Topic · FRETish

How do I write FRETish requirements a compiler can check?

Proof compiles FRETish, one structured English sentence, into temporal logic. The compiler either accepts the sentence or it does not. That is the machine-checkable part.

proof validate --preflight

TLA+, Alloy, and Dafny still win when the spec is an arbitrary formula. FRETish is 288 templates, not a general-purpose prover language.

Request demo The five slots

01 · The distinction

English hides the off-by-one. FRETish cannot.

"Enter safe mode upon anomalous readings" is a requirement people will sign. It does not say which sensors, which threshold, or whether exceeding means > or >=. The translator has to pick. The compiler then has something to check.

FRETish is the structured English NASA's FRET project used so a requirements engineer could write a sentence that still compiled to temporal logic. Proof ships a compiler for that grammar. A valid sentence has up to five parts: optional scope, optional condition, a component, a priority word (shall / should / may), optional timing, and a response. Only component, priority, and response are required.

Gherkin, OpenAPI, and JSON Schema are also machine-checkable, in other directions. Gherkin is an example. OpenAPI is a contract on the wire. Neither compiles a shall about the component's behaviour into LTL. TLA+, Alloy, Dafny, and Frama-C do, if you write in their languages. Proof's bet is the English-shaped subset: 288 templates, each with a fixed translation.

02 · The exhibit

One sentence. A key the compiler looks up.

The compiler decomposes the sentence into scope,condition,timing,response, loads the matching template, and substitutes the variables. An undeclared variable fails preflight. A nested sequence does not parse as one sentence.

Signed prose

Sentence Enter safe mode upon anomalous readings
Gap > vs >= never written

People will sign it

Compiler

Nothing to compile. The translator has to pick.

No template

English

Still ambiguous.

Signed

Proof

Slots scope, condition, shall, timing, response
Command proof validate --preflight

Parses or it does not

Same shall. Two grammars. Click the tabs.

Slot	What it names	Default if omitted
Scope	`in`, `after`, `before`, `while`, `only in`, `except in`	Global. Always active.
Condition	`if` / `when`, `unless`, `upon` / `whenever`	None. Always applies.
Component + priority	One identifier, then `shall`, `should`, or `may`	Required. No default.
Timing	`always`, `never`, `immediately`, `eventually`, `within N ticks`	Immediate.
Response	`satisfy` a boolean expression over declared variables	Required. No default.

A circuit breaker written as one business rule does not fit a template: after five failures open; after 30 ticks try one request; on success close; on failure reopen. That needs nested sequencing. Split it, or do not pretend FRETish said it.

when five_failures the gateway shall within 30 ticks satisfy half_open
in half_open if success the gateway shall immediately satisfy closed
in half_open if failure the gateway shall immediately satisfy open

proof compile "when five_failures the gateway shall within 30 ticks satisfy half_open"
proof validate --preflight specs/system gateway

Each sentence is independently checkable. Consistency across the three is a different command, not a hidden fourth slot.

03 · The honest loss

FRETish is not TLA+. Informal requirements still exist.

The 288 templates cover single-operator temporal patterns and simple nesting. They do not cover chained timeouts with different durations, or "do A, then B or C depending on the outcome," as one sentence.

Keep TLA+, Alloy, or Dafny if the specification is an arbitrary formula and the team already writes in that language. Proof does not replace them. Cucumber/Gherkin, OpenAPI, and JSON Schema stay the right tools for examples, wire contracts, and schema validation. They are named here, not on twin pages.

Not every requirement in a programme is formalizable. Stakeholder prose that states intent no formula expresses is marked informal and discharged through the machine-checkable requirements underneath it. Jama still wins at programme authoring: thousands of shalls, reviews, baselines. Proof compiles the subset that has a trigger, a component, and a response, then re-reads the code. A green compile is not a claim the software is correct. It is a claim the sentence parsed.

The other direction of the same problem is links that were asserted once and never re-derived. That is the traceability matrix.

Request demo Instruments