This paper describes experiences using requirements engineering (RE) to reduce the risk of large heterogeneous distributed systems not working in their intended environments. Industry is creating ever-larger systems by integrating increasingly complex smaller systems. As a result, systems integration is becoming a major, or even dominant, risk in the production of systems such as an aircraft, railway or telecommunications infrastructure. The authors we describe some practical techniques used for the RE of such integrated systems. They aim to provide assurance, before development, that the final integrated system will achieve its overall requirements. We illustrate the techniques with case studies drawn from their industrial application.

The paper describes the use of formal development methods on an industrial safety-critical application. The Z notation was used for documenting the system specification and part of the design, and the SPARK subset of Ada was used for coding. However, perhaps the most distinctive nature of the project lies in the amount of proof that was carried out: proofs were carried out both at the Z level (approximately 150 proofs in 500 pages) and at the SPARK code level (approximately 9000 verification conditions generated and discharged). The project was carried out under UK Interim Defence Standards 00-55 and 00-56, which require the use of formal methods on safety-critical applications. It is believed to be the first to be completed against the rigorous demands of the 1991 version of these standards. The paper includes comparisons of proof with the various types of testing employed, in terms of their efficiency at finding faults. The most striking result is that the Z proof appears to be substantially more efficient at finding faults than the most efficient testing phase. Given the importance of early fault detection, we believe this helps to show the significant benefit and practicality of large-scale proof on projects of this kind.