Part-of-Speech (POS) tags are natural attributes of words in natural languages, and they are fundamental for natural language analysis. Many automated approaches have been proposed to tag natural language texts. Identifiers in source code have POS tags as well, which are useful for various source code analysis tasks, like code search, code comment generation, and code completion. Currently, state-of-the-art POS taggers originally designed for natural languages are often employed to tag source code identifiers. However, identifiers in source code are significantly different from natural languages. Consequently, POS taggers designed for natural languages could be less accurate in source code identifiers. Recently, several identifier-specific taggers have been proposed within the field of software engineering, but their adoption in practical software engineering tasks remains limited. This raises the question of why these taggers have not been more widely utilized in such tasks. In this article, we investigate the performance of natural language POS taggers on source code identifiers, specifically method names, parameter names, and class names. To do so, we manually annotated identifiers from open source projects in Java, C, and Python, creating a large dataset IDData for evaluation. We then evaluated six widely used natural language POS taggers: NLTK, CoreNLP, OpenNLP, spaCy, Flair, and Stanza, alongside three identifier-specific taggers: SWUM, POSSE, and Ensemble Tagger. Our evaluation reveals that while natural language-oriented POS taggers outperform identifier-specific taggers, their performance on identifiers is still significantly lower compared to their performance on natural language sentences. To understand the underlying reasons for this, we conducted an in-depth analysis, examining factors such as identifier length, POS distribution, syntactic structures, and special tags, which differentiate identifiers from natural language sentences. To further improve POS tagging performance on identifiers, we created a large-scale method name dataset MNTrain with manually labeled tags and retrained the natural language taggers on this new dataset. The results show substantial improvements in method name POS tagging performance, with taggers achieving performance comparable to their results on natural language sentences. Finally, we discuss the significance and practical implications of our findings, offering insights for future research.

Graphical user interface (GUI) prototyping helps to clarify requirements and keep stakeholders engaged in software development. While contemporary approaches retrieve GUIs relevant to a user’s query, little support exists for the actual reuse, i.e., for using an existing GUI to create a new one. To shorten the gap, we investigate GUI-centered reuse via one of the latest artificial intelligence (AI) techniques—vision-language models (VLMs). We report an empirical study involving 73 university students working on ten GUI reuse tasks. Each task is associated with different reuse directions recommended by VLMs and by a natural language (NL) method. In addition, a focused GUI element is provided to offer a starting point for making the actual changes. Our results show that VLMs significantly outperform the NL method in making reuse recommendations, but surprisingly, the focused GUI elements are not consistently modified during reuse. With the assessments made by four experienced designers, we further offer insights into the creativity of human-reuse and AI-reuse results.

Context: As mobile applications (apps) widely spread throughout our society and daily life, various personal information is constantly demanded by apps in exchange for more intelligent and customized functionality. An increasing number of users are voicing their privacy concerns through app reviews on app stores. Objective: The main challenge of effectively mining privacy concerns from user reviews lies in that reviews expressing privacy concerns are overridden by a large number of reviews expressing more generic themes and noisy content. In this work, we propose a novel automated approach to overcome that challenge. Method: Our approach first employs information retrieval and document embeddings to extract candidate privacy reviews in an unsupervised manner , which are further labeled to prepare the annotation dataset. Then, supervised classifiers are trained to automatically identify privacy reviews. Finally, an interpretable topic mining algorithm is designed to detect privacy concern topics contained in the privacy reviews. Results: Experimental results show that the best performing document embedding achieves an average precision of 96.80% in the top 100 retrieved candidate privacy reviews, outperforming the taxonomy-based baseline, which achieves 73.87%. All trained privacy review classifiers achieve an F 1 score above 91%, surpassing the keyword-matching baseline by as much as 7.5% and the large language model baseline by up to 2.74%. For detecting privacy concern topics from privacy reviews, our proposed algorithm achieves both better topic coherence and topic diversity than three strong topic modeling baselines, including LDA . Conclusion: Empirical evaluation results demonstrate the effectiveness of our approach in identifying privacy reviews and detecting user privacy concerns in app reviews.

Mobile applications are widely used by billions of users in their daily work and life. Such GUI software is prone to bugs, potentially degrading user experience. Notably, many bugs in mobile apps are reported by end-users who cannot access the requirements of the app or test cases accompanied by explicitly specified test oracles. It may suggest that such bugs are not identified in the traditional way, i.e., by comparing the actual behaviors of the apps against their expected behaviors explicitly specified in the requirements or test cases. Instead, such bugs are often identified by comparing the actual behaviors against users’ common knowledge of apps, noted as common sense. We refer to such bugs as common sense-violating bugs. Although it is well-known that common sense-violating bugs are common in mobile apps, it remains unclear how popular they are and what kind of common sense principles are violated by them, let alone the relationship among the violated common sense principles. To this end, in this paper, we conduct the first large-scale empirical study on common sense-violating bugs in open-source mobile apps. We manually analyzed 2,808 real-world bug reports across 948 open-sourced mobile apps on GitHub. Our analysis results suggest that 1,006 (35.8%) out of the 2,808 bugs pertain to common sense-violating bugs. From those common sense-violating bugs, we identified a set of common sense principles violated by the buggy behaviors, and built a taxonomy for the common sense principles. Such principles fall into three categories: UI content-related common sense principles, UI layout-related common sense principles, and interaction-related common sense principles. By analyzing the frequency of the common sense principles being violated, we observed that a small set of common sense principles were frequently violated by the majority of common sense-violating bugs: 18 common sense principles, accounting for only 5% of the violated common sense principles, were violated by more than half of the common sense-violating bugs. These findings suggest that identifying the most frequent common sense-violating bugs could be achieved by using a small set of critical common sense principles, which may significantly reduce the cost of common sense-based bug detection. Finally, to demonstrate the feasibility of automated bug detection with common sense-based test oracles, we propose an automated approach to validating whether a given test run violates the most frequently violated common sense principle: No raw error message. Our evaluation results suggest that the automated approach is accurate, whose precision and recall are 91.3% and 91.6%, respectively.

Software developers and maintainers frequently conduct software refactorings to improve software quality. Identifying the conducted software refactorings may significantly facilitate the comprehension of software evolution, and thus facilitate software maintenance and evolution. Besides that, the identified refactorings are also valuable for data-driven approaches in software refactoring. To this end, researchers have proposed a few approaches to identifying software refactorings automatically. However, the performance (especially precision) of such approaches deserves substantial improvement. To this end, in this paper, we propose a novel refactoring detection approach, calledReExtractor+. At the heart ofReExtractor+is a reference-based entity matching algorithm that matches coarse-grained code entities (e.g., classes and methods) between two successive versions, and a context-aware statement matching algorithm that matches statements within a pair of matched methods. We evaluatedReExtractor+on a benchmark consisting of 400 commits from 20 real-world projects. The evaluation results suggested thatReExtractor+significantly outperformed the state of the art in refactoring detection, reducing the number of false positives by 57.4% and improving recall by 18.4%. We also evaluated the performance of the proposed matching algorithms that serve as the cornerstone of refactoring detection. The evaluation results suggested that the proposed algorithms excel in matching code entities, substantially reducing the number of mistakes (false positives plus false negatives) by 67% compared to the state-of-the-art approaches.

Software refactoring is widely conducted in the industry and well-studied in the academic community. There are dozens of software refactoring types, and each type of refactoring often requires its unique tool support and algorithms. Consequently, knowing which types of refactorings are popular in real-world practice and which are less supported by existing tools is highly valuable. To this end, in this paper, we present a large-scale empirical study on software refactorings in real-world open-source Java projects. We first retrieved by keywords 15,860 code commits from GitHub that might contain software refactorings. From the resulting commits, we manually analyzed 1,200 of them and successfully identified 100 types of refactorings from 420 commits. We built a taxonomy for the discovered refactorings, and compared them against the refactoring types supported by state-of-the-art refactoring engines and miners. The comparison results suggest that 61 out of the 100 refactoring types have not yet been explicitly supported by any of the refactoring engines, and any refactoring miners have not explicitly supported 62. The empirical study has identified and revealed 31 under-explored refactorings observed in Java real-world open-source applications but not yet supported by existing refactoring tools. These refactorings may have implications for the development of future tool support and enhancements in the refactoring ecosystem.

Renaming is one of the most popular software refactorings. Although developers may know what the new name should be when they conduct a renaming, it remains valuable for refactoring tools to recommend new names automatically so that developers can simply hit Enter and efficiently accept the recommendation to accomplish the refactoring. Consequently, most IDEs automatically recommend new names for renaming refactorings by default. However, the recommendation made by mainstream IDEs is often incorrect. For example, the precision of IntelliJ IDEA in recommending names for field renamings is as low as 6.3%. To improve the accuracy, in this paper, we propose a context-aware lightweight approach (called CARER) to recommend new names for Java field renamings. Different from mainstream IDEs that rely heavily on initializers and data types of the to-be-renamed fields, CARER exploits both dynamic and static contexts of the renamings as well as naming conventions. We evaluate CARER on 1.1K real-world field renamings discovered from open-source applications. Our evaluation results suggest that CARER can significantly improve the state of the practice in recommending new names for field renamings, improving the precision from 6.30% to 61.15%, and recall from 6.30% to 41.50%. Our evaluation results also suggest that CARER is as efficient as IntelliJ IDEA is, making it suitable to be integrated into IDEs.

Version control systems are widely used to manage the evolution of software applications. However, such version control systems take source code as lines of plain text, and thus they cannot present the evolution of software entities embedded in the source code. To this end, a few approaches have been proposed to match software entities before and after a given commit, known as software entity matching algorithms. However, the accuracy of such algorithms requires further improvement. In this paper, we propose an automated iterative algorithm (called ReMapper) to match software entities between two successive versions. The key insight of ReMapper is that the qualified name, the implementation, and the references of a software entity together can distinguish it from others. It matches software entities iteratively because the mapping depends on the reference-based similarity whereas the reference-based similarity depends on the mapping of entities as well. We evaluated ReMapper on a benchmark consisting of 215 commits from 21 real-world projects. Our evaluation results suggest that ReMapper substantially outperformed the state of the art, reducing the number of mistakes (false positives plus false negatives) substantially by 85.8%. We also evaluated to what extent it may improve the automated refactoring discovery (mining) that relies heavily on automated entity matching. Our evaluation results suggest that it substantially improved the state of the art in refactoring discovery, improving recall by 6.9% and reducing the number of false positives by 72.6%.

Creativity focuses on the generation of novel and useful ideas. In this paper, we propose an approach to automatically generating creative requirements candidates via the adversarial examples resulted from applying small changes (perturbations) to the original requirements descriptions. We present an architecture where the perturbator and the classifier positively influence each other. Meanwhile, we ensure that each adversarial example is uniquely traceable to an existing feature of the software, instrumenting explainability. Our experimental evaluation of six datasets shows that around 20% adversarial shift rate is achievable. In addition, a human subject study demonstrates our results are more clear, novel, and useful than the requirements candidates outputted from a state-of-the-art machine learning method. To connect the creative requirements closer with software development, we collaborate with a software development team and show how our results can support behavior-driven development for a web app built by the team.

Feature envy is one of the well-recognized code smells that should be removed by software refactoring. A major challenge in feature envy detection is that traditional approaches are less accurate whereas deep learning-based approaches are suffering from the lack of high-quality large-scale training data. Although existing refactoring detection tools could be employed to discover real-world feature envy examples, the noise (i.e., false positives) within the resulting data could significantly influence the quality of the training data as well as the performance of the models trained on the data. To this end, in this paper, we propose a sequence of heuristic rules and a decision tree-based classifier to filter out false positives reported by state-of-the-art refactoring detection tools. The data after filtering serve as the positive items in the requested training data. From the same subject projects, we randomly select methods that are different from positive items as negative items. With the real-world examples (both positive and negative examples), we design and train a deep learning-based binary model to predict whether a given method should be moved to a potential target class. Different from existing models, it leverages additional features, i.e., coupling between methods and classes (CBMC) and the message passing coupling between methods and classes (MCMC) that have not yet been exploited by existing approaches. Our evaluation results on real-world open-source projects suggest that the proposed approach substantially outperforms the state of the art in feature envy detection, improving precision and recall by 38.5% and 20.8%, respectively.

Bug-related research, e.g., fault localization, program repair, and software testing, relies heavily on high-quality and large-scale software bug repositories. The importance of such repositories is twofold. On one side, real-world bugs and their associated patches may inspire novel approaches for finding, locating, and repairing software bugs. On the other side, the real-world bugs and their patches are indispensable for rigorous and meaningful evaluation of approaches to software testing, fault localization, and program repair. To this end, a number of software bug repositories, e.g., iBUGS and Defects4J, have been constructed recently by mining version control systems and bug tracking systems. However, fully automated construction of bug repositories by simply taking bug-fixing commits from version control systems often results in inaccurate patches that contain many bug-irrelevant changes. Although we may request experts or developers to manually exclude the bug-irrelevant changes (as the authors of Defects4J did), such extensive human intervention makes it difficult to build large-scale bug repositories. To this end, in this paper, we propose an automatic approach, calledBugBuilder, to construct bug repositories from version control systems. Different from existing approaches, it automatically extracts complete and concise bug-fixing patches and excludes bug-irrelevant changes. It first detects and excludes software refactorings involved in bug-fixing commits.BugBuilderthen enumerates all subsets of the remaining part, and discards invalid subsets by compilation and software testing. If exactly a single subset survives the validation, this subset is taken as the complete and concise bug-fixing patch for the associated bug. In case multiple subsets survive, BugBuilder employs a sequence of heuristics to select the most likely one. Evaluation results on 809 real-world bug-fixing commits in Defects4J suggest thatBugBuildersuccessfully extracted complete and concise bug-fixing patches from forty-three percent of the bug-fixing commits, and its precision (99%) was even higher than human experts. We also built a bug repository, called GrowingBugs, with the proposed approach. The resulting repository serves as evidence of the usefulness of the proposed approach, as well as a publicly available benchmark for bug-related research.

Fault injection attacks can completely bypass typical code defenses on embedded systems and lead to severe consequences, such as leaking encryption keys and bypassing secure boot. However, programmers lack awareness of fault injection attacks and there are limited tools to automatically detect these vulnerabilities. In this paper, we conduct an empirical evaluation over 15 C files (5,005 lines of code) selected from GitHub projects designed for embedded systems. We find that 3.72% of lines (i.e., 186 lines) are vulnerable under fault injection attacks. Moreover, we develop a new tool, named FaultHunter, which can automatically detect fault injection vulnerabilities in C code. Our detection method consists of two key building blocks, including parse tree generation and token search. Our experimental results show that FaultHunter can achieve a detection performance with 90.3% recall and 56.4% precision.

Cache-based website fingerprinting attacks can infer which website a user visits by measuring CPU cache activities. Studies have shown that an attacker can achieve high accuracy with a low sampling rate by monitoring cache occupancy of the entire Last Level Cache. Although a defense has been proposed, it was not effective when an attacker adapts and retrains a classifier with defended data. In this paper, we propose a new defense, referred to as cache shaping, to preserve user privacy against cache-based website fingerprinting attacks. Our proposed defense produces dummy cache activities by introducing dummy I/O operations and implementing with multiple processes, which hides fingerprints when a user visits websites. Our experimental results over large-scale datasets collected from multiple web browsers and operating systems show that our defense remains effective even if an attacker retrains a classifier with defended cache traces. We demonstrate the efficacy of our defense in the closed-world setting and the open-world setting by leveraging deep neural networks as classifiers.

Requirements terminology defines and unifies key specialized and/or technical concepts of the software system, which is significant for understanding the application domain in requirements engineering (RE). However, manual terminology extraction from natural language requirements is laborious and expensive, especially with large scale requirements specifications. In this paper, we aim to employ natural language processing (NLP) techniques and machine learning (ML) algorithms to automatically extract and rank the requirements terms to support high-level feature modeling. To this end, we propose an automatic framework composed of noun phrase identification technique for requirements terms extraction and TextRank combined with semantic similarity for terms ranking. The final ranked terms are organized as a hierarchy, which can be used to help name elements when performing feature modeling. In the quantitative evaluation, our extraction method performs better than three baseline methods in recall with comparable precision. Moreover, our adapted TextRank algorithm can rank more relevant terms at the top positions in terms of average precision compared with most baselines. An illustrative example on the smart home domain further shows the usefulness of our framework in aiding elements naming during feature modeling. The research results suggest that proper adoption and adaption of NLP and ML techniques according to the characteristics of specific RE task could provide automation support for problem domain understanding.

Design models are essential for multiple tasks in software engineering, such as consistency checking, code generation, and design-to-code tracing. Almost all of these works need a semantically analyzable model to represent the software architecture design, e.g., a UML class diagram. Unfortunately, many design models are stored as images and embedded in text-based documentations, impeding the usage and evolution of these models. Thus, identifying the semantic elements of design models from images is important. However, there are lots of design models with different elements in diverse representations, which ask for different approaches for semantic elements extraction. In order to grasp an overview of the commonly used design model types, we conduct a survey on both open-source communities and industry. We find that design model diagrams are usually embedded in documents as pictures (73.72%), and UML class diagrams are the most used type (55.43%). Considering that there are limited studies on automatically recognizing the semantic elements from class diagram images, we propose an approach, which we call ReSECDI. ReSECDI includes our customized design for extracting UML class diagram elements based on image processing technologies. We design a rectangle clustering method for class recognition, to address the challenge that the presentation of classes may vary due to the UML constraints and tools’ styles. We design a polygonal line merging method and double-recognition-approximation method for relationship recognition to deal with the impact of low resolution on the detection. We evaluate the applicability of ReSECDI on 30 images drawn by three popular UML tools and 50 diagrams collected from the open-source communities, and get promising performances. ReSECDI can recognize all types of semantic elements commonly used. It has well applicability and can be used to process the images drawn by the mainstream tools and stored in different resolutions. Editor’s note: Open Science material was validated by the Journal of Systems and Software Open Science Board.

To release developers from time-consuming software development, many approaches have been proposed to generate source code automatically according to software requirements. With significant advances in deep learning and natural language processing, deep learning-based approaches are proposed to generate source code from natural language descriptions. The key insight is that given a large corpus of software requirements and their corresponding implementations, advanced deep learning techniques may learn how to translate software requirements into source code that fulfill such requirements. Although such approaches are reported to be highly accurate, they are evaluated on datasets that are rather small, lack of diversity, and significantly different from real-world software requirements. To this end, we build a large scale dataset that is composed of longer requirements as well as validated implementations. We evaluate the state-of-the-art approaches on this new dataset, and the results suggest that their performance on our dataset is significantly lower than that on existing datasets concerning the common metrics, i.e., BLEU. Evaluation results also suggest that the generated programs often contain syntactic and semantical errors, and none of them can pass even a single predefined test case. Further analysis reveals that the state-of-the-art approaches learn little from software requirements, and most of the successfully generated statements are popular statements in the training programs. Based on this finding, we propose a popularity-based approach that always generates the most popular statements in training programs regardless of the input (software requirements). Evaluation results suggest that none of the state-of-the-art approaches can outperform this simple statistics-based approach. As a conclusion, deep learning-based program generation requires significant improvement in the future, and our dataset may serve as a basis for future research in this direction.

Cyber attacks targeting software applications have a tremendous impact on our daily life. For example, attackers have utilized vulnerabilities of web applications to steal and gain unauthorized use of sensitive data stored in these systems. Previous studies indicate that security testing is highly precise, and therefore is widely applied to validate individual security requirements. However, dependencies between security requirements may cause additional vulnerabilities. Manual dependency detection faces scalability challenges, e.g., a previous study shows that the pairwise dependency analysis of 40 requirements would take around 12 hours. In this article, we present a novel approach which integrates the interdependency among high-level security requirements, such as those documented in policies, regulations, and standards. We then use automated requirements tracing methods to identify product-level security requirements and their dependencies. Our manual analysis of HIPAA and FIPS 200 leads to the identification of five types of high-level security requirements dependencies, which further inform the automated tracing methods and guide the designs of system-level security tests. Experimental results on five projects in healthcare and education domains show the significant recall improvements at 81 percent. Our case study on a deployed production system uncovers four previously unknown vulnerabilities by using the detected requirements dependencies as test paths, demonstrating our approach's value in connecting requirements engineering with security testing.

Background: Metamorphic testing emerges as a simple and effective approach for testing scientific software; yet, its adoption in actual scientific software projects is less studied.

High-quality and large-scale repositories of real bugs and their concise patches collected from real-world applications are critical for research in software engineering community. In such a repository, each real bug is explicitly associated with its fix. Therefore, on one side, the real bugs and their fixes may inspire novel approaches for finding, locating, and repairing software bugs; on the other side, the real bugs and their fixes are indispensable for rigorous and meaningful evaluation of approaches for software testing, fault localization, and program repair. To this end, a number of such repositories, e.g., Defects4J, have been proposed. However, such repositories are rather small because their construction involves expensive human intervention. Although bug-fixing code commits as well as associated test cases could be retrieved from version control systems automatically, existing approaches could not yet automatically extract concise bug-fixing patches from bug-fixing commits because such commits often involve bug-irrelevant changes. In this paper, we propose an automatic approach, called BugBuilder, to extracting complete and concise bug-fixing patches from human-written patches in version control systems. It excludes refactorings by detecting refactorings involved in bug-fixing commits, and reapplying detected refactorings on the faulty version. It enumerates all subsets of the remaining part and validates them on test cases. If none of the subsets has the potential to be a complete bug-fixing patch, the remaining part as a whole is taken as a complete and concise bug-fixing patch. Evaluation results on 809 real bug-fixing commits in Defects4J suggest that BugBuilder successfully generated complete and concise bug-fixing patches for forty percent of the bug-fixing commits, and its precision (99%) was even higher than human experts.

Abstraction identification is aimed at discovering significant domain terms. Prior work, notably AbstFinder and RAI (relevance-driven abstraction identification), has introduced the core ideas, but offered only limited tool support. This paper presents our abstraction identification tool, Co-AI, built on the Google Colab environment allowing the users to run the tool within their web browsers, promoting tool adoption and extension. Co-AI integrates the Wikipedia pages as the domain corpus, and identifies the candidate abstractions with a set of natural language processing (NLP) patterns. Co-AI is available at: https://colab.research.google.com/drive/1ur5KILoi_n-3KY0_vJcMBQDtiSYgcYeP?usp=sharing and we welcome the community’s feedback of our tool.

Abstractions are significant domain terms that have assisted in requirements elicitation and modeling. To extend the assistance towards requirements validation, we present in this paper an automated approach to identifying the abstractions for supporting requirements-based testing. We select relevant Wikipedia pages to serve as a domain corpus that is independent from any specific software system. We further define five novel patterns based on part-of-speech tagging and dependency parsing, and frame our candidate abstractions in the form ofpairs for better testability. We evaluate our approach with six software systems in two application domains: Electronic health records and Web conferencing. The results show that our abstractions are more accurate than those generated by two of the state-of-the-art techniques. Initial findings also indicate our abstractions’ capabilities of revealing bugs and matching the environmental assumptions created manually.

Abbreviations are common in source code. Properly designed abbreviations may significantly facilitate typing, typesetting, and reading of lengthy source code. However, abbreviations, if used improperly, may also significantly reduce the readability and maintainability of source code. Although a few automated approaches have been proposed to suggest full terms for given abbreviations, to the best of our knowledge, there is no automated approaches to suggest whether abbreviations are used properly, i.e., whether they should be replaced with corresponding full terms. Notably, it is often challenging for inexperienced developers and maintainers to make such decisions. To this end, in this paper, we propose an automated approach to assisting developers and maintainers in making the decisions. The rationale of the approach is that abbreviations should not be expanded if the expansion would result in unacceptably lengthy identifiers or if developers/maintainers can easily figure out the meaning (full terms) of the abbreviations based on their domain knowledge or contexts of the abbreviations. From a corpus of programs, we leverage data mining techniques to discover common abbreviations that are frequently employed by various developers in similar contexts. The key of the data mining is to turn the problem of mining common abbreviations into the maximal clique problem that has been extensively studied. We suggest to not expand given abbreviation if it matches at least one of the discovered common abbreviations. From the same corpus, we also calculate the probability distribution for the length of different types of identifier, e.g., variable names and method names. The probability distribution specifies how likely an identifier of type T is composed of exactly n characters. Our heuristic is to not expand the abbreviation if the probability of its enclosing identifier would be reduced by the expansion. Finally, we also suggest to not expand the abbreviation if its full terms are contained in surrounding contexts of the abbreviation, i.e., tokens on the same source code line. Other abbreviations that do not receive suggestions from the proposed approach are expected to be replaced with their full terms. Our evaluation results on 1,818 abbreviations from five open-source applications suggest that the proposed approach is accurate with a high accuracy of 95%.

Artificial intelligence and deep learning are becoming increasingly prevalent in contemporary software solutions. Explainable artificial intelligence (XAI) tools attempt to address the black box nature of the deep learning models and make them more understandable to humans. In this work, we apply three state-of-the-art XAI tools in a real-world case study. Our study focuses on predicting combined sewer overflow events for a municipal wastewater treatment organization. Through a data driven inquiry, we collect both qualitative information via stakeholder interviews and quantitative measures. These help us assess the predictive accuracy of the XAI tools, as well as the simplicity, soundness, and insightfulness of the produced explanations. Our results not only show the varying degrees that the XAI tools meet the requirements, but also highlight that domain experts can draw new insights from complex explanations that may differ from their previous expectations.

Modern communication platforms such as Gitter and Slack play an increasingly critical role in supporting software teamwork, especially in open source development.Conversations on such platforms often contain intensive, valuable information that may be used for better understanding OSS developer communication and collaboration. However, little work has been done in this regard. To bridge the gap, this paper reports a first comprehensive empirical study on developers' live chat, investigating when they interact, what community structures look like, which topics are discussed, and how they interact. We manually analyze 749 dialogs in the first phase, followed by an automated analysis of over 173K dialogs in the second phase. We find that developers tend to converse more often on weekdays, especially on Wednesdays and Thursdays (UTC), that there are three common community structures observed, that developers tend to discuss topics such as API usages and errors, and that six dialog interaction patterns are identified in the live chat communities. Based on the findings, we provide recommendations for individual developers and OSS communities, highlight desired features for platform vendors, and shed light on future research directions. We believe that the findings and insights will enable a better understanding of developers' live chat, pave the way for other researchers, as well as a better utilization and mining of knowledge embedded in the massive chat history.

Traceability plays an essential role in assuring that software and systems are safe to use. Automated requirements traceability faces the low precision challenge due to a large number of false positives being returned and mingled with the true links. To overcome this challenge, we present a mutation-driven method built on the novel idea of proactively creating many seemingly correct tracing targets (i.e., mutants of a state machine diagram), and then exploiting model checking within process mining to automatically verify whether the safety requirement's properties hold in the mutants. A mutant is killed if its model checking fails; otherwise, it is survived. We leverage the underlying killed-survived distinction, and develop a correlation analysis procedure to identify the traceability links. Experimental evaluation results on two automotive systems with 27 safety requirements show considerable precision improvements compared with the state-of-the-art.

Complementarity between activities reveals that doing any one of them increases the returns to doing the others. In other words, complementarity leads to the synergistic effect that the whole is greater than the sum of its parts. Identifying and exploiting complementarity can benefit many cybernetic activities, where human-machine interactions are inherent and dominant. One such activity is requirements tracing that helps stakeholders to track the status of their goals. Although various kinds of support for human analysts in requirements tracing have been proposed, little is known about the nature of complementarity when different tracing practices are involved. In this paper, we explore the role of complementarity by considering together the tagging-to-trace (T2T) and learning-to-trace (L2T) activities. We present a novel approach to examining which T2T and L2T practices enhance the qualities of each other. Our approach also uncovers the environmental factors which the complementarity is sensitive to. Applying our approach to the logs of 140 analyst-tracing units offers operational insights into the rigorous detection of complementarity and shows the importance of understanding the cybernetic conditions under which the requirements tracing practices may in fact be complementary.

Software developers dedicate a major portion of their development effort towards testing and quality assurance (QA) activities, especially during and around the implementation phase. Nevertheless, we continue to see an alarmingly increasing trend in the cost and consequences of software failure. In an attempt to mitigate such loss and address software issues at a much earlier stage, researchers have recently emphasized on the successful coordination of requirements engineering and testing. In addition, the notion of requirements-based testing (RBT) has also emerged with a focus on checking the correctness, completeness, unambiguity, and logical consistency of requirements. One seminal work points out that requirements reside in the environment which is comprised of certain problem domain phenomena. Environmental assertions, which connect some of these phenomena in the indicative mood, play a key role in deciding whether a software solution is acceptable. Despite that requirements are located in the environment, little is known about if and how the environment assertions would impact testing and QA activities. In order to address this gap, we present a detailed empirical study, with 114 developers, on the prominence of environment assertions in RBT. Although the results suggest that paying attention to correct, complete, and useful environment assertions has a positive impact on RBT, developers often face difficulty in formulating good assertions from scratch. Our work, to that end, illuminates the potential usefulness of automated support in generating environment assertions.

During software evolution, developers often receive new requirements expressed as feature requests. To implement the requested features, developers have to perform necessary modifications (refactorings) to prepare for new adaptation that accommodates the new requirements. Software refactoring is a well-known technique that has been extensively used to improve software quality such as maintainability and extensibility. However, it is often challenging to determine which kind of refactorings should be applied. Consequently, several approaches based on various heuristics have been proposed to recommend refactorings. However, there is still lack of automated support to recommend refactorings given a feature request. To this end, in this paper, we propose a novel approach that recommends refactorings based on the history of the previously requested features and applied refactorings. First, we exploit the stateof-the-art refactoring detection tools to identify the previous refactorings applied to implement the past feature requests. Second, we train a machine classifier with the history data of the feature requests and refactorings applied on the commits that implemented the corresponding feature requests. The machine classifier is then used to predict refactorings for new feature requests. We evaluate the proposed approach on the dataset of 43 open source Java projects and the results suggest that the proposed approach can accurately recommend refactorings (average precision 73%).

Automated program repair (APR) has great potential to reduce the effort and time-consumption in software maintenance and becomes a hot topic in software engineering recently with many approaches being proposed.Multi-location program repair has always been a challenge in this field since its complexity in logic and structure.While some approaches do not claim to have the features for solving multi-location bugs, they generate correct patches for these defects in practice.In this paper, we first make an observation on multi-location bugs in Defects4J and divide them into two categories (i.e., similar and relevant multi-location bugs) based on the repair actions in their patches.We then summarize the situation of multi-location bugs in Defects4J fixed by current tools.We analyze the twenty-two patches generated by current tools and propose two feasible strategies for fixing multi-location bugs, illustrating them through two detailed case studies.At last, preliminary results prove the feasibility of our methods with the repair of two bugs that have never been fixed before.By learning from successful experience in the past, this paper points out possible ways ahead for multi-location program repair.

In[1], Li Da Xu’s main affiliation should be Old Dominion University, Norfolk, VA 23529 USA.

Automated production systems are critical enablers for Industry 4.0 because these design-to-order, custom-built mechatronic systems are not only capable of delivering automation capabilities to satisfy the stakeholder requirements in the manufacturing/production domain, but doing so for a long period of time (e.g., several decades) during which numerous changing needs shall also be accounted for. Although traceability has long been recognized as key to sustain changes, little is known about how the traceability information is managed in place, i.e., in the native environments where the engineering artifacts reside. We contribute in this paper a survey of traceability support within state-of-the-practice tools: seven for programming logic controllers and six for building models in systems modeling language. We draw the similarities and differences from our survey results, and further present a design by leveraging the in-place traceability to better support the development and evolution of automated production systems.

Requirements traceability provides critical support throughout all phases of software engineering. Automated tracing based on information retrieval (IR) reduces the effort required to perform a manual trace. Unfortunately, IR-based trace recovery suffers from low precision due to polysemy, which refers to the coexistence of multiple meanings for a term appearing in different requirements. Latent semantic indexing (LSI) has been introduced as a method to tackle polysemy, as well as synonymy. However, little is known about the scope and significance of polysemous terms in requirements tracing. While quantifying the effect, we present a novel method based on artificial neural networks (ANN) to enhance the capability of automatically resolving polysemous terms. The core idea is to build an ANN model which leverages a term's highest-scoring coreferences in different requirements to learn whether this term has the same meaning in those requirements. Experimental results based on 2 benchmark datasets and 6 long-lived open-source software projects show that our approach outperforms LSI on identifying polysemous terms and hence increasing the precision of automated tracing.

Work in information foraging theory presumes that software developers have a predefined patch of information (e.g., a Java class) within which they conduct a search task. However, not all tasks have easily delineated patches. Requirements traceability, where a developer must traverse a combination of technical artifacts and social structures, is one such task. We examine requirements socio-technical graphs to describe the key relationships that a patch should encode to assist in a requirements traceability task. We then present an algorithm, based on spreading activation, which extracts a relevant set of these relationships as a patch. We test this algorithm in requirements repositories of four open-source software projects. Our results show that applying this algorithm creates useful patches with reduced superfluous information.

To understand requirements traceability in practice, we contribute, in this paper, an automated approach to identifying questions from requirements repositories and examining their answering status. Applying our approach to 345 open-source projects results in 20622 questions, among which 53% and 15% are classified as successfully and unsuccessfully answered, respectively. By constructing a novel requirements socio-technical graph, we explore the impact of stakeholder-artifact relationships on traceability. The number of people, surprisingly, has little influence compared to other graph-theoretic measures like the clustering coefficient. Based on the repository mining results, we formulate a set of novel hypotheses about traceability. A case study supports some hypotheses while offering new insights.

In many critical industrial information systems, tracking a dependability requirement is instrumental to the verification and validation (V&V) of security, privacy, and other dependability concerns. Automated traceability tools employ information retrieval methods to recover candidate links, which saves much manual effort. Integrating relevance feedback (RF) could potentially improve the retrieval effectiveness by soliciting the relevance judgments on a subset of the retrieval results and then incorporating the feedback into subsequent retrieval. However, little is known about how to use RF to trace dependability requirements. In this paper, we propose a novel term-based RF algorithm that leverages the term usage context to recommend positive and negative feedback. Experiments on two software datasets show that our algorithm significantly outperforms the contemporary link-based RF tracing method. Our work not only contributes a new solution to dependability requirements' V&V, but also enables further automation to reduce the manual effort in the development life cycle of dependable industrial systems.

A panel discussing the role of requirements engineering (RE) in agile software development is organized at the 25th IEEE International Requirements Engineering Conference (RE'17) taking place in Lisbon, Portugal during September 4-8, 2017. Agile software practices introduce important changes to traditional understandings about requirements, such as how much to elicit and model, in which form to document, and what serves as good stopping criteria for doing RE. This panel invites members who have a significant presence in the field of RE, and engages them in a serious debate. The objective of the panel is to shed light on how to embrace agile into the RE community by sharing a diversity of views from the panelists.

During programming, end-user developers constantly go to search engines to seek for information. The search engine is of significant help since it ranks the webpage links according to relevance. However, the time cost of foraging a webpage also affects if and how soon a developer can obtain a satisfying answer. In this paper, we use operationalizable constructs from Information Foraging Theory to identify two features: information accumulation and information amount for a webpage, which we hypothesize could assist developers in selecting appropriate webpages. We then invited 20 participants to perform a lab experiment of two software change tasks. The results supported our hypothesis by two findings. When having the tool support, the participants used less task completion time, and tended to visit more easy-to-forage webpages.

The use of secure HTTP calls is a first and critical step toward securing the Android application data when the app interacts with the Internet. However, one of the major causes for the unencrypted communication is app developer's errors or ignorance. Could the paradigm of literally repetitive and ineffective emphasis shift towards emphasis as a mechanism? This paper introduces emphaSSL, a simple, practical and readily-deployable way to harden networking security in Android applications. Our emphaSSL could guide app developer's security development decisions via real-time feedback, informative warnings and suggestions. At its core of emphaSSL, we use a set of rigorous security rules, which are obtained through an in-depth SSL/TLS security analysis based on security requirements engineering techniques. We implement emphaSSL via the PMD and evaluate it against 75 open- source Android applications. Our results show that emphaSSL is effective at detecting security violations in HTTPS calls with a very low false positive rate, around 2%. Furthermore, we identified 164 substantial SSL mistakes in these testing apps, 40% of which are potentially vulnerable to man-in-the-middle attacks. In each of these instances, the vulnerabilities could be quickly resolved with the assistance of our highlighting messages in emphaSSL. Upon notifying developers of our findings in their applications, we received positive responses and interest in this approach.

Compared to building a single requirements view, modeling stakeholder viewpoints and then merging them is shown to improve the understanding of the problem domain, but also very time consuming. How has the situation changed? This paper reports our replication of a case study, where we take theoretical replication's advantage to mitigate the original study design's threat and to embrace an important evolving factor, namely automated tool support for producing i* models. Our replicate case study verifies the rich domain understanding gained through viewpoint-based modeling, and updates the prior results by showing the time saving enabled by the tool. Our work offers operational insights into independent, theoretical replications. These insights, we believe, can advance requirements engineering research toward an empirically backed body of knowledge.

The value of traceability is in its use. How do different software engineering tasks affect the tracing of the same requirement? In this paper, we answer the question via an empirical study where we explicitly assign the participants into 3 trace-usage groups of one requirement: finding its implementation for verification and validation purpose, changing it within the original software system, and reusing it toward another application. The results uncover what we call "gray links"--around 20% of the total traces are voted to be true links with respect to only one task but not the others. We provide a mechanism to identify such gray links and discuss how they can be leveraged to advance the research and practice of value-based requirements traceability.

Group size is a key factor in collaborative software development and many other cybernetic applications where task assignments are important. While methods exist to estimate its value for proprietary projects, little is known about how group size affects distributed and decentralized cybernetic applications and in particular open source software (OSS) development. This paper presents a novel approach in which we frame developers' collective resolution of OSS change tasks as a social information foraging problem. This new perspective enables us to predict the optimal group size and quantify group size's effect on individual performance. We test the theory with data mined from two projects: 1) Firefox and 2) Mylyn. This paper not only uncovers the mismatch of optimal and actual group sizes, but also reveals the association of optimality with improved productivity. In addition, the social-level productivity gain is observed as project evolves. We show this paper's impact by extending the frontiers of knowledge in two areas: 1) social coding and 2) recommendation systems.

Developers often spend valuable time navigating and seeking relevant code in software maintenance. Currently, there is a lack of theoretical foundations to guide tool design and evaluation to best shape the code base to developers. This paper contributes a unified code navigation theory in light of the optimal food-foraging principles. We further develop a novel framework for automatically assessing the foraging mechanisms in the context of program investigation. We use the framework to examine to what extent the clustering of software entities affects code foraging. Our quantitative analysis of long-lived open-source projects suggests that clustering enriches the software environment and improves foraging efficiency. Our qualitative inquiry reveals concrete insights into real developer's behavior. Our research opens the avenue toward building a new set of ecologically valid code navigation tools.

Requirements engineering (RE), framed as a creative problem solving process, plays a key role in innovating more useful and novel requirements and improving a software system's sustainability. Existing approaches, such as creativity workshops and feature mining from web services, facilitate creativity by exploring a search space of partial and complete possibilities of requirements. To further advance the literature, we support creativity from a combinational perspective, i.e., making unfamiliar connections between familiar possibilities of requirements. In particular, we propose a novel framework that extracts familiar ideas from the requirements and stakeholders' comments using topic modeling and applies part-of-speech tagging to obtain unfamiliar idea combinations. We apply our framework on two large open source software systems and further report a human subject evaluation. The results show that our framework complements existing approaches by generating original and relevant requirements in an automated manner.

Just-in-time requirements management, characterized by lightweight representation and continuous refinement of requirements, fits many iterative and incremental development projects. Being lightweight and flexible, however, can cause wasteful and procrastinated implementation, leaving certain stakeholder goals not satisfied. This paper proposes traceability-enabled refactoring aimed at fulfilling more requirements fully. We make a novel use of requirements traceability to accurately locate where the software should be refactored, and develop a new scheme to precisely determine what refactorings should be applied to the identified places. Our approach is evaluated through an industrial study. The results show that our approach recommends refactorings more appropriately than a contemporary recommender.

Studying human analyst's behavior in automated tracing is a new research thrust. Building on a growing body of work in this area, we offer a novel approach to understanding requirements analyst's information seeking and gathering. We model analysts as predators in pursuit of prey - the relevant traceability information, and leverage the optimality models to characterize a rational decision process. The behavior of real analysts with that of the optimal information forager is then compared and contrasted. The results show that the analysts' information diets are much wider than the theory's predictions, and their residing in low-profitability information patches is much longer than the optimal residence time. These uncovered discrepancies not only offer concrete insights into the obstacles faced by analysts, but also lead to principled ways to increase practical tool support for overcoming the obstacles.

We propose a novel approach for evaluating software clustering algorithms in the context of program comprehension. Based on the assumption that program comprehension is a task-driven activity, our approach utilizes interaction logs from previous maintenance sessions to automatically devise multiple comprehension-aware and task-sensitive decompositions of software systems. These decompositions are then used as authoritative figures to evaluate the effectiveness of various clustering algorithms. Our approach addresses several challenges associated with evaluating clustering algorithms externally using expert-driven authoritative decompositions. Such limitations include the subjectivity of human experts, the availability of such authoritative figures, and the decaying structure of software systems. We conduct an experimental analysis using two datasets, including an open-source system and a proprietary system, to test the applicability of our approach and validate our research claims.

Modern traceability tools employ information retrieval (IR) methods to generate candidate traceability links. These methods track textual signs embedded in the system to establish relationships between software artifacts. However, as software systems evolve, new and inconsistent terminology finds its way into the system's taxonomy, thus corrupting its lexical structure and distorting its traceability tracks. In this paper, we argue that the distorted lexical tracks of the system can be systematically re-established through refactoring, a set of behavior-preserving transformations for keeping the system quality under control during evolution. To test this novel hypothesis, we investigate the effect of integrating various types of refactoring on the performance of requirements-to-code automated tracing methods. In particular, we identify the problems of missing, misplaced, and duplicated signs in software artifacts, and then examine to what extent refactorings that restore, move, and remove textual information can overcome these problems respectively. We conduct our experimental analysis using three datasets from different application domains. Results show that restoring textual information in the system has a positive impact on tracing. In contrast, refactorings that remove redundant information impact tracing negatively. Refactorings that move information among the system modules are found to have no significant effect. Our findings address several issues related to code and requirements evolution, as well as refactoring as a mechanism to enhance the practicality of automated tracing tools.

For many software projects, keeping requirements on track needs an effective and efficient path from data to decision. Visual analytics creates such a path that enables the human to extract insights by interacting with the relevant information. While various requirements visualization techniques exist, few have produced end-to-end values to practitioners. In this paper, we advance the literature on visual requirements analytics by characterizing its key components and relationships. This allows us to not only assess existing approaches, but also create tool enhancements in a principled manner. We evaluate our enhanced tool supports through a case study where massive, heterogeneous, and dynamic requirements are processed, visualized, and analyzed. In particular, our study illuminates how increased interactivity of requirements visualization could lead to actionable decisions.

Numerous software architecture proposals are available to industrial information engineers in developing their enterprise information systems. While those proposals and corresponding methodologies are helpful to engineers in determining appropriate architecture, the systematic methods for the evaluation of software architecture are scarce. To select appropriate software architecture from various alternatives appropriately, a scenario-based method has been proposed to assess how software architecture affects the fulfillment of business requirements. The empirical evaluation on the selection of a supply chain software tool has shown that the developed method offers remarkable insights of software development and can be incorporated into the industrial informatics practice of an organization with a moderate cost.

The software entities of an object-oriented system should be organized in such a way that "spatial relatedness entails semantic relatedness". We refer this as the tenet of "topical locality" and argue that it is fundamental for the code base to be navigable. In this paper, we propose a novel experimental framework to test this key tenet and use large-scale open-source projects to assess three relationships. In particular, we find that: (1) class name along with header comments conveys class body's topic; (2) a code line is indicative of its surroundings; and (3) a contiguous code fragment may serve as a snapshot of the entire class. Our work not only shows the foundations necessary for the success of many code navigation approaches, but also opens avenues for further tool enhancements.

Human analysts working with automated tracing tools need to directly vet candidate traceability links in order to determine the true traceability information. Currently, human intervention happens at the end of the traceability process, after candidate traceability links have already been generated. This often leads to a decline in the results' accuracy. In this paper, we propose an approach, based on semantic relatedness (SR), which brings human judgment to an earlier stage of the tracing process by integrating it into the underlying retrieval mechanism. SR tries to mimic human mental model of relevance by considering a broad range of semantic relations, hence producing more semantically meaningful results. We evaluated our approach using three datasets from different application domains, and assessed the tracing results via six different performance measures concerning both result quality and browsability. The empirical evaluation results show that our SR approach achieves a significantly better performance in recovering true links than a standard Vector Space Model (VSM) in all datasets. Our approach also achieves a significantly better precision than Latent Semantic Indexing (LSI) in two of our datasets.

Modern requirements tracing tools employ information retrieval methods to automatically generate candidate links. Due to the inherent trade-off between recall and precision, such methods cannot achieve a high coverage without also retrieving a great number of false positives, causing a significant drop in result accuracy. In this paper, we propose an approach to improving the quality of candidate link generation for the requirements tracing process. We base our research on the cluster hypothesis which suggests that correct and incorrect links can be grouped in high-quality and low-quality clusters respectively. Result accuracy can thus be enhanced by identifying and filtering out low-quality clusters. We describe our approach by investigating three open-source datasets, and further evaluate our work through an industrial study. The results show that our approach outperforms a baseline pruning strategy and that improvements are still possible.

Clustering is of great practical value in discovering natural groupings of large numbers of requirements artifacts. Clustering-based visualization has shown promise in supporting requirements tracing. In this paper, we transform the success to a wider range of clustering-based visual exploration tasks in requirements engineering. We describe ReCVisu, a requirements exploration tool based on quantitative visualizations. We discuss the key features of ReCVisu and its potential improvements over previous work.

A major software engineering challenge is to understand the fundamental mechanisms that underlie the developer's code navigation behavior. We propose a novel and unified theory based on the premise that we can study developer's information seeking strategies in light of the foraging principles that evolved to help our animal ancestors to find food. Our preliminary study on code navigation graphs suggests that the tenets of information foraging provide valuable insight into software maintenance. Our research opens the avenue towards the development of ecologically valid tool support to augment developers' code search skills.

Much of developers' time is spent in exploring and understanding an unfamiliar software space. In this paper, we present a novel approach that characterizes the code fragments along several orthogonal dimensions in order for developers to navigate complex software spaces in a flexible manner. Central to our approach are hierarchical faceted categories (HFC), which have become especially successful in supporting exploratory web search activities. We apply the HFC approach for exploring a sizeable open-source software system. Our preliminary evaluation shows that HFC are promising in supporting software exploration tasks.

Automated tracing tools employ information retrieval (IR) methods to recover traceability links between software artifacts. A large body of research is available on the back-end design of such tools, including artifacts indexing and the underlying IR mechanism. In contrast, less attention has been paid to the front-end presentation of the retrieved results. This paper describes TraCter, a result categorization tool with novel search user interfaces. We discuss the key features of TraCter and its potential improvements over previous work.

Requirements tracing is a central activity for software systems quality management. However, in large-scale evolving systems, maintaining traceability information manually can become a tedious task. To address this problem, several dynamic techniques were introduced to provide automatic traceability links generation. These techniques are usually based on information retrieval (IR) methods which link different artifacts based on their syntactic information. This paper reports an ongoing experimental investigation of using semantics-enabled IR methods to generate traceability links. Our goal is to explore dynamic, accurate, and conceptually rich ways to generate and maintain traceability information.

Modern software product line development uses viewpoints to capture the needs of various stakeholders without resorting to a single complex model. Comparing and integrating different viewpoints help to gain insights into the product line and to derive products. Recent research has proposed conflict resolution rules for handling variability in the integration process. However, one benefit viewpoints bring is to tolerate inconsistency until the rationales about variability are better understood. In this paper, we propose a method for modeling variability when product line viewpoints are consolidated. Our method takes advantage of a lattice ordering to support late binding of variability and stakeholder traceability. We apply our method to viewpoints derived from the mobile phone domain, and show how delayed commitment can support product line evolution and product derivation.

We introduce an extractive approach to building a product line's requirements assets. We define the functional requirements profiles (FRPs) according to the linguistic characterization of a domain's action-oriented concerns, and show that FRPs can be extracted from a document based on domain-aware lexical affinities that bear a 'verb - direct object' relation. The validated FRPs are then amenable to semantic case analysis so as to uncover the variation structures. Finally, merging FRPs helps discover the requirements interdependencies. We use orthogonal variability modeling to represent the product line's external variability and constraints. We apply our approach to an auto-marker product line. The study shows our approach complements domain analysis by quickly offering insights into system functionalities and product line variabilities.

We propose an on-demand clustering framework for analyzing the functional requirements in a product line. Our approach is novel in that the objects to be clustered capture the domain's action themes at a primitive level, and the essential attributes are uncovered via semantic analysis. We provide automatic support to complement domain analysis by quickly identifying important entities and functionalities. A second contribution is our recognition of stakeholders' different goals in cluster analysis, e.g., feature identification for users versus system decomposition for designers. We thus advance the literature by examining requirements clusters that overlap and those causing a minimal information loss, and by facilitating the discovery of product line variabilities. A proof-of-concept example is presented to show the applicability and usefulness of our approach.

Aspects promote a clear separation of concerns so that tangled and scattered concerns are modularized throughout software development. We propose a framework to trace aspects identified during goal-oriented requirements analysis to code and testing. Two types of checks are performed to validate the resulting system in light of stakeholders' crosscutting concerns. One ensures that systems with and without aspects have the same functionality defined by the hard goals. The other checks whether the weaved system with aspects indeed improves system qualities in terms of the degree of softgoal satisfaction. We demonstrate the approach using an open-source e-commerce platform.

Terminological interference occurs in requirements engineering when stakeholders vary in the concepts they use to understand a problem domain, and the terms they use to describe those concepts. This paper investigates the use of Kelly's Repertory Grid Technique (RGT) to explore stakeholders' varying interpretations of the labels attached to softgoals in a goal model. We associate softgoals with stakeholders' personal constructs, and use the tasks that contribute to these goals as elements that stakeholders can rate using their constructs. By structurally exchanging grids data among stakeholders, we can compare their conceptual and terminological structures, and gain insights into relationships between problem domain concepts.

Software merging is a common and essential activity during the lifespan of large-scale software systems. Traditional textual merge techniques are inadequate for detecting syntactic merge conflicts. In this paper, we propose a domain-independent approach for syntactic software merging that exploits the graph-based structure(s) of programs. We use morphisms between fuzzy graphs to capture the relationships between the structural elements of the programs to be merged, and apply a truth ordering lattice to express inconsistencies and evolutionary properties as we compute the merge. We demonstrate the approach with a three-way consolidation merge in a commercial software system; in particular, we show how analyzing merged call structures can help developers gain a better understanding and control of software evolution.