Project stig-robot
This model-only example describes an indoor delivery robot that autonomously transports a payload between indoor destinations. One ASIL C obstacle-stop requirement and one output failure connect its modeled elements.
Element hierarchy
Boxes show Kotlin model instances by reference name, with their metamodel types in guillemets. Containment follows the Design viewpoint's child relationships.
flowchart TB
subgraph deliveryRobot["deliveryRobot<br/>«Item»"]
direction LR
subgraph robotControlUnit["robotControlUnit<br/>«SystemElement»"]
subgraph robotComputer["robotComputer<br/>«Subsystem»"]
subgraph robotApplication["robotApplication<br/>«Cluster»"]
collisionGuardNode["collisionGuardNode<br/>«Component»"]
end
end
end
driveUnit["driveUnit<br/>«SystemElement»"]
end| Instance | Element documentation |
|---|---|
deliveryRobot «Item» |
Indoor delivery robot |
robotControlUnit «SystemElement» |
Robot control unit |
robotComputer «Subsystem» |
Robot computer |
robotApplication «Cluster» |
Robot application |
collisionGuardNode «Component» |
Collision guard node |
driveUnit «SystemElement» |
Drive unit |
Obstacle-stop example
The robot control unit includes its directly attached peripherals. Its robot computer combines the SoC, memory, storage, Linux, ROS 2 middleware, and robot application, including the collision guard node. The drive unit executes brake requests using connected wheel motors and encoders. The collision guard node receives camera images on input_stream and publishes brake_request when an image shows an obstacle in the forward travel corridor.
Every element exposes one input and one output. Requirements trace down through allocatedTo and derivedFrom; failures trace upward through usedIn and propagatesTo. The node's missed-brake-request failure references two proposed Design mechanisms: input plausibility and successive-image comparison.
The failure evaluation remains GAP. Design issue #1 requests an independent camera/lidar path and the operating envelope, timing limits and fault reactions needed to establish stopping before contact. ASIL C is the demonstration classification; the model contains verification criteria but no HARA or executed verification evidence. Source-code analysis is disabled.
This example is licensed under 0BSD. STIG is a separate MPL-2.0 dependency.
Model-check results
Context
| Rule | Findings | Findings without filed issue |
|---|---|---|
HIGH configuredElementIdMatchesContext Configured element id matches context |
0 | 0 |
MODERATE contextClassInstance Context class has no instance property in its file |
0 | 0 |
MODERATE contextClassPascalCase Context class name violates PascalCase |
0 | 0 |
MODERATE contextClassesTopLevel Context class is nested inside another declaration |
0 | 0 |
MODERATE contextObjectCamelCase Context instance name violates camelCase |
0 | 0 |
HIGH descriptionDefinedInContextPackage Context entity has no required description |
0 | 0 |
HIGH INFO elementAllocatedAsilBound Element allocates an ASIL above its own ASIL |
0 | 0 |
HIGH elementAsilDefined Element has no ASIL |
0 | 0 |
HIGH elementInParentDesign Element names a parent whose design omits it |
0 | 0 |
HIGH elementParentDefined Element has no required parent |
0 | 0 |
MODERATE elementTopLevelNoParent Top-level element declares a parent |
0 | 0 |
MODERATE forbiddenWordsInContext Context entity contains forbidden wording |
0 | 0 |
HIGH interfaceEntityAsilDefined Context entity has no required ASIL |
0 | 0 |
HIGH INFO interfacePointAsilBound Provided interface point exceeds its element's ASIL limit |
0 | 0 |
HIGH interfacePointParentAsilBound Interface point exceeds its enclosing interface point's ASIL |
0 | 0 |
HIGH nameDefinedInContextPackage Context entity has no required name |
0 | 0 |
HIGH nonContextEntityInContextPackage Entity uses the wrong viewpoint package (Context) |
0 | 0 |
HIGH portMemberUse Port member use references a member outside its service interface |
0 | 0 |
HIGH portMemberUseAsilBound Port member use exceeds its referenced member's ASIL |
0 | 0 |
HIGH requiredMethodDefinitionAsilBound Required method exceeds its definition's ASIL |
0 | 0 |
HIGH unresolvedInterfaceMember Service member has no resolved interface definition |
0 | 0 |
Requirements
| Rule | Findings | Findings without filed issue |
|---|---|---|
HIGH descriptionDefinedInRequirementsPackage Requirements entity has no required description |
0 | 0 |
HIGH designChildAllocation Parent requirements omit allocation to a design child |
0 | 0 |
MODERATE forbiddenWordsInRequirement Requirements entity contains forbidden wording |
0 | 0 |
HIGH nameDefinedInRequirementsPackage Requirements entity has no required name |
0 | 0 |
HIGH nonRequirementsEntityInRequirementsPackage Entity uses the wrong viewpoint package (Requirements) |
0 | 0 |
HIGH orphanRequirement Derived requirement cites no parent requirement |
0 | 0 |
HIGH requirementAllocatedToChildOfSubject Requirement allocates outside its subject's design children |
0 | 0 |
HIGH requirementAllocatedToDefined Requirement allocates to no child element |
0 | 0 |
HIGH requirementAllocation Requirement has no subject element |
0 | 0 |
HIGH requirementAllocationCoverage Requirements omit an allocated obligation |
0 | 0 |
HIGH requirementAsilDefined Requirement has no ASIL |
0 | 0 |
HIGH requirementAsilDerivation Derived requirement falls below a parent requirement's ASIL |
0 | 0 |
HIGH INFO requirementAsilLeqSubject Requirement exceeds its subject element's ASIL |
0 | 0 |
INFO requirementAsilOverclassification Derived requirement exceeds every parent requirement's ASIL |
0 | 0 |
MODERATE requirementBottomLevelNoAllocation Bottom-level requirement allocates to child elements |
0 | 0 |
HIGH requirementContainerElementDefined Requirements specification has no subject element |
0 | 0 |
HIGH requirementContainerSubject Requirement names a different subject from its specification |
0 | 0 |
HIGH requirementDerivedFromAllocationConsistency Requirement derives from a parent that does not allocate to its subject |
0 | 0 |
HIGH requirementMustLiveInRequirementContainer Requirement lacks a containing requirements specification |
0 | 0 |
MODERATE requirementNormativeModal Requirement omits a recognized normative modal |
0 | 0 |
MODERATE requirementTopLevelNoParent Top-level requirement cites a parent requirement |
0 | 0 |
HIGH requirementVerificationCriteriaDefined Requirement has no verification criteria |
0 | 0 |
MODERATE requirementsClassInstance Requirements class has no instance property in its file |
0 | 0 |
MODERATE requirementsClassPascalCase Requirements class name violates PascalCase |
0 | 0 |
MODERATE requirementsClassesTopLevel Requirements class is nested inside another declaration |
0 | 0 |
MODERATE requirementsObjectCamelCase Requirements instance name violates camelCase |
0 | 0 |
MODERATE subjectBeforeVerbInRequirement Requirement omits its subject before the normative modal |
0 | 0 |
Design
| Rule | Findings | Findings without filed issue |
|---|---|---|
HIGH descriptionDefinedInDesignPackage Design entity has no required description |
0 | 0 |
HIGH designChildrenBoundary Design contradicts the element's bottom-level declaration |
0 | 0 |
HIGH designChildrenParent Design lists a child with a different parent |
0 | 0 |
MODERATE designClassInstance Design class has no instance property in its file |
0 | 0 |
MODERATE designClassPascalCase Design class name violates PascalCase |
0 | 0 |
MODERATE designClassesTopLevel Design class is nested inside another declaration |
0 | 0 |
HIGH designElementDefined Design has no subject element |
0 | 0 |
MODERATE designObjectCamelCase Design instance name violates camelCase |
0 | 0 |
MODERATE forbiddenWordsInDesign Design entity contains forbidden wording |
0 | 0 |
HIGH nameDefinedInDesignPackage Design entity has no required name |
0 | 0 |
HIGH nonDesignEntityInDesignPackage Entity uses the wrong viewpoint package (Design) |
0 | 0 |
HIGH safetyMeasureAsilDefined Safety measure has no ASIL |
0 | 0 |
HIGH safetyMeasureMustLiveInDesign Safety measure lacks a containing design |
0 | 0 |
HIGH safetyMechanismAsilDefined Safety mechanism has no ASIL |
0 | 0 |
HIGH INFO safetyMechanismAsilExceedsElement Safety mechanism exceeds its element's ASIL |
0 | 0 |
Analysis
| Rule | Findings | Findings without filed issue |
|---|---|---|
MODERATE analysisClassInstance Analysis class has no instance property in its file |
0 | 0 |
MODERATE analysisClassPascalCase Analysis class name violates PascalCase |
0 | 0 |
MODERATE analysisClassesTopLevel Analysis class is nested inside another declaration |
0 | 0 |
HIGH analysisElementDefined Analysis has no subject element |
0 | 0 |
MODERATE analysisObjectCamelCase Analysis instance name violates camelCase |
0 | 0 |
HIGH analysisQmAssessment Analysis omits the assessment for its QM exemption |
0 | 0 |
HIGH descriptionDefinedInAnalysisPackage Analysis entity has no required description |
0 | 0 |
HIGH failureArgument Failure records a positive evaluation without an argument |
0 | 0 |
HIGH INFO failureAsilBound Failure exceeds its interface point's ASIL |
0 | 0 |
HIGH failureAsilDefined Failure has no ASIL |
0 | 0 |
HIGH INFO failureAsilPropagation Failure exceeds every propagation target's ASIL |
0 | 0 |
HIGH failureChildPropagationCoverage Failure lacks a contributing child failure |
0 | 0 |
MODERATE failureDescriptionElement Failure description omits its element name at the start |
0 | 0 |
MODERATE failureDescriptionInterface Failure description omits its interface name after the element name |
0 | 0 |
HIGH failureEvaluation Failure lacks a sufficient or residual evaluation |
6 total · 6 high | 0 |
HIGH MODERATE failureIndependentReference Failure cites an invalid independent failure |
0 | 0 |
HIGH failureMultiplePointIndependent Multiple-point failure cites no independent failure |
0 | 0 |
HIGH failureMultiplicityDefined Failure has no multiplicity |
0 | 0 |
HIGH failureMultiplicityPropagation Single-point failure propagates to a failure with incompatible multiplicity |
0 | 0 |
HIGH failureMustLiveInInterfacePointAnalysis Failure lacks a containing interface-point analysis |
0 | 0 |
MODERATE failureNameSeverityMatch Failure name contradicts its severity |
0 | 0 |
HIGH failurePropagationDefined Failure declares no required propagation target |
0 | 0 |
HIGH failurePropagationParentElement Failure propagates outside its eligible analysis parent |
0 | 0 |
MODERATE failurePropagationToBottomLevel Failure propagates to a bottom-level failure |
0 | 0 |
HIGH failurePropagationUsedInConsistency Failure propagates outside its declared interface dependencies |
0 | 0 |
HIGH failureQmSeverity QM failure reaches S10 severity |
0 | 0 |
HIGH failureS10SafetyMeasures Failure lacks a safety measure or valid independent failure |
5 total · 5 high | 0 |
HIGH failureSeverityDefined Failure has no severity |
0 | 0 |
HIGH INFO failureSeverityPropagation Failure exceeds every propagation target's severity |
0 | 0 |
HIGH failureSeverityValue Failure has an invalid severity value |
0 | 0 |
MODERATE failureTopLevelNoPropagation Top-level failure declares propagation targets |
0 | 0 |
MODERATE forbiddenWordsInAnalysis Analysis entity contains forbidden wording |
0 | 0 |
HIGH interfacePointAnalysisChildContributionCoverage Interface-point analysis lacks a contributing child analysis |
0 | 0 |
MODERATE interfacePointAnalysisContributionToBottomLevel Interface-point analysis contributes to a bottom-level interface |
0 | 0 |
HIGH interfacePointAnalysisCoverage Analysis omits an interface point |
0 | 0 |
HIGH interfacePointAnalysisMustLiveInElementAnalysis Interface-point analysis lacks a containing element analysis |
0 | 0 |
MODERATE interfacePointAnalysisName Analysis declaration violates the Analysis naming convention |
0 | 0 |
HIGH interfacePointAnalysisQmAssessment Interface-point analysis omits the assessment for its QM exemption |
0 | 0 |
HIGH interfacePointAnalysisScopeAssessment Interface-point analysis omits the assessment for its safety-scope exclusion |
0 | 0 |
HIGH interfacePointAnalysisSubject Interface-point analysis references another element's interface |
0 | 0 |
MODERATE interfacePointAnalysisTopLevelNoUsedIn Top-level interface-point analysis declares parent dependencies |
0 | 0 |
HIGH interfacePointAnalysisUsedInNotEmpty Interface-point analysis declares no required parent dependency |
0 | 0 |
HIGH interfacePointAnalysisUsedInParentElement Interface-point analysis links outside its eligible analysis parent |
0 | 0 |
HIGH INFO interfacePointAsilUsedIn Interface-point analysis has no parent dependency with sufficient ASIL |
0 | 0 |
HIGH interfacePointS10Failure Interface-point analysis contains no required S10 failure |
4 total · 4 high | 1 total · 1 high |
HIGH nameDefinedInAnalysisPackage Analysis entity has no required name |
0 | 0 |
HIGH nonAnalysisEntityInAnalysisPackage Entity uses the wrong viewpoint package (Analysis) |
0 | 0 |
Tests
| Rule | Findings | Findings without filed issue |
|---|---|---|
HIGH descriptionDefinedInTestsPackage Tests entity has no required description |
0 | 0 |
MODERATE forbiddenWordsInTests Tests entity contains forbidden wording |
0 | 0 |
HIGH nameDefinedInTestsPackage Tests entity has no required name |
0 | 0 |
HIGH nonTestsEntityInTestsPackage Entity uses the wrong viewpoint package (Tests) |
0 | 0 |
HIGH testCaseAllocationConsistency Test case exercises none of its verified requirements' allocated elements |
0 | 0 |
HIGH testCaseAsilDefined Test case has no ASIL |
0 | 0 |
HIGH testCaseContainerElementDefined Test specification has no subject element |
0 | 0 |
HIGH testCaseElementUnderTest Test case identifies no element under test |
0 | 0 |
MODERATE testCaseGivenWhenThen Test case omits the required Given–When–Then sequence |
0 | 0 |
HIGH testCaseInterfacesUnderTest Test case identifies no interface under test |
0 | 0 |
HIGH testCaseMustLiveInTestCaseContainer Test case lacks a containing test specification |
0 | 0 |
HIGH testCaseTraceability Test case has no trace to an element, interface, or requirement |
0 | 0 |
HIGH testCaseVerifiesRequirement Test case identifies no requirement to verify |
0 | 0 |
MODERATE testsClassInstance Tests class has no instance property in its file |
0 | 0 |
MODERATE testsClassPascalCase Tests class name violates PascalCase |
0 | 0 |
MODERATE testsClassesTopLevel Tests class is nested inside another declaration |
0 | 0 |
MODERATE testsObjectCamelCase Tests instance name violates camelCase |
0 | 0 |
More complete diagnostic records and evidence are available locally on the build machine (not published), at repository-relative path build/stig/model-check/project--model-check-results.json.
Filed issues in external tracking systems
Build Provenance
-
Project version:
0.1.0-SNAPSHOT -
STIG version:
4.5.0
Source Repositories
All modules:
Robot application is the ROS 2 application containing the collision guard node. It subscribes to input_stream camera images and publishes brake_request.
Shared camera-image and braking-request data definitions and ROS 2 topics in com.example.stig.common.interfaces.context, available to each consumer's Context compilation. Each element's Context owns its input and output interfaces. The delivery robot's physical interactions remain in its own Context and do not use ROS 2 topics.
Collision guard node is a ROS 2 software component that detects obstacles in input_stream camera images and publishes brake_request.
Shared GitLab issue references for the robot specifications. Use gitlabIssue(1) in an entity's issues list to link the tracked design request while retaining its unresolved analysis evaluation.
Indoor delivery robot models stopping before an obstacle during indoor delivery. The item contains the robot control unit and drive unit.
Robot computer combines the SoC, Linux, ROS 2 and deployed robot application. It accepts camera images and supplies a logical braking request to the control unit.
Drive unit contains motor-control electronics and connected wheel motors and encoders. It receives brake_request over CAN and brings the robot to rest.
Robot control unit contains the robot computer and its directly attached camera. It observes the travel corridor and sends brake_request to the drive unit over CAN.
Issues
Model-check findings
Browse findings from the modules included in this report. The full table supports filtering, sharing a filtered view, and downloading its rows.
More complete diagnostic records and evidence are available locally on the build machine (not published), at repository-relative path build/stig/model-check/project--model-check-results.json.
Filed issues in external tracking systems
1 filed issue is referenced in this scope. Open the full table to filter tickets and view their current Jira status.