[Paper Review] Expressing and verifying embedded software requirements.

Alexandr Naumchev, Bertrand Meyer+4 more|arXiv (Cornell University)|Oct 8, 2017

Advanced Software Engineering Methodologies3 citations

TL;DR

This paper proposes AutoReq, a method that expresses embedded software requirements directly in a programming language using formal assertions, enabling early verification via program provers like AutoProof. By integrating Design by Contract and Hoare-style logic, the approach ensures consistency and uncovers errors early, as demonstrated by a mechanically verified proof of correctness in a landing gear system case study.

ABSTRACT

Writing requirements for embedded software is pointless unless they reflect actual needs and the final software implements them. In usual approaches, the use of different notations for requirements (often natural language) and code (a programming language) makes both conditions elusive. To address the problem, we propose to write requirements in the programming language itself. The expected advantages of this seamless approach, called AutoReq include: avoiding the potentially costly miss due to the use of different notations; facilitating software change and evolution, by making it easier to update code when requirements change and conversely; benefiting from the remarkable expressive power of modern object-oriented programming languages, while retaining a level of abstraction appropriate for requirements; leveraging, in both requirements and code, the ideas of Design by Contract, including (as the article shows) applying Hoare-style assertions to express temporal-logic-style properties and timing constraints; and taking advantage of the powerful verification tools that have been developed in recent years. The last goal, verification, is a focus of this article. While the idea of verifying requirements is not widely applied, the use of a precise formalism and a modern program prover (in our case, AutoProof for Eiffel) makes it possible at a very early stage to identify errors and inconsistencies which would, if not caught in the requirements, contaminate the final code. Applying the approach to a well-documented industrial example (a landing gear system) allowed a mechanical proof of consistency and uncovered an error in a previously published discussion of the problem.

Motivation & Objective

• To address the gap between informal natural language requirements and formal code by unifying them in a single notation.
• To reduce costly misunderstandings caused by using different notations for requirements and implementation.
• To enable early detection of inconsistencies and errors through formal verification of requirements.
• To leverage modern program proving tools to validate requirements before implementation begins.
• To demonstrate the feasibility and benefits of writing requirements in a programming language with formal assertions.

Proposed method

• Expressing requirements directly in a programming language (Eiffel) using object-oriented constructs and formal contracts.
• Applying Hoare-style assertions to specify temporal and timing properties within the code.
• Using the AutoProof prover to formally verify requirements expressed as assertions in the code.
• Integrating Design by Contract principles to ensure correctness and consistency at the requirement level.
• Mapping natural language requirements into precise, executable, and verifiable assertions in the programming language.
• Validating the approach on a real-world industrial example: a landing gear control system.

Experimental results

Research questions

• RQ1 Can embedded software requirements be effectively expressed and verified using a programming language and formal assertions?
• RQ2 Does expressing requirements in code reduce the risk of inconsistencies and errors compared to traditional natural language approaches?
• RQ3 To what extent can modern program provers verify requirements at the early stage of development?
• RQ4 How does using a unified notation for requirements and code affect software evolution and maintenance?
• RQ5 Can formal verification of requirements uncover errors that remain undetected in prior informal analyses?

Key findings

• The AutoReq approach enabled a mechanically verified proof of consistency for a landing gear system, demonstrating the feasibility of formal requirement verification.
• An error was uncovered in a previously published analysis of the landing gear system through formal verification of the requirements.
• The use of assertions in the programming language allowed precise expression of timing and temporal logic properties.
• Formal verification at the requirement stage identified inconsistencies that would have propagated into the final implementation.
• The integration of Design by Contract and program proving tools enabled early detection of logical flaws.
• The seamless transition from requirements to code reduced the risk of misinterpretation and improved maintainability.