Article,
Operational anomalies as a cause of safety-critical requirements evolution
Journal of Systems and Software, 65 (2): 155--161 (February 2003)
DOI: 10.1016/S0164-1212(02)00057-2
Abstract
This paper reports the results of a small study of requirements changes to the onboard software of seven spacecraft subsequent to launch. Only those requirement changes that resulted from operational (i.e., post-launch) anomalies were of interest here, since the goal was to better understand the relationship between critical anomalies during operations and how safety-critical requirements evolve. The results of the study were surprising in that anomaly-driven requirements changes during operations were rarely due to previous requirements having been incorrect. Instead, changes involved new requirements either (1) for the software to handle rare but high-consequence events or (2) for the software itself to compensate for hardware failures or limitations. The prevalence of new requirements as a result of post-launch anomalies suggests a need for increased requirements-engineering support of maintenance activities in these systems. The results also confirm both the difficulty and the benefits of pursuing requirements completeness, especially in terms of fault tolerance, during development of critical systems.
