Property-based theorem proving and template-based fault tree analysis of NuSCR requirements specification

Abstract

Computer controlled safety-critical systems are increasingly becoming a routine and integral part of modern society. Examples include fly-by-wire aircraft and emergency shutdown systems for nuclear power plants. Safety assurance requirements for such systems are very demanding (e.g., requiring failure probabilities as low as $10^{-9}$) with national and international regulation bodies routinely requiring rigorous safety demonstrations. Of all the phases in software development, requirements engineering is generally considered to play the most critical role in determining the overall software quality. NASA data \cite{Lut96} demonstrate that nearly $75\%$ of failures found in operational software were caused by errors in the requirements. Various approaches have been suggested for developing high-quality SRS and conducted cost-effective analysis. Inspection \cite{Fag86} and formal methods are generally shown to be effective \cite{HB95,Whe96}. Although inspection can, in principle, detect all types of errors in SRS, experience in conducting inspections on the SRS for the Wolsong NPP (nuclear power plant) SDS2 (shutdown system) \cite{AECL94} revealed that inspection is ineffective when verifying application-independent properties of large, complex, and evolving software requirements. To leap these limitations, we decided to use formal methods as an activity in the verification process and fault tree analysis as an activity in the safety analysis. Safety-critical software process is composed of development process, verification process, and safety analysis process. The safety analysis process is an additional process which is not found in a conventional software process. A software requirements specification is an artifact of requirements phase in development process. The verification process in requirements phase checks the correctness of software requirements specification, and the safety analysis process analyzes the safety-related properties in detail. We cl...