Automated deductive requirements analysis of critical systems

Abstract

We advocate the need for automated support to System Requirement Analysis in the development of time-and safety-critical computer-based systems. To this end we pursue an approach based on deductive analysis: high-level, real-world entities and notions, such as events, states, finite variability, cause-effect relations, are modeled through the temporal logic TRIO, and the resulting deductive system is implemented by means of the theorem prover PVS. Throughout the paper, the constructs and features of the deductive system are illustrated and validated by applying them to the well-known example of the Generalized Railway Crossing.

Trio2Promela: A Model Checker for Temporal Metric Specifications

“…Over the years a variety of methods and tools have been defined to support typical validation and verification activities in TRIO, as described in [6] and [2].…”

ArchiTRIO: A UML-Compatible Language for Architectural Description and Its Formal Semantics

“…Secondly, we will investigate verification techniques (to be supported by TRIDENT) to complement the modeling features presented in this paper. In this regard, the semantics of ArchiTRIO in terms of HOT suggests an encoding of ArchiTRIO classes into the higher-order logic of a theorem prover such as PVS, along the lines already followed for the TRIO language [5].…”

“…[7]. With ArchiTRIO one can express all of these properties and some more; for example, axiom dataRelay shown in Section 2, which defines neither a class invariant, nor a pre/post condition (nor a constraint) on an operation, but, rather, a dynamic relationship between two different operations, cannot be expressed as an OCL constraint 5 . In addition, OCL expressions are forbidden to "alter the state of the corresponding executing system" (i.e.…”

Modeling Time in Computing

“…The axiomatic description of nonZenoness is immediate for a first order, metric temporal logic like MTL or TRIO, when it is applied to simple entities like predicates or variables ranging over finite domains. It can be more complicated when nonZenoness must be specified in the most general case of variables that are real-valued functions of time [Gargantini and Morzenti 2001].…”