  Verification of complex, safety-critical systems is a significant challenge.
Manual testing and simulations are often used, but are only capable of
exploring a subset of the system's reachable states. Formal methods are
mathematically-based techniques for the specification and development of
software, which can provide proofs of properties and exhaustive checks over a
system's state space. In this paper, we present a formal requirements-driven
methodology, applied to a model of an aircraft engine controller that has been
provided by our industrial partner. Our methodology begins by formalising the
controller's natural-language requirements using the (pre-existing) Formal
Requirements Elicitation Tool (FRET), iteratively, in consultation with our
industry partner. Once formalised, FRET can automatically translate the
requirements to enable their verification alongside a Simulink model of the
aircraft engine controller; the requirements can also guide formal verification
using other approaches. These two parallel streams in our methodology seek to
combine the results from formal requirements elicitation, classical
verification approaches, and runtime verification; to support the verification
of aerospace systems modelled in Simulink, from the requirements phase through
to execution. Our methodology harnesses the power of formal methods in a way
that complements existing verification techniques, and supports the
traceability of requirements throughout the verification process. This
methodology streamlines the process of developing verifiable aircraft engine
controllers, by ensuring that the requirements are formalised up-front and
useable during development. In this paper we give an overview of (FRET),
describe our methodology and work to-date on the formalisation and verification
of the requirements, and outline future work using our methodology.
