DO-78C / ED-2C Model Based Supplement Pierre Lionne, SC-205 / WG-7 SG-4 Co-Chairman Nov. 20
Summary Introduction Foundations Concepts Highlights Conclusion
Introduction
Introduction Issues TOR DO-78C ED-94C ED-94B Supplement X Supplement Y DO-78B
Introduction CNS/ATM & Safety Document Integration SG SG 7 Formal Methods Issues & Rationale SG 2 SC 205 WG 7 SG 6 Tools SG 3 SG 4 SG 5 Object Oriented Model Based Development & Verification
Foundation Concepts
Foundation Concepts Models to express requirements Scope of supplement Modeling Technique Model Parent Requirements Simulation
Concept # Model is an acceptable means to express completely software requirements or architecture Req_00: The XX module shall Wait 0ms before entering in blabl state Req_002: The XX module. Derived Req_003: enable 2 > nb_ticks Relational Operator /z From Unit Delay u u2 if(u == 0) elseif(u2 == ) else If if { } reset counter elseif { } counter_n_ increment counter Goto Status Status else { } WHC_DFS_38/39 raise confirmation flag
Concept #2 The supplement applies to any model that is used to define software artifacts whatever the process that produced it u if(u == 0) enable 2 nb_ticks elseif(u2 == ) > u2 else Relational If Operator if { } reset counter Goto From /z Unit Delay elseif { } counter_n_ increment counter Status Status else { } WHC_DFS_38/39 raise confirmation flag u if(u == 0) enable 2 nb_ticks elseif(u2 == ) > u2 else Relational If Operator if { } reset counter Goto From /z Unit Delay elseif { } counter_n_ increment counter Status Status else { } WHC_DFS_38/39 raise confirmation flag
Concept #3 Modeling Technique = A Modeling Language AND A manner of using this language Modeling Technique has to be suitable to the type and to the level of abstr of the information to be expressed Modeling Technique have to be described in Model Standards
Concept #4 Model should be developed from a complete set of requirements and constraints external to it Model Parent Requirements
Concept #5 Simulation: appropriate means to support model verification Model Parent Requirements
Concept #6 Simulation may be used to support the testing effort Model Parent Requirements enable 2 nb_ticks > Relational Operator u u2 if(u == 0) elseif(u2 == ) If else if { } reset counter Goto From /z Unit Delay elseif { } counter_n_ increment counter Status Status else { } WHC_DFS_38/39 raise confirmation flag Executable Object Code
Highlights
Highlights System / Software Planning Process Development Process Verification Process Tools
System / Software Interfaces between System and Software processes updated to address the case where system team produces a software model
Planning Process Introduction of Model Standards Syntax & Semantic of the language Constraint on complexity Means to identify Requirements Derived requirements identification Means to establish traceability
Development Process Same guidance apply for requirements expressed in a model Model elements which do not represent requirements should be identified
Verification Process Guidance from DO-78C / ED-2C Core Document remains applicable
Verification Process Simulation & model verification: New means => New artifacts: Simulation Cases & Procedures Simulation Results Simulation Cases based on Model Parent Requirements
Verification Process Model Parent Requirements Simulation Cases Development Simulation Procedures Verification enable 2 nb_ticks if(u == 0) u elseif(u2 == ) > u2 else Relational If Operator if { } reset counter Goto Simulation Results From /z Unit Delay elseif { } counter_n_ increment counter Status Status else { } WHC_DFS_38/39 raise confirmation flag
Verification Process Test: Same guidance than in DO-78B / ED-2B: Compliance & Robustness with LLR Compliance & Robustness with HLR
Verification Process Test (classical) High Level Requirements Low Level Requirements Executable Object Code
Verification Process Test (example #) u if(u == 0) Model = HLR enable 2 nb_ticks elseif(u2 == ) > u2 else Relational If Operator if { } reset counter Goto From /z Unit Delay elseif { } counter_n_ increment counter Status Status else { } WHC_DFS_38/39 raise confirmation flag Low Level Requirements Executable Object Code
Verification Process Test (example #2) High Level Requirements u if(u == 0) Model = LLR enable elseif(u2 == ) 2 > u2 nb_ticks else Relational If Operator /z From Unit Delay if { } reset counter Goto elseif { } counter_n_ increment counter Status Status else { } WHC_DFS_38/39 raise confirmation flag Executable Object Code
Verification Process Test (example #3) Model = HLR + LLR enable 2 > nb_ticks Relational Operator /z From Unit Delay u u2 if(u == 0) elseif(u2 == ) else If if { } reset counter elseif { } counter_n_ increment counter Goto Status Status else { } WHC_DFS_38/39 raise confirmation flag Executable Object Code
Verification Process Test (example 3) Model Parent Requirements enable 2 nb_ticks if(u == 0) u elseif(u2 == ) > u2 else Relational If Operator if { } reset counter Goto From /z Unit Delay elseif { } counter_n_ increment counter Status Status Model = HLR + LLR else { } WHC_DFS_38/39 raise confirmation flag Executable Object Code
Verification Process Test (example 3) When model express both LLR and HLR, it is required to show: Compliance & Robustness of EOC with Model Compliance & Robustness of EOC with Model Parent Requirements (whatever the process that produced it)
Verification Process Model Coverage Analysis: Detect unintended functions in a model Model Parents Requirements u if(u == 0) enable 2 nb_ticks elseif(u2 == ) > u2 else Relational If Operator if { } reset counter Goto From /z Unit Delay elseif { } counter_n_ increment counter Status Status Unintended function else { } WHC_DFS_38/39 raise confirmation flag Executable
Verification Process Simulation & Test: Some testing objectives can be achieved by a combination of simulation and other traditional means. HW/SW Integration test objectives cannot be achieved by simulation.
Tools Model Parent Requirements Code Verification & Validation Code Coverage Model Standards Model Conformance enable 2 nb_ticks if(u == 0) u elseif(u2 == ) > u2 else Relational If Operator if { } reset counter Goto Test Model Coverage Trace Tool From /z Unit Delay elseif { } counter_n_ increment counter else { } Status Status WHC_DFS_38/39 raise confirmation flag Code Conformance Code Inspector Source Code Code Verification & Validation Code Coverage Trace Tool Executable Object Code
Conclusion
Highlights Model Parent Requirements Concept #4 Model Standards u if(u == 0) enable 2 nb_ticks elseif(u2 == ) > u2 else Relational If Operator if { } reset counter Goto Concept #5 From /z Unit Delay elseif { } counter_n_ increment counter Status Status Concept #3 else { } WHC_DFS_38/39 raise confirmation flag Concept # #2 Source Code Concept #6 Executable Object Code
Conclusion In the continuity of existing rules Consistent with current practices Try to anticipate future trends
Thank you for your attention! The reproduction, distribution and utilization of this document as well as the communication of its contents to others without express authorization is prohibited. Offenders will be held liable for the payment of damages. All rights reserved in the event of the grant of a patent, utility model or design. Title Date 35