Experiences and lessons from the analysis of TCAS II

ABSTRACT

This report highlights some of the experiences gathered while analyzing the requirements specification for a commercial avionics system called TCAS II (Traffic alert and Collision Avoidance System II) for consistency and completeness. Completeness in this context is defined as a complete set of requirements, that is, there is a behavior specified for every possible input and input sequence.Under the leadership of Dr. Nancy G. Leveson, the Irvine Safety Research Group has developed a state-based requirements specification language RSML (Requirements State Machine Language) using TCAS II as a testbed [6]. The TCAS requirements specification project was very successful; RSML was well liked by all participants in the project, and the formal specification has been adopted as the official TCAS II requirements. The requirements document has been delivered to the FAA and has undergone an extensive independent validation and verification effort (IV&V).In a previous investigation, we defined procedures for analyzing state-based requirements specifications for completeness and consistency [5]. To demonstrate that our approach is feasible and is applicable to realistic systems, we have implemented a draft analysis tool and we have applied the analysis to the TCAS II requirements. The initial results from the analysis effort were encouraging [4, 5] and scaled well to a large requirements specification. The most complex parts of the TCAS requirements specification have recently been analyzed. Even though the effort was largely successful, some limitations with the approach have surfaced. Most importantly, the accuracy of the analysis algorithms needs improvement. When analyzing the most complex parts of the TCAS requirements, the number of spurious error reports can occasionally be overwhelming. Furthermore, we discovered that once the analysis has identified problems, it has been unexpectedly difficult to correct some of them.

REFERENCES

• 1: Randal E. Bryant, Graph-based algorithms for Boolean function manipulation, IEEE Transactions on Computers, v.35 n.8, p.677-691, Aug. 1986 [doi>10.1109/TC.1986.1676819]
• 2: David Harel, Statecharts: A visual formalism for complex systems, Science of Computer Programming, v.8 n.3, p.231-274, June 1, 1987 [doi>10.1016/0167-6423(87)90035-9]
• 3: David Harel, On visual formalisms, Communications of the ACM, v.31 n.5, p.514-530, May 1988 [doi>10.1145/42411.42414]
• 4: Mats Per Erik Heimdahl, Static analysis of state-based requirements analysis for completeness and consistency, University of California at Irvine, Irvine, CA, 1995
• 5: Mats P. E. Heimdahl , Nancy G. Leveson, Completeness and consistency analysis of state-based requirements, Proceedings of the 17th international conference on Software engineering, p.3-14, April 24-28, 1995, Seattle, Washington, United States [doi>10.1145/225014.225015]
• 6: Nancy G. Leveson , Mats Per Erik Heimdahl , Holly Hildreth , Jon D. Reese, Requirements Specification for Process-Control Systems, IEEE Transactions on Software Engineering, v.20 n.9, p.684-707, September 1994 [doi>10.1109/32.317428]

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.1 Project and People Management
          Subjects: Systems analysis and design

Additional Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING

General Terms:
Design, Theory, Verification