Abstract In the development and verification of safety-critical aero-space software, Linear Temporal Logic (LTL) has been widely used to specify complex system properties derived from requirements. However, a significant gap remains in industrial practice: translating natural language (NL) requirements into formal LTL properties is a labor-intensive and error-prone process that requires rare expertise in both aerospace control engineering and formal methods. While recent NL-to-LTL tools ( e.g. , NL2SPEC, NL2TL, NL2LTL) are capable of automating parts of this process, they often fail on real requirement documents in industrial settings, due to complex domain terminology or implicit temporal and logical structure. To address these challenges, we present Aero Req2LTL , a framework that automates LTL property generation for aerospace requirements using large language models (LLMs), with two key industrial innovations: (i) a data dictionary that normalizes technical jargon into precise atomic propositions; and (ii) a template-based requirement language that makes temporal cues and logical relations explicit before translation. On a real aerospace dataset, Aero Req2LTL achieves 85% precision and 88% recall in LTL generation, and its outputs can be directly consumed by existing verification tools.

Automating the translation of natural language (NL) software requirements into formal specifications remains a critical challenge in scaling formal verification practices to industrial settings, particularly in safety-critical domains. Existing approaches, both rule-based and learning-based, face significant limitations. While large language models (LLMs) like GPT4o demonstrate proficiency in semantic extraction, they still encounter difficulties in addressing the complexity, ambiguity, and logical depth of real-world industrial requirements. In this paper, we propose Req2LTL, a modular framework that bridges NL and Linear Temporal Logic (LTL) through a hierarchical intermediate representation called OnionL. Req2LTL leverages LLMs for semantic decomposition and combines them with deterministic rule-based synthesis to ensure both syntactic validity and semantic fidelity. Our comprehensive evaluation demonstrates that Req2LTL achieves 88.4% semantic accuracy and 100% syntactic correctness on real-world aerospace requirements, significantly outperforming existing methods.

Requirements classification, which organizes software requirements into structured categories, is crucial in safety-critical domains such as aerospace. However, practical implementation is challenging due to the absence of unified, domain-specific taxonomies, as different developers often adopt divergent classification schemes. Moreover, safety-critical requirements frequently intertwine functional and reliability constraints, creating complex multi-label classification challenges. Existing supervised learning approaches depend on large annotated datasets, which are rarely feasible in specialized industries, while current LLM-based methods face difficulties handling hierarchical, multi-label scenarios effectively. To address these issues, we propose TRClass, a novel taxonomy-guided classification approach. The key idea behind TRClass is to integrate domain knowledge into the classification process by first constructing a unified taxonomy semi-automatically, extracting structure from existing documents, and refining it with expert validation. TRClass then guides an LLM to classify requirements by reasoning step-by-step through the taxonomy hierarchy, using few-shot retrieval and confidence-based exploration to achieve accurate multi-label decisions. We validate TRClass using aerospace software requirements as a representative case study for safety-critical industries. Results show that TRClass consistently outperforms baselines, with all components contributing to its overall effectiveness, and remains robust across different LLM configurations. A user study further confirms its practical usability in real-world industrial scenarios.

Interrupt-driven embedded software is widely used in aerospace, automotive electronics, medical equipment, IoT, and other industrial fields. This type of software is usually programmed with interrupts to interact with hardware and respond to external stimuli on time. However, uncertain interleaving execution of interrupts may cause concurrency bugs, resulting in task failure or serious safety issues. A deep understanding of real-world concurrency bugs in embedded software will significantly improve the ability of techniques in combating concurrency bugs, such as bug detection, testing and fixing.

Interrupt-driven programs are extensively employed in safety-critical areas such as aerospace, autonomous driving, and medical equipment. Nevertheless, the uncertainty of interrupt preemption may result in concurrent bugs. Among these concurrent bugs, atomicity violations are critical and challenging to detect. Existing methods mostly concentrate on predicting or detecting single-variable atomicity violations but fail to address the more intricate multi-variable atomicity violations. In real-world programs, many variables are inherently correlated and must be accessed together with their correlated peers consistently. To significantly improve the ability of techniques in inferring correlated variables, this paper conducts an empirical study on real-world software to understand the manifestation characteristics of variable correlations. Building upon this foundation, an automated method called intCV, based on the XGBoost model, is introduced to effectively infer correlated variables within interrupt-driven programs. Once we accurately identify the correlated variables requiring atomic execution, existing detection techniques can be utilized to identify violations of multi-variable atomicity. Experimental results on real-world aerospace embedded software demonstrate the practicality and effectiveness of our method.

Branch prediction structures are increasingly used in space processors due to their crucial role in improving processor performance. Due to radiation effects such as Single Event Upset (SEU) causing system failures, it is necessary to provide protection techniques for branch prediction modules against complex spatial environments. In this paper, we proposed a simple, efficient, low-power, and fault-tolerant design scheme for L0 BTB consisting of a master-slave and a check-decision module. The strategy sets up the L0 BTB structure as a master-slave structure and adds an error check to detect single-bit errors. Experimental results show that we achieve 100% fault tolerance without a loss hit rate. The increase in resource usage is 1.1x, and the path delay increases by 8.1%, superior to other methods. The L0 BTB is a fully-associative structure and multiple entries are accessed simultaneously, which introduces significant power consumption. We added a low-power design for the master-slave module to reduce the query power consumption by 65.9%. In addition, we also applied the scheme to the RAS module. The experimental results demonstrate that our approach is an efficient, generic, fault-tolerant design scheme that can be deployed to different register files.

Interrupt-driven programs are widely used in aerospace and other safety-critical areas. However, uncertain interleaving execution of interrupts may cause concurrency bugs, which could result in serious safety problems. Most of the previous researches tackling the detection of interrupt concurrency bugs focus on data races, that are usually benign as shown in empirical studies. Some studies focus on pattern-based atomicity violations that are most likely harmful. However, they cannot achieve simultaneous high precision and scalability. This paper presents intAtom, a precise and efficient static detection technique for interrupt atomicity violations, described by access interleaving pattern. The key point is that it eliminates false violations by staged path pruning with constraint solving. It first identifies all the violation candidates using data flow analysis and access interleaving pattern matching. intAtom then analyzes the path feasibility between two consecutive accesses in preempted task/interrupt, in order to recognize the atomicity intention of developers, with the help of which it filters out some candidates. Finally, it performs a modular path pruning by constructing symbolic summary and representative preemption points selection to eliminate the infeasible path in concurrent context efficiently. All the path feasibility checking processes are based on sparse value-flow analysis, which makes intAtom scalable. intAtom is evaluated on a benchmark and 6 real-world aerospace embedded programs. The experimental results show that intAtom reduces the false positive by 72% and improves the detection speed by 3 times, compared to the state-of-the-art methods. Furthermore, it can finish analyzing the real-world aerospace embedded software very fast with an average FP rate of 19.6%, while finding 19 bugs that were confirmed by developers.

Concurrency bugs are common in interrupt-driven programs, which are widely used in safety-critical areas. These bugs are often caused by incorrect data sharing among tasks and interrupts. Therefore, data sharing analysis is crucial to reason about the concurrency behaviours of interrupt-driven programs. Due to the variety of data access forms, existing tools suffer from both extensive false positives and false negatives while applying to interrupt-driven programs. This paper presents SpecChecker-ISA, a tool that provides sound and precise data sharing analysis for interrupt-driven embedded software. The tool uses a memory access model parameterized by numerical invariants, which are computed by abstract interpretation based value analysis, to describe data accesses of various kinds, and then uses numerical meet operations to obtain the final result of data sharing. Our experiments on 4 real-world aerospace embedded software show that SpecChecker-ISA can find all shared data accesses with few false positives, significantly outperforming other existing tools. The demo can be accessed at https://github.com/wangilson/specchecker-isa.

We give an introduction to the MARS toolchain for formal modeling and verification of hybrid systems. It consists of translators from Simulink/Stateflow models to Hybrid Communicating Sequential Processes (HCSP), and tools for simulation, code generation, and deductive verification of an HCSP model. We apply the toolchain to model the descent guidance control phase of the recently launched Tianwen I mars lander, and verify that it correctly controls the velocity of the lander.

Memory allocation and deallocation are the fundamental operations of embedded operating systems, which have been extensively used in many safety critical systems. The correctness of the operations is of paramount importance because their failure could incur severe consequences. While the system is running, the memory state can easily grow to a gigantic amount, which means that it is impossible to verify the huge memory states one by one. Therefore, it is a challenge how to verify the correctness of running memory state of the system. In this article, we propose a novel memory state verification method based on inductive and deductive reasoning. First, we abstract the memory state as a list of memory blocks, which will transform in memory operations. Second, we construct the generic model based on the transition function of the memory management and summarize the invariant properties of the memory state. Third, we use the inductive method to calculate the changes between the memory states, and verify that the memory state of the system always satisfy the global properties. All the proofs are implemented in the interactive theorem prover Coq. On the basis of our proposed model, we verify the correctness of a two-level segregated fit (TLSF) algorithm through some extensions, and we also apply this method to verify the correctness of the memory state of the embedded system at runtime.

Formal methods are promising for modeling and analyzing system requirements. However, applying formal methods to large-scale industrial projects is a remaining challenge. The industrial engineers are suffering from the lack of automated engineering methodologies to effectively conduct precise requirement models, and rigorously validate and verify (V&V) the generated models. To tackle this challenge, in this paper, we present a systematic engineering approach, named Formal Requirement Engineering Platform in Aircraft (FREPA), for formal requirement modeling and V&V in the aerospace and aviation control domains. FREPA is an outcome of the seamless collaboration between the academy and industry over the last eight years. The main contributions of this paper include 1) an automated and systematic engineering approach FREPA to construct requirement models, validate and verify systems in the aerospace and aviation control domain, 2) a domain-specific modeling language AASRDL to describe the formal specification, and 3) a practical FREPA-based tool AeroReq which has been used by our industry partners. We have successfully adopted FREPA to seven real aerospace gesture control and two aviation engine control systems. The experimental results show that FREPA and the corresponding tool AeroReq significantly facilitate formal modeling and V&V in the industry. Moreover, we also discuss the experiences and lessons gained from using FREPA in aerospace and aviation projects.

With the continuous development of computer and electronics, the idea of artificial intelligence has been integrating into the fault tolerance research. As a valuable and prospective intelligent fault tolerance technique in high reliability and high safety applications, the evolvable hardware fault tolerance technique is becoming an important and widely applicable method. However, this technique confronts two difficult problems: evolved circuit scale and evolution efficiency. Toward these problems, we present a programmable architecture called neural network architecture-based virtual reconfigurable circuit (NNA-VRC), and an evolutionary fault tolerance method based on this programmable architecture. The NNA-VRC-based evolution method simplifies the structure and configuration of programmable architecture, avoids illegal interconnections during the circuit evolution, and implements high level (module level) evolution. The experiments of this paper show that a function module scale circuit is evolved efficiently. Furthermore, NNA-VRC-based evolution method can recovery from many injected fault patterns, behaving a strong feature of fault tolerance.

This paper investigates the integration of linear constraints with MSVL. To this end, we first define linear constraint statements and discuss related issues of the incorporation. Further, for calling SMT solvers to solve the newly introduced constraints, we give a translation algorithm from state programs in MSVL with linear constraints to SMT-LIB2.0 script language and then supply a solving procedure.

This paper shows how channel assignment in multicast terrestrial communication systems with different user populations and distributed channel occupancy detection can be improved using intelligence based on reinforcement learning. The schemes greatly reduce the number of reassignments and improve the dropping probability, at the expense of increased blocking. It is found that compared to detection by single users, detection by multiple users reduces the 'hidden node' problem. Using different minimum quality of service threshold percentages can partly control and improve the performance, in place of the more traditional SINR threshold levels. At the same time, with reinforcement leaning, the ability of find an optimal channel for users is significantly improved, because the channel weighting can help the users avoid the interference.