Context: Laws and regulations increasingly influence software design, development, and quality assurance in regulated domains; however, the technology-neutral formulation of legal provisions complicates the derivation of concrete specifications, requirements, and acceptance criteria needed to verify software compliance. Producing these artifacts manually is labour-intensive and error-prone. Recent advances in generative AI, particularly large language models (LLMs), offer the potential for automated assistance in deriving software engineering artifacts from legal texts. Objective: Following a quasi-experimental design, we present the first systematic human-subject evaluation of LLMs’ ability to automatically derive Gherkin behavioural specifications from legal texts. Gherkin is a domain-specific language for specifying system behaviours through scenario-based descriptions written in the Given--When--Then format. Due to their structured and machine-readable nature, Gherkin specifications lend themselves more readily to automation within software-development processes. Methods: We recruited 10 participants to evaluate Gherkin specifications generated from food-safety regulations by two LLMs, Claude and Llama. Sixty specifications were generated. Each participant independently assessed 12 specifications across five quality criteria: relevance , clarity , completeness , singularity , and time savings . Each specification was evaluated by two participants, yielding 120 assessments with quantitative ratings and qualitative feedback. Results: Ratings were uniformly high (top-two categories): relevance 95%, clarity 100%, completeness 94.2%, singularity 93.4%, and time savings 91.7%. No statistically reliable differences were observed across participants or between LLMs. Qualitative feedback noted occasional omissions, hallucinations, and mixed intents; the first two, in particular, underscore the importance of human oversight, especially in safety-critical domains where non-compliance can have severe consequences. Conclusion: Our results suggest that, in the context of food safety, LLMs can assist in deriving Gherkin specifications from legal texts; however, observed omissions and hallucinations necessitate systematic human review.

This paper presents a manifesto that articulates the conceptual foundations of Agentic Business Process Management (APM), an extension of Business Process Management (BPM) for governing autonomous agents executing processes in organizations. From a management perspective, APM represents a paradigm shift from the traditional view on business processes. This shift is driven by the realization of process awareness by agent-oriented abstractions: software and human agents act as primary functional entities that perceive, reason, and act within explicit process frames. Thus, APM moves away from automation-oriented BPM towards systems in which autonomy is constrained, aligned, and made operational through process aware agents. We introduce the core abstractions and architectural elements required to realize APM systems and elaborate on four key capabilities that agents in APM systems must support: framed autonomy , explainability , conversational actionability , and self-modification . These capabilities jointly ensure that agents’ goals are aligned with organizational goals and that agents behave in a framed yet proactive manner in pursuing those goals. We discuss the extent to which the capabilities can be realized and identify research challenges whose resolution requires further advances in BPM, AI, and multi-agent systems. The manifesto thus serves as a roadmap for bridging these communities and for guiding the development of APM systems in practice.

Abstract This research commentary explores how requirements engineering (RE) can contribute to achieving digital humanism in AI-enabled healthcare, ensuring that technological innovation is balanced with human values. Drawing on insights from a panel discussion at the REWBAH’25 (RE for Well-Being, Aging, and Health) workshop, we identify four key themes: the necessity of interdisciplinary collaboration, the nuances of cultural and individual differences, human-AI collaborative decision-making, and the challenge of balancing technological advancement with sustainability and emotional considerations. We argue that RE is well suited for addressing these issues because it brings together diverse stakeholder perspectives to define what systems should achieve and how they should be used. In this paper, we build on digital humanism principles, on RE-relevant frameworks for AI, and on the above themes to frame the role of RE in supporting human-centred healthcare. We highlight open challenges, and outline five promising research directions and related research questions to guide future research and practice in RE, aiming to ensure that AI-enabled healthcare systems better reflect the values of digital humanism.

Eliciting Business Intelligence (BI) requirements is challenging, especially in dynamic business environments. This paper introduces AutoBIR, an AI-driven system that uses semantic search and Large Language Models (LLMs) to automate BI specification and prototyping. Through a conversational interface, it translates user inputs into analytic code, descriptions, and data dependencies while generating test-case reports with optional visuals. AutoBIR refines BI reporting via feedback, accelerating data-driven decision-making. We also explore the broader potential of generative AI in transforming BI development, illustrating its role in enhancing data engineering practice for large-scale, evolving systems.

As software-intensive systems face growing pressure to comply with laws and regulations, providing automated support for compliance analysis has become paramount. Despite advances in the Requirements Engineering (RE) community on legal compliance analysis, important obstacles remain in developing accurate and generalizable compliance automation solutions. This paper highlights some observed limitations of current approaches and examines how adopting new automation strategies that leverage Large Language Models (LLMs) can help address these shortcomings and open up fresh opportunities. Specifically, we argue that the examination of (textual) legal artifacts should, first, employ a broader context than sentences, which have widely been used as the units of analysis in past research. Second, the mode of analysis with legal artifacts needs to shift from classification and information extraction to more end-to-end strategies that are not only accurate but also capable of providing explanation and justification. We present a compliance analysis approach designed to address these limitations. We further outline our evaluation plan for the approach and provide preliminary evaluation results based on data processing agreements (DPAs) that must comply with the General Data Protection Regulation (GDPR). Our initial findings suggest that our approach yields substantial accuracy improvements and, at the same time, provides justification for compliance decisions.

SymboleoNLP is a Web-based tool that allows contract authors to make customizations to a legal contract template using a controlled, yet expressive, natural language. The tool also maintains a formal specification of the contract in Symboleo, a formal specification language designed for the legal contract monitoring domain. The controlled customizations allow for the automated formalization of the customized contract, enabling Symboleo-based property verification and code generation of monitoring smart contracts. This work pushes the boundaries of requirements-based contract template customization with a view towards full formalization.

Industrial control systems (ICSs), such as Supervisory Control and Data Acquisition (SCADA) systems, are increasingly popular for manufacturing applications, leading to significant improvements in efficiency and productivity. However, the vulnerability of these systems to ransomware attacks has become a major concern. This vulnerability is mainly due to the centralized nature of ICSs, which prioritize efficiency over security. To address this issue, this paper proposes a decentralized Blockchain-Based ICS (BBICS) architecture. Such architecture uses a peer-to-peer network of nodes to replicate critical data and distribute transactions using a consensus mechanism, which synchronizes nodes and resolves single points of failure. Additionally, BBICS encrypts critical data in a tamper-resistant manner to prevent attackers from decrypting or manipulating data. Moreover, zero-trust authorization and authentication further enhance security by preventing the broadcasting of ransomware attacks in internal networks of devices. The evaluation of the proposed system with respect to performance and reliability under normal and ransomware attack situations suggest BBICS’ feasibility and practicality.

Automated formalization of legal texts in order to remove ambiguities, conflicts and incompleteness has been a challenge for Requirements Engineering (RE) research for decades. This work seeks to make an incremental step towards this objective for legal contracts by making use of contract templates. Our proposed approach starts with a natural language contract template, together with a manually formalized specification of that template. A contract writer can make customizations to the template, which trigger the automatic formalization of the corresponding customized contract. Our target specification language is Symboleo, which is created specifically for contract verification and monitoring. Starting with a manually formalized template reduces the complexity associated with a fully automated formalization. Typical contract templates use simple fill-in-the-blank parameters, which serve as customizations to formalize in our framing of the problem. Our approach pushes the boundaries of these templates by allowing the contract writer to enter complex natural language customizations, such as prepositional phrases and conditional statements. This work explores what types of natural language patterns can be used in that context by analyzing relevant linguistics and real legal contracts. It also introduces a tool, SymboleoNLP, that suggests the feasibility of the formalization process.

Legal contracts specify requirements for business transactions. As any other requirements specification, contracts may contain errors and violate properties expected by contracting parties. Symboleo was recently proposed as a formal specification language for legal contracts. This paper presents SymboleoPC, a tool for analyzing Symboleo contracts using model checking. It highlights the architecture, implementation and testing of the tool, as well as a scalability evaluation with respect to the size of contracts and properties to be checked through a series of experiments. The results suggest that SymboleoPC can be usefully applied to the analysis of formal specifications of contracts with real-life sizes and structures.

Smart contracts (SCs) are software systems that monitor and control the execution of legal contracts to ensure compliance with the contracts' terms and conditions. They often exploit Internet-of-Things technologies to support their monitoring functions, and blockchain technology to ensure the integrity of their data. Ethereum and business blockchain platforms, such as Hyperledger Fabric, are popular choices for SC development. However, there is a gap in the knowledge of SCs between developers and legal experts. Symboleo is a formal specification language for legal contracts that was introduced to address this issue. Symboleo specifications directly encode legal concepts such as parties, obligations, and powers. In this paper, we propose a tool-supported method for translating Symboleo specifications into smart contracts. We have extended the current Symboleo IDE, implemented the ontology and semantics of Symboleo into a reusable library, and developed the Symboleo2SC tool to generate Hyperledger Fabric code exploiting this library. Symboleo2SC was evaluated with three sample contracts. The results shows that legal contract specifications in Symboleo can be fully converted to SCs for monitoring purposes. Moreover, Symboleo2SC helps simplify the SC development process, saves development effort, and helps reduce risks of coding errors.

A goal model family is a set of related goal models that conform to the same metamodel, with commonalities and variabilities between models. Such families stem from the evolution of initial models into several versions over time and/or the variation of models over the space dimension (e.g., products). In contexts where there are several versions/variations of a goal model, analyzing a set of related models with typical similarities, one model at a time, often involves redundant computations and may require repeated user assistance (e.g., for interactive analysis) and laborious activities. This paper proposes the use of union models as first-class artifacts to analyze families of goal models, in order to improve performance of language-specific analysis procedures. The paper empirically evaluates the performance gain resulting from adapting (or lifting) an existing analysis technique specific to the Goal-oriented Requirement Language (GRL) to a family of GRL models, all at once using a union model, compared to analyzing individual models. Our experiments show, based on the use of the IBM CPLEX optimizer, the usefulness and performance gains of using union models to perform a computationally expensive analysis, namely quantitative backward propagation, on families of GRL models.

Legal contracts specify the terms and conditions (in essence, requirements) that apply to business transactions. Smart contracts are software systems that monitor and control the execution of contracts to ensure compliance. This paper proposes a formal specification language for contracts, called Symboleo, where contracts consist of collections of obligations and powers that define the legal contract's compliant executions. The formal semantics of Symboleo is based on an extension of an ontology for Law and is described in terms of logical axioms on statecharts that describe the lifetimes of contracts, obligations and powers. Our proposal includes a preliminary evaluation through the specification of a real life-inspired Sale-of-Goods contract, with a prototype execution engine. We envision this language to enable formally verifying contracts to detect requirements-level issues and to generate executable smart contracts (e.g., on blockchain technology).

Many Cyber-Physical Systems (CPSs) today are self-adaptive, in order to handle frequent changes in environmental conditions and requirements. In CPSs, goal-based reasoning is often used to include stakeholder and social concerns in decision making during design and runtime adaptation activities. To better support some of these activities, arithmetic semantics for goal models were proposed to enable the generation of mathematical functions usable by systems. However, goal models often allow invalid combinations of alternatives, which can be prevented by companion feature models. In this paper, to enable the generation of valid and optimal configurations for adaptive CPSs, we propose new arithmetic semantics for feature models that enable their transformations to mathematical functions (in several programming languages) further restricting the ones generated from goal models. The composition of feature and goal functions results in a smaller design space, leading to fewer but valid solutions that can be generated (e.g., through optimization) and used in simulations and running adaptive CPSs with social concerns. Finally, a simulation model in SysML is proposed in this paper to demonstrate the feasibility and usefulness of this composition.

This document includes the welcome message from the chairs of the 26th IEEE International Requirements Engineering Conference, including an introduction to the program and main contributors.

We nominate the University of Ottawa Software Engineering Program for the 2017 CSEE&T Hall of Fame. This was one of the first three undergraduate software engineering programs in Canada. It was used to help guide the development of the IEEE/ACM SE2004 curriculum recommendations. It is accredited by both the Canadian Engineering Accreditation Board and the Computer Science Accreditation Council of Canada. It is a bilingual English-French program that has undergone continuous improvement over the years, and now is co-op only, meaning that all its students are required to have three work terms of job experience before graduating.

Regulations constitute a rich source of requirements for software systems, especially so for information systems that handle sensitive data. However, there has been little attention paid to regulators and their requirements for managing the regulatory lifecycle. This paper presents a study of the state-of-practice for regulators in Canada by examining seven Government of Canada (GoC) agencies responsible for regulations. In each case, we attempt to capture the context within which regulations are created, the motivation behind these regulations, and the practices related to their design, enforcement, and review. Our aims are to understand how regulators currently design, monitor, and assess regulations and other regulatory instruments in their respective domains, and to identify opportunities where information system (IS) solutions can be applied to improve practice. Our field study involved reviewing publicly available information and conducting informal interviews. Together, these activities helped us understand key regulators' activities and concerns, as well as important challenges they currently face. In this paper, we summarize our findings and explain the implications for the use of ISs to improve the practice of regulatory management in the form of a research agenda.

The Systems Modeling Language (SysML) is a popular and standardized UML profile for systems engineering applications. In addition to seven conventional UML diagram types, SysML supports requirement diagrams and tables that can be used to capture requirements, their attributes, and their relationships. However, several important concepts such as goals and contributions are not predefined in SysML, hindering the reasoning about tradeoffs and adaptation, especially in emerging socio-cyber-physical systems such as smart cities. In this paper, we provide a preliminary investigation of different ways of combining SysML with the User Requirements Notation (URN), a standard that focuses on the modeling and analysis of goals and scenarios. We argue that SysML and URN are complementary and synergistic, and that their combination enables new requirements modeling, analysis, and management opportunities for new types of systems. Examples of potential integration approaches are discussed, briefly assessed, and illustrated with existing tools for SysML, URN, and requirements management.

A main challenge for clinical protocol evaluations is the lack of public real-world data sets due to the private nature of patient information. We studied the case of phase 1 clinical trials where the identity of participants is key in determining their eligibility to participate in a trial. Our objective is to use the experience from our study to present a list of parameters to help generate data sets that closely match their real-world counterparts. We also examine existing tools and address their limitations with a tool of our own. Through the development of our clinical trial protocol, we discovered a field selection that proved to be efficient to detect a participant's identity, which may be used by other researchers in their protocols.

Researchers need to evaluate newly thought clinical protocols for validity and performance. A main challenge for such evaluations is the lack of real-world data sets due to the private nature of patient information. Researchers resort to synthetic data in order to simulate the real-world counterpart. We present a tool for researchers to increase their confidence in the evaluations they perform by allowing them to run their evaluations on a large number of synthetic data sets efficiently. This tool is used for distributing the evaluation on multiple machines in parallel, hence reducing processing time by the number of machines used, and for monitoring and merging the results. It allows the comparison of multiple algorithms and includes filters based on name length and record field selection to evaluate the effectiveness of algorithms in that regard. It also addresses the firewall limitations of current laboratory infrastructures, especially when security is of key importance.

Every year, governments introduce new or revised regulations that are imposing new types of requirements on software development. Analyzing and modeling these legal requirements is time consuming, challenging and cumbersome for software and requirements engineers. Having regulation models can help understand regulations and converge toward better compliance levels for software and systems. This paper introduces a systematic method to extract legal requirements from regulations by mapping the latter to the Legal Profile for Goal-oriented Requirements Language (GRL) (Legal GRL). This profile provides a conceptual meta-model for the anatomy of regulations and maps its elements to standard GRL with specialized annotations and links, with analysis techniques that exploit this additional information. The paper also illustrates examples of Legal GRL models for The Privacy and Electronic Communications Regulations. Existing tool support (jUCMNav) is also extended to support Legal GRL modeling.

Most systems and business processes in organizations need to comply with more than one law or regulation. Different regulations can partially overlap (e.g., one can be more detailed than the other) or even conflict with each other. In addition, one regulation can permit an action whereas the same action in another regulation might be mandatory or forbidden. In each of these cases, an organization needs to take different strategies. This paper presents an approach to handle different situations when comparing and attempting to comply with multiple regulations as part of a goal-oriented modeling framework named LEGAL-URN. This framework helps organizations find suitable trade-offs and priorities when complying with multiple regulations while at the same time trying to meet their own business objectives. The approach is illustrated with a case study involving a Canadian health care organization that must comply with four laws related to privacy, quality of care, freedom of information, and care consent.

i* is a goal-oriented and agent-oriented modeling framework that focuses on the analysis of intentional and strategic relationships among actors. In this mini-tutorial, we highlight a number of recent applications in practical industrial and business settings.

The User Requirements Notation (URN) enables the graphical modeling of requirements with goals and scenarios, and jUCMNav is a free, Eclipse-based tool that supports modeling and analysis with URN. Concern-Driven Development (CDD) enables requirements engineers to encapsulate and reason about concerns, whether they are crosscutting (i.e., aspects) or not. However, to truly capitalize on the benefits promised by CDD, concerns need to be encapsulated across software development phases, i.e., across different types of models at different levels of abstraction. Recently, URN was extended to support aspect-oriented concepts. This demonstration focuses on the new concern-driven modeling features of jUCMNav, together with its capabilities to compose aspects together, and to transform aspectual scenario models into design models in the Reusable Aspect Models notation. jUCMNav is hence one of the few tools that enable CDD from requirements to design.

Transport Canada is reviewing its Aviation Security regulations in a multi-year modernization process. As part of this review, consideration is given to transitioning regulations where appropriate from a prescriptive style to an outcome-based style. This raises new technical and cultural challenges related to how to measure compliance. This paper reports on a novel approach used to model regulations with the Goal-oriented Requirement Language, augmented with qualitative indicators. These models are used to guide the generation of questions for inspection activities, enable a flexible conversion of real-world data into goal satisfaction levels, and facilitate compliance analysis. A new propagation mechanism enables the evaluation of the compliance level of an organization. This outcome-based approach is expected to help get a more precise understanding of who complies with what, while highlighting opportunities for improving existing regulatory elements.

Context-aware systems often use rule-based reasoning engines for decision making without involving explicit interaction with the user. While rule-based systems excel in filtering out unsuitable solutions based on clear criteria, it is difficult to rank suitable solutions based on vague, qualitative criteria with a rule-based approach. Moreover, the description of such systems is typically ad-hoc without well-defined modeling tasks. CARGO (Context-Aware Reasoning using Goal-Orientation) aims to address these problems by combining rule-based and goal-based reasoning as well as scenario-based modeling to provide a more comprehensive way to define context-aware systems and to process contextual information. This demo presents CARGO, a modeling, simulation, and execution environment for context-aware systems built on existing tool support for the User Requirements Notation.

Abstract Source Code Management (SCM) is a valuable tool in software development projects, providing the ability to store and retrieve past versions of source files. Comparison tools offer the capability to compare different files or versions, highlighting their differences. Most such tools are built around a two‐pane interface, with files displayed side by side. Such interfaces are inefficient in the use of horizontal screen space, and ineffective since duplication makes text more difficult to read, leaving most of the comparison burden to the user. In this article we introduce an innovative metaphor for comparison interfaces. Based on a single‐pane interface, common text is displayed only once with differences intelligently combined into a single text, improving readability. To further improve usability, additional features were developed: difference classification (additions, deletions, and modifications); fine level of granularity; special features to display modifications; and intelligent white space handling. A usability study conducted among 16 participants using real‐world samples demonstrated the interface adequacy: on average, participants were 60% faster in performing comparison tasks, while the quality of answers improved by almost 80% on our scale. After the experiment, the proposed interface was declared the favorite choice by all participants. Copyright © 2010 John Wiley & Sons, Ltd.

In organizations, a gap commonly exists between business goals and business processes. While several approaches provide modeling solutions in each of these two areas, their relationships are often not defined well enough to be used in the software development process. This paper aims to better fill this gap through the introduction of a pattern-based framework that helps construct business processes from organization goals while maintaining traceability relationships between the two. How to extract patterns, which are composed of goal templates, process templates, and their relationships, is briefly presented. The framework, which includes a collection of patterns for a particular domain, is formalized as a profile of the User Requirements Notation, a standard modeling language that supports goals, scenarios, and links between them. A method for the use of such framework is defined and then illustrated through a case study involving an adverse event management system that targets the improvement of patient safety in healthcare organizations.

In this article, we introduce the application of rigorous analysis procedures to goal models to provide several benefits beyond the initial act of modeling. Such analysis can allow modelers to assess the satisfaction of goals, facilitate evaluation of high-level design alternatives, help analysts decide on the high-level requirements and design of the system, test the sanity of a model, and support communication and learning. The analysis of goal models can be done in very different ways depending on the nature of the model and the purpose of the analysis. In our work, we use the Goal-oriented Requirement Language (GRL), which is part of the User Requirements Notation (URN). URN, a new Recommendation of the International Telecommunications Union, provides the first standard goal-oriented language. Using GRL, we develop an approach to analysis that can be done by evaluating qualitative or quantitative satisfaction levels of the actors and intentional elements (e.g., goals and tasks) composing the model. Initial satisfaction levels for some of the intentional elements are provided in a strategy and then propagated to the other intentional elements of the model through the various links that connect them. The results allow for an assessment of the relative effectiveness of design alternatives at the requirements level. Although no specific propagation algorithm is imposed in the URN standard, different criteria for defining evaluation mechanisms are described. We provide three algorithms (quantitative, qualitative, and hybrid) as examples, which satisfy the constraints imposed by the standard. These algorithms have been implemented in the open-source jUCMNav tool, an Eclipse-based editor for URN models. The algorithms are presented and compared with the help of a telecommunication system example. © 2010 Wiley Periodicals, Inc.

In recent years, many governmental regulations have been introduced to protect the privacy of personal information. As a result, organizations must take a systematic approach to ensure that their business processes comply with these regulations. In the past, we introduced a requirements framework that mapped regulations documents and goals to goal and scenario models of organizational processes. The intent was to help organizations document and manage the compliance of their processes in the face of evolutionary changes. In this paper, we extend our framework by incorporating regulation scenario models and by adding the notion of contribution link level to the compliance link types. These extensions result in a frame-work that is more aligned to the needs of an organization when it must evaluate and ensure the legal compliance of its organizational processes.

In November 2008, the User Requirements Notation (URN) was approved as a standard by the International Telecommunication Union (ITU-T). jUCMNav is the most comprehensive tool available to date that supports the definition, analysis, transformation, and management of URN requirements engineering models. URN is the first standardized framework unifying modeling concepts and notations for goals and intentions (mainly for non-functional requirements, quality attributes, and reasoning about alternatives) and scenarios (mainly for operational/functional requirements and reasoning about scenario interactions, performance, and high-level architecture). jUCMNav has been and continues to be instrumental in validating key concepts for the current standard as well as prototyping new concepts.

Interactions between dependent or conflicting aspects are a well-known problem with aspect-oriented development (and related paradigms). These interactions are potentially dangerous and can lead to unexpected or incorrect results when aspects are composed. To date, most aspect interaction detection methods have been based either on purely syntactic comparisons or have relied on heavyweight formal methods. We present a new approach that is based instead on lightweight semantic annotations of aspects. Each aspect is annotated with domain-specific markers and a separate influence model describes how semantic markers from different domains influence each other. Automated analysis can then be used both to highlight semantic aspect conflicts and to trade-off aspects. We apply this technique to early aspects, namely, aspect scenarios, because it is desirable to detect aspect interactions as early in the software lifecycle as possible. We evaluate the technique using an industrial case study and show that the technique detects interactions that cannot be discovered using syntactic techniques.

BACKGROUND: Explicit patient consent requirements in privacy laws can have a negative impact on health research, leading to selection bias and reduced recruitment. Often legislative requirements to obtain consent are waived if the information collected or disclosed is de-identified. OBJECTIVE: The authors developed and empirically evaluated a new globally optimal de-identification algorithm that satisfies the k-anonymity criterion and that is suitable for health datasets. DESIGN: Authors compared OLA (Optimal Lattice Anonymization) empirically to three existing k-anonymity algorithms, Datafly, Samarati, and Incognito, on six public, hospital, and registry datasets for different values of k and suppression limits. Measurement Three information loss metrics were used for the comparison: precision, discernability metric, and non-uniform entropy. Each algorithm's performance speed was also evaluated. RESULTS: The Datafly and Samarati algorithms had higher information loss than OLA and Incognito; OLA was consistently faster than Incognito in finding the globally optimal de-identification solution. CONCLUSIONS: For the de-identification of health datasets, OLA is an improvement on existing k-anonymity algorithms in terms of information loss and performance.

Many Interactive Voice Response (IVR) systems use the popular VoiceXML standard for managing vocal dialogs. For call control aspects, such systems often use the Session Initiation Protocol (SIP) or a similar protocol. W3C is currently developing a new Call Control eXtensible Markup Language (CCXML) standard, at a higher abstraction level than SIP and which could hide the latter in order to accelerate the development of complex VoIP solutions that have an IVR component. But will this really be the case? This paper presents a comparative study base on a simple Personal Assistant system. Although there are undeniable benefits to a CCXML-VoiceXML approach, many observations and lessons lead us to believe that developers will face several limitations and potential pitfalls.

Functional scenarios describing system views, uses, or services are a common way of capturing requirements of distributed systems. However, integrating individual scenarios in different ways may result in different kinds of unexpected or undesirable interactions. We present an innovative approach based on the combined use of two notations. The first one is a recent visual notation for causal scenarios called use case maps (UCMs), which is used to capture and integrate the requirements. Integrating UCMs together helps avoiding many interactions before any prototype is generated. The second notation is the formal specification language LOTOS. UCM scenarios are translated into high-level LOTOS specifications, which can be used to validate the requirements formally through numerous techniques, including functional testing based on UCMs. LOTOS possesses powerful testing concepts and tools that we use for the detection of remaining undesirable interactions. To illustrate these concepts, we use a simple connection example and results from the capture and the validation of several telephony features from the First Feature Interaction Contest.