Designing a Requirements Specification Language for Reactive Systems

Abstract

Although I have been working in the area of safety analysis for 18 years, I only started designing modeling languages in 1990. Up to that time, I was satisfied with using existing languages. However, in 1990 I got an FAA research grant to build a system requirements specification for a real system, TCAS II (a collision avoidance system). When I tried to use some standard modeling languages, I found they were not adequate. Because we tried to make this exercise as realistic as possible, we could not simply specify the parts of the system that were easily modeled in a particular language, but needed to describe all the required behavior. In addition, our specification was continually reviewed by engineers, pilots, and certification officials, so we were able to determine which features were understandable and which were not. We ended up modifying the syntax (and some semantics) of a commercial language (Statecharts), and even then we were only half-satisfied with the results. The FAA officials and industry committee responsible for TCAS II liked our language, RSML (Requirements State Machine Language), and adopted it for the official TCAS II specification, which we helped them prepare.