SHF: Small: Automated Fine-Grained Requirements Traceability

在安全关键领域（如航空航天、运输、通信、医疗器械软件等），需求可追溯性是强制性的。并且它在支持验收测试或监管审查中是必不可少的。 需求和代码之间的可追溯性链接的创建和维护已经被研究人员确定为软件可追溯性的重大挑战之一。鉴于大多数需求都是用自然语言编写的，源代码也包含大量的自然语言，研究人员提出使用文本检索技术来自动恢复可追溯性链接。 基于文本检索的方法固有地遭受低准确性，这是由于需求和源代码之间的词汇不匹配以及检索到的代码（例如类、文件、方法）的粗粒度。 因此，开发人员很少在与代码更改相关的日常任务中使用可跟踪性链接。改进需求和代码之间的自动恢复将有助于软件工程师面临的重要日常任务（如错误定位和代码审查），这反过来将产生潜在的巨大经济影响，因为它可能导致更高质量的软件和更少的开发工作。 此外，安全关键软件的监管审查人员预计将采用本研究项目的结果，以改善他们的工作。 因此，他们的工作对社会的影响预计会很大。该项目将需求到代码的可追溯性检索问题重新定义为一种实用驱动的方法，使用静态代码分析和文本分析，准确地匹配嵌入在需求中的功能约束及其源代码实现。 该项目的一个贡献将是对以自然语言编写的需求中存在的功能约束进行识别和分类。 该项目的核心是由初步研究支持的假设，即开发人员使用定义良好的模式来表达和实现代码中的功能约束，这些约束将被发现和编目。 需求中描述的功能约束将使用自然语言处理技术和深度学习自动识别。 实现模式将使用精确的静态分析技术自动识别。 总的来说，新的需求到代码的可追溯性范例将允许根据不同用户的需要，在不同的粒度级别恢复链接。 最后，新型的可追溯性链接将用于改进基本的软件开发任务，即缺陷定位和代码审查。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Requirements traceability is mandatory in safety-critical domains (such as aerospace, transportation, communication, medical device software, etc.) and it is essential in supporting acceptance testing or regulatory reviews. The creation and maintenance of traceability links between requirements and code has been identified by researchers as one of the grand challenges in software traceability. Given that most requirements are written in natural language and source code also contains large amounts of natural language, researchers proposed using text-retrieval techniques for automated traceability-link recovery. Text-retrieval-based approaches inherently suffer from low accuracy due to the vocabulary mismatch between requirements and source code and the coarse-grained granularity of the retrieved code (such as classes, files, methods). As a consequence, developers rarely use traceability links in everyday tasks related to code change. Improving the automated recovery between requirements and code will help with important daily tasks faced by the software engineers (such as bug localization and code reviews), which in turn will have a potentially large economic impact, as it may lead to higher quality software and less development effort. In addition, regulatory reviewers of safety-critical software are expected to adopt results of this research project to improve their work. The impact of their work on society is expected to be high as a result. This project redefines the requirement-to-code traceability-retrieval problem into a heuristic-driven approach, using static code analysis and text analysis, which accurately matches functional constraints embedded in requirements to their source code implementations. One contribution of the project will be the identification and classification of functional constraints present in requirements, written in natural language. Central to the project is the hypothesis, supported by preliminary research, that developers use well-defined patterns to express and implement the functional constraints in code, which will be discovered and cataloged. The functional constraints described in requirements will be automatically identified using natural-language-processing techniques and deep learning. The implementation patterns will be automatically identified using precise static-analysis techniques. Overall, the novel requirements-to-code traceability paradigm will allow recovering links at various granularity levels, as needed by various users. Finally, the new type of traceability links will be used to improve essential software-development tasks, namely bug localization and code reviews.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.