Reactis Use Cases#
For the following sections, if the section title is X, then the section answers the question How does Reactis help with X?
Back-to-Back Testing of C Code Against Model#
Back-to-back testing of C code against a model is one of the most common use cases for Reactis.

The workflow to check if foo.c
conforms to foo.slx
is as follows:
Start Reactis for Simulink, select File > Open Model…, select
foo.slx
.If ranges for top-level inports are specified in the Simulink Data Dictionary, those will be automatically imported. If ranges are not available in the Simulink model, you can specify them in Reactis by selecting Edit > Inports.
Launch Reactis Tester by selecting Test Suite > Create…. In the launch dialog, for Output file specify
foo_tests.rst
.When Tester completes examine the level of coverage attained by the generated tests. If the level of coverage is not high enough, then return to step 3 and run Tester again, giving it more time to generate tests. Otherwise, proceed to step 5.
Start Reactis for C, select File > New Build File…, add
foo.c
to the build file. A build file is like a Makefile, it names all the C files that comprise the application. Here we assume there is only a single C file. To confirm the code compiles in Reactis, click the Build button, save the new .rsm file when prompted, inspect compile results. If there are no errors proceed to step 6.Select Edit > New Harness…, to create a harness for testing the C code. A harness defines the entry function for the code, as well as the top-level inputs and outputs. For back-to-back testing these must match the model.
In the Create Harness dialog, give the harness a name and specify the entry function. Select Create harness from .rsi file and for RSI file enter
foo.rsi
to tell Reactis we want this harness to test the C code against thefoo.slx
model. Click Ok.Click the green button in the Reactis for C toolbar to enable Reactis Simulator.
After Simulator starts, select Test Suite > Open, then select the test suite
foo_tests.rst
which was generated from the modelfoo.slx
. Note that Reactis test suites store the outputs computed by the model in addition to the inputs which drive the test.Select Simulate > Fast Run with Report… to run the just loaded test suite on the C code. The generated HTML report will indicate if there were any differences between the output values computed by the code when compared against the values stored in the test (which came from the model).
Security Testing#
Reactis supports security testing in a model-based design process with Simulink through its ability to find vulnerabilities in both Simulink models and C code. Reactis for Simulink works with Simulink models and Reactis for C can be applied directly to C code.
Reactis for Simulink identifies potential run-time errors that can occur in a Simulink model such as bad indexing, integer overflow, integer division by zero, or floating point operations that result in an Inf or NaN value. For each potential run-time error, Reactis constructs a run-time error assertion (RTE assertion) which is a logical expression which evaluates to false if the run-time error occurs, otherwise it evaluates to true. A circled check mark is drawn on a Simulink block or Stateflow state or transition anywhere a potential run-time error has been identified.

Reactis employs both static and dynamic techniques to ensure that none of the identified run-time errors can occur. It first does a static check to identify potential failures that can never occur. For such errors that are impossible (a good thing), the circled check mark is drawn in green to convey the good news. For errors not proved impossible, Reactis then uses dynamic techniques to search for errors. If it finds an error, the circled check mark becomes red and yellow and a test is returned that can be executed to diagnose and debug the problem. One benefit of this approach is that there are no false positives, any detected run-time error has a concrete test that can be executed to reproduce the error.
Reactis Tester is the component of Reactis that performs both the static and dynamic analysis. It is easy to run on any Simulink model, just load the model in Reactis and select Test Suite > Create. The dynamic test generation produces a test suite (set of tests). In addition to finding run-time errors, Tester has the goal of maximizing test coverage with respect to a collection of coverage metrics including decision coverage, condition coverage, and MC/DC coverage. The fact that Reactis Tester also aims to maximize coverage, increases the probability of detecting run-time errors. Tester uses a patented technique called guided simulation to generate the tests. The basic idea is to simulate the model, but at each step select inputs that either exercise new coverage targets or cause a run-time error to occur. The technique is somewhat like fuzzers used in the security community, but the guided aspect of the simulation makes it more targeted at covering all coverage targets and finding run-time errors, i.e. it is a white-box approach.
Tests leading to an error can be executed in Reactis Simulator, an advanced debug environment for Simulink models. Simulator can also generate detailed reports that describe coverage and details of run-time error checking.
Reactis for C works in a way similar to Reactis for Simulink but directly works with C code instead of Simulink models. In addition to the types of run-time errors described above for models, Reactis for C also identifies and flags a variety of different types of memory errors in C code.
Eliminating run-time errors with Reactis from both Simulink models and C code is an important tool for ensuring the security of applications developed using model-based design. Each potential run-time error identified by Reactis is a potential vulnerability that could be exploited. Ensuring run-time errors cannot occur is an important step towards a secure application. The push-button nature of the checks make it easy to apply throughout the development of an application or via the Reactis API in a continuous integration system such as Jenkins.