An Intent Specifications Model for a Robotic Software Control System

Intent specifications are a new way to structure specifications to support human problem solving, system and software development and evolution, traceability, and specification of design rationale. An intent specification provides a hierarchical abstraction based on intent ("why") in addition to the usual "what" and "how." For a given system being specified, an intent specification defines seven levels, each one of them supporting a different type of reasoning about the system. Each level is mapped to the appropriate parts of the intent levels above and below it, providing a means to trace design rationale and decisions from high-level system requirements and constraints down to code and vice versa (from code to specifications, requirements, and safety analyses). The third level of an intent specification contains a black-box model that uses an executable formal specification language, SpecTRM-RL, which provides special support for requirements review and analysis -particularly for completeness and safety. SpecTRM-RL models can be mathematically analyzed and checked for various properties, including human-computer interaction properties such as mode confusion. They can also be executed as part of system simulations. The approach is demonstrated using an industrial robot designed to service the heat resistant tiles on the Space Shuttle. Introduction Intent Specifications are a new way of structuring system and software specifications to support the development of large and complex realtime control systems [1]. Special attention is given to the support of system safety techniques throughout the entire development process. The specifications are organized along two dimensions: intent abstraction and part-whole abstraction (see Figure 1). The intent dimension specifies seven hierarchical levels that each support a different type of reasoning about the system. The part-whole dimension is itself divided into refinement and decomposition, providing a way to structure the pertinent information within each level. Lack of documentation and analysis of design decisions in any engineering project can lead to serious development delays and cost overruns, losses and disruptions during operations, and serious problems in upgrading and evolving the system design [2]. Specifying design rationale is particularly important to being able to change complex systems without introducing errors or inadvertently reversing decisions that should not be reversed. The fear of making such mistakes has on occasion led to leaving obsolete functions in the design (which, itself, has led to accidents). In either case, the safety of the system is compromised by the lack of documentation of necessary information. The traditional specification models establish what-how relationships between the hierarchical levels. That is, they enumerate what functions are required and how they are accomplished. The intent or "why" relationship adds the ability to keep track of the rationale behind system design decisions and changes. Each intent level contains intent information ("why") about the level below. The levels are mapped to the appropriate parts of the intent levels above and below, providing