Qualkitdo Slci Tor

8/20/2019 Qualkitdo Slci Tor

1/25

DO Qualification Kit

Simulink® Code Inspector™ Tool Operational Requirements

R2015b, September 2015


2/25

How to Contact MathWorks

Latest news: www.mathworks.com

Sales and services: www.mathworks.com/sales_and_services

User community: www.mathworks.com/matlabcentral

Technical support: www.mathworks.com/support/contact_us

Phone: 508-647-7000

The MathWorks, Inc.

3 Apple Hill Drive

Natick, MA 01760-2098 DO Qualification Kit: Simulink ® Code Inspector™ Tool Operational Requirement s

© COPYRIGHT 2012 – 2015 by The MathWorks, Inc.

The software described in this document is furnished under a license agreement. The software may be used or copied only under

the terms of the license agreement. No part of this manual may be photocopied or reproduced in any form without prior written

consent from The MathWorks, Inc.

FEDERAL ACQUISITION: This provision applies to all acquisitions of the Program and Documentation by, for, or through the

federal government of the United States. By accepting delivery of the Program or Documentation, the government hereby agrees

that this software or documentation qualifies as commercial computer software or commercial computer software documentationas such terms are used or defined in FAR 12.212, DFARS Part 227.72, and DFARS 252.227-7014. Accordingly, the terms and

conditions of this Agreement and only those rights specified in this Agreement, shall pertain to and govern the use, modification,

reproduction, release, performance, display, and disclosure of the Program and Documentation by the federal government (or

other entity acquiring for or through the federal government)and shall supersede any conflicting contractual terms or conditions.

If this License fails to meet the government’s needs or is inconsistent in any respect with federal procurement law, the

government agrees to return the Program and Documentation, unused, to The MathWorks, Inc.

Trademarks

MATLAB and Simulink are registered trademarks of The MathWorks, Inc. See www.mathworks.com/trademarks f or alist of additional trademarks. Other product or brand names may be trademarks or registered trademarks of their respectiveholders.

Patents

MathWorks products are protected by one or more U.S. patents. Please see www.mathworks.com/patents f or moreinformation.

http://www.mathworks.com/http://www.mathworks.com/http://www.mathworks.com/sales_and_serviceshttp://www.mathworks.com/sales_and_serviceshttp://www.mathworks.com/matlabcentral/http://www.mathworks.com/matlabcentral/http://www.mathworks.com/support/contact_us/http://www.mathworks.com/support/contact_us/http://www.mathworks.com/trademarkshttp://www.mathworks.com/trademarkshttp://www.mathworks.com/trademarkshttp://www.mathworks.com/patentshttp://www.mathworks.com/patentshttp://www.mathworks.com/patentshttp://www.mathworks.com/patentshttp://www.mathworks.com/trademarkshttp://www.mathworks.com/support/contact_us/http://www.mathworks.com/matlabcentral/http://www.mathworks.com/sales_and_serviceshttp://www.mathworks.com/


3/25

Revision History

March 2012 New for Version 1.6 (Applies to Release 2012a)

September 2012 Revised for Version 2.0 (Applies to Release 2012b)

March 2013 Revised for Version 2.1 (Applies to Release 2013a)September 2013 Revised for Version 2.2 (Applies to Release 2013b)

March 2014 Revised for Version 2.3 (Applies to Release 2014a)

October 2014 Revised for Version 2.4 (Applies to Release 2014b)

March 2015 Revised for Version 2.5 (Applies to Release 2015a)

September 2015 Revised for DO Qualification Kit Version 3.0 (Applies to Release 2015b)


4/25


5/25

v

Contents

1

Introduction ...................................................................................................................................... 1-1

1.1

Simulink Code Inspector Product Description ........................................................................ 1-2

2

Operational Requirements ................................................................................................................ 2-1

2.1

Code Inspector Report Operational Requirements .................................................................. 2-2

2.2

Code Inspection User Information ........................................................................................ 2-11

3

Installation ........................................................................................................................................ 3-1

4

Operational Environment ................................................................................................................. 4-1


6/25

vi


7/25

1 Introduction

This document comprises the Tool Operational Requirements (Reference DO-330 Section10.3.1) for the following capabilities of the Simulink ® Code Inspector™ verification product:

Code inspection report

The document identifies:

Features of the Simulink Code Inspector product.

The environment in which the Simulink Code Inspector product is installed (ReferenceDO-330, Sections 10.2.4 and 10.3.2).

This document is intended for use in the DO-330 tool qualification process for TQL-4 tools. Theapplicant needs to:

Review the Tool Operational Requirements for applicability in the project or programunder consideration.

Configure the Tool Operational Requirements in the project or program’s configurationmanagement system.

Complete the Tool Operational Requirements and make the document available for review.

For more information about the following products, see the MathWorks® Documentation Center,R2015b:

Simulink Code Inspector

Simulink ®

http://www.mathworks.com/help/releases/R2015b/index.htmlhttp://www.mathworks.com/help/releases/R2015b/index.htmlhttp://www.mathworks.com/help/releases/R2015b/index.htmlhttp://www.mathworks.com/help/releases/R2015b/index.htmlhttp://www.mathworks.com/help/releases/R2015b/index.htmlhttp://www.mathworks.com/help/releases/R2015b/index.htmlhttp://www.mathworks.com/help/releases/R2015b/index.htmlhttp://www.mathworks.com/help/releases/R2015b/index.html


8/25

1-2

1.1 Simulink Code Inspector Product DescriptionAutomate source code reviews for safety standards

Simulink ® Code Inspector automatically compares generated code with its source model to

satisfy code-review objectives in DO-178 and other high-integrity standards. The code inspector

systematically examines blocks, state diagrams, parameters, and settings in a model to determinewhether they are structurally equivalent to operations, operators, and data in the generated code.

Simulink Code Inspector provides detailed model-to-code and code-to-model traceability

analysis. It generates structural equivalence and traceability reports that you can submit tocertification authorities to satisfy DO-178 software coding verification objectives.

Key Features

Structural equivalence analysis and reports

Bidirectional traceability analysis and reports

Compatibility checker to restrict model, block, state diagrams, and coder usage to operationstypically used in high-integrity applications

Tool independence from Simulink ® code generators

Simulink Code Inspector carries out translation validation. Inputs to the Code Inspector are a

Simulink model and the C source code generated by the Embedded Coder® code generator forthe model. To be compatible with code inspection, the code generated by Embedded Coder

must comply with either the ANSI C89/C90 or ISO/IEC 9899:1990 standard.

The code inspector processes these two inputs into internal representations (IRs), called modelIR and code IR. These IRs are transformed into normalized representation’s to facilitate further

analysis. In this process, the model IR represents the expected pattern, and the code IR

constitutes the actual pattern to be verified. To verify the generated code, the Code Inspector

attempts to match the normalized model IR with the normalized code IR.


9/25

1-3

Figure 1 shows the architecture of Simulink Code Inspector.

Figure 1: Simulink Code Inspector Architecture


10/25

1-4


11/25

2 Operational Requirements


12/25

2-2

2.1 Code Inspector Report Operational RequirementsThe Simulink ® Code Inspector™ product includes the capability to generate a code inspection

report for a Simulink ® model and its generated code. The report provides detailed analysis ofstructural equivalence and bidirectional traceability between the model and the code generated

from the model.

The code inspection report contains the following major sections:

Code Verification Results — Summary and detailed reports on verification of structuralequivalence between model and code elements. Categories include:

Function Interface Verification

Model To Code Verification

Code To Model Verification Temporary Variable Usage

Traceability Results — Summary and detailed reports on

Model To Code Traceability

Code To Model Traceability

Code inspection automatically compares generated code with its source model to satisfy code-review objectives in DO-178C/DO-331 and other high-integrity standards. The code inspection

process builds an in-memory representation of the model that is independent of the code

generation process. The Simulink Code Inspector systematically examines blocks, parameters,and settings in a model to determine whether they are structurally equivalent to operations,

operators, and data in the generated code, and generates reports that can be used to support

software certification.


13/25

2-3

Prior to code inspection, the Simulink Code Inspector provides compatibility checks to verify

model compatibility with code inspection. The model incompatibilities are either fatal ornonfatal.

Code generated from models with fatal incompatibilities cannot be verified. The useris notified with a message and code inspection terminates.

Code generated from models with nonfatal incompatibilities can be partially verified.Although it might not be possible to fully verify the generated code, code inspectioncontinues.

The aspects of a Simulink model that are analyzed by code inspection include the following:

Model and code compatibility

Model interface

Block behavior

Stateflow® behavior

MATLAB Function block behavior

Block connectivity and execution order

Data and file packaging Local variables

Configuration parameters

The following table lists the Simulink Code Inspector capabilities that are supported by the DOQualification Kit. The user is responsible for ensuring that the tool features they rely on to

eliminate, reduce or automate the process are sufficiently covered by Tool Operational

Requirements (reference DO-300 Section 6.2.1.aa).


14/25

2-4

Simulink Code Inspector— Operational Requirements Summary

Requirement ID Requirement Example of

Detectable Condition

Limitations

Model and Code Compatibility

MDLCOMPILE If a model does not compile,Simulink Code Inspector shall

consider the model invalid and postan error message.

If a model does not compile, codeinspection terminates with an error

message.

None

INVSRCCODE If the source code cannot be parsed,

Simulink Code Inspector shallconsider the code invalid and post an

error message.

If source code cannot be parsed, code

inspection terminates with an errormessage.

None

MDLFATAL Simulink Code Inspector shall detectif the model is fatally incompatiblewith code inspection and terminate

the inspection.

Code inspection terminates when themodel does not use an ert-basedsystem target file.

None

MDLNONFATAL Simulink Code Inspector shall detectif the model is nonfatally

incompatible with code inspectionand, by default, continue the

inspection.

Code inspection continues when Sum block input and output ports do not

have the same data type.

None

NONFATALCHOICE Simulink Code Inspector shall allowthe user to terminate code inspectionfor nonfatal incompatibilities.

Code inspection terminates for anonfatally incompatible model anduser has selected the option to

terminate inspection for a nonfatallyincompatible model.

None

Model Interface

MDLINTFUNCGEN Simulink Code Inspector shall verify

that the model interface functions are

implemented in the generated code.

Model step function is missing. None

MDLINTDATAGEN Simulink Code Inspector shall verifythat the model interface datastructures are implemented in thegenerated code.

Root input data structure for a bus ismissing.

Arrays and built-in typesare supported forinspection. For structures,the name or tag is verified,

but not the structure fields.

MDLINTFUNCSIG Simulink Code Inspector shall verifythat the model interface functionshave the expected signatures

Model step function argumentsequence differs from function prototype control specification.

None

MDLINTIOGEN Simulink Code Inspector shall verifythat the expected input and outputdata structures are implemented inthe generated code.

External input for initializationfunction was not initialized asexpected.

Arrays and built-in typesare supported forinspection. For structures,the name or tag is verified,

but not the structure fields.

Block Behavior


15/25

2-5

Requirement ID Requirement Example ofDetectable Condition

Limitations

BLKCOMPS Simulink Code Inspector shall verify

that code generated for a blockincludes all components offunctionality.

Code for a Unit Delay block does not

include code for updating its statevariable.

None for blocks supported

for inspection.*

BLKCOMPSEXP Simulink Code Inspector shall verify

that code generated for a blockincludes only expected instances of

component functionality.

Code includes two independent

addition operations that trace to thesame Sum block.


for inspection.*

BLKCOMPSTRACE Simulink Code Inspector shall verifythat code segments trace back to

block component functionality andthat system logic code traces back tosystem functionality.

A segment of code exists that doesnot trace back to a block source.

None for blocks supportedfor inspection.*

BLKCOMPSCONFIG Simulink Code Inspector shall verify

that code for block componentfunctionality represents the current

block configuration.

A Relational Operator block is

configured for an equal (==)operation, but it traces to code that

applies a not equal (!=) operation.


for inspection.*

BLKCOMPSSYSFUNC Simulink Code Inspector shall verifythat code for block component

functionality is in the correspondingsystem function.

The output code for a Unit Delay block is in the start function of the

parent system.

None for blocks supportedfor inspection.*

BLKCOMPSPROPS Simulink Code Inspector shall verify

that property settings in the code arecompliant with settings forcorresponding source blocks.

A Gain block with an output data

type of double traces to code thatassigns the block output to variable of

type real32_T.


for inspection.*

BLKCRL Simulink Code Inspector shall verifythat code generated for a block usesfunctions and operations supported

for code inspection in the Code

Replacement Libraries (CRLs).

Code for Sqrt block does not use afunction or operation supported forcode inspection in the CRL.

For a list of functions andoperations supported forcode inspection, see“Supported Functions and

Operations in CodeReplacement Libraries” in

the Simulink Code Inspector Tool

Requirements, R2015b.

* For a list of blocks supported for code inspection, see “ Supported Block Constraints” in the Simulink Code Inspector Tool Requirements, R2015b.

Stateflow Behavior

SFFLOWGRAPH Simulink Code Inspector shall verifythat the generated code executionorder and execution paths represent

the execution order and execution paths in the Stateflow Chart.

Stateflow does not generate a controlflow with more than 1 defaulttransition.

See “Stateflow Charts” inthe Simulink Code Inspector Tool



16/25

2-6


Limitations

SFSTATES Simulink Code Inspector shall verify

that the code generated for a staterepresents the corresponding state inthe model, including entry, during,and exit actions.

Stateflow does not generate a control

flow with more than 1 defaulttransition.

See “Stateflow States” in



SFTRANSITION Simulink Code Inspector shall verifythat the code generated for a

transition represents thecorresponding transition in themodel, including conditions and

actions.

A condition action uses operator cos and the generated code has operator

sin.

See “StateflowTransitions” in the

Simulink Code Inspector

Tool Requirements,R2015b.

SFJUNCTION Simulink Code Inspector shall verifythat the code generated for a junction

represents the corresponding junction in the model and includesall transition paths into and out of

the junction.

An unconditional transition executinglast in the chart is executed first in the

generated code.

See “Stateflow Junctions”

in the Simulink Code

Inspector Tool


SFDATA Simulink Code Inspector shall verifythat the Stateflow data in the

generated code represents the modeldata.

Output of Stateflow block with data

type uint32_T traces to code thatassigns the block output to variable of

data type int8_T.

See “Stateflow Data andEvents” in the Simulink

Code Inspector Tool


SFEVENT Simulink Code Inspector shall verifythat the code generated for

function-call event represents

the function-call event in themodel.

Output trigger type is Either edge instead of function-call.

See “Stateflow Data andEvents” in the Simulink

Code Inspector Tool


SFGRAPHFUNC Simulink Code Inspector shall verifythat the code generated for a

graphical function represents the

graphical function in the model,including the control flow.

Stateflow graphical function property

InlineOption is set to Inline but the generated code has a

function.

See “Stateflow GraphicalFunctions” in the Simulink

Code Inspector Tool


SFSLFUNC Simulink Code Inspector shall verifythat the code generated for aSimulink function represents the

Simulink function in the model.

Generated code does not inline thecorrect Simulink function whenSimulink functions exist in both a

chart and a state within the chart.

See “Stateflow SimulinkFunctions” in the SimulinkCode Inspector Tool


SFTRUTHTABLE Simulink Code Inspector shall verifythat the code generated for a truth

table represents the truth table in the

model.

When Decision 1 is true, Action 1should execute. However, in the

generated code, Action 2 executes.

See “Stateflow TruthTables” in the Simulink

Code Inspector Tool

Requirements, R2015b.MATLAB Function block behavior


17/25

2-7


Limitations

MLFUNCFLOW Simulink Code Inspector shall verify

that the generated code executionorder and execution paths representthe execution order and execution paths in the MATLAB function.

In a MATLAB Function block, a

variable is updated after it isconsumed. However, in the generatedcode, it is updated before it isconsumed.

See “Code in MATLAB

Functions” in the SimulinkCode Inspector Tool


MLFUNCDATA Simulink Code Inspector shall verifythat the MATLAB function data in

the generated code represents themodel data.

Output of MATLAB Function block

with data type uint32 traces to codethat assigns the block output to

variable of data type int32.

See “Data in MATLABFunctions” in the Simulink

Code Inspector Tool


MLFUNCOPER Simulink Code Inspector shall verify

that the code generated forMATLAB function block operators

represents the current blockfunctionality.

A statement in a MATLAB Function

block using a plus (+) operator tracesto code that performs a subtraction (-)

operation.

See “MATLAB Function

Blocks” in the SimulinkCode Inspector Tool


MLFUNUSER Simulink Code Inspector shall verify

that the code generated for user-written functions in MATLAB

Function blocks represents the user-written function in the model.

A statement in a user-defined

function inside a MATLAB function block uses the second element in an

array. However, in the generatedcode, the third element is used.

See “MATLAB Function

Blocks” in the SimulinkCode Inspector Tool


Block Connectivity and Execution OrderBLKDATADEPEND Simulink Code Inspector shall verify

that the data dependency between

two block components is preservedin the generated code.

A Gain block generates amultiplication operation with one

operand as its parameter and anotheroperand as a variable not written to by the source of the Gain block.

None

BLKDATADEFUSE Simulink Code Inspector shall verifythat the data definition and use

dependencies in the code reflect the

dependencies in the model.

A variable buffer is written to by theoperation of block A. It is written to

again by the operation of block B

before a destination block for block Ahas read the first value.

None

BLKINPUT Simulink Code Inspector shall verify

that the block input sources in thecode represent the block input

sources in the model.

A Gain block uses input from a

muxed signal for input ports 1 and 2(in that order). The generated

multiplication code for the Gain block represents the block inputsources in a different order thanexpected. For example,

[y1, y2] = [k2, k1] .* [u1 u2]

or[y1, y2] = [k1, k2] .* [u2 u1]instead of[y1, y2] = [k1, k2] .* [u1 u2]

None


18/25

2-8


Limitations

BLKINDEX Simulink Code Inspector shall verify

that the data selection in the coderepresents the data selection in themodel.

A Gain block is fed by a Bus Selector

that selects field f1 from bus foobus.The multiplication operation in thecode is on foobus.

None

BLKEXEORDER Simulink Code Inspector shall verify

that the code execution order isconsistent with model element

execution order.

Gain block A feeds a Unit Delay

block B. The update code of UnitDelay block B appears before the

output code of Gain block A.

None

BLKMULTIRATE If a model contains blocks thatexecute at different sample rates,

Simulink Code Inspector shall verifythat the code for each block is calledat the proper rate and in the proper

execution order.

An Abs block is executing at asample rate of 10 Hz. However, in

the generated code, the Abs blockexecutes at 20 Hz.

See the “Solver Pane” and“Diagnostics Pane:

Sample Time” constraintsin the Simulink Code Inspector Tool


Data and File Packaging

SIGOBJAUTO Simulink Code Inspector shall verifythat signal objects with auto storage

classes in the code represent signalobjects with auto storage classes in

the model.

Signal sig1 is specified with the

auto storage class. In the code,

sig1 is represented as a globalvariable instead of an element of the

output data structure.

None

SIGOBJGLOB Simulink Code Inspector shall verifythat signal objects that do not have

an storage class in the coderepresent signal objects that do not

have an auto storage class in themodel.

Signal sig1 is specified with the

ExportedGlobal storage class. In

the code, sig1 is represented as aglobal variable.

Code inspection issupported for Simulinkglobal and other storage

classes with CustomStorage Class types set to

Unstructured.

PARAMOBJAUTO Simulink Code Inspector shall verify

that parameter objects with storage

class auto in the code represent parameter objects with storage class

auto in the model.

Parameter K is specified with the

auto storage class. In the code, the

literal value of the parameter isrepresented as a global variableinstead of its literal value or anelement of the parameter data

structure.

None

PARAMOBJTUNA Simulink Code Inspector shall verify

that parameter objects that do nothave an auto storage class in thecode represent parameter objects thatdo not have an auto storage class in

the model. (For example, SimulinkCode Inspector will verify that

tunable parameters in the coderepresent tunable parameters in themodel.)

Parameter K is specified with the

ExportedGlobal storage class. Inthe code, the literal value of the

parameter is represented as a globalvariable.

Code inspection is

supported for Simulinkglobal and other storageclasses with CustomStorage Class types set to

Unstructured.


19/25

2-9


Limitations

PARAMINLINE Simulink Code Inspector shall verify

that Inlined parameter values in thecode represent Inlined parametervalues in the model.

A Gain block has its Gain parameter

set to 3.0. The code uses the literalvalue 4.0 in the multiplicationoperation.

None

Local Variables

LCLVARUSED Simulink Code Inspector shall

verify that all local variables areused.

Local variable tmp is defined but not

used.

None

LCLVARDEF Simulink Code Inspector shall

verify that all local variables aredefined before initial use.

Local variable tmp is used, but is not

defined.

None

Configuration Parameters

SOLVERPANE Simulink Code Inspector shall detect

configuration parameter settings onthe Solver Pane that are not

compatible with code inspection.

Model specifies a single sample time,

but the generated code has multiratecode.

See “Configuration

Parameter Constraints” in

the Simulink Code

Inspector Tool


DATAPANE Simulink Code Inspector shall detect

configuration parameter settings onthe Data Import/Export Pane that arenot compatible with code inspection.

Configuration parameter

InitialState is set to ‘’, but thegenerated code has code for initialstate override.


Parameter Constraints” in



OPTPANE Simulink Code Inspector shall detectconfiguration parameter settings on

the Optimization Pane that are notcompatible with code inspection.


StateBitSets is set to off, butthe generated code behaves as if this

parameter is on.

See “ConfigurationParameter Constraints” in



DIAGPANE Simulink Code Inspector shall detect

configuration parameter settings onthe Diagnostics Pane that are notcompatible with code inspection.


UnderspecifiedInitializationDetection is set to

Simplified, but the generated

code has code for Classic mode.


Parameter Constraints” inthe Simulink Code Inspector Tool


HWPANE Simulink Code Inspector shall detectconfiguration parameter settings onthe Hardware Implementation Pane

that are not compatible with codeinspection.


ProdBitPerShort is set to 16,

but the generated code uses 32.

See “ConfigurationParameter Constraints” in



MODREFPANE Simulink Code Inspector shall detectconfiguration parameter settings onthe Model Referencing Pane that arenot compatible with code inspection.

A referenced model hasModelReferenceNumInstance

sAllowed set to Multi, but thegenerated code for it has single-instance code.

None


20/25

2-10


Limitations

CODEGENPANE Simulink Code Inspector shall detect

configuration parameter settings onthe Code Generation Pane that arenot compatible with code inspection.

On Code Generation: Interface >

Data pane, configuration parameterInterface is set to None, but thegenerated code has initialization code

for error C-API interface.


Parameter Constraints” inthe Simulink Code Inspector Tool



21/25

2-11

2.2 Code Inspection User InformationFor information about code inspection reports, see “Code Inspection Reports” in the Simulink

Code Inspector User’s Guide, R2015b.

For a list of blocks supported for code inspection, see “Supported Block Constraints” in the

Simulink Code Inspector Tool Requirements, R2015b.

For information about model configuration, block, Stateflow, and MATLAB function

constraints when using the Simulink Code Inspector to inspect code, see the following sections

in the Simulink Code Inspector Tool Requirements, R2015b:

“Model Configuration Constraints”

“Block Constraints”

“Stateflow Constraints”

“MATLAB Function Block Constraints”

For traceability between the operational requirements and tool requirements, see

qualkitdo_slci_tor_tr_trace.xlsx

To access these documents, on the MATLAB command line, type qualkitdo to open theArtifacts Explorer. The documents are in Simulink Code Inspector.


22/25

2-12


23/25

3 Installation

To use the Simulink ® Code Inspector™ product, install the following MathWorks® products:

MATLAB®

Simulink ® Simulink Code Inspector

To generate model code for inspection, install the following MathWorks products:

MATLAB® Coder™

Simulink ® Coder™

Embedded Coder ®

Instructions for installing the products are available at the MathWorks Documentation Center,R2015b:

Installation

http://www.mathworks.com/help/releases/R2015b/index.htmlhttp://www.mathworks.com/help/releases/R2015b/index.htmlhttp://www.mathworks.com/help/releases/R2015b/index.htmlhttp://www.mathworks.com/help/releases/R2015b/index.htmlhttp://www.mathworks.com/help/releases/R2015b/index.htmlhttp://www.mathworks.com/help/releases/R2015b/index.html


24/25

3-2


25/25

4 Operational Environment

The DO Qualification Kit product supports the following operating environments for theSimulink ® Code Inspector™ product:

Personal computer One of the following operating systems:

Microsoft® Windows®

Linux®1

MATLAB® Software

Simulink ® Software

Simulink Code Inspector software

1 Linux® is a registered trademark of Linus Torvalds.

Documents

Qualkitdo Slci Tor