Formal Requirements Specification Research Articles

Formal Specification and Verification of Requirements in Architecture and Construction using the EXPRESS Modeling Language

Formal Specification and Verification of Requirements in Architecture and Construction using the EXPRESS Modeling Language

A journey with ASMETA from requirements to code: application to an automotive system with adaptive features

Modern automotive systems with adaptive control features require rigorous analysis to guarantee correct operation. We report our experience in modeling the automotive case study from the ABZ2020 conference using the ASMETA toolset, based on the State Machine formal method. We adopted a seamless system engineering method: from an incremental formal specification of high-level requirements to increasingly refined ASMETA models, to the C++ code generation from the model. Along this process, different validation and verification activities were performed. We explored modeling styles and idioms to face the modeling complexity and ensure that the ASMETA models can best capture and reflect specific behavioral patterns. Through this realistic automotive case study, we evaluated the applicability and usability of our formal modeling approach.

SOTIF-Oriented Perception Evaluation Method for Forward Obstacle Detection of Autonomous Vehicles

The inclusion of autonomous vehicles into our society requires not only mature automated technologies but also adequate confidence in safety guarantees. Safety of the intended functionality (SOTIF) is an incipient important field that focuses on risk led by performance limitations rather than faults. There are still plenty of gaps in addressing it, especially when concerning perception ability. This article introduces a method to evaluate SOTIF-oriented perception effectiveness for forward obstacle detection of autonomous vehicles. Both inevitable existence uncertainty and state uncertainty in perception results are taken into account, and a formal SOTIF requirement specification is defined. Based on the safety distance model, we further deduce the minimum required perception area and the perception error requirements under a given driving situation to refine the SOTIF requirement specification. Then, a SOTIF-oriented unified sensing model is established by combining sensing space and ability characteristics. The system-level perception ability of an autonomous vehicle is subsequently deduced with the assumption that every available sensor is described in the form of our proposed sensing model. Evaluation can be executed according to the above methods that support determining the SOTIF requirements and the system-level perception ability, and the entire evaluation process is presented as an algorithm in this article. Finally, a practical case generated according to a well-known autonomous vehicle prototype is used to prove the effectiveness of the method. Evaluation results can serve as suggestions to improve the overall SOTIF level for perception.

State-Constraint Transition: A Language for the Formal Specification of Dynamic Cyber-System Requirements

Existing formal languages for the specification of self-adaptive cyber-physical systems focus on re-configuring the system-to-be depending on its current context, to satisfy the user’s requirements, that is by dynamically composing the software’s structure and behavior. While these approaches specify context-sensitive requirements, they rarely consider their run-time dynamic and scalable nature. The State-Constraint Transition (SCT) modeling language, introduced in this paper, provides an answer to the problems linked to the specification of dynamic requirements by introducing the concept of configuration states, in which requirements are translated into constraints. The expressiveness of existing approaches is thus extended, combining the ease of use of well-established notations, notably those based on characteristics, and those based on Finite-state Machines (FSM), with the computational power and expressiveness of the constraint programming approach. The paper briefly presents the results of the preliminary evaluation, which assesses the expressiveness, scalability, and domain independence of the SCT language.

State-Constraint Transition: A Language for the Formal Specification of Dynamic Cyber-System Requirements

Existing formal languages for the specification of self-adaptive cyber-physical systems focus on re-configuring the system-to-be depending on its current context, to satisfy the user’s requirements, that is by dynamically composing the software’s structure and behavior. While these approaches specify context-sensitive requirements, they rarely consider their run-time dynamic and scalable nature. The State-Constraint Transition (SCT) modeling language, introduced in this paper, provides an answer to the problems linked to the specification of dynamic requirements by introducing the concept of configuration states, in which requirements are translated into constraints. The expressiveness of existing approaches is thus extended, combining the ease of use of well-established notations, notably those based on characteristics, and those based on Finite-state Machines (FSM), with the computational power and expressiveness of the constraint programming approach. The paper briefly presents the results of the preliminary evaluation, which assesses the expressiveness, scalability, and domain independence of the SCT language.

A review on security requirements specification by formal methods

AbstractSecurity is an afterthought process for the development of software in earlier days but now the time has been changed. Now, security is on top priority and involved from the beginning of software development. Security requirements are the prime concern for the development and quality of any software product. The specification and verification of security requirements need a lot of attention from the computer science community in the process of the software development life cycle. Formal Methods are a widely used and well‐recognized approach for the specification and verification of any safety‐critical system. Formal methods play an important role in the requirement phase to the design phase of software development. In this study, we summarized the outcomes of related papers to find out the current state of the art in the proposed area. In this manuscript, three research questions are frame and we try to find the answer to these research questions to the best of our effort and knowledge. The objective of this research paper is to find out the gap analysis, state of art, and trends in the proposed area. The academician needs to pursue more effort toward the formal specification of security requirements, providing a deeper understanding to help security experts in the development of systems.

A formal approach to support the identification of unsafe control actions of STPA for nuclear protection systems

STPA (System-Theoretic Process Analysis) is a widely used safety analysis technique to identify UCAs (Unsafe Control Actions) resulting in potential losses. It is totally dependent on the experience and ability of analysts to construct an information model called Control Structures, upon which analysts try to identify unsafe controls between system components. This paper proposes a formal approach to support the manual identification of UCAs, effectively and systematically. It allows analysts to mechanically extract Process Model, an important element that makes up the Control Structures, from a formal requirements specification for a software controller. It then concisely constructs the contents of Context Tables, from which analysts can identify all relevant UCAs effectively, using a software fault tree analysis technique. The case study with a preliminary version of a Korean nuclear reactor protections system shows the proposed approach's effectiveness and applicability.

Designing physical systems through a model-based synthesis approach. Example of a Li-ion battery for electrical vehicles

This paper presents an approach for the preliminary design of complex physical systems in the framework of systems engineering. This approach is centered on the activities and actors involved in the pre-design tasks. It focuses on the modeling of design problems with DEPS (DEsign Problem Specification), a recent formalism for specifying and modeling design problems in engineering. This design methodology completes simulation-based analysis approaches, which are mainly used today for the design of physical systems. In particular, our approach allows the synthesis of pre-design architectures, which analysis/simulation approaches cannot do. Starting from the textual specification of the requirements, the proposed approach builds a formal model of the design problem and solves it using Constraint Programming. Ideas and concepts related to this approach are discussed: the issue of reusability of problem models, the concepts of problem, knowledge and solutions spaces as well as the formal specification of requirements and everything else that distinguish a design problem model from a designed system model. An example of a Li-ion battery design for an electric vehicle acts as a practical use case for this article.

Correct Audit Logging in Concurrent Systems

Audit logging provides post-facto analysis of runtime behavior for different purposes, including error detection, amelioration of system operations, and the establishment of security in depth. This necessitates some level of assurance on the quality of the generated audit logs, i.e., how well the audit log represents the events transpired during the execution. Information-algebraic techniques have been proposed to formally specify this relation and provide a framework to study correct audit log generation in a provable fashion. However, previous work fall short on how to guarantee this property of audit logging in concurrent environments. In this paper, we study an implementation model in a concurrent environment. We propose an algorithm that instruments a concurrent system according to a formal specification of audit logging requirements, so that any instrumented concurrent system guarantees correct audit log generation. As an application, we consider systems with microservices architecture, where logging an event by a microservice is conditioned on the occurrence of a collection of events that take place in other microservices of the system.

Service selection and workflow composition in modern business processes

Abstract Enterprises heavily rely on the state-of-the-art information technologies user behaviors and social system to sustain business competitiveness. Service-Oriented Architecture (SoA) and Cloud allow enterprises to utilize dynamic distributed services across enterprise boundaries and even individuals. Based on the needs of society, enterprise can spin off a virtual enterprise for new businesses where the demanded manufacturing resources are obtained through service selection and workflow composition over the Internet. An increasing number of Internet of Things (IoT) services make enterprises facing the challenge to select preferable services for their business workflows. We improve workflow compositions methods at three major aspects: (1) we present an integrated approach for service selection and composition to meet the needs of users and social system. (2) We extend Service Workflow Specification (SWSpec) as a formal requirement specification to determine a design space of services. (3) We introduce the Fuzzy Analytic Hierarchy Process (F-AHP) to evaluate non-functional specifications quantitatively with less uncertainty. Appropriate rankings can be assigned to available services based on non-functional requirements to determine the best-suited services with less uncertainty.

Formal Specification and Analysis of Requirements using SpeAR

PDF of Powerpoint Slides

Using Formal Methods For Quality Assurance OfInterlocking Systems

"Formal methods" denotes mathematical techniques making it possible to perform a formal mathematical proof of the compliance or noncompliance of a system to its specification. We discuss the views of the Swedish National Rail Administration on the use of formal methods to increase safety and reliability of safety-critical signalling systems. As a study, a formal requirements specification for interlockings has been developed, and an existing relay-based interlocking of a common design has been modelled and analysed. The analysis uncovered a safetycritical design error which had not been discovered using the traditional methods of quality assurance. Transactions on the Built Environment vol 34, © 1998 WIT Press, www.witpress.com, ISSN 1743-3509

Operational Semantics of Annotated Reflex Programs

Reflex is a process-oriented language that provides a design of easy-to-maintain control software for programmable logic controllers. The language has been successfully used in a several reliability critical control systems, e. g. control software for a silicon single crystal growth furnace and electronic equipment control system. Currently, the main goal of the Reflex language project is to develop formal verification methods for Reflex programs in order to guarantee increased reliability of the software created on its basis. The paper presents the formal operational semantics of Reflex programs extended by annotations describing the formal specification of software requirements as a necessary basis for the application of such methods. A brief overview of the Reflex language is given and a simple example of its use – a control program for a hand dryer – is provided. The concepts of environment and variables shared with the environment are defined that allows to disengage from specific input/output ports. Types of annotations that specify restrictions on the values of the variables at program launch, restrictions on the environment (in particular, on the control object), invariants of the control cycle, pre- and postconditions of external functions used in Reflex programs are defined. Annotated Reflex also uses standard annotations assume, assert and havoc. The operational semantics of the annotated Reflex programs uses the global clock as well as the local clocks of separate processes, the time of which is measured in the number of iterations of the control cycle, to simulate time constraints on the execution of processes at certain states. It stores a complete history of changes of the values of shared variables for a more precise description of the time properties of the program and its environment. Semantics takes into account the infinity of the program execution cycle, the logic of process transition management from state to state and the interaction of processes with each other and with the environment. Extending the formal operational semantics of the Reflex language to annotations simplifies the proof of the correctness of the transformation approach to deductive verification of Reflex programs developed by the authors, transforming an annotated Reflex program to an annotated program in a very limited subset of the C language, by reducing a complex proof of preserving the truth of program requirements during the transformation to a simpler proof of equivalence of the original and the resulting annotated programs with respect to their operational semantics.

Multioracle Coevolutionary Learning of Requirements Specifications from Examples in On-The-Fly Markets.

In software engineering, the imprecise requirements of a user are transformed to a formal requirements specification during the requirements elicitation process. This process is usually guided by requirements engineers interviewing the user. We want to partially automate this first step of the software engineering process in order to enable users to specify a desired software system on their own. With our approach, users are only asked to provide exemplary behavioral descriptions. The problem of synthesizing a requirements specification from examples can partially be reduced to the problem of grammatical inference, to which we apply an active coevolutionary learning approach. However, this approach would usually require many feedback queries to be sent to the user. In this work, we extend and generalize our active learning approach to receive knowledge from multiple oracles, also known as proactive learning. The ``user oracle'' represents input received from the user and the "knowledge oracle" represents available, formalized domain knowledge. We call our two-oracle approach the "first apply knowledge then query" (FAKT/Q) algorithm. We compare FAKT/Q to the active learning approach and provide an extensive benchmark evaluation. As result we find that the number of required user queries is reduced and the inference process is sped up significantly. Finally, with so-called On-The-Fly Markets, we present a motivation and an application of our approach where such knowledge is available.

JPIAspectZ: A Formal Requirement Specification Language for Joint Point Interface AOP Applications

Aspect-oriented software development (AOSD) solves a few issues of the object-oriented software development (OOSD) approach and adds a few more concerning modules and their relationships. Join point interface (JPI) is an AOSD methodology that by the definition of the interface between advised artifacts and aspects solves associated AOSD issues to get software with a high modularity level. Looking for a JPI software development approach, this article proposes and exemplifies the use of JPIAspectZ, an extension of the formal aspect-oriented language AspectZ for the software JPI requirement specifications. Mainly, JPIAspectZ looks for a concept and model consistency in a JPI software development process. Since the main JPI characteristics are the joining point interfaces definitions, i. e. explicit associations definition between aspects and advised modules, thus, by JPI, classes are no longer oblivious of possible interaction with aspects, and aspects, for their action effectiveness, do not depend anymore on signatures of advisable module components. JPIAspectZ fully supports these JPI principles. As JPI application examples, this article shows the formal requirements specification for classic aspect-oriented and JPI examples, along with describing the advantages and disadvantages of this language.

Translation of IEC 61131-3 Function Block Diagrams to PVS for Formal Verification with Real-Time Nuclear Application

The trip computers for the two reactor shutdown systems of the Ontario Power Generation (OPG) Darlington Nuclear Power Generating Station are being refurbished due to hardware obsolescence. For one of the systems, the general purpose computer originally used is being replaced by a programmable logic controller (PLC). The trip computer application software has been rewritten using function block diagrams (FBDs), a commonly used PLC programming language defined in the IEC 61131-3 standard. The replacement project’s quality assurance program requires that formal verification be performed to compare the FBDs against a formal software requirements specification written using tabular expressions (TEs). The PVS theorem proving tool is used in formal verification. Custom tools developed for OPG are used to translate TEs and FBDs into PVS code. In this paper, we present a method to rigorously translate the graphical FBD language to a mathematical model in PVS using an abstract syntax to represent the FBD constructs. We use an example from the replacement project to demonstrate the use of the model to translate a FBD module into a PVS specification. We then extend that example to demonstrate the method’s applicability to a Simulink-based design.

Research on formalization of efficient query application problems with compound condition in software development

This paper provides a formalized definition of the application problem of compound condition query (CCQ) and a formal method of applying requirements elicitation based on trace information space derived from trace algebra. With the formalized process of solving the application problem of CCQ, formal requirements specification of application of CCQ is given, a formalized and automatic mapping of the results of requirements elicitation to the formal requirements specification is performed, the software system model and the application code are developed. Through a sample application of comprehensive query on housing information, the feasibility of formalized and automatic software development for the application problem of CCQ is proved. The result has important implications for the other problems regarding formalization and automatic software development.

GODA: A goal-oriented requirements engineering framework for runtime dependability analysis

Context: Many modern software systems must deal with changes and uncertainty. Traditional dependability requirements engineering is not equipped for this since it assumes that the context in which a system operates be stable and deterministic, which often leads to failures and recurrent corrective maintenance. The Contextual Goal Model (CGM), a requirements model that proposes the idea of context-dependent goal fulfillment, mitigates the problem by relating alternative strategies for achieving goals to the space of context changes. Additionally, the Runtime Goal Model (RGM) adds behavioral constraints to the fulfillment of goals that may be checked against system execution traces.Objective: This paper proposes GODA (Goal-Oriented Dependability Analysis) and its supporting framework as concrete means for reasoning about the dependability requirements of systems that operate in dynamic contexts.Method: GODA blends the power of CGM, RGM and probabilistic model checking to provide a formal requirements specification and verification solution. At design time, it can help with design and implementation decisions; at runtime it helps the system self-adapt by analyzing the different alternatives and selecting the one with the highest probability for the system to be dependable. GODA is integrated into TAO4ME, a state-of-the-art tool for goal modeling and analysis.Results: GODA has been evaluated against feasibility and scalability on Mobee: a real-life software system that allows people to share live and updated information about public transportation via mobile devices, and on larger goal models. GODA can verify, at runtime, up to two thousand leaf-tasks in less than 35ms, and requires less than 240 KB of memory.Conclusion: Presented results show GODA’s design-time and runtime verification capabilities, even under limited computational resources, and the scalability of the proposed solution.

OOAspectZ and aspect-oriented UML class diagrams for Aspect-oriented software modelling (AOSM)

Regarding modularised software development, Aspect-oriented programming (AOP) identifies and represents individually crosscutting concerns during the software development cycle's programming stage. This article proposes and applies OOAspectZ to formal Aspect-oriented requirement specifications for prior stages of the software development cycle. It particularly concerns requirement specification and the structural design of data and behaviour, along with describing and applying Aspect-oriented UML class diagrams to designing classes, aspects and associations among classes and aspects during Aspect-oriented software development (AOSD). OOAspectZ is a language integrating both Object-Z and AspectZ formal languages whereas Aspect-oriented UML class diagrams represent AOP code, object class and crosscutting concern class structure by means of stereotypes. This article shows and applies the main OOAspectZ and AO UML class diagram characteristics to Aspect-oriented software modelling (AOSM) using a classic example of AOP. Ideas for future work concerning an actual AOP version are also indicated.

SWSpec: The Requirements Specification Language in Service Workflow Environments

Advanced technologies have changed the nature of business processes in the form of services. In coordinating services to achieve a particular objective, service workflow is used to control service composition, execution sequences as well as path selection. Since existing mechanisms are insufficient for addressing the diversity and dynamicity of the requirements in a large-scale distributed environment, developing formal requirements specification is necessary. In this paper, we propose a Service Workflow Specification language, called SWSpec, which allows arbitrary services in a workflow to formally and uniformly impose their requirements. As such, the solution will provide a formal way to regulate and control workflows as well as enrich the proliferation of service provisions and consumptions in opened environments.