Abstract In the development and verification of safety-critical aero-space software, Linear Temporal Logic (LTL) has been widely used to specify complex system properties derived from requirements. However, a significant gap remains in industrial practice: translating natural language (NL) requirements into formal LTL properties is a labor-intensive and error-prone process that requires rare expertise in both aerospace control engineering and formal methods. While recent NL-to-LTL tools ( e.g. , NL2SPEC, NL2TL, NL2LTL) are capable of automating parts of this process, they often fail on real requirement documents in industrial settings, due to complex domain terminology or implicit temporal and logical structure. To address these challenges, we present Aero Req2LTL , a framework that automates LTL property generation for aerospace requirements using large language models (LLMs), with two key industrial innovations: (i) a data dictionary that normalizes technical jargon into precise atomic propositions; and (ii) a template-based requirement language that makes temporal cues and logical relations explicit before translation. On a real aerospace dataset, Aero Req2LTL achieves 85% precision and 88% recall in LTL generation, and its outputs can be directly consumed by existing verification tools.

With the advent of neural language models, the performance of code generation has been significantly boosted.However, the problem of repetitions during the generation process continues to linger.Previous work has primarily focused on content repetition, which is merely a fraction of the broader repetition problem in code generation.A more prevalent and challenging problem is structural repetition.In structural repetition, the repeated code appears in various patterns but possesses a fixed structure, which can be inherently reflected in grammar.In this paper, we formally define structural repetition and propose an efficient decoding approach called RPG, which stands for Repetition Penalization based on Grammar, to alleviate the repetition problems in code generation for LLMs.Specifically, RPG first leverages grammar rules to identify repetition problems during code generation, and then strategically decays the likelihood of critical tokens that contribute to repetitions, thereby mitigating them in code generation.To facilitate this study, we construct a new dataset CodeRepetEval to comprehensively evaluate approaches for mitigating the repetition problems in code generation.Extensive experimental results demonstrate that RPG substantially outperforms the best-performing baselines on CodeRepetEval dataset as well as HumanEval and MBPP benchmarks, effectively reducing repetitions and enhancing the quality of generated code. 1

Time series anomaly detection (TSAD) is essential for ensuring the safety and reliability of aerospace software systems. Although large language models (LLMs) provide a promising training-free alternative to unsupervised approaches, their effectiveness in aerospace settings remains under-examined because of complex telemetry, misaligned evaluation metrics, and the absence of domain knowledge. To address this gap, we introduce ATSADBench, the first benchmark for aerospace TSAD. ATSADBench comprises nine tasks that combine three pattern-wise anomaly types, univariate and multivariate signals, and both in-loop and out-of-loop feedback scenarios, yielding 108,000 data points. Using this benchmark, we systematically evaluate state-of-the-art open-source LLMs under two paradigms: Direct, which labels anomalies within sliding windows, and Prediction-Based, which detects anomalies from prediction errors. To reflect operational needs, we reformulate evaluation at the window level and propose three user-oriented metrics: Alarm Accuracy (AA), Alarm Latency (AL), and Alarm Contiguity (AC), which quantify alarm correctness, timeliness, and credibility. We further examine two enhancement strategies, few-shot learning and retrieval-augmented generation (RAG), to inject domain knowledge. The evaluation results show that (1) LLMs perform well on univariate tasks but struggle with multivariate telemetry, (2) their AA and AC on multivariate tasks approach random guessing, (3) few-shot learning provides modest gains whereas RAG offers no significant improvement, and (4) in practice LLMs can detect true anomaly onsets yet sometimes raise false alarms, which few-shot prompting mitigates but RAG exacerbates. These findings offer guidance for future LLM-based TSAD in aerospace software.

Requirements classification, which organizes software requirements into structured categories, is crucial in safety-critical domains such as aerospace. However, practical implementation is challenging due to the absence of unified, domain-specific taxonomies, as different developers often adopt divergent classification schemes. Moreover, safety-critical requirements frequently intertwine functional and reliability constraints, creating complex multi-label classification challenges. Existing supervised learning approaches depend on large annotated datasets, which are rarely feasible in specialized industries, while current LLM-based methods face difficulties handling hierarchical, multi-label scenarios effectively. To address these issues, we propose TRClass, a novel taxonomy-guided classification approach. The key idea behind TRClass is to integrate domain knowledge into the classification process by first constructing a unified taxonomy semi-automatically, extracting structure from existing documents, and refining it with expert validation. TRClass then guides an LLM to classify requirements by reasoning step-by-step through the taxonomy hierarchy, using few-shot retrieval and confidence-based exploration to achieve accurate multi-label decisions. We validate TRClass using aerospace software requirements as a representative case study for safety-critical industries. Results show that TRClass consistently outperforms baselines, with all components contributing to its overall effectiveness, and remains robust across different LLM configurations. A user study further confirms its practical usability in real-world industrial scenarios.

The reuse of requirements artifacts is essential for software development, particularly in aerospace systems where high reliability and efficiency are paramount. However, current methods for managing these artifacts are predominantly manual and costly, as the artifacts are dispersed across multiple documents and exist in heterogeneous formats. Leveraging recent advances in large language models (LLMs) offers a promising opportunity for automating and scaling requirements reuse. Nonetheless, this approach faces two critical challenges: (1) encapsulating scattered, diverse requirement artifacts into coherent and reusable components, and (2) organizing these components into a structured, easily retrievable library. To address these challenges, we introduce AeroR, a novel format for encapsulating aerospace requirements artifacts, and propose AERORM, an LLM-based method for automated requirements artifact management. AERORM operates in two phases: first, it consolidates requirements from disparate sources into reusable components (i.e., AeroRs); then, it organizes these AeroRs into a hierarchical library to enable efficient retrieval. We validate AERORM on artifacts from six aerospace projects, successfully encapsulating 1,624 AeroRs. A user study with senior engineers shows that 67% of sampled AeroRs are high-quality, and a comparative retrieval study across 12 configurations achieves a best-case Recall@10 exceeding 80%. These results demonstrate the potential of AERORM to automate requirements reuse at scale, offering a practical solution for safety-critical domains.

Simulink plays an important role in the industry for modeling and synthesis of embedded systems. Ensuring system stability requires using numerous test cases to validate the functionality and safety of the models. However, as requirements increase, the complexity of the models poses new challenges to traditional testing methods. Traditional methods such as constraint solving and random search run into significant obstacles when navigating the complex branching logic and states within models.

Interrupt-driven embedded software is widely used in aerospace, automotive electronics, medical equipment, IoT, and other industrial fields. This type of software is usually programmed with interrupts to interact with hardware and respond to external stimuli on time. However, uncertain interleaving execution of interrupts may cause concurrency bugs, resulting in task failure or serious safety issues. A deep understanding of real-world concurrency bugs in embedded software will significantly improve the ability of techniques in combating concurrency bugs, such as bug detection, testing and fixing.

Web browsers exhibit rich semantics that enable a plethora of web-based functionalities. However, these intricate semantics present significant challenges for the implementation and testing of browsers. For example, fuzzing, a widely adopted testing technique, typically relies on handwritten context-free grammars (CFGs) for automatically generating inputs. However, these CFGs fall short in adequately modeling the complex semantics of browsers, resulting in generated inputs that cover only a portion of the semantics and are prone to semantic errors. In this paper, we present SaGe, an automated method that enhances browser fuzzing through the use of production-context sensitive grammars (PCSGs) incorporating semantic information. Our approach begins by extracting a rudimentary CFG from W3C standards and iteratively enhancing it to create a PCSG. The resulting PCSG enables our fuzzer to generate inputs that explore a broader range of browser semantics with a higher proportion of semantically-correct inputs. To evaluate the efficacy of SaGe, we conducted 24-hour fuzzing campaigns on mainstream browsers, including Chrome, Safari, and Firefox. Our approach demonstrated better performance compared to existing browser fuzzers, with a 6.03%-277.80% improvement in edge coverage, a 3.56%-161.71% boost in semantic correctness rate, twice the number of bugs discovered. Moreover, we identified 62 bugs across the three browsers, with 40 confirmed and 10 assigned CVEs.

Attacks on smart contracts have caused considerable losses to digital assets. Many techniques based on symbolic execution, fuzzing, and static analysis are used to detect contract vulnerabilities. Most of the current analyzers only consider vulnerability detection intra-contract scenarios. However, Ethereum contracts usually interact with others by calling their functions. A bug hidden in a path that depends on information from external contract calls is defined as an inter-contract vulnerability. Failure to deal with this kind of bug can result in potential false negatives and false positives. In this work, we propose Pluto, which supports vulnerability detection in inter-contract scenarios. It first builds an Inter-contract Control Flow Graph (ICFG) to extract semantic information among contract calls. Afterward, it symbolically explores the ICFG and deduces Inter-Contract Path Constraints (ICPC) to check the reachability of execution paths more accurately. Finally, Pluto detects whether there is a vulnerability based on some predefined rules. For evaluation, we compare Pluto with five state-of-the-art tools, including Oyente, Mythril, Securify, ILF, and Clairvoyance on a labeled benchmark and 39,443 real-world Ethereum smart contracts. The result shows that other tools can only detect 10% of the inter-contract vulnerabilities, while Pluto can detect 80% of them on the labeled dataset. Beyond that, Pluto has detected 451 confirmed vulnerabilities on real-world contracts, including 36 vulnerabilities in inter-contract scenarios. Two bugs have been assigned with unique CVE identifiers by the US National Vulnerability Database (NVD). On average, Pluto costs 16.9 seconds to analyze a contract, which is as fast as the state-of-the-art tools.

We give an introduction to the MARS toolchain for formal modeling and verification of hybrid systems. It consists of translators from Simulink/Stateflow models to Hybrid Communicating Sequential Processes (HCSP), and tools for simulation, code generation, and deductive verification of an HCSP model. We apply the toolchain to model the descent guidance control phase of the recently launched Tianwen I mars lander, and verify that it correctly controls the velocity of the lander.

Formal methods are promising for modeling and analyzing system requirements. However, applying formal methods to large-scale industrial projects is a remaining challenge. The industrial engineers are suffering from the lack of automated engineering methodologies to effectively conduct precise requirement models, and rigorously validate and verify (V&V) the generated models. To tackle this challenge, in this paper, we present a systematic engineering approach, named Formal Requirement Engineering Platform in Aircraft (FREPA), for formal requirement modeling and V&V in the aerospace and aviation control domains. FREPA is an outcome of the seamless collaboration between the academy and industry over the last eight years. The main contributions of this paper include 1) an automated and systematic engineering approach FREPA to construct requirement models, validate and verify systems in the aerospace and aviation control domain, 2) a domain-specific modeling language AASRDL to describe the formal specification, and 3) a practical FREPA-based tool AeroReq which has been used by our industry partners. We have successfully adopted FREPA to seven real aerospace gesture control and two aviation engine control systems. The experimental results show that FREPA and the corresponding tool AeroReq significantly facilitate formal modeling and V&V in the industry. Moreover, we also discuss the experiences and lessons gained from using FREPA in aerospace and aviation projects.

This paper proposes a requirement analysis approach to periodic control systems that are widely used as one of the real time systems. By regulating the initial requirement documents with key words in natural language, we compile the regulated requirement documents into an intermediate model specified by SPARDL language with formal syntax and semantics. To make the requirement executable, a prototype generation technique is proposed to simulate the system behaviors. To analyze the dataflow relations among modules among the same mode or different modes, we introduce module-level and mode-level dataflow analysis techniques to help system engineers to uncover the potential affections on any two modules. The dataflow analysis techniques are useful especially for module reuse when a new version of the system is developed. We have applied the developed tool based on our approach to the Moon-Exploration Spacecraft Project from Beijing Institute of Control Engineering, and the preliminary experiments are encouraging. We have found both the ambiguity and the inconsistency cases in the requirement documents from the project.

SPARDL is a domain-specific modeling language for periodic control systems, which are widely used in embedded systems. Periodic control systems are usually driven by the given period. A periodic control system can be decomposed into different modes or sub-modes, and each mode represents a system state observed from outside. We believe that introducing static checking will extend the power of SPARDL. In this paper, we develop a type system for SPARDL. To make the contributions of this paper convincible and easy to understand, we apply the traditional approaches to construct the type system for SPARDL. An operational semantics is proposed as the basic explanation of SPARDL. And then some type safety theorems are proved under such semantics. We apply the type system to an industrial case from China Academy of Space Technology(CAST) to evaluate the effectiveness of our approach in practice, and then eight type errors are revealed.