High Assurance Requires Goal Orientation

High assurance systems must guarantee safety, security, fault tolerance and survivability objectives; it is therefore essential that such objectives be made explicit, refined, specified precisely and completely in application-specific terms, interrelated and analyzed thoroughly. The paper argues that goals are an essential abstraction for eliciting, elaborating, modeling, specifying, analyzing, verifying, negotiating and documenting robust and conflict-free requirements for high assurance systems. A safety injection system for a nuclear power plant is used as a running example to illustrate the key role of goals while engineering such requirements.