• Automatic model-based load test generation for elastic microservice applications. • Models explicitly couple application and autoscaler dynamics. • Optimization identifies failure-inducing workload traces offline. • Framework supports multiple objectives and workload scenarios. • Generated tests expose performance violations in real microservice applications. Microservice applications are required to consistently guarantee Service-Level Agreements (SLAs) under fluctuating workloads, a challenge commonly addressed through autoscaling mechanisms. However, the effectiveness of an autoscaler strongly depends on the workload scenario, and validating robustness across diverse workload conditions remains an open problem. To address this, we propose an offline model-based framework that automatically generates load test traces designed to expose performance failures in elastic microservice applications. The system under test is modeled as a closed-loop dynamical system where the microservice application and the autoscaler are explicitly coupled. Specifically, we encode both components as piecewise affine functions, allowing a wide set of applications and autoscalers to be captured. Test generation is framed using a falsification approach and solved as a mixed-integer linear program, eliminating the need for manual configuration or real system interactions during test generation. The generated test cases are designed to cause SLA violations, uncovering critical workload scenarios that may be overlooked by existing approaches. We evaluate the framework on both a realistic benchmark microservice application and a population of randomly generated systems, demonstrating that the generated traces consistently induce performance failures in real deployments. Furthermore, we show that the method generalizes across different autoscaling policies and workload patterns, producing valid test traces within short time intervals. Finally, we discuss and compare alternative approaches for load test generation. These experiments highlight both the effectiveness of the approach in exposing performance violations and its applicability to diverse autoscaling configurations.

After more than thirty-five years of research and development in software architecture, several fundamental challenges remain unsolved. First, despite the importance of having a well-defined architecture description aligned with the system, inconsistencies and misalignments are still prevalent. Second, although numerous languages exist to describe architectures, none have achieved widespread use or recognition as a de facto standard. Third, while architecture is dynamic and evolving, with architectural decisions often made by non-architect stakeholders, there are no universally accepted methodologies to capture emergent aspects and incorporate them into the architecture.In this paper, we explore the emerging concept of architecture as code. Inspired by the success of infrastructure as code, which enables infrastructure management in a codified, automated, and repeatable manner, architecture as code aims to bring similar benefits to software architecture. To the best of our knowledge, this is the first scientific paper to study this concept in depth within the context of software architecture, providing a comprehensive description and analysis of its characteristics. We also investigate how architecture as code is implemented and applied in practice.

We present a novel approach to differential cost analysis that, given a program revision, attempts to statically bound the difference in resource usage, or cost, between the two program versions. Differential cost analysis is particularly interesting because of the many compelling applications for it, such as detecting resource-use regressions at code-review time or proving the absence of certain side-channel vulnerabilities. One prior approach to differential cost analysis is to apply relational reasoning that conceptually constructs a product program on which one can over-approximate the difference in costs between the two program versions. However, a significant challenge in any relational approach is effectively aligning the program versions to get precise results. In this paper, our key insight is that we can avoid the need for and the limitations of program alignment if, instead, we bound the difference of two cost-bound summaries rather than directly bounding the concrete cost difference. In particular, our method computes a threshold value for the maximal difference in cost between two program versions simultaneously using two kinds of cost-bound summaries---a potential function that evaluates to an upper bound for the cost incurred in the first program and an anti-potential function that evaluates to a lower bound for the cost incurred in the second. Our method has a number of desirable properties: it can be fully automated, it allows optimizing the threshold value on relative cost, it is suitable for programs that are not syntactically similar, and it supports non-determinism. We have evaluated an implementation of our approach on a number of program pairs collected from the literature, and we find that our method computes tight threshold values on relative cost in most examples.

We introduce a framework for the symbolic verification of epistemic properties of programs expressed in a class of general-purpose programming languages. To this end, we reduce the verification problem to that of satisfiability of first-order formulae in appropriate theories. We prove the correctness of our reduction and we validate our proposal by applying it to two examples: the dining cryptographers problem and the ThreeBallot voting protocol. We put forward an implementation using existing solvers, and report experimental results showing that the approach can perform better than state-of-the-art symbolic model checkers for temporal-epistemic logic.

Intelligent Environments (IE) are a very active area of research and a number of applications are currently being deployed in domains ranging from smart home to e-health and autonomous vehicles. In a number of cases, IE operate together with (or to support) humans, and it is therefore fundamental that IE are thoroughly verified. In this paper we present how a set of techniques and tools developed for the verification of software code can be employed in the verification of IE described by means of event-condition-action rules. In particular, we reduce the problem of verifying key properties of these rules to satisfiability and termination problems that can be addressed using state-of-the-art SMT solvers and program analysers. We introduce a tool called vIRONy that implements these techniques and we validate our approach against a number of case studies from the literature.

We present the design, implementation and information flow verification of CoSMeDis, a distributed social media platform. The system consists of an arbitrary number of communicating nodes, deployable at different locations over the Internet. Its registered users can post content and establish intra-node and inter-node friendships, used to regulate access control over the posts. The system's kernel has been verified in the proof assistant Isabelle/HOL and automatically extracted as Scala code. We formalized a framework for composing a class of information flow security guarantees in a distributed system, applicable to input/output automata. We instantiated this framework to confidentiality properties for CoSMeDis's sources of information: posts, friendship requests, and friendship status.

Several logics for expressing coalitional ability under resource bounds have been proposed and studied in the literature. Previous work has shown that if only consumption of resources is considered or the total amount of resources produced or consumed on any path in the system is bounded, then the model-checking problem for several standard logics, such as Resource-Bounded Coalition Logic (RB-CL) and Resource-Bounded Alternating-Time Temporal Logic (RB-ATL) is decidable. However, for coalition logics with unbounded resource production and consumption, only some undecidability results are known. In this paper, we show that the model-checking problem for RB-ATL with unbounded production and consumption of resources is decidable but EXPSPACE-hard. We also investigate some tractable cases and provide a detailed comparison to a variant of the resource logic RAL, together with new complexity results.

We present MCMAS, a model checker for the verification of multi-agent systems. MCMAS supports efficient symbolic techniques for the verification of multi-agent systems against specifications representing temporal, epistemic and strategic properties. We present the underlying semantics of the specification language supported and the algorithms implemented in MCMAS, including its fairness and counterexample generation features. We provide a detailed description of the implementation. We illustrate its use by discussing a number of examples and evaluate its performance by comparing it against other model checkers for multi-agent systems on a common case study.

In this work, we propose the use of multi-agent system (MAS) models as the basis for predictive reasoning about various safety conditions and the performance of Air Traffic Management (ATM) Systems. To this end, we describe the engineering of a domain-specific MAS model that provides constructs for creating scenarios related to ATM systems and procedures; we then instantiate the constructs in the ATM model for different scenarios. As a case study we generate a model for a concept that provides the ability to maximize departure throughput at La Guardia airport (LGA) without impacting the flow of the arrival traffic; the model consists of approximately 1.5 hours real time flight data. During this time, between 130 and 150 airplanes are managed by four en-route controllers, three TRACON controllers, and one tower controller at LGA who is responsible for departures and arrivals. The planes are landing at approximately 36 to 40 planes an hour. A key contribution of this work is that the model can be extended to various air-traffic management scenarios and can serve as a template for engineering large-scale models in other domains.

In this paper we present an affordable solution to help blind people navigate unknown environments. Our solution performs image classification on a Raspberry Pi and provides feedback to users by means of vibration motors to signal the presence of an obstacle in a given direction. The training phase is performed off-line, while the on-line phase can classify an image in 1.12 seconds on average. We provide an evaluation using several thousands images, showing that we can achieve a precision of 79% and a recall of 79%. All our code and the hardware design files are released open source.

Embedded systems such as Cyber-Physical Systems (CPS) are typically designed as a network of multiple interacting elements with physical input (or sensors) and output (or actuators). One aspect of interest of open systems is fidelity, or the compliance between physical figures of interest and their internal representation. High fidelity is defined as a stable mapping between actions in the physical domain and intended or expected values in the system domain and deviations from fidelity are quantifiable over time by some appropriate informative variable. In this paper, we provide a model for designing such systems based on a framework for trustworthiness monitoring and we provide a Jason implementation to evaluate the feasibility of our approach. In particular, we build a bridge between a standard publish/subscribe framework for CPS called MQTT and Jason to enable automatic reasoning about trustworthiness.

The role of software systems on societal sustainability has generally not been the subject of substantive research activity. In this paper we examine the role of software engineering practice as an agent of change/impact for societal sustainability through the manifestation of value sensitive concerns. These concerns remain relatively neglected by software design processes except at early stages of user interface design. Here, we propose a conceptual model that can contribute to a translation of value sensitive design from its current focus in participatory design to one located in mainstream software engineering processes. Addressing this need will have an impact of societal sustainability and we outline some of the key research challenges for that journey.

We consider security threats in software installation processes, posed by transitively trusted dependencies between packages from distinct repositories. To analyse them, we present SecureNDC, a Coq implemented calculus using an explicit trust function to bridge repository access and software package installation rights. Thereby, we resolve a version of the minimum install problem under trust conditions on repositories.

Several logics for expressing coalitional ability under resource bounds have been proposed and studied in the literature. Previous work has shown that if only consumption of resources is considered or the total amount of resources produced or consumed on any path in the system is bounded, then the model-checking problem for several standard logics, such as Resource-Bounded Coalition Logic (RB-CL) and Resource-Bounded Alternating-Time Temporal Logic (RB-ATL) is decidable. However, for coalition logics with unbounded resource production and consumption, only some undecidability results are known. In this paper, we show that the model-checking problem for RB-ATL with unbounded production and consumption of resources is decidable.

System integrity can be put at risk by unintentional transitivity of resource access. We present a natural deduction calculus for an access control model with an explicit trust function on resources. Its inference relation is designed to limit unintentionally transitive access from untrusted parties. We also offer results for ordered cut and normalization related to security and hint at a prototype implementation.

Wireless Sensor Networks are becoming one of the most successful choices for the development and deployment of applications in a range of scenarios, from intelligent homes to environment monitoring. Nowadays, there is a growing demand for programming large-scale wireless sensor networks. New programming paradigms should ease the task of building WSN applications that adapt at run-time to changes in the context, in the available resources, and also in user requirements. In this paper we describe PROTEUS, a platform to manage adaptation and reconfiguration, with the aim of supporting the development of WSN applications. After introducing PROTEUS, we show how it can be used to program a dynamic clustering algorithm, where clusters are created and destroyed at runtime, and nodes need to adapt and reconfigure accordingly. We provide a prototype implementation using TinyOS. Some remarks on the work are also presented.

Applications running on mobile devices are intensely context-aware and adaptive. Streams of context values continuously drive these applications, making them very powerful but, at the same time, susceptible to undesired configurations. Such configurations are not easily exposed by existing validation techniques, thereby leading to new analysis and testing challenges. In this paper, we address some of these challenges by defining and applying a new model of adaptive behavior called an Adaptation Finite-State Machine (A-FSM) to enable the detection of faults caused by both erroneous adaptation logic and asynchronous updating of context information, with the latter leading to inconsistencies between the external physical context and its internal representation within an application. We identify a number of adaptation fault patterns, each describing a class of faulty behaviors. Finally, we describe three classes of algorithms to detect such faults automatically via analysis of the A-FSM. We evaluate our approach and the trade-offs between the classes of algorithms on a set of synthetically generated Context-Aware Adaptive Applications (CAAAs) and on a simple but realistic application in which a cell phone's configuration profile changes automatically as a result of changes to the user's location, speed, and surrounding environment. Our evaluation describes the faults our algorithms are able to detect and compares the algorithms in terms of their performance and storage requirements.

The potential of communication networks and middleware to enable the composition of services across organizational boundaries remains incompletely realized. In this paper, we argue that this is in part due to outsourcing risks and describe the possible contribution of Service-Level Agreements (SLAs) to mitigating these risks. For SLAs to be effective, it should be difficult to disregard their original provisions in the event of a dispute between the parties. Properties of understandability, precision, and monitorability ensure that the original intent of an SLA can be recovered and compared to trustworthy accounts of service behavior to resolve disputes fairly and without ambiguity. We describe the design and evaluation of a domain-specific language for SLAs that tend to exhibit these properties and discuss the impact of monitorability requirements on service-provision practices.

The aim of requirements-based testing is to generate test cases from a set of requirements for a given system or piece of software. In this paper we propose a formal semantics for the generation of test cases from requirements by revising and extending the results presented in previous works (e.g.: [21, 20, 13]). We give a syntactic characterisation of our method, defined inductively over the syntax of LTL formulae, and prove that this characterisation is sound and complete, given some restrictions on the formulae that can be used to encode requirements. We provide various examples to show the applicability of our approach.

If an organization depends on the service quality provided by another organization it often enters into a bilateral service level agreement (SLA), which mitigates outsourcing risks by associating penalty payments with poor service quality. Once these agreements are entered into, it becomes necessary to monitor their conditions, which will commonly relate to timeliness, reliability and request throughput, at runtime. We show how these conditions can be translated into timed automata. Acceptance of a timed word by a timed automaton can be decided in quadratic time and because the timed automata can operate while messages are exchanged at runtime there is effectively only a linear run-time overhead. We present an implementation to derive on-line monitors for web services automatically from SLAs using an Eclipse plugin. We evaluate the efficiency and scalability of this approach using a large-scale case study in a service-oriented computational grid.

The testing of the performance of opportunistic communication protocols and applications is usually done through simulation as i) deployments are expensive and should be left to the final stage of the development process, and ii) the number of varying parameters in thesesystems is so high that it would be very hard to conduct thorough testing of all the functionality within a single deployment. Therefore, protocols and applications are often plugged into mobility simulators to test their performance; however, until recently, most of the testing has been conducted with random mobility models which do not mirror reality. Furthermore, despite disconnections playing a veryprominent role in the performance of any opportunistic mobile system, most models do not really account for it. A different approach to testing is the use of real traces of movement collected in specific domains as test cases. These cases, however, do not allow for flexible performance testing, as they are specific for a given scenario withfixed connectivity properties.