DO-178C / ED-12C Model Based Supplement - MathWorks · Pierre Lionne, SC-205 / WG-71 SG-4 Co-Chairman 1 Nov. 2011 DO-178C / ED-12C Model Based Supplement

Pierre Lionne,

SC-205 / WG-71 SG-4 Co-Chairman

1 Nov. 2011

DO-178C / ED-12C

Model Based Supplement

© 2010 APSYS - All rights reserved

Summary

• Introduction

• Foundations Concepts

• Highlights

• Conclusion


Introduction


Introduction

DO-178B

ED-94B

Issues

DO-178C

ED-94C

Supplement X

Supplement Y

TOR


Introduction

SC 205WG 71

Document Integration

Issues & Rationale

Tools

Model Based Development & Verification

Object Oriented

Formal Methods

CNS/ATM & Safety

SG 1

SG 2

SG 3

SG 4

SG 5

SG 6

SG 7


Foundation Concepts


Foundation Concepts

• Models to express requirements

• Scope of supplement

• Modeling Technique

• Model “Parent” Requirements

• Simulation


Concept #1

• Model is an acceptable means to express

completely software requirements or

architecture

WHC_DFS_38/39

Status

1

reset counter

if { }Conf Status

Counter

raise confirmation flag

else { }

Conf Status

increment counter

elseif { }

counter_N_1

Counter

Conf StatusUnit Delay

1/z

Relational

Operator

>

Merge Status

Merge

Merge Counter

MergeIf

u1

u2

if(u1 == 0)

elseif(u2 == 1)

else

Goto

[counter]

From

[counter]

nb_ticks

2

enable

1

action

uint16

boolean

uint16

uint16

boolean

uint16

boolean

boolean

boolean

booleanaction

uint16

uint16action

Req_001: The XX module shall

Wait 10ms before entering

in blabl state

Req_002: The XX module ….

Derived Req_003: …


WHC_DFS_38/39

Status

1

reset counter

if { }Conf Status

Counter


else { }

Conf Status

increment counter

elseif { }

counter_N_1

Counter


1/z

Relational

Operator

>

Merge Status

Merge

Merge Counter

MergeIf

u1

u2

if(u1 == 0)

elseif(u2 == 1)

else

Goto

[counter]

From

[counter]

nb_ticks

2

enable

1

action

uint16

boolean

uint16

uint16

boolean

uint16

boolean

boolean

boolean

booleanaction

uint16

uint16action

Concept #2

• The supplement applies to any model that is

used to define software artifacts whatever

the process that produced it

WHC_DFS_38/39

Status

1

reset counter

if { }Conf Status

Counter


else { }

Conf Status

increment counter

elseif { }

counter_N_1

Counter


1/z

Relational

Operator

>

Merge Status

Merge

Merge Counter

MergeIf

u1

u2

if(u1 == 0)

elseif(u2 == 1)

else

Goto

[counter]

From

[counter]

nb_ticks

2

enable

1

action

uint16

boolean

uint16

uint16

boolean

uint16

boolean

boolean

boolean

booleanaction

uint16

uint16action


Concept #3

• Modeling Technique =– A Modeling Language

AND– A manner of using this language

• Modeling Technique has to be suitable to the type and tothe level of abstraction of the information to be expressed

• Modeling Technique have to be described in ModelStandards


Concept #4

• Model should be developed from a complete

set of requirements and constraints external

to it

Model Parent

Requirements


Concept #5

• Simulation: appropriate means to support

model verification

Model Parent

Requirements


Concept #6

• Simulation may be used to support the

testing effort

WHC_DFS_38/39

Status

1

reset counter

if { }Conf Status

Counter


else { }

Conf Status

increment counter

elseif { }

counter_N_1

Counter


1/z

Relational

Operator

>

Merge Status

Merge

Merge Counter

MergeIf

u1

u2

if(u1 == 0)

elseif(u2 == 1)

else

Goto

[counter]

From

[counter]

nb_ticks

2

enable

1

action

uint16

boolean

uint16

uint16

boolean

uint16

boolean

boolean

boolean

booleanaction

uint16

uint16action

Model Parent

Requirements

Executable Object Code


Highlights


Highlights

• System / Software

• Planning Process

• Development Process

• Verification Process

• Tools


System / Software

• Interfaces between System and Software

processes updated to address the case

where system team produces a software

model


Planning Process

• Introduction of Model Standards

– Syntax & Semantic of the language

– Constraint on complexity

– Means to identify Requirements

– Derived requirements identification

– Means to establish traceability

– …


Development Process

• Same guidance apply for requirements

expressed in a model

• Model elements which do not represent

requirements should be identified


Verification Process

Guidance from DO-178C / ED-12C

Core Document remains applicable



Simulation & model verification:

• New means => New artifacts:– Simulation Cases & Procedures

– Simulation Results

• Simulation Cases based on

Model Parent Requirements



WHC_DFS_38/39

Status

1

reset counter

if { }Conf Status

Counter


else { }

Conf Status

increment counter

elseif { }

counter_N_1

Counter


1/z

Relational

Operator

>

Merge Status

Merge

Merge Counter

MergeIf

u1

u2

if(u1 == 0)

elseif(u2 == 1)

else

Goto

[counter]

From

[counter]

nb_ticks

2

enable

1

action

uint16

boolean

uint16

uint16

boolean

uint16

boolean

boolean

boolean

booleanaction

uint16

uint16action

Model Parent

Requirements

Simulation Results

Simulation Procedures

Simulation Cases

Development

Verification



Test:

• Same guidance than in DO-178B / ED-12B:

– Compliance & Robustness with LLR

– Compliance & Robustness with HLR



High Level

Requirements

Low Level

Requirements


Test (classical)


WHC_DFS_38/39

Status

1

reset counter

if { }Conf Status

Counter


else { }

Conf Status

increment counter

elseif { }

counter_N_1

Counter


1/z

Relational

Operator

>

Merge Status

Merge

Merge Counter

MergeIf

u1

u2

if(u1 == 0)

elseif(u2 == 1)

else

Goto

[counter]

From

[counter]

nb_ticks

2

enable

1

action

uint16

boolean

uint16

uint16

boolean

uint16

boolean

boolean

boolean

booleanaction

uint16

uint16action


Test (example #1)

Low Level

Requirements


Model = HLR



High Level

Requirements


Test (example #2)

WHC_DFS_38/39

Status

1

reset counter

if { }Conf Status

Counter


else { }

Conf Status

increment counter

elseif { }

counter_N_1

Counter


1/z

Relational

Operator

>

Merge Status

Merge

Merge Counter

MergeIf

u1

u2

if(u1 == 0)

elseif(u2 == 1)

else

Goto

[counter]

From

[counter]

nb_ticks

2

enable

1

action

uint16

boolean

uint16

uint16

boolean

uint16

boolean

boolean

boolean

booleanaction

uint16

uint16action

Model = LLR




Test (example #3)

WHC_DFS_38/39

Status

1

reset counter

if { }Conf Status

Counter


else { }

Conf Status

increment counter

elseif { }

counter_N_1

Counter


1/z

Relational

Operator

>

Merge Status

Merge

Merge Counter

MergeIf

u1

u2

if(u1 == 0)

elseif(u2 == 1)

else

Goto

[counter]

From

[counter]

nb_ticks

2

enable

1

action

uint16

boolean

uint16

uint16

boolean

uint16

boolean

boolean

boolean

booleanaction

uint16

uint16action

Model = HLR + LLR



WHC_DFS_38/39

Status

1

reset counter

if { }Conf Status

Counter


else { }

Conf Status

increment counter

elseif { }

counter_N_1

Counter


1/z

Relational

Operator

>

Merge Status

Merge

Merge Counter

MergeIf

u1

u2

if(u1 == 0)

elseif(u2 == 1)

else

Goto

[counter]

From

[counter]

nb_ticks

2

enable

1

action

uint16

boolean

uint16

uint16

boolean

uint16

boolean

boolean

boolean

booleanaction

uint16

uint16action

Model Parent

Requirements


Test (example 3)

Model = HLR + LLR



Test (example 3)

When model express both LLR and HLR, it is

required to show:

– Compliance & Robustness of EOC with Model

– Compliance & Robustness of EOC with Model Parent Requirements

(whatever the process that produced it)



Model Coverage Analysis: Detect unintended

functions in a model

Model Parents

Requirements

Unintended function

WHC_DFS_38/39

Status

1

reset counter

if { }Conf Status

Counter


else { }

Conf Status

increment counter

elseif { }

counter_N_1

Counter


1/z

Relational

Operator

>

Merge Status

Merge

Merge Counter

MergeIf

u1

u2

if(u1 == 0)

elseif(u2 == 1)

else

Goto

[counter]

From

[counter]

nb_ticks

2

enable

1

action

uint16

boolean

uint16

uint16

boolean

uint16

boolean

boolean

boolean

booleanaction

uint16

uint16action

Executable



Simulation & Test:

• Some testing objectives can be achieved

by a combination of simulation and other

traditional means.

• HW/SW Integration test objectives cannot

be achieved by simulation.


Tools

Model Parent

Requirements

Source Code

Executable Object

Code

Model

Standards

WHC_DFS_38/39

Status

1

reset counter

if { }Conf Status

Counter


else { }

Conf Status

increment counter

elseif { }

counter_N_1

Counter


1/z

Relational

Operator

>

Merge Status

Merge

Merge Counter

MergeIf

u1

u2

if(u1 == 0)

elseif(u2 == 1)

else

Goto

[counter]

From

[counter]

nb_ticks

2

enable

1

action

uint16

boolean

uint16

uint16

boolean

uint16

boolean

boolean

boolean

booleanaction

uint16

uint16action

Code Verification & Validation

Code Coverage

Code Verification & Validation

Code Coverage

Code ConformanceCode Inspector

Test Model Coverage

Trace Tool

Trace Tool

Model Conformance


Conclusion


Highlights

Model Parent

Requirements

Source Code

Executable Object

Code

Model

Standards

Concept #3 WHC_DFS_38/39

Status

1

reset counter

if { }Conf Status

Counter


else { }

Conf Status

increment counter

elseif { }

counter_N_1

Counter


1/z

Relational

Operator

>

Merge Status

Merge

Merge Counter

MergeIf

u1

u2

if(u1 == 0)

elseif(u2 == 1)

else

Goto

[counter]

From

[counter]

nb_ticks

2

enable

1

action

uint16

boolean

uint16

uint16

boolean

uint16

boolean

boolean

boolean

booleanaction

uint16

uint16action

Concept #1 #2

Concept #4

Concept #5

Concept #6


Conclusion

• In the continuity of existing rules

• Consistent with current practices

• Try to anticipate future trends


The reproduction, distribution and utilization of this document as well as

the communication of its contents to others without express authorization

is prohibited. Offenders will be held liable for the payment of damages.

All rights reserved in the event of the grant of a patent, utility model or design.

Thank you for your attention!

35

Title

Date

DO-178C / ED-12C Model Based Supplement - MathWorks · Pierre Lionne, SC-205 / WG-71 SG-4 Co-Chairman 1 Nov. 2011 DO-178C / ED-12C Model Based Supplement

Documents