ABSTRACT To assess test quality, mutation testing (MT) creates mutants by injecting artificial faults into the system and evaluates the ability of tests to distinguish these mutants. Tests distinguishing more mutants have also been proven empirically to detect more real faults. MT has been applied to many domains. We focus on MT for timed safety‐critical systems modelled as Timed Automata (TA). While powerful, MT usually yields equivalent and duplicate mutants, the former having the same behaviour as the original system and the latter other mutants. Such useless mutants bring no value, waste execution time and can be difficult to detect. We integrate useless mutant detection and removal strategies in our mutation framework MUPPAAL. MUPPAAL leverages existing equivalence‐avoiding mutation operators and focuses on detecting mutant duplicates using a scalable bisimulation algorithm and a fast approximate one based on biased simulation. We also demonstrate how to design an operator that reduces the occurrence of mutant duplicates. We evaluate MUPPAAL on six systems, demonstrating that (1) mutant duplicates account for up to 32% of all generated mutants, (2) our bisimulation approach scales effectively with these systems and (3) biased simulations further enhance performance. Our heuristic is 10 times faster than bisimulation and limits the exploration to two times the number of exact duplicates compared to up to 10 times for the baseline.

Neural Architecture Search (NAS) methods seek optimal networks by exploring thousands of variants of a reference architecture.Yet, optimality is typically related to prediction performance, overlooking the environmental impacts of training.Thus, NAS search spaces are unfit for performance and energy consumption trade-offs.We contribute to energy-aware NAS with (i) a grammar-based Convolutional Neural Network generator (CN-NGen) producing diverse architectures not based on a reference one; (ii) 1,300 available architectures obtained via CNNGen with their implementation, energy consumption and performance measurements; (iii) Three state-of-the-art predictors releasing the need for trained models for performance and energy estimation. CNN Generator (CNNGen)CNNGen uses the Xtext context-free grammar framework [3] to generate CNN architectures.The sequence of grammar tokens describes the CNN's topology (i.e., the succession of layers).Our grammar captures the CNN domain knowledge to produce valid architectures.Thus, CNNGen differs from other NAS methods like NASBench [2] Indeed, CNNGen produces architectures from scratch and not as variants of existing ones.CNNGen also comes with an editor allowing to specify architectures.From a valid sequence of grammar tokens, 173

Computer-assisted learning is widely discussed in the literature to aid the comprehension of SQL queries (Structured Query Language) in higher education. However, it is difficult for educators/instructors to track, monitor and analyze students’ learning situation due to the higher education massification, and institutions with large classes. Consequently, we need to provide for educators a learning dashboard to monitor and analyze the digital traces issued from students during the practice learning in SQL course. We propose a system called LSQL (Learning Analytics for SQL) that is a solution based on the learning analytics’ methodology. To this end, we propose (i) learning environment dedicated to help students understand the syntax and logic of SQL and getting data issued from these students during online SQL lab work, (ii) trace model which is designed to more effectively represent and capture the complex interactions/actions carried by a student during practice learning activities in virtual/remote laboratories, and (iii) learning analytics dashboard for educators to visualize the statistics and metrics that represent the students’ behavior, and control the students progress in SQL skills to enhance the teaching activities. Tool support is fully available.

Cost-based optimization is a promising paradigm that relies on execution queries to enable fast and efficient ex- ecution reached by the database cost model (CM) during query processing/optimization. While a few database management systems (DBMS) already have support for mathematical CMs, developing such a CMs embedded or hard-coded for any DBMS remains a challenging and error-prone task. A generic interface must support a wide range of DBMS independently of the internal structure used for extending and modifying their signature; be efficient for good responsiveness. We propose a solution that provides a common set of parameters and cost primitives allowing intercepting the signature of the internal cost function and changing its internal parameters and configuration options. Therefore, the power of abstraction allows one to capture the designers/develop- ers intent at a higher level of abstraction and encode expert knowledge of domain-specific transformation in order to construct complex CMs, receiving quick feedback as they calibrate and alter the specifications. Our contribution relies on a generic CM interface supported by Model-Driven Engineering paradigm to create cost functions for database operations as intermediate specifications in which more optimization concerning the performance are delegated by our framework and that can be compiled and executed by the target DBMS. A proof-of-concept prototype is implemented by considering the CM that exists in PostgreSQL optimizer.

We propose mutation model checking as an approach to strengthen formal specifications used for model checking. Inspired by mutation testing, our approach concludes that specifications are not strong enough if they fail to detect faults in purposely mutated models. Our preliminary experiments on two case studies confirm the relevance of the problem: their specification can only detect 40% and 60% of randomly generated mutants. As a result, we propose a framework to strengthen the original specification, such that the original model satisfies the strengthened specification but the mutants do not.

Summary Recently artificial intelligence techniques in the database community have become a driver for many database applications. The proposed solution adopting AI in the core database shows that incorporating AI improves the query processing and the self‐tuning of database systems. In traditional systems, self‐tuning database systems are commonly addressed with heuristics to suggest the physical structures (e.g., creation of indexes and materialized views) that enable the fastest execution of queries. However, existing designer tools do not explain/justify how the system behaves and the reasoning behind tuning activities. Moreover, these tools do not keep the database administrator (DBA) in the loop of the optimization process to trust some of the automatic tuning decisions. To address this problem, we introduce a framework called Explain‐Tun that enables to predict and explain self‐tuning actions with transparent strategy from historical data using two explicit models, that is, decision tree and random forests. First, we propose AI‐based DBMS to explain how to select physical structures and provide decision rules extracted by machine learning (ML) as a designed plug‐gable component. Second, a goal‐oriented model to keep DBA in the loop of the optimization process in order to manipulate ML models as CRUD entities. Finally, we evaluate our approach on three use cases, results show that bridging the DBA's experience and ML make sense in tuning database systems.

Mutation testing relies on the principle of artificially injecting faults in systems to create mutants, in order to either assess the sensitivity of existing test suites, or generate test cases that are able to find real faults. Mutation testing has been employed in a variety of application areas and at various levels of abstraction (code and models). In this paper, we focus on model-based mutation testing for timed systems. In order to cartography the field, we provide a taxonomy of mutation operators and discuss their usages on various formalisms, such as timed automata or synchronous languages. We also delineate a research agenda for the field addressing mutation costs, the impact of delays in operators specification and mutation equivalence.

A mogram designates a software language implemented in either a programming or a modelling language. Object-Oriented mograms share many common language features, but also have specificities related to inheritance, collection values, opposite and contained references, or overloading. We propose a mathematical framework that captures the semantics of such mograms with a precise characterisation of the variation points. We implemented a prototype tool that enables formal analysis in a uniform way.

Mutation analysis is a popular test assessment method. It relies on the mutation score, which indicates how many mutants are revealed by a test suite. Yet, there are mutants whose behaviour is equivalent to the original system, wasting analysis resources and preventing the satisfaction of the full (100%) mutation score. For finite behavioural models, the Equivalent Mutant Problem (EMP) can be addressed through language equivalence of non-deterministic finite automata, which is a well-studied, yet computationally expensive, problem in automata theory. In this paper, we report on our preliminary assessment of a state-of-the-art exact language equivalence tool to handle the EMP against 3 models of size up to 15,000 states on 1170 mutants. We introduce random and mutation-biased simulation heuristics as baselines for comparison. Results show that the exact approach is often more than ten times faster in the weak mutation scenario. For strong mutation, our biased simulations are faster for models larger than 300 states. They can be up to 1,000 times faster while limiting the error of misclassifying non-equivalent mutants as equivalent to 10% on average. We therefore conclude that the approaches can be combined for improved efficiency.

Model-based mutation analysis is a powerful but expensive testing technique. We tackle its high computation cost by proposing an optimization technique that drastically speeds up the mutant execution process. Central to this approach is the Featured Mutant Model, a modelling framework for mutation analysis inspired by the software product line paradigm. It uses behavioural variability models, viz., Featured Transition Systems, which enable the optimized generation, configuration and execution of mutants. We provide results, based on models with thousands of transitions, suggesting that our technique is fast and scalable. We found that it outperforms previous approaches by several orders of magnitude and that it makes higher-order mutation practically applicable.

By analogy with software product reuse, the ability to reuse (meta)models and model transformations is key to achieve better quality and productivity. To this end, various opportunistic reuse techniques have been developed, such as higher-order transformations, metamodel adaptation, and model types. However, in contrast to software product development that has moved to systematic reuse by adopting (model-driven) software product lines, we are not quite there yet for modelling languages, missing economies of scope and automation opportunities. Our vision is to transpose the product line paradigm at the metamodel level, where reusable assets are formed by metamodel and transformation fragments and "products" are reusable language building blocks (model types). We introduce featured model types to concisely model variability amongst metamodelling elements, enabling configuration, automated analysis, and derivation of tailored model types. We provide a wish list of software engineering activities to work with featured model types.

Mutation testing is an established technique used to evaluate the quality of a set of test cases. As model-based testing took momentum, mutation techniques were lifted to the model level. However, as for code mutation analysis, assessing test cases on a large set of mutants can be costly. In this paper, we introduce the Variability-Intensive Behavioural teSting (VIBeS) framework. Relying on Featured Transition Systems (FTSs), we represent all possible mutants in a single model constrained by a feature model for mutant (in)activation. This allow to assess all mutants in a single test case execution. We present VIBeS implementation steps and the DSL we defined to ease model-based mutation analysis.

The model-checking problem for Software Products Lines (SPLs) is harder than for single systems: variability constitutes a new source of complexity that exacerbates the state-explosion problem. Abstraction techniques have successfully alleviated state explosion in single-system models. However, they need to be adapted to SPLs, to take into account the set of variants that produce a counterexample. In this paper, we apply CEGAR (Counterexample-Guided Abstraction Refinement) and we design new forms of abstraction specifically for SPLs. We carry out experiments to evaluate the efficiency of our new abstractions. The results show that our abstractions, combined with an appropriate refinement strategy, hold the potential to achieve large reductions in verification time, although they sometimes perform worse. We discuss in which cases a given abstraction should be used.

Mutation testing is an effective technique for either improving or generating fault-finding test suites. It creates defective or incorrect program artifacts of the program under test and evaluates the ability of test suites to reveal them. Despite being effective, mutation is costly since it requires assessing the test cases with a large number of defective artifacts. Even worse, some of these artifacts are behaviourally ``equivalent'' to the original one and hence, they unnecessarily increase the testing effort. We adopt a variability perspective on mutation analysis. We model a defective artifact as a transition system with a specific feature selected and consider it as a member of a mutant family. The mutant family is encoded as a Featured Transition System, a compact formalism initially dedicated to model-checking of software product lines. We show how to evaluate a test suite against the set of all candidate defects by using mutant families. We can evaluate all the considered defects at the same time and isolate some equivalent mutants. We can also assist the test generation process and efficiently consider higher-order mutants.

EAST-ADL is an architectural description language dedicated to safety-critical automotive embedded system design with a focus on structural specification and behavioral constraints. The current concept of EAST-ADL provides limited support for modeling and analysis of Energy-aware Real-Time (ERT) behaviors due to the absence of energy constraints modeling notations and the lack of formal semantics. We address these limitations by extending the EAST-ADL notation with energy constraints and integrating this extension with formal modeling and analysis techniques. We provide a mapping scheme as the basis for automatic model transformation between the extended EAST-ADL and priced timed automata for model checking. This methodology has been implemented in a tool called A-BeTA and is demonstrated by means of the Brake-By-Wire case study. Our approach enables formal modeling and verification of ERT systems in EAST-ADL and identifies potential conflicts between different automotive functions at an early stage of development.

Model checking techniques for software product lines (SPL) are actively researched. A major limitation they currently have is the inability to deal efficiently with non-Boolean features and multi-features. An example of a non-Boolean feature is a numeric attribute such as maximum number of users which can take different numeric values across the range of SPL products. Multi-features are features that can appear several times in the same product, such as processing units which number is variable from one product to another and which can be configured independently. Both constructs are extensively used in practice but currently not supported by existing SPL model checking techniques. To overcome this limitation, we formally define a language that integrates these constructs with SPL behavioural specifications. We generalize SPL model checking algorithms correspondingly and evaluate their applicability. Our results show that the algorithms remain efficient despite the generalization.

The premise of variability-intensive systems, specifically in software product line engineering, is the ability to produce a large family of different systems efficiently. Many such systems are critical. Thorough quality assurance techniques are thus required. Unfortunately, most quality assurance techniques were not designed with variability in mind. They work for single systems, and are too costly to apply to the whole system family. In this paper, we propose an efficient automata-based approach to linear time logic (LTL) model checking of variability-intensive systems. We build on earlier work in which we proposed featured transitions systems (FTSs), a compact mathematical model for representing the behaviors of a variability-intensive system. The FTS model checking algorithms verify all products of a family at once and pinpoint those that are faulty. This paper complements our earlier work, covering important theoretical aspects such as expressiveness and parallel composition as well as more practical things like vacuity detection and our logic feature LTL. Furthermore, we provide an in-depth treatment of the FTS model checking algorithm. Finally, we present SNIP, a new model checker for variability-intensive systems. The benchmarks conducted with SNIP confirm the speedups reported previously.

Software Product Line (SPL) engineering is a software engineering paradigm that exploits the commonality between similar software products to reduce life cycle costs and time-to-market. Many SPLs are critical and would benefit from efficient verification through model checking. Model checking SPLs is more difficult than for single systems, since the number of different products is potentially huge. In previous work, we introduced Featured Transition Systems (FTS), a formal, compact representation of SPL behaviour, and provided efficient algorithms to verify FTS. Yet, we still face the state explosion problem, like any model checking-based verification. Model abstraction is the most relevant answer to state explosion. In this paper, we define a novel simulation relation for FTS and provide an algorithm to compute it. We extend well-known simulation preservation properties to FTS and thus lay the theoretical foundations for abstraction-based model checking of SPLs. We evaluate our approach by comparing the cost of FTS-based simulation and abstraction with respect to product-by-product methods. Our results show that FTS are a solid foundation for simulation-based model checking of SPL.

In Software Product Line (SPL) engineering, software products are build in families rather than individually. Many critical software are nowadays build as SPLs and most of them obey hard real-time requirements. Formal methods for verifying SPLs are thus crucial and actively studied. The verification problem for SPL is, however, more complicated than for individual systems; the large number of different software products multiplies the complexity of SPL model-checking. Recently, promising model-checking approaches have been developed specifically for SPLs. They leverage the commonality between the products to reduce the verification effort. However, none of them considers real time.

Most model-checking algorithms are based on automata theory. For instance, determining whether or not a transition system satisfies a Linear Temporal Logic (LTL) formula requires computing strongly connected component of its transition graph. In Software Product-Line (SPL) engineering, the model checking problem is more complex due to the huge amount of software products that may compose the line. Indeed, one has to determine the exact subset of those products that do not satisfy an intended property. Efficient dedicated verification methods have been recently developed to answer this problem. However, most of them does not allow incremental verification. In this paper, we introduce an automata-based incremental approach for SPL model checking. Our method makes use of previous results to determine whether or not the addition of conservative features (i.e., features that do not remove behaviour from the system) preserves the satisfaction of properties expressed in LTL. We provide a detailed description of the approach and propose algorithms that implement it. We discuss how our method can be combined with SPL dedicated verification methods, viz. Featured Transition Systems.

We study the problem of model checking software product line (SPL) behaviours against temporal properties. This is more difficult than for single systems because an SPL with n features yields up to 2n individual systems to verify. As each individual verification suffers from state explosion, it is crucial to propose efficient formalisms and heuristics.

In product line engineering, systems are developed in families and differences between family members are expressed in terms of features. Formal modelling and verification is an important issue in this context as more and more critical systems are developed this way. Since the number of systems in a family can be exponential in the number of features, two major challenges are the scalable modelling and the efficient verification of system behaviour. Currently, the few attempts to address them fail to recognise the importance of features as a unit of difference, or do not offer means for automated verification.

S.357-358

Feature diagrams are a popular means for documenting variability in software product line engineering. When examining feature diagrams in the literature and from industry, we observed that the same modelling concepts are used for documenting two different kinds of variability: (1) product line variability, which reflects decisions of product management on how the systems that belong to the product line should vary, and (2) software variability, which reflects the ability of the reusable product line artefacts to be customized or configured. To disambiguate the documentation of variability, we follow previous suggestions to relate orthogonal variability models (OVMs) to feature diagrams. This paper reuses an existing formalization of feature diagrams, but introduces a formalization of OVMs. Then, the relationships between the two kinds of models are formalized as well. Besides a precise definition of the languages and the links, the important benefit of this formalization is that it serves as a foundation for a tool supporting automated reasoning on variability. This tool can, e.g., analyse whether the product line artefacts are flexible enough to build all the systems that should belong to the product line.

Representation and reasoning about information system (IS) requirements is facilitated with the use of goal models to describe the desired and undesired IS behaviors. One difficulty in building and using goal models is in knowing why a model instance is as it is at some point of the requirements engineering (RE) process. If justifications for modeling choices are missing, an instance of a goal model can neither be considered appropriate nor inappropriate in a given RE project. This paper suggests a goal argumentation method (GAM) for recording the decision-making process which results in modeling choices. GAM combines a design rationale approach that guides common-sense reasoning about the goal model with an argumentation model which records and allows analysis of the justification processes leading to modeling decisions

Feature diagrams (FD) are a family of popular modelling languages used for engineering requirements in software product lines. FD were first introduced by Kang as part of the FODA (feature oriented domain analysis) method back in 1990, Since then, various extensions of FODA FD were devised to compensate for a purported ambiguity and lack of precision and expressiveness. However, they never received a proper formal semantics, which is the hallmark of precision and unambiguity as well as a prerequisite for efficient and safe tool automation, In this paper, we first survey FD variants. Subsequently, we generalize the various syntaxes through a generic construction called free feature diagrams (FFD). Formal semantics is defined at the FFD level, which provides unambiguous definition for ail the surveyed FD variants in one shot. All formalisation choices found a clear answer in the original FODA FD definition, which proved that although informal and scattered throughout many pages, it suffered no ambiguity problem. Our definition has several additional advantages: it is formal, concise and generic. We thus argue that it contributes to improve the definition, understanding, comparison and reliable implementation of FD languages

The problem of relating state-based intraagent (or intraobject) behavioral descriptions with scenario-based interagent (interobject) descriptions has recently focused much interest among the software engineering community. This paper compiles the results of our investigation of this problem. As interagent formalism, we adopt a simple variant of live sequence charts. For the intraagent perspective, we consider a game-theoretic foundation, looking at agents as "strategies," which encompasses the popular "state-based" paradigm. Three classes of relationships between models are studied: scenario checking (called eLSC checking), synthesis, and verification. We set a formally defined theoretical stage that allows us to express these three problems very simply, to discuss their complexity, and to describe optimal solutions. Our study reveals the intrinsic high computational difficulty of these tasks. Consequently, many related problems and solutions are surveyed, some of which can be the basis for practical solutions. In this, we also offer a panorama of current research and directions for the future.

We provide a symbolic algorithm for synthesizing winning strategies in Alternating Time Temporal Logic. ATL has game semantics, which makes it suitable for modeling open systems where coalitions of agents work together to achieve their goals. A typical use of the algorithm would begin with a highly non-deterministic set of agents, A, for which we wish to synthesize behavior. These may be composed with a set of opponent agents, which provide an environment. The desired behavior is then written in>-LTL, and a strategy for A to implement this is synthesized. If A implements this strategy, then the system will be guaranteed to satisfy the desired property. The algorithm presented here is part of a work in progress and updates can be found at http://www.cs.bham.ac.uk/ /spl sim/ ath/atl/spl I.bar/synthesis.

The paper is a theoretical study of a generalization of the lexicographic rule for combining ordering relations. We define the concept of priority operator: a priority operator maps a family of relations to a single relation which represents their lexicographic combination according to a certain priority on the family of relations. We present four kinds of results. • We show that the lexicographic rule is the only way of combining preference relations which satisfies natural conditions (similar to those proposed by Arrow). • We show in what circumstances the lexicographic rule propagates various conditions on preference relations, thus extending Grosof's results. • We give necessary and sufficient conditions on the priority relation to determine various relationships between combinations of preferences. • We give an algebraic treatment of this form of generalized prioritization. Two operators, called but and on the other hand, are sufficient to express any prioritization. We present a complete equational axiomatization of these two operators. These results can be applied in the theory of social choice (a branch of economics), in non‐monotonic reasoning (a branch of artificial intelligence), and more generally wherever relations have to be combined.

The theory of non-monotonic reasoning has interesting applications for the formalization and automated use of legal concepts, specially: