a way for applicable formal specification of safety requirements by ...

emoving a signal). In that case a specific pattern
of the following kind is inserted:
Formulation in norm language:
α changes from valid to invalid
Formulation in formal language (CTL):
α & AX not α
In addition to this insertion, before all other
variables in the formal specification of the
requirement an AX has to be placed. It is in
process to support also this kind of instantiation
by the tool SAPIS.
For specification of complex safety
requirements several safety patterns have to be
combined by and, or, xor or not connectives
of Propositional logic. In other cases safety
patterns have to be inserted in other safety
patterns to specify complex safety requirements.
E.g. a safety requirement of a train door control
is:
If the door block button is activated, the
ending of the door blocking is only permitted
when the signal v5 is not longer contacted.
It is obvious that this safety requirement
consists of two parts: A causal condition and a
temporal condition. The causal condition for the
whole safety requirement is: the door block
button is activated. The temporal condition for
the ending of the door blocking is: the signal v5
is not longer contacted. For that reason two
safety patterns have to be identified in such a
way like it is explained before, to specify this
safety requirement.
First selected safety pattern:
Safety pattern in norm language:
Always if a is valid, then b must also be valid.
Alternative: Always if a is valid, then it must
also be valid: b
Safety pattern in formal language (CTL):
AG (a → b)
Instantiation of this safety pattern for the relevant
part of the safety requirement:
Safety requirement in norm language:
Always if door_blockbutton_activated
is valid it must also be valid: b
For b a second safety pattern has to be inserted.
Second selected safety pattern:
Safety pattern in norm language:
a must be valid permanently until b is valid.
Safety pattern in formal language (CTL):
A(a W (b and a))
Instantiation of this safety pattern for the relevant
part of the safety requirement:
Safety requirement in norm language:
door_blocked must be valid permanently
until not signal_v5 is valid.
Total result - specification of the complete safety
requirement:
Safety requirement in norm language:
Always if door_blockbutton_activated
is valid then it must also be valid:
door_blocked must be valid permanently
until not signal_v5 is valid.
Safety pattern formulation in formal
language (CTL):
AG (door_blockbutton_activated →
A(door_blocked W (not signal_v5
and door_blocked)))
6. RELATED WORKS
Bitsch & Göhner, 2002 and Bitsch, 2001 have
already discussed works related to the safety
pattern concept. Moreover there is the pattern
library for the Certifier of the tool Statemate of
I-Logix Inc. (I-Logix Inc. and OFFIS Systems
and Consulting GmbH, 2002). A basic difference
of their pattern system is that they expect the
user to have knowledge and mastery of temporal
logic application, which is not necessary in our
approach. They only divide the patterns into four
classes and give no further support to identify the
correct pattern, neither by a detailed pattern
classification nor by a tool. There are no patterns
for specification in a terminology of natural
language and only in some cases explanations in
natural language are provided. A good idea is
that they give an example of a state diagram for
every pattern, which meets the respective
requirement. In some cases they give graphical
explanations using timelines.
A main difference to the safety patterns
approach is, that they do not restrict the practical
use of formal verification to the context of
safety. For this reason their considered kinds of
specification patterns are not restricted to safety
requirements. If the interest of a user in formal
specification was only in the context to safety, it
would be much easier to use a pattern system,
which is restricted to the context to safety.
Otherwise there are many patterns, which are not
relevant to safety requirements in general.
Therefore it is easier to select the suitable pattern
in a pattern system restricted to the context to
safety. Furthermore the bigger the pattern system