Formulated in the late 1970s to specify the requirements of the Operational Flight Program (OFP) of the A-7 aircraft [8] , the SCR (Software Cost Reduction) requirements method is a method based on tables for specifying the requirements of software systems. During the 1980s and the early 1990s, many companies, including Bell Laboratories, Grumman, Ontario Hydro, and Lockheed, applied the SCR requirements method to practical systems. Each of these applications of SCR had, at most, weak tool support. To provide powerful, robust tool support customized for the SCR method, we have developed the SCR* toolset. To provide formal underpinnings for the method, we have also developed a formal model which defines the semantics of SCR requirements specifications. In SCR, monitored and controlled variables represent environmental quantities that the system monitors and controls [7] . The environment nondeterministically produces a sequence of input events, where an input event is a change in some monitored quantity. The system responds to each input event in turn by changing state and possibly changing one or more controlled quantities. The SCR formal model, a special case of the classic state machine model, represents a system as a 4-tuple, S; S 0 ; E m ; T , where S is a set of states, S 0 S is the initial state set, E m is the set of input events, and T is a function describing the allowed state transitions [7] . T is a composition of simpler functions derived from the tables in an SCR specification. The formal model requires each table to satisfy certain properties. These properties guarantee that each table describes a total function. To specify the system requirements concisely, the SCR method uses mode classes, conditions, and events. A mode class organizes the system states into equivalence classes, each called a mode. The SCR model includes a set RF containing the names of all variables (e.g., monitored and controlled variables, mode classes) in a given specification and a type function TY mapping each variable in RF to a set of values. In the model, a state is a function mapping each variable r in RF to its value in TYr, a condition is a predicate defined on a state, and an event is a predicate defined on two states when any state variable changes. SCR* is an integrated suite of tools supporting the SCR requirements method. It includes a specification editor for creating a requirements specification, a dependency graph browser for displaying the variable dependencies, a consistency checker for detecting well-formedness errors (e.g., missing cases), a simulator for validating the specification, a model checker and theorem prover for checking application properties, and an invariant generator for automatically constructing state invariants from the SCR tables. To create and modify a requirements specification, the user invokes the specification editor [4] . Each SCR specification is organized into dictionaries and tables. The dictionaries define the static information in the specification, such as the names and values of variables and the user-defined types. The tables specify how the variables change in response to input events. Eacj Dependency Graph Browser. Understanding the relationship between different parts of a large specification can be difficult. To address this problem, the Dependency Graph Browser (DGB) represents the dependencies among the variables in a given SCR specification as a directed graph [6] . By studying the graph, a user can detect errors such as undefined variables and circular definitions. He can also use the DGB to extract and analyze subsets of the dependency graph, e.g., the subgraph containing all variables upon which a selected controlled variable depends. Consistency Checker. The consistency checker [7, 6] analyzes a specification for consistency with the SCR requirements model. It exposes syntax and type errors, variable name discrepancies, missing cases, nondeterminism, and circular definitions. When an error is detected, the consistency checker provides detailed feedback to facilitate error correction. A form of static analysis, consistency checking avoids executing the specification and reachability analysis. In developing an SCR specification, the user normally
A well-known specification technique for requirements is the software cost reduction (SCR) method REF .
Using the SCR* toolset to specify software requirements
Proceedings. 2nd IEEE Workshop on Industrial Strength Formal Specification Techniques
Proceedings. 2nd IEEE Workshop on Industrial Strength Formal Specification Techniques
Computer Science