7 Conclusions and Future Work

Therefore, the monotonicity of hypotheses can be stated as a requirement because it follows from the specification of the domain knowledge. If a requirement cannot be derived from the domain knowledge it must be stated as an assumption. In our example, the requirement ∃ x (x ∈ observables) cannot be derived from the domain knowledge because it is concerned with the input. However, assuming an input for deriving a diagnosis is not a critical assumption. For example, a more serious assumption would be the single-fault assumption (cf. [8]). Formulating it as a requirement on domain knowledge enforces that each possible fault combination is represented as a single fault by the domain knowledge. Therefore, it is often used as an assumption that limits the scope of the problems that can be handled correctly by the system. Cases, where a single fault is the actual cause can be solved correctly by the system. Situation with more complex error situations must be solved without support by the system. In general, formulating a property as a requirement increases the demand on domain knowledge and formulating a property as an assumption decreases the application scope of the system (cf. [4]). In the paper, we introduce a formal and conceptual framework for specifying and verifying KBSs. One can specify tasks, PSMs, domain models, and adapters and can verify whether the assumed relationships between them are guaranteed, i.e., which assumptions are necessary for establishing these relationships. Such a conceptual model improves the understandability of specification and verification. The modularization reduces the effort in specification and verification by defining smaller contexts and enabling reuse of smaller parts in new contexts. The idea of an adapter allows to combine and adapt reusable elements without being forced to modify them. The specification of the PSM is decomposed in external and internal aspects. The specification of the competence of the PSM provide all necessary aspects for relating it with the task that must be solved. When specifying a reusable PSM it must be proven one time whether the operational specification specifies a terminating computational process that has the specified competence. When reusing the method, it is possible to abstract from all details of the internal operationalization and refer only to the external specification of the competence. This requires that the competence specification is complete for the signature that describes the input and the output of the method. In analogy to [28] …