Practical guide
Write a requirement whose timing can be inspected
Restricted requirement language can expose ambiguity before it reaches code. FRETish makes selected temporal behavior precise enough to compile and analyze.
Replace vague timing with explicit choices
“The gateway should recover quickly” leaves the trigger, deadline and recovery outcome undefined. NASA FRET uses restricted English with formal and visual representations to make requirement meaning reviewable. Proof has its own supported compiler and analysis paths; use the syntax accepted by the installed version.
Illustrative requirement: a retry deadline
when retry_requested the gateway shall within 3 ticks satisfy retry_completed
This names a trigger, component, interval and response. It does not explain the mapping from ticks to wall-clock time, whether completion includes failure, or which response belongs to which request. For concurrent operations, one pair of booleans may lose the identity needed to express the real obligation. Define these choices before treating the sentence as an exact system contract.
Inspect the compiled meaning
proof compile "when retry_requested the gateway shall within 3 ticks satisfy retry_completed" --format json
proof validate --preflight specs/system gateway
Inspect the temporal formula and variable set. Declare the trigger according to who controls it and the response according to who produces it. Preflight catches missing names and ownership problems. Review triggers at startup, repeated triggers, scope changes and the exact deadline. Keep environmental assumptions explicit rather than hiding them in reassuring variable names.
A parseable sentence can still be weak
Realizability asks whether the contract admits an appropriate strategy for allowed inputs. Gap analysis asks where modeled outcomes remain unspecified. Vacuity analysis investigates formulas that hold without exercising their intended behavior. A successful parse answers none of those questions, and none alone establishes that production code implements the sentence.
Map signals to real observations
Identify the request event, timer behavior and completion observation in code. Generated scenarios can suggest tests; record actual executions separately. When the deadline or completion meaning changes, review dependent fixtures and verdicts for freshness. Formalization earns its place by removing a specific ambiguity and enabling evidence against the intended behavior.
Follow the evidence
Compile one timing-sensitive requirement and review a trace that would violate it.
Review one timing-sensitive requirement. Bring the sentence and a real event trace so we can assess its trigger, timing model and observable response.