# Diophantine stability for elliptic curves on average

Anwesh Ray  Centre de recherches mathématiques, Université de Montréal,
Pavillon André-Aisenstadt, 2920 Chemin de la tour, Montréal (Québec) H3T 1J4,
Canada<EMAIL_ADDRESS>and  Tom Weston  Department of Mathematics,
University of Massachusetts, Amherst, MA, USA<EMAIL_ADDRESS>
###### Abstract.

Let $K$ be a number field and $\ell\geq 5$ be a prime number. Mazur and Rubin
introduced the notion of _diophantine stability_ for a variety $X_{/K}$ at a
prime $\ell$. Under the hypothesis that all elliptic curves $E_{/\mathbb{Q}}$
have finite Tate-Shafarevich group, we show that there is a positive density
set of elliptic curves $E_{/\mathbb{Q}}$ of rank $1$, such that $E_{/K}$ is
diophantine stable at $\ell$. This result has implications to Hilbert’s tenth
problem for number rings.

##  1\. Introduction

Let $V$ be a variety over a number field $K$ and let $\ell$ be a prime number.
Mazur and Rubin introduced the notion of diophantine stability. Given a number
field extension $L/K$, the variety $V_{/K}$ is _diophantine stable_ in $L$ if
$V(L)=V(K)$. For a prime $\ell$ it is said that $V$ is _$\ell$ -diophantine
stable_ over $K$ if for every $n\in\mathbb{Z}_{\geq 1}$ and finite set of
primes $\Sigma$ of $K$, there are infinitely many cyclic extensions $L/K$ of
degree $\ell^{n}$, such that

  1. (1)

all primes $v\in\Sigma$ are completely split in $L$,

  2. (2)

$V(L)=V(K)$.

######  Theorem 1.1 (Mazur-Rubin [MRL18], Theorem 1.2).

Let $A_{/K}$ be a simple abelian variety for which all geometric endomorphisms
are defined over $K$. Then, there is a set of prime numbers $S$ of positive
density such that $A$ is $\ell$-diophantine stable for all $\ell\in S$.

When specialized to elliptic curves, this result has significant consequences
to Hilbert’s tenth problem for number rings.

######  Corollary 1.2 (Mazur-Rubin [MRL18], Corollary 1.6).

For every prime $\ell$, there are uncountably many pairwise non-isomorphic
totally real fields $L$ of algebraic numbers in $\mathbb{Q}_{\ell}$ over which
the following two statements both hold:

  1. (1)

There is a diophantine definition of $\mathbb{Z}$ in the ring of integers
$\mathcal{O}_{L}$ of $L$. In particular, Hilbert’s Tenth Problem has a
negative answer for $\mathcal{O}_{L}$; i.e., there does not exist an algorithm
to determine whether a polynomial (in many variables) with coefficients in
$\mathcal{O}_{L}$ has a solution in $\mathcal{O}_{L}$.

  2. (2)

There exists a first-order definition of the ring $\mathbb{Z}$ in $L$. The
first-order theory for such fields $L$ is undecidable.

###  1.1. Main results

We study statistical questions from a different perspective. Any elliptic
curve $E_{/\mathbb{Q}}$ is isomorphic to a unique curve of the form

$E=E_{A,B}\mathrel{\mathop{\mathchar 58\relax}}y^{2}=x^{3}+Ax+B,$

where $(A,B)\in\mathbb{Z}^{2}$ such that for all primes $p$, either
$p^{4}\nmid A$ or $p^{6}\nmid B$. Such a Weierstrass equation is minimal and
the (naive) height of $E$ is defined as follows

$H(E)=H(E_{A,B})\mathrel{\mathop{\mathchar
58\relax}}=\operatorname{max}\\{|A|^{3},B^{2}\\}.$

Let $\mathcal{C}$ be the set of all isomorphism classes of elliptic curves
over $\mathbb{Q}$ and $\mathcal{C}(X)$ those with height $\leq X^{6}$. As is
well known,

$\\#\mathcal{C}(X)=C_{1}X^{5}+O(X^{3}),$

where $C_{1}=\frac{4}{\zeta(10)}$, cf. [Bru92, Lemma 4.3]. Let $\mathcal{S}$
be a subset of isomorphism classes of elliptic curves defined over
$\mathbb{Q}$. Set $\mathcal{S}(X)\mathrel{\mathop{\mathchar
58\relax}}=\mathcal{S}\cap\mathcal{C}(X)=\\{E\in\mathcal{S}\mid H(E)\leq
X^{6}\\}$. The density of $\mathcal{S}$ is given by

$\delta(\mathcal{S})\mathrel{\mathop{\mathchar
58\relax}}=\lim_{X\rightarrow\infty}\frac{\\#\mathcal{S}(X)}{\\#\mathcal{C}(X)},$

provided the limit exists.

In any case, we can define the upper and lower densities by

$\overline{\delta}(\mathcal{S})\mathrel{\mathop{\mathchar
58\relax}}=\limsup_{X\rightarrow\infty}\frac{\\#\mathcal{S}(X)}{\\#\mathcal{C}(X)}$

and

$\underline{\delta}(\mathcal{S})\mathrel{\mathop{\mathchar
58\relax}}=\liminf_{X\rightarrow\infty}\frac{\\#\mathcal{S}(X)}{\\#\mathcal{C}(X)}$

respectively. We prove the following result.

######  Theorem A (Theorem 2.3).

Let $\ell\geq 5$ be a prime number and let $K$ be a number field. Then, the
set of elliptic curves $E_{/\mathbb{Q}}$ that are $\ell$-diophantine stable
over $K$ has density $1$.

In the above result, we make no assumption on the finiteness of the Tate-
Shafarevich group. We recall a result of Bhargava and Shankar, which will be
shown to have consequences for Hilbert’s tenth problem over number rings.

######  Theorem 1.3 (Bhargava-Shankar [BS15], Theorem 5).

Assume that for all elliptic curves $E_{/\mathbb{Q}}$, the Tate-Shafarevich
group $\Sh(E/\mathbb{Q})$ is finite. Then, the upper density of elliptic
curves $E_{/\mathbb{Q}}$ with rank $1$ is positive.

######  Theorem B (Theorem 2.5).

Let $\ell\geq 5$ be a prime number and let $K$ be a number field. Assume that
for all elliptic curves $E_{/\mathbb{Q}}$, the Tate-Shafarevich group
$\Sh(E/\mathbb{Q})$ is finite. Then, the set of elliptic curves
$E_{/\mathbb{Q}}$ for which

  1. (1)

$E_{/K}$ is $\ell$ diophantine stable,

  2. (2)

$\operatorname{rank}E(\mathbb{Q})=1$

has positive upper density.

######  Theorem C.

Let $\ell\geq 5$ be a prime number, let $K$ be a number field,
$n\in\mathbb{Z}_{\geq 1}$ and $\Sigma$ be a finite set of primes of $K$.
Assume that the following conditions are satisfied.

  1. (1)

For all elliptic curves $E_{/\mathbb{Q}}$, the Tate-Shafarevich group
$\Sh(E/\mathbb{Q})$ is finite,

  2. (2)

$\mathbb{Z}$ is a diophantine subset of $\mathcal{O}_{K}$, and consequently,
Hilbert’s tenth problem has a negative answer for $\mathcal{O}_{K}$.

Then, there are infinitely many degree $\ell^{n}$ cyclic extensions $L/K$ in
which the primes of $\Sigma$ are completely split, such that $\mathbb{Z}$ is
diophantine in $\mathcal{O}_{L}$ and Hilbert’s tenth problem has a negative
answer for $\mathcal{O}_{L}$.

The key point is that the above result holds for all primes $\ell\geq 5$. It
follows from results of Shlapentokh and Mazur-Rubin that the above assertion
holds for a density $1$ set of primes $\ell$.

###  1.2. Organization

Including the introduction, the article consists of four sections. In section
2, we recall a criterion of Mazur and Rubin for diophantine stability, cf.
Theorem 2.2. For elliptic curves $E_{/\mathbb{Q}}$, this criterion can be
verified if the field cut out by the residual representation satisfies some
additional conditions, cf. Proposition 2.8. In section 3, it is shown that the
conditions of Theorem 2.2 are satisfied for a set of elliptic curves of
density $1$. Theorems A and B are proven at the end of this section. In
section 4, we discuss Hilbert’s tenth problem and prove Theorem C.

### Acknowledgment

The first named author’s research is supported by the CRM Simons postdoctoral
fellowship. We thank Lea Beneish, Barry Mazur and Ravi Ramakrishna for helpful
suggestions.

##  2\. Diophantine stability

###  2.1. Diophantine stability for elliptic curves

We review the notion of diophantine stability for an elliptic curve.
Throughout, we shall fix a number field $K$ and a prime number $\ell\geq 5$.
For $n\in\mathbb{Z}_{\geq 1}$, we say that an extension $L$ of $K$ is a
$\mathbb{Z}/\ell^{n}\mathbb{Z}$-extension if it is a Galois extension of $K$
such that $\operatorname{Gal}(L/K)$ is isomorphic to
$\mathbb{Z}/\ell^{n}\mathbb{Z}$. We recall the notion of diophantine
stability, due to Mazur and Rubin [MRL18].

######  Definition 2.1.

Let $L/K$ be a field extension and let $E_{/K}$ be an elliptic curve. Then,
$E_{/K}$ is said to be diophantine stable in $L$ if $E(L)=E(K)$. It is said
that $E_{/K}$ is diophantine stable at $\ell$ if for all $n\in\mathbb{Z}_{\geq
1}$ and every finite set of primes $\Sigma$ of $K$, there are infinitely many
$\mathbb{Z}/\ell^{n}\mathbb{Z}$-extensions $L/K$ such that

  1. (1)

$E(L)=E(K)$,

  2. (2)

all primes in $\Sigma$ are completely split in $L$.

Given an elliptic curve $E_{/\mathbb{Q}}$, we say that $(E,K,\ell)$ satisfies
(DS) if $E_{/K}$ is diophantine stable at $\ell$.

Given a number field $K$, set $\operatorname{G}_{K}$ to denote the absolute
Galois group $\operatorname{Gal}(\bar{K}/K)$. Let $E_{/\mathbb{Q}}$ be an
elliptic curve and denote by $E[\ell]$, the $\ell$-torsion group

$E[\ell]\mathrel{\mathop{\mathchar
58\relax}}=\operatorname{ker}\left(E(\bar{\mathbb{Q}})\rightarrow
E(\bar{\mathbb{Q}})\right).$

Set $\bar{\rho}_{E}=\bar{\rho}_{E,\ell}\mathrel{\mathop{\mathchar
58\relax}}\operatorname{G}_{\mathbb{Q}}\rightarrow\operatorname{GL}_{2}(\mathbb{F}_{\ell})$
to denote the Galois representation on $E[\ell]$. Set $\mathbb{Q}(E[\ell])$ to
be the field cut out by $E[\ell]$, i.e.,
$\mathbb{Q}(E[\ell])\mathrel{\mathop{\mathchar
58\relax}}=\bar{\mathbb{Q}}^{\operatorname{ker}\bar{\rho}_{E,\ell}}$.

We recall a criterion for diophantine stability, specialized to rational
elliptic curves without complex multiplication.

######  Theorem 2.2 (Mazur-Rubin).

Let $K$ be a number field, $E_{/\mathbb{Q}}$ an elliptic curve without complex
multiplication, and $\ell\geq 3$ a prime number. Assume that the following
conditions hold

  1. (1)

$E[\ell]$ is an irreducible $\operatorname{G}_{K}$-module,

  2. (2)

$H^{1}(K(E[\ell])/K,E[\ell])=0$,

  3. (3)

there is no abelian extension of degree $\ell$ of $K(\mu_{\ell})$ contained in
$K(E[\ell])$,

  4. (4)

there is $\tau_{0}\in\operatorname{G}_{K(\mu_{\ell})}$ such that
$E[\ell]/(\tau_{0}-1)E[\ell]=0$,

  5. (5)

there is $\tau_{1}\in\operatorname{G}_{K(\mu_{\ell})}$ such that
$\operatorname{dim}_{\mathbb{F}_{\ell}}\left(E[\ell]/(\tau_{1}-1)E[\ell]\right)=1$.

Then, $E_{/K}$ is diophantine stable at $\ell$.

###### Proof.

The result follows from [MRL18, Theorem 9.21]. ∎

In the next section, we prove the following result.

######  Theorem 2.3.

Let $\ell\geq 5$ be a prime number and let $K$ be a number field. Then, the
set of elliptic curves $E_{/\mathbb{Q}}$ for which the conditions of Theorem
2.2 are satisfied has density $1$.

######  Definition 2.4.

Let $\mathcal{S}_{K,\ell}$ be the set of elliptic curves $E_{/\mathbb{Q}}$
such that

  1. (1)

$\operatorname{rank}E(\mathbb{Q})=1$,

  2. (2)

$(E,K,\ell)$ satisfies (DS).

######  Theorem 2.5.

Let $\ell\geq 5$ be a prime number and $K$ be any number field. Assume that
for all elliptic curves $E_{/\mathbb{Q}}$, the Tate-Shafarevich group
$\Sh(E/\mathbb{Q})$ is finite. Then, $\mathcal{S}_{K,\ell}$ has positive upper
density.

###### Proof.

This is a direct consequence of Theorem 2.3 and Theorem 1.3. ∎

###  2.2. A criterion for diophantine stability in terms of the residual image

In the remainder of this section, we shall introduce some further notation and
establish a criterion for the conditions of Theorem 2.2 to be satisfied. We
fix $(K,\ell)$ where $K$ is a number field and $\ell\geq 5$ is a prime number.
We let $E_{/\mathbb{Q}}$ be an elliptic curve and recall that

$\bar{\rho}_{E}\mathrel{\mathop{\mathchar
58\relax}}\operatorname{G}_{\mathbb{Q}}\rightarrow\operatorname{GL}_{2}(\mathbb{F}_{\ell})$

denotes the representation on $E[\ell]$. Set $\mathbf{1}$ to denote the
identity element of $\operatorname{GL}_{2}(\mathbb{F}_{\ell})$ and
$\langle-\mathbf{1}\rangle$ the subgroup of order $2$ generated by
$-\mathbf{1}$. We set
$\operatorname{GL}_{2}^{\prime}(\mathbb{F}_{\ell})\mathrel{\mathop{\mathchar
58\relax}}=\frac{\operatorname{GL}_{2}(\mathbb{F}_{\ell})}{\langle-\mathbf{1}\rangle}$
and denote by

$\bar{\rho}_{E}^{\prime}\mathrel{\mathop{\mathchar
58\relax}}\operatorname{G}_{\mathbb{Q}}\rightarrow\operatorname{GL}_{2}^{\prime}(\mathbb{F}_{\ell})$

the homomorphism which is the composite of $\bar{\rho}_{E}$ with the natural
quotient map. The determinant character $\operatorname{det}\bar{\rho}_{E}$ is
the mod-$\ell$ cyclotomic character $\chi_{\ell}$, and thus the kernel of
$\operatorname{det}\bar{\rho}_{E}$ is
$\operatorname{G}_{\mathbb{Q}(\mu_{\ell})}$. Note that
$\langle-\mathbf{1}\rangle$ lies in the kernel of the determinant map, and
hence, $\operatorname{det}\mathrel{\mathop{\mathchar
58\relax}}\operatorname{GL}_{2}(\mathbb{F}_{\ell})\rightarrow\mathbb{F}_{\ell}^{\times}$
factors through $\operatorname{GL}_{2}^{\prime}(\mathbb{F}_{\ell})$. Note that
the restriction of $\bar{\rho}_{E}$ and $\bar{\rho}_{E}^{\prime}$ to
$\operatorname{G}_{\mathbb{Q}(\mu_{\ell})}$ gives rise to homomorphisms
$\bar{\rho}_{E}\mathrel{\mathop{\mathchar
58\relax}}\operatorname{G}_{\mathbb{Q}(\mu_{\ell})}\rightarrow\operatorname{SL}_{2}(\mathbb{F}_{\ell})$
and $\bar{\rho}_{E}^{\prime}\mathrel{\mathop{\mathchar
58\relax}}\operatorname{G}_{\mathbb{Q}(\mu_{\ell})}\rightarrow\operatorname{PSL}_{2}(\mathbb{F}_{\ell})$
respectively. Galois [Gal46, p. 412], in a letter to Chevalier showed that
when $\ell\geq 5$, the group $\operatorname{PSL}_{2}(\mathbb{F}_{\ell})$ is
simple. This property shall prove to be considerably useful in establishing
our results.

Given a number field $F$, a finite group $\mathcal{G}$, and a homomorphism
$\varrho\mathrel{\mathop{\mathchar
58\relax}}\operatorname{G}_{F}\rightarrow\mathcal{G}$, we let $F(\varrho)$
denote the field $\bar{F}^{\operatorname{ker}\varrho}$. We identify the Galois
group $\operatorname{Gal}(F(\varrho)/F)$ with the image of $\varrho$. We refer
to $F(\varrho)$ as the extension of $F$ cut out by $\varrho$. In particular,
when $\varrho$ is surjective, $F(\varrho)$ is a $\mathcal{G}$-extension of
$F$. With respect to the above notation, we set $F(\bar{\rho}_{E})$ (resp.
$F(\bar{\rho}_{E}^{\prime})$) to be the extension of $F$ cut out by
$\bar{\rho}_{E}$ (resp. $\bar{\rho}_{E}^{\prime}$). We shall also write
$F(E[\ell])$ to denote the field $F(\bar{\rho}_{E})$. Let $G_{E}$ (resp.
$G_{E}^{\prime}$) denote the Galois group
$\operatorname{Gal}(\mathbb{Q}(\bar{\rho}_{E})/\mathbb{Q})$ (resp.
$\operatorname{Gal}(\mathbb{Q}(\bar{\rho}_{E}^{\prime})/\mathbb{Q})$). Set
$D\mathrel{\mathop{\mathchar
58\relax}}=\operatorname{Gal}(\mathbb{Q}(\bar{\rho}_{E})/\mathbb{Q}(\bar{\rho}_{E}^{\prime}))$
and identify $G_{E}^{\prime}$ with $G_{E}/D$. The residual representation
$\bar{\rho}_{E}$ induces an injection

$\bar{\rho}_{E}\mathrel{\mathop{\mathchar
58\relax}}G_{E}\hookrightarrow\operatorname{GL}_{2}(\mathbb{F}_{\ell}),$

and $D$ lies in the kernel of the determinant character

(2.1) $\operatorname{det}\bar{\rho}_{E}\mathrel{\mathop{\mathchar
58\relax}}G_{E}\hookrightarrow\operatorname{GL}_{2}(\mathbb{F}_{\ell})\rightarrow\mathbb{F}_{\ell}^{\times}.$

The character
$G_{E}\xrightarrow{\operatorname{det}\bar{\rho}_{E}}\mathbb{F}_{\ell}^{\times}$
(2.1) thus factors through the quotient $G_{E}^{\prime}$. Let $H_{E}$ (resp.
$\bar{H}_{E}$) denote the kernel of
$G_{E}\xrightarrow{\operatorname{det}\bar{\rho}_{E}}\mathbb{F}_{\ell}^{\times}$
(resp.
$G_{E}^{\prime}\xrightarrow{\operatorname{det}\bar{\rho}_{E}}\mathbb{F}_{\ell}^{\times}$).
Note that $D$ is contained in $H_{E}$ and $\bar{H}_{E}=H_{E}/D$. We find that
$H_{E}=\operatorname{Gal}(\mathbb{Q}(\bar{\rho}_{E})/\mathbb{Q}(\mu_{\ell}))$,
while $\mathbb{Q}(\mu_{\ell})$ is contained
$\mathbb{Q}(\bar{\rho}_{E}^{\prime})$ and
$\bar{H}_{E}=\operatorname{Gal}(\mathbb{Q}(\bar{\rho}_{E}^{\prime})/\mathbb{Q}(\mu_{\ell}))$.
Set $\tilde{K}$ to be the Galois closure of $K$ over $\mathbb{Q}$.

######  Definition 2.6.

Let $\mathcal{T}_{K,\ell}$ be the set of elliptic curves $E_{/\mathbb{Q}}$
such that the following conditions are satisfied

  1. (1)

$\bar{\rho}_{E}^{\prime}$ is surjective,

  2. (2)

$\tilde{K}(\mu_{\ell})$ does not contain
$\mathbb{Q}(\bar{\rho}_{E}^{\prime})$.

Note that if $\bar{\rho}^{\prime}_{E}$ is surjective, then the image of
$\bar{\rho}_{E}$ is not solvable. In particular, $E$ does not have complex
multiplication.

######  Lemma 2.7.

For $E\in\mathcal{T}_{K,\ell}$,

$\operatorname{Gal}(K(\bar{\rho}_{E}^{\prime})/K(\mu_{\ell}))\simeq\operatorname{PSL}_{2}(\mathbb{F}_{\ell}).$

###### Proof.

Note that since $\bar{\rho}_{E}^{\prime}$ is surjective, we find that
$\operatorname{Gal}(\mathbb{Q}(\bar{\rho}_{E}^{\prime})/\mathbb{Q}(\mu_{\ell}))\simeq\operatorname{PSL}_{2}(\mathbb{F}_{\ell})$.
On the other hand, since $\operatorname{PSL}_{2}(\mathbb{F}_{\ell})$ is
simple, and $\tilde{K}(\mu_{\ell})$ does not contain
$\mathbb{Q}(\bar{\rho}_{E}^{\prime})$, it follows that
$\tilde{K}(\mu_{\ell})\cap\mathbb{Q}(\bar{\rho}_{E}^{\prime})=\mathbb{Q}(\mu_{\ell})$.
This implies that
$K(\mu_{\ell})\cap\mathbb{Q}(\bar{\rho}_{E}^{\prime})=\mathbb{Q}(\mu_{\ell})$
and therefore we conclude that

$\operatorname{Gal}(K(\bar{\rho}_{E}^{\prime})/K(\mu_{\ell}))\simeq\operatorname{Gal}(\mathbb{Q}(\bar{\rho}_{E}^{\prime})/\mathbb{Q}(\mu_{\ell}))\simeq\operatorname{PSL}_{2}(\mathbb{F}_{\ell}).$

∎

######  Proposition 2.8.

For every elliptic curve $E\in\mathcal{T}_{K,\ell}$, $(E,K,\ell)$ satisfies
(DS).

###### Proof.

It suffices to show that the five conditions of Theorem 2.2 are satisfied.
Note that Lemma 2.7 asserts that
$\operatorname{Gal}(K(\bar{\rho}_{E}^{\prime})/K(\mu_{\ell}))\simeq\operatorname{PSL}_{2}(\mathbb{F}_{\ell})$.

  1. (1)

Since
$\operatorname{Gal}(K(\bar{\rho}_{E}^{\prime})/K(\mu_{\ell}))\simeq\operatorname{PSL}_{2}(\mathbb{F}_{\ell})$,
$E[\ell]$ is irreducible as a $\operatorname{G}_{K}$-module.

  2. (2)

This part follows from [LW17] or [PS21, Lemma 2.2]. We summarize the argument
here. Let $G\subseteq\operatorname{GL}_{2}(\mathbb{F}_{\ell})$ denote the
image of $\bar{\rho}_{E|\operatorname{G}_{K}}$. Note that since
$\operatorname{Gal}(K(\bar{\rho}_{E}^{\prime})/K(\mu_{\ell}))\simeq\operatorname{PSL}_{2}(\mathbb{F}_{\ell})$,
$G$ contains an element of order $\ell$. Clearly, $G$ is not contained in a
Borel subgroup. It follows from [Sut16, Proposition 3.1] that $G$ contains
$\operatorname{SL}_{2}(\mathbb{F}_{\ell})$. In particular, $G$ contains the
negative identity $-\mathbf{1}$. Identify $G$ with
$\operatorname{Gal}(K(E[\ell])/K)$ and let $\Delta$ be the subgroup of $G$
generated by $-\mathbf{1}$. Inflation-restriction yields an exact sequence

$0\rightarrow H^{1}(G/\Delta,E[\ell]^{\Delta})\rightarrow
H^{1}(G,E[\ell])\rightarrow H^{1}(\Delta,E[\ell]).$

Since $E[\ell]^{\Delta}=0$, it follows that
$H^{1}(G/\Delta,E[\ell]^{\Delta})=0$. Since $D$ has order $2$, its order is
coprime to that of $E[\ell]$ and we find that $H^{1}(\Delta,E[\ell])=0$.
Therefore, we conclude from the above exact sequence that
$H^{1}(G,E[\ell])=0$.

  3. (3)

Since $\operatorname{PSL}_{2}(\mathbb{F}_{\ell})$ is simple,
$\operatorname{Gal}(K(\bar{\rho}_{E}^{\prime})/K(\mu_{\ell}))\simeq\operatorname{PSL}_{2}(\mathbb{F}_{\ell})$
and the degree $[K(E[\ell])\mathrel{\mathop{\mathchar
58\relax}}K(\bar{\rho}_{E}^{\prime})]$ is prime to $\ell$, it follows that
there is no abelian extension of degree $\ell$ of $K(\mu_{\ell})$ contained in
$K(E[\ell])$.

  4. (4)

Since $\bar{\rho}_{E}^{\prime}(\operatorname{G}_{K(\mu_{\ell})})$ is
isomorphic to $\operatorname{PSL}_{2}(\mathbb{F}_{\ell})$, it is clear that
there is a diagonal element $\left({\begin{array}[]{cc}a&\\\ &a^{-1}\\\
\end{array}}\right)\in\bar{\rho}_{E}(\operatorname{G}_{K(\mu_{\ell})})$, such
that $a\neq\pm 1$. Let $\tau_{0}\in\operatorname{G}_{K(\mu_{\ell})}$ be chosen
so that $\bar{\rho}(\tau_{0})=\left({\begin{array}[]{cc}a&\\\ &a^{-1}\\\
\end{array}}\right)$. Then, it follows that $E[\ell]/(\tau_{0}-1)E[\ell]=0$.

  5. (5)

It is easy to see that $\bar{\rho}_{E}(\operatorname{G}_{K(\mu_{\ell})})$
contains a unipotent element $\left({\begin{array}[]{cc}1&b\\\ &1\\\
\end{array}}\right)$, with $b\neq 0$. Let
$\tau_{1}\in\operatorname{G}_{K(\mu_{\ell})}$ be such that
$\bar{\rho}(\tau_{1})=\left({\begin{array}[]{cc}1&b\\\ &1\\\
\end{array}}\right)$, we find that

$\operatorname{dim}_{\mathbb{F}_{\ell}}\left(E[\ell]/(\tau_{1}-1)E[\ell]\right)=1.$

∎

##  3\. A refinement of Duke’s theorem

Recall from Definition 2.6 that $\mathcal{T}_{K,\ell}$ is the set of elliptic
curves $E_{/\mathbb{Q}}$ such that the following conditions are satisfied

  1. (1)

$\bar{\rho}_{E}^{\prime}$ is surjective,

  2. (2)

$\tilde{K}(\mu_{\ell})$ does not contain
$\mathbb{Q}(\bar{\rho}_{E}^{\prime})$.

According to Proposition 2.8, for every elliptic curve
$E\in\mathcal{T}_{K,\ell}$, $(E,K,\ell)$ satisfies (DS). We prove that the set
of elliptic curves $\mathcal{T}_{K,\ell}$ has density $1$. Let
$\mathcal{T}_{\ell}^{\prime}$ be the set of elliptic curves $E_{/\mathbb{Q}}$
for which $\bar{\rho}_{E}^{\prime}$ is surjective. We shall assume throughout
this section that $\ell\geq 5$. Note that the elliptic curves
$E\in\mathcal{T}_{\ell}^{\prime}$ do not have complex multiplication. Duke
[Duk97] showed that the set of elliptic curves $E_{/\mathbb{Q}}$ for which
$\bar{\rho}_{E}\mathrel{\mathop{\mathchar
58\relax}}\operatorname{G}_{\mathbb{Q}}\rightarrow\operatorname{GL}_{2}(\mathbb{F}_{\ell})$
is surjective has density $1$. In particular, it follows from Duke’s result
that the set $\mathcal{T}_{\ell}^{\prime}$ has density $1$. The result proven
in _loc. cit._ is much stronger. A prime $\ell$ is an _exceptional prime_ of
an elliptic curve $E_{/\mathbb{Q}}$ if the residual representation at $\ell$
is not surjective. It is proven that a density $1$ set of elliptic curves
$E_{/\mathbb{Q}}$ have no exceptional primes. An elliptic curve $E_{/Q}$ is
said to be a _Serre curve_ if the image of its associated adelic Galois
representation has index $2$ in $\operatorname{GL}_{2}(\widehat{\mathbb{Z}})$.
Jones [Jon10] proves that the set of Serre curves has density $1$.

Let $A_{/\mathbb{Q}}$ be an elliptic curve and let $\mathcal{T}_{A}$ be the
set of elliptic curves $E_{/\mathbb{Q}}$ such that
$\bar{\rho}_{E}^{\prime}\simeq\bar{\rho}_{A}^{\prime}$. Given an elliptic
curve $E$, we write $N_{E}$ for its conductor. At a prime $p$, let
$\operatorname{G}_{p}$ denote the absolute Galois group
$\operatorname{Gal}(\bar{\mathbb{Q}}_{p}/\mathbb{Q}_{p})$ and
$\sigma_{p}\in\operatorname{G}_{p}$ be a lift of the Frobenius element. For
$p\nmid N_{E}\ell$,

$\operatorname{trace}\bar{\rho}_{E}(\sigma_{p})\equiv a_{p}(E)\pmod{\ell};$

set $t_{p}(E)\in\mathbb{F}_{\ell}$ to denote
$\operatorname{trace}\bar{\rho}(\sigma_{p})$. For $E\in\mathcal{T}_{A}$, we
find that

(3.1) $t_{p}(E)=\pm t_{p}(A)$

for all primes $p\nmid N_{E}N_{A}\ell$.

Let $E_{1}$ and $E_{2}$ be elliptic curves over $\mathbb{Q}$ and let
$(t_{1},t_{2},d)\in\mathbb{F}_{\ell}^{3}$ be such that $d\neq 0$. Let
$\pi(X,d,\ell)$ be the number of prime numbers $p\leq X$ such that $p\equiv
d\pmod{\ell}$, and set $\pi_{E_{1},E_{2}}(X,t_{1},t_{2},d,\ell)$ to be the
number of prime numbers $p\leq X$ such that

  1. (1)

$p\nmid N_{E_{1}}N_{E_{2}}$,

  2. (2)

$p\equiv d\pmod{\ell}$,

  3. (3)

$t_{p}(E_{i})=t_{i}$ for $i=1,2$.

For $t\in\mathbb{F}_{\ell}$, set $\chi_{t,d,\ell}$ to denote the Kronecker
symbol $\left(\frac{t^{2}-4d}{\ell}\right)$, set

$\delta(t,d,\ell)\mathrel{\mathop{\mathchar
58\relax}}=\left(\frac{\ell+\chi_{t,d,\ell}}{\ell^{2}-1}\right),$

and set

(3.2) $\delta=\delta(t_{1},t_{2},d,\ell)\mathrel{\mathop{\mathchar
58\relax}}=\delta(t_{1},d,\ell)\delta(t_{2},d,\ell).$

For an integer $n$, set $H(n)$ to denote the _Hurwitz class number_. We refer
to [Duk97, p. 816, l. 24] or [Cox22, p.293] for the definition. Let
$E=E_{r,s}$ be the elliptic curve with minimal Weierstrass equation
$y^{2}=x^{3}+rx+s$, and assume that this equation is minimal. Let $\Delta_{E}$
be the discriminant of $E$. The Frobenius trace $a_{p}(E)$ depends only on
$(r,s)$, and

$a_{p}(E)=a_{r,s}(p)\mathrel{\mathop{\mathchar
58\relax}}=-\sum_{x\in\mathbb{F}_{p}}\left(\frac{x^{3}+rx+s}{p}\right).$

Let $p\geq 5$ be a prime number. We recall a well known formula of Deuring for
the number of elliptic curves over $\mathbb{F}_{p}$ which have a preassigned
number of points.

######  Theorem 3.1 (Deuring).

Let $p\geq 5$ be a prime and $N=p+1-a$ be an integer such that
$|a|<2\sqrt{p}$. Then the number of Weierstrass equations for elliptic curves
$E_{/\mathbb{F}_{p}}$ for which $\\#E(\mathbb{F}_{p})=N$ is
$\left(\frac{p-1}{2}\right)H(a^{2}-4p)$. In other words,

$\\#\left\\{(r,s)\in(\mathbb{Z}/p\mathbb{Z})^{2}\mid 4r^{3}+27s^{2}\neq
0\text{ and }a_{r,s}(p)=a\right\\}=\left(\frac{p-1}{2}\right)H(a^{2}-4p).$

###### Proof.

We refer to [Cox22, Theorem 14.18] for a proof of the result. ∎

Recall from the previous section that $\mathcal{C}$ is the set of all
isomorphism classes of elliptic curves over $\mathbb{Q}$ and $\mathcal{C}(X)$
those with height $\leq X^{6}$. Denote by $\mathcal{C}(X)^{2}$ the Cartesian
product $\mathcal{C}(X)\times\mathcal{C}(X)$ consisting of all pairs of
elliptic curves $(E_{1},E_{2})$ defined over $\mathbb{Q}$. Let $f(X)$ and
$g(X)$ be functions of $X$ taking on postive values. We write $f(X)\ll g(X)$,
or equivalently, $f(X)=O(g(X))$, to mean that there exists a constant $C>0$,
independent of $X$, such that $f(X)\leq Cg(X)$.

######  Proposition 3.2.

Let $(t_{1},t_{2},d)\in\mathbb{F}_{\ell}^{3}$ be such that $d\neq 0$. Then,
with respect to notation above,

$\frac{1}{\\#\mathcal{C}(X)^{2}}\sum_{(E_{1},E_{2})\in\mathcal{C}(X)^{2}}\left(\pi_{E_{1},E_{2}}(X,t_{1},t_{2},d,\ell)-\delta\pi(X,d,\ell)\right)^{2}\ll
X.$

###### Proof.

The proof of this result follows from a similar argument to that of [Duk97,
Theorem 2]. For each prime $p$, let $\Omega(p)$ be a prescribed subset of
$(\mathbb{Z}/p\mathbb{Z})^{n}$. For $m\in\mathbb{Z}^{n}$, set

$P(X;m)\mathrel{\mathop{\mathchar 58\relax}}=\\#\\{p\leq X\mid
m\\!\\!\mod{p}\in\Omega(p)\\},$ $P(X)=\sum_{p\leq X}\\#\Omega(p)p^{-n}.$

Let $\mathcal{B}$ be a box in $\mathbb{R}^{n}$ whose sides are parallel to the
coordinate planes which has minimum width $W(\mathcal{B})$ and volume
$V(\mathcal{B})$. Then, the large sieve inequality states that if
$W(\mathcal{B})\geq X^{2}$, then

(3.3) $\sum_{\mathcal{B}\cap\mathbb{Z}^{n}}(P(X;m)-P(X))^{2}\ll
V(\mathcal{B})P(X).$

We refer to the proof of [Duk97, Lemma 1] for the standard references on this
theme.

Taking $n=4$, let us define $\Omega(p)$ to be empty if $p=2,3$ or $p\not\equiv
d\mod{\ell}$. For $p>3$ such that $p\equiv d\mod{\ell}$, set

$\Omega(p)\mathrel{\mathop{\mathchar
58\relax}}=\\{(r_{1},s_{1},r_{2},s_{2})\in(\mathbb{Z}/p\mathbb{Z})^{4}\mid
4r_{i}^{3}+27s_{i}^{2}\neq 0\text{ and }a_{r_{i},s_{i}}(p)\equiv
t_{i}\mod{\ell}\text{ for }i=1,2\\}.$

For primes $p>3$, with $p\equiv d\mod{\ell}$, it follows from Theorem 3.1 (or
[Duk97, Lemma 2]) that

$\begin{split}&\\#\\{(r_{1},s_{1},r_{2},s_{2})\in(\mathbb{Z}/p\mathbb{Z})^{4}\mid
4r_{i}^{3}+27s_{i}^{2}\neq 0,a_{r_{i},s_{i}}(p)=a_{i}\text{ for }i=1,2\\}\\\
=&\left(\frac{p-1}{2}\right)^{2}H(4p-a_{1}^{2})H(4p-a_{2}^{2}).\end{split}$

We find that

(3.4)
$\begin{split}\\#\Omega(p)=&\left(\frac{p-1}{2}\right)^{2}\prod_{i=1}^{2}\left(\sum_{a_{i}\equiv
t_{i}\mod{\ell}}H(4p-a_{i}^{2})\right).\\\ =&\delta p^{4}+O(\ell
p^{7/2}),\end{split}$

where the second equality follows from [Duk97, Lemma 3], which states that

$\left(\sum_{a_{i}\equiv
t_{i}\mod{\ell}}H(4p-a_{i}^{2})\right)=2\delta(t_{i},d,\ell)p+O(\ell
p^{1/2}).$

Recall that $P(X)=\sum_{p\leq X}\\#\Omega(p)p^{-n}$, and therefore, from the
estimate (3.4), we find that

(3.5) $\begin{split}P(X)=&\sum_{p\equiv d\mod{\ell};p\leq
X}\delta+O\left(\ell\sum_{p\equiv d\mod{\ell};p\leq X}p^{-1/2}\right),\\\
&\delta\pi(X;\ell,d)+O(X^{1/2}).\end{split}$

The second estimate is the same as that of [Duk97, p.817, l. 4]. Let
$(E_{1},E_{2})\in\mathcal{C}(X)\times\mathcal{C}(X)$, with minimal Weierstrass
equation

$E_{i}\mathrel{\mathop{\mathchar 58\relax}}y^{2}=x^{3}+r_{i}x+s_{i}.$

Then, it is easy to see that

(3.6)
$P(X;(r_{1},s_{1},r_{2},s_{2}))=\pi_{E_{1},E_{2}}(X,a,b,d,\ell)+O(\operatorname{log}X).$

We take

$\mathcal{B}\mathrel{\mathop{\mathchar
58\relax}}=\\{(r_{1},s_{1},r_{2},s_{2})\in\mathbb{R}^{4}\mid|r_{i}|\leq
X^{2}\text{ and }|s_{i}|\leq X^{3}\\},$

and from (3.3), (3.5) and (3.6), we deduce that

$\begin{split}&\frac{1}{\\#\mathcal{C}(X)^{2}}\sum_{E_{1}\in\mathcal{C}(X)}\sum_{E_{2}\in\mathcal{C}(X)}\left(\pi_{E_{1},E_{2}}(X,\ell;t_{1},t_{2},d)-\delta\pi(X;\ell,d)\right)^{2}\\\
\ll&\frac{1}{X^{5}}\sum_{\mathcal{B}\cap\mathbb{Z}^{n}}(P(X;m)-P(X))^{2}\ll
P(X)\ll X.\end{split}$

This proves the result.

∎

######  Proposition 3.3.

Let $A_{/\mathbb{Q}}$ be an elliptic curve, then,

$\frac{\\#\mathcal{T}_{A}(X)}{\\#\mathcal{C}(X)}=O\left(\frac{\operatorname{log}(X)}{\sqrt{X}}\right).$

In particular, the set $\mathcal{T}_{A}$ has density $0$ in $\mathcal{C}$.

###### Proof.

We choose a triple $w=(a,b,d)\in\mathbb{F}_{\ell}^{3}$ such that $a\neq\pm b$
and $d\neq 0$. For any pair
$(E_{1},E_{2})\in\mathcal{T}_{A}\times\mathcal{T}_{A}$, we find that (3.1)
implies that the relation $t_{p}(E_{1})=\pm t_{p}(E_{2})$ holds. In
particular, $(t_{p}(E_{1}),t_{p}(E_{2}))\neq(a,b)$. In particular, this
implies that for $(E_{1},E_{2})\in\mathcal{T}_{A}\times\mathcal{T}_{A}$,

$\pi_{E_{1},E_{2}}(X,a,b,d,\ell)=0.$

Invoking Proposition 3.2, we find that

$\frac{1}{\\#\mathcal{C}(X)^{2}}\sum_{E_{1}\in\mathcal{C}(X)}\sum_{E_{2}\in\mathcal{C}(X)}\left(\pi_{E_{1},E_{2}}(X,a,b,d,\ell)-\delta\pi(X;\ell,d)\right)^{2}\leq
CX.$

In particular, this implies that

$\frac{1}{\\#\mathcal{C}(X)^{2}}\sum_{E_{1}\in\mathcal{T}_{A}(X)}\sum_{E_{2}\in\mathcal{T}_{A}(X)}\left(\pi_{E_{1},E_{2}}(X,a,b,d,\ell)-\delta\pi(X;\ell,d)\right)^{2}\leq
CX.$

Since $\pi_{E_{1},E_{2}}(X,a,b,d,\ell)=0$ for
$(E_{1},E_{2})\in\mathcal{T}_{A}\times\mathcal{T}_{A}$, we find that

$\left(\frac{\\#\mathcal{T}_{A}(X)}{\\#\mathcal{C}(X)}\right)^{2}\leq\frac{C}{\delta}\frac{X}{\pi(X;\ell,d)^{2}}=O\left(\frac{\operatorname{log}(X)^{2}}{X}\right),$

and thus,

$\frac{\\#\mathcal{T}_{A}(X)}{\\#\mathcal{C}(X)}=O\left(\frac{\operatorname{log}(X)}{\sqrt{X}}\right).$

Since $\lim_{X\rightarrow\infty}\frac{\operatorname{log}(X)}{\sqrt{X}}=0$, the
result follows. ∎

###### Proof of Theorem A/ Theorem 2.3.

According to Proposition 2.8, every elliptic curve $E\in\mathcal{T}_{K,\ell}$,
$(E,K,\ell)$ satisfies (DS) and the conditions of Theorem 2.2 are satisfied.
Thus, it suffices to show that $\mathcal{T}_{K,\ell}$ has density $1$. Let $L$
denote $\tilde{K}(\mu_{\ell})$ and $\mathcal{D}_{K,\ell}$ be the set of
elliptic curves $E_{/\mathbb{Q}}$ such that

  1. (1)

$\bar{\rho}_{E}^{\prime}$ is surjective,

  2. (2)

$\tilde{K}(\mu_{\ell})$ contains $\mathbb{Q}(\bar{\rho}_{E}^{\prime})$.

Note that $\mathcal{T}_{K,\ell}\cup\mathcal{D}_{K,\ell}$ consists of all
elliptic curves $E_{/\mathbb{Q}}$ for which $\bar{\rho}_{E}^{\prime}$ is
surjective. By the main result of [Duk97] discussed at the start of this
section, their union has density $1$. Therefore, it suffices to show that
$\mathcal{D}_{K,\ell}$ has density $0$. Let $F$ be a subfield of $L$ and
$\mathcal{D}_{F}$ be the set of elliptic curves $E_{/\mathbb{Q}}$ such that

  1. (1)

$\bar{\rho}_{E}^{\prime}$ is surjective,

  2. (2)

$\mathbb{Q}(\bar{\rho}_{E}^{\prime})=F$.

There are finitely many number fields $F$ contained in $L$. Therefore, it
suffices to show that $\mathcal{D}_{F}$ has density $0$. Without loss of
generality, we may assume that $\mathcal{D}_{F}$ is nonempty. Suppose that
$A_{1},A_{2}\in\mathcal{D}_{F}$. Then, since

$\mathbb{Q}(\bar{\rho}_{A_{1}}^{\prime})\simeq\mathbb{Q}(\bar{\rho}_{A_{2}}^{\prime})$

it follows that
$\bar{\rho}_{A_{1}}^{\prime}\simeq\bar{\rho}_{A_{2}}^{\prime}\circ\eta$, where
$\eta\in\operatorname{Aut}\left(\operatorname{GL}_{2}^{\prime}(\mathbb{F}_{\ell})\right)$.
The group
$\operatorname{Aut}\left(\operatorname{GL}_{2}^{\prime}(\mathbb{F}_{\ell})\right)$
is finite. Therefore, we find that $\mathcal{D}_{F}$ is a finite union
$\bigcup_{i=1}^{n}\mathcal{T}_{A_{i}}$. Proposition 3.3 asserts that
$\mathcal{T}_{A}$ has density $0$ for any elliptic curve $A_{/\mathbb{Q}}$.
Being a finite union of density $0$ sets, it follows that $\mathcal{D}_{F}$
has density $0$ as well. Since $\mathcal{D}_{K,\ell}$ is a finite union of
sets of the form $\mathcal{D}_{L}$, it follows that $\mathcal{D}_{K,\ell}$ has
density $0$, and therefore, $\mathcal{T}_{K,\ell}$ has density $1$. This
proves the result. ∎

###### Proof of Theorem B.

The result is an immediate consequence of Theorem 2.5. ∎

##  4\. Hilbert’s tenth problem

In this section, we prove Theorem C. Let us first recall the notion of an
integrally diophantine extension of number fields, in the sense of [Shl07,
Section 1.2]. Let $A$ be a commutative ring with identity, and $A^{n}$ be the
free $A$-module of rank $n$, consisting of tuples $a=(a_{1},\dots,a_{n})$ with
entries in $A$. Let $m$ and $n$ be positive integers and let
$a=(a_{1},\dots,a_{n})\in A^{n}$ and $b=(b_{1},\dots,b_{m})\in A^{m}$. Denote
by $(a,b)\in A^{n+m}$ the tuple $(a_{1},\dots,a_{n},b_{1},\dots,b_{m})$. Given
a finite set of polynomials, $F_{1},\dots,F_{k}$, we set

$\mathcal{F}(a;F_{1},\dots,F_{k})\mathrel{\mathop{\mathchar 58\relax}}=\\{b\in
A^{m}\mid F_{i}(a,b)=0\text{ for all }i=1,\dots,k\\}.$

######  Definition 4.1.

A subset $S$ of $A^{n}$ is a _diophantine subset_ of $A^{n}$ if for some
$m\geq 1$, there are polynomials $F_{1},\dots,F_{k}\in
A[x_{1},\dots,x_{n},y_{1},\dots,y_{m}]$ such that $S$ consists of all $a\in
A^{n}$ for which the set $\mathcal{F}(a;F_{1},\dots,F_{k})$ is nonempty.

######  Definition 4.2.

An extension of number fields $L/K$ is said to be _integrally diophantine_ if
$\mathcal{O}_{K}$ is a diophantine subset of $\mathcal{O}_{L}$.

Let $L^{\prime},L$ and $K$ be number fields such that

$L^{\prime}\supseteq L\supseteq K.$

Suppose that $L^{\prime}/L$ and $L/K$ are integrally diophantine extensions.
Then, it is a well known fact that $L^{\prime}/K$ is an integrally diophantine
extension. Indeed, this is a special case of [Shl07, Theorem 2.1.15].

We recall a conjecture of Denef and Lipchitz [DL78].

######  Conjecture 4.3 (Denef-Lipchitz).

For any number field $L$, $L/\mathbb{Q}$ is an integrally diophantine
extension.

The celebrated result of Matiyasevich proves that Hilbert’s tenth problem has
a negative answer over $\mathbb{Z}$. If $L$ is a number field for which
Conjecture 4.3 holds, then Hilbert’s tenth problem has a negative answer for
$\mathcal{O}_{L}$. New cases of Conjecture 4.3 are established via the
following criterion of Shlapentokh.

######  Theorem 4.4 (Shlapentokh).

Let $L/K$ be an extension of number fields and suppose that there exists an
elliptic curve $E_{/K}$ such that
$\operatorname{rank}E(L)=\operatorname{rank}E(K)>0$. Then, $L/K$ is integrally
diophantine. In particular, if Hilbert’s tenth problem has a negative answer
for $\mathcal{O}_{K}$, then, Hilbert’s tenth problem has a negative answer for
$\mathcal{O}_{L}$.

###### Proof of Theorem C.

By Theorem 2.5, there exists an elliptic curve $E_{/\mathbb{Q}}$ with positive
rank which is diophantine stable at $\ell$. The result is then an immediate
consequence of Theorem 4.4. ∎

## References

  * [Bru92] Armand Brumer.  The average rank of elliptic curves I.  Inventiones mathematicae, 109(1):445–472, 1992.
  * [BS15] Manjul Bhargava and Arul Shankar.  Ternary cubic forms having bounded invariants, and the existence of a positive proportion of elliptic curves having rank 0.  Annals of Mathematics, pages 587–621, 2015.
  * [Cox22] David A Cox.  Primes of the Form $x^{2}+ny^{2}$: Fermat, Class Field Theory, and Complex Multiplication. with Solutions, volume 387.  American Mathematical Soc., 2022.
  * [DL78] Jan Denef and Leonard Lipshitz.  Diophantine sets over some rings of algebraic integers.  Journal of the London Mathematical Society, 2(3):385–391, 1978\.
  * [Duk97] William Duke.  Elliptic curves with no exceptional primes.  Comptes rendus de l’Académie des sciences. Série 1, Mathématique, 325(8):813–818, 1997.
  * [Gal46] Évariste Galois.  OEmathematic works.  Journal of Pure and Applied Mathematics, 11:381–444, 1846.
  * [Jon10] Nathan Jones.  Almost all elliptic curves are serre curves.  Transactions of the American Mathematical Society, 362(3):1547–1570, 2010.
  * [LW17] Tyler Lawson and Christian Wuthrich.  Vanishing of some galois cohomology groups for elliptic curves.  In Elliptic Curves, Modular Forms and Iwasawa Theory: In Honour of John H. Coates’ 70th Birthday, Cambridge, UK, March 2015, pages 373–399. Springer, 2017.
  * [MRL18] Barry Mazur, Karl Rubin, and Michael Larsen.  Diophantine stability.  American Journal of Mathematics, 140(3):571–616, 2018.
  * [PS21] Dipendra Prasad and Sudhanshu Shekhar.  Relating the Tate–Shafarevich group of an elliptic curve with the class group.  Pacific Journal of Mathematics, 312(1):203–218, 2021.
  * [Shl07] Alexandra Shlapentokh.  Hilbert’s tenth problem: Diophantine classes and extensions to global fields.  Number 7. Cambridge University Press, 2007.
  * [Sut16] Andrew V Sutherland.  Computing images of galois representations attached to elliptic curves.  In Forum of Mathematics, Sigma, volume 4, page e4. Cambridge University Press, 2016.


# Towards an Approach to Pattern-based Domain-Specific Requirements
Engineering

Tatiana Chuprina, Daniel Méndez(1,2), Vivek Nigam and Marina Reich(3,4),
Andreas Schweiger(3)
(1)fortiss GmbH
Munich, Germany
(2)Blekinge Institute of Technology
Karlskrona, Sweden
(3)Airbus Defence and Space GmbH
Manching, Germany
(4)Technische University of Chemnitz
Chemnitz, Germany

###### Abstract

Requirements specification patterns have received much attention as they
promise to guide the structured specification of natural language
requirements. By using them, the intention is to reduce quality problems
related to requirements artifacts. Patterns may need to vary in their syntax
(e.g. domain details/ parameter incorporation) and semantics according to the
particularities of the application domain. However, pattern-based approaches,
such as EARS, are designed domain-independently to facilitate their wide
adoption across several domains. Little is yet known about how to adopt the
principle idea of pattern-based requirements engineering to cover domain-
specificity in requirements engineering and, ideally, integrate requirements
engineering activities into quality assurance tasks. In this paper, we propose
the _Pattern-based Domain-specific Requirements Engineering Approach_ for the
specification of functional and performance requirements in a holistic manner.
This approach emerges from an academia-industry collaboration and is our first
attempt to frame an approach which allows for analyzing domain knowledge and
incorporating it into the requirements engineering process enabling automated
checks for requirements quality assurance and computer-aided support for
system verification. Our contribution is two-fold: First, we present a
solution to pattern-based domain-specific requirements engineering and its
exemplary integration into quality assurance techniques. Second, we showcase a
proof of concept using a tool implementation for the domain of flight
controllers for Unmanned Aerial Vehicles. Both shall allow us to outline next
steps in our research agenda and foster discussions in this direction.

###### Index Terms:

Domain-Specific Requirements, Re-usable Pattern-based Requirements, System
Compliance, Defect-based Testing, Unmanned Aerial Vehicle (UAV)

##  I Introduction

The _Naming the Pain in Requirements Engineering_ initiative (NaPiRE)111See
www.napire.org, last access 29/10/2019. constitutes a large-scale survey
research initiative to understand which practices industry practitioners use
in requirements engineering (RE) and which problems they experience [23].
Based on recent results [21], the most rated issues include “Underspecified
Requirements” and “Weak Domain Knowledge” [23, 21]. The latter rating
strengthens our confidence in the value of an appropriate exploration of
domain knowledge and its incorporation into the RE process as this is expected
to improve the requirements’ quality.

Pattern-based approaches, such as EARS [20], are well perceived in the RE
community as a remedy for unstructured and imprecisely specified textual
requirements. Moreover, such patterns are easy in application. Despite of all
their merits, however, these patterns are domain-independent and an
integration of domain specificity is not in their scope.

The main objective of this research is to investigate how domain knowledge can
be incorporated into the requirements specification for improving requirements
engineering process. In our current research efforts, we have focused on
exploring how such patterns can improve the requirements’ quality, while
considering domain-specific aspects. Additionally, since RE is part of the
overall systems development process and interconnected to all other stages
(e.g., system design decisions are driven by requirements, system verification
is related to valid requirements), we consider the impact of the domain
knowledge not only on the RE process, but also on their propagation to the
other development stages, such as system verification.

In this paper we summarize the related work (Section II) and propose an
Approach to Pattern-based Domain-Specific RE to further close existing gaps.
One particular challenge we focus on is the verification of requirements with
a particular focus on performance requirements, i.e. requirements which
describe the continuous input data space. The idea is to integrate defect-
based testing for the verification of the system compliance according to
performance requirements. In Section IV, we further contribute an example for
the domain of flight controllers for Unmanned Aerial Vehicles (UAVs): we
implemented first parts of our approach in the Model-Based Engineering tool
AutoFOCUS3 [6] to show as a running example the Take-off Performance DSR; and
we demonstrate, in Section IV-A, how domain knowledge can be incorporated into
the requirements for integration into quality assurance techniques. In Section
IV-B, we then demonstrate how our approach supports system verification
process, in particular, using defect-based testing techniques for system
compliance of UAV controllers. We close with a conclusion along with a future
work in Section V.

##  II Related Work

There exists a broad and elaborate body of knowledge for handling requirements
quality issues and their causes as well as for improving or automating RE-
related activities such as quality assurance or verification. Related work can
be categorized into the following groups and will be discussed in the
following paragraphs: (1) Natural language processing (NLP), (2) Pattern-based
approaches including boilerplates, (3) Model-based approaches including
domain-specific languages (DSL), and (4) Formal specifications.

Natural language processing (NLP) [35] aims at extracting the semantics of
natural language for automated processing. Related techniques cope with the
analysis of natural language available as text or speech. Those techniques
applied are checking for, e.g., subjective language, vague pronouns or
negative words. Requirements that contain such findings, are then considered
to be potentially problematic. An introduction into using NLP for requirements
quality assurance is summarized in previvous work [10, 9]. However, NLP allows
for the check of a small subset of requirements quality properties only, such
as unambiguities or consistencies in text. Exemplary valuable contributions
are given by the authors in [7, 38, 11, 37, 16]. These approaches, however, do
not cover yet the following aspects: (1) Aspects such as adequacy or
pertinence cannot be tackled due to the focus on text, (2) NLP does not take
into account domain knowledge provided in non-textual form such as figures,
tables and symbols, and (3) NLP does not integrate the analyzed requirements
into the verification of functional and performance requirements. Our approach
intends to close those contemporary gaps.

Pattern-based approaches include controlled natural language (CNL) techniques.
These approaches aim at controlling the requirements quality such as ambiguity
or consistency. CNL operates with predefined rules to formalize and to
structure textual requirements; for instance, boilerplates [28] are created
based on frequent or appropriate patterns. EARS [20] patterns and their
extensions such as EARS-CTRL [18], Parametrized Safety Requirements templates
[4], and Adv-EARS [19] are prominent examples for providing templates to the
engineer for gathering the requirements. Though some approaches propose to
structure behavior requirements in tables, e.g., for defining a state
automaton in a table view [13, 34], the following aspects are not in scope of
existing pattern-based approaches: (1) Related approaches are applicable to
functional requirements only, rather than to performance requirements, (2)
they do not incorporate domain knowledge using figures, and (3) they do not
cover requirements quality characteristics such as adequacy or pertinence.
Also here we intend to close existing gaps with our contributions.

Model-based approaches aim at capturing requirements graphically, e.g., by
applying UML/SysML [27, 26] or BPMN [25]. The MIRA framework [33] is an
example for a holistic model-based approach which considers quality assurance
for functional requirements and an integration into a seamless development
process. Model-based approaches also incorporate domain knowledge for a
specific purpose [24]. A domain model can support domain-specific modeling, as
a domain model is capturing the concepts, terminology (defined by an
ontology), scope, and features of the domain [22]. This domain model can then
be utilized for modeling e.g. a specific use case, requirement for a system or
desired system behaviour in this domain [31]. We can include Domain-Specific
Languages (DSL) for RE model-based approaches, and graphical (e.g.,
Arcadia/Capella [1]) or textual DSL for modeling requirements [24], because
there is no strict distinction between them. Our DSRs elements also can be
referred to DSL. However, when comparing existing approaches to our
objectives, these approaches have several shortcomings: (1) Automated
requirements quality assurance is not yet a prime objective of such
approaches, (2) the integration of such approaches with defect-based testing
is not supported, and (3) performance requirements are not taken into account.
This is in scope of our contributions.

Formal specification offers precise logical definition (e.g., using temporal
logic formulae), which copes with requirement quality issues such as
ambiguity. Well-known techniques are Z [14] and B [2] and their extensions
Event-B [3] and Z++ [17], respectively. Other approaches propose logical
patterns by applying formal specifications, e.g., Specification Pattern System
(SPS) [12] or Real-time Specification Patterns [15]. However, formal
specifications still suffer from the following limitations: (1) Requirements
quality properties such as adequacy or pertinence are not covered, and (2)
domain knowledge for RE is not exploited explicitly. Finally, also here we
contribute to further closing existing gaps in literature.

##  III Approach

Inspired by our industry partner’s project that aimed to analyze the reusable
nature of UAV controller requirements, we developed an Approach to Pattern-
based Domain-Specific RE that can be used for requirements specification,
requirements quality assurance and system compliance phases in a holistic
manner. Moreover, our approach supports automation of the work-flow. The
approach is based on the idea to collect descriptive data of the considered
domain (domain knowledge) and incorporate them into graphical representation
of requirements (in short, a picture with appended meta-data), so that such
approach can control quality of the requirements and support integration the
RE with a system verification process (here with defect-based testing
techniques).

We analyzed the given requirements for quadcopter controllers which are
typically used by control engineers (CEers). We discovered that CEers use
graphical representations of the requirements along with textual
specifications, because presenting requirements graphically is more
informative way for explaining system design, than describing it with
sentences of text. Indeed, as we describe in Section IV-A, the domain
knowledge can be intuitively represented by a simple picture of the desired
performance of the quadcopter controller.

Because of requirements repetition from project to project for the same kind
of system (e.g. a basic drone should perform take-off or landing maneuvers),
the graphical representation of the requirements can be considered as
graphical patterns. Comparing to EARS [20] domain-independent textual
patterns, we see an advantage of our approach in graphical pattern-based
presentation of requirements with domain knowledge incorporation. These
patterns were recently introduced in a short paper [30] and called Domain-
Specific Requirements (DSRs).

We identified that DSRs for UAV Controller include eight patterns: (1) Mode
DSR, specifying the UAV modes and transitions; (2) Performance Error DSR,
specifying the performance error when transiting from one mode to another; (3)
Take-off DSR and (4) Step Altitude DSR, specifying the performance of take-off
UAV maneuvers; (5) Hover DSR, (6) Trajectory Following DSR, (7) Landing DSR,
(8) Stationary DSR, these four DSRs as well as Take-Off DSR describe
performance modes of the UAV. Figure 1 presents meta-model of DSR collection
for UAV Controller we propose in this paper. DSR-elements are model elements
such as, figures and tables, resembling usual (textual) requirements of the
domain.

Figure 1: an Approach to Pattern-based Domain-Specific RE

Such pattern representations are known to be informative and serve for better
understanding, explanation of requirements [32] improving the communication
process between stakeholders within system life-cycle. However, differently
from usual textual requirements containing figures, the (meta-)data in DSRs
have precise meaning, thus enabling semi-automated quality checks. Figures
help visualize the key aspects of a requirement, such as, variables and
parameters. Tables are then used to specify the properties of these aspects,
such as, variable ranges. Further in this paper, we present example with take-
off maneuver of UAV to demonstrate this. Figure 2 shows "Take-off DSR" with
the graphical element of the take-off maneuver, table elements for structuring
the requirement and domain-specific parameters, which describes possible
scenarios of the take-off maneuver of UAV.

##  IV Take-Off Performance DSR

Figure 2: Take-Off Performance DSR Prototype in AutoFOCUS3.

We illustrate DSRs with a Take-Off performance requirement for UAV
controllers. The Take-Off Performance DSR specifies the control performance of
the UAV while carrying out a take-off maneuver. Its elements use the figure
and the tables presented on Figure 2. The idea is that the take-off maneuver
illustrates graphically the key parameters relevant for this requirement. Then
the exact bounds for these values are established by using the remaining DSR
elements. The values in the tables (DSR elements) are not to be taken too
seriously, but serve only for illustrative purpose. Take-Off Performance DSR
is composed by four DSR elements:

Take-Off Maneuver DSR Element: This element is a figure illustrating the main
maneuver parameters. An instance of this DSR element is depicted on the left
side of Figure 2. It is a commonly used illustration by control engineers to
describe the takes-off movement of UAV and the performance criteria.
Therefore, it naturally incorporating domain knowledge. The take-off maneuver
consists of: taking off from an initial position point; specified rotation
angles about the axis $(x,y,z)$ of the UAV: _pitch_ ($\Theta$), _yaw_ ($\Psi$)
and _roll_ ($\Phi$); moving upwards to the designated height $h$; two UAV
performance variables: the overshoot ($\Delta h_{ov}$) and the horizontal
deviation ($\Delta(x,y)$).

Take-Off Starting and Final Conditions DSR Element: The second DSR element is
a table for specifying the ranges of the UAV parameters ($\Theta,\Psi,\Phi$
and $h$) in initial and final position points. The values in the Figure 2
specify, for example, that the UAV can take-off to a height between 2 or 3
meters when starting from any surface with inclination ($\Theta$) of at most
20 degrees.

Horizontal Deviation DSR Element is a table for specifying the performance of
the UAV take-off maneuver in terms of the maximal horizontal deviation
($\Delta(x,y)$) (depicted as Horizontal Error on Figure 2) in any direction
from the take-off point at times _after starting the take-off maneuver_. A
special entry _always_ indicates the global property that shall be satisfied
at all times by the take-off maneuver. For example, at all times the
horizontal deviation shall be not greater than 2 meters. Also, in the table a
particular time steps of take-off maneuver can be specified, e.g., 3 seconds
[s] after the system became airborne, the horizontal deviation shall not be
greater than 0.1 meter.

Altitude Deviation DSR Element is a table for specifying the performance of
the UAV take-off maneuver in terms of the maximum admissible altitude error
($\Delta h_{ov}$) at different times _after reaching the target height._ As
with the Horizontal Deviation DSR Element, the table also contains the entry
_always_.

Notice that the time steps for the Horizontal and Altitude Deviation DSRs may
differ and not be limited in number.

Organizing DSRs in this way has some advantages. It incorporates naturally the
domain-specific terminology by means of figures and tables as opposed to more
sophisticated machinery, such as formal specifications. Moreover, such a DSR
enables the semi-automated methods for requirement quality assurance and
system compliance, as the meaning of the values can be inferred from the meta-
data (domain-specific parameters). The explanation goes in Sections IV-A and
IV-B.

###  IV-A Domain-Specific Defects

This Section proposes a set of Domain-Specific Defects (DSDs) for Take-off
Performance DSR described in Section IV. The data in red illustrate Domain-
Specific Defects presented as Table I.

In our research we took the requirement quality characteristics proposed in
[36] as a base set for DSR quality assurance.

We first argue that the DSRs do not suffer from the defects Unintelligibility,
Unstructured Textual Requirements, Invisible Dependencies Between Items. Below
we present a list of the Domain-specific defects and respective to these
defects quality characteristics (QC) in format [defect-QC].

  * •

Unintelligibility - Measurability: defect indicates that a requirement is bad-
defined and, consequently, not prepared for the evaluation process. The use of
domain knowledge in DSR, incorporated into the DSR elements support the
precision necessary for evaluation. For example, the Take-off Performance DSR
uses well-established terms for control engineers, such as pitch,roll and yaw
angles.

  * •

Unstructured Textual Requirements - Good Structuring: defect indicates the
problem of a bad-structured textual requirement, where the structural links
among DSR elements are not highlighted. The DSR elements in Take-Off
Performance DSRs proposed have a logical connection. For example, the _Take-
Off Maneuver DSR element_ illustrates the parameters used by the _Take-Off
Starting and Final Conditions DSR Element_ and _Altitude Error DSR Element_.

TABLE I: Example of Domain-Specific Defects for Take-Off Starting and Final Conditions DSR Element. | Initial | Final |  Unit
---|---|---|---
|  min |  max |  min |  max
Theta ($\Theta$) |  0 |  95 |  0 |  0 |  Degree
Psi ($\Psi$) |  320-360 |  360 |  0 |  360 |  Degree
Phi ($\Phi$) |  0.001 |  – |  0 |  0 |  –
Height (${h}$) |  – |  – |  -1 |  2 |  Meter
  * •

Invisible Dependencies Between Items - Traceability: The same argument can be
used for this defect. The dependencies are explicit in the construction of
DSRs, through the incorporation of domain knowledge within requirements (DSR-
Elements).

  * •

Omission - Completeness: The Take-Off Performance DSR suffers from Omission if
it does not contain the data in its Table DSR Elements. For example, missing
values for the initial conditions of the Take-Off maneuver in the table Take-
Off Performance DSR Element, however the domain-specific parameters for these
conditions are presented at a pictured Take-Off Maneuver DSR Element (Psi,
Theta, Phi, $\Delta{(x,y)}$ horizontal or $\Delta{h\\_ov}$ vertical
deviations).

  * •

Imprecise - Unambiguity: The Take-Off Performance DSR provides a template-
based table view, which structures the given data of requirements into the
certain format: [Parameter] = [Value] [Unit]. This helps to avoid Imprecise
information defect, such as parameters are declared in an imprecise way:
initial $\Psi$ is from 0 to 320 or 360, or without unit:
$\psi$=$[$0;320-360$]$ $[$-$]$.

  * •

Contradiction - Consistency: If every parameter and its unit are not defined
consistently w.r.t UAV domain and related DSR Elements, then we can conclude
that DSR defected,e.g., $\Phi$=0,001[-] and $\Theta$=[0;20][degree].

  * •

Incorrect Domain Laws Description - Adequacy: The incorporation of domain-
specific knowledge in DSRs is valuable in defining precisely these defects.
For the Take-Off Performance DSR, it is defective if one specifies unrealistic
parameters without rationale. According to domain rules, UAV cannot take-off
from inclination $\Theta$ = 95 degree or take-off attitude cannot be negative.

  * •

Superfluous - Pertinence: Take-Off Performance DSR will be defective if it
specifies variables which are out of its domain-specific set, e.g., landing
point(x,y,h) = (0,0,0), which is not a relevant parameter for taking-off UAV
maneuver.

We apply static analysis methods for requirements quality checks comparing
predefined domain-specific data baseline with the data incorporated in Take-
Off Performance DSR. This comparison can be performed by setting predefined
constraints for data in DSRs, e.g., constraint: "allowed range for inclination
parameter $\Theta$ $\in$ [0;20]". Such approach was proposed by [5] and allows
automation of the quality checks.

###  IV-B DSRs Integration with Defect-based Testing

The verification of performance requirements, such as, for UAV controllers
described above, is challenging because there are infinitely many test cases
to consider (instead of precise values, the take-off parameters (i.e.$\Theta$,
$\Psi$, $h$) are the allowed ranges).

To address this challenge, defect-based testing (DBT) approaches have been
successfully deployed [29].

The overall DBT approach is to build test-cases so that to maximize the chance
of triggering a defect. For example, when testing the logic of a software, one
tests its corner cases, e.g., by applying Boundary Value Analysis [8].

In this research, we review the definition of the DBT artifacts and explain
how these are instantiated for our approach continuing with the example of
Take-Off Performance DSR:

  * •

Specification: The specification represents properties that shall be tested.
These have to be verified for the implementation. Our DSRs contain these
specifications by design. For example, the Take-Off Performance DSR contains
the initial conditions for the take-off maneuver and maximum horizontal
deviation at a given elapsed time.

  * •

Implementation Model: The implementation represents the system under test. It
is an executable software design of the system under development. For UAV
controller development, the implementation model is developed in Matlab/
Simulink. This model is assumed to reflect as close as possible the actual UAV
to be developed;

  * •

Environment Model: If the system interacts with its environment, the
environment model can be provided. For UAV controller development, the
implementation model incorporates the environment model, namely, in the flight
dynamics model. The environment, Quadcopter Dynamic Modeling and Simulation
package (Quad-Sim)222git repository:https://github.com/dch33/Quad-
Sim333https://www.mathworks.com/matlabcentral/fileexchange/48053-quad-sim was
used for our simulation;

  * •

Failure Model: A failure is the observed difference between actual and
intended behavior. This model is used to determine which test-cases have a
greater chance to find a defect in the actual UAV implementation (and not the
simulation model). For the Take-Off Maneuver DSR, the failure model is how
close the UAV does not comply with the altitude and horizontal errors.

We now put these components together to generate test-cases using DBT
methodology on the Take-Off Performance DSR:

(1) Input Space Partitioning: We partition the input space, namely, the values
for the initial yaw($\Psi$), pitch($\Theta$) (we elide $\Phi$ for simplicity)
and intended height($h$), specified in the Take-Off Performance DSR:

$\begin{array}[]{lll}\Theta\in[0,6]&\Theta\in~{}]6,12]&\Theta\in~{}]12,20]\\\
\Psi\in[0,120]&\Psi\in~{}]120,240]&\Psi\in~{}]240,360]\\\
h\in[0,1]&h\in~{}]1,2]&h\in~{}]2,3]\\\ \end{array}$

(2) Generate Random Take-Off Scenarios: For each partition $P_{j}$, we
generate $n$ random take-off scenarios, $S_{1},\ldots,S_{n}$, by randomly
generating values for $\Theta,\Psi,h$ that belong to the partition,e.g.
$\Theta=7.4,\Psi=101,h=2.3m$.

In our use case we specified 2 test-cases for every partition. The greater the
number of scenarios generated, the greater is the effort and the greater are
the chances for finding a defect.

Note that the number of take-off scenarios($n$) and the granularity of the
partitions depend on the available computational power and the desired level
of precision.

(3) Run Take-Off Simulations: Using the implementation/environment model, we
carry out one simulation for each generated take-off scenario, $S_{i}$. The
output is a simulated take-off maneuver, $\Xi_{i}$.

(4) Compute Failure Model:

For our example, we generate test-cases that maximize the chance of finding
defects on the admissible horizontal deviation. (For the altitude deviation is
similar.)

$\Delta(x,y)$ is the horizontal deviation in the Take-Off Performance DSR. For
each simulated take-off maneuver, $\Xi_{i}$ for the scenario $S_{i}$, we
compute the maximum horizontal deviation, $max({\Xi_{i}})$. Afterwards, we
compute for $S_{i}$ its _defect-value_ as follows:

$dfb(S_{i})=\left\\{\begin{array}[]{ll}\infty&\textrm{if
$max({\Xi_{i}})>\Delta(x,y)$}\\\
\frac{1}{\Delta(x,y)-max({\Xi_{i}})}&\textrm{otherwise}\end{array}\right.$

Intuitively, the greater the defect-value, the greater is the chance for the
scenario $S_{i}$ that generated $\Xi$ to trigger a defect for the actual UAV.

(5) Consolidate Defect-Values for Partitions: Let
$dfb(S_{1}),\ldots,dfb(S_{n})$ be the defect-values of the scenarios generated
for the partition $P_{j}$ in step (2). The defect-value of the partition
$P_{j}$, $dfb(P_{j})$ is equal to $dfb(S_{1})+\cdots+dfb(S_{n})$.

Figure 3 is an illustration of an output of the procedure $(1)-(5)$ as a heat
map, where defect-based points inverted to by 1 and presented in color (the
darker color, the more chance of triggering the defect). Such output
presentation supports prioritization of the test-case scenarios, and indicates
the partition-candidate for more precise testing.

Figure 3: Illustration of Defect-Values for Partitions.

##  V Conclusion and Future Work

In this paper we present our first attempts towards an Approach to Pattern-
based Domain-Specific RE illustrating the concept for performance requirements
with Take-off DSR. Using this example, we demonstrate how our holistic
approach integrates domain-specific requirements specification, computer-aided
quality assurance techniques and system verification techniques, such as
defect-based testing. Providing Take-off performance DSR, we explain how
domain knowledge can be incorporated in performance requirements specification
to improve quality of requirements and to support system verification process.

A further most interesting and challenging question is related to non-
functional requirements, i.e., how our approach can be applied to requirements
specifications which describe such system aspects as safety and security.

Furthermore, our initial results (as well as those of upcoming) require an
evaluation at practice. Therefore, the next stage of the research can be an
empirical study for validating our approach and publishing the achieved
results. Finally, the approach requires an investigation on scalability by
applying it for other domains, e.g., self-driving cars (AI-based systems
domain).

Therefore, we believe that our Approach to Pattern-based Domain-Specific RE
can be helpful and poses actual and interesting questions for the community.
Acknowledgements. Our research is a part of the global research funded by
DAAD, in cooperation with Institute of Flight System Dynamics (FSD) at
Technical University of Munich (TUM), Germany and Federal University of
Paraíba, Brasil. Also we thank PhD student Daniel Morais for the support in
this research.

## References

  * [1] Arcadia / Capella, a field-proven modeling solution for system and software architecture engineering (presented by Thales).
  * [2] J. Abrial and J. Abrial.  The B-Book: Assigning Programs to Meanings.  Cambridge University Press, 2005.
  * [3] J.-R. Abrial.  Modeling in Event-B: System and Software Engineering.  Cambridge University Press, New York, NY, USA, 1st edition, 2010.
  * [4] P. O. Antonino, M. Trapp, P. F. C. Barbosa, and L. Sousa.  The parameterized safety requirements templates.  2015 IEEE/ACM 8th International Symposium on Software and Systems Traceability, pages 29–35, 2015.
  * [5] V. Aravantinos and S. Kanav.  Tool support for live formal verification.  In 2017 ACM/IEEE 20th International Conference on Model Driven Engineering Languages and Systems (MODELS), pages 145–155, Sep. 2017.
  * [6] V. Aravantinos, S. Voss, S. Teufl, F. Hölzl, and B. Schätz.  AutoFOCUS 3: Tooling concepts for seamless, model-based development of embedded systems.  In Proc. 8th Int. MODELS Workshop Model-based Archit. Cyber-physical Embed. Syst. (ACES-MB ’15), pages 19–26, 2015.
  * [7] F. Chantree, B. Nuseibeh, A. de Roeck, and A. Willis.  Identifying nocuous ambiguities in natural language requirements.  In 14th IEEE International Requirements Engineering Conference (RE’06), pages 59–68, Sep. 2006.
  * [8] D. J. Coe.  A review of boundary value analysis techniques.  2008\.
  * [9] H. Femmer, D. Méndez, E. Juergens, M. Klose, I. Zimmer, and J. Zimmer.  Rapid requirements checks with requirements smells: Two case studies.  In Proceedings of the 1st International Workshop on Rapid Continuous Software Engineering, RCoSE 2014, pages 10–19, New York, NY, USA, 2014. ACM.
  * [10] H. Femmer, D. Méndez, S. Wagner, and S. Eder.  Rapid quality assurance with requirements smells.  Journal of Systems and Software, 2016.
  * [11] A. Ferrari and S. Gnesi.  Using collective intelligence to detect pragmatic ambiguities.  In 2012 20th IEEE International Requirements Engineering Conference (RE), pages 191–200, Sep. 2012.
  * [12] P. Filipovikj, M. Nyberg, and G. Rodriguez-Navas.  Reassessing the pattern-based approach for formalizing requirements in the automotive domain.  In 2014 IEEE 22nd International Requirements Engineering Conference (RE), 2014.
  * [13] M. Herrmannsdoerfer, D. S. Konrad, and B. Berenbach.  Tabular notations for state machine-based specifications.  2008\.
  * [14] S. S. . Joint Technical Committee ISO/IEC JTC 1, Information technology.  Information technology — z formal specification notation — syntax, type system and semantics, 1996.
  * [15] S. Konrad and B. H. C. Cheng.  Real-time specification patterns.  In Proceedings of the 27th International Conference on Software Engineering, ICSE ’05. ACM.
  * [16] S. J. Körner and T. Brumm.  Natural language specification improvement with ontologies.  Int. J. Semantic Computing, 2009.
  * [17] K. Lano.  Z++, an object-orientated extension to z.  pages 151–172, 12 1990.
  * [18] L. Lucio, S. Rahman, S. bin Abid, and A. Mavin.  Ears-ctrl: Generating controllers for dummies.  In MODELS, 2017.
  * [19] D. Majumdar, S. Sengupta, A. Kanjilal, and S. Bhattacharya.  Adv-ears: A formal requirements syntax for derivation of use case models.  In D. C. Wyld, M. Wozniak, N. Chaki, N. Meghanathan, and D. Nagamalai, editors, Advances in Computing and Information Technology, pages 40–48. Springer Berlin Heidelberg, 2011.
  * [20] A. Mavin, P. Wilkinson, A. Harwood, and M. Novak.  Easy approach to requirements syntax (ears).  In Proceedings of the 2009 17th IEEE International Requirements Engineering Conference, RE, RE ’09, pages 317–322. IEEE Computer Society, 2009.
  * [21] D. Méndez.  Supporting requirements-engineering research that industry needs: The napire initiative.  IEEE Software, 35(1):112–116, 2018.
  * [22] M. Mernik, J. Heering, and A. M. Sloane.  When and how to develop domain-specific languages.  ACM Comput. Surv., 37(4):316–344, dec 2005.
  * [23] D. Méndez, S. Wagner, M. Kalinowski, M. Felderer, P. Mafra, A. Vetro, T. Conte, M.-T. Christiansson, D. Greer, C. Lassenius, T. Männistö, M. Nayebi, M. Oivo, B. Penzenstadler, D. Pfahl, R. Prikladnicki, G. Ruhe, A. Schekelmann, S. Sen, and R. Wieringa.  Naming the pain in requirements engineering: Contemporary problems, causes, and effects in practice.  Empirical Software Engineering, 2016.
  * [24] O. Olajubu.  A textual domain specific language for requirement modelling.  2015\.
  * [25] OMG.  Business process model and notation - version 2.0, 2001.
  * [26] OMG.  System modeling language (omg sysml).  formal/17-05-01, May 2017.
  * [27] OMG.  Unified modeling language (omg uml).  formal/17-12-05, 2017.
  * [28] K. Pohl and C. Rupp.  Requirements Engineering Fundamentals - A Study Guide for the Certified Professional for Requirements Engineering Exam: Foundation Level - IREB compliant. rockynook, 2011.
  * [29] A. Pretschner.  Defect-based testing, pages 141–163.  01 2017.
  * [30] M. Reich, T. Chuprina, and V. Nigam.  Towards computer-aided software requirements process.  In Proceedings of the Workshops of the Software Engineering Conference 2019, Stuttgart, Germany, February 19, 2019., pages 75–78, 2019.
  * [31] T. Stahl, M. Voelter, and K. Czarnecki.  Model-Driven Software Development: Technology, Engineering, Management.  John Wiley & Sons, Inc., 2006.
  * [32] H. Störrle.  How are conceptual models used in industrial software development?: A descriptive survey.  In Proceedings of the 21st International Conference on Evaluation and Assessment in Software Engineering, EASE’17. ACM, 2017.
  * [33] S. Teufl, D. Mou, and D. Ratiu.  MIRA: A tooling-framework to experiment with model-based requirements engineering.  In Proc. 21st Int. Conf. Requirements Engineering (RE ’13). IEEE, 2013.
  * [34] J. Thyssen and B. Hummel.  Behavioral specification of reactive systems using stream-based i/o tables.  Software & Systems Modeling, 12(2), 2013.
  * [35] A. M. Turing.  Computing machinery and intelligence.  Mind, 59, 1950.
  * [36] A. van Lamsweerde.  Requirements Engineering: From System Goals to UML Models to Software Specifications.  Wiley Publishing, 1st edition, 2009.
  * [37] J. Winkler and A. Vogelsang.  Automatic classification of requirements based on convolutional neural networks.  In 24th IEEE International Requirements Engineering Conference, RE 2016, pages 39–45, 2016.
  * [38] H. Yang, A. de Roeck, V. Gervasi, A. Willis, and B. Nuseibeh.  Analysing anaphoric ambiguity in natural language requirements.  Requirements Engineering, 2011.