Does Stateflow Coder always generate code that has complete code coverage?

Under certain scenarios a model containing Stateflow charts generates dead code that cannot be tested. DO-178B coding standards require that generated code achieve 100% code coverage during execution and testing. Hence if there is any generated code that cannot be executed and tested, it poses a problem.

For example, Stateflow Coder may generate code such as the following:

a = TRUE;

if(a==TRUE)

{

// some code here

}

The above code snippet cannot be tested for the condition "a = FALSE".

Answer 1

[MathWorks Support Team]

This enhancement has been incorporated in Release 2011a (R2011a). For previous product releases, read below for any possible workarounds:

The ability to generate code that can achieve complete code coverage during execution and testing is not available in Stateflow Coder 7.2 (R2008b).

Currently, there are no known workarounds.

However, the use of model coverage tools provides an early indicator of sections of the model that might generate unreachable code.

The two most common scenarios under which Stateflow generates dead code (unreachable code) are as below:

1. Enable "saturate on overflow" for blocks and have upstream blocks or data types that actually prevent saturation from occurring. This is one of the most common ways to produce "dead code" from Stateflow.

For example, create a model with an "Add" block that takes 2 UINT8 inputs and output a UINT16. Enable the "Saturate on integer overflow based on the data type".

The resulting code will include a check for overflow based on the maximum value of the output data type (UINT16). However, the overflow never occurs, because it is far above the maximum possible sum of the two inputs (255+255 = 510).

Although the above example is fairly straightforward, the issue also occurs with saturation blocks located far upstream that limit actual values without actually changing the data types.

2. Another situation when Stateflow generates unreachable code is when the generated code contains fixed-point arithmetic that includes branching for saturation on overflow. In this case the real-world inputs that drive the fixed-point signals may never be large enough to force the overflow. This will result in unreachable code.