Traceability Matrix

The supplier shall provide documentation describing their strategies and methods for working with embedded systems cybersecurity.

The supplier shall perform risk assessment based on a threat and vulnerability analysis for each release, including any vehicle manufacturer-specific adaptations.

Method and scope shall be proposed to and approved by the vehicle manufacturer.

Documentation on the method and results shall be provided to the vehicle manufacturer.

Note: The vehicle manufacturer and supplier shall collaboratively define the context of the system or function to enable the supplier performing the risk assessment.

The supplier shall describe the cybersecurity concept and how it is implemented in hardware and software respectively.

All risks identified in cybersecurity risk analyses shall be evaluated.

For each risk identified in the cybersecurity risk analyses, a risk treatment decision shall be made to avoid, reduce, share, or retain the risk.

Cybersecurity controls shall sufficiently reduce the risk.

It shall be possible to verify which cybersecurity controls were derived from which requirements.

The cybersecurity concept of the supplier shall contain a documentation of the accepted residual risk and be agreed with the vehicle manufacturer.

The supplier shall provide documentation of the verification and validation methods of cybersecurity features.

The supplier shall provide test reports detailing the results from the verification and validation of cybersecurity features.

An inventory of software and protocols, including their versions, shall be provided by the supplier.

A BOM containing part numbers and versions of hardware components used in the product shall be provided by the supplier.

The vehicle manufacturer and the supplier shall set up a cybersecurity DIA to agree on the responsibilities for the distributed cybersecurity activities.

The ECU shall be able to verify integrity and authenticity of a vehicle manufacturer-specified set of data stored within the ECU.

Methods shall be proposed to and approved by the vehicle manufacturer.

The supplier shall apply methods for isolation of software/hardware components and data to reduce the effect in case of a cybersecurity breach.

Selection of cryptographic methods and their use shall be agreed upon between the vehicle manufacturer and the supplier.

The ECU shall only expose network and communication services that have been agreed upon with the vehicle manufacturer.

Communication interfaces shall use boundary controls such as ingress/egress filtering.

Communication boundary controls shall be configurable by the vehicle manufacturer.

Methods shall be proposed and approved by the vehicle manufacturer.

The details shall be agreed upon between the vehicle manufacturer and the supplier.

Only hardware interfaces and protocols specified by the vehicle manufacturer shall be available in series production.

It shall be possible for the vehicle manufacturer to securely inject data into the product in accordance with the specification provided by the vehicle manufacturer.

Data specified by the vehicle manufacturer shall be protected from manipulations.

Data specified by the vehicle manufacturer shall be protected from disclosure.

Intellectual property of the vehicle manufacturer shall be protected from disclosure.

It shall be possible for the vehicle manufacturer to securely inject key material and other data used for cybersecurity controls into the ECU according to the specification of the vehicle manufacturer.

Secrets, public keys and other data used for cybersecurity controls in production vehicle systems shall be different from those used in pre-production phases.

ECUs shall only contain the secrets agreed between the vehicle manufacturer and the supplier.

ECUs shall conform to the harmonized Security Access specification [1] provided by the vehicle manufacturer.

It shall be possible to update the software of the ECU.

The supplier shall inform the vehicle manufacturer if any cybersecurity patches are available.

An incident response process shall be proposed to and approved by the vehicle manufacturer.

The incident response process shall ensure that risk is managed in coordination with the vehicle manufacturer.

Any vulnerabilities that are identified during product lifecycle shall be promptly communicated to the vehicle manufacturer.

The report shall include information needed to identify the affected vehicles/products.

Methods including the stipulation of a reasonable notification time shall be proposed to and approved by the vehicle manufacturer.

Following each identified and reported vulnerability, the supplier and vehicle manufacturer shall agree on an initial response to the vulnerability.

Within adequate time after the initial vulnerability report, the supplier shall provide more information about the identified vulnerability.

The information shall contain • the version(s) of affected hardware or software components, • nature of the vulnerability, • description of the affected cybersecurity goal, • technical conditions to exploit the vulnerability, • impact of the exploitation and • possibilities to remove the vulnerability.

Methods including the stipulation of a reasonable reporting time shall be proposed to and approved by the vehicle manufacturer.

The supplier shall have a method for monitoring available vulnerability databases for vulnerabilities that can affect the delivered product.

Identified vulnerabilities shall be considered in all current development projects or projects under field monitoring.

An ECU returned from field shall allow for field-return analysis.

Field-return analysis secrets shall not be operational in the field.

All secrets specified by the vehicle manufacturer shall be protected throughout the lifecycle of the ECU.

End-of-life and decommissioning shall be specifically considered.

Notes: a) It shall not be possible for a third party to reuse an ECU without system support from the vehicle manufacturer.

b) Decommissioning of an ECU shall not have the potential of causing unacceptable risk to the road user or the vehicle manufacturer.

The gearbox itself shall be used in all drivetrains and the ECA shall be common and must be complaint to be put on any driveline setup.

The clutch actuator shall be electrically driven

The ECA (Electric Clutch Actuator) must have its own internal ECU for manoeuvring and error handling.

The ECA units shall be manufactured with marking variants according to the requirements in Scania STD19 (Ref 14.17). The variant type shall be based on delivery agreement and Brand involved. Variant 1: For Scania units, wordmark variant C1 Part number (7 digits). Variant 2: For MAN units, wordmark variant Z1. Part number (13 digits). Variant 3: For International units, wordmark variant X1. Part number (8 digits) Variant 4 Tentik wordmark variant W. Part number (9 digits, two spaces in format: 12 345 6789). Common marking requirements that must be fulfilled for each marking variant are: Marking method: MA1 Marking height: 3 mm Date format: YYMMDD A unique serial number A DMC according to Scania STD 4562 (Ref 14.18) that contains the part number and serial number information. The marking shall not be visible when the ECA is mounted on a gearbox. The ECA units shall be delivered to the required Traton brand’s production in a position in the pallet where the marking is visible.

The variant type shall be based on delivery agreement and Brand involved.

Common marking requirements that must be fulfilled for each marking variant are: Marking method: MA1 Marking height: 3 mm Date format: YYMMDD A unique serial number A DMC according to Scania STD 4562 (Ref 14.18) that contains the part number and serial number information.

The marking shall not be visible when the ECA is mounted on a gearbox.

The ECA units shall be delivered to the required Traton brand’s production in a position in the pallet where the marking is visible.

The rubber cover (See req. 4.16) shall be marked according to the requirements in Scania STD19 (Ref 14.17) Tentik, wordmark variant W Part number (9 digits, two spaces in format 12 345 6789) Marking method: CAS Marking height: 2-6 mm. Date dial: CVM. Alternative design: CXM or equivalent combination of date dial and date field The rubber cover marking shall not be visible when the ECA is mounted on a gearbox

The ECA shall be designed with Remanufacturing and/or Refurbishment in mind with possibility of swapping out larger electronic assemblies/components. Details to be agreed with Traton

The mechanics shall also be tested and verified, in an overall durability test as stated in Appendix B etc.

4.16) shall be marked according to the requirements in Scania STD19 (Ref 14.17) Tentik, wordmark variant W Part number (9 digits, two spaces in format 12 345 6789) Marking method: CAS Marking height: 2-6 mm.

Details to be agreed with Traton 2.9 Traton shall be invited to participate in electrical and mechanical design reviews.

2.10 Traton requires extensive testing to be performed by the supplier to verify all demands stated in the requirement specification.

2.12 Traton requires: - Documentation of the product, i.e.

The total stroke of the actuator shall be 85 mm

The clutch actuator shall be able to reach the extreme positions A and B in with the center of the pushrod end. Dimensions measured on the ECA. See Figure 3 - Pushrod positions. Figure 3 - Pushrod positions

When the ECA is assembled, it shall not be possible to insert an object larger than Ø0,2 mm (A wire could be used as test object) between the ECA and gearbox flange, so that the object enters the space behind the ECA. The rubber grommet at the lower part of the flange can have the same interface as the surrounding aluminum flange.

When the ECA is assembled, a gap of 3,5 mm towards surface B with a profile tolerance of ±1 mm to the nominal dimensions shall be provided. The surface roughness of the ECA opposite to surface B shall be equal or finer than Ra 3,2 µm.

The ECA shall be adapted for 6 pcs M8 flange screws described by Scania STD4435

P 1 Page 4.4 ECA shall not interfere with any geometry in the 3D envelope -1 1_RFQ2030.stp except where interference fits or other types of functional contacts are required.

The surface roughness of the ECA opposite to surface B shall be equal or finer than Ra 3,2 µm.

The ECA shall be adapted for 2 pcs 10 mm guide pins Figure 5 - Gearbox flange

The guide pin holes in the ECA shall be Ø 10,1±0.05 mm and at least 12 mm deep. The holes shall also block the guide pin from protruding more than 14 mm from the gearbox housing. Both depths measured from the center of the oval hole in the Gearbox/ECA flange.

The ECA shall be able to be held by the guide pins only while being exposed to the max clutch load, (req. 4.22) up to 50 times. The clutch load will be removed and the screw interface tightened between every load occasion. Surface indents in the contacts are allowed as long as the structural integrity is unaffected

The pushrod end that makes contact with the clutch lever shall be a Ø15,93±0,07 mm steel sphere.

It shall be possible to pull the pushrod 50 times with a force of 300 N without risk for it to come loose from the ECA. Alternatively it can have a loose fit in the ECA, but it shall be possible to reconnect it by pushing it back by hand.

The ECA shall allow space for external tools according to the cylinders in the 3D envelope attached.

The ECA shall provide a support for a clutch snap in tool on the marked surface in Figure 4 ISO view of 3D envelope. The maximum force is 1kN. Surface indents are allowed as long as it does not affect other requirements or the structural integrity of the ECA.

The holes shall also block the guide pin from protruding more than 14 mm from the gearbox housing.

Alternatively it can have a loose fit in the ECA, but it shall be possible to reconnect it by pushing it back by hand.

The hole shall be equipped with a cover possible to assemble and disassemble at least 50 times without tools. If an interference fit is chosen, the maximum force to assemble/disassemble shall be 50 N in room temperature. It shall still remain intac t and keep tightness after vibration testing (See req.10.5)

When the cover is assembled it shall not be possible to insert an object larger than Ø0,2 mm into the gearbox housing between the cover and ECA. A wire could be used as test object. Figure 6 - Snap in tool space

If the ECA is powered up with the PP in the utmost forward position (for example when not connected to the clutch lever) it shall move AP to its utmost reversed position.

If an interference fit is chosen, the maximum force to assemble/disassemble shall be 50 N in room temperature.

Details regarding actual length and positioning tolerances shall be agreed in design phase.

The actuator shall apply a preload force for the release bearing. The preload force measured on the push rod shall be 150N to 250N independent of the clutch position

It must be possible to assemble the actuator independent of the lever position without any power connection. This means that the push rod shall be possible to move by hand. Maximum force allowed is 300N.

This means that the push rod shall be possible to move by hand.

4.26 When the clutch is fully engaged, the active control mode is position or torque control mode and there is no active request to extract the pushrod (clutch opening motion), the ECA shall not apply a force outside of limits in preload force defined in req.

P 1 Page 5 Clutch engage and disengage 5.1 It shall be possible to disengage the clutch in 180ms (= Ts) with accuracy according to ,and max speed set to 125mm/s (see

This shall be measured against the maximum disengage force (See Appendix A) Figure 7 – Maximum disengage time

P 1 Page 5.2 It shall be possible to engage the clutch in 180ms (=Ts) with accuracy according to re q.5.10, and the max speed set to 125mm/s (see ).

This shall be measured against the minimum engage force (See Appendix A) Figure 8 - Maximum engage time

The clutch actuator shall report the absolute position of the current actuator stroke (AP) (Ref 14.14).

It shall also report the position that corresponds to a fully closed clutch position (FCCP), expressed in absolute position of the actuator stroke and relative to the absolute zero position (See req. 6.5).

The clutch actuator shall be equipped with a displacement sensor measuring the movement of the push rod, (Ref 14.14)

The actuator must be able to determine the pushrod position according to the following Accuracy (maximum difference between measured pushrod position and actual pushrod position): +/- 1.6mm. Resolution (smallest discernible unit of change along the X axis): 0.0125mm. Repeatability (maximum variation between measurements at the same position and in the same unit, with equal environmental conditions): +/- 0.1mm. Range: 85mm (AP)

The maximum stationary position error relative to real FCCP (i e self-adjustment error + step response error) shall be ±0.15mm.

This means that is shall be possible to request a relative stroke from the fully closed clutch position and achieve the step accuracy as defined in req.

The FCCP after a clutch engage shall be updated to 90% of the step within 0,2 s per mm that the FCCP have changed during the stroke.

P 1 Page 5.10 The actuator shall move the pushrod according to the following points: Actuator maximum speed: The maximum achievable speed of the pushrod shall be at least 125 mm/s.

The actuator shall move the pushrod at the highest possible speed, limited only by its maximum achievable speed and the maximum speed request.

6.4) Dynamics start of movement: The requested speed (or 125mm/s, if requested speed > 125mm/s) shall be achieved within 50ms from when a new value for requested position is sent.

Dynamics end of movement: The requested speed shall be kept until 2 mm from the target position.

100ms after reaching 2 mm from target, the maximum position error should be ±0.1mm.

Maximum overshoot is 0.2 mm When a new position is requested, but the stroke is too short to reach requested speed, the ECA shall complete the stroke in minimum time with dynamic in compliance with the , 5.2 and this section.

Req. 5.10 shall be tested with a step response test cycle, according to description and Figure 10 - Step response test cycle. Step from FCCP to 0.5x fully open position Wait 2 seconds Step to fully open position Wait 2 seconds Step to 0.5x fully open position Wait 2 seconds Step to FCCP Figure 10 - Step response test cycle

5.10 shall be tested with a step response test cycle, according to description and Figure 10 - Step response test cycle.

P 1 Page 5.12 The ECA shall be able to run the 4 second test cycle in Figure 11 - Release frequency test continuously for 5 hours without any degradation or failure.

The test shall be done with the highest operating temperature (see ) and maximum clutch force (See Appendix A) Figure 11 - Release frequency test

It shall be possible to keep the clutch disengaged continuously without risk of loss of function for 120 min. This shall be measured against the maximum disengage force (Appendix A) and an highest operating temperature (see req. 8.1).

Between 16V and loss of power the ECA shall hold its current position or move towards requested position without any time requirement.

The strategy shall be disc ussed and approved with Traton.

This shall be measured against the maximum disengage force (Appendix A) and an highest operating temperature (see req.

The ECA will be controlled by messages on the CAN bus and by the PWM signal specified in req. 7.24-7.33. The CAN communication messages are specified in PD2497100 (Ref 14.14). It shall be followed to its full extent. If needed, some messages might be complemented with additional checksums and message counters

P 1 Page 6 SW functionality 6.1 TB4684 shall be applied.

It shall be followed to its full extent.

Control (RPC) the actuator shall move to an offset that corresponds to the Requested Position from the Fully Closed Clutch Position (FCCP). The RP can be up to a full Release Travel (22,4 mm) in this mode. How the FCCP can be identified is described in 6.5. When RP = 0 the actuator is allowed to have a position that is less than the FCCP but not more, since this would open the clutch. Control mode Relative position 0x02

When requesting Absolute Position Control the actuator shall move to the actuator position defined by the Requested Position (RP).

Specific cases shall be approved with Traton.

Control mode Relative position 0x02 6.3.3 When requesting Torque Control (TC) the actuator shall actuate the requested motor torque.

A maximum allowed speed of the actuator is sent as a separate signal on CAN. If the actuator can move faster than this value it shall be controlled in a such way that it does not exceed this limit.

The value shall be frozen at the last identified position and used for RPC. Self-adjustment disabled 0x3

6.3.4 When requesting Test Mode, the actuator shall perform tests to detect latent faults.

ECA behavior and additional requirements for this mode can be found in (Ref 14.16) Control mode Test mode 0x04 6.3.5 When this Control Mode is sent the actuator shall behave as if the power supply was cut with aspect to control of the actuator.

CAN communication shall still be active.

If the actuator can move faster than this value it shall be controlled in a such way that it does not exceed this limit.

6.5 Self-adjustment The self-adjustment signal defines the restrictions of how the FCCP shall be identified.

The value of the FCCP shall be reported via CAN(Ref 14.14) Req.

The value shall be frozen at the last identified position and used for RPC.

The ECA shall report a unique ECA individual identification number

The ECA shall report supplier code 5 via CAN.

The ECA shall report a complete SW version number. The number is decided by the supplier and can be in the range 0-64255.

The ECA shall report a complete HW version number. The number is decided by the supplier and can be in the range 0-64255.

The ECA shall report its current System State. Valid states are explained in requirements 6.14.1 - 6.14.9.

6.6.1 When low accuracy mode is requested, the maximum push rod position(PP) error can be ±0.5mm Accuracy mode Low accuracy 0x0 6.6.2 Accuracy according to 5.10 shall be fulfilled.

6.13 Error State Diagnostic - ESD and Error State Action - ESA The ECA shall send a bit field via CAN containing errors present Additionally, see ,

ESA definition( Ref 14.16) The supplier shall provide documentation for the ESD bits and related faults .

This value shall be sent when the ECA is actuating Absolute Position Control. 0x1

This value shall be sent when the ECA is actuating Relative Position Control. 0x2

This value shall be sent when the ECA is actuating Torque Control. The torque being controlled is the torque of the motor. 0x4

This value shall be sent when the ECA is performing a Self-Adjustment procedure that is not part of a RPC or TC request (i.e. passing FCCP). 0x5

This value shall be sent when the ECA is performing its initiation routine and is not yet available for control. 0xA

This value shall be sent when the actuator is in debug or test control state. 0xC

This value shall be sent when the actuator is performing a motor brake simulation. 0xD

6.14.1 Boot Mode If the actuator is in boot mode, 0x00 shall be reported as active state.

0xA 6.14.7 Shut down This value shall be sent when the ECA is performing its shut down routing and is not available for control.

The ECA shall report the current system temperature.(Ref 14.14)

The ECA shall calculate and report the actuator motor torque. (Ref 14.14)

The ECA shall report the current for each phase of the actuator. These values shall be calculated using a moving mean filter. The filter time shall equal the update frequency . (Ref 14.14)

The ECA shall report the current system voltage. (input voltage) (Ref 14.14)

The ECA shall store and report its accumulated operational hours.

The ECA shall report its accumulated lifetime travel length.

CVS120 shall be applied (Ref 14.12).

Cybersecurity shall be considered through a separate process with the latest Traton workflow in mind. The following apply: Mandatory: TRATON secure updates - CVS31,CVS32,CVS123-2,CVS154 TRATON secure diagnostics - CVS31,CVS32,CVS151 TRATON Specification on Unified diagnostic Services CVS124 Other applicable documents considered as supporting specifications: CVS30, CVS33, CVS34,CVS121,CVS122,SecureBoot,Vehicle Baseline Requirements, ECU Baseline Requirements Additional standards/documents will be made available, if applicable.

These values shall be calculated using a moving mean filter.

The filter time shall equal the update frequency .

The reported ESD must be able to be validated and invalidated.

The gearbox control unit(TCU) shall be responsible for setting DTCs based on received notifications from ECA via ESD, including time-stamps, occurrence counters etc. One unique DTC will be set per bit in the ESD signal. If higher resolution is required for the supplier to properly troubleshoot any individual occurrence, then the ECA is responsible for storing these parameters internally. Internally stored parameters may be accessible only using supplier defined tools .

Any data logged or stored shall be agreed upon together with Traton.

When storing data in the device, the supplier shall take measures to prevent corruption of data which can occur for example when suffering power loss during read or write cycles. The supplier shall also ensure that systems are in place that ensure that data corruption is handled without loss of data, or loss of function. This could be designed with for example data mirroring. It is acceptable if purely statistical data (e.g. operation hours) from the active operation cycle is not stored in case of an abnormal shutdown.

There shall only be one calibration set of the ECA that is delivered to Traton, i.e, the calibration shall not be dependent of installation variants.

It shall be possible to reset the ECA application with a power off/on cycle after all functional safety events. Handling to be agreed with Traton.

If higher resolution is required for the supplier to properly troubleshoot any individual occurrence, then the ECA is responsible for storing these parameters internally.

The supplier shall also ensure that systems are in place that ensure that data corruption is handled without loss of data, or loss of function.

The electrical design must ensure that an internal short circuit through one of H -bridges (“shoot through”) is avoided.

A safe boot sequence must be set to prevent unwanted or undefined behavior during or after loss of power, or corruption of stored data.

A safe memory read/write sequence must also be implemented during actuator movement, in order to ensure safe and predictable behavior during operation, or in case of power lo ss. Relates to Safety Goals set in PD3339794 (Ref 14.16).

All external electrical connectors shall be geometrically coded. If internal components are included in repair kits, the internal electrical connectors shall also be geometrically coded.

7.2 Short circuit protection shall be implemented by hardware.

If internal components are included in repair kits, the internal electrical connectors shall also be geometrically coded.

7.8 ECU tab headers shall comply with TB1787.(Ref 14.6) 7.9 ECU tab headers shall be made of self-extinguishing materials (i.e.

The ECA can be connected to the battery+ (30) permanently through the system fuse or through a master switch that physically cuts off power. All power used by the ECA shall be taken from this battery connection.

The ECA is connected directly to the battery GND (31). This ground connection will act as system ground and reference for the entire ECA. The ground shall not be DC connected to the ECA housing. Requirements Power cable dimension: Operating parameters Remark Min Typ. Max. Unit

All power used by the ECA shall be taken from this battery connection.

The ground shall not be DC connected to the ECA housing.

7.23 Quiescent current: According to CVS41 (Ref 14.2), must be met independent of input and output conditions.

It shall be used to control the power up sequence to the µP.

The Wake-up signal shall also be connected to a digital input on the µP.

Special precautions shall be taken to prevent direct connection between Wake-up and 30 in case of a single failure.

After the wake-up line goes to high state: The ECA shall communicate on the CAN line within 250ms in case of a normal start -up The ECA shall be ready to open the clutch within 350ms in case of a normal start -up The ECA shall be ready to open the clutch as soon as possible after necessary movements in case of an abnormal start-up.

After movement and reset, the ECA shall communicate on the CAN line within 250ms After movement and reset, the ECA shall be ready to open the clutch within 400ms In the case if the wake-up goes "high" at the same time as U30 signal the ECA should be ready to open the clutch within 3 seconds.

Definition ready to open clutch: The actuator position shall be between FCCP and FCCP -3mm and the ECA is capable to move to disengaged clutch directly when requeste d.

Redundancies due improper shutdown shall be aligned with Traton.

If a signal for disengaging the clutch is received the ECA shall actuate the request regardless of CAN-request.

The ECA has one CAN bus. Any watchdog circuit shall have no influence on the CAN bus The CAN front end shall be designed to comply with TB1905 (Ref 14.3), with the following additional information in this chapter.

The controller and transceiver shall be CAN FD ready Parameter Limit values Unit Remarks Min. Typ. Max.

Any watchdog circuit shall have no influence on the CAN bus.

The CAN front end shall be designed to comply with TB1905 (Ref 14.3), with the following additional information in this chapter.

7.36 Termination resistance: - 2 x 60 - Ω 1% resistors shall be used 7.37 Baud rate: 250 500 1000 kbit/s Flashing in production shall be possible with 1000kbit/s.

The layout shall always be present on the PCB and the supplier must be flexible in changing/removing the CAN related components in this section.

CAN shield. Footprint prepared for internal connection to system ground 31_ECA via a resistor and a capacitor in series. The components shall not be populated by default. The CAN front end shall be designed to comply with TB1905. (Ref 14.3)

The components shall not be populated by default.

The CAN front end shall be designed to comply with TB1905.

The air inside the electronics enclosure shall be ventilated with the use of a membrane. The following requirements shall be fulfilled: The unit shall withstand the salt-spray environment, according to CVS40 §6.1.6, without clogging of the membrane. The membrane shall be placed so that it is protected against blunt force, falling dust and dripping salt-water. The design shall be made to prevent accumulation of water on top of the membrane, or in the cavity of the membrane.

The quality of the wire bonding and position shall be properly analyzed.

The material shall be lead free and of ”high temperatures solder type”.

The melting point of the soldering material and the composition of the soldering material shall be declared by supplier.

The PCB must be supported and must not bent in any direction during the process.

Conformal coating or lacquer shall cover the entire PCB and all solder joints.

The layout of the PCB, including component placement, shall take the applying of conformal coating into consideration so that the aforementioned requirement can be met.

shall be specified in the initial offer.

The conformal coating process and materials shall apply to the latest versions of IPC/EIA J-STD-001 (with applicable standards as e.g.

HDBK-001, IPC-CC-830 and HDBK-830) and the visual appearance of the final coating shall be consistent with the latest version of IPC-A-610.

Water based and silicone lacquers shall not be used.

The following requirements shall be fulfilled: The unit shall withstand the salt-spray environment, according to CVS40 §6.1.6, without clogging of the membrane.

The membrane shall be placed so that it is protected against blunt force, falling dust and dripping salt-water.

The design shall be made to prevent accumulation of water on top of the membrane, or in the cavity of the membrane.

7.46 Forbidden components: BGA capsule in any form must not be used.

Tantalum capacitors must not be used Serial resistors on power supply circuits must not be used.

The clutch actuator shall withstand 6 500 000 actuations with the test cycle described in Appendix B.

The ECA must be maintenance free over the whole life time

In a situation where the ECA has jammed, and is holding the clutch open, it shall be possible to remove the clutch force by following an instruction documented on the ECA drawing. It is allowed to destroy the ECA in the process.

8.4 Six consecutive units shall run past 6.5M actuations at the supplier, and continue to end of life.

Three consecutive units shall run past 6.5M actuations at Scania, and continue to end of life.

8.6 Failure rate for ECU and electronics shall be less than: 0ppm @ “0” km 200ppm/year during year 1-5 400ppm/year during year 6-10 1000ppm/year during year 11-15 8.7 External vulnerable components might need to be replaceable.

Spare parts or repair kits shall be defined together in agreement.

4.17) shall be provided as a spare part.

The ECA shall fulfil the requirements stated in STD3868 STD3868 is a comprehensive document referring to several underlying standards. Out of a recycling and environmental perspective the following standards shall be taken under consideration in addition to CVS55(Ref 14.32): STD4158, Chemical substances which shall not be used – Scania Black list. STD4159, Chemical substances with limited use – Scania Grey list. CVS 83, Material declaration according to Scania IMDS reporting std. The different parts of the housing shall be marked according to material content. The ECA shall be lead free.

All included parts shall fulfil applicable sections of Part 9 in Annex B to the latest ADR ,as applicable at the time of type approval. For type approval, the vehicle and its components shall comply with ECE Regulation No. 105 and with European Directive 2008/68/EC, as amended.

Out of a recycling and environmental perspective the following standards shall be taken under consideration in addition to CVS55(Ref 14.32): STD4158, Chemical substances which shall not be used – Scania Black list.

The different parts of the housing shall be marked according to material content.

The ECA shall be lead free.

For type approval, the vehicle and its components shall comply with ECE Regulation No.

The ECA must fulfil the general requirements for Electronic Control Units (ECUs), which are stated in CVS40 (Ref 14.1) and CVS41 (Ref 14.2).

The ECA must not be dependent on software for protection against requirements stated in CVS40 (Ref 14.1) and CVS41 (Ref 14.2).

CAN communication shall not be affected.

Memory functions shall remain Class A.

Accepted behaviour in this case shall be agreed upon between Traton and Supplier.

For this unit, the following definitions of test procedure I and test procedure II shall be used Test procedure I A comprehensive test where all functional requirements are verified. This test shall be performed before and after exposure. Test procedure I (See Figure 17 - Test procedure I) shall at least contain: - Full stroke to evaluate speed - Staircase to evaluate accuracy - Power loss to evaluate safety Figure 17 - Test procedure I Test procedure II A reduced function test where the fundamental requirements are verified. This test shall be possible to perform during exposure. Reduced versions of test procedure II may be agreed and used during various tests. Alternative 1: Test cycle according to Appendix B, frequency 10 to 30 strokes per minute. Alternative 2: Release frequency test according to req. 5.12.

This test shall be performed before and after exposure.

Test procedure I (See Figure 17 - Test procedure I) shall at least contain: - Full stroke to evaluate speed - Staircase to evaluate accuracy - Power loss to evaluate safety Figure 17 - Test procedure I Test procedure II A reduced function test where the fundamental requirements are verified.

This test shall be possible to perform during exposure.

CVS40 §5.10 TC-10 Ingress protection The ECA shall also fulfil IP54 without mounted connectors. IP classes to test: IP6K6K, IP6K7, and IP6K9K Y

CVS40 §8.1 TS-01 Flammability In order to fulfil flammability demands, any plastic materials (i.e. tab headers) shall be made of self- extinguishing materials (i.e. UL94). Y

tab headers) shall be made of self- extinguishing materials (i.e.

P 1 Page 11 Functional safety The ECA is a part of a safety critical system and shall be handled as such.

The ECA shall therefore be developed and implemented in accordance with the objectives and requirements of ISO 26262 "Road vehicles - Functional Safety".

The supplier shall analyse risks of individua l HW and SW components, mechanics, and any other technologies, independently of the scope of ISO 26262.

For this purpose possible causes must be systematically identified.

For these analyses at least the methods in ISO 26262 shall be applied.

The supplier of the unit must write software to enable his own testing of the unit during development, production and on any claimed unit.

ID Verification methods 12.1 Conformance to Requirement Specification A1 The supplier must do conformance test of all external and internal I/O.

This test must verify that all internal and external I/O fulfils the requirements in this specification.

A2 The supplier must perform full DV (Design Verification at B-sample level) and full PV (Product Validation at C-sample level) environmental test programs according to CVS40 and CVS41 (incl.

the suppler must carry out two full test rounds according to the Traton test requirements.

Additional tests initiated and performed by the supplier must be discussed with Traton.

A3 The supplier must test the connectors according to TB1787.

A4 The supplier must do EMC tests with the unit alone.

The supplier must certify the ECA according to UN ECE R10 (EMC), according to the latest revision with all amendments.

A5 The supplier must check that both prototypes and serial units fulfil the dimension requirement according to any relevant Traton supplied drawings.

A6 All prototypes and serial ECA’s shall fulfil requirements according to TB1822, IPC/EIA J-STD-001 class 3 and IPC-A-610 class 3.

and 5.2.