Search

While modern software companies strive to increase team autonomy to enable them to successfully operate the piece of software they develop and deploy, efficient ways to orchestrate the work of multiple autonomous teams working in parallel are still poorly understood. In this paper, we report how team autonomy is maintained at Spotify at scale, based on team retrospectives, interviews with team managers and archival analysis of corporate databases and work procedures. In particular, we describe how managerial authority is decentralized through various workgroups with collective authority, what compromises are made to team autonomy to ensure alignment and which team-related factors can further hinder autonomy. Our findings show that scaled autonomy at Spotify does not mean anarchy, or unlimited permissiveness. Instead, squads are expected to take responsibility for their work and coordinate, communicate and align their actions with others, and comply with a few enabling constraints. Further, squads take many decisions independently without management control or due to collective efforts that bypass formal boundary structures. Mechanisms and strategies that enable self-organization at Spotify are related to effective sharing of the codebase, achieving alignment, networking and knowledge sharing, and are described to guide other companies in their efforts to scale autonomy. © 2023 The Author(s)

Background: Software engineering research aims to establish software development practice on a scientific basis. However, the evidence of the efficacy of technology is insufficient to ensure its uptake in industry. In the absence of a theoretical frame of reference, we mainly rely on best practices and expert judgment from industry-academia collaboration and software process improvement research to improve the acceptance of the proposed technology. Objective: To identify acceptance models and theories and discuss their applicability in the research of acceptance behavior related to software development.Method: We analyzed literature reviews within an interdisciplinary team to identify models and theories relevant to software engineering research. We further discuss acceptance behavior from the human information processing perspective of automatic and affect-driven processes (“fast” system 1 thinking) and rational and rule-governed processes (“slow” system 2 thinking). Results: We identified 30 potentially relevant models and theories. Several of them have been used in researching acceptance behavior in contexts related to software development, but few have been validated in such contexts. They use constructs that capture aspects of (automatic) system 1 and (rational) system 2 oriented processes. However, their operationalizations focus on system 2-oriented processes indicating a rational view of behavior, thus overlooking important psychological processes underpinning behavior. Conclusions: Software engineering research may use acceptance behavior models and theories more extensively to understand and predict practice adoption in the industry. Such theoretical foundations will help improve the impact of software engineering research. However, more consideration should be given to their validation, overlap, construct operationalization, and employed data collection mechanisms when using these models and theories. open access ELLIIT

Coordination is important in software development. Socio-Technical Congruence (STC) is proposed to measure the match between coordination requirements and actual coordination activities. The previous work of Cataldo et al. computes STC in commercial projects and finds it related to software failures. In this paper, we study the relationship between file-level STC and bug proneness in Open Source Software (OSS) projects. We apply the fundamental STC framework to the OSS data setting and present a method of computing file-level STC based on our available data. We also propose a derivative STC metric called Missing Developer Links (MDL), which is to measure the amount of coordination breakdowns. In our empirical analysis on five OSS projects, we find that MDL is more related to bug proneness than STC. Furthermore, STC or MDL can be computed based on different types of file networks and developer networks, and we find out the best file network and the best developer network via an empirical study. We also evaluate the usefulness of STC or MDL metrics in bug prediction. This work is promising to help detect coordination issues in OSS projects.

Performance is one of the key aspects of non-functional qualities as performance bugs can cause significant performance degradation and lead to poor user experiences. While bug reports are intended to help developers to understand and fix bugs, they are also extensively used by researchers for finding benchmarks to evaluate their testing and debugging approaches. Although researchers spend a considerable amount of time and effort in finding usable performance bugs from bug repositories, they often get only a few. Reproducing performance bugs is difficult even for performance bugs that are confirmed by developers with domain knowledge. The amount of information disclosed in a bug report may not always be sufficient to reproduce the performance bug for researchers, and thus hinders the usability of bug repository as the resource for finding benchmarks. In this paper, we study the characteristics of confirmed performance bugs by reproducing them using only informations available from the bug report to examine the challenges of bug reproduction from the perspective of researchers. We spent more than 800 h over the course of six months to study and to try to reproduce 93 confirmed performance bugs, which are randomly sampled from two large-scale open-source server applications. We (1) studied the characteristics of the reproduced performance bug reports; (2) summarized the causes of failed-to-reproduce performance bug reports from the perspective of researchers by reproducing bugs that have been solved in bug reports; (3) shared our experience on suggesting workarounds to improve the bug reproduction success rate; (4) delivered a virtual machine image that contains a set of 17 ready-to-execute performance bug benchmarks. The findings of our study provide guidance and a set of suggestions to help researchers to understand, evaluate, and successfully replicate performance bugs.

Use case modeling is a forefront technique to specify functional requirements of a system. Many research works related to use case modeling have been devoted to improving various aspects of use case modeling and its utilization in software development processes. One key aspect of use case models that has thus far been overlooked by the research community is the visual perception of use case diagrams by its readers. Any model is used transfer a mental idea by a modeler to a model reader. Even if a use case diagram is constructed flawlessly, if it is misread or misinterpreted by its reader then the intrinsic purpose of modeling has failed. This paper provides a two-fold contribution. Firstly, this paper presents an evaluation of the cognitive effectiveness of use case diagrams notation. The evaluation is based on theory principles and empirical evidence mainly from the cognitive science field. Secondly, it provides empirically validated improvements to the use case diagram notation that enhances its cognitive effectiveness. Empirical validation of the improvements is drawn by conducting an industrial survey using business analyst professionals. Empirical validation is also drawn by conducting an experiment using software engineering professionals as subjects.

During the development and maintenance of software-intensive products or services, we depend on various artefacts. Some of those artefacts, we deem central to the feasibility of a project and the product's final quality. Typically, these central artefacts are referred to as assets. However, despite their central role in the software development process, little thought is yet invested into what eventually characterises as an asset, often resulting in many terms and underlying concepts being mixed and used inconsistently. A precise terminology of assets and related concepts, such as asset degradation, are crucial for setting up a new generation of cost-effective software engineering practices. In this position paper, we critically reflect upon the notion of assets in software engineering. As a starting point, we define the terminology and concepts of assets and extend the reasoning behind them. We explore assets' characteristics and discuss what asset degradation is as well as its various types and the implications that asset degradation might bring for the planning, realisation, and evolution of software-intensive products and services over time. We aspire to contribute to a more standardised definition of assets in software engineering and foster research endeavours and their practical dissemination in a common, more unified direction., Manuscript submitted to the Journal of Systems and Software

The term “case study” is not used consistently when describing studies and, most importantly, is not used according to the established definitions. Given the misuse of the term “case study”, we critically analyse articles that cite case study guidelines and report case studies. We find that only about 50% of the studies labelled “case study” are correctly labelled, and about 40% of studies labelled “case study” are actually better understood as “small-scale evaluations”. Based on our experiences conducting the analysis, we formulate support for ensuring and assuring the correct labelling of case studies. We develop a checklist and a self-assessment scheme. The checklist is intended to complement existing definitions and to encourage researchers to use the term “case study” correctly. The self-assessment scheme is intended to help the researcher identify when their empirical study is a “small-scale evaluation” and, again, encourages researchers to label their studies correctly. Finally, we develop and evaluate a smell indicator to automatically suggest when a reported case study may not actually be a case study. These three instruments have been developed to help ensure and assure that only those studies that are actually case studies are labelled as “case study”. © 2022 The Author(s) open access

In a collaborative development context, conflicting code changes might compromise software quality and developers productivity. To reduce conflicts, one could avoid the parallel execution of potentially conflicting tasks. Although hopeful, this strategy is challenging because it relies on the prediction of the required file changes to complete a task. As predicting such file changes is hard, we investigate its feasibility for BDD (Behaviour-Driven Development) projects, which write automated acceptance tests before implementing features. We develop a tool that, for a given task, statically analyzes Cucumber tests and infers test-based interfaces (files that could be executed by the tests), approximating files that would be changed by the task. To assess the accuracy of this approximation, we measure precision and recall of test-based interfaces of 513 tasks from 18 Rails projects on GitHub. We also compare such interfaces with randomly defined interfaces, interfaces obtained by textual similarity of test specifications with past tasks, and interfaces computed by executing tests. Our results give evidence that, in the specific context of BDD, Cucumber tests might help to predict files changed by tasks. We find that the better the test coverage, the better the predictive power. A hybrid approach for computing test-based interfaces is promising.

Systematic reuse is crucial to efficiently engineer and deploy software languages to software experts and domain experts alike. But “software languages are software too”, and hence their engineering, customization, and reuse are subject to similar challenges. To this effect, we propose an approach for composing independent, grammar-based language syntax modules in a structured way that realizes a separation of concerns among the participants in the life cycle of the languages. We present a refined concept of systematic and controlled syntactic variability of extensible software language product lines through identification of syntax variation points and derivation of variants from independently developed features. This facilitates reuse of software languages and reduces the efforts of engineering and customizing languages for specific domains. We realized our concept with the MontiCore language workbench and assessed it through a case study on architecture description languages. Ultimately, systematic and controlled software language reuse reduces the effort of software language engineering and fosters the applicability of software languages.

A software product line comprises a set of products that share a common code base, but vary in specific characteristics called features. Ideally, features of a product line are developed in isolation and composed subsequently. Product lines are increasingly used for safety-critical software, for which quality assurance becomes indispensable. While the verification of product lines gained considerable interest in research over the last decade, the subject of how to specify product lines is only covered rudimentarily. One challenge is composition; similar to inheritance in object-oriented programming, features of a product line may refine other features along with their specifications.In our work [1], we present a comprehensive discussion and empirical evaluation of how to specify product lines implemented by means of feature-oriented programming. In feature-oriented programs, implementation artifacts, such as methods, are distributed over the set of feature modules and subsequently composed together when the respective features are selected. Similar to this idea, contracts could be modularized, too, and are subsequently composed together with their respective methods. In particular, we investigate how refinement and composition of such specifications can be established and derive a notion of feature-oriented contracts comprising preconditions, postconditions, and framing conditions of a method (i.e., following the design-by-contract paradigm).While both design by contract and feature-oriented programming have been hot research topics for more than two decades, their combination had rarely been explored. When features refine methods, an important question is whether refinement of their contracts is inevitable or not. However, unlike method composition where only the order of features is relevant, it seems that contract composition has to be handled differently according to certain scenarios. Consequently, a diverse set of composition techniques is required. In total, we identify and discuss six mechanisms to perform contract composition between original and refining contracts. Moreover, we identify and discuss desired properties for contract composition and evaluate which properties are established by which mechanism. As proof-of-concept and to enable larger evaluations, we developed tool support for feature-oriented contracts and their composition in FEATUREHOUSE and FEATUREIDE.We conducted an empirical evaluation, in which we specified 14 product lines by means of contracts. To evaluate product lines specified with feature-oriented contracts, we applied three strategies. First, we implemented five product lines and feature-oriented contracts from scratch. Second, we decomposed six existing, object-oriented programs, which were formally verified before, including their contracts into a product line. That is, we identified features of the program and separated them into feature modules. Third, we specified three existing product lines with feature-oriented contracts. Each of these creation strategies is a typical application scenario of employing feature-oriented contracts and may impose different requirements for contract-composition mechanisms.We gained six insights from our work. First, the majority of contracts defined for product lines are not contained in all products (i.e., family-wide specification is not sufficient). Second, product-line specifications can be given by specifying each feature module and usually even without derivative modules (i.e., feature-based specification is not sufficient). Third, most but not all method refinements establish behavioral subtyping, which means that the Liskov principle does not apply to feature specifications. Fourth, we identified that four of our six mechanisms were superior to all other mechanisms for certain contract refinements, and thus we conclude that these four mechanisms should be used in concert. Fifth, fine-granular contract refinements and alternative method introductions often cause specification clones. Finally, most contract refinements only refine the postcondition while the precondition and framing condition remain unchanged. In particular, only eleven out of sixty contract refinements modified the frame.

Cloud management stack (CMS) provides convenience for organizations in managing their cloud platforms. CMS software is complex and bugs in it can cause serious damage to the cloud environment. Therefore, an in-depth understanding of CMS bugs can help developers detect and fix them. In this paper, we conduct a thorough empirical study of several key characteristics of bugs in OpenStack — the most popular open source CMS. Our study computes general statistics for about 50K OpenStack bugs, including the evolution of bugs, the distribution of bugs, and the duration of bugs. We then selected 579 bugs for an in-depth study. In particular, we study the input factors for triggering the bugs, the consequences of the bugs, and how the bugs are fixed. The findings of this study provide a set of lessons learned and guidance to aid practitioners and researchers to better handle bugs in CMS software.

Model-driven software engineering (MDE) techniques are not only useful in forward engineering scenarios, but can also be successfully applied to evolve existing systems. RAD (Rapid Application Development) platforms emerged in the nineties, but the success of modern software technologies motivated that a large number of enterprises tackled the migration of their RAD applications, such as Oracle Forms. Our research group has collaborated with a software company in developing a solution to migrate PL/SQL monolithic code on Forms triggers and program units to Java code separated in several tiers. Our research focused on the model-driven reengineering process applied to develop the migration tool for the conversion of PL/SQL code to Java. Legacy code is represented in form of KDM (Knowledge-Discovery Metamodel) models. In this paper, we propose a software process to implement a model-driven re-engineering. This process integrates a TDD-like approach to incrementally develop model transformations with three kinds of validations for the generated code. The implementation and validation of the re-engineering approach are explained in detail, as well as the evaluation of some issues related with the application of MDE.

ROS, the Robot Operating System, offers a core set of software for operating robots that can be extended by creating or using existing packages, making it possible to write robotic software that can be reused on different hardware platforms. With thousands of packages available per stable distribution, encapsulating algorithms, sensor drivers, etc., it is the de facto middleware for robotics. Like any software ecosystem, ROS must evolve in order to keep meeting the requirements of its users. In practice, packages may end up being abandoned between releases: no one may be available to update a package, or newer packages offer similar functionality. As such, we wanted to identify and understand the evolution challenges faced by the ROS ecosystem. In this article, we report our findings after interviewing 19 ROS developers in depth, followed by a focus group (4 participants) and an online survey of 119 ROS community members. We specifically focused on the issues surrounding package reuse and how to contribute to existing packages. To conclude, we discuss the implications of our findings, and propose five recommendations for overcoming the identified issues, with the goal of improving the health of the ROS ecosystem.

Crosscutting concerns are an intrinsic problem of legacy systems, hindering their maintenance and evolution. A possible solution is to modernize these systems employing aspect-orientation, which provides suitable abstractions for modularizing these kind of concerns. Architecture-Driven Modernization is a more specific kind of software reengineering focused on employing standard metamodels along the whole process, promoting interoperability and reusability across different tools/vendors. Its main metamodel is the Knowledge Discovery Metamodel (KDM), which is able to represent a significant amount of system details. However, up to this moment, there is no extension of this metamodel for aspect-orientation, preventing software engineers from conducting Aspect-Oriented Modernizations. Therefore, in this paper we present our experience on creating a heavyweight and a lightweight extension of KDM for aspect-orientation. We conducted two evaluations. The first one showed all aspect-oriented concepts were represented in both extensions. The second one was a experiment, in which we have analyzed the productivity of software engineers using both extensions. The results showed that the heavyweight extension propitiate a more productive environment in terms of time and number of errors when compared to the lightweight one.

In this paper we present a collection of ontologies specifically designed to model the information exchange needs of combined software and data engineering. Effective, collaborative integration of software and big data engineering for Web-scale systems, is now a crucial technical and economic challenge. This requires new combined data and software engineering processes and tools. Our proposed models have been deployed to enable: tool-chain integration, such as the exchange of data quality reports; cross-domain communication, such as interlinked data and software unit testing; mediation of the system design process through the capture of design intents and as a source of context for model-driven software engineering processes. These ontologies are deployed in web-scale, data-intensive, system development environments in both the commercial and academic domains. We exemplify the usage of the suite on case-studies emerging from two complex collaborative software and data engineering scenarios: one from the legal sector and the other from the Social sciences and Humanities domain.

Business process models are recognized as being important assets for companies, since appropriate management of them provides companies with a competitive advantage. Quality assurance of business process models has become a critical issue, especially when companies carry out reverse engineering techniques to retrieve their business process models. Thus, companies have to deal with several quality faults, such as unmeaningful elements, fine-grained granularity or incompleteness, which seriously affect understandability and modifiability of business process models. The most widely-used method to reduce these faults is refactoring. Although several refactoring operators exist in the literature, there are no refactoring techniques specially developed for business process models obtained by process mining and other reverse engineering techniques. Therefore, this paper presents the use of IBUPROFEN, a business process model refactoring technique for those models obtained by reverse engineering. IBUPROFEN is applied in an in-depth case study with a real-life information system belonging to a European bank company. The goal of this industrial evaluation is to prove that the refactoring operators improve the understandability and modifiability of the business process model after being refactored. In addition, the scalability of the technique is assessed to demonstrate the feasibility of its application.

A fundamental building block of a mobile application is the ability to persist program data between different invocations. Referred to as \emph{persistence}, this functionality is commonly implemented by means of persistence frameworks. Without a clear understanding of the energy consumption, execution time, and programming effort of popular Android persistence frameworks, mobile developers lack guidelines for selecting frameworks for their applications. To bridge this knowledge gap, we report on the results of a systematic study of the performance and programming effort trade-offs of eight Android persistence frameworks, and provide practical recommendations for mobile application developers., Preprint version of Journal of Systems and Software submission

The growth in the number of publicly available services on the Web has encouraged developers to rely more heavily on such services to deliver products in a faster, cheaper and more reliable fashion. Many developers are now using a collection of these services in tandem to build their applications. While there has been much attention to the area of service composition, there are few works that examine the possibility of automatically generating service compositions for variability-intensive application domains. High variability in a domain is often captured through an organized feature space, which has the potential for developing many different application instantiations. The focus of our work is to develop an end-to-end technique that would enable the automatic generation of composite services based on a specific configuration of the feature space that would be directly executable and presented in WS-BPEL format. To this end, we adopt concepts from software product line engineering and AI planning to deliver the automated composition of online services. We will further benefit from such notions as safeness and threat from AI planning to optimize the generated service compositions by introducing parallelism where possible. Furthermore, we show how the specification of the generated service composition can be translated into executable WS-BPEL code. More specifically, the core contributions of our work are: (1) we show how AI planning techniques can be used to generate a workflow based on a feature model configuration; (2) we propose a method for optimizing a workflow generated based on AI planning techniques; and (3) we demonstrate that the optimized workflow can be directly translated into WS-BPEL code. We evaluate our work from two perspectives: (i) we will first formally prove that the methods that we have proposed are sound and complete from a theoretical perspective, and (ii) we will show through experimentation that our proposed work is usable from a practical point of view.

© 2018 Elsevier Inc. Software Defined Networks (SDN) is a popular modern network technology that decouples the control logic from the underlying hardware devices. The control logic has implemented as a software entity that resides in a server called controller. In a Software-Defined Wide Area Network (SDWAN) with n nodes; deploying k number of controllers (k < n) is one of the challenging issue. Due to some internal or external factors, when the primary path between switch to controller fails, it severely interrupt the networks’ availability. In this regard, the proposed approach provides a seamless backup mechanism against single link failure with minimum communication delay based on the survivability model. In order to obtain an efficient solution, we have considered controller placement problem (CPP) as a multi-objective combinatorial optimization problem and solve it using two population-based meta-heuristic techniques such as: Particle Swarm Optimization (PSO) and FireFly Algorithm (FFA). For CPP, three metrics have been considered: (a) controller to switch latency, (b) inter-controller latency and (c) multi-path connectivity between the switch and controller. The performance of the algorithms is evaluated on a set of publicly available network topologies in order to obtain the optimum number of controllers, and controller positions. Then we present Average Delay Rise (ADR) metric to measure the increased delay due to the failure of the primary path. By comparing the performance of our scheme to competing scheme, it was found that our proposed scheme effectively improves the survivability of the control path and the performance of the network as well.

Automated sentiment analysis in software engineering textual artifacts has long been suffering from inaccuracies in those few tools available for the purpose. We conduct an in-depth qualitative study to identify the difficulties responsible for such low accuracy. Majority of the exposed difficulties are then carefully addressed through building a domain dictionary and appropriate heuristics. These domain-specific techniques are then realized in SentiStrength-SE , a tool we have developed for improved sentiment analysis in text especially designed for application in the software engineering domain. Using a benchmark dataset consisting of 5,600 manually annotated JIRA issue comments, we carry out both qualitative and quantitative evaluations of our tool. We also separately evaluate the contributions of individual major components (i.e., domain dictionary and heuristics) of SentiStrength-SE . The empirical evaluations confirm that the domain specificity exploited in our SentiStrength-SE enables it to substantially outperform the existing domain-independent tools/toolkits ( SentiStrength , NLTK , and Stanford NLP ) in detecting sentiments in software engineering text.

Developing state of the art product service systems (PSS) requires the intense collaboration of different engineering domains, such as mechanical, software and service engineering. This can be a challenging task, since each engineering domain uses their own specification artefacts, software tools and data formats. However, to be able to seamlessly integrate the various components that constitute a PSS and also being able to provide comprehensive traceability throughout the entire solution life cycle it is essential to have a common representation of engineering data. To address this issue, we present TRAILS, a novel software tool that joins the heterogeneous artefacts, such as process models, requirements specifications or diagrams of the systems structure. For this purpose, our tool uses a semantic model integration ontology onto which various source formats can be mapped. Overall, our tool provides a wide range of features that supports engineers in ensuring traceability, avoiding system inconsistencies and putting collaborative engineering into practice. Subsequently, we show the practical implementation of our approach using the case study of a bike sharing system and discuss limitations as well as possibilities for future enhancement of TRAILS.

Business processes modeling has proven to be effective and reverse engineering techniques with which to recover business process models when they are missing or outmoded have therefore emerged. Regrettably, these techniques often lead to models with quality flaws and consequently to models with low levels of understandability and modifiability. Refactoring has been widely used to deal with such flaws, altering the internal structure of models while preserving their semantics. There are several studies concerning how understandability and modifiability are affected by refactoring in terms of several artifact-based measures. However, there is little evidence regarding how refactoring affects quality in terms of human-perceived measures. The goals of this paper are, therefore: to collect further empirical evidence about the influence of refactoring on understandability and modifiability of business process models and to investigate the correlation between artifact-based understandability and modifiability and human-perceived ones. The obtained results are not trivial and show that business process obtained by means of reverse engineering has recurrent quality flaws, and the understandability and modifiability of business process models cannot be assessed by using artifact-based measures only. Human-perceived measures need to be taken in to consideration in order to have a more accurate evaluation.

In industry, the benefit of maturity models is uncontested, and models like CMMI are normally taught in at least advanced software engineering courses. However, when not being part of real-world projects, the added values are difficult to be experienced on first hand by our students. In this paper we report on a study and teaching approach where, in three successive semesters and at two different institutions, we started rating the process-maturity of students solving tasks in our software engineering courses and transparently related the maturity levels to the task performances. It turned out that not only the quality of the students’ task preparation plays a crucial role, but that there is also a non-negligible correlation between the individual process maturity and performances. Considering this finding, the approach might yield to students’ process-improvement steps during our courses, help in fostering the understanding of the term process maturity, and finally, also might help in improving the overall students’ performances.

A key challenge in cyber-physical systems (CPS) design is their highly dynamic nature including runtime changes of system goals. Additional safety regulations or changed priorities may apply, e.g. (temporarily) focusing on safety goals after some incident occurred. Goal-aware CPS continuously evaluate goal achievement and autonomously perform adaptations for re-achievement at runtime. For complex system goals capturing dependencies, priorities, and conflicts, efficient goal evaluation techniques are required. To enable a fine-grained balancing of the cost-benefit ratio of autonomous decisions at runtime, a qualitative evaluation of goals is not sufficient. We provide an algorithm that efficiently calculates the quantitative “distance” between a system state and the system goals. We organise various goal types, their parent-children-relationships, context-dependent importances, and dependency relations in a hierarchical goal model. Due to its modular structure, goals can easily be added, removed, and changed at runtime. We illustrate our approach with an exemplary autonomous air drone delivery system and discuss it based on illustrative example scenarios. We argue that our approach enables a) the design of complex context-dependent quantitative goal models for autonomous goal-aware systems, b) the measurement of the impact of autonomous decisions at runtime, and c) the efficient runtime management of changing system goals.

The evolution to next generation embedded systems is shortening the obsolescence period of the underlying hardware. As this happens, software designed for those platforms (a.k.a., legacy code), that might be functionally correct and validated code, may be lost in the architecture and peripheral change unless a retargeting approach is applied. Embedded systems often have real-time computing constraints, therefore, the legacy code retargeting issue directly affects real-time systems. When dealing with real-time legacy code migration, the timing as well as the functional behaviour must be preserved. This article sets the focus on the timing issue, providing a migration path to real-time legacy embedded control applications by integrating a portable timing enforcement mechanism into a machine-adaptable binary translation tool. The proposed timing enforcement solution provides at the same time means for validating the legacy timing behaviour on the new hardware platform using formal timing specifications in the form of contracts.

The worldwide adoption of cloud data centers (CDCs) has given rise to the ubiquitous demand for hosting application services on the cloud. Further, contemporary data-intensive industries have seen a sharp upsurge in the resource requirements of modern applications. This has led to the provisioning of an increased number of cloud servers, giving rise to higher energy consumption and, consequently, sustainability concerns. Traditional heuristics and reinforcement learning based algorithms for energy-efficient cloud resource management address the scalability and adaptability related challenges to a limited extent. Existing work often fails to capture dependencies across thermal characteristics of hosts, resource consumption of tasks and the corresponding scheduling decisions. This leads to poor scalability and an increase in the compute resource requirements, particularly in environments with non-stationary resource demands. To address these limitations, we propose an artificial intelligence (AI) based holistic resource management technique for sustainable cloud computing called HUNTER. The proposed model formulates the goal of optimizing energy efficiency in data centers as a multi-objective scheduling problem, considering three important models: energy, thermal and cooling. HUNTER utilizes a Gated Graph Convolution Network as a surrogate model for approximating the Quality of Service (QoS) for a system state and generating optimal scheduling decisions. Experiments on simulated and physical cloud environments using the CloudSim toolkit and the COSCO framework show that HUNTER outperforms state-of-the-art baselines in terms of energy consumption, SLA violation, scheduling time, cost and temperature by up to 12, 35, 43, 54 and 3 percent respectively., Comment: Accepted in Elsevier Journal of Systems and Software, 2021

Access control (AC) is an important security mechanism used in software systems to restrict access to sensitive resources. Therefore, it is essential to validate the correctness of AC implementations with respect to policy specifications or intended access rights. However, in practice, AC policy specifications are often missing or poorly documented; in some cases, AC policies are hard-coded in business logic implementations. This leads to difficulties in validating the correctness of policy implementations and detecting AC defects. In this paper, we present a semi-automated framework for reverse-engineering of AC policies from Web applications. Our goal is to learn and recover role-based access control (RBAC) policies from implementations, which are then used to validate implemented policies and detect AC issues. Our framework, built on top of a suite of security tools, automatically explores a given Web application, mines domain input specifications from access logs, and systematically generates and executes more access requests using combinatorial test generation. To learn policies, we apply machine learning on the obtained data to characterize relevant attributes that influence AC. Finally, the inferred policies are presented to the security engineer, for validation with respect to intended access rights and for detecting AC issues. Inconsistent and insufficient policies are highlighted as potential AC issues, being either vulnerabilities or implementation errors. We evaluated our approach on four Web applications (three open-source and a proprietary one built by our industry partner) in terms of the correctness of inferred policies. We also evaluated the usefulness of our approach by investigating whether it facilitates the detection of AC issues. The results show that 97.8% of the inferred policies are correct with respect to the actual AC implementation; the analysis of these policies led to the discovery of 64 AC issues that were reported to the developers.

Spreadsheets are widely used in organizations for various purposes such as data aggregation, reporting and decision-making. Since spreadsheets, like other types of software, can contain faulty formulas, it is important to provide developers with appropriate methods to find and fix such faults. Recently, various heuristic and statistics-based fault identification methods were proposed, which point developers to potentially faulty parts of the spreadsheets. Due to their heuristic nature, these methods might, however, miss some faults. As a result, if spreadsheet developers rely too strongly on these methods, they might not pay sufficient attention to problems that are not pinpointed by the methods. In this research, we are the first to study this potential problem of over-reliance in spreadsheet debugging, which may lead to limited debugging effectiveness. We report the outcome of a controlled experiment where 59 participants were tasked to find faulty formulas in a given spreadsheet with and without support of a novel spreadsheet debugging tool. Our results indicate that tool over-reliance can indeed result as a phenomenon of using heuristic debugging techniques. However, the study also provides evidence that making users aware of potential tool limitations within the debugging environment may help to address this problem. Editor’s note: Open Science material was validated by the Journal of Systems and Software Open Science Board.

Assigning developers and allocating issue types are two important tasks in the bug triage process. Existing approaches tackle these two tasks separately, which is time-consuming due to repetition of effort and negating the values of correlated information between tasks. In this paper, a multi-triage model is proposed that resolves both tasks simultaneously via multi-task learning (MTL). First, both tasks can be regarded as a classification problem, based on historical issue reports. Second, performances on both tasks can be improved by jointly interpreting the representations of the issue report information. To do so, a text encoder and abstract syntax tree (AST) encoder are used to extract the feature representation of bug descriptions and code snippets accordingly. Finally, due to the disproportionate ratio of class labels in training datasets, the contextual data augmentation approach is introduced to generate syntactic issue reports to balance the class labels. Experiments were conducted on eleven open-source projects to demonstrate the effectiveness of this model compared with state-of-the-art methods.

Modern automotive software systems consist of hundreds of heterogeneous software applications, belonging to separated function domains and often developed within distributed automotive ecosystems consisting of original equipment manufactures, tier-1 and tier-2 companies. Hence, the development of modern automotive software systems is a formidable challenge. A well-known instrument for coping with the tremendous heterogeneity and complexity of modern automotive software systems is the use of architectural languages as a way of enabling different and specific views over these systems. However, the use of different architectural languages might come with the cost of reduced interoperability and automation as different languages might have weak to no integration. In this article, we tackle the challenge of integrating two architectural languages heavily used in the automotive domain for the design and timing analysis of automotive software systems: AMALTHEA and Rubus Component Model. The main contributions of this paper are (i) a mapping scheme for the translation of an AMALTHEA architecture into a Rubus Component Model architecture where high-precision timing analysis can be run, and the back annotation of the analysis results on the starting AMALTHEA architecture; (ii) the implementation of the proposed scheme, which uses the concept of model transformations for enabling a full-fledged automated integration; (iii) the application of such automation on three industrial automotive systems being the brake-by-wire, the full blown engine management system and the engine management system. We discuss and evaluate the proposed contributions using an online, experts survey and the above-mentioned use cases. Based on the evaluation results, we conclude that the proposed automation mechanism is correct and applicable in industrial contexts. Besides, we observe that the performance of the automation mechanism does not degrade when translating large models with several thousands of elements. Eventually, we conclude that experts in this field find the proposed contribution industrially relevant.

Bad smells in code are indications of low code quality representing potential threats to the maintainability and reusability of software. Code clone is a type of bad smells caused by code fragments that have the same functional semantics with syntactic variations. In the recent years, the research on duplicate code has been dramatically geared up by deep learning techniques powered by advances in computing power. However, there exists little work studying the current state-of-art and future prospects in the area of applying deep learning to code clone detection. In this paper, we present a systematic review of the literature on the application of deep learning on code clone detection. We aim to find and study the most recent work on the subject, discuss their limitations and challenges, and provide insights on the future work.

International audience; The systematic use of models in software engineering represents the foundation of Model Driven Engineering (or MDE). High-level domain-specific models are defined and further exploited for the implementation, testing, integration, and maintenance of software. One of the key ideas in MDE is that transformation of models from a high abstraction level to a lower level can be described and automated by using transformation languages. Source code can be then generated by limiting the amount of hand written code, implying less effort and possibly less errors.Moreover, during its life cycle, existing software needs maintenance, modification and evolution independently of its size and application domain. Most of the times, the related documentation (e.g., concerning its architecture, features, knowledge) quickly becomes obsolete. Hence, most companies are facing the problem of performing reverse engineering tasks to comprehend the software to be changed. In this context, models can play a key role for improving software understanding processes, by providing different views on existing software at a higher abstraction level than source code. Hence, Model Driven Reverse Engineering (or MDRE) approaches start from the source code, at a low abstraction level, and produce different kinds of models of the software at higher abstraction levels. These models represent various perspectives on the same software. Depending on the cases, model discovery from source code and further model transformations can be more or less automated. As a result, the obtained models can be analyzed by domain experts and tools, or used as inputs to model-based processes (e.g., for forward engineering activities).This special issue contains papers reporting on various research efforts, experiences or practices in the area of Model Driven Engineering (MDE) and Model Driven Reverse Engineering (MDRE). These papers are the result of a rigorous peer-reviewing and selection process that started in March 2018 (the submission deadline was actually extended up to April 16, 2018 due to several requests). At this date, we got 13 full paper submissions in total. Among them, and after one-to-three rounds of reviews by at least 2 reviewers for each paper, 6 full papers were finally selected for publication in the present special issue.The papers contained in this volume cover a variety of MDE/MDRE-related topics going from extensions of the Knowledge Discovery Metamodel for aspect-orientation, metamodels for software protection and reverse engineering, structured assurance metamodels to model-driven IT governance process for long term objectives, retrieving behavioral model from black-box system, to approaches for reverse engineering of legacy systems and code migration.

Variability analysis is an essential activity that supports increasing and systemizing reuse across similar software products. Current studies use different types of artifacts for analyzing variability, most notably are architecture or design, requirements, and code. While architecture, design, and code help understand and model the differences in solutions and realizations, requirements enable capturing differences in a higher level of abstraction through the intended use of the software products or their behavior. However, analyzing variability based on requirements may result in inaccurate outcomes, due to the informal and incomplete nature of requirements. To tackle this deficiency, we call for augmenting requirements-based variability analysis with other behavior-related cross-lifecycle artifacts. Particularly, we extend an approach that compares and analyzes software behaviors based on requirements taking into account both ontological and semantic considerations. Using test cases and their relations to requirements, our extension, named SOVA R-TC, extract software behaviors more comprehensively, including their preconditions, post-conditions, and expected results. The outputs of SOVA R-TC are feature diagrams, which group similar behaviors and present variability of software products in a tree structure. Empirically evaluating outcomes of SOVA R-TC, they seem to be perceived as significantly better than outcomes generated based on requirements only.

Software engineering researchers have studied specific types of issues such reopened bugs, performance bugs, dormant bugs, etc. However, one special type of severe bugs is blocking bugs. Blocking bugs are software bugs that prevent other bugs from being fixed. These bugs may increase maintenance costs, reduce overall quality and delay the release of the software systems. In this paper, we study blocking bugs in eight open source projects and propose a model to predict them early on. We extract 14 different factors (from the bug repositories) that are made available within 24 hours after the initial submission of the bug reports. Then, we build decision trees to predict whether a bug will be a blocking bugs or not. Our results show that our prediction models achieve F-measures of 21%–54%, which is a two-fold improvement over the baseline predictors. We also analyze the fixes of these blocking bugs to understand their negative impact. We find that fixing blocking bugs requires more lines of code to be touched compared to non-blocking bugs. In addition, our file-level analysis shows that files affected by blocking bugs are more negatively impacted in terms of cohesion, coupling complexity and size than files affected by non-blocking bugs.

We examine the use of the Java exception types in the Android platform’s Application Programming Interface (API) reference documentation and their impact on the stability of Android applications. We develop a method that automatically assesses an API’s quality regarding the exceptions listed in the API’s documentation. We statically analyze ten versions of the Android platform’s API (14–23) and 3539 Android applications to determine inconsistencies between exceptions that analysis can find in the source code and exceptions that are documented. We cross-check the analysis of the Android platform’s API and applications with crash data from 901,274 application execution failures (crashes). We discover that almost 10% of the undocumented exceptions that static analysis can find in the Android platform’s API source code manifest themselves in crashes. Additionally, we observe that 38% of the undocumented exceptions that developers use in their client applications to handle API methods also manifest themselves in crashes. These findings argue for documenting known might-thrown exceptions that lead to execution failures. However, a randomized controlled trial we run shows that relevant documentation improvements are ineffective and that making such exceptions checked is a more effective way for improving applications’ stability.

Context: Search-Based Software Testing (SBST), and the wider area of Search-Based Software Engineering (SBSE), is the application of optimization algorithms to problems in software testing, and sof ...

In model-driven information systems engineering, model transformations reside at the very core of this paradigm. Indeed, model transformations (in particular, model-to-model, or M2M) are a must-have feature of any modern model-driven approach supported by CASE technology. Model transformations are intended to raise quality of the models under development, and also speed-up the modeling itself by bringing in certain level of automation into the development process. Nevertheless, due to certain objective reasons, the level of such automation is spread unevenly throughout the development process – in this respect, Business Modeling and System Analysis are, arguably, the most underdeveloped phases of the model-driven information systems development life cycle. In this paper, we show how M2M transformation technology was used to extract well-structured business vocabularies and business rules from formal use case models represented through a set of use case diagrams; Object Management Group's (OMG) standards Semantics for Business Vocabulary and Rules (SBVR) and Unified Modeling Language (UML) were used for this purpose. The proposed solution consists of two concurrent approaches, namely, automatic and semi-automatic, which may be used selectively to achieve the best expected result. Basic implementation aspects of the solution integrating both approaches are also briefly presented in the paper. While UML use case models is the main subject in this research, the proposed solution may be adopted for other UML and MOF-based models as well.

© 2017 Elsevier Inc. Moving existing legacy systems to cloud platforms is an ever popular option. But, such endeavour may not be hazard-free and demands a proper understanding of requirements and risks involved prior to taking any action. The time is indeed ripe to undertake a realistic view of what migrating legacy systems to cloud may offer, an understanding of exceptional situations causing system quality goal failure in such a transition, and insights on countermeasures. The cloud migration body of knowledge, although is useful, is dispersed over the current literature. It is hard for busy practitioners to digest, synthesize, and harness this body of knowledge into practice when integrating legacy systems with cloud services. We address this issue by creating an innovative synergy between the approaches evidence-based software engineering and goal-oriented modelling. We develop an evidential repository of commonly occurred obstacles and platform agnostic resolution tactics related to cloud enablement of legacy systems. The repository is further utilized during systematic goal-obstacle elaboration of given cloud migration scenarios. The applicability of our proposed framework is also demonstrated.

Background In Software Engineering (SE), conference publications have high importance both in effective communication and in academic careers. Researchers actively discuss how a paper should be organized to be accepted in mainstream conferences. Aiming This work tackles the problem of generalizing and characterizing the type of papers accepted at SE conferences. Method The paper offers a new perspective in the analysis of SE literature: a categorization scheme for SE papers is obtained by merging, extending and revising related proposals from a few existing studies. The categorization scheme is used to classify the papers accepted at three top-tier SE conferences during five years (2012–2016). Results While a broader experience is certainly needed for validation and fine-tuning, preliminary outcomes can be observed relative to what problems and topics are addressed, what types of contributions are presented and how they are validated. Conclusions The results provide insights to paper writers, paper reviewers and conference organizers in focusing their future efforts, without any intent to provide judgments or authoritative guidelines.

Android provides a framework for the development of collaborative applications, which is considered as one of the reasons behind its success. Collaborative model provides flexibility to an application in utilizing services offered by other applications. This approach offers several advantages to developers, such as allowing them to dedicate all of their resources in developing only core functionalities of an application while leveraging services offered by other applications for its auxiliary functionalities. However, the collaborative model also has some disadvantages, such as opening of attack surfaces in an application during exposure of some of its components as it offers its services. Malicious actions can be performed through the exposed components of the application. Android provides permission-based security to protect the exposed components. However, developers must implement the security correctly. In this paper, we empirically evaluate the scale of the collaborative model adopted by Android applications. We also investigate various methods to achieve collaboration among applications. Furthermore, we evaluate the scale of security risk instigated by the collaborative model and perform several other empirical studies on 13,944 Android applications.

Software Testing (ST) is an indispensable part of software development. Proper testing education is thus of paramount importance. Indeed, the mere exposition to ST knowledge might have an impact on programming skills. In particular, it can encourage the production of more correct - and thus reliable - code. Although this is intuitive, to the best of our knowledge, there are no studies about such effects. Concerned with this, we have conducted two investigations related to ST education: (1) a large experiment with students to evaluate the possible impact of ST knowledge on the production of reliable code; and (2) a survey with professors that teach introductory programming courses to evaluate their level of ST knowledge. Our study involved 60 senior-level computer science students, 8 auxiliary functions with 92 test cases, a total of 248 implementations, and 53 professors of diverse subfields that completed our survey. The investigation with students shows that ST knowledge can improve code reliability in terms of correctness in as much as 20%, on average. On the other hand, the survey with professors reveals that, in general, university instructors tend to lack the same knowledge that would help students increase their programming skills toward more reliable code.

iStar is a general-purpose goal-based modelling language used to model requirements at early and late phases of software development. It has been used in industrial and academic projects. Often the language is extended to incorporate new constructs related to an application area. The language is currently undergoing standardisation, so several studies have focused on the analysis of iStar variations to identify the similarities and defining a core iStar. However, we believe it will continue to be extended and it is important to understand how iStar is extended. This paper contributes to this purpose through the identification and analysis of the existing extensions and its constructs. A Systematic Literature Review was conducted to guide identification and analysis. The results point to 96 papers and 307 constructs proposed. The extensions and constructs were analysed according to well-defined questions in three dimensions: a general analysis; model-based analysis (to characterise the extensions from semantic and syntactic definitions); and a third dimension related to semiotic clarity. The application area targeted by the iStar extensions and their evolutions are presented as results of our analysis. The results point to the need for more complete, consistent and careful development of iStar extensions. The paper concludes with some discussions and future directions for this research field.

Following a well-established track record of success in other domains such as manufacturing, Kanban is increasingly used to achieve continuous development and delivery of value in the software industry. However, while research on Kanban in software is growing, these articles are largely descriptive, and there is limited rigorous research on its application and with little cohesive building of cumulative knowledge. As a result, it is extremely difficult to determine the true value of Kanban in software engineering. This study investigates the scientific evidence to date regarding Kanban by conducting a systematic mapping of Kanban literature in software engineering between 2006 and 2016. The search strategy resulted in 382 studies, of which 23 were identified as primary papers relevant to this research. This study is unique as it compares the findings of these primary papers with insights from a review of 23 Kanban experience reports during the same period. This study makes four important contributions, (i) a state-of-the-art of Kanban research is provided, (ii) the reported benefits and challenges are identified in both the primary papers and experience reports, (iii) recommended practices from both the primary papers and experience reports are listed and (iv) opportunities for future Kanban research are identified.

In educational projects, having students encounter problems is desirable, if it increases learning. However, in capstone projects with industrial customers, negative effects problems can have on customer satisfaction must be considered. We conducted a survey in a capstone project course in order to study problems, learning and customer satisfaction related to eleven software engineering topics. On the average, students working in the managerial roles learned quite a lot about each topic, and the developers learned moderately, but the degree of learning varied a lot among the teams, and among the team members. The most extensively encountered problems were related to testing, task management, effort estimation and technology skills. The developers contributed quite a lot to solving problems with technology skills, but only moderately or less with other topics, whereas the managers contributed quite a lot with most of the topics. Contributing to solving problems increased learning moderately for most of the topics. The increases were highest with maintaining motivation and technology skills. Encountering problems with task management, customer expectations and customer communication affected customer satisfaction very negatively. When considering both learning and customer satisfaction, the best topics to encounter problems in were effort estimation, testing, and technology skills.

Dynamic Software Product Line (DSPL) engineering is a paradigm aimed at handling adaptations at runtime. An inherent challenge in DSPL engineering is to reduce the design complexity of adaptable software, particularly in terms of evolution. Existing research only recently started to investigate evolution in this field, but does not assess the impact of different implementations under software quality in evolutionary scenarios. This work presents a characterization of thirteen dynamic variability mechanisms. Based on such characterization, we implemented a DSPL using Object-oriented Programming (OOP) mechanisms. From this implementation, we evidenced that DSPL requires changes and extensions to design, in terms of functionality and adaptation capabilities. Since Aspect-oriented Programming (AOP) was well ranked according to characterization and some studies have demonstrated the likely synergies between AOP and DSPL, we decided to compare it with OOP. We empirically evaluated how OOP and AOP could affect source code quality from the viewpoint of an evolving DSPL. As a result, AOP yields better results in terms of size, SoC, cohesion, and coupling measures. Conversely, AOP provides lower change propagation impact. Although the packages in AOP were more susceptible to changes than in OOP, we could indicate that AOP may be a feasible strategy for DSPL implementation.

Background: Handling large-sized classes is one of the major challenges in Personal Software Process (PSP) education in a tertiary education environment. We applied a pairing approach in PSP education and managed to mitigate the size challenge without sacrificing education effectiveness, which has been verified in an experiment in 2010 ( PSP2010 ). However, there are several issues (e.g., mutual interference among student pairs, confusing evaluation comments, untraceable corrections, etc.) existing in this experiment, which may create mist towards proper understanding of the education approach. Objective: In order to address the identified issues and better understand both pros and cons of the pairing approach, we replicated the experiment in 2014. Method: With new lab arrangement and evaluation mechanism devised, the replication ( PSP2014 ) involved 120 students after their first academic year, who were separated into two groups with 40 pairs of students in one group and 40 solo students in the other. Results: Results of the replication include: 1) paired students conformed process discipline no worse (sometime better) than solo students; 2) paired students performed better than solo students in the final exam; 3) both groups spent comparable amount of time in preparing submissions; 4) both groups performed similar in size estimation and time estimation of the course assignments; 5) the quality of the programs developed by paired students is no less (sometime better) than solo students. Conclusion: The replication together with the original study confirms that, as an education approach, the pairing practice could reduce the amount of submissions required in a PSP training without sacrificing (sometime improving) the education effectiveness.

All the mainstream programming languages in widespread use for mobile app development provide error handling mechanisms to support the implementation of robust apps. Android apps, in particular, are usually written in the Java programming language. Java includes an exception handling mechanism that allows programs to signal the occurrence of errors by throwing exceptions and to handle these exceptions by catching them. All the Android-specific abstractions, such as activities and asynctasks, can throw exceptions when errors occur. When an app catches the exceptions that it or the libraries upon which it depends throw, it can resume its activity or, at least, fail in a graceful way. On the other hand, uncaught exceptions can lead an app to crash, particularly if they occur within the main thread. Previous work has shown that, in real Android apps available at the Play Store, uncaught exceptions thrown by Android-specific abstractions often cause these apps to fail. This paper presents an empirical study on the relationship between the usage of Android abstractions and uncaught exceptions. Our approach is quantitative and maintenance-centric. We analyzed changes to both normal and exception handling code in 112 versions extracted from 16 software projects covering a number of domains, amounting to more than 3 million LOC. Change impact analysis and exception flow analysis were performed on those versions of the projects. The main finding of this study is that, during the evolution of the analyzed apps, an increase in the use of Android abstractions exhibits a positive and statistically significant correlation with the number of uncaught exception flows. Since uncaught exceptions cause apps to crash, this result suggests that these apps are becoming potentially less robust as a consequence of exception handling misuse. Analysis of multiple versions of these apps revealed that Android developers usually employ abstractions that may throw exceptions without adding the appropriate handlers for these exceptions. This study highlights the need for better testing and verification tools with a focus on exception handling code and for a change of culture in Android development or, at least, in the design of its APIs.

Selecting sourcing options for software assets and components is an important process that helps companies to gain and keep their competitive advantage. The sourcing options include: in-house, COTS, open source and outsourcing. The objective of this paper is to further refine, extend and validate a solution presented in our previous work. The refinement includes a set of decision-making activities, which are described in the form of a process-line that can be used by decision-makers to build their specific decision-making process. We conducted five case studies in three companies to validate the coverage of the set of decision-making activities. The solution in our previous work was validated in two cases in the first two companies. In the validation, it was observed that no activity in the proposed set was perceived to be missing, although not all activities were conducted and the activities that were conducted were not executed in a specific order. Therefore, the refinement of the solution into a process-line approach increases the flexibility and hence it is better in capturing the differences in the decision-making processes observed in the case studies. The applicability of the process-line was then validated in three case studies in a third company. © 2017 Elsevier Inc.