Formal Requirements Specification Research Articles

Integration of Informal and Formal Development of Object-Oriented Safety-Critical Software: A Case Study with the KeY System

The KeY system allows integrated informal and formal development of object oriented Java software. In this paper we report on a major industrial case study involving safety-critical software for computation of a particular kind of railway time table used by train drivers. Our case study includes formal specification of requirements on the analysis and the implementation level. Particular emphasis in our research is put on the challenge of how authoring and maintenance of formal specifications can be made easier. We demonstrate that the technique of specification patterns implemented in KeY for the language OCL yields significant improvements.

Temporal logic properties of Java objects

Applying finite-state verification techniques to software systems looks attractive because they are capable of detecting very subtle defects in the logic design of these systems. Nevertheless, the integration of existing formal verification tools within programming environments is not yet easy, mainly because of the semantic gap between widely used programming languages and the languages used to describe system requirements. In this paper, we propose a formal requirement specification notation based on linear temporal logic, with regard to object oriented program elements, such as classes and interfaces. The specification is inherently object oriented and is meant for the verification of concurrent and distributed software systems.

Program Synthesis from Formal Requirements Specifications Using APTS

Formal specifications of software systems are extremely useful because they can be rigorously analyzed, verified, and validated, giving high confidence that the specification captures the desired behavior. To transfer this confidence to the actual source code implementation, a formal link is needed between the specification and the implementation. Generating the implementation directly from the specification provides one such link. A program transformation system such as Paige's APTS can be useful in developing a source code generator. This paper describes a case study in which APTS was used to produce code generators that construct C source code from a requirements specification in the SCR (Software Cost Reduction) tabular notation. In the study, two different code generation strategies were explored. The first strategy uses rewrite rules to transform the parse tree of an SCR specification into a parse tree for the corresponding C code. The second strategy associates a relation with each node of the specification parse tree. Each member of this relation acts as an attribute, holding the C code corresponding to the tree at the associated nodes the root of the tree has the entire C program as its member of the relation. This paper describes the two code generators supported by APTS, how each was used to synthesize code for two example SCR requirements specifications, and what was learned about APTS from these implementations.

Monitoring, Checking, and Steering of Real-Time Systems

The MaC system has been developed to provide assurance that a target program is running correctly with respect to formal requirements specification. This is achieved by monitoring and checking the execution of the target program at run-time. MaC bridges the gap between formal verification, which ensures the correctness of a design rather than an implementation, and testing, which only partially validates an implementation. One weakness of the MaC system is that it can detect property violations but cannot provide any feedback to the running system. To remedy this weakness, the MaC system has been extended with a feedback capability. The resulting system is called MaCS (Monitoring and Checking with Steering). The feedback component uses the information collected during monitoring and checking to steer the application back to a safe state after an error occurs. We present a case study where MaCS is used in a control system that keeps an inverted pendulum upright. MaCS detects faults in controllers and performs dynamic reconfiguration of the control system using steering.

ARIFS:: an Environment for Incomplete and Formal Specifications

The selection of appropriate components for satisfying a given equirement is a key problem in software reuse. Although this problem is remarkable in the reuse of software within same domain or application area, which is known as vertical reuse, it is more pronounced in horizontal reuse, that is, the reuse of software elements in different application areas. This paper describes how ARIFS tool (Approximate Retrieval of Incomplete and Formal Specifications) provides a suitable reusing environment to classify, retrieve and adapt formal and incomplete requirements specifications. Both classification and retrieval tasks are based on functional similarities according to structural closeness, which provides a suitable basis for horizontal reuse; and semantic closeness, which is more appropriated for vertical reuse. To this effect, we define four partial ordering relations among reusable components and different measures to quantify functional differences among them. By using these measures we are able to offer an approximate and efficient retrieval, without formal proofs, and to predict adaptation efforts to satisfy the required functional specification.

Requirements specification and analysis of fault-tolerant digital systems

We present an integrated computer-aided design environment, the PrT (predicate/transition) net system, in order to systematically introduce fault-tolerant properties into the design of complicated digital systems. This is accomplished by exploiting a formal specification of the system requirements in which the amount of necessary redundancy can be determined. The system is based on an integration of PrT nets with regular expressions. PrT nets are used to describe and analyze a high level system and regular expressions are used to describe and analyze the more detailed system structures. Both models provide us with well-defined levels of fault diagnosis needed in the digital system design. An S-invariant technique can be used to check the constancy of PrT nets; and a finite state automaton can be used to check the acceptability of regular expressions. Furthermore, the regular expression can also enable a system designer to determine redundancy in order to perform error correction. In consequence, our approach is superior to the current techniques for requirements analysis. Finally, main results are presented in the form of four propositions and supported by some experiments.

FAILURE MODES IN MEDICAL DEVICE SOFTWARE: AN ANALYSIS OF 15 YEARS OF RECALL DATA

Most complex systems today contain software, and systems failures activated by software faults can provide lessons for software development practices and software quality assurance. This paper presents an analysis of software-related failures of medical devices that caused no death or injury but led to recalls by the manufacturers. The analysis categorizes the failures by their symptoms and faults, and discusses methods of preventing and detecting faults in each category. The nature of the faults provides lessons about the value of generally accepted quality practices for prevention and detection methods applied prior to system release. It also provides some insight into the need for formal requirements specification and for improved testing of complex hardware-software systems.

CASL: the Common Algebraic Specification Language

The Common Algebraic Specification Language (C ASL) is an expressive language for the formal specification of functional requirements and modular design of software. It has been designed by C OFI, the international Common Framework Initiative for algebraic specification and development. It is based on a critical selection of features that have already been explored in various contexts, including subsorts, partial functions, first-order logic, and structured and architectural specifications. C ASL should facilitate interoperability of many existing algebraic prototyping and verification tools. This paper gives an overview of the C ASL design. The major issues that had to be resolved in the design process are indicated, and all the main concepts and constructs of C ASL are briefly explained and illustrated — the reader is referred to the C ASL Language Summary for further details. Some familiarity with the fundamental concepts of algebraic specification would be advantageous.

Java-MaC: A Run-time Assurance Tool for Java Programs

We describe Java-MaC, a prototype implementation of the Monitoring and Checking (MaC) architecture for Java programs. The MaC architecture provides assurance about the correct execution of target programs at run-time. Monitoring and checking is performed based on a formal specification of system requirements. MaC bridges the gap between formal verification, which ensures the correctness of a design rather than an implementation, and testing, which only partially validates an implementation. Java-MaC provides a lightweight formal method solution as a viable complement to the current heavyweight formal methods. An important aspect of the architecture is the clear separation between monitoring implementation-dependent low-level behaviors and checking high-level behaviors against a formal requirements specification. Another salient feature is automatic instrumentation of executable codes. The paper presents an overview of the MaC architecture and a prototype implementation Java-MaC.

Logics for hybrid systems

Hybrid systems are heterogenous dynamical systems characterized by interacting continuous and discrete dynamics. Such mathematical models have proved fruitful in a great diversity of engineering applications, including air-traffic control, automated manufacturing, and chemical process control. The high-profile and safety-critical nature of the application areas has fostered a large and growing body of work on formal methods for hybrid systems: mathematical logics, computational models and methods, and computer-aided reasoning tools supporting the formal specification and verification of performance requirements for hybrid systems, and the design and synthesis of control programs for hybrid systems that are provably correct with respect to formal specifications. This paper offers synthetic overview of, and original contributions to, the use of logics and formal methods in the analysis of hybrid systems.

A Formal Definition of FRSM and Applications

FRSM (Formal Requirements Specification Method) is a structured formal language and method for requirements analysis and specification construction based on data flow analysis. It uses a formalized DeMarco data flow diagram to describe the overall structure of systems and a VDM-SL like formal notation to describe precisely the functionality of components in the diagrams. This paper first describes the formal syntax and semantics of FRSM and then presents an example of using the axiom and inference rules given in the definition of the formal semantics for checking consistency of specifications. A case study of applying FRSM to a practical example is described to demonstrate the principle of constructing requirements specifications and to uncover the benefits and deficiencies of FRSM.

Integrating semi-formal and formal software specification techniques

In this paper, we report on the integration of informal, semiformal and formal system specification techniques. We present a framework for system specification called TRADE, within which several well-known semiformal specification techniques are placed. TRADE is based on an analysis of structured and object-oriented requirements specification methods. In this paper, we combine TRADE with the logic-based specification language Albert II and show that this leads to a coherent formal and semiformal requirements specification. We illustrate our approach with examples taken from a large distributed telecommunication application case study, performed in the context of the Esprit project 2RARE.

Integration and analysis of use cases using modular Petri nets in requirements engineering

It is well known that requirements engineering plays a critical role in software quality. The use case approach is a requirements elicitation technique commonly used in industrial applications. Software requirements are stated as a collection of use cases, each of which is written in the user's perspective and describes a specific flow of events in the system. The use case approach offers several practical advantages in that use case requirements are relatively easy to describe, understand, and trace. Unfortunately, there are a couple of major drawbacks. Since use cases are often stated in natural languages, they lack formal syntax and semantics. Furthermore, it is difficult to analyze their global system behavior for completeness and consistency, partly because use cases describe only partial behaviors and because interactions among them are rarely represented explicitly. We propose the Constraints-based Modular Petri Nets (CMPNs) approach as an effective way to formalize the informal aspects of use cases. CMPNs, an extension of Place/Transition nets, allow the formal and incremental specification of requirements. The major contributions of the paper, in addition to the formal definitions of CMPNs, are the development of: 1) a systematic procedure to convert use cases stated in natural language to a CMPN model; and 2) a set of guidelines to find inconsistency and incompleteness in CMPNs. We demonstrate an application of our approach using use cases developed for telecommunications services.

Software Requirements Specification and System Safety

Computer software is playing an increasingly important role in safety-critical embedded computer systems, where incorrect operation of the software could lead to loss of life, substantial material or environmental damage, or large monetary losses. Such diverse technologies as avionics, automobile drive trains, power plants, and medical equipment are relying more and more on the computer to control system parameters. Although software is a powerful and flexible tool for industry, these very advantages have contributed to a corresponding increase in system complexity. Traditional approaches to system development have not successfully handled the problems of increased system complexity. The fatal accidents caused by software in the Therac-25 radiation therapy machine, as well as other incidents, have brought public attention to these problems. Ironically, it is becoming clear that the powerful control logic that software can bring to a system can also impair the ability of the systems analyst to study and understand, and hence safely control, the system’s behavior. sion avoidance System II). Furthermore, using a formal requirements specification language, for example, RSML, enables several types of automated or semi automated analysis techniques that can be used to detect and eliminate potential safety problems from the specification. In this tutorial, we will discuss techniques for automatically detecting incomplete, inconsistent, and nondeterministic requirements, show how fault tree analysis can be used in the RSML framework, and demonstrate how a new analysis technique called deviation analysis can be used to evaluate the effects on the system if the inputs to the system deviates from expected value.

Formal analysis of the Shlaer-Mellor method: Towards a toolkit of formal and informal requirements specification techniques

In this paper, we define a number of tools that we think belong to the core of any toolkit for requirements engineers. The tools are conceptual and hence, they need precise definitions that lay down as exactly as possible what their meaning and possible use is. We argue that this definition can best be achieved by a formal specification of the tool. This means that for each semi-formal requirements engineering tool we should provide a formal specification that precisely specifies its meaning. We argue that this mutually enhances the formal and semi-formal technique: it makes formal techniques more usable and, as we will argue, at the same time simplifies the diagram-based notations. At the same time, we believe that the tools of the requirements engineer should, where possible, resemble the familiar semi-formal specification techniques used in practice today. In order to achieve this, we should search existing requirements specification techniques to look for a common kernel of familiar semi-formal techniques and try to provide a formalisation for these. In this paper we illustrate this approach by a formal analysis of the Shlaer-Mellor method for object-oriented requirements specification. The formal specification language used in this analysis is LCM, a language based on dynamic logic, but similar results would have been achieved by means of another language. We analyse the techniques used in the information model, state model, process model and communication model of the Shlaer-Mellor method, identify ambiguities and redundancies, indicate how these can be eliminated and propose a formalisation of the result. We conclude with a listing of the tools extracted from the Shlaer-Mellor method that we can add to a toolkit that in addition contains LCM as formal specification technique.

Using joint application design to develop readable formal specifications

A requirements specification is a ‘contract’ between a client and a systems developer. This document is frequently written in some type of ‘computerese’ or formal specification that is unintelligible to most clients. Why can't we have a precise, formal specification that is understandable? In fact, why can't we let the client take charge of developing a formal specification? In this paper, we present OSS (Object-oriented Systems Specification), a graphical model with an embedded textual language that has a formal foundation, is suitable for requirements specification, and is understandable to at least technically oriented clients. We also introduce IPOST, a prototyping/specification tool to assist the client. We describe a Joint Application Development (JAD) scenario utilizing OSS and IPOST that involves heavy client participation in the development of formal requirements specifications.

Adding rigour to object-oriented analysis

The rigorous object-oriented analysis (ROOA) method integrates formal description techniques with standard object-oriented analysis methods. ROOA provides a systematic development process which, starting from a set of informal requirements, produces an executable objected-oriented analysis model. The model is expressed in LOTOS and provides a precise and unambiguous formal requirements specification of the static, dynamic and functional aspects of a problem. As the specification is executable, prototyping can be used to validate the specification against the requirements. Inconsistencies, omissions and ambiguities in the requirements can be detected sufficiently early in a development so that feedback can be given to the requirement capture process.

Specifying Security for Computer Supported Collaborative Working

CSCW systems provide computer support to facilitate cooperation between users. This paper proposes an approach to the formal specification of security requirements for CSCW applications, where a CSCW application is viewed as a collection of activities that users may participate in. The specification approach is straightforward, and can be used to capture a wide variety of security requirements, including integrity and confidentiality. It is illustrated with a case study of a secure electronic examinations system.

Developing formal object-oriented requirements specifications: A model, tool and technique

The creation of a requirements specification for systems development has always been a difficult problem and continues to be a problem in the object-oriented software development paradigm. The problem persists because there is a paucity of formal, object-oriented specification models that are seamlessly integrated into the development cycle and that are supported by automated tools. Here, we present a formal object-oriented specification model (OSS), which is an extension of an object-oriented analysis model (OSA), and which is supported by a tool (IPOST) that automatically generates a prototype from an OSA model instance, lets the user execute the prototype, and permits the user to refine the OSA model instance to generate a requirements specification. This technique leverages the benefits of a formal model, an object-oriented model, a seamless model, a graphical diagrammatic model, incremental development, and CASE tool support to facilitate the development of requirements specifications.

A DEVELOPMENT FRAMEWORK AND VERIFICATION METHODOLOGIES FOR KNOWLEDGE-BASED SYSTEMS

In this paper, we present a development framework and verification methodologies for knowledge-based systems (KBSs) with real-time systems as our target system. The framework originates from an integration of three software development paradigms: rapid prototyping, operational specification, and transformational implementation. Based on this framework, we present RT-FRORL as a formal requirements specification language which exploits knowledge representation techniques as an aid in the specification, development, and verification of a KBS for real-time systems. RT-FRORL uses a combination of resolution refutation, anomaly detection matrix, and algorithms methods to verify a number of properties which might exist in KBSs. By incorporating RT-FROHL and its verification methods with the underlying framework, it lays a very strong foundation to deal with the current issues in KBSs verification.