User Safety: safe

by

Summary

A production-level integration failure occurred during a large-scale model-based systems engineering (MBSE) workflow. The issue involved a misunderstanding of link persistence and configuration contexts when connecting MATLAB/Simulink to IBM DOORS Next Generation (DNG) requirements. Specifically, the team observed that changing the OSLC Configuration Context via setConfigurationContext failed to update existing links to point to new requirement streams, necessitating a manual call to slreq.dngUpdateConfig.

Root Cause

The failure stems from a fundamental distinction between Dynamic Contextual Resolution and Static Link Binding:

  • OSLC Configuration Context: This is a “view” or “lens” applied to an OSLC client. It uses the Configuration-Context HTTP header to instruct the server to resolve a resource (the requirement) within a specific versioned stream. It does not rewrite the URI of the link itself.
  • Direct Link Binding: The slreq.dngUpdateConfig function performs a destructive, physical update to the link metadata. It modifies the underlying URIs to point to specific, versioned resource identifiers within a DNG stream.
  • The Conflict: The engineers assumed that changing the “lens” (the context) would automatically change the “subject” (the link target) for all existing connections. In reality, the links were already hard-coded to specific stream versions, overriding the transient configuration context.

Why This Happens in Real Systems

This phenomenon is common in Distributed Traceability Systems where data is synchronized across different vendor toolchains (e.g., MathWorks and IBM).

  • Semantic vs. Physical Identity: In complex systems, a resource can be identified by its generic type (the concept) or its specific instance (the version).
  • Stateful vs. Stateless Operations: Setting a configuration context is often a stateless request (applying a filter to a query), whereas updating a configuration is a stateful transaction (modifying a database record).
  • Caching Mechanisms: Link resolvers often cache the first version of a requirement they encounter. If the context changes but the link URI remains the same, the system may continue to serve the old version from the cache.

Real-World Impact

  • Traceability Drift: Engineers may believe they are testing against the “Latest Requirements” (Stream B), while their simulation models are actually still tracing to “Deprecated Requirements” (Stream A).
  • False Positives in Verification: Automated test suites may pass because they are validating against outdated requirements, leading to critical safety failures once the correct requirements are finally integrated.
  • Configuration Corruption: Frequent manual updates to links via slreq.dngUpdateConfig increase the risk of broken links if the synchronization process is interrupted.

Example or Code

% Scenario: Transitioning from Baseline_V1 to Baseline_V2

% 1. Incorrect Assumption: Only changing the context is enough
myClient = oslcClient();
setConfigurationContext(myClient, 'Baseline_V1');
% Existing links still point to V1 because the URIs are statically bound

% 2. The Correct Production Approach: Physically update the links
% This modifies the underlying link metadata to point to the new stream
slreq.dngUpdateConfig(myProject, 'Baseline_V2');

% 3. Verification
% Ensure the configuration context is also aligned for new queries
setConfigurationContext(myClient, 'Baseline_V2');

How Senior Engineers Fix It

Senior engineers implement Idempotent Synchronization Pipelines rather than relying on manual client-side context switching.

  • Enforce Single Source of Truth: Instead of allowing individual users to toggle contexts, they implement a Global Configuration Management (GCM) policy where the toolchain automatically triggers dngUpdateConfig as part of the Continuous Integration (CI) pipeline.
  • Automated Link Validation: They write scripts to parse the link-type and target-uri properties of all traces to ensure no “orphaned” links to old streams exist after a baseline shift.
  • Abstraction Layers: They wrap OSLC calls in a custom API that forces both the Context Header and the Physical Link Update to occur atomically, preventing developers from performing one without the other.

Why Juniors Miss It

  • Treating Links as Pointers: Juniors often treat links like software pointers (which change what they point to) rather than Value Types (where the identity is baked into the data).
  • Over-reliance on API Documentation: They often read the documentation for setConfigurationContext and assume it is a “global switch,” without investigating the underlying HTTP protocol and how OSLC handles versioned resources.
  • Lack of System-Level Thinking: They focus on whether a single link works in their current session, rather than how that link will behave when the entire system undergoes a Configuration Baseline Change.

Leave a Comment