Black Box Testing: a safety obligation that impacts development cost/time using matlab/simulink?

One main cost saver in model based design using Matlab/Simulink is to avoid as much manual documentation as possible. To do that our decision was to keep the Simulink model as a single source of truth (as much as possible). This means that we decided not to create any extra textual specifications in design level. According to IEC61508 we are obliged to perform “black box testing” on all the models (or code) by an “independent tester”.

Running independent black box testing means we cannot supply an open model to the tester (sitting somewhere else in the world). This forces us to specify textual requirements at design level which we think is a pure waste of time. By doing that we are jeopardizing the cost/time advantage in using model based development.

How do we solve this? What do you recommend??

[George]

Can you use a Simulink Protected Model?

[Naveenraj Vijayan]

That is the point. A masked/locked model needs a seperate requirement specification (which doesn't exist) to be supplied along with it. This is needed for the tester to perform black box testing. In our case the model itself is the requirement and there are no textual requirements.