Military Embedded Systems Summer 2006

Mil Tech Trends
optional setting, item 126 is also inserted
into the DOORS module for navigation
back from DOORS to the design model,
providing bidirectional connectivity.
Requirements, tests, and
assertions
To test the requirements, a test harness
is established in Simulink, where inputs
are created in the Signal Builder block
and system outputs are checked using
verification blocks such as assertions.
Different assertions can be used for each
test case. Additionally, each test case can
be associated with the requirement(s)
that it tests. Figure 4 shows the test case
where the hydraulic pressure of circuit 1
(H1) and the left outer actuator position
sensor (LO_pos) both fail.
The right-hand panes of the test case
show the verification blocks and
requirements associations. For this test
case, the expected output of the mode
logic component is for the left outer
actuator to move into the Off mode, the
left inner and right inner actuator to move
into the Active mode, and the right outer
actuator to move into the Standby mode.
The verification blocks check that this
happens. There are two requirements
associated with this test case, one that
describes what happens to the left outer
actuator when both the hydraulic pressure
and actuator position fails, and another
one to define the configuration of the
remaining actuators in the system. Both
associated requirements, when doubleclicked,
provide navigation back to the
item in the requirements document.
The requirements associations must be
robust and easy to make. Context menus
can be used to establish links between
Simulink and Stateflow models and
requirements-management systems, such
as Telelogic DOORS, or documents such
Figure 3
38 / SUMMER 2006 MILITARY EMBEDDED SYSTEMS
as Microsoft Word, Microsoft Excel, PDF,
and HTML files. Figure 3 shows how an
association is formed to DOORS between
the design element Actuators state (top)
and the detailed DOORS requirement 2,
“1.1 Actuators” (bottom). Using an
Tests designed for all requirements can be
combined into a test harness and applied
to the design model for requirementsbased
testing. Tests can be executed
individually or in batch mode. If a test
runs without any verification blocks
asserting, then the design passes the test.
If an assertion is detected, the simulation
stops and the verification block issuing
the assertion is highlighted, which helps
diagnose why the test failed.
Coverage
Creating and executing requirementsbased
tests to ensure that the design