The Syntactically Dangerous All and Plural in Specifications

W e're academics. When each of us wishes to augment his income with consulting, his favorite positions are requirements specification (RS) inspector or inspection facilitator. Each of us has developed his own private check list of potential-problem indicators , and, when he inspects an RS, he reports any instances of these indicators to the authors. Often enough, these potential problems prove to be actual ones. Among the items on both of our lists are specific problems involving the correct use of the natural language in which the RS was written , usually English or German for our clients. These issues include incorrect grammar, incorrect word placement, and all kinds of ambiguities. 1,2 Perhaps surprisingly, our lists of grammatical and word-placement problems are similar despite the difference in the natural languages involved. These syntactic problems are symptoms of ambiguities in meaning—a grammatical problem occurs when part of a sentence disagrees with another, and each choice in the disagreement corresponds to a different meaning. (From our common background in compiling, contrary to the usage in linguistics, 3 we use syntactic to classify sentence form issues and semantic to classify sentence meaning issues.) We'll discuss only one such class of problems , apparently not treated in the software engineering literature: the syntactically dangerous all and plural in specifications. The literature has covered other issues, including the dangerously misplaced only (thoroughly discussed by Peter Neumann 4) and the semantically dangerous all (thoroughly discussed by Chris Rupp and Rolf Goetz 5 and by us 6). One of us, Daniel Berry, discovered the issue we address while facilitating an inspection of an RS. We've modified the example to protect the client's identity and trade secrets, but the example is structurally identical to the one that occurred during the inspection. Consider the sentence All the lights in any room have a single on-off switch. How many switches does any room have, one or one per light? Berry noticed that some parts of the RS appeared to assume that all the lights in any given room share a single on-off switch. Other parts of the same RS appeared to assume that each light in any room has its own on-off switch. From Berry's limited domain knowledge, each choice seemed equally