Systems engineering — V-model, requirements traceability: Worked examples

Before we compute anything, we agree on the two numbers we will use again and again.

Definition Margin (and the two flavours of requirement)

First, the two words that appear in every formula on this page:

Capability = what the hardware actually delivers (measured or predicted).
Requirement = the number written in the spec.

Margin is how much better than required the Capability is — in plain words, "how much room do I have before I fail the requirement?" There are two kinds of requirement, and the formula flips between them.

Floor requirement ( $\geq$ , bigger-is-better — e.g. "provide at least 600 W"): $Margin_{\geq} = \frac{Capability - Requirement}{Requirement} \times 100%$

Ceiling requirement ( $\leq$ , smaller-is-better — e.g. "lose no more than 10 W/m²"): $Margin_{\leq} = \frac{Requirement - Capability}{Requirement} \times 100%$

Notice: for a ceiling we put Requirement first in the numerator, because now beating the spec means being below it. In both cases positive = pass with room, negative = fail, zero = exactly meets with no cushion.

The scenario matrix

Every problem this topic can throw is one of these cells. Each worked example below is tagged with the cell(s) it covers.

#	Case class	What makes it tricky	Example
A	All children pass (happy path)	Confirm the AND-rule closes the loop	Ex 1
B	One child fails → parent fails	Conjunction breaks on a single FALSE	Ex 2
C	Zero / degenerate input	A budget term is 0 (no eclipse, no loss)	Ex 3
D	Limiting / end-of-life	Value drifts to a worst-case boundary	Ex 4
E	Negative margin (fails with numbers)	Margin formula goes below zero	Ex 5
F	Exactly-zero margin (boundary)	Capability == Requirement exactly	Ex 6
G	Real-world word problem	Translate prose → traceability chain	Ex 7
H	Exam twist: unverifiable requirement	Requirement written so it cannot be tested	Ex 8
I	Impact analysis (requirement changes)	Follow links backward when spec moves	Ex 9

Worked examples

Worked example Example 1 — Cell A: all children pass (happy path)

Statement. System requirement S3: "All components stay within survival limits." It flows down to three thermal children:

SS3.1 (MLI heat loss): required $\leq 10 W/m^{2}$ , measured $8 W/m^{2}$ .
SS3.2 (eclipse heater): required $\geq 50 W$ , measured $51 W$ .
SS3.3 (radiator): required $\geq 200 W$ , measured $205 W$ .

Is S3 verified? What is the worst (smallest) margin?

Forecast: Guess now — all three beat their numbers, so S3 should pass. Which child is closest to failing?

Step 1 — Check each child against its requirement.

SS3.1: is $8 \leq 10$ ? Yes ✓
SS3.2: is $51 \geq 50$ ? Yes ✓
SS3.3: is $205 \geq 200$ ? Yes ✓

Why this step? The AND-rule ( $⋀$ ) only lets S3 pass if every child is TRUE. So we test them one at a time.

Step 2 — Compute each margin using the right flavour. SS3.1 is a ceiling ( $\leq$ ), so we use $Margin_{\leq}$ (Requirement first). SS3.2 and SS3.3 are floors ( $\geq$ ), so we use $Margin_{\geq}$ (Capability first).

SS3.1 (ceiling): $\frac{10 - 8}{10} \times 100% = \frac{2}{10} \times 100% = 20%$
SS3.2 (floor): $\frac{51 - 50}{50} \times 100% = 2%$
SS3.3 (floor): $\frac{205 - 200}{200} \times 100% = 2.5%$

Why this step? A pass with $2%$ margin is fragile — one hot day and it flips to a fail. Margins tell you how safe the pass is, not just whether it passed. Using the correct flavour keeps the number meaningful (a ceiling margin measures how far below the limit you sit).

Step 3 — Close the loop. All children TRUE $\Rightarrow$ by conjunction, S3 is verified. The weakest link is SS3.2 at $2%$ .

Why this step? The AND-rule only guarantees the parent once every child has been individually confirmed; naming the weakest child ( $2%$ ) hands the review board the single number that would flip S3 to a fail — that is the whole point of computing margins in Step 2.

Verify: Units: $W$ vs $W$ and $W/m^{2}$ vs $W/m^{2}$ — consistent. $(10 - 8) /10 = 0.20 = 20%$ , not $25%$ — a common slip. Sanity: the loop closes and identifies the thinnest margin, exactly what a review board wants.

Worked example Example 2 — Cell B: one child fails, parent fails

Statement. Same three children, but retest of the radiator now reads only $195 W$ (required $\geq 200 W$ ). SS3.1 and SS3.2 still pass. Is S3 verified?

Forecast: Two out of three pass. Does "mostly passing" verify S3? Guess before reading.

Step 1 — Re-evaluate the failing child. SS3.3: is $195 \geq 200$ ? No ✗.

Why this step? The conjunction $⋀$ is unforgiving: it needs all TRUE. A single FALSE makes the whole AND FALSE.

Step 2 — Apply the AND-rule. $(SS3.1 = T) \land (SS3.2 = T) \land (SS3.3 = F) = F$ Therefore S3 is NOT verified, regardless of the two passes.

Step 3 — Compute the negative margin. SS3.3 is a floor ( $\geq 200$ ), so use $Margin_{\geq}$ : $\frac{195 - 200}{200} \times 100% = - 2.5%$

Why this step? The sign of the margin is your headline: negative ⇒ you are short by $5 W$ and must redesign (bigger radiator) or renegotiate the requirement.

Verify: $- 2.5%$ of $200 = - 5 W$ , matching the $195 - 200$ shortfall. Sanity: two green boxes and one red box still means the parent is red.

Worked example Example 3 — Cell C: zero / degenerate input

Statement. A spacecraft in a dawn–dusk sun-synchronous orbit never enters eclipse, so eclipse duration $= 0$ . Battery child SS4.2 required "store enough for eclipse loads." Average eclipse load $300 W$ , eclipse time $t_{ecl} = 0 h$ . How much usable energy does SS4.2 need, and what does that do to the requirement — and can we even quote a margin?

Forecast: With no eclipse, does the battery requirement vanish entirely? And what happens if you try to compute margin? Guess.

Step 1 — Plug the zero in. Energy needed $= P \times t = 300 W \times 0 h = 0 Wh$ .

Why this step? Always test what a zero input does to a formula before assuming the term disappears. Here the eclipse-survival requirement collapses to $0 Wh$ .

Step 2 — Try (and refuse) to compute a margin. The requirement is now $0 Wh$ . The margin formula would give $\frac{Capability - 0}{0} \times 100% = \frac{something}{0} = undefined .$ So per the [!mistake] rule above, we do not report a percentage. We record SS4.2 (eclipse) as "trivially satisfied by inspection" — any non-negative battery capacity meets a zero requirement.

Why this step? Division by zero is not a huge margin, it is no margin defined at all. Reporting "infinite margin" would mislead a reviewer; "trivially satisfied" is the honest, auditable phrase.

Step 3 — Don't over-conclude. SS4.2 for eclipse is auto-passed, BUT a real battery is still required for launch, safe-mode, and load transients — those are separate requirements with their own non-zero numbers and real margins.

Why this step? A degenerate input zeroes one derived requirement, not the component's whole reason to exist. Traceability keeps those requirements as distinct rows.

Verify: $300 \times 0 = 0 Wh$ . Units $W \cdot h = Wh$ . Sanity: the zero requirement is auto-passed and documented, and no margin percentage is quoted (denominator is zero).

Worked example Example 4 — Cell D: limiting / end-of-life boundary

Statement. Solar array: beginning-of-life power $P_{BOL} = 1226 W$ , radiation degradation $d = 2.5%$ per year, mission $t = 15$ years. Requirement SS4.1: $P_{EOL} \geq 600 W$ . Verify.

Forecast: After 15 years of decay, does the array still clear $600 W$ ? Guess a number.

Step 1 — Model the decay. Each year multiplies power by $(1 - d)$ . After $t$ years: $P_{EOL} = P_{BOL} (1 - d)^{t}$

Why this step? Degradation is multiplicative (a fixed fraction lost each year), so it compounds — an exponential $(1 - d)^{t}$ , not a straight subtraction. We use the power law because "same percentage each year" is exactly what defines geometric decay.

Step 2 — Evaluate the limit. $P_{EOL} = 1226 \times (0.975)^{15} \approx 1226 \times 0.6853 \approx 840 W$

Why this step? We do the arithmetic at the worst instant — $t = 15$ , end of life — because that is where the exponential bottoms out; if the number clears $600 W$ here, it cleared it at every earlier, brighter year too.

Step 3 — Compare and margin. This is a floor ( $\geq 600$ ): $840 \geq 600$ ✓, margin $= \frac{840 - 600}{600} \times 100% = 40%$ .

Why this step? The floor margin turns "passes" into "passes with $40%$ headroom," which is the number a review board records as evidence that SS4.1 — and therefore S4 — is safely met.

Read the figure. The black curve below is $P_{BOL} (1 - d)^{t}$ ; it starts at the black BOL dot ( $1226 W$ ) and sags downward as radiation eats the cells. The dashed black line is the $600 W$ requirement floor. The red EOL dot at $t = 15$ sits at $\approx 840 W$ — well above the dashed line. The vertical gap between the red dot and the dashed line is the $40%$ margin: the whole curve stays above the requirement for the entire mission, so the array passes at every instant, not just at the end.

Figure 1 — Solar array power vs. years in orbit. Black curve: $P = P_{BOL} (1 - d)^{t}$ decaying from the black BOL dot ( $1226 W$ ). Dashed black line: the $600 W$ floor requirement. Red dot: the end-of-life point at $t = 15$ , $\approx 840 W$ — its height above the dashed line is the $40%$ margin.

Verify: $ln (0.975) \times 15 \approx - 0.3797$ , $e^{- 0.3797} \approx 0.684$ , times $1226 \approx 839$ . Boundary passes.

Worked example Example 5 — Cell E: negative margin (numeric failure)

Statement. A cheaper array cell gives $P_{BOL} = 780 W$ with the same $d = 2.5%/ yr$ , $t = 15$ . Requirement still $\geq 600 W$ . Does SS4.1 pass?

Forecast: BOL is only $780$ ; will 15 years of decay push it under $600$ ? Guess.

Step 1 — Same decay law. $P_{EOL} = 780 \times (0.975)^{15} \approx 780 \times 0.6853 \approx 535 W$ .

Why this step? We reuse the identical geometric-decay law from Example 4 because the physics (fixed fractional loss per year) is unchanged — only the starting power differs.

Step 2 — Margin (floor $\geq 600$ ): $\frac{535 - 600}{600} \times 100% \approx - 10.8%$

Why this step? The sign is the verdict: negative ⇒ SS4.1 FAILS, and by flow-down S4 (power) fails, and any mission requirement depending on S4 is now at risk.

Step 3 — What breaks upward. Because $⋀$ needs SS4.1 TRUE, and it's FALSE, S4 is FALSE. Fix options: bigger array area, better cells (higher BOL), or shorter mission (smaller $t$ ).

Why this step? Tracing the failure upward tells the program exactly which parent (S4) is now unmet, and enumerating fixes turns a red margin into an actionable design decision.

Verify: $780 \times 0.6853 = 534.5 W < 600$ . $(- 65/600) = - 0.108$ . Fails as claimed.

Worked example Example 6 — Cell F: exactly-zero margin (the boundary)

Statement. Array delivers exactly the required EOL power: capability $= 600 W$ , requirement $= 600 W$ . Pass or fail?

Forecast: Equal to the requirement — is that a pass?

Step 1 — Margin (floor $\geq 600$ ): $\frac{600 - 600}{600} \times 100% = 0%$

Why this step? Zero margin means "meets requirement with no cushion." Mathematically $600 \geq 600$ is TRUE, so it passes the letter of the spec.

Step 2 — Engineering judgement. Real programs demand a positive margin (often $\geq 5 - 10%$ ) at review, because measurement error alone could flip a $0%$ pass to a fail.

Why this step? The math says pass; the process says "unacceptably risky." Traceability records it as pass with zero margin and flags it for a waiver.

Verify: $600 - 600 = 0$ . Boundary case: passes logically, flagged operationally.

Worked example Example 7 — Cell G: real-world word problem

Statement. "An Earth-imaging satellite must resolve objects $10 m$ across from a $500 km$ orbit. Its camera focal length is $2 m$ and each detector pixel is $6 μ m$ ." Does the design meet the resolution requirement? Build the traceability chain M1 → S1 → SS1.x.

Forecast: Guess whether $6 μ m$ pixels are small enough for $10 m$ ground resolution.

Step 1 — Find the tool. Ground sample distance (GSD) — the patch of ground one pixel sees — comes from similar triangles: pixel size $p$ is to focal length $f$ as GSD is to altitude $H$ . $\frac{GSD}{H} = \frac{p}{f} ⟹ GSD = \frac{p H}{f}$

Why this step? We use similar triangles because the lens forms a scaled image: the small triangle (pixel over focal length) and the big triangle (ground patch over altitude) share the same shape. That is exactly the geometry the ratio $p / f$ encodes.

Read the figure. In the picture below the lens is the black dot in the middle. Above it, the small black triangle has base = one pixel ( $6 μ m$ ) and height = the focal length ( $2 m$ ). Below it, the large triangle has base = the red ground patch (the GSD we want) and height = the altitude ( $500 km$ ). The two triangles are mirror images through the lens, so they are similar — equal shape, different size — which is exactly why the ratios $p / f$ and $GSD / H$ are equal. The red base is the one unknown we solve for.

Figure 2 — Pinhole/lens similar-triangles geometry. Black dot: the lens. Small black triangle above: base = one pixel ( $6 μ m$ ), height = focal length ( $2 m$ ). Large triangle below: height = altitude ( $500 km$ ), red base = the ground sample distance (GSD) we solve for. Equal shapes ⇒ $p / f = GSD / H$ .

Step 2 — Compute GSD (put everything in metres: $p = 6 \times 1 0^{- 6} m$ , $H = 5 \times 1 0^{5} m$ , $f = 2 m$ ). $GSD = \frac{( 6 \times 1 0 ^{- 6} ) ( 5 \times 1 0 ^{5} )}{2} = \frac{3}{2} = 1.5 m$

Why this step? We convert everything to one unit (metres) before multiplying, because mixing $μ m$ , $km$ and $m$ in the same fraction is the single most common way to get a GSD wrong by a factor of a thousand.

Step 3 — Compare to requirement. Resolution is a ceiling ( $\leq 10 m$ : smaller GSD = sharper), so use $Margin_{\leq}$ : $\frac{10 - 1.5}{10} \times 100% = 85%.$ $1.5 m \leq 10 m$ ✓ with $85%$ margin — the design PASSES with wide room to spare.

Why this step? Resolution is smaller-is-better, so we must use the ceiling margin (Requirement first) — using the floor formula here would give a misleading sign. The huge $85%$ margin says the pixels are far finer than needed.

Step 4 — Complete the traceability chain. $M1 (10 m resolution) \to S1 (camera GSD \leq 10 m) \to {SS1.1, SS1.2, SS1.3}$ where the children are SS1.1: focal length $f = 2 m$ , SS1.2: orbit altitude $H = 500 km$ , SS1.3: pixel pitch $p = 6 μ m$ . All three feed the GSD formula; their combined result ( $1.5 m \leq 10 m$ ) satisfies S1, and by conjunction $SS1.1 \land SS1.2 \land SS1.3 \Rightarrow S1$ verified $\Rightarrow$ M1 verified.

Why this step? The chain is the deliverable: it proves with a formula and a number that the top-level mission requirement M1 is met by the three physical design choices, and it is exactly what a review board audits.

Verify: $6 \times 1 0^{- 6} \times 5 \times 1 0^{5} = 3$ ; $3/2 = 1.5 m$ . Units: $m \cdot m / m = m$ ✓. Ceiling margin $(10 - 1.5) /10 = 0.85 = 85%$ ✓.

Worked example Example 8 — Cell H: exam twist — the unverifiable requirement

Statement. A draft spec reads: SS7: "The spacecraft shall be reliable." Your task: explain why this cannot be verified, and rewrite it so it can.

Forecast: Guess what's wrong before reading — is it the design or the wording?

Step 1 — Test for verifiability. A good requirement must be measurable: it needs a quantity, a value, and a method. "Reliable" has none — there is no number to test against.

Why this step? Every V-model right-arm activity is verify a number. If the left arm gives no number, the horizontal traceability line has nothing to point at. See Verification vs Validation.

Step 2 — Rewrite it. Replace the vague adjective with a testable statement:

"The spacecraft shall achieve a mission reliability $R \geq 0.90$ over 5 years, demonstrated by fault-tree analysis."

Now it has a metric ( $R$ ), a value ( $0.90$ ), a timeframe (5 yr) and a method (analysis).

Why this step? Turning an adjective into a metric+value+method is the only way to hang a verification test on the requirement — otherwise it can never be closed on the V-model's right arm.

Step 3 — Numeric sanity. If the design has 3 independent critical strings each of reliability $0.966$ , the series reliability is $R = 0.96 6^{3} \approx 0.901 \geq 0.90 ✓$

Why this step? Serial systems multiply (the AND-rule again, in probability form): all strings must survive, so their probabilities multiply — and the product must still clear the newly-quantified floor.

Verify: $0.96 6^{3} = 0.9014 \geq 0.90$ . The rewritten requirement is now testable and passes.

Worked example Example 9 — Cell I: impact analysis when a requirement changes

Statement. The customer changes M3 from "survive $- 4 0^{\circ} C$ " to "survive $- 5 0^{\circ} C$ ." Using traceability, which children must be re-examined, and does the eclipse heater still suffice? The interior is held at $+ 2 0^{\circ} C$ ; the old eclipse heater delivered $51 W$ (required $\geq 50 W$ ), and eclipse heat loss scales linearly with the interior-to-exterior temperature gap.

Forecast: Guess how many downstream items a single top-level change disturbs — and whether the existing $51 W$ heater survives the colder floor.

Step 1 — Follow links downward. M3 → S3 → {SS3.1 MLI, SS3.2 heater, SS3.3 radiator}. A colder survival floor stresses heat retention, so SS3.1 (MLI) and SS3.2 (heater) are impacted; SS3.3 (radiator, a hot-case item) is not.

Why this step? Impact analysis is traceability run backwards then forwards: from the changed parent, walk every child link and ask "does this number depend on the changed value?"

Step 2 — Recompute the heater need. Eclipse heat loss $\propto$ temperature gap. Old gap (interior $+ 20$ to exterior $- 40$ ): $20 - (- 40) = 6 0^{\circ}$ , old heater sized $50 W$ . New gap (interior $+ 20$ to exterior $- 50$ ): $20 - (- 50) = 7 0^{\circ}$ . Scale the required heater power by the gap ratio: $P_{new} = 50 \times \frac{70}{60} \approx 58.3 W$

Why this step? Because the loss is proportional to the gap, a bigger gap needs proportionally more heater power to hold the same interior temperature — so we multiply the old requirement by $70/60$ .

Step 3 — Check the installed heater against the new requirement. Installed capability is still $51 W$ ; new requirement is $58.3 W$ (a floor, $\geq$ ): $\frac{51 - 58.3}{58.3} \times 100% \approx - 12.5%$ $51 < 58.3$ ⇒ SS3.2 now FAILS. The heater must be resized (bigger heater) or the interior setpoint lowered.

Why this step? The negative margin is the alarm bell: the requirement change has broken a previously-passing child. Only two tests (MLI, heater) need re-running, not the whole spacecraft — that is the payoff of traceability. See Configuration Management and Requirements Derivation.

Step 4 — Report the ripple. Changed: M3. Impacted children: SS3.1, SS3.2 (SS3.3 untouched). Failing child after change: SS3.2. Re-verification needed: T-SS3.1-001 and T-SS3.2-001 only.

Why this step? Documenting the exact ripple set is the auditable output of impact analysis — it tells the configuration board precisely what to re-open and what to leave frozen. See Configuration Management.

Verify: $50 \times 70/60 = 58.33 W$ ; $51 < 58.33$ ; $(51 - 58.33) /58.33 = - 0.1257 \approx - 12.5%$ . Change correctly ripples to exactly the two thermal-retention children.

Recall Quick self-check

AND-rule: one child fails, does the parent pass? ::: No — $⋀$ needs every child TRUE. Margin formula for a ceiling requirement (smaller-is-better)? ::: $(Req - Capability) / Req \times 100%$ . What is the margin when the requirement equals $0$ ? ::: Undefined — report "trivially satisfied by inspection," never a percentage. A requirement says "shall be robust." Verifiable? ::: No — no metric/value/method; rewrite with a number. Solar decay $(1 - d)^{t}$ : why a power, not subtraction? ::: Loss is a fixed fraction each year, so it compounds (geometric). Zero eclipse time ⇒ eclipse battery energy? ::: $P \times 0 = 0 Wh$ ; requirement auto-passes but stays documented. GSD formula from a 500 km orbit? ::: $GSD = p H / f$ (similar triangles).

Related: Systems Engineering Fundamentals · Interface Control Documents · Spacecraft Integration and Testing · Risk Management in Spacecraft Design