Formal Specification Translation

• Formal specification translation is a process that rigorously maps system specifications from one formalism to another while preserving semantics.
• It employs diverse methodologies such as template-driven, grammar-aware, and neural approaches to ensure formal verification and tool interoperability.
• This technique supports applications in safety-critical systems, model-based engineering, and automated code verification with traceable validation.

Formal specification translation refers to the systematic, semantics-preserving mapping of system specifications expressed in one formalism, modeling notation, or structured natural language into another formal specification language. This activity is foundational in rigorous systems engineering, model-based development, and formal verification, as it enables requirements and design models to be analyzed by diverse tool chains, to be realized in different target logics, or to be linked from high-level requirements documents to implementation-level artifacts in a traceable fashion.

1. Scope and Motivation

Formal specification translation is crucial wherever there is a semantic gap between requirements capture and target verification/analysis environments, or between different components of a modeling stack. Typical motivations include:

• Enabling formal verification/model-checking of requirements specified informally or in high-level notations by translating them into logics supported by verification tools, such as LTL, MTL, PCTL*, or first-order or higher-order logics (Ma et al., 19 Dec 2025, Conrad et al., 2022, Hahn et al., 2022, Gordon et al., 2023).
• Bridging graphical/ontological system models (SysML, KAOS, ontologies) to formal system-level or data-level specification for theorem proving, behavioral analysis, or proof obligation generation (Tueno et al., 2017, Fotso et al., 2018).
• Supporting tool interoperability in model-based development, e.g., translating textual requirements into formal Simulink observers, BTC EmbeddedValidator SPECs, or SV-COMP C stubs (Berger et al., 2019, Liu et al., 2016).
• Enabling synthesis and realizability checking from semi-structured or structured English requirements, which are then mapped to target logics amenable to synthesis analysis (Yan et al., 2014, Conrad et al., 2022).
• Automating the passage from algebraic or rule-based specifications to executable contracts and code-level verification—e.g., algebraic modules in CafeOBJ to Design-by-Contract annotations in JML for Java (Triantafyllou et al., 2012, Hähnle et al., 24 Sep 2025).

The process may be highly automated, fully compositional, and formally justified, or may require some human–in-the-loop for intermediate model or parse tree correction, especially in translation pipelines originating from unconstrained or ambiguous natural language (Gordon et al., 2023, Ma et al., 19 Dec 2025).

2. Translation Methodologies and Architectures

Translation approaches are highly varied and typically driven by source/target formalisms, structural patterns in source models, and trust/traceability objectives. Common patterns include:

1. Syntactic Template-Driven: Requirements conforming to structured language templates are algorithmically mapped to formal formulas by pattern-matching and substitution, preserving structural semantics (Berger et al., 2019, Ma et al., 19 Dec 2025, Conrad et al., 2022).
2. Grammar- and Ontology-Aware: Ontological or domain models (e.g., SysML/KAOS) are mapped via generic, rule-based patterns into the constructs of a set-based, invariant- or event-oriented formalism (e.g., Event-B, B System) using a translation schema that tracks concepts, individuals, relations, attributes, and their properties (Tueno et al., 2017).
3. Modular/Hierarchical Decomposition: High-level requirements or modular designs are decomposed into intermediate trees (e.g., OnionL), which organize the semantic structure for post-order deterministic synthesis into the target logic (Ma et al., 19 Dec 2025).
4. Intermediate Representation and Staging: Many translation pipelines introduce a rigorously-defined, typed intermediate representation (IR), which enables validation, deterministic synthesis, and offers a hook for manual semantic patching or certificate explanation (Ma et al., 19 Dec 2025, Gordon et al., 2023).
5. Neural and Neuro-Symbolic Systems: Data-driven and LLM-based methods leverage transformer models or seq2seq architectures to generalize from training pairs of requirements and logic formulas, or to perform local semantic decomposition that is then formally validated (Hahn et al., 2022, He et al., 2021, Gordon et al., 2023, Ma et al., 19 Dec 2025).

These approaches generally aim at soundness (provable semantic equivalence or inclusion), coverage (expressiveness w.r.t. practical requirements), and traceability (certificate or witness generation for auditability).

3. Representative Translation Rules and Formal Guarantees

A central achievement in formal specification translation is the systematic definition and (often mechanized) proof of generic mapping rules, ensuring semantic preservation. As a typical instance, translation from SysML/KAOS domain ontologies to Event-B operates as follows (Tueno et al., 2017):

• Concepts: Top-level concepts with no parent map to SETs (carrier sets) in Event-B CONTEXTs; sub-concepts map to constants declared as subsets; variable domains map to VARIABLES tracking dynamic extent, constrained by invariants.
• Individuals: Map to CONSTANTS typed via the parent concept.
• Enumerated DataSets: Map to SETS and associated constants; non-enumerated datasets to SETs or constants.
• Relations and Attributes: Map to CONSTANTS (if static) or VARIABLES (if variable), with explicit EVENT-B type constants specifying domain/range, cardinality, and properties such as functional, injective, symmetric, etc. Maplets are declared by explicitly axiomatizing element pairs.
• Predicates and Gluing Invariants: Copied verbatim into B SYSTEM property/invariant clauses.

Each rule potentially introduces proof obligations (e.g., type consistency, invariant preservation in INITIALISATION); compliance is checked automatically by formal tools such as Rodin.

Tabular Summary: Example translation rules from SysML/KAOS to Event-B (Tueno et al., 2017)

Ontology Element	Event-B Construct	Proof Obligation / Property
Concept (no parent)	SETS C	None
Concept (with parent)	CONSTANT C; C⊆Parent	Subset typing
Individual	CONSTANT ind; ind∈C	Typing
Relation (static)	CONSTANT R; R∈Dom↔Ran	Typing, cardinality
Relation (variable)	VARIABLE R; R∈Dom↔Ran	Invariant, initialization
AttributeMaplet	CONSTANT; Maplet = pair	Axiomatization
GluingInvariant	INVARIANT or PROPERTY	Well-typedness, refinement proof

This compositional, rule-based approach is echoed in other frameworks, including translation from AGREE contracts (AADL annex, Lustre style) into Simulink observers (Liu et al., 2016), and OTS/CafeOBJ specifications to JML-annotated Java classes (Triantafyllou et al., 2012).

4. Intermediate Representation and Semantic Decomposition

For translation tasks originating from (structured or free-form) natural language, a crucial step is the semantic normalization of the requirement into a canonical intermediate representation that mediates between surface syntax and target logic.

• OnionL (Req2LTL): A hierarchical JSON-based tree whose nodes are scope operators, relation connectives, and normalized atomic propositions (with fields for component, variable, relation, formula), providing a complete account of syntactic and semantic structure. This enables deterministic, rule-driven synthesis of LTL formulas, machine-validation, and human-in-the-loop correction if required (Ma et al., 19 Dec 2025).
• Lean "pspec" certificates: By building a categorial grammar for controlled English in Lean, each successfully parsed requirement produces a tree of instance applications (carrying categories, spans, and semantic terms), forming a proof certificate checked by the Lean kernel. The path from English phrase to Lean proposition is fully audited and reconstructible (Gordon et al., 2023).
• Structured Natural Language (FRETish, FRET): Requirements authored in a multi-field ANTLR-style grammar are mapped to MTL or PCTL* via compositional translation functions, with denotational semantics and correctness theorems encoded in theorem provers for full trust (Conrad et al., 2022, Mavridou et al., 15 Dec 2025).

Intermediate representations enable both precise semantic tracking and rigorous validation at every stage of translation, and are instrumental in supporting extensibility, modularity, and auditable synthesis.

5. Practical Tool Chains, Proof Obligations, and Validation

Translation frameworks in practice are typically embedded in end-to-end tool chains equipped for:

• Automated syntactic/semantic parsing (ANTLR-based frontends, AST construction, typechecking).
• Formal rule application (mapping AST or IR nodes to target formalization constructs).
• Certificate generation (producing proof certificates, core-to-target correspondence, or traceability maps).
• Proof obligation generation and discharge (Rodin, Atelier B, PVS, OpenJML, KeY), allowing the machine-verification of properties, e.g., invariant preservation, initialization correctness, and refinement consistency (Tueno et al., 2017, Conrad et al., 2022, Hähnle et al., 24 Sep 2025).
• Testing and coverage instrumentation (e.g., automated export of Simulink test objectives corresponding to formal patterns) (Berger et al., 2019).
• Semantic equivalence validation (oracle-based and model-checking-based, as in probabilistic requirements translation: path enumeration, model checking against the generated PCTL*, and counterexample analysis) (Mavridou et al., 15 Dec 2025).

For neural and neuro-symbolic translators (e.g., T5-based or Transformer-based pipelines), empirical validation of translation accuracy is carried out via exact-match, BLEU, and semantic-equivalence checks. Formal semantic validation is employed on held-out real-world requirements wherever possible (Hahn et al., 2022, He et al., 2021, Ma et al., 19 Dec 2025).

6. Applications and Industrial Impact

Formal specification translation underpins a wide range of practical workflows:

• Model-based engineering for automotive, aerospace, and railway domains: Enables automatic verification and test-case generation from requirements specified in high-level, often informal, notation (Berger et al., 2019, Huang et al., 2019, Fayolle et al., 2016).
• Safety-critical system requirements: Structured natural-language requirements can be translated with guarantee of semantic preservation to formal logics suitable for exhaustive or probabilistic model checking (Mavridou et al., 15 Dec 2025, Conrad et al., 2022, Ma et al., 19 Dec 2025).
• Design contracts and low-level code verification: Translation from architectural contracts (e.g., AGREE, OTS/CafeOBJ) into observers/monitors/annotations in target languages (Simulink, JML, ASM) supports tool-supported verification down to the implementation artifact (Liu et al., 2016, Triantafyllou et al., 2012, Hähnle et al., 24 Sep 2025).

Empirical studies in industrial settings report high expressiveness coverage for structured fragments (often exceeding 90% of requirements handled without expert intervention), dramatic reduction in manual formalization cost, and integration with verification workflows for continuous compliance (Berger et al., 2019, Mavridou et al., 15 Dec 2025).

7. Limitations, Challenges, and Future Work

Despite substantial advances, specification translation faces several persistent challenges:

• Expressiveness bounds: Structured languages and IRs must balance coverage with tractability and tool support, often leaving highly complex, ambiguous, or domain-specific forms outside their scope (Mavridou et al., 15 Dec 2025, Berger et al., 2019).
• Ambiguity and underspecification: Free-form natural language still requires domain expertise for disambiguation and correction, and ambiguity may be deferred to human-in-the-loop stages (Gordon et al., 2023, Ma et al., 19 Dec 2025).
• Automated lexical and grammar induction: Enabling robust translation for new domains or technical lexicons demands automated expansion of vocabularies and pattern libraries (Gordon et al., 2023).
• Scalability and performance: Typeclass-based parsing (e.g., in Lean) and recursive semantic decomposition can face performance bottlenecks with large lexicons or deeply nested requirements (Gordon et al., 2023).
• Semantic validation and trust: For neuro-symbolic pipelines, hybrid techniques combining LLM-driven parsing, deterministic synthesis, certificate generation, and formal proof are emerging as essential for high-assurance settings (Ma et al., 19 Dec 2025, Hahn et al., 2022).

Active research addresses incorporating direct tool feedback (counterexample-driven refinement), improving neural generalization to real-world requirements, integrating with domain ontologies, and extending coverage to new logics (e.g., continuous-time, probabilistic, or real-time logics).

---

References (by arXiv id; see source data for full details): (Tueno et al., 2017, Fotso et al., 2018, Berger et al., 2019, Huang et al., 2019, Liu et al., 2016, Ma et al., 19 Dec 2025, Mavridou et al., 15 Dec 2025, Hahn et al., 2022, Conrad et al., 2022, He et al., 2021, Triantafyllou et al., 2012, Hähnle et al., 24 Sep 2025, Gordon et al., 2023, Fayolle et al., 2016, Yan et al., 2014, Zhang et al., 2024, Talukder, 2010, Cabalar et al., 2020, Southern et al., 2013).