdleIdleIdleIdleIdleIdleIdleIdle

GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GearSet!GearSet!GearSet!GearSet!GearSet!GearSet!GearSet!GearSet!GearSet!GearSet!GearSet!GearSet!GearSet!GearSet!GearSet!GearSet!GearSet!

GBTimer==300GBTimer==300GBTimer==300GBTimer==300GBTimer==300GBTimer==300GBTimer==300GBTimer==300GBTimer==300GBTimer==300GBTimer==300GBTimer==300GBTimer==300GBTimer==300GBTimer==300GBTimer==300GBTimer==300ErrStat:=3ErrStat:=3ErrStat:=3ErrStat:=3ErrStat:=3ErrStat:=3ErrStat:=3ErrStat:=3ErrStat:=3ErrStat:=3ErrStat:=3ErrStat:=3ErrStat:=3ErrStat:=3ErrStat:=3ErrStat:=3ErrStat:=3

GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GearNeu!GearNeu!GearNeu!GearNeu!GearNeu!GearNeu!GearNeu!GearNeu!GearNeu!GearNeu!GearNeu!GearNeu!GearNeu!GearNeu!GearNeu!GearNeu!GearNeu!

GBTimer>200GBTimer>200GBTimer>200GBTimer>200GBTimer>200GBTimer>200GBTimer>200GBTimer>200GBTimer>200GBTimer>200GBTimer>200GBTimer>200GBTimer>200GBTimer>200GBTimer>200GBTimer>200GBTimer>200ErrStat:=4ErrStat:=4ErrStat:=4ErrStat:=4ErrStat:=4ErrStat:=4ErrStat:=4ErrStat:=4ErrStat:=4ErrStat:=4ErrStat:=4ErrStat:=4ErrStat:=4ErrStat:=4ErrStat:=4ErrStat:=4ErrStat:=4

ReqSet?ReqSet?ReqSet?ReqSet?ReqSet?ReqSet?ReqSet?ReqSet?ReqSet?ReqSet?ReqSet?ReqSet?ReqSet?ReqSet?ReqSet?ReqSet?ReqSet?GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0

ReqNeu?ReqNeu?ReqNeu?ReqNeu?ReqNeu?ReqNeu?ReqNeu?ReqNeu?ReqNeu?ReqNeu?ReqNeu?ReqNeu?ReqNeu?ReqNeu?ReqNeu?ReqNeu?ReqNeu?GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0

Fig. 3. The Gear-Box Automaton.

ClutchClutchClutchClutchClutchClutchClutchClutchClutchClutchClutchClutchClutchClutchClutchClutchClutch

ErrorOpenErrorOpenErrorOpenErrorOpenErrorOpenErrorOpenErrorOpenErrorOpenErrorOpenErrorOpenErrorOpenErrorOpenErrorOpenErrorOpenErrorOpenErrorOpenErrorOpen

ErrorCloseErrorCloseErrorCloseErrorCloseErrorCloseErrorCloseErrorCloseErrorCloseErrorCloseErrorCloseErrorCloseErrorCloseErrorCloseErrorCloseErrorCloseErrorCloseErrorClose

ClosingClosingClosingClosingClosingClosingClosingClosingClosingClosingClosingClosingClosingClosingClosingClosingClosing( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )

OpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpening( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )

OpenOpenOpenOpenOpenOpenOpenOpenOpenOpenOpenOpenOpenOpenOpenOpenOpen

ClosedClosedClosedClosedClosedClosedClosedClosedClosedClosedClosedClosedClosedClosedClosedClosedClosed CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100ClutchIsClosed!ClutchIsClosed!ClutchIsClosed!ClutchIsClosed!ClutchIsClosed!ClutchIsClosed!ClutchIsClosed!ClutchIsClosed!ClutchIsClosed!ClutchIsClosed!ClutchIsClosed!ClutchIsClosed!ClutchIsClosed!ClutchIsClosed!ClutchIsClosed!ClutchIsClosed!ClutchIsClosed!

CTimer==150CTimer==150CTimer==150CTimer==150CTimer==150CTimer==150CTimer==150CTimer==150CTimer==150CTimer==150CTimer==150CTimer==150CTimer==150CTimer==150CTimer==150CTimer==150CTimer==150ErrStat:=1ErrStat:=1ErrStat:=1ErrStat:=1ErrStat:=1ErrStat:=1ErrStat:=1ErrStat:=1ErrStat:=1ErrStat:=1ErrStat:=1ErrStat:=1ErrStat:=1ErrStat:=1ErrStat:=1ErrStat:=1ErrStat:=1

CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100ClutchIsOpen!ClutchIsOpen!ClutchIsOpen!ClutchIsOpen!ClutchIsOpen!ClutchIsOpen!ClutchIsOpen!ClutchIsOpen!ClutchIsOpen!ClutchIsOpen!ClutchIsOpen!ClutchIsOpen!ClutchIsOpen!ClutchIsOpen!ClutchIsOpen!ClutchIsOpen!ClutchIsOpen!


CloseClutch?CloseClutch?CloseClutch?CloseClutch?CloseClutch?CloseClutch?CloseClutch?CloseClutch?CloseClutch?CloseClutch?CloseClutch?CloseClutch?CloseClutch?CloseClutch?CloseClutch?CloseClutch?CloseClutch?CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0OpenClutch?OpenClutch?OpenClutch?OpenClutch?OpenClutch?OpenClutch?OpenClutch?OpenClutch?OpenClutch?OpenClutch?OpenClutch?OpenClutch?OpenClutch?OpenClutch?OpenClutch?OpenClutch?OpenClutch?

CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0

Fig. 4. The Clutch Automaton.

Gear1Gear1Gear1Gear1Gear1Gear1Gear1Gear1Gear1Gear1Gear1Gear1Gear1Gear1Gear1Gear1Gear1 Gear2Gear2Gear2Gear2Gear2Gear2Gear2Gear2Gear2Gear2Gear2Gear2Gear2Gear2Gear2Gear2Gear2chkGear12chkGear12chkGear12chkGear12chkGear12chkGear12chkGear12chkGear12chkGear12chkGear12chkGear12chkGear12chkGear12chkGear12chkGear12chkGear12chkGear12

ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!FromGear:=1FromGear:=1FromGear:=1FromGear:=1FromGear:=1FromGear:=1FromGear:=1FromGear:=1FromGear:=1FromGear:=1FromGear:=1FromGear:=1FromGear:=1FromGear:=1FromGear:=1FromGear:=1FromGear:=1ToGear:=2ToGear:=2ToGear:=2ToGear:=2ToGear:=2ToGear:=2ToGear:=2ToGear:=2ToGear:=2ToGear:=2ToGear:=2ToGear:=2ToGear:=2ToGear:=2ToGear:=2ToGear:=2ToGear:=2

NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?

Fig. 5. A Change from Gear 1 to Gear 2.

This article was processed using the LATEX macro package with LLNCS style

20

EngineEngineEngineEngineEngineEngineEngineEngineEngineEngineEngineEngineEngineEngineEngineEngineEngine

ClutchCloseClutchCloseClutchCloseClutchCloseClutchCloseClutchCloseClutchCloseClutchCloseClutchCloseClutchCloseClutchCloseClutchCloseClutchCloseClutchCloseClutchCloseClutchCloseClutchClose( ETimer<=900 )( ETimer<=900 )( ETimer<=900 )( ETimer<=900 )( ETimer<=900 )( ETimer<=900 )( ETimer<=900 )( ETimer<=900 )( ETimer<=900 )( ETimer<=900 )( ETimer<=900 )( ETimer<=900 )( ETimer<=900 )( ETimer<=900 )( ETimer<=900 )( ETimer<=900 )( ETimer<=900 )c:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpen

FindSpeedFindSpeedFindSpeedFindSpeedFindSpeedFindSpeedFindSpeedFindSpeedFindSpeedFindSpeedFindSpeedFindSpeedFindSpeedFindSpeedFindSpeedFindSpeedFindSpeed( ETimer<=200 )( ETimer<=200 )( ETimer<=200 )( ETimer<=200 )( ETimer<=200 )( ETimer<=200 )( ETimer<=200 )( ETimer<=200 )( ETimer<=200 )( ETimer<=200 )( ETimer<=200 )( ETimer<=200 )( ETimer<=200 )( ETimer<=200 )( ETimer<=200 )( ETimer<=200 )( ETimer<=200 )

ErrorSpeedErrorSpeedErrorSpeedErrorSpeedErrorSpeedErrorSpeedErrorSpeedErrorSpeedErrorSpeedErrorSpeedErrorSpeedErrorSpeedErrorSpeedErrorSpeedErrorSpeedErrorSpeedErrorSpeed

InitialInitialInitialInitialInitialInitialInitialInitialInitialInitialInitialInitialInitialInitialInitialInitialInitial

SpeedSpeedSpeedSpeedSpeedSpeedSpeedSpeedSpeedSpeedSpeedSpeedSpeedSpeedSpeedSpeedSpeed( ETimer<=500 )( ETimer<=500 )( ETimer<=500 )( ETimer<=500 )( ETimer<=500 )( ETimer<=500 )( ETimer<=500 )( ETimer<=500 )( ETimer<=500 )( ETimer<=500 )( ETimer<=500 )( ETimer<=500 )( ETimer<=500 )( ETimer<=500 )( ETimer<=500 )( ETimer<=500 )( ETimer<=500 )

ZeroZeroZeroZeroZeroZeroZeroZeroZeroZeroZeroZeroZeroZeroZeroZeroZero

DecTorqueDecTorqueDecTorqueDecTorqueDecTorqueDecTorqueDecTorqueDecTorqueDecTorqueDecTorqueDecTorqueDecTorqueDecTorqueDecTorqueDecTorqueDecTorqueDecTorque( ETimer<=400 )( ETimer<=400 )( ETimer<=400 )( ETimer<=400 )( ETimer<=400 )( ETimer<=400 )( ETimer<=400 )( ETimer<=400 )( ETimer<=400 )( ETimer<=400 )( ETimer<=400 )( ETimer<=400 )( ETimer<=400 )( ETimer<=400 )( ETimer<=400 )( ETimer<=400 )( ETimer<=400 )

TorqueTorqueTorqueTorqueTorqueTorqueTorqueTorqueTorqueTorqueTorqueTorqueTorqueTorqueTorqueTorqueTorque

ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?

ETimer==900ETimer==900ETimer==900ETimer==900ETimer==900ETimer==900ETimer==900ETimer==900ETimer==900ETimer==900ETimer==900ETimer==900ETimer==900ETimer==900ETimer==900ETimer==900ETimer==900

ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0

ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0

ETimer==200ETimer==200ETimer==200ETimer==200ETimer==200ETimer==200ETimer==200ETimer==200ETimer==200ETimer==200ETimer==200ETimer==200ETimer==200ETimer==200ETimer==200ETimer==200ETimer==200UseCase:=2UseCase:=2UseCase:=2UseCase:=2UseCase:=2UseCase:=2UseCase:=2UseCase:=2UseCase:=2UseCase:=2UseCase:=2UseCase:=2UseCase:=2UseCase:=2UseCase:=2UseCase:=2UseCase:=2

ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50SpeedSet!SpeedSet!SpeedSet!SpeedSet!SpeedSet!SpeedSet!SpeedSet!SpeedSet!SpeedSet!SpeedSet!SpeedSet!SpeedSet!SpeedSet!SpeedSet!SpeedSet!SpeedSet!SpeedSet!ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0

ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0

ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ETimer<500ETimer<500ETimer<500ETimer<500ETimer<500ETimer<500ETimer<500ETimer<500ETimer<500ETimer<500ETimer<500ETimer<500ETimer<500ETimer<500ETimer<500ETimer<500ETimer<500



ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0

TorqueZero!TorqueZero!TorqueZero!TorqueZero!TorqueZero!TorqueZero!TorqueZero!TorqueZero!TorqueZero!TorqueZero!TorqueZero!TorqueZero!TorqueZero!TorqueZero!TorqueZero!TorqueZero!TorqueZero!ETimer>=150ETimer>=150ETimer>=150ETimer>=150ETimer>=150ETimer>=150ETimer>=150ETimer>=150ETimer>=150ETimer>=150ETimer>=150ETimer>=150ETimer>=150ETimer>=150ETimer>=150ETimer>=150ETimer>=150


ReqZeroTorque?ReqZeroTorque?ReqZeroTorque?ReqZeroTorque?ReqZeroTorque?ReqZeroTorque?ReqZeroTorque?ReqZeroTorque?ReqZeroTorque?ReqZeroTorque?ReqZeroTorque?ReqZeroTorque?ReqZeroTorque?ReqZeroTorque?ReqZeroTorque?ReqZeroTorque?ReqZeroTorque?ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0

Fig. 6. The Engine Automaton.

ClutchClutchClutchClutchClutchClutchClutchClutchClutchClutchClutchClutchClutchClutchClutchClutchClutch

// 1996-11-20, 1997-02-20, and 1997-07-31// 1996-11-20, 1997-02-20, and 1997-07-31// 1996-11-20, 1997-02-20, and 1997-07-31// 1996-11-20, 1997-02-20, and 1997-07-31// 1996-11-20, 1997-02-20, and 1997-07-31// 1996-11-20, 1997-02-20, and 1997-07-31// 1996-11-20, 1997-02-20, and 1997-07-31// 1996-11-20, 1997-02-20, and 1997-07-31// 1996-11-20, 1997-02-20, and 1997-07-31// 1996-11-20, 1997-02-20, and 1997-07-31// 1996-11-20, 1997-02-20, and 1997-07-31// 1996-11-20, 1997-02-20, and 1997-07-31// 1996-11-20, 1997-02-20, and 1997-07-31// 1996-11-20, 1997-02-20, and 1997-07-31// 1996-11-20, 1997-02-20, and 1997-07-31// 1996-11-20, 1997-02-20, and 1997-07-31// 1996-11-20, 1997-02-20, and 1997-07-31// @ Uppsala University.// @ Uppsala University.// @ Uppsala University.// @ Uppsala University.// @ Uppsala University.// @ Uppsala University.// @ Uppsala University.// @ Uppsala University.// @ Uppsala University.// @ Uppsala University.// @ Uppsala University.// @ Uppsala University.// @ Uppsala University.// @ Uppsala University.// @ Uppsala University.// @ Uppsala University.// @ Uppsala University.// Paul Pettersson, DoCS & Magnus Lindahl, Mecel AB// Paul Pettersson, DoCS & Magnus Lindahl, Mecel AB// Paul Pettersson, DoCS & Magnus Lindahl, Mecel AB// Paul Pettersson, DoCS & Magnus Lindahl, Mecel AB// Paul Pettersson, DoCS & Magnus Lindahl, Mecel AB// Paul Pettersson, DoCS & Magnus Lindahl, Mecel AB// Paul Pettersson, DoCS & Magnus Lindahl, Mecel AB// Paul Pettersson, DoCS & Magnus Lindahl, Mecel AB// Paul Pettersson, DoCS & Magnus Lindahl, Mecel AB// Paul Pettersson, DoCS & Magnus Lindahl, Mecel AB// Paul Pettersson, DoCS & Magnus Lindahl, Mecel AB// Paul Pettersson, DoCS & Magnus Lindahl, Mecel AB// Paul Pettersson, DoCS & Magnus Lindahl, Mecel AB// Paul Pettersson, DoCS & Magnus Lindahl, Mecel AB// Paul Pettersson, DoCS & Magnus Lindahl, Mecel AB// Paul Pettersson, DoCS & Magnus Lindahl, Mecel AB// Paul Pettersson, DoCS & Magnus Lindahl, Mecel AB//////////////////////////////////// Engine// Engine// Engine// Engine// Engine// Engine// Engine// Engine// Engine// Engine// Engine// Engine// Engine// Engine// Engine// Engine// Engineint UseCase;int UseCase;int UseCase;int UseCase;int UseCase;int UseCase;int UseCase;int UseCase;int UseCase;int UseCase;int UseCase;int UseCase;int UseCase;int UseCase;int UseCase;int UseCase;int UseCase;chan ReqZeroTorque, TorqueZero, ReqSpeed;chan ReqZeroTorque, TorqueZero, ReqSpeed;chan ReqZeroTorque, TorqueZero, ReqSpeed;chan ReqZeroTorque, TorqueZero, ReqSpeed;chan ReqZeroTorque, TorqueZero, ReqSpeed;chan ReqZeroTorque, TorqueZero, ReqSpeed;chan ReqZeroTorque, TorqueZero, ReqSpeed;chan ReqZeroTorque, TorqueZero, ReqSpeed;chan ReqZeroTorque, TorqueZero, ReqSpeed;chan ReqZeroTorque, TorqueZero, ReqSpeed;chan ReqZeroTorque, TorqueZero, ReqSpeed;chan ReqZeroTorque, TorqueZero, ReqSpeed;chan ReqZeroTorque, TorqueZero, ReqSpeed;chan ReqZeroTorque, TorqueZero, ReqSpeed;chan ReqZeroTorque, TorqueZero, ReqSpeed;chan ReqZeroTorque, TorqueZero, ReqSpeed;chan ReqZeroTorque, TorqueZero, ReqSpeed;chan SpeedSet, ReqTorque;chan SpeedSet, ReqTorque;chan SpeedSet, ReqTorque;chan SpeedSet, ReqTorque;chan SpeedSet, ReqTorque;chan SpeedSet, ReqTorque;chan SpeedSet, ReqTorque;chan SpeedSet, ReqTorque;chan SpeedSet, ReqTorque;chan SpeedSet, ReqTorque;chan SpeedSet, ReqTorque;chan SpeedSet, ReqTorque;chan SpeedSet, ReqTorque;chan SpeedSet, ReqTorque;chan SpeedSet, ReqTorque;chan SpeedSet, ReqTorque;chan SpeedSet, ReqTorque;// Clutch// Clutch// Clutch// Clutch// Clutch// Clutch// Clutch// Clutch// Clutch// Clutch// Clutch// Clutch// Clutch// Clutch// Clutch// Clutch// Clutchchan OpenClutch, CloseClutch, ClutchIsOpen, ClutchIsClosed;chan OpenClutch, CloseClutch, ClutchIsOpen, ClutchIsClosed;chan OpenClutch, CloseClutch, ClutchIsOpen, ClutchIsClosed;chan OpenClutch, CloseClutch, ClutchIsOpen, ClutchIsClosed;chan OpenClutch, CloseClutch, ClutchIsOpen, ClutchIsClosed;chan OpenClutch, CloseClutch, ClutchIsOpen, ClutchIsClosed;chan OpenClutch, CloseClutch, ClutchIsOpen, ClutchIsClosed;chan OpenClutch, CloseClutch, ClutchIsOpen, ClutchIsClosed;chan OpenClutch, CloseClutch, ClutchIsOpen, ClutchIsClosed;chan OpenClutch, CloseClutch, ClutchIsOpen, ClutchIsClosed;chan OpenClutch, CloseClutch, ClutchIsOpen, ClutchIsClosed;chan OpenClutch, CloseClutch, ClutchIsOpen, ClutchIsClosed;chan OpenClutch, CloseClutch, ClutchIsOpen, ClutchIsClosed;chan OpenClutch, CloseClutch, ClutchIsOpen, ClutchIsClosed;chan OpenClutch, CloseClutch, ClutchIsOpen, ClutchIsClosed;chan OpenClutch, CloseClutch, ClutchIsOpen, ClutchIsClosed;chan OpenClutch, CloseClutch, ClutchIsOpen, ClutchIsClosed;// GearBox// GearBox// GearBox// GearBox// GearBox// GearBox// GearBox// GearBox// GearBox// GearBox// GearBox// GearBox// GearBox// GearBox// GearBox// GearBox// GearBoxchan ReqNeu, GearNeu, ReqSet, GearSet;chan ReqNeu, GearNeu, ReqSet, GearSet;chan ReqNeu, GearNeu, ReqSet, GearSet;chan ReqNeu, GearNeu, ReqSet, GearSet;chan ReqNeu, GearNeu, ReqSet, GearSet;chan ReqNeu, GearNeu, ReqSet, GearSet;chan ReqNeu, GearNeu, ReqSet, GearSet;chan ReqNeu, GearNeu, ReqSet, GearSet;chan ReqNeu, GearNeu, ReqSet, GearSet;chan ReqNeu, GearNeu, ReqSet, GearSet;chan ReqNeu, GearNeu, ReqSet, GearSet;chan ReqNeu, GearNeu, ReqSet, GearSet;chan ReqNeu, GearNeu, ReqSet, GearSet;chan ReqNeu, GearNeu, ReqSet, GearSet;chan ReqNeu, GearNeu, ReqSet, GearSet;chan ReqNeu, GearNeu, ReqSet, GearSet;chan ReqNeu, GearNeu, ReqSet, GearSet;// Gear// Gear// Gear// Gear// Gear// Gear// Gear// Gear// Gear// Gear// Gear// Gear// Gear// Gear// Gear// Gear// Gearint FromGear, ToGear;int FromGear, ToGear;int FromGear, ToGear;int FromGear, ToGear;int FromGear, ToGear;int FromGear, ToGear;int FromGear, ToGear;int FromGear, ToGear;int FromGear, ToGear;int FromGear, ToGear;int FromGear, ToGear;int FromGear, ToGear;int FromGear, ToGear;int FromGear, ToGear;int FromGear, ToGear;int FromGear, ToGear;int FromGear, ToGear;chan ReqNewGear, NewGear;chan ReqNewGear, NewGear;chan ReqNewGear, NewGear;chan ReqNewGear, NewGear;chan ReqNewGear, NewGear;chan ReqNewGear, NewGear;chan ReqNewGear, NewGear;chan ReqNewGear, NewGear;chan ReqNewGear, NewGear;chan ReqNewGear, NewGear;chan ReqNewGear, NewGear;chan ReqNewGear, NewGear;chan ReqNewGear, NewGear;chan ReqNewGear, NewGear;chan ReqNewGear, NewGear;chan ReqNewGear, NewGear;chan ReqNewGear, NewGear;// System Decoration// System Decoration// System Decoration// System Decoration// System Decoration// System Decoration// System Decoration// System Decoration// System Decoration// System Decoration// System Decoration// System Decoration// System Decoration// System Decoration// System Decoration// System Decoration// System Decorationint ErrStat;int ErrStat;int ErrStat;int ErrStat;int ErrStat;int ErrStat;int ErrStat;int ErrStat;int ErrStat;int ErrStat;int ErrStat;int ErrStat;int ErrStat;int ErrStat;int ErrStat;int ErrStat;int ErrStat;clock CTimer, ETimer, GBTimer, GCTimer, SysTimer;clock CTimer, ETimer, GBTimer, GCTimer, SysTimer;clock CTimer, ETimer, GBTimer, GCTimer, SysTimer;clock CTimer, ETimer, GBTimer, GCTimer, SysTimer;clock CTimer, ETimer, GBTimer, GCTimer, SysTimer;clock CTimer, ETimer, GBTimer, GCTimer, SysTimer;clock CTimer, ETimer, GBTimer, GCTimer, SysTimer;clock CTimer, ETimer, GBTimer, GCTimer, SysTimer;clock CTimer, ETimer, GBTimer, GCTimer, SysTimer;clock CTimer, ETimer, GBTimer, GCTimer, SysTimer;clock CTimer, ETimer, GBTimer, GCTimer, SysTimer;clock CTimer, ETimer, GBTimer, GCTimer, SysTimer;clock CTimer, ETimer, GBTimer, GCTimer, SysTimer;clock CTimer, ETimer, GBTimer, GCTimer, SysTimer;clock CTimer, ETimer, GBTimer, GCTimer, SysTimer;clock CTimer, ETimer, GBTimer, GCTimer, SysTimer;clock CTimer, ETimer, GBTimer, GCTimer, SysTimer;system GearControl, Gear, Engine, GearBox, Clutch;system GearControl, Gear, Engine, GearBox, Clutch;system GearControl, Gear, Engine, GearBox, Clutch;system GearControl, Gear, Engine, GearBox, Clutch;system GearControl, Gear, Engine, GearBox, Clutch;system GearControl, Gear, Engine, GearBox, Clutch;system GearControl, Gear, Engine, GearBox, Clutch;system GearControl, Gear, Engine, GearBox, Clutch;system GearControl, Gear, Engine, GearBox, Clutch;system GearControl, Gear, Engine, GearBox, Clutch;system GearControl, Gear, Engine, GearBox, Clutch;system GearControl, Gear, Engine, GearBox, Clutch;system GearControl, Gear, Engine, GearBox, Clutch;system GearControl, Gear, Engine, GearBox, Clutch;system GearControl, Gear, Engine, GearBox, Clutch;system GearControl, Gear, Engine, GearBox, Clutch;system GearControl, Gear, Engine, GearBox, Clutch;

ConfigConfigConfigConfigConfigConfigConfigConfigConfigConfigConfigConfigConfigConfigConfigConfigConfig

GearBoxGearBoxGearBoxGearBoxGearBoxGearBoxGearBoxGearBoxGearBoxGearBoxGearBoxGearBoxGearBoxGearBoxGearBoxGearBoxGearBoxGearControlGearControlGearControlGearControlGearControlGearControlGearControlGearControlGearControlGearControlGearControlGearControlGearControlGearControlGearControlGearControlGearControl

GearGearGearGearGearGearGearGearGearGearGearGearGearGearGearGearGear EngineEngineEngineEngineEngineEngineEngineEngineEngineEngineEngineEngineEngineEngineEngineEngineEngine

GNeuErrorGNeuErrorGNeuErrorGNeuErrorGNeuErrorGNeuErrorGNeuErrorGNeuErrorGNeuErrorGNeuErrorGNeuErrorGNeuErrorGNeuErrorGNeuErrorGNeuErrorGNeuErrorGNeuError

GSetErrorGSetErrorGSetErrorGSetErrorGSetErrorGSetErrorGSetErrorGSetErrorGSetErrorGSetErrorGSetErrorGSetErrorGSetErrorGSetErrorGSetErrorGSetErrorGSetError

COpenErrorCOpenErrorCOpenErrorCOpenErrorCOpenErrorCOpenErrorCOpenErrorCOpenErrorCOpenErrorCOpenErrorCOpenErrorCOpenErrorCOpenErrorCOpenErrorCOpenErrorCOpenErrorCOpenError

CCloseErrorCCloseErrorCCloseErrorCCloseErrorCCloseErrorCCloseErrorCCloseErrorCCloseErrorCCloseErrorCCloseErrorCCloseErrorCCloseErrorCCloseErrorCCloseErrorCCloseErrorCCloseErrorCCloseError

CheckClutchClosed2CheckClutchClosed2CheckClutchClosed2CheckClutchClosed2CheckClutchClosed2CheckClutchClosed2CheckClutchClosed2CheckClutchClosed2CheckClutchClosed2CheckClutchClosed2CheckClutchClosed2CheckClutchClosed2CheckClutchClosed2CheckClutchClosed2CheckClutchClosed2CheckClutchClosed2CheckClutchClosed2( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )

c:ClutchClosec:ClutchClosec:ClutchClosec:ClutchClosec:ClutchClosec:ClutchClosec:ClutchClosec:ClutchClosec:ClutchClosec:ClutchClosec:ClutchClosec:ClutchClosec:ClutchClosec:ClutchClosec:ClutchClosec:ClutchClosec:ClutchClose

ClutchCloseClutchCloseClutchCloseClutchCloseClutchCloseClutchCloseClutchCloseClutchCloseClutchCloseClutchCloseClutchCloseClutchCloseClutchCloseClutchCloseClutchCloseClutchCloseClutchClose( ETimer<=900 )( ETimer<=900 )( ETimer<=900 )( ETimer<=900 )( ETimer<=900 )( ETimer<=900 )( ETimer<=900 )( ETimer<=900 )( ETimer<=900 )( ETimer<=900 )( ETimer<=900 )( ETimer<=900 )( ETimer<=900 )( ETimer<=900 )( ETimer<=900 )( ETimer<=900 )( ETimer<=900 )c:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpen

FindSpeedFindSpeedFindSpeedFindSpeedFindSpeedFindSpeedFindSpeedFindSpeedFindSpeedFindSpeedFindSpeedFindSpeedFindSpeedFindSpeedFindSpeedFindSpeedFindSpeed( ETimer<=200 )( ETimer<=200 )( ETimer<=200 )( ETimer<=200 )( ETimer<=200 )( ETimer<=200 )( ETimer<=200 )( ETimer<=200 )( ETimer<=200 )( ETimer<=200 )( ETimer<=200 )( ETimer<=200 )( ETimer<=200 )( ETimer<=200 )( ETimer<=200 )( ETimer<=200 )( ETimer<=200 )

c:ReqSetGearc:ReqSetGearc:ReqSetGearc:ReqSetGearc:ReqSetGearc:ReqSetGearc:ReqSetGearc:ReqSetGearc:ReqSetGearc:ReqSetGearc:ReqSetGearc:ReqSetGearc:ReqSetGearc:ReqSetGearc:ReqSetGearc:ReqSetGearc:ReqSetGear

ErrorSpeedErrorSpeedErrorSpeedErrorSpeedErrorSpeedErrorSpeedErrorSpeedErrorSpeedErrorSpeedErrorSpeedErrorSpeedErrorSpeedErrorSpeedErrorSpeedErrorSpeedErrorSpeedErrorSpeed

ErrorIdleErrorIdleErrorIdleErrorIdleErrorIdleErrorIdleErrorIdleErrorIdleErrorIdleErrorIdleErrorIdleErrorIdleErrorIdleErrorIdleErrorIdleErrorIdleErrorIdle

ErrorNeuErrorNeuErrorNeuErrorNeuErrorNeuErrorNeuErrorNeuErrorNeuErrorNeuErrorNeuErrorNeuErrorNeuErrorNeuErrorNeuErrorNeuErrorNeuErrorNeuErrorOpenErrorOpenErrorOpenErrorOpenErrorOpenErrorOpenErrorOpenErrorOpenErrorOpenErrorOpenErrorOpenErrorOpenErrorOpenErrorOpenErrorOpenErrorOpenErrorOpen

ErrorCloseErrorCloseErrorCloseErrorCloseErrorCloseErrorCloseErrorCloseErrorCloseErrorCloseErrorCloseErrorCloseErrorCloseErrorCloseErrorCloseErrorCloseErrorCloseErrorClose

InitialInitialInitialInitialInitialInitialInitialInitialInitialInitialInitialInitialInitialInitialInitialInitialInitial

c:Initiatec:Initiatec:Initiatec:Initiatec:Initiatec:Initiatec:Initiatec:Initiatec:Initiatec:Initiatec:Initiatec:Initiatec:Initiatec:Initiatec:Initiatec:Initiatec:Initiate

CheckClutch2CheckClutch2CheckClutch2CheckClutch2CheckClutch2CheckClutch2CheckClutch2CheckClutch2CheckClutch2CheckClutch2CheckClutch2CheckClutch2CheckClutch2CheckClutch2CheckClutch2CheckClutch2CheckClutch2( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )

CheckGearNeuCheckGearNeuCheckGearNeuCheckGearNeuCheckGearNeuCheckGearNeuCheckGearNeuCheckGearNeuCheckGearNeuCheckGearNeuCheckGearNeuCheckGearNeuCheckGearNeuCheckGearNeuCheckGearNeuCheckGearNeuCheckGearNeu( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )

c:ReqNeuGearc:ReqNeuGearc:ReqNeuGearc:ReqNeuGearc:ReqNeuGearc:ReqNeuGearc:ReqNeuGearc:ReqNeuGearc:ReqNeuGearc:ReqNeuGearc:ReqNeuGearc:ReqNeuGearc:ReqNeuGearc:ReqNeuGearc:ReqNeuGearc:ReqNeuGearc:ReqNeuGear

CheckTorqueCheckTorqueCheckTorqueCheckTorqueCheckTorqueCheckTorqueCheckTorqueCheckTorqueCheckTorqueCheckTorqueCheckTorqueCheckTorqueCheckTorqueCheckTorqueCheckTorqueCheckTorqueCheckTorque( GCTimer<=255 )( GCTimer<=255 )( GCTimer<=255 )( GCTimer<=255 )( GCTimer<=255 )( GCTimer<=255 )( GCTimer<=255 )( GCTimer<=255 )( GCTimer<=255 )( GCTimer<=255 )( GCTimer<=255 )( GCTimer<=255 )( GCTimer<=255 )( GCTimer<=255 )( GCTimer<=255 )( GCTimer<=255 )( GCTimer<=255 )

CheckClutchClosedCheckClutchClosedCheckClutchClosedCheckClutchClosedCheckClutchClosedCheckClutchClosedCheckClutchClosedCheckClutchClosedCheckClutchClosedCheckClutchClosedCheckClutchClosedCheckClutchClosedCheckClutchClosedCheckClutchClosedCheckClutchClosedCheckClutchClosedCheckClutchClosed( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )

c:GearChangedc:GearChangedc:GearChangedc:GearChangedc:GearChangedc:GearChangedc:GearChangedc:GearChangedc:GearChangedc:GearChangedc:GearChangedc:GearChangedc:GearChangedc:GearChangedc:GearChangedc:GearChangedc:GearChanged

c:ReqTorqueCc:ReqTorqueCc:ReqTorqueCc:ReqTorqueCc:ReqTorqueCc:ReqTorqueCc:ReqTorqueCc:ReqTorqueCc:ReqTorqueCc:ReqTorqueCc:ReqTorqueCc:ReqTorqueCc:ReqTorqueCc:ReqTorqueCc:ReqTorqueCc:ReqTorqueCc:ReqTorqueC


c:ReqSyncSpeedc:ReqSyncSpeedc:ReqSyncSpeedc:ReqSyncSpeedc:ReqSyncSpeedc:ReqSyncSpeedc:ReqSyncSpeedc:ReqSyncSpeedc:ReqSyncSpeedc:ReqSyncSpeedc:ReqSyncSpeedc:ReqSyncSpeedc:ReqSyncSpeedc:ReqSyncSpeedc:ReqSyncSpeedc:ReqSyncSpeedc:ReqSyncSpeed

GearGearGearGearGearGearGearGearGearGearGearGearGearGearGearGearGear

SpeedSpeedSpeedSpeedSpeedSpeedSpeedSpeedSpeedSpeedSpeedSpeedSpeedSpeedSpeedSpeedSpeed( ETimer<=500 )( ETimer<=500 )( ETimer<=500 )( ETimer<=500 )( ETimer<=500 )( ETimer<=500 )( ETimer<=500 )( ETimer<=500 )( ETimer<=500 )( ETimer<=500 )( ETimer<=500 )( ETimer<=500 )( ETimer<=500 )( ETimer<=500 )( ETimer<=500 )( ETimer<=500 )( ETimer<=500 )

ZeroZeroZeroZeroZeroZeroZeroZeroZeroZeroZeroZeroZeroZeroZeroZeroZero

DecTorqueDecTorqueDecTorqueDecTorqueDecTorqueDecTorqueDecTorqueDecTorqueDecTorqueDecTorqueDecTorqueDecTorqueDecTorqueDecTorqueDecTorqueDecTorqueDecTorque( ETimer<=400 )( ETimer<=400 )( ETimer<=400 )( ETimer<=400 )( ETimer<=400 )( ETimer<=400 )( ETimer<=400 )( ETimer<=400 )( ETimer<=400 )( ETimer<=400 )( ETimer<=400 )( ETimer<=400 )( ETimer<=400 )( ETimer<=400 )( ETimer<=400 )( ETimer<=400 )( ETimer<=400 )

TorqueTorqueTorqueTorqueTorqueTorqueTorqueTorqueTorqueTorqueTorqueTorqueTorqueTorqueTorqueTorqueTorque


c:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpenc:ClutchOpen

CheckClutchCheckClutchCheckClutchCheckClutchCheckClutchCheckClutchCheckClutchCheckClutchCheckClutchCheckClutchCheckClutchCheckClutchCheckClutchCheckClutchCheckClutchCheckClutchCheckClutch( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )( GCTimer<=200 )

CheckSyncSpeedCheckSyncSpeedCheckSyncSpeedCheckSyncSpeedCheckSyncSpeedCheckSyncSpeedCheckSyncSpeedCheckSyncSpeedCheckSyncSpeedCheckSyncSpeedCheckSyncSpeedCheckSyncSpeedCheckSyncSpeedCheckSyncSpeedCheckSyncSpeedCheckSyncSpeedCheckSyncSpeed( GCTimer<=155 )( GCTimer<=155 )( GCTimer<=155 )( GCTimer<=155 )( GCTimer<=155 )( GCTimer<=155 )( GCTimer<=155 )( GCTimer<=155 )( GCTimer<=155 )( GCTimer<=155 )( GCTimer<=155 )( GCTimer<=155 )( GCTimer<=155 )( GCTimer<=155 )( GCTimer<=155 )( GCTimer<=155 )( GCTimer<=155 )

ClosingClosingClosingClosingClosingClosingClosingClosingClosingClosingClosingClosingClosingClosingClosingClosingClosing( GBTimer<=300 )( GBTimer<=300 )( GBTimer<=300 )( GBTimer<=300 )( GBTimer<=300 )( GBTimer<=300 )( GBTimer<=300 )( GBTimer<=300 )( GBTimer<=300 )( GBTimer<=300 )( GBTimer<=300 )( GBTimer<=300 )( GBTimer<=300 )( GBTimer<=300 )( GBTimer<=300 )( GBTimer<=300 )( GBTimer<=300 )

OpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpening( GBTimer<=200 )( GBTimer<=200 )( GBTimer<=200 )( GBTimer<=200 )( GBTimer<=200 )( GBTimer<=200 )( GBTimer<=200 )( GBTimer<=200 )( GBTimer<=200 )( GBTimer<=200 )( GBTimer<=200 )( GBTimer<=200 )( GBTimer<=200 )( GBTimer<=200 )( GBTimer<=200 )( GBTimer<=200 )( GBTimer<=200 )

NeutralNeutralNeutralNeutralNeutralNeutralNeutralNeutralNeutralNeutralNeutralNeutralNeutralNeutralNeutralNeutralNeutral

IdleIdleIdleIdleIdleIdleIdleIdleIdleIdleIdleIdleIdleIdleIdleIdleIdle

ClosingClosingClosingClosingClosingClosingClosingClosingClosingClosingClosingClosingClosingClosingClosingClosingClosing( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )

OpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpeningOpening( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )( CTimer<=150 )

OpenOpenOpenOpenOpenOpenOpenOpenOpenOpenOpenOpenOpenOpenOpenOpenOpen

ClosedClosedClosedClosedClosedClosedClosedClosedClosedClosedClosedClosedClosedClosedClosedClosedClosed

CheckGearNeu2CheckGearNeu2CheckGearNeu2CheckGearNeu2CheckGearNeu2CheckGearNeu2CheckGearNeu2CheckGearNeu2CheckGearNeu2CheckGearNeu2CheckGearNeu2CheckGearNeu2CheckGearNeu2CheckGearNeu2CheckGearNeu2CheckGearNeu2CheckGearNeu2( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )( GCTimer<=250 )

c:ReqSetGear2c:ReqSetGear2c:ReqSetGear2c:ReqSetGear2c:ReqSetGear2c:ReqSetGear2c:ReqSetGear2c:ReqSetGear2c:ReqSetGear2c:ReqSetGear2c:ReqSetGear2c:ReqSetGear2c:ReqSetGear2c:ReqSetGear2c:ReqSetGear2c:ReqSetGear2c:ReqSetGear2

c:ClutchOpen2c:ClutchOpen2c:ClutchOpen2c:ClutchOpen2c:ClutchOpen2c:ClutchOpen2c:ClutchOpen2c:ClutchOpen2c:ClutchOpen2c:ClutchOpen2c:ClutchOpen2c:ClutchOpen2c:ClutchOpen2c:ClutchOpen2c:ClutchOpen2c:ClutchOpen2c:ClutchOpen2

GearNGearNGearNGearNGearNGearNGearNGearNGearNGearNGearNGearNGearNGearNGearNGearNGearN

Gear1Gear1Gear1Gear1Gear1Gear1Gear1Gear1Gear1Gear1Gear1Gear1Gear1Gear1Gear1Gear1Gear1

GearRGearRGearRGearRGearRGearRGearRGearRGearRGearRGearRGearRGearRGearRGearRGearRGearR





chkGear12chkGear12chkGear12chkGear12chkGear12chkGear12chkGear12chkGear12chkGear12chkGear12chkGear12chkGear12chkGear12chkGear12chkGear12chkGear12chkGear12



chkGear45chkGear45chkGear45chkGear45chkGear45chkGear45chkGear45chkGear45chkGear45chkGear45chkGear45chkGear45chkGear45chkGear45chkGear45chkGear45chkGear45chkGear54chkGear54chkGear54chkGear54chkGear54chkGear54chkGear54chkGear54chkGear54chkGear54chkGear54chkGear54chkGear54chkGear54chkGear54chkGear54chkGear54




chkGear1NchkGear1NchkGear1NchkGear1NchkGear1NchkGear1NchkGear1NchkGear1NchkGear1NchkGear1NchkGear1NchkGear1NchkGear1NchkGear1NchkGear1NchkGear1NchkGear1N

chkGearN1chkGearN1chkGearN1chkGearN1chkGearN1chkGearN1chkGearN1chkGearN1chkGearN1chkGearN1chkGearN1chkGearN1chkGearN1chkGearN1chkGearN1chkGearN1chkGearN1

chkGearNRchkGearNRchkGearNRchkGearNRchkGearNRchkGearNRchkGearNRchkGearNRchkGearNRchkGearNRchkGearNRchkGearNRchkGearNRchkGearNRchkGearNRchkGearNRchkGearNR

chkGearRNchkGearRNchkGearRNchkGearRNchkGearRNchkGearRNchkGearRNchkGearRNchkGearRNchkGearRNchkGearRNchkGearRNchkGearRNchkGearRNchkGearRNchkGearRNchkGearRN










ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0ToGear==0CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0


CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!CloseClutch!GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0

ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0

ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0

ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque? ETimer==400ETimer==400ETimer==400ETimer==400ETimer==400ETimer==400ETimer==400ETimer==400ETimer==400ETimer==400ETimer==400ETimer==400ETimer==400ETimer==400ETimer==400ETimer==400ETimer==400

UseCase:=1UseCase:=1UseCase:=1UseCase:=1UseCase:=1UseCase:=1UseCase:=1UseCase:=1UseCase:=1UseCase:=1UseCase:=1UseCase:=1UseCase:=1UseCase:=1UseCase:=1UseCase:=1UseCase:=1

ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0

ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ReqSpeed?ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!ReqSet!

GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0

GCTimer<150GCTimer<150GCTimer<150GCTimer<150GCTimer<150GCTimer<150GCTimer<150GCTimer<150GCTimer<150GCTimer<150GCTimer<150GCTimer<150GCTimer<150GCTimer<150GCTimer<150GCTimer<150GCTimer<150SpeedSet?SpeedSet?SpeedSet?SpeedSet?SpeedSet?SpeedSet?SpeedSet?SpeedSet?SpeedSet?SpeedSet?SpeedSet?SpeedSet?SpeedSet?SpeedSet?SpeedSet?SpeedSet?SpeedSet?


GBTimer==300GBTimer==300GBTimer==300GBTimer==300GBTimer==300GBTimer==300GBTimer==300GBTimer==300GBTimer==300GBTimer==300GBTimer==300GBTimer==300GBTimer==300GBTimer==300GBTimer==300GBTimer==300GBTimer==300ErrStat:=3ErrStat:=3ErrStat:=3ErrStat:=3ErrStat:=3ErrStat:=3ErrStat:=3ErrStat:=3ErrStat:=3ErrStat:=3ErrStat:=3ErrStat:=3ErrStat:=3ErrStat:=3ErrStat:=3ErrStat:=3ErrStat:=3

GBTimer>200GBTimer>200GBTimer>200GBTimer>200GBTimer>200GBTimer>200GBTimer>200GBTimer>200GBTimer>200GBTimer>200GBTimer>200GBTimer>200GBTimer>200GBTimer>200GBTimer>200GBTimer>200GBTimer>200ErrStat:=4ErrStat:=4ErrStat:=4ErrStat:=4ErrStat:=4ErrStat:=4ErrStat:=4ErrStat:=4ErrStat:=4ErrStat:=4ErrStat:=4ErrStat:=4ErrStat:=4ErrStat:=4ErrStat:=4ErrStat:=4ErrStat:=4




FromGear<=0FromGear<=0FromGear<=0FromGear<=0FromGear<=0FromGear<=0FromGear<=0FromGear<=0FromGear<=0FromGear<=0FromGear<=0FromGear<=0FromGear<=0FromGear<=0FromGear<=0FromGear<=0FromGear<=0

ReqNewGear?ReqNewGear?ReqNewGear?ReqNewGear?ReqNewGear?ReqNewGear?ReqNewGear?ReqNewGear?ReqNewGear?ReqNewGear?ReqNewGear?ReqNewGear?ReqNewGear?ReqNewGear?ReqNewGear?ReqNewGear?ReqNewGear?SysTimer:=0SysTimer:=0SysTimer:=0SysTimer:=0SysTimer:=0SysTimer:=0SysTimer:=0SysTimer:=0SysTimer:=0SysTimer:=0SysTimer:=0SysTimer:=0SysTimer:=0SysTimer:=0SysTimer:=0SysTimer:=0SysTimer:=0

ReqZeroTorque!ReqZeroTorque!ReqZeroTorque!ReqZeroTorque!ReqZeroTorque!ReqZeroTorque!ReqZeroTorque!ReqZeroTorque!ReqZeroTorque!ReqZeroTorque!ReqZeroTorque!ReqZeroTorque!ReqZeroTorque!ReqZeroTorque!ReqZeroTorque!ReqZeroTorque!ReqZeroTorque!GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0FromGear>0FromGear>0FromGear>0FromGear>0FromGear>0FromGear>0FromGear>0FromGear>0FromGear>0FromGear>0FromGear>0FromGear>0FromGear>0FromGear>0FromGear>0FromGear>0FromGear>0

ToGear<=0ToGear<=0ToGear<=0ToGear<=0ToGear<=0ToGear<=0ToGear<=0ToGear<=0ToGear<=0ToGear<=0ToGear<=0ToGear<=0ToGear<=0ToGear<=0ToGear<=0ToGear<=0ToGear<=0




TorqueZero?TorqueZero?TorqueZero?TorqueZero?TorqueZero?TorqueZero?TorqueZero?TorqueZero?TorqueZero?TorqueZero?TorqueZero?TorqueZero?TorqueZero?TorqueZero?TorqueZero?TorqueZero?TorqueZero?GCTimer<250GCTimer<250GCTimer<250GCTimer<250GCTimer<250GCTimer<250GCTimer<250GCTimer<250GCTimer<250GCTimer<250GCTimer<250GCTimer<250GCTimer<250GCTimer<250GCTimer<250GCTimer<250GCTimer<250


ReqTorque!ReqTorque!ReqTorque!ReqTorque!ReqTorque!ReqTorque!ReqTorque!ReqTorque!ReqTorque!ReqTorque!ReqTorque!ReqTorque!ReqTorque!ReqTorque!ReqTorque!ReqTorque!ReqTorque!


ReqSpeed!ReqSpeed!ReqSpeed!ReqSpeed!ReqSpeed!ReqSpeed!ReqSpeed!ReqSpeed!ReqSpeed!ReqSpeed!ReqSpeed!ReqSpeed!ReqSpeed!ReqSpeed!ReqSpeed!ReqSpeed!ReqSpeed!GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0GCTimer:=0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0ToGear>0

ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ReqTorque?ETimer<500ETimer<500ETimer<500ETimer<500ETimer<500ETimer<500ETimer<500ETimer<500ETimer<500ETimer<500ETimer<500ETimer<500ETimer<500ETimer<500ETimer<500ETimer<500ETimer<500




GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GearSet!GearSet!GearSet!GearSet!GearSet!GearSet!GearSet!GearSet!GearSet!GearSet!GearSet!GearSet!GearSet!GearSet!GearSet!GearSet!GearSet!

ReqSet?ReqSet?ReqSet?ReqSet?ReqSet?ReqSet?ReqSet?ReqSet?ReqSet?ReqSet?ReqSet?ReqSet?ReqSet?ReqSet?ReqSet?ReqSet?ReqSet?GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0

GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GBTimer>=100GearNeu!GearNeu!GearNeu!GearNeu!GearNeu!GearNeu!GearNeu!GearNeu!GearNeu!GearNeu!GearNeu!GearNeu!GearNeu!GearNeu!GearNeu!GearNeu!GearNeu!

ReqNeu?ReqNeu?ReqNeu?ReqNeu?ReqNeu?ReqNeu?ReqNeu?ReqNeu?ReqNeu?ReqNeu?ReqNeu?ReqNeu?ReqNeu?ReqNeu?ReqNeu?ReqNeu?ReqNeu?GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0GBTimer:=0

CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100ClutchIsClosed!ClutchIsClosed!ClutchIsClosed!ClutchIsClosed!ClutchIsClosed!ClutchIsClosed!ClutchIsClosed!ClutchIsClosed!ClutchIsClosed!ClutchIsClosed!ClutchIsClosed!ClutchIsClosed!ClutchIsClosed!ClutchIsClosed!ClutchIsClosed!ClutchIsClosed!ClutchIsClosed!

CloseClutch?CloseClutch?CloseClutch?CloseClutch?CloseClutch?CloseClutch?CloseClutch?CloseClutch?CloseClutch?CloseClutch?CloseClutch?CloseClutch?CloseClutch?CloseClutch?CloseClutch?CloseClutch?CloseClutch?CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0

CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100CTimer>=100ClutchIsOpen!ClutchIsOpen!ClutchIsOpen!ClutchIsOpen!ClutchIsOpen!ClutchIsOpen!ClutchIsOpen!ClutchIsOpen!ClutchIsOpen!ClutchIsOpen!ClutchIsOpen!ClutchIsOpen!ClutchIsOpen!ClutchIsOpen!ClutchIsOpen!ClutchIsOpen!ClutchIsOpen!

OpenClutch?OpenClutch?OpenClutch?OpenClutch?OpenClutch?OpenClutch?OpenClutch?OpenClutch?OpenClutch?OpenClutch?OpenClutch?OpenClutch?OpenClutch?OpenClutch?OpenClutch?OpenClutch?OpenClutch?CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0CTimer:=0




ReqZeroTorque?ReqZeroTorque?ReqZeroTorque?ReqZeroTorque?ReqZeroTorque?ReqZeroTorque?ReqZeroTorque?ReqZeroTorque?ReqZeroTorque?ReqZeroTorque?ReqZeroTorque?ReqZeroTorque?ReqZeroTorque?ReqZeroTorque?ReqZeroTorque?ReqZeroTorque?ReqZeroTorque?ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0UseCase:=0










NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!FromGear:=5FromGear:=5FromGear:=5FromGear:=5FromGear:=5FromGear:=5FromGear:=5FromGear:=5FromGear:=5FromGear:=5FromGear:=5FromGear:=5FromGear:=5FromGear:=5FromGear:=5FromGear:=5FromGear:=5ToGear:=4ToGear:=4ToGear:=4ToGear:=4ToGear:=4ToGear:=4ToGear:=4ToGear:=4ToGear:=4ToGear:=4ToGear:=4ToGear:=4ToGear:=4ToGear:=4ToGear:=4ToGear:=4ToGear:=4







NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?


NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?NewGear?ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!ReqNewGear!FromGear:=6FromGear:=6FromGear:=6FromGear:=6FromGear:=6FromGear:=6FromGear:=6FromGear:=6FromGear:=6FromGear:=6FromGear:=6FromGear:=6FromGear:=6FromGear:=6FromGear:=6FromGear:=6FromGear:=6ToGear:=0ToGear:=0ToGear:=0ToGear:=0ToGear:=0ToGear:=0ToGear:=0ToGear:=0ToGear:=0ToGear:=0ToGear:=0ToGear:=0ToGear:=0ToGear:=0ToGear:=0ToGear:=0ToGear:=0


NewGear!NewGear!NewGear!NewGear!NewGear!NewGear!NewGear!NewGear!NewGear!NewGear!NewGear!NewGear!NewGear!NewGear!NewGear!NewGear!NewGear!

TorqueZero!TorqueZero!TorqueZero!TorqueZero!TorqueZero!TorqueZero!TorqueZero!TorqueZero!TorqueZero!TorqueZero!TorqueZero!TorqueZero!TorqueZero!TorqueZero!TorqueZero!TorqueZero!TorqueZero!ETimer>=150ETimer>=150ETimer>=150ETimer>=150ETimer>=150ETimer>=150ETimer>=150ETimer>=150ETimer>=150ETimer>=150ETimer>=150ETimer>=150ETimer>=150ETimer>=150ETimer>=150ETimer>=150ETimer>=150

ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50ETimer>=50SpeedSet!SpeedSet!SpeedSet!SpeedSet!SpeedSet!SpeedSet!SpeedSet!SpeedSet!SpeedSet!SpeedSet!SpeedSet!SpeedSet!SpeedSet!SpeedSet!SpeedSet!SpeedSet!SpeedSet!ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0ETimer:=0





Fig. 7. The System Description (engine.atg).

21

industrial case study u pp aal e-mail · industrial case study using u pp aal? magn us lindahl 1 p...

Documents