Topic · Software design document

What is a software design document, and how do I keep it true in CI?

Gist

A software design document is the architecture and unit design that still match this graph. Proof prints that document from the current traces with proof doc generate sdd, then fails the merge when the graph is stale.

proof doc generate sdd --output docs/sdd.html

Keep Jama if you author the programme. Keep VectorCAST or LDRA if you need a qualified C toolchain. Proof is not that review, and a printed SDD is not proof the architecture is complete.

Request demo Last SDD vs this push

01 · The dated design pack

An SRS is not an SDD. Last review's SDD is not this push.

The design document lists components, interfaces, variables, and which shalls sit on which unit. A person can fill those once. The next commit does not reopen Word.

The NASA SRS artefact lives on NPR 7150.2D. Automotive Part 6 lives on ISO 26262. Medical 5.3/5.4 lives on IEC 62304. This page is the document: render sdd from the graph you already gate.

The template is seven sections from loaded project data: introduction with counts, a Mermaid component diagram, per-component interfaces and variables, data design from the variable table, the full interface list, and requirement-to-component traces. It is not a human architecture review. It will not invent a component you did not declare.

proof validate --preflight
proof doc generate sdd --format html --output docs/sdd.html
proof audit --fail-level warn

The first command rejects a sentence the templates cannot parse. The second renders HTML (or Markdown) from the current graph. PDF is a separate path and currently fails. The third is the standing gate. Generating the SDD before traces are refreshed is how last review's pack got stale.

02 · The exhibit

Same section titles. A date, or this graph.

The Word file still has architecture headings. The graph moved. Click the tabs.

Word / Confluence

Opened architecture from last PDR
rate_limiter still in section 3

Sections present

This push

The interface changed. The pack did not.

No re-render

Word / Confluence

Still last PDR. Still a date.

Keep the review minutes

Proof

Ask does sdd still match traces
Gate audit --fail-level warn

Merge blocked if the graph is stale

Same section titles. A date, or this graph. Click the tabs.

Who	What they notice	What they lose
Word / Confluence	Section titles, a date, a diagram someone pasted	The next commit does not reopen the file. Keep the minutes. Do not treat the paste as this graph.
Jama / Polarion	A stored shall, a design object, a review workflow	They author the programme. They do not emit the SDD from the current traces. Keep them.
VectorCAST / LDRA	A qualified C toolchain and structural coverage	They still win at airborne and automotive C with a DER. The four-jobs H1 lives on DO-178C-style.
Proof	Current traces rendered into `sdd`, then the same audit on every push	Not a complete architecture. Tests are not executed. Not DO-330. Jama still authors.

The generate command loads the project, then one template, then one format:

proof doc list-templates
proof doc generate sdd --format md --output docs/sdd.md
proof doc generate sdd --format html --output docs/sdd.html
proof audit --fail-level warn

Unknown template names fail before render. Unsupported formats fail before render. HTML and Markdown are the supported pair. PDF is classified separately and currently errors. Treat generated output as a view of the graph, not as a second source of shalls. If documentation coverage is low, the SDD is a thin print of a thin graph.

We have not run this template against a frozen SDD corpus, and we have not scored it against VectorCAST or LDRA on the same pack. The loss is named, not scored.

03 · The honest loss

A green Proof audit is not a design review.

The SDD reflects the authored model. Proof will not pretend that print proves the architecture is complete or appropriate.

NPR 7150.2D section 3.3 still wants a human to judge whether the design satisfies the software requirements. The generated document lists what you declared: components, interfaces, variables, traces. It does not independently prove those declarations are the right decomposition. Keep the PDR. Keep the minutes.

DO-178C section 11.10 names a Software Design Description. ISO 26262 Part 6 names architectural and unit design. IEC 62304 names 5.3 and 5.4. Those regulator H1s stay on their own URLs. This URL is the artefact they all print. Code-level coverage still wants the qualified toolchain. Tests are not executed. Keep go test.

Jama still authors. The NASA SRS still lives on NPR 7150.2D. The four jobs still live on DO-178C-style verification.

Request demo How the install is bought

04 · Nearby questions

What people type next.

What is ISO 26262? Automotive functional safety. Part 6 is software. Same sdd template, different regulator. ISO 26262.

What is IEC 62304? Medical software. Clauses 5.3 and 5.4. IEC 62304.

What is NPR 7150.2D? NASA's software engineering procedure. The SRS artefact lives on that URL. This page is the design document, not a twin.

What is a software requirements specification? The shalls. Proof prints those with npr7150-srs. The SDD is what sits under the shalls.

I need DO-178C style verification but I'm not in aerospace. What can I use? The four jobs, not the Type Certificate. DO-178C-style.

What is a requirements traceability matrix, and how do I keep it true? The SDD wants the links re-derived, not pasted. RTM.