Building Dependable Systems

R1. There is a single control button available for the user of the oven. If the oven is idle with the door closed and you push the button, the oven will start cooking (this is, energize the power-tube for one minute).

R2. If the button is pushed while the oven is cooking it will cause the oven to cook for an extra minute.

R1. There is a single control button available for the user of the oven. If the oven is idle with the door closed and you push the button, the oven will start cooking (this is, energize the power-tube for one minute).

R2. If the button is pushed while the oven is cooking it will cause the oven to cook for an extra minute.

R1. There is a single control button available for the user of the oven. If the oven is idle with the door closed and you push the button, the oven will start cooking (this is, energize the power-tube for one minute).

R2. If the button is pushed while the oven is cooking it will cause the oven to cook for an extra minute.

R1. There is a single control button available for the user of the oven. If the oven is idle with the door closed and you push the button, the oven will start cooking (this is, energize the power-tube for one minute).

R2. If the button is pushed while the oven is cooking it will cause the oven to cook for an extra minute.

Ambiguous

Incomplete

Inconsistent

Complex

Defect RemovalFormalisation

Control of Complexity

Behavior Trees

Integrated Behavior Tree

Simulation

Model Checking

Implementation

Informal Requirements

Integration

Informal Requirements

Integrated Behavior TreeRequirements Integration

Requirement Behavior Trees

Informal Requirements

Requirements Translation

Simulation

Verification

R1. There is a single control button available for the user of the oven. If the oven is idle with the door closed and you push the button, the oven will start cooking (this is, energize the power-tube for one minute).

R2. If the button is pushed while the oven is cooking it will cause the oven to cook for an extra minute.

R3. Pushing the button when the door is open has no effect (because it is disabled).

R4. Whenever the oven is cooking or the door is open the light in the oven will be on.

R5. Opening the door stops the cooking.

R6. Closing the door turns off the light. This is the normal idle state, prior to cooking when the user has placed food in the oven.

R7. If the oven times-out, the light and the power-tube are turned off and then a beeper emits a sound to indicate that the cooking is finished.

Component Behavior Tree

Implementation

Component Behavior Tree

Implementation

Informal Requirements

Integrated Behavior TreeRequirements Integration

Requirement Behavior TreesRequirements Translation

Simulation

Verification

R1. There is a single control button available for the user of the oven. If the oven is idle with the door closed and you push the button, the oven will start cooking (this is, energize the power-tube for one minute).

R2. If the button is pushed while the oven is cooking it will cause the oven to cook for an extra minute.

R3. Pushing the button when the door is open has no effect (because it is disabled).

R4. Whenever the oven is cooking or the door is open the light in the oven will be on.

R5. Opening the door stops the cooking.

R6. Closing the door turns off the light. This is the normal idle state, prior to cooking when the user has placed food in the oven.

R7. If the oven times-out, the light and the power-tube are turned off and then a beeper emits a sound to indicate that the cooking is finished.

Requirements Translation

Informal Requirements

Integrated Behavior TreeRequirements Integration

Requirement Behavior TreesRequirements Translation

Simulation

Verification

R1. There is a single control button available for the user of the oven. If the oven is idle with the door closed and you push the button, the oven will start cooking (this is, energize the power-tube for one minute).

R2. If the button is pushed while the oven is cooking it will cause the oven to cook for an extra minute.

R3. Pushing the button when the door is open has no effect (because it is disabled).

R4. Whenever the oven is cooking or the door is open the light in the oven will be on.

R5. Opening the door stops the cooking.

R6. Closing the door turns off the light. This is the normal idle state, prior to cooking when the user has placed food in the oven.

R7. If the oven times-out, the light and the power-tube are turned off and then a beeper emits a sound to indicate that the cooking is finished.

Requirement Behavior Tree

Component Behavior Tree

Implementation

Component Behavior Tree

Implementation

Informal Requirements

Integrated Behavior TreeRequirements Integration

Requirement Behavior TreesRequirements Translation

Simulation

Verification

R1. There is a single control button available for the user of the oven. If the oven is idle with the door closed and you push the button, the oven will start cooking (this is, energize the power-tube for one minute).

R2. If the button is pushed while the oven is cooking it will cause the oven to cook for an extra minute.

R3. Pushing the button when the door is open has no effect (because it is disabled).

R4. Whenever the oven is cooking or the door is open the light in the oven will be on.

R5. Opening the door stops the cooking.

R6. Closing the door turns off the light. This is the normal idle state, prior to cooking when the user has placed food in the oven.

R7. If the oven times-out, the light and the power-tube are turned off and then a beeper emits a sound to indicate that the cooking is finished.

Requirements Integration

Informal Requirements

Integrated Behavior TreeRequirements Integration

Requirement Behavior TreesRequirements Translation

Simulation

Verification

R1. There is a single control button available for the user of the oven. If the oven is idle with the door closed and you push the button, the oven will start cooking (this is, energize the power-tube for one minute).

R2. If the button is pushed while the oven is cooking it will cause the oven to cook for an extra minute.

R3. Pushing the button when the door is open has no effect (because it is disabled).

R4. Whenever the oven is cooking or the door is open the light in the oven will be on.

R5. Opening the door stops the cooking.

R6. Closing the door turns off the light. This is the normal idle state, prior to cooking when the user has placed food in the oven.

R7. If the oven times-out, the light and the power-tube are turned off and then a beeper emits a sound to indicate that the cooking is finished.

Integrated Behavior Tree

Component Behavior Tree

Implementation

Informal Requirements

Integrated Behavior TreeRequirements Integration

Requirement Behavior TreesRequirements Translation

Simulation

Verification

R1. There is a single control button available for the user of the oven. If the oven is idle with the door closed and you push the button, the oven will start cooking (this is, energize the power-tube for one minute).

R2. If the button is pushed while the oven is cooking it will cause the oven to cook for an extra minute.

R3. Pushing the button when the door is open has no effect (because it is disabled).

R4. Whenever the oven is cooking or the door is open the light in the oven will be on.

R5. Opening the door stops the cooking.

R6. Closing the door turns off the light. This is the normal idle state, prior to cooking when the user has placed food in the oven.

R7. If the oven times-out, the light and the power-tube are turned off and then a beeper emits a sound to indicate that the cooking is finished.

Component Behavior Tree

Component Behavior Tree

Implementation

Informal Requirements

Integrated Behavior Tree

Requirement Behavior TreesRequirements Translation

Simulation

Verification

R1. There is a single control button available for the user of the oven. If the oven is idle with the door closed and you push the button, the oven will start cooking (this is, energize the power-tube for one minute).

R2. If the button is pushed while the oven is cooking it will cause the oven to cook for an extra minute.

R3. Pushing the button when the door is open has no effect (because it is disabled).

R4. Whenever the oven is cooking or the door is open the light in the oven will be on.

R5. Opening the door stops the cooking.

R6. Closing the door turns off the light. This is the normal idle state, prior to cooking when the user has placed food in the oven.

R7. If the oven times-out, the light and the power-tube are turned off and then a beeper emits a sound to indicate that the cooking is finished.

Requirements Integration

Simulation

Component Behavior Tree

Implementation

Informal Requirements

Integrated Behavior TreeRequirements Integration

Requirement Behavior TreesRequirements Translation

Simulation

Verification

R1. There is a single control button available for the user of the oven. If the oven is idle with the door closed and you push the button, the oven will start cooking (this is, energize the power-tube for one minute).

R2. If the button is pushed while the oven is cooking it will cause the oven to cook for an extra minute.

R3. Pushing the button when the door is open has no effect (because it is disabled).

R4. Whenever the oven is cooking or the door is open the light in the oven will be on.

R5. Opening the door stops the cooking.

R6. Closing the door turns off the light. This is the normal idle state, prior to cooking when the user has placed food in the oven.

R7. If the oven times-out, the light and the power-tube are turned off and then a beeper emits a sound to indicate that the cooking is finished.

Verification

Component Behavior Tree

Implementation

Automatically Generated Implementation

Informal Requirements

Integrated Behavior Tree

Requirements Translation

Simulation

Verification

Component Behavior Tree

R1. There is a single control button available for the user of the oven. If the oven is idle with the door closed and you push the button, the oven will start cooking (this is, energize the power-tube for one minute).

R2. If the button is pushed while the oven is cooking it will cause the oven to cook for an extra minute.

R3. Pushing the button when the door is open has no effect (because it is disabled).

R4. Whenever the oven is cooking or the door is open the light in the oven will be on.

R5. Opening the door stops the cooking.

R6. Closing the door turns off the light. This is the normal idle state, prior to cooking when the user has placed food in the oven.

R7. If the oven times-out, the light and the power-tube are turned off and then a beeper emits a sound to indicate that the cooking is finished.

Implementation

Informal Requirements

Integrated Behavior Tree

Requirement Behavior TreesRequirements Translation

Simulation

Verification

Component Behavior Tree

R1. There is a single control button available for the user of the oven. If the oven is idle with the door closed and you push the button, the oven will start cooking (this is, energize the power-tube for one minute).

R2. If the button is pushed while the oven is cooking it will cause the oven to cook for an extra minute.

R3. Pushing the button when the door is open has no effect (because it is disabled).

R4. Whenever the oven is cooking or the door is open the light in the oven will be on.

R5. Opening the door stops the cooking.

R6. Closing the door turns off the light. This is the normal idle state, prior to cooking when the user has placed food in the oven.

R7. If the oven times-out, the light and the power-tube are turned off and then a beeper emits a sound to indicate that the cooking is finished.

Requirements Integration

Building Dependable Systems

Implementation

Building Dependable Systems

1. Control of ComplexityAvoids short-term memory overflow

2. Early Defect DetectionQuality, verified

software

3. Rigorous TranslationBuilding right system,

right

4. Ease of Simulation, Model checking Dependable systems

5. Productivity gains for teams

Parallel working,Co-operative editing

6. Wide applicabilityCommand and Control,

Enterprise Systems