Validating Cyber-Physical Systems requires co-simulation of continuous physical dynamics alongside discrete control logic. However, standard fixed-step coupling often limits accuracy at the interface. Discretization errors distort signal behaviour between updates, and asynchronous events, such as safety threshold violations, are frequently detected with critical delays. In this paper we address these limitations by extending the FERAL simulation framework with a derivative-aware communication interface and an adaptive rollback mechanism. Our approach enables subsystems to extrapolate inputs continuously using First-Order Hold and allows the simulator to retroactively correct timing errors by re-simulating critical windows with high precision. We validated this methodology using an Adaptive Emergency Brake case study. Although the standard baseline simulation failed to prevent a collision due to an 891 ms detection delay, our proposed method achieved a safe stop with a response latency of < 1 ms, effectively eliminating the synchronization error. Performance analysis confirms that this 99.8\% accuracy improvement is achieved with only a marginal computational overhead, utilizing the hierarchical architecture of the framework to execute targeted rollbacks of only the affected components to the exact time of the event.

Validating Advanced Driver Assistance Systems (ADAS) requires executing millions of simulation scenarios, which necessitates efficient coupled simulations that integrate heterogeneous models. However, these simulations contain events that are discontinuities or sudden state changes and pose significant challenges. If not detected properly, such events can cause numerical instabilities, erroneous results, and costly rollbacks. This paper presents a component-based event detection framework for hybrid simulations that captures, classifies, and analyzes events during execution. Our approach decomposes simulation scenarios into reusable components, maps raw component outputs to semantic event categories, distinguishes new discontinuities from state continuations, and builds correlation models revealing temporal relationships between event types. Evaluation in an urban traffic scenario involving lane merging, traffic signal coordination, and pedestrian crossing demonstrates that our framework successfully identifies distinct behavioral signatures across components with only ~3% overhead. Analysis reveals that 96% of reported events represent stable behavior suitable for coarser temporal resolution, suggesting 24.5% potential computational savings through adaptive time step scheduling. Our contribution is a systematic event detection infrastructure that enables informed optimization decisions for simulations in CI/CD (Continuous Integration/Continuous Delivery) pipelines, providing a foundation for efficient ADAS validation through virtual testing.

Building Information Modeling (BIM) has advanced the construction industry from simple 2D/3D CAD to semantically rich, object-oriented, and visually intuitive modeling. However, unlike, e.g., the UML or SysML, BIM's modeling formalisms lack universal applicability and full life cycle coverage, confining its use largely to architectural design. Key trades like building control remain insufficiently integrated, leading to inefficiencies and misaligned design and operational requirements. This paper presents an ecosystem of domain-specific modeling languages (DSML) integrated with BIM, to expand its capabilities to additional trades such as building control. By embedding operational requirements (cf. the building control system installation) during the design phase by integrating them into the BIM model, the subsequent application of model-driven deployment ensures alignment with operational objectives. Validation in a Living Lab at the University of Innsbruck highlights the approach's benefits, including faster commissioning and improved energy efficiency, representing a step toward comprehensive, BIM-based building design and operation.

Failures in safety-critical Cyber-Physical Systems (CPS), both software and hardware-related, can lead to severe incidents impacting physical infrastructure or even harming humans. As a result, extensive simulations and field tests need to be conducted, as part of the verification and validation of system requirements, to ensure system safety. However, current simulation and field testing practices, particularly in the domain of small Unmanned Aerial Systems (sUAS), are ad-hoc and lack a thorough, structured testing process. Furthermore, there is a dearth of standard processes and methodologies to inform the design of comprehensive simulation and field tests. This gap in the testing process leads to the deployment of sUAS applications that are: (a) tested in simulation environments which do not adequately capture the real-world complexity, such as environmental factors, due to a lack of tool support; (b) not subjected to a comprehensive range of scenarios during simulation testing to validate the system requirements, due to the absence of a process defining the relationship between requirements and simulation tests; and (c) not analyzed through standard safety analysis processes, because of missing traceability between simulation testing artifacts and safety analysis artifacts. To address these issues, we have developed an initial framework for validating CPS, specifically focusing on sUAS and robotic applications. We demonstrate the suitability of our framework by applying it to an example from the sUAS domain. Our preliminary results confirm the applicability of our framework. We conclude with a research roadmap to outline our next research goals along with our current proposal.

The assessment of source code in university education is a central and important task for lecturers of programming courses. In doing so, educators are confronted with growing numbers of students having increasingly diverse prerequisites, a shortage of tutors, and highly dynamic learning objectives. To support lecturers in meeting these challenges, the use of automated programming assessment systems (APASs), facilitating formative assessments by providing timely, objective feedback, is a promising solution. Measuring the effectiveness and success of these platforms is crucial to understanding how such platforms should be designed, implemented, and used. However, research and practice lack a common understanding of aspects influencing the success of APASs. To address these issues, we have devised a success model for APASs based on established models from information systems as well as blended learning research and conducted an online survey with 414 students using the same APAS. In addition, we examined the role of mediators intervening between technology-, system- or self-related factors, respectively, and the users' satisfaction with APASs. Ultimately, our research has yielded a model of success comprising seven constructs influencing user satisfaction with an APAS.

This article introduces a new method for knowledge-based security testing by logic programming and the related tool implementation for model-based non-functional security testing of web applications. Our method helps to overcome the current prevalent focus on functional instead of non-functional (or negative) requirements as well as the required high level of security knowledge when performing non-functional security testing. It addresses issues like considering non-functional requirements for testing, managing the virtually infinite amount of negative security test cases, advancing non-functional security testing away from its prevalent penetration testing-like style, and making non-functional security testing feasible for testers that are not experts in security via a security knowledge base. The method and its model-based tool implementation are evaluated in two studies, which show the method’s effectiveness in detecting vulnerabilities in web applications and thus, also its value in making software system more secure.

Model-based security testing relies on models to test whether a software system meets its security requirements. It is an active research field of high relevance for industrial applications, with many approaches and notable results published in recent years. This article provides a taxonomy for model-based security testing approaches. It comprises filter criteria (i.e. model of system security, security model of the environment and explicit test selection criteria) as well as evidence criteria (i.e. maturity of evaluated system, evidence measures and evidence level). The taxonomy is based on a comprehensive analysis of existing classification schemes for model-based testing and security testing. To demonstrate its adequacy, 119 publications on model-based security testing are systematically extracted from the five most relevant digital libraries by three researchers and classified according to the defined filter and evidence criteria. On the basis of the classified publications, the article provides an overview of the state of the art in model-based security testing and discusses promising research directions with regard to security properties, coverage criteria and the feasibility and return on investment of model-based security testing. Copyright © 2015 John Wiley & Sons, Ltd.

Assuring the security of a software system in terms of testing nowadays still is a quite tricky task to conduct. Security requirements are taken as a foundation to derive tests to be executed against a system under test. Yet, these positive requirements by far do not cover all the relevant security aspects to be considered. Hence, especially in the event of security testing, negative requirements, derived from risk analysis, are vital to be incorporated. If considering today's emerging trend in the adoption of cloud computing, security testing even has a more important significance. Due to a cloud's openness, in theory there exists an infinite number of tests. Hence, a concise technique to incorporate the results of risk analysis in security testing is inevitable. We therefore propose a new model-driven methodology for the security testing of cloud environments, ingesting misuse cases, defined by negative requirements derived from risk analysis.