Software systems that process structured inputs often lack complete and up-to-date specifications, which specify the input syntax and the semantics of input processing. While grammar mining techniques have focused on recovering syntactic structures, the semantics of input processing remains largely unexplored. In this work, we introduce a novel approach for inferring attributed grammars from parser implementations. Given an input grammar, our technique dynamically analyzes the implementation of recursive descent parsers to reconstruct the semantic aspects of input handling, resulting in specifications in the form of attributed grammars. By observing program executions and mapping the program's runtime behavior to the grammar, we systematically extract and embed semantic actions into the grammar rules. This enables comprehensive specification recovery. We demonstrate the feasibility of our approach using an initial set of programs, showing that it can accurately reproduce program behavior through the generated attributed grammars.

Equivalence checking is used to verify whether two programs produce equivalent outputs when given equivalent inputs. Research in this field mainly focused on improving equivalence checking accuracy and runtime performance. However, for program pairs that cannot be proven to be either equivalent or non-equivalent, existing approaches only report a classification result of unknown, which provides no information regarding the programs’ non-/equivalence. In this paper, we introduce PASDA, our partition-based semantic differencing approach with best effort classification of undecided cases. While PASDA aims to formally prove non-/equivalence of analyzed program pairs using a variant of differential symbolic execution, its main novelty lies in its handling of cases for which no formal non-/equivalence proof can be found. For such cases, PASDA provides a best effort equivalence classification based on a set of classification heuristics. We evaluated PASDA with an existing benchmark consisting of 141 non-/equivalent program pairs. PASDA correctly classified 61%–74% of these cases at timeouts from 10 s to 3600 s. Thus, PASDA achieved equivalence checking accuracies that are 3%–7% higher than the best results achieved by three existing tools. Furthermore, PASDA’s best effort classifications were correct for 70%–75% of equivalent and 55%–85% of non-equivalent cases across the different timeouts.

A Low-Code Development Platform (LCDP) enables people with little or no software development training to create software applications. Unlike traditional textual programming environments, it provides tools that are more natural to the users, such as visual programming. By raising the level of abstraction beyond code, an LCDP empowers those who need software to develop it, bridging the gap between the growing demand for industrial software and the ability to deliver it. In this paper, we present an iterative, user-centered approach for developing an LCDP for welding robot control that replaces a system based on the C programming language. Findings indicate that an iterative approach, active user participation, usability evaluations, and paper prototyping all favor the successful development of an industrial LCDP.

The specification of program inputs is a requirement for many software engineering tasks, but often does not exist or is out of date. To tackle this problem, software engineers may apply program analysis techniques to extract parts of a specification from the source code that processes the program input. Today there are analysis techniques for the extraction of constraints (mathematical formulas) for individual program inputs (e.g. function parameters) as well as emerging techniques for inferring context-free grammars that specify the syntax of program input strings. However, such techniques focus on a single aspect (e.g., constraints or grammars) of the specification only and neglect the other one. We propose to integrate such analysis techniques by extending existing approaches for mining input grammars with the extraction of constraints. Constraints are integrated with a grammar in the form of attributes and context constraints on grammar symbols, resulting in an attribute grammar as specification format. To achieve this goal, we choose the analysis method dynamic symbolic execution (DSE), which is already an established technique for the extraction of constraints and beneficial for grammar mining (e.g., through automatic input generation) as well. Thus, DSE not only covers both aspects but also—as a single analysis method—should facilitate the integration of these two aspects. In this paper, we describe the basic idea of the proposed integration and report the first results on DSE-based grammar extraction.

Software documentation is an asset for many activities in maintenance and evolution of software. To alleviate the problem of outdated or lost documentation and to improve program understanding, reverse engineering tools and documentation generators have been developed and used during development, maintenance, and evolution of software systems. In this paper, we report on the development of six tools that address different programming languages (e.g. COBOL, Java, and C), problem domains (e.g. banking, insurance, and engineering), and SE activities (e.g. maintenance and migration). While the development of these tools was driven by domain-specific requirements, an architecture that supports reuse of components for the analysis and visualization of software from different programming languages was pursued from the beginning. This resulted in a polyglot software platform for building reverse engineering tools and documentation generators. The software platform provides a modular set of programming language frontends, static program analysis components and document/diagram generators. To evaluate effectiveness of the platform for tool creation, we conducted an industrial case study and discuss results on reuse potential, adoption of new languages and usage of a generic intermediate representation.

Abstract Source code comments contain key information about the underlying software system. Many redocumentation approaches, however, cannot exploit this valuable source of information. This is mainly due to the fact that not all comments have the same goals and target audience and can therefore only be used selectively for redocumentation. Performing a required classification manually, for example, in the form of heuristics, is usually time‐consuming and error‐prone and strongly dependent on programming languages and guidelines of concrete software systems. By leveraging machine learning (ML), it should be possible to classify comments and thus transfer valuable information from the source code into documentation with less effort but the same quality. We applied classical ML techniques but also deep learning (DL) approaches to legacy systems by transferring source code comments into meaningful representations using, for example, word embeddings but also novel approaches using quick response codes or a special character‐to‐image encoding. The results were compared with industry‐strength heuristic classification. As a result, we found that ML outperforms the heuristics in number of errors and less effort, that is, we finally achieve an accuracy of more than 95% for an image‐based DL network and even over 96% for a traditional approach using a random forest classifier.

Source code comments contain key information about the underlying software system. Many redocumentation approaches, however, cannot exploit this valuable source of information. This is mainly due to the fact that not all comments have the same goals and target audience and can therefore only be used selectively for redocumentation. Performing a required classification manually, e.g. in the form of heuristic rules, is usually time-consuming and error-prone and strongly dependent on programming languages and guidelines of concrete software systems. By leveraging machine learning, it should be possible to classify comments and thus transfer valuable information from the source code into documentation with less effort but the same quality. We applied different machine learning techniques to a COBOL legacy system and compared the results with industry-strength heuristic classification. As a result, we found that machine learning outperforms the heuristics in number of errors and less effort.

Screencasts and videos with screen recordings are becoming an increasingly popular source of information for users to understand and learn about software applications. However, searching for answers to specific questions in screen videos is notoriously difficult due to the effort for locating specific events of interest and reproducing the application's state up to this event. To increase the efficiency when working with screen videos, we propose a solution for replaying recorded sequences shown in videos directly on live applications. In this paper, we describe the analysis of screen videos to automatically identify and extract user interactions and the construction of visual scripts, which are used to run the application in sync with replaying the video. Currently, a first prototype has been developed to demonstrate the technical feasibility of the approach. The paper provides an overview of the implemented solution concept and discusses technical challenges, open issues, as well as future application scenarios.

Model-driven software development comes in different styles. While standard-based approaches leverage existing language standards (e.g. UML), tooling, and even development processes, DSM requires domain-specific languages and tool support to be created prior the actual software development. The design, implementation, and test of languages and tool support require a wide spectrum of methods and techniques where each of it brings also additional complexity and challenges. To tackle these DSM-specific challenges, best practices have been collected from various application domains and published in literature to guide the development and application of DSM solutions. This work explores existing best practices by conducting a systematic mapping study. We identify and classify studies reporting practical guidance on domain-specific modeling and present best practices from literature. Moreover, we discuss how best practices overlap, complement, or contradict each other. From a total of 309 best practices in 19 papers, we compiled 191 unique best practices. The systematic and comprehensive compilation of best practices is intended to facilitate industrial adoption of DSM in various domains.

This paper presents an approach for deriving a state transition model which represents the behavior of a control component using symbolic execution. Symbolic execution is a technique for executing a program using symbolic values for unknowns. It explores execution paths in a program and then uses a SAT/SMT solver to prove that paths are feasible. Further, the approach allows using constraints on the environment and simplifications with a widening operator similar to abstract interpretation.We present the formal foundation of the approach, depict the the tool implementation, present results from a preliminary evaluation, and discuss various application scenarios.

Complex engineering problems are typically solved by running a batch of software programs. Data exchange between these software programs is frequently based on semi-structured text files. These files are edited by text editors providing basic input support, however without proper input validation prior program execution. Consequently, even minor lexical or syntactic errors cause software programs to stop without delivering a result. To tackle these problems a more specific editor support, which is aware of language concepts of data exchange files, needs to be provided. In this paper, we investigate if and in what quality a language grammar can be inferred from a set of existing text files, in order to provide a basis for the desired editing support. For this experiment, we chose a Minimal Adequate Teacher (MAT) method together with specific preprocessing of the existing text files. Thereby, we were able to construct complete grammar rules for most of the language constructs found in a corpus of semi-structured text files. The inferred grammar, however, requires refactoring towards a suitable and maintainable basis for the desired editor support.

The reuse of code fragments by copying and pasting is widely practiced in software development and results in code clones. Cloning is considered an anti-pattern as it negatively affects program correctness and increases maintenance efforts. Programmable Logic Controller (PLC) software is no exception in the code clone discussion as reuse in development and maintenance is frequently achieved through copy, paste, and modification. Even though the presence of code clones may not necessary be a problem per se, it is important to detect, track and manage clones as the software system evolves. Unfortunately, tool support for clone detection and management is not commonly available for PLC software systems or limited to generic tools with a reduced set of features. In this paper, we investigate code clones in a real-world PLC software system based on IEC 61131-3 Structured Text and C/C++. We extended a widely used tool for clone detection with normalization support. Furthermore, we evaluated the different types and natures of code clones in the studied system and their relevance for refactoring. Results shed light on the applicability and usefulness of clone detection in the context of industrial automation systems and it demonstrates the benefit of adapting detection and management tools for IEC 611313-3 languages.

Software migration projects need precise and up-to-date documentation of the software system to be migrated. Missing or outdated documentation hampers the migration process and compromises the overall quality of the resulting new software system. Moreover, if documentation is missing in the first place and no additional effort is undertaken to document the new software system, future maintenance and evolution tasks are burdened right from the beginning. Therefore, we apply an automatic re-documentation approach that uses a single tool chain to generate documentation for the software to be migrated and the transformed software system. By this, we not only support an ongoing COBOL to Java migration project at one of our industry partners but as well create the foundations to continuously generate up-to-date documentation for the new software system.

We describe the motivation, approach and first experience from reverse engineering Common Intermediate Language (CIL) for the purpose of documentation generation. Instead of parsing source code implemented in different programming languages, we reverse engineer CIL code and thereby enable documentation generation for all programming languages that can be compiled into CIL code. Initial results show that we are able to generate documents in the same quality as compared to directly analyzing source code. To overcome initial shortcomings we introduce additional preprocessing in form of AST refactoring which is not required when analyzing source code.

In software development we are faced with the problem to comprehend and take over source code from other developers. The key challenge is to understand the underlying specification implemented by the software system. Regaining this understanding is more difficult when the source code is the only reliable source of information, documentation is outdated or only present in fragments, and original developers are not available anymore. Unfortunately, we encounter such situations frequently for scientific and engineering software systems, developed in industry. For instance, process models in the steelmaking domain are developed and maintained over decades by single engineers. If such an engineer leaves the company, he/she literally leaves behind a legacy system for another person (or team). We propose tool support combining static and dynamic program analysis to tackle this challenge. Using static program analysis we extract the input/output behavior from program source code and present the extracted information besides the analyzed source code, providing seamless navigation between both views. Dynamic program analysis allows developers to examine input/output behavior for single program executions and thereby gain insight into standard behavior and exceptional cases. In this paper we present requirements on tool support integrating static and dynamic code analysis, briefly describe the implementation of the tool and report on its application to a C++ program source in the industry. Furthermore, we discuss challenges in the present implementation as well as the potential and limitations of using the tool in general.

Reverse engineering tools are utilized for development, maintenance, and modernization of software systems. The reverse engineering community has developed a large number of reverse engineering tools for different programming languages that support a variety of software engineering activities. Although tools address different reverse engineering problems and different programming languages, several issues with respect to parsing, intermediate representations, code query, program analysis, etc. are similar. However, reuse between tools takes place only on a moderate scale. To facilitate reuse in building reverse engineering tools, we have used the OMG standard ASTM as intermediate representation of source code together with black box reuse of existing (free) language parsers. In this paper we report on challenges, experiences, and solutions from several industrial research projects, in which ASTM based reverse engineering tools have been developed and used for re-documentation, re-engineering, and modernization of software systems.

Graphical User Interfaces (GUI) play an essential role in operating industrial facilities and machines. Depending on the range and variability of a manufacturer's product portfolio a huge library of GUI software may exist. This poses quite a challenge when it comes to testing or re-engineering. Static analysis helps to unveil valuable, inherent knowledge and prepare it for further analysis and processing. In our case at ENGEL Austria GmbH, we extract the internal structure of the GUI screens, their variants and the control system context they are used in, i.e. which PLC variables they access. In another step, we analyze the usage pattern of method calls to certain UI widgets. In this paper we show our approach to gain these information based on static analysis of existing GUI source code for injection molding machines.

This paper demonstrates RbG, a new tool intended for the generation of high-quality documentation from source code of scientific and engineering applications. RbG extracts mathematical formulae and decision tables from program statements by means of static code analysis and generates corresponding documentation in the Open Document Format or LaTeX. Annotations in source code comments are used to define the structure of the generated documents, include additional textual and graphical descriptions, and control extraction of formulae on a fine-grained level. Furthermore, RbG provides an interpreter to generate function plots for extracted formulae. In this tool demonstration we briefly introduce the tool and show its usage for different scenarios such as reverse engineering and re-documentation of legacy code and documentation generation during development and maintenance of software.

Implementation, fault analysis, and maintenance of robot welding automation solutions are traditionally restricted to professional software developers only. Program code is written in a general purpose programming language and, hence, unmanageable by other stakeholders with limited or no programming skills. To tackle this problem we have implemented a domain-specific language (DSL) specifically designed to the domain of robot welding automation and to be intuitively manageable by all stakeholders. The created DSL supports a textual and visual notation and is embedded within a full featured tool chain which let our customer fully replace the creation and maintenance of welding automation solutions by our DSL-based development approach.

The reengineering of legacy code is a tedious endeavor. Automatic transformation of legacy code from an old technology to a new one preserves potential problems in legacy code with respect to obsolete, changed, and new business cases. On the other hand, manual analysis of legacy code without assistance of original developers is time consuming and error-prone. For the purpose of reengineering PL/SQL legacy code in the steel making domain, we developed tool support for the reverse engineering of PL/SQL code into a more abstract and comprehensive representation. This representation then serves as input for stakeholders to manually analyze legacy code, to identify obsolete and missing business cases, and, finally, to support the re-implementation of a new system. In this paper we briefly introduce the tool and present results of reverse engineering PL/SQL legacy code in the steel making domain. We show how stakeholders are supported in analyzing legacy code by means of general-purpose analysis techniques combined with domain-specific representations and conclude with some of the lessons learned.

In this paper we present an approach and a software prototype that enables domain experts to program control software in the automation domain. The approach follows the principles of domain-specific modeling providing a graphical domain-specific language to model the control cycle of an injection molding machine, a user interface to manipulate and monitor the control cycle as well as code generators to generate control code that can be executed by the machine. As result, domain experts like machine operators can manipulate and monitor the control cycle directly on the touch-screen of a machine without detailed software development expertise.

Software testing is essential and takes a large part of resources during software development. This motivates automating software testing as far as possible. Frameworks for automating unit testing are approved and applied for a plethora of programming languages to write tests for small units in the same programming language. Both constraints, unit size and programming language, inhibit automation of software testing in domain of mobile software frameworks. This circumstance has motivated the development of a new testbed for a framework in the domain of mobile systems. In this paper, we describe requirements and challenges in testing mobile software frameworks in general and present a novel testbed for the APOXI framework that addresses these requirements. The main ideas behind this testbed are the usage of a scripting language to specify test cases and to incorporate domain-specific aspects on the language level. The testbed facilitates component and system testing but can be used for unit testing as well.

In this paper we describe our experience from developing and testing a visual graphical user interface (GUI) editor for mobile and multimedia devices. Testing of the editor's highly interactive user interface is critical for its success, yet remains a challenge due to the specification of often intangible quality characteristics of the GUI and its proneness to change. The approach we provide is supporting exploratory testing of the GUI with tools integrated with the tested object. Thus a step-by-step guide for manual exploratory testing can be enhanced with automated elements that directly manipulate the status of the editor, access internal properties of the GUI, and record interactions for bug reporting.