While creative artificial intelligence (AI) is becoming integral to our lives, we know little about what makes us call AI “creative”. Informed by prior theoretical and empirical work, we investigate how perceiving evidence of a creative act beyond the final product affects our assessment of robot creativity. We study embodiment morphology as a potential moderator of this relationship, informing a 3 × 2 factorial design. In two lab experiments on visual art, participants (N = 30 + 60) assessed drawings produced by two physical robots with different morphologies, under exposure to product, process and producer as three levels of perceptual evidence. The data supports that the human assessment of robot creativity is significantly higher the more is revealed beyond the product about the creation process, and eventually the producer. We find no significant effects of embodiment morphology, contrasting existing hypotheses and offering a more detailed understanding for future work. The latter is also informed by additional exploratory analyses revealing factors potentially influencing creativity assessments, including perceived robot likeability and participants’ experience with robotics and AI. Our insights empirically ground existing design patterns, foster fairness and validity in system comparisons, and contribute to a deeper understanding of our relationship with creative AI and thus its adoption in society.

Tertiary education institutions aim to prepare their computer science and software engineering students for working life. While much of the technical principles are covered in lower-level courses, team-based capstone courses are a common way to provide students with hands-on experience and teach soft skills. This paper explores the characteristics of project-based software engineering capstone courses presented in the literature. The goal of this work is to understand the pros and cons of different approaches by synthesising the various aspects of software engineering capstone courses and related experiences. In a systematic literature review for 2007–2022, we identified 127 articles describing real-world capstone courses. These articles were analysed based on their presented course characteristics and the reported course outcomes. The characteristics were synthesised into a taxonomy consisting of duration, team sizes, client and project sources, project implementation, and student assessment. We found out that capstone courses generally last one semester and divide students into groups of 4–5 where they work on a project for a client. For a slight majority of courses, the clients are external to the course staff and students are often expected to produce a proof-of-concept level software product as the main end deliverable. The courses generally include various forms of student assessment both during and at the end of the course. This paper provides researchers and educators with a classification of characteristics of software engineering capstone courses based on previous research. We also further synthesise insights on the reported course outcomes. Our review study aims to help educators to identify various ways of organising capstones and effectively plan and deliver their own capstone courses. The characterisation also helps researchers to conduct further studies on software engineering capstones.

Issue trackers, such as Jira, have become the prevalent collaborative tools in software engineering for managing issues, such as requirements, development tasks, and software bugs. However, issue trackers inherently focus on the lifecycle of single issues, although issues have and express dependencies on other issues that constitute issue dependency networks in large complex collaborative projects. The objective of this study is to develop supportive solutions for the improved management of dependent issues in an issue tracker. This study follows the Design Science methodology, consisting of eliciting drawbacks and constructing and evaluating a solution and system. The study was carried out in the context of The Qt Company's Jira, which exemplifies an actively used, almost two-decade-old issue tracker with over 100,000 issues. The drawbacks capture how users operate with issue trackers to handle issue information in large, collaborative, and long-lived projects. The basis of the solution is to keep issues and dependencies as separate objects and automatically construct an issue graph. Dependency detections complement the issue graph by proposing missing dependencies, while consistency checks and diagnoses identify conflicting issue priorities and release assignments. Jira's plugin and service-based system architecture realize the functional and quality concerns of the system implementation. We show how to adopt the intelligent supporting techniques of an issue tracker in a complex use context and a large data-set. The solution considers an integrated and holistic system view, practical applicability and utility, and the practical characteristics of issue data, such as inherent incompleteness.

Agile companies are not uniform. Consequently, agile transformations are conceived broadly, ranging from adopting agile methods and practices in software development teams or functions to building all-encompassing enterprise agility. Moreover, the targeted effects of agility may vary, and the success of transformations and the attainment of agility are measured in various ways. In this paper, based on a recent industrial survey study, we scrutinize holistically why companies want to transform, what types of agility they are aiming at, and how they gauge transformations. The survey data was collected during the COVID-19 pandemic in 2020. Most of the respondents were in large or very large companies in Finland and Sweden in diverse industry domains. The main findings indicate that there are many reasons for companies to transform both to improve external outcomes (fore mostly responsiveness) and to develop internal capabilities (adaptability, organizational learning). Companies seemed to have aims and goals with respect to all types of agility, including business agility. As the nature of transformations and the companies’ aims and goals vary, the transformations follow various means and measures. As a conclusion, for the hybrid era, we advise companies to consider how agility has benefited during the pandemic era, how hybrid work possibly affects the goals for agile transformations and the different facets of agility, and how to sustain agility in hybrid work.

Especially web-facing software systems enable the collection of usage data at a massive scale. At the same time, the scale and scope of software processes have grown substantively. Automated tools are needed to increase the speed and quality of controlling software processes. The usage data has great potential as a driver for software processes. However, research still lacks constructs for collecting, refining and utilising usage data in controlling software processes. The objective of this paper is to introduce a framework for data-driven software engineering. The Undulate framework covers generating, collecting and utilising usage data from software processes and business processes supported by the software produced. In addition, we define the concepts and process of extreme continuous experimentation as an exemplar of a software engineering process. We derive requirements for the framework from the research literature, with a focus on papers inspired by practical problems. In addition, we apply a multilevel modelling language to describe the concepts related to extreme continuous experimentation. We introduce the Undulate framework and give requirements and provide an overview of the processes of collecting usage data, augmenting it with additional dimensional data, aggregating the data along the dimensions and computing different metrics based on the data and other metrics. The paper represents significant steps inspired by previous research and practical insight towards standardised processes for data-driven software engineering, enabling the application of soft computing and other methods based on artificial intelligence.

Machine learning (ML) provides us with numerous opportunities, allowing ML systems to adapt to new situations and contexts. At the same time, this adaptability raises uncertainties concerning the run-time product quality or dependability, such as reliability and security, of these systems. Systems can be tested and monitored, but this does not provide protection against faults and failures in adapted ML systems themselves. We studied software designs that aim at introducing fault tolerance in ML systems so that possible problems in ML components of the systems can be avoided. The research was conducted as a case study, and its data was collected through five semi-structured interviews with experienced software architects. We present a conceptualisation of the misbehaviour of ML systems, the perceived role of fault tolerance, and the designs used. Common patterns to incorporating ML components in design in a fault tolerant fashion have started to emerge. ML models are, for example, guarded by monitoring the inputs and their distribution, and enforcing business rules on acceptable outputs. Multiple, specialised ML models are used to adapt to the variations and changes in the surrounding world, and simpler fall-over techniques like default outputs are put in place to have systems up and running in the face of problems. However, the general role of these patterns is not widely acknowledged. This is mainly due to the relative immaturity of using ML as part of a complete software system: the field still lacks established frameworks and practices beyond training to implement, operate, and maintain the software that utilises ML. ML software engineering needs further analysis and development on all fronts.

Artificial intelligence (AI) has made its way into everyday activities, particularly through new techniques such as machine learning (ML). These techniques are implementable with little domain knowledge. This, combined with the difficulty of testing AI systems with traditional methods, has made system trustworthiness a pressing issue. This paper studies the methods used to validate practical AI systems reported in the literature. Our goal is to classify and describe the methods that are used in realistic settings to ensure the dependability of AI systems. A systematic literature review resulted in 90 papers. Systems presented in the papers were analysed based on their domain, task, complexity, and applied validation methods. The validation methods were synthesized into a taxonomy consisting of trial, simulation, model-centred validation, and expert opinion. Failure monitors, safety channels, redundancy, voting, and input and output restrictions are methods used to continuously validate the systems after deployment. Our results clarify existing strategies applied to validation. They form a basis for the synthesization, assessment, and refinement of AI system validation in research and guidelines for validating individual systems in practice. While various validation strategies have all been relatively widely applied, only few studies report on continuous validation.

Experiments are often used as a means to continuously validate user needs and to aid in making software development decisions. Involving users in the development of software products benefits both the users and companies. How software companies efficiently involve users in both general development and in experiments remains unclear; however, it is especially important to determine the perceptions and attitudes held by practitioners in different roles in these companies. We seek to: 1) explore how software companies involve users in software development and experimentation; 2) understand how developer, manager and UX designer roles perceive and involve users in experimentation; and 3) uncover systematic patterns in practitioners’ views on user involvement in experimentation. The study aims to reveal behaviors and perceptions that could support or undermine experiment-driven development, point out what skills could enhance experiment-driven development, and raise awareness of such issues for companies that wish to adopt experiment-driven development. We conducted a survey within four Nordic software companies, inviting practitioners in three major roles: developers, managers, and UX designers. We asked the respondents to indicate how they involve users in their job function, as well as their perspectives regarding software experiments and ethics. We identified six patterns describing experimentation and user involvement. For instance, managers were associated with a cautious user notification policy, that is, to always let users know of an experiment they are subject to, and they also believe that users have to be convinced before taking part in experiments. We discovered that, due to lack of clear processes for involving users and the lack of a common understanding of ethics in experimentation, practitioners tend to rationalize their perceptions based on their own experiences. Our patterns were based on empirical evidence and they can be evaluated in different populations and contexts.

Virtualization technologies have become common-place both in software development as well as engineering in a more general sense. Using virtualization offers other benefits than simulation and testing as a virtual environment can often be more liberally configured than the corresponding physical environment. This, in turn, introduces new possibilities for education and training, including both for humans and artificial intelligence (AI). To this end, we are developing a simulation platform AILiveSim. The platform is built on top of the Unreal Engine (www.unrealengine.com) game development system, and it is dedicated to training and testing autonomous systems, their sensors and their algorithms in a simulated environment. In this paper, we describe the elements that we have built on top of the engine to realize a Virtual Environment (VE) useful for the design, implementation, application and analysis of autonomous systems. We present the architecture that we have put in place to transform our simulation platform from automotive specific to be domain agnostic and support two new domains of applications: autonomous ships and autonomous mining machines. We describe the important specificity of each domain in regard to simulation.In addition, we also report the challenges encountered when simulating those applications, and the decisions taken to overcome these challenges.

Context: A software product line is a means to develop a set of products in which variability is a central phenomenon captured in variability models. The field of SPLs and variability have been topics of extensive research over the few past decades. Objective: This research characterizes systematic reviews (SRs) in the field, studies how SRs analyze and use evidence-based results, and identifies how variability is modeled. Method: We conducted a tertiary study as a form of systematic review. Results: 86 SRs were included. SRs have become a widely adopted methodology covering the field broadly otherwise except for variability realization. Numerous variability models exist that cover different development artifacts, but the evidence is insufficient in quantity and immature, and we argue for better evidence. SRs perform well in searching and selecting studies and presenting data. However, their analysis and use of the quality of and evidence in the primary studies often remains shallow, merely presenting of what kinds of evidence exist. Conclusions: There is a need for actionable, context-sensitive, and evaluated solutions rather than novel ones. Different kinds of SRs (SLRs and Maps) need to be better distinguished, and evidence and quality need to be better used in the resulting syntheses.

Requirements Engineering (RE) has established itself as a software engineering discipline over the past decades. While researchers have been investigating the RE discipline with a plethora of empirical studies, attempts to systematically derive an empirical theory in context of the RE discipline have just recently been started. However, such a theory is needed if we are to define and motivate guidance in performing high quality RE research and practice. We aim at providing an empirical and externally valid foundation for a theory of RE practice, which helps software engineers establish effective and efficient RE processes in a problem-driven manner. We designed a survey instrument and an engineer-focused theory that was first piloted in Germany and, after making substantial modifications, has now been replicated in 10 countries worldwide. We have a theory in the form of a set of propositions inferred from our experiences and available studies, as well as the results from our pilot study in Germany. We evaluate the propositions with bootstrapped confidence intervals and derive potential explanations for the propositions. In this article, we report on the design of the family of surveys, its underlying theory, and the full results obtained from the replication studies conducted in 10 countries with participants from 228 organisations. Our results represent a substantial step forward towards developing an empirical theory of RE practice. The results reveal, for example, that there are no strong differences between organisations in different countries and regions, that interviews, facilitated meetings and prototyping are the most used elicitation techniques, that requirements are often documented textually, that traces between requirements and code or design documents are common, that requirements specifications themselves are rarely changed and that requirements engineering (process) improvement endeavours are mostly internally driven. Our study establishes a theory that can be used as starting point for many further studies for more detailed investigations. Practitioners can use the results as theory-supported guidance on selecting suitable RE methods and techniques.

Background: Requirement engineering is often considered a critical activity in system development projects. The increasing complexity of software as well as number and heterogeneity of stakeholders motivate the development of methods and tools for improving large-scale requirement engineering. Aims: The empirical study presented in this paper aim to identify and understand the characteristics and challenges of a platform, as desired by experts, to support requirement engineering for individual stakeholders, based on the current pain-points of their organizations when dealing with a large number requirements. Method: We conducted a multiple case study with three companies in different domains. We collected data through ten semi-structured interviews with experts from these companies. Results: The main pain-point for stakeholders is handling the vast amount of data from different sources. The foreseen platform should leverage such data to manage changes in requirements according to customers' and users' preferences. It should also offer stakeholders an estimation of how long a requirements engineering task will take to complete, along with an easier requirements dependency identification and requirements reuse strategy. Conclusions: The findings provide empirical evidence about how practitioners wish to improve their requirement engineering processes and tools. The insights are a starting point for in-depth investigations into the problems and solutions presented. Practitioners can use the results to improve existing or design new practices and tools.

The requirements for a system have many dependencies that can be expressed in the individual requirements managed in an issue tracker or a requirements management system. However, managing the entire body of requirements taking into account all complex dependencies is not well supported. We describe how a feature model based configurator can be used as a tool to help manage requirements data. Data transfer and constructing the needed requirements model can be carried out automatically by relying on a model generator. We implemented a prototype tool for requirements and release management that utilizes a knowledge-based configurator.

Background: Online forums are instruments through which information or problems are shared and discussed, including expressions of interests and intentions. Objective: In this paper, we present ongoing work aimed at analyzing the content of forum posts of a hybrid open source company that offers both free and commercial licenses, in order to help its community manager gain improved understanding of the forum discussions and sentiments and automatically discover new opportunities such as sales leads, i.e., people who are interested in buying a license. These leads can then be forwarded to the sales team for follow-up and can result in them potentially making a sale, thus increasing company revenue. Method: For the analysis of the forums, an untapped channel for sales leads by the company, text analysis techniques are utilized to identify potential sales leads and the discussion topics and sentiments in those leads. Results: Results of our preliminary work make a positive contribution in lessening the community manager's work in understanding the sentiment and discussion topics in the hybrid open source forum community, as well as make it easier and faster to identify potential future customers. Conclusion: We believe that the results will positively contribute to improving the sales of licenses for the hybrid open source company.

Background: Experiment-driven development with the help of real usage data helps to build software products and services that are of high value to their users. As more software companies use experimentation in their development practises, ethical concerns are increasingly important. Objective: There is a need for understanding the ethical issues companies must take into account when practising experimentation as a development strategy. This paper examines how software development practitioners experience the need for notifying users when involving them in experimentation. Method: We conducted a survey within four software companies, inviting employees in different functional roles to indicate their attitudes and perceptions through a number of statements. Results: Employees working in different roles have different viewpoints on ethical issues. While managers are more conscious about company-customer relationships, UX designers appear more familiar with involving users. Developers think that details of experiments can be withheld from users if the results depend on it. Conclusion: Barriers to successfully conducting experiment-driven development are different for different roles. Clear and specific guidelines are needed for ethical aspects of experimentation.

Within software product lines, customers may have different quality needs. To produce products with purposefully different quality attributes, several challenges must be addressed. First, one must be able to distinguish product quality attributes to the customers in a meaningful way. Second, one must create the desired quality attribute differences during product-line architecture design and derivation. To study how performance is varied purposefully in software product lines, we conducted a comparison and re-analysis of two industrial case studies in the telecommunication and mobile game domains. The results show that performance variants must be communicated to the customer in a way that links to customer value and her role. When performance or its adaptation are crucial for the customer, performance differences must be explicitly "designed in" with software or hardware means. Due to the emergent nature of performance, it is important to test performance and manage how other variability affects performance.

Finding a suitable time for a meeting is a common practical problem. The existing software solutions either cannot be used across heterogeneous calendar systems and organizations, or require manual effort and waiting. We employ design science to study how meetings can be scheduled over organizational and calendar system boundaries; the scheduling should be effortless while ensuring the user control and privacy of the calendar data. The resulting artifact utilizes heterogeneous calendar data from the mobile devices and the cloud calendars; the aim is to aid the organizer in making better decisions regarding the meeting times.

Evaluating the multidimensional and dynamic nature of IT business value is a continuous challenge. This paper examines how system dynamics can be used in evaluating IT business value in a company level. We approach IT business value as a web of impacts, where benefits and sacrifices are ultimately evaluated against company earnings logic. This study is based on an action research and covers a pilot project within two co-operating companies. System dynamics was utilised to construct a value creation model for an existing Gaming Management System. This value creation modelling covered two dimensions: 1) structural evaluation of IT impacts with cause-and-effect models, 2) dynamic evaluation and simulation of value realisation over time. As a result, value creation modelling was able to provide a visual overview of how IT impacts were linked to business value through value paths, and how much and when value was realised. Value creation modelling enabled prototyping of value realisation that can provide value based insights for development activities like requirements elicitation and analysis. The examined approach proved its potential for providing a common language for technology and business parties, thus improving IT business alignment.

Engineering large software-based systems in safety-critical domains is a challenging task despite extensive research on the topic. The software technologies and development processes are established, and basic safety principles are well known. However, demonstrating the safety of a software-based automation system remains a key challenge, particularly in the nuclear domain. In this paper, we describe our experiences from current nuclear projects featuring software-based automation. We observed a number of assumptions in regulation and standards related to safety principles, such as separation and diversity, which do not apply to software systems. The assumptions result in unrealistic expectations for software-based systems, making both design and safety demonstration challenging.

In the research on software product lines, product variants typically differ by their functionality, and quality attributes are more or less similar across products. To accumulate empirical evidence, this paper presents a descriptive case study of performance variability in a software product line of mobile network base stations. The goal is to study the motivation to vary performance, and the strategy for realizing performance variability in the product line architecture. The results highlight that the evolution of customer needs motivates performance variability; performance variability can be realized either with software or hardware variability strategy, with the latter often being prevailing; and the software strategy can be kept focused by downgrading performance.

In the context of mobile devices, services from several devices can be composed. Such compassable services may include data and device resources, such as microphones or cameras. The services can be composed to create collaborative composite services, such as video streaming. The mobility of the devices makes the service compositions inherently dynamic. Further, the set of possible service compositions may be large, and thus finding a suitable service composition at runtime becomes a challenge. Recommender systems are intelligent information systems that propose items to a user based on the user preferences, they are particularly useful in under-constrained problems, where the most suitable item is recommended from a large set of possible items that satisfy the user preferences. The main contribution of this paper is the application of knowledge-based recommendation techniques for composing dynamic services for mobile devices. The contribution is exemplified and validated with the Social Device Platform, which provides interactive, proximity-based service compositions for mobile devices. Knowledge-based recommender systems were found to be applicable technologically and feasible in terms of performance for composing dynamic services in environments where runtime composition is necessary.

This paper evaluates the usefulness of different simulators developed in server system testing for a mobile application during 5 years, with the purpose of identifying the advantages and weaknesses of each simulation method in the given setup. The study found that simulation was used on almost every interface to external systems, and two factors that affected the usefulness of simulators over long term were the functionality supported and the applicable usage scenarios. Large-scale simulation did not keep yielding high returns. In the mobile application of server/client architecture, emulating external servers raised the testing capability, and emulating mobile clients led to higher efficiency. The findings in this study can be used as references for software teams to plan simulation in QA activities properly for faster QA cycles, deeper understanding of the system, more stable test results and lower resource costs.

Online social media services, such as Facebook and Twitter, have set new standards on how people interact with each other online, share their everyday activities, and media services. While current mobile services supporting social interaction are typically primarily for remote communication, similar services can be introduced to co-located social interactions. In such a setting, people and proactive, context sensing mobile devices form a new kind of a socio-digital system where the mobile devices are active participants and can initiate interaction among the devices and people. Physical proximity of the devices becomes a key enabler to advance users' interaction with each other and the supporting mobile services. In this paper, we introduce the concept of Social Devices and its implementation. The Social Devices Platform facilitates autonomously composed cooperative services in co-located devices where the client part is simple and easily deployable to different kinds of devices.

Typically, products in a software product line differ by their functionality, and quality attributes are not intentionally varied. Why, how, and which quality attributes to vary has remained an open issue. A systematically conducted literature review on quality attribute variability is presented, where primary studies are selected by reading all content of full studies in Software Product Line Conference. The results indicate that the success of feature modeling influences the proposed approaches, different approaches suit specific quality attributes differently, and empirical evidence on industrial quality variability is lacking.

Currently users own and use many network-connected devices such as laptop, smart phone, or tablet. The user creates content using the default applications in these devices. One approach is to share and ubiquitously access the contents through a social media. Nevertheless, the contents residing in these devices should be available from anywhere, without any explicit user activity, even the contents residing in a remote location should also appear to be locally available in the operating device. With this approach we believe a user's content gets cloudified, while still remaining operable with the existing applications. In this paper we propose to cloudify a user's content in all her mobile devices. We present a middleware that allows a user to uniformly use the existing applications on local as well as remote content, and to also share the contents in a controlled way. The middleware hides all network activity to the user, it also makes the applications almost unaware while operating on a content residing in a remote location. To evaluate our approach in a mobile device context, we also present the efficiency measures of the middleware in terms of latency in content-retrieval, as well as in terms of resource usage viz. power consumption.

The successful practices of requirements engineering vary between application domains and are characterized by the nature of the application domain. One relatively peculiar application domain is the nuclear energy domain, which is characterized by the long life cycle of power plant operation and construction project, strict control of safety, and collaboration between several stakeholder groups including various branches of technology. We describe the state of the practice of requirements engineering in the nuclear energy domain in Finland on the basis of a descriptive case study focusing on the safety-related automation systems of the nuclear power plants. The results of the study indicate that explicit requirements engineering practices are becoming increasingly important due to the increasing complexity of the technology used, retirement of the older generation of experts, and construction of new power plants along with renewal of the existing nuclear power plants. The challenges of requirements engineering are especially within efficient communication and management of requirements. We highlight challenges that are emphasized by the characteristics of the nuclear energy domain but also discuss the more generic nature of these challenges. The identified challenges are in authority requirements, aging, communication, knowledge transfer, representation of requirements, and tool support.

A symposium for doctoral students is organized at SPLC. The purpose of the symposium is to offer expert feedback to students on their thesis work. In addition, the overall aim of the symposium is to improve the quality of doctoral thesis work in the area of software product lines.

Variability is the ability of a software artifact to be changed for a specific context. Mechanisms to accommodate variability include software product lines, configuration wizards and tools in commercial software, configuration interfaces of software components, or the dynamic runtime composition of web services. Variability is primarily reflected in and facilitated through the software architecture. Also, the software architecture is the centerpiece of software systems and acts as reference point for many development activities, and many of today's software systems are built to accommodate variability. Thus, variability in software architecture should be well-understood and be treated as a first-class concern. The software architecture community acknowledges that variability is a concern of different stakeholders, and in turn affects other concerns. Nevertheless, treating variability related to the architecture and all architecture aspects, as a cross-cutting concern, is currently not well understood. Therefore, VARSA 2011 aims at identifying critical challenges and progressing the state-of-the-art on variability in software architecture.

The research and practice on designing and analyzing software architectures has evolved considerably during the past decade. In particular, more precise architecture modeling methods have reached industrial practice. Despite this, simple dependency diagrams are still widely used ease communication with non-technical stakeholders, to reduce need for domain knowledge, and to make initial design before detailed architecture phase. Based on our experience, seasoned architects can easily find potential architectural problems in these descriptions. In this paper, we describe a representative set of potentially problematic structures in dependency diagrams to raise relevant questions on the decisions made to create the software architecture.

Peer reviews have been identified as one of the best practices in requirements engineering. The most formal peer review technique - inspection - has been found to be effective for the discovery of defects in documents. Nonetheless, many software companies practice inspections infrequently or not at all. For instance, some engineers consider inspections to be uncreative work that adds costs. This paper describes the success factors and challenges involved in persuading review teams to document inspections. The case study utilized an action research approach over a 10-year period, during which two separate attempts were made to address inspection practices. Document inspections did not gain a sustainable position in the study. Consequently, key success factors and challenges were identified in order to explain how the review teams changed their perception throughout the adoption of document inspection. Long-term engagement to document inspection requires motivation and commitment on the part of the teams, and the favorable development culture of an organization, dedicated champions, and the careful tailoring of inspection practices seem to positively influence this. In the long run, it can be challenging to keep document inspections consistent with the existing values, previous experiences, and needs of the software development teams.

The growing number of software security vulnerabilities is an ever-increasing challenge for organizations. As security managers in the industry have to operate within limited budgets they also have to prioritize their vulnerability responses. The Common Vulnerability Scoring System (CVSS) aids in such prioritization by providing a metric for the severity of vulnerabilities. In its most prominent application, as the severity metric in the U.S. National Vulnerability Database (NVD), CVSS scores omit information pertaining the potential exploit victims' context. Researchers and managers in the industry have long understood that the severity of vulnerabilities varies greatly among different organizational contexts. Therefore the CVSS scores provided by the NVD alone are of limited use for vulnerability prioritization in practice. Security managers could address this limitation by adding the missing context information themselves to improve the quality of their CVSS-based vulnerability prioritization. It is unclear for them, however, whether the potential improvements are worth the additional effort. We present a method that enables practitioners to estimate these improvements. Our method is of particular use to practitioners who do not have the resources to gather large amounts of empirical data, because it allows them to simulate the improvement potential using only publicly available data in the NVD and distribution models from the literature. We applied the method on a sample set of 720 vulnerability announcements from the NVD and found that adding context information significantly improved the prioritization and selection of vulnerability response process. Our findings contribute to the discourse on returns on security investment, measurement of security processes and quantitative security management.

Usability and requirements engineering both provide means for discovering, analyzing, and fulfilling users' needs. In practice, it is difficult to manage and control user-centered design and system development processes separately. Based on a case study conducted in two software product companies, we have aimed to understand the role of usability specialists in the requirements engineering (RE) process. Our findings indicate that usability is still often seen as user interface design instead of a more comprehensive characteristic of a software product. Therefore, usability specialists had difficulties participating in early RE activities. To integrate usability as a natural part of the RE process, the usability teams have started to organize training in their companies. The main purpose of the training is to ensure that usability is not relying solely on the work of specialists but becomes a common responsibility for the whole product development organization.

Teaching software architecture design in an academic course so that it would equip the students with industrially useful capabilities is challenging. The real software architecture design problems are less clear than what the students are used to learning; the existing mass of assets of an industrial environment is hard to bring into a classroom; and so forth. We have designed a special course into an academic software engineering curriculum, taking into account the industrial needs in teaching the problem of understanding and solving demanding software architecture design problems. The course form is similar to an industrial architecture study assigned to a team of architects. In this paper, we discuss the industrial motivation for the course, the development of the course to its current form, and the lessons learned from running the course.

Product lines should be based on the business reality in the selected market segments. Since the success of the product line is determined by the success of the resulting products, it is essential to guarantee that the key requirements of each identified market segment are satisfied. A critical issue for any company pursuing product line development is the competitiveness of their products against products from other manufacturers. The competitiveness can be realized by carefully managing the differentiating requirements during the initial analysis of the product line requirements. For industrial scale product lines, the number of initial requirements can be large, seriously hindering the analysis. In this paper, we first discuss the economic foundation of differentiating requirements. Then we show how to identify the key requirements for a product line and in which way we can reduce the set of requirements that needs to be discussed during the analysis. Finally, we demonstrate our approach with a worked example where we analyze the key requirements in terms of differentiation among the products.

Software product lines have proven to be successful for developing many critical software systems. Sharing thoroughly tested components can greatly improve the quality of individual products. The structuring of commonality and variability in the product line creates dependencies among features and components. Because of the dependencies, individual products may be bloated with features and components not required by the product specification. This increases complexity and resource consumption, affecting product quality negatively. We propose a method for analyzing product line dependencies for identifying unnecessary features. If these features are found, the method also addresses how to correct the situation. Our approach is demonstrated with a running example and our experiences in real industrial cases are discussed.

Under today's fiercely competitive conditions, companies are seeking new means to develop innovative products that satisfy customer and user needs. In order to understand how requirements engineering (RE) can support innovations, we observed RE activities in six Finnish companies. Our observations indicate that RE can play a vital role in the development of innovative products. We identified three main opportunities for innovations: 1) discovering hidden customer and user needs, 2) inventing new product features that satisfy these needs, and 3) supporting feature development with an innovative technical solution. Based on our observations, as well as on existing innovation and business-management literature, we have concluded that RE research can gain significant results by investigating how to discover and model hidden customer and user needs. We believe that this would allow RE to much better support those innovation practices that provide real competitive advantage.

Feature modelling has become perhaps the most popular method for representing variabilities and commonalities in software product families. A large number of feature modelling methods and supporting tools have been reported. The conceptual foundation of feature models remains vague, a fact that severely undermines the usability of feature models. Therefore, we introduce Forfamel, a rigorous conceptual foundation for feature modelling. Forfamel synthesises existing feature modelling methods in the sense that it covers most concepts and constructs found in existing feature modelling methods. In addition, Forfamel includes a few additional constructs that may prove to be useful. We show the novel contribution of Forfamel by reflecting it against previous feature modelling methods and arguing for its underlying design decisions