a way for applicable formal specification of safety requirements by ...

mode “strong guided dialog“ so that the order of
the question is given. In the following the
relevant classification criteria , which have to be
decided are listed (a) with the questions
belonging to them (b). Then the decision for the
correct class the safety requirement belongs to is
explained (c):
1. a. Existence of a temporal logic
aspect in the safety requirement.
b. Does the safety requirement contain any
temporal logic aspect?
c. Yes, the possible message reception
and the stop of the train before the
level crossing are in a temporal
relation. Therefore the class dynamic
safety requirement has to be selected.
2. a. Type of time specification.
b. Does the safety requirement contain
any explicit time specification?
c. No, there is no temporal statement in
dependence on a system clock. For that
reason it is a safety requirement with
implicit time specification only.
3. a. Existence of temporal dependencies
between propositions.
b. Does the safety requirement contain
any temporal dependencies between
propositions or does it require a
reachability or an assurance of
reaching without temporal conditions?
c. There exists a temporal dependency
between ...
• if the train receives the message
“level_crossing_not_protected“ and
• that the train stops before the level
crossing.
Therefore, the safety requirement belongs
to the class safety requirements with
temporal dependencies between
propositions.
4. a. Temporal restriction of validity.
b. What kind of temporal validity restriction
of a property is to be set?
c. It is stated at which point in time the train
has to be stopped. So the correct class is
beginning of validity.
5. a. Frequency of validity in validity
interval.
b. What is the frequency of the predicate
validity in the validity interval?
c. There is no safety related necessary
restriction with respect to the frequency
but the train must stop at least one time
if the train receives the negative message.
Therefore the right class is validity at
least n times (with n=1).
6. a. Modality of demand.
b. What is the modality of demand?
c. The safety requirement does not state a
permitted or forbidden behaviour but a
necessary one. That is why the class is
necessity.
7. a. Type of beginning of validity.
b. When exactly should the validity of the
demanded property begin?
c. The stopping of the train may be started
from that point in time on when the train
receives the message. Therefore, the
safety requirement has to be assigned to
the class validity from a certain point in
time on.
Based on this classification the following
safety pattern with the appropriate explanation is
identified:
Safety pattern in norm language:
b must be valid at least once together with or
anytime after a is valid.
Safety pattern in formal language (CTL):
AG (a → AF b)
Specification of the safety requirement in
norm language:
(train.current_velocity=0 and
train.current_position < levelcrossing.position_beginning)
must be
valid at least once together with or anytime after
train.message_level_crossing_not_
protected is valid.
Specification of the safety requirement in
formal language (CTL):
AG (train.message_level_crossing_not_
protected → AF (train.current_
velocity=0 and train.current_position
< level-crossing.position_beginning))
The example shows clearly that the variables
of a safety pattern predicates can be substituted
by state, event, action, condition or configuration
variables of the corresponding operational
model, which has to fulfil the safety requirement.
Furthermore predicates with boolean meaning
can be inserted like comparisons with >,