Thomas Kropf

Linking Functional Requirements and Software Verification

Synchronization between component requirements and implementation centric tests remains a challenge that is usually addressed by requirements reviews with testers and traceability policies. The claim of this work is that linking requirements, their scenario-based formalizations, and software verification provides a promising extension to this approach. Formalized scenarios, for example in the form of low-level assume/assert statements in C, are easier to trace to requirements than traditional test sets. For a verification engineer, they offer an opportunity to better participate in requirements changes. Changes in requirements can be more easily propagated because adapting formalized scenarios is often easier than deriving and updating a large set of test cases. The proposed idea is evaluated in a case study encompassing over 50 functional requirements of an automotive software developed at Robert Bosch GmbH. Results indicate that requirement formalization together with formal verification leads to the discovery of implementation problems missed in a traditional testing process.

Abstract Testing: Connecting Source Code Verification with Requirements

Traditionally, test cases are used to check whether a system conforms to its requirements. However, to achieve good quality and coverage, large amounts of test cases are needed, and thus huge efforts have to be put into test generation and maintenance. We propose a methodology, called Abstract Testing, in which test cases are replaced by verification scenarios. Such verification scenarios are more abstract than test cases, thus fewer of them are needed and they are easier to create and maintain. Checking verification scenarios against the source code is done automatically using a software model checker. In this paper we describe the general idea of Abstract Testing, and demonstrate its feasibility by a case study from the automotive systems domain.

Software bugs seen from an industrial perspective or can formal methods help on automotive software development

Developing software for automotive applications is a challenging task. To stay competitive conflicting goals must be met: complex and innovative algorithms with many versions for different car line variants have to be implemented within the tight resource boundaries of embedded systems; high reliability especially for safety critical applications like airbag or braking applications has to be ensured under immense cost pressure. Despite these demanding constraints in recent years automotive software development has made significant progress in terms of productivity and quality. All this has been achieved without direct usage of formal methods.

Bridging the gap between test cases and requirements by abstract testing

In this article we propose a technique, called abstract testing, which replaces traditional test cases by abstract test cases. By doing so, fewer test cases are needed, and they are linked more closely to the requirements. Abstract tests can be considered as verification scenarios on the source code level which are derived from the requirements. Checking verification scenarios against the source code is done automatically using a software model checker. We also suggest a migration path from traditional tests to abstract test cases, which provides a smooth transition towards this new technique. Finally, we demonstrate feasibility of abstract testing by a case study from the automotive systems domain.

Higher-Order Logics

The approach presented in this chapter significantly differs from all formalisms presented before. Up to now, all approaches were n n nfully automized n n n n n n nbased on simple formalisms like FSMs, close to the usual modeling methods of hardware designers

Modeling and Managing Context-Aware Systems’ Variability

This theme issue provides an updated perspective on techniques to manage software system variability at runtime, to make software systems smarter and less dependent on human intervention.

Approaches Based on Finite State Machines

Digital circuits usually contain storage elements like flipflops, registers or RAMs. Thus we have to cope with sequential circuits, where the current output may depend not only on the current input but also on previous values (Fig. 3–1). Boolean functions as presented in Chapter 2 lack sufficient expressiveness to model this kind of behavior and we have to use more powerful formalisms.

Propositional Temporal Logics

All verification approaches presented in Chapter 3 are based on finite state machine theory. As the single available proof goal is FSM equivalence, we can verify only that two sequential circuits have the same behavior.1 This simple equivalence check is sufficient to verify circuit optimizations where a modified circuit version still must be behaviorally equivalent to the original one. It is however not possible to specify and to verify more abstract circuit properties. This comprises all forms of partial specifications like safety, liveness and fairness properties.