The results indicate that language-model assistance can add value in regulated automotive requirements workflows when it is embedded in deterministic, provenance-rich, and expert-governed processes.
Abstract
Automotive software developed under ISO 26262 and ISO/SAE 21434 depends on requirements that are traceable, reviewable, and grounded in safety and cybersecurity evidence. The practical bottleneck is often not requirement writing alone, but turning fragmented project artifacts into auditable specifications at engineering speed. This paper presents CADRE, an AI-assisted requirements-engineering framework for safety- and cybersecurity-critical automotive systems. CADRE combines deterministic parsers for structured artifacts with retrieval-augmented synthesis for semi-structured and unstructured sources. It constrains this workflow through schema validation, source-grounded traceability, expert review gates, fixed decoding controls, and cryptographic provenance tracking. The evaluation covers four industrial automotive modules from ASIL-B to ASIL-D and CAL-2 to CAL-4. CADRE produced 1,022 synthesized requirements, achieved 98.6% traceability coverage, kept the fabrication rate at 0.2%, and produced byte-identical outputs across independent runs. The results indicate that language-model assistance can add value in regulated automotive requirements workflows when it is embedded in deterministic, provenance-rich, and expert-governed processes.
Translating high-level business requirements into standards-grounded security requirements remains a persistent challenge in software engineering. Traditional Security Requirements Engineering (SRE) is often manual, error-prone, and too slow for modern development, creating a translation gap that can leave software vulnerable. This paper presents MAS-SRE, a multi-agent framework that automates the transformation of business requirements into traceable security requirements grounded in OWASP ASVS, NIST SP 800–53, and ISO 27001. MAS-SRE orchestrates 10 specialized agents across 4 workflow stages and combines STRIDE-based threat modeling with Retrieval-Augmented Generation (RAG) to produce standards-aligned outputs. Following the Design Science Research Process, the framework was evaluated on 14 industrial use cases through expert assessment by 15 software engineering practitioners and deterministic coverage and traceability metrics. MAS-SRE achieved 100% verification test coverage, 98.6% threat mapping coverage, 87.6% control mapping coverage, and about 40% lower processing time than sequential execution, while also receiving positive practitioner feedback on usefulness and adoption intent. These results indicate that MAS-SRE is a feasible approach for drafting standards-grounded, traceable security requirements, although comparative evaluation against alternative methods and deeper integration into development workflows remain future work.
Savvas Mantzouranidis, Ricardo Britto· International Conference on...· 0 citations
Traceability is an important part of safety-critical software development in areas such as avionics, space, and automotive engineering. Ada is often used in these systems. It shows how requirements are implemented in code and how changes are reflected in commits and issue reports. Automated traceability tools for Ada are not as common as those for other programming languages. Currently, the systematic linking of requirements to Ada source files, version-control history, and issue artifacts is often a manual process that requires effort to maintain throughout the software lifecycle. We present ADATracer, a software traceability tool designed to recover links between natural language requirements, Ada source files, version-control commits, and issue-tracking artifacts. The tool uses keyword-based retrieval, semantic vector embeddings, and a Neo4j-based knowledge graph. It includes an Ada-aware parser that accounts for language features such as package specifications, bodies, and strong typing. ADATracer supports traceability recovery and graph-based exploration, allowing for the inspection of evidence chains from requirements to implementation and issue resolution. We apply ADATracer to the open-source Ada Web Application (AWA) framework, where the tool identifies traceability links. This work facilitates traceability in certification-driven Ada development and provides a framework for further study in safety-critical software systems. The source code and demonstration video are publicly available at https://github.com/rishalab/ADATracer and https://youtu.be/sb66cEffF-o.
This article describes the deployment of a validated, low-code electronic Device History Record (eDHR) system on a high-mix, low-volume manufacturing line at Smith & Nephew’s Memphis site. Prior to this work, all Device History Records were maintained on paper, creating delays in inspection, opportunities for transcription errors, and long retrieval times during audits. The new system runs on an industrial IoT platform and connects wireless gauges, barcode-based calibration checks, dynamic sampling logic, and modular inspection applications. Each module was validated independently and assigned to specific workstations so changes could be controlled without large documentation overhead. In day-to-day use, inspectors capture measurements directly from calibrated tools, materials are verified at scan, and each routing step is logged with a timestamp and operator ID. The transition from paper packets to a digital workflow reduced inspection time, lowered documentation defects, and improved audit preparation through immediate access to traceable records. The framework described here has since expanded beyond the original pilot to additional sites and value streams within Smith & Nephew, with further integrations and AI-enabled capabilities in active development. The resulting deployment provides a practical and replicable model for regulated manufacturing environments that need to strengthen compliance while gaining flexibility for future analytics and system integration.
Pareshkumar Hotchandani, Mr. Wakhare· IEEE Access· 0 citations
Empirical evidence is provided that generative AI can effectively support security requirements engineering when embedded within human-centered workflows and organizational governance structures, offering practical insights for adoption in regulated software development contexts.
F. Martins, Elaine Venson· SIGSOFT FSE Companion· 0 citations
The increasing regulatory complexity in automotive development places significant pressure on engineering teams to derive complete and correct requirements. This paper presents a multi-agent-based large language model (LLM) workflow designed to support requirement extraction from technical specifications and regulatory documents in compliance with automotive requirement guidelines. The approach structures the requirement derivation process across collaborating agents that interpret specification and regulatory text, generate candidate requirements for the early engineering activities, and cross-validate their outputs to improve consistency and traceability. To evaluate the applicability of the workflow in an industrial context, we applied it to the draft Euro 7 emissions regulation. The agents produced requirements for relevant functional domains, which were subsequently reviewed by domain experts at FEV. The evaluation focused on correctness, completeness, and coverage. Results indicate that the agentic workflow can achieve high alignment with expert expectations, demonstrates robust coverage of regulatory intent, and reduces manual effort in the early requirements engineering phase. The findings highlight the potential of structured multi-agent LLM systems to accelerate compliant software development processes and to enhance the reproducibility and quality of regulatory requirement interpretation in the automotive domain.
Abdelrahman Abdalla, Lukas Schäfers, Fabian Schmidt et al.· SAE technical paper series· 0 citations
Ensuring software quality while meeting deadlines and adapting to evolving requirements is a persistent challenge in software engineering practice. This paper introduces Algorithm-Driven Development (ADD), a methodology developed from industrial practice to address recurring challenges in translating requirements into reliable, testable, and maintainable software behavior. ADD translates requirements into algorithmic flowcharts from which acceptance tests are systematically derived. These flowcharts serve both as specification artifacts and as technical blueprints, supporting shared understanding between stakeholders and developers. By linking requirement modeling with automated test generation, ADD provides systematic coverage of functional scenarios, including edge cases, from the outset of development. The approach was evaluated over a four-year period within an industrial project at Dassault Syst\`emes, involving two development teams, 22,444 lines of production code for Team 1, and 157 APIs analyzed for Team 2. The evaluation combined longitudinal quality and delivery indicators with a comparative analysis of ADD, TDD, and test-last development practices across API functions of different complexity levels. Empirical data collected from internal lifecycle management and CI/CD systems show that ADD supported sustained code coverage above 95%, low defect density in both QA and post-release phases, and a stable delivery cadence. These findings provide evidence of ADD's potential to strengthen the connection between requirements, testing, and implementation in industrial software development contexts.
Philippe Jawish, Pierre Evrard, Alexandre Lemerle et al.· Journal of Systems and Softw...· 0 citations