In V-process, ideas for a new system are repeatedly verified in an agile way using Model Based Development (MBD) in the early stages of a system development. Although verifying those ideas through simulations and/or in-depth analysis by writing detailed requirements specifications is possible, it is unrealistic due to difficulty of understanding relations among functions, and the development cost. In our preliminary experiment, we first construct abstract models and verify given ideas through those models. However, we find that the cost of preparing requirements specification documents and building consensus with the system concept designers and the model designers require considerable cost. To overcome the issue, we propose a requirements elicitation method using Goal Strucuturing Notations (GSN). We apply the proposed method to three automotive-domain system development projects. As a result, the cost of preparing requirement specification documents can be reduced compared to the conventional methods.

Requirements engineering for machine learning (ML)-based systems involves unique difficulties. The core cause is the intrinsic uncertainty or unpredictability, not only in requirements and environments but also in implementation. In this paper, we discuss the impact of this type of uncertainty on requirements engineering methods such as goal-oriented requirements analysis (GORE). Many aspects in requirements analysis or prior decision making remain as hypotheses, which may be validated or invalidated with evidences from Proof-of Concept experiments, field tests, and operation. To deal with this point, we present principles of evidence-driven requirements engineering and instantiate them into a method that links GORE and ML operation (GORE-MLOps).

Advanced information technology offers greater convenience to the general public. However, information technology can cause failures that have significant negative impacts (e.g., system failures and personal information leaks). To improve this situation, it is important to understand past failures, extract their causes, and define countermeasures. In this paper, we focus on communications networks and financial information systems, and collect and analyze publicly available data on failure cases during a 15-year period. The analysis results allow us to identify the most important issues and describe countermeasures to mitigate potential negative impacts.

Information systems have become indispensable in our daily lives. It is anticipated that if information systems become more huge and complex, more critical failures will occur. However, reports of failures have not been adequately collected. This paper presents failure analyses of communications systems and networks by using public data from newspapers, official governmental information, and news websites in Japan. Our failure data consist of 798 failures that occurred from 2000 to 2013. Of these, 335 failures were significant. Using our database, we analyze and evaluate these failures from the viewpoint of dependability in detail from 2011 to 2013. Our analyses resulted in an error-handling flowchart, classification of failures by the patterns of unsuccessful cases of fault-tolerant functions, and factors leading to error propagation. In addition, countermeasures are identified. We believe that these results will encourage public sharing of failure information.

Assurance cases are documented bodies of evidence that provide valid and convincing arguments that a system is adequately dependable in a given application and environment. Assurance cases are widely required by regulation for safety-critical systems in the EU. There have been several graphical notation systems proposed for assurance cases. GSN (Goal Structuring Notation) and CAE (Claim, Argument, Evidence) are such two notation systems, and a standardization effort for these notation systems have been attempted in OMG (Object Management Group). However, these notation systems have not been defined in a formal way. This paper presents a formal definition of an assurance case language based on GSN and its pattern and module extensions. We take the framework of functional programming language as the basis of our study. The implementation has been done on an Eclipse based GSN editor. We report case studies on previous work done with GSN and show the applicability of the assurance case language.

System developers should explain system errors sufficiently, during a system failure situation. This is an essential act in order to verify the dependability of systems. Dependability Case (D-Case) is one method for confirming systems of dependability suffciently, against a system failure situations. However, in D-Case, we could not clearly describe the relationship of words (people, objects, activities) within its (D-Case) nodes. For this reason, we introduce a new way to define Word Relationship Diagram (WRD) that describes the relationship of words within D-Case and propose our conversion rules from Dependability Case to Word Relationship Diagram (D2W rule) and vice versa (from Word Relationship Diagram to Dependability Case (D2W rule)). In addition to this, (1) we created a rule for the relationship of words for D-Case. (2) We applied the rules to the Dependability Case (D-Case) and the Word Relationship Diagram (WRD) of a train operation system.

Today's information systems have become large and complex because they must interact with each other via networks. This makes testing and assuring the dependability of systems much more difficult than ever before. DS-Bench Toolset has been developed to address this issue, and it includes D-Case Editor, DS-Bench, and D-Cloud. D-Case Editor is an assurance case editor. It makes a tool chain with DS-Bench and D-Cloud, and exploits the test results as evidences of the dependability of the system. DS-Bench manages dependability benchmarking tools and anomaly loads according to benchmarking scenarios. D-Cloud is a test environment for performing rapid system tests controlled by DS-Bench. It combines both a cluster of real machines for performance-accurate benchmarks and a cloud computing environment as a group of virtual machines for exhaustive function testing with a fault-injection facility. DS-Bench Toolset enables us to test systems satisfactorily and to explain the dependability of the systems to the stakeholders.

Computers are now present almost everywhere and connected into ever more complex networks. This means not only that embedded systems are more complicated, but also that communication among the diverse stakeholders of systems is much harder than before. This paper introduces the D-Case approach to a systematic explanation of embedded-systems dependability. A D-Case is a structured document that argues for the dependability of a system, supported by evidence. This extends the notion of safety cases commonly used in (European) safety-critical sectors. The goal is to develop the D-Case language for communication systems dependability among the stakeholders. The paper reports the experience in constructing a D-Case for the remote test surveillance system developed to demonstrate certain dependability system components. D-Case construction is shown to be an effective method in explaining how each system component contributes to the overall dependability of the system. Another experiment shows how the D-Case approach can promote dependability through the life cycle of a larger system. Finally, the paper presents some comments on the difficulties and insights for future work.

This paper develops a static type system equivalent to static single assignment (SSA) form. In this type system, a type of a variable at some program point represents the control flows from the assignment statements that reach the program point. For this type system, we show that a derivable typing of a program corresponds to the program in SSA form. By this result, any SSA transformation can be interpreted as a type inference process in our type system. By adopting a result on efficient SSA transformation, we develop a type inference algorithm that reconstructs a type annotated code from a given code. These results provide a static alternative to SSA based compiler optimization without performing code transformation. Since this process does not change the code, it does not incur overhead due to insertion of φ functions. Another advantage of this type based approach is that it is not constrained to naming mechanism of variables and can therefore be combined with other static properties useful for compilation and code optimization such as liveness information of variables. As an application, we express optimizations as type-directed code transformations