Systems engineering — V-model, requirements traceability: Exercises

Before we start, one word we lean on the whole page: a requirement is a single sentence saying what something must do or must not exceed — testable, with a number where possible. "The battery shall deliver 200 Wh" is a requirement; "the battery should be good" is not.

Level 1 — Recognition

Exercise 1.1 (L1)

On the V-model, name the level on the right arm that verifies a requirement written at the subsystem level of the left arm.

Recall Solution 1.1

WHAT the V-model says: each horizontal line joins a left-arm design level to the right-arm level directly opposite it at the same height. That opposite level is the abstraction level at which you check the promise you made. Look at Figure s01 — the dashed grey line at the "subsystem" height connects Subsystem Requirements on the left to Subsystem Integration & Test on the right. Answer: Subsystem Integration & Test.

Exercise 1.2 (L1)

Match each item to "design (left arm)" or "verification (right arm)": (a) Concept of Operations, (b) Component Testing, (c) Subsystem Requirements, (d) Validation.

Recall Solution 1.2

The left arm decomposes — it goes from big idea down to detailed parts. The right arm builds confidence back up by testing.

(a) ConOps → design (left, top)
(b) Component Testing → verification (right, bottom)
(c) Subsystem Requirements → design (left)
(d) Validation → verification (right, top) — the mission-level "did we build the right thing?" check (Verification vs Validation).

Exercise 1.3 (L1)

Fill the blank: in a traceability matrix, a Test Result = PASS provides ______ that the linked requirement is met.

Recall Solution 1.3

Answer: evidence. Traceability's whole job is to attach a chain of proof — requirement → design item → test → result — so that "we met it" is not an opinion but a documented fact.

Level 2 — Application

Exercise 2.1 (L2)

A system requirement says the spacecraft shall operate 5 years. It flows down to three subsystem requirements:

$R_{1}$ : battery survives 5 years of thermal cycles,
$R_{2}$ : solar panels degrade $< 20%$ over 5 years,
$R_{3}$ : electronics survive 5-year radiation dose.

Write the flow-down using the parent note's logical conjunction, and state what must be true for the system requirement $R_{sys}$ to hold.

Recall Solution 2.1

WHAT we do: apply the flow-down rule from the parent's [!formula]. $R_{sys} \Rightarrow {R_{1}, R_{2}, R_{3}}, ⋀_{i = 1}^{3} R_{i} ⟹ R_{sys}$ The symbol $⋀$ means "AND across all of them", so $⋀_{i = 1}^{3} R_{i} = R_{1} \land R_{2} \land R_{3}$ . WHY conjunction and not OR: the spacecraft is a serial chain — if the battery dies, or the panels fade too far, or the electronics fry, the 5-year mission ends. So all three must hold. Only $R_{1} \land R_{2} \land R_{3} = true$ guarantees $R_{sys}$ .

Exercise 2.2 (L2)

Solar array sizing (numbers from the parent's Example 2). Cells are 30% efficient, area $A = 3 m^{2}$ , solar constant $S = 1361 W/m^{2}$ . Compute the beginning-of-life power $P_{BOL}$ .

Recall Solution 2.2

WHAT the formula means: incoming sunlight power on the panel is (area) $\times$ (power per area) $= A \cdot S$ . The panel only converts a fraction $η$ (efficiency) into electricity, so multiply by $η$ . $P_{BOL} = A \cdot S \cdot η = 3 \times 1361 \times 0.30 = 1224.9 \approx 1225 W$ (The parent rounds to $\approx 1226 W$ ; both are the same figure to 3 significant places.)

Exercise 2.3 (L2)

Degradation. A triple-junction array degrades $d = 2.5%$ per year. Starting from $P_{BOL} = 1225 W$ , find the end-of-life power after $t = 15$ years.

Recall Solution 2.3

WHY a power (exponential) law and not subtraction: each year the array loses $2.5%$ of whatever it currently produces, not $2.5%$ of the original. Losing a fraction of the current value every step is exactly what repeated multiplication by $(1 - d)$ does — that is why we use $(1 - d)^{t}$ and not $P_{BOL} - d t$ . $P_{EOL} = P_{BOL} (1 - d)^{t} = 1225 \times (0.975)^{15}$ Now $(0.975)^{15} \approx 0.6839$ , so $P_{EOL} \approx 1225 \times 0.6839 \approx 838 W .$ Requirement was $\geq 600 W$ at EOL, so it passes with margin ( $838 > 600$ ).

Level 3 — Analysis

Exercise 3.1 (L3)

Eclipse battery sizing. Eclipse lasts $30 min$ with an average load of $300 W$ . (a) How many watt-hours are needed? (b) The battery is $50 Ah$ at $18 V$ ; what is its installed energy? (c) If usable energy is limited to $22%$ depth-of-discharge, is the eclipse requirement (need $\geq$ what you found in (a)) met?

Recall Solution 3.1

(a) Energy needed. Energy $=$ power $\times$ time. Convert 30 min to hours: $0.5 h$ . $E_{need} = 300 W \times 0.5 h = 150 Wh .$ (b) Installed energy. For a battery, energy (Wh) $=$ charge (Ah) $\times$ voltage (V): $E_{installed} = 50 Ah \times 18 V = 900 Wh .$ (c) Usable energy. Depth-of-discharge $22%$ means we only draw $22%$ before recharging (protecting battery life): $E_{usable} = 0.22 \times 900 = 198 \approx 200 Wh .$ Since $198 Wh > 150 Wh$ , the requirement is met, with margin $\frac{198 - 150}{150} = 32%$ .

Exercise 3.2 (L3)

Distribution loss. The power system must deliver $500 W$ to the loads through DC-DC converters measured at $96%$ efficiency. (a) How much input power must the converters draw? (b) What is the loss in watts, and is the " $< 5%$ loss" requirement met?

Recall Solution 3.2

(a) Input power. Output $=$ efficiency $\times$ input, so input $=$ output $/$ efficiency: $P_{in} = \frac{500}{0.96} = 520.83 \approx 520.8 W .$ (b) Loss. $P_{loss} = P_{in} - P_{out} = 520.8 - 500 = 20.8 W$ . As a fraction of input: $\frac{20.8}{520.8} = 4.0%$ (equivalently, $100% - 96% = 4%$ ). Since $4% < 5%$ , requirement met. WHY we budget this explicitly: every watt lost in wiring/converters is a watt the solar array must also generate. If you forget it, the array is undersized and the whole power chain fails at EOL.

Exercise 3.3 (L3)

Impact analysis. In the thermal example (parent Example 1), the mission requirement M3 changes from survival at $- 4 0^{\circ} C$ to $- 5 0^{\circ} C$ . Using traceability, list exactly which requirements, designs and tests must be revisited, and explain why traceability makes this instant.

Recall Solution 3.3

The chain from the parent: $M 3 \to S 3 \to {S S 3.1, S S 3.2, S S 3.3} \to {MLI, Heater, Radiator} \to {T-SS3.1, T-SS3.2, T-SS3.3}$ . A colder survival limit means less heat loss allowed and more heater authority in eclipse. Walking the chain downward from M3:

S3 must change ( $- 40 \to - 5 0^{\circ} C$ limit).
SS3.1 (MLI heat loss) — likely tightened (colder means we can afford less loss).
SS3.2 (heater 50 W) — likely increased (need more supplemental heat).
SS3.3 (radiator) — check it doesn't over-cool; possibly re-sized.
Designs: MLI layer count, heater power rating, radiator area.
Tests: all three thermal tests re-run against new limits. WHY instant: because every link was recorded during flow-down, changing one node lets you follow the arrows to every affected item — no hunting through documents. This is the core value of a traceability matrix (Configuration Management keeps those links under control when things change).

Level 4 — Synthesis

Exercise 4.1 (L4)

Build a one-row traceability matrix for this thread: Mission M1 "image Earth at 10 m resolution" → System S1 "camera achieves 10 m ground sample distance" → Subsystem SS1.1 "focal length 2 m". Choose sensible IDs, name a design item, a test ID, and state the result condition that verifies the whole thread up to M1.

Recall Solution 4.1

WHAT a matrix row is: a horizontal record that ties one requirement thread to its evidence. Columns are Mission → System → Subsystem → Design → Test → Result.

Mission Req	System Req	Subsystem Req	Design Item	Test ID	Result
M1: 10 m resolution	S1: camera 10 m GSD	SS1.1: focal length 2 m	Optical bench TB-101	T-SS1.1-001	PASS

Verification logic (bottom-up, the right arm of the V): T-SS1.1-001 = PASS verifies SS1.1; when all subsystem reqs feeding S1 pass, S1 is verified; S1 verified (plus the orbit-altitude thread) validates M1. WHY IDs matter: unique IDs (S1, SS1.1, T-SS1.1-001) are what let a database (DOORS/Jama) draw the parent-child links automatically — see Interface Control Documents for how the boundary between camera and structure is frozen so this thread stays valid.

Exercise 4.2 (L4)

Full power-chain synthesis. Combining EOL degradation (Ex 2.3), distribution loss (Ex 3.2) and a required $500 W$ to loads with a $20%$ system margin on top: (a) compute the required array output at EOL, and (b) check whether the $838 W$ EOL array of Ex 2.3 passes.

Recall Solution 4.1

WHAT we do — build the budget outward from the load:

Load: $500 W$ .
Add distribution loss (Ex 3.2): input to converters $= 500/0.96 = 520.8 W$ .
Add $20%$ system margin: required $= 520.8 \times 1.20 = 625.0 W$ . (a) Required array output at EOL $\approx 625 W$ . (b) The array delivers $838 W$ at EOL. Since $838 > 625$ , it passes, with margin $\frac{838 - 625}{625} = 34%$ . WHY margin on top: models are imperfect and space is unforgiving; margin absorbs the unknowns you couldn't trace. This connects to Risk Management in Spacecraft Design — margin is how you buy down uncertainty risk.

Level 5 — Mastery

Exercise 5.1 (L5)

A mission requires 5-year operation. Flow it down and verify by analysis the solar-panel branch: requirement $R_{2}$ says "panels degrade $< 20%$ over 5 years." Using $d = 2.5%$ /year compounding, (a) compute the actual 5-year degradation, (b) decide PASS/FAIL, and (c) explain how this single number plugs into the V-model's verification of $R_{sys}$ , naming the verification method used and why it (not physical test) is appropriate here.

Recall Solution 5.1

(a) Degradation fraction. Remaining fraction after 5 years is $(1 - d)^{5} = (0.975)^{5} \approx 0.8811$ . So degradation is $1 - 0.8811 = 0.1189 = 11.9%.$ (b) Decision. $11.9% < 20%$ ⇒ PASS. $R_{2}$ is satisfied. (c) Into the V-model. From Ex 2.1, $R_{1} \land R_{2} \land R_{3} ⟹ R_{sys}$ . This analysis discharges $R_{2}$ ; with $R_{1}$ (battery cycles) and $R_{3}$ (radiation dose) also verified, the conjunction closes and $R_{sys}$ (5-year operation) is verified. Method: Analysis (calculation using an established degradation model), not physical test. WHY analysis is appropriate: you cannot run a real 5-year test before a launch that must happen this decade. Where the physics is a well-validated model (compounding radiation degradation), analysis is the credible verification method — exactly the "Test vs Analysis" choice the parent's "Verification methods" section lists. Physical flash-tests validate the model's starting efficiency; the long-term extrapolation is then trusted analysis.

Exercise 5.2 (L5)

Design closure under a tightened requirement. Suppose M3 tightens survival to $- 5 0^{\circ} C$ and, as a result, SS3.2 heater power must rise from $50 W$ to $75 W$ . The eclipse average electrical load in Ex 3.1 therefore rises from $300 W$ to $325 W$ . (a) Recompute the eclipse energy need. (b) Does the existing $198 Wh$ usable battery still pass? (c) In one sentence, state the traceability consequence and which document control process governs the change.

Recall Solution 5.2

(a) New eclipse energy. $E_{need} = 325 W \times 0.5 h = 162.5 Wh .$ (b) Check. Usable $= 198 Wh > 162.5 Wh$ ⇒ still PASS, margin now $\frac{198 - 162.5}{162.5} = 21.8%$ (down from $32%$ ). (c) Traceability consequence. A change to M3 propagated (via the recorded links) into SS3.2 and into the power branch SS4.2 — a cross-subsystem impact — so all touched requirements, designs and tests must be re-baselined and re-verified under Configuration Management (formal change control), and the interface between thermal and power is re-checked via Interface Control Documents. WHY this is mastery: you traced a single mission change across two subsystems, re-ran the affected budgets, re-confirmed a margin, and named the governing process — the full loop the V-model exists to protect.

Recall Self-test summary (cloze)

The V-model verifies each requirement at the ::: same abstraction level it was specified. Flow-down uses logical ::: conjunction (AND) — all sub-requirements must hold. Solar degradation compounds as ::: $P_{BOL} (1 - d)^{t}$ , not linearly. Energy of a battery in Wh equals charge in Ah times ::: voltage in V. A traceability matrix links requirement to design to test to ::: result (evidence). The two questions of the right arm are: verification = "built it right?" and validation = ::: "built the right thing?"