DO-178C / ED-12C Model Based Supplement. Pierre Lionne, SC-205 / WG-71 SG-4 Co-Chairman 1 Nov. 2011

Transcription

1 DO-78C / ED-2C Model Based Supplement Pierre Lionne, SC-205 / WG-7 SG-4 Co-Chairman Nov. 20

2 Summary Introduction Foundations Concepts Highlights Conclusion

3 Introduction

4 Introduction Issues TOR DO-78C ED-94C ED-94B Supplement X Supplement Y DO-78B

5 Introduction CNS/ATM & Safety Document Integration SG SG 7 Formal Methods Issues & Rationale SG 2 SC 205 WG 7 SG 6 Tools SG 3 SG 4 SG 5 Object Oriented Model Based Development & Verification

6 Foundation Concepts

7 Foundation Concepts Models to express requirements Scope of supplement Modeling Technique Model Parent Requirements Simulation

8 Concept # Model is an acceptable means to express completely software requirements or architecture Req_00: The XX module shall Wait 0ms before entering in blabl state Req_002: The XX module. Derived Req_003: enable 2 > nb_ticks Relational Operator /z From Unit Delay u u2 if(u == 0) elseif(u2 == ) else If if { } reset counter elseif { } counter_n_ increment counter Goto Status Status else { } WHC_DFS_38/39 raise confirmation flag

9 Concept #2 The supplement applies to any model that is used to define software artifacts whatever the process that produced it u if(u == 0) enable 2 nb_ticks elseif(u2 == ) > u2 else Relational If Operator if { } reset counter Goto From /z Unit Delay elseif { } counter_n_ increment counter Status Status else { } WHC_DFS_38/39 raise confirmation flag u if(u == 0) enable 2 nb_ticks elseif(u2 == ) > u2 else Relational If Operator if { } reset counter Goto From /z Unit Delay elseif { } counter_n_ increment counter Status Status else { } WHC_DFS_38/39 raise confirmation flag

10 Concept #3 Modeling Technique = A Modeling Language AND A manner of using this language Modeling Technique has to be suitable to the type and to the level of abstr of the information to be expressed Modeling Technique have to be described in Model Standards

11 Concept #4 Model should be developed from a complete set of requirements and constraints external to it Model Parent Requirements

12 Concept #5 Simulation: appropriate means to support model verification Model Parent Requirements

13 Concept #6 Simulation may be used to support the testing effort Model Parent Requirements enable 2 nb_ticks > Relational Operator u u2 if(u == 0) elseif(u2 == ) If else if { } reset counter Goto From /z Unit Delay elseif { } counter_n_ increment counter Status Status else { } WHC_DFS_38/39 raise confirmation flag Executable Object Code

14 Highlights

15 Highlights System / Software Planning Process Development Process Verification Process Tools

16 System / Software Interfaces between System and Software processes updated to address the case where system team produces a software model

17 Planning Process Introduction of Model Standards Syntax & Semantic of the language Constraint on complexity Means to identify Requirements Derived requirements identification Means to establish traceability

18 Development Process Same guidance apply for requirements expressed in a model Model elements which do not represent requirements should be identified

19 Verification Process Guidance from DO-78C / ED-2C Core Document remains applicable

20 Verification Process Simulation & model verification: New means => New artifacts: Simulation Cases & Procedures Simulation Results Simulation Cases based on Model Parent Requirements

21 Verification Process Model Parent Requirements Simulation Cases Development Simulation Procedures Verification enable 2 nb_ticks if(u == 0) u elseif(u2 == ) > u2 else Relational If Operator if { } reset counter Goto Simulation Results From /z Unit Delay elseif { } counter_n_ increment counter Status Status else { } WHC_DFS_38/39 raise confirmation flag

22 Verification Process Test: Same guidance than in DO-78B / ED-2B: Compliance & Robustness with LLR Compliance & Robustness with HLR

23 Verification Process Test (classical) High Level Requirements Low Level Requirements Executable Object Code

24 Verification Process Test (example #) u if(u == 0) Model = HLR enable 2 nb_ticks elseif(u2 == ) > u2 else Relational If Operator if { } reset counter Goto From /z Unit Delay elseif { } counter_n_ increment counter Status Status else { } WHC_DFS_38/39 raise confirmation flag Low Level Requirements Executable Object Code

25 Verification Process Test (example #2) High Level Requirements u if(u == 0) Model = LLR enable elseif(u2 == ) 2 > u2 nb_ticks else Relational If Operator /z From Unit Delay if { } reset counter Goto elseif { } counter_n_ increment counter Status Status else { } WHC_DFS_38/39 raise confirmation flag Executable Object Code

26 Verification Process Test (example #3) Model = HLR + LLR enable 2 > nb_ticks Relational Operator /z From Unit Delay u u2 if(u == 0) elseif(u2 == ) else If if { } reset counter elseif { } counter_n_ increment counter Goto Status Status else { } WHC_DFS_38/39 raise confirmation flag Executable Object Code

27 Verification Process Test (example 3) Model Parent Requirements enable 2 nb_ticks if(u == 0) u elseif(u2 == ) > u2 else Relational If Operator if { } reset counter Goto From /z Unit Delay elseif { } counter_n_ increment counter Status Status Model = HLR + LLR else { } WHC_DFS_38/39 raise confirmation flag Executable Object Code

28 Verification Process Test (example 3) When model express both LLR and HLR, it is required to show: Compliance & Robustness of EOC with Model Compliance & Robustness of EOC with Model Parent Requirements (whatever the process that produced it)

29 Verification Process Model Coverage Analysis: Detect unintended functions in a model Model Parents Requirements u if(u == 0) enable 2 nb_ticks elseif(u2 == ) > u2 else Relational If Operator if { } reset counter Goto From /z Unit Delay elseif { } counter_n_ increment counter Status Status Unintended function else { } WHC_DFS_38/39 raise confirmation flag Executable

30 Verification Process Simulation & Test: Some testing objectives can be achieved by a combination of simulation and other traditional means. HW/SW Integration test objectives cannot be achieved by simulation.

31 Tools Model Parent Requirements Code Verification & Validation Code Coverage Model Standards Model Conformance enable 2 nb_ticks if(u == 0) u elseif(u2 == ) > u2 else Relational If Operator if { } reset counter Goto Test Model Coverage Trace Tool From /z Unit Delay elseif { } counter_n_ increment counter else { } Status Status WHC_DFS_38/39 raise confirmation flag Code Conformance Code Inspector Source Code Code Verification & Validation Code Coverage Trace Tool Executable Object Code

32 Conclusion

33 Highlights Model Parent Requirements Concept #4 Model Standards u if(u == 0) enable 2 nb_ticks elseif(u2 == ) > u2 else Relational If Operator if { } reset counter Goto Concept #5 From /z Unit Delay elseif { } counter_n_ increment counter Status Status Concept #3 else { } WHC_DFS_38/39 raise confirmation flag Concept # #2 Source Code Concept #6 Executable Object Code

34 Conclusion In the continuity of existing rules Consistent with current practices Try to anticipate future trends

35 Thank you for your attention! The reproduction, distribution and utilization of this document as well as the communication of its contents to others without express authorization is prohibited. Offenders will be held liable for the payment of damages. All rights reserved in the event of the grant of a patent, utility model or design. Title Date 35