Software systems that process structured inputs often lack complete and up-to-date specifications, which specify the input syntax and the semantics of input processing. While grammar mining techniques have focused on recovering syntactic structures, the semantics of input processing remains largely unexplored. In this work, we introduce a novel approach for inferring attributed grammars from parser implementations. Given an input grammar, our technique dynamically analyzes the implementation of recursive descent parsers to reconstruct the semantic aspects of input handling, resulting in specifications in the form of attributed grammars. By observing program executions and mapping the program's runtime behavior to the grammar, we systematically extract and embed semantic actions into the grammar rules. This enables comprehensive specification recovery. We demonstrate the feasibility of our approach using an initial set of programs, showing that it can accurately reproduce program behavior through the generated attributed grammars.

Software development education faces challenges in teaching abstract and complex programming concepts. Since problems in comprehension can lead to decreased student engagement, we introduce JavaWiz: an educational graphical debugger that addresses these challenges by combining traditional debugging functionality with intuitive, dynamic visualizations of program state and run-time behavior. JavaWiz's key features include real-time visualization of heap, stack, and static fields; automatically generated flow charts; interactive representations of data structures; and unique time-travel debugging capabilities. Its step-by-step visual exploration of code execution, including the ability to step backward, bridges the gap between abstract concepts and concrete program understanding. We present the tool's visualization components in detail and discuss its applications in teaching. Lecturers report positive influence on their in-class demonstrations and initial student feedback reinforces the tool's usefulness for program comprehension.

Abstract Software companies frequently customize and extend product lines in multiple projects concurrently to quickly deliver solutions to customers. Engineers use a distributed and feature-oriented development process, commonly supported by version control systems to track implementation-level changes. For instance, feature branches are widely used to add new or modify existing features. However, when merging back features to the product line, the information about feature-to-code mappings is usually lost. Furthermore, the granularity of merging is limited to branches, making it hard to extract and merge selected individual features from one product to another. This paper thus presents feature-oriented clone and pull operations for distributed development, which are implemented in the FORCE2 platform. Our evaluation uses variants of the ArgoUML product line to investigate the correctness and performance of our approach. The results show that the feature-oriented operations work with high precision and recall for different cases of feature interactions, also when feature implementations are scattered across many locations in the source code. The performance measurements demonstrate that the operations can be integrated in the typical workflows of engineers.

Feature models are a de facto standard for representing the commonalities and variability of product lines and configurable software systems. Requirements-level features are commonly implemented in multiple source code artifacts, which results in complex dependencies at the code level. As developers change and evolve features frequently, it is challenging to keep feature models consistent with their implementation. We thus present an approach combining feature-to-code mappings and code dependency analyses to inform engineers about possible inconsistencies. Our focus is on code-level changes requiring updates in feature dependencies and constraints. Our approach uses static code analysis and a variation control system to lift complex code-level dependencies to feature models. We present the suggested dependencies to the engineer in two ways: directly as links between features in a feature model and as a heatmap visualizing the dependency changes of all features in a model. We present results of an evaluation on the Pick-and-Place Unit system, which demonstrates the utility and performance of our approach and the quality of the suggestions.

A feature model (FM) describes commonalities and variability within a software product line (SPL) and represents the configuration options at one point in time. A temporal feature model (TFM) additionally represents FM evolution, e.g., the change history or the planning of future releases. The increasing number of different TFM notations hampers research collaborations due to a lack of interoperability regarding notations, editors, and analyses. We present a common API for TFMs, which provides the core of a TFM ecosystem, to harmonize notations. We identified the requirements for the API based on systematically classifying and comparing the capabilities of existing TFM approaches. Our approach allows to work seamlessly with different TFM notations to perform, track, analyze and replay evolution. Our evaluation investigates two research questions on the expressiveness (RQ1) and utility (RQ2) of our approach by presenting implementations for several existing FM and TFM notations and replaying evolution histories from two case study systems.

Understanding variability is essential to allow the configuration of software systems to diverse requirements. Variability-aware program analysis techniques have been proposed for analyzing the space of program variants. Such techniques are highly beneficial, e.g., to determine the potential impact of changes during maintenance. This article presents an interprocedural and configuration-aware change impact analysis (CIA) approach for determining the possibly impacted source code elements when changing the source code of a product family. The approach also supports engineers, who are adapting the code of specific product variants after an initial pre-configuration. The approach can be adapted to work with different variability mechanisms, it is more precise than existing CIA approaches, and it can be implemented using standard control flow and data flow analysis. We report evaluation results on the benefit and performance of the approach using industrial product lines.

In the domain of industrial automation many companies nowadays need to serve a mass market while at the same time customers demand individual customer-specific solutions. Such customizations often apply to individual products only but may also be needed at the level of product lines for whole market segments. To handle this problem, development is frequently organized in software ecosystems (SECOs), i.e., interrelated software product lines involving internal and external developers. This paper introduces an approach supporting feature-oriented, distributed development and evolution in industrial SECOs. It is common industrial practice to first derive initial products from a product line, then adding and adapting features to satisfy individual customer requirements, possibly followed by merging back these changes into the original product line. Our approach goes beyond this practice and also allows to share new or updated features by transferring them to other product lines in the ecosystem. This is for instance useful when a feature developed in an individual customer project becomes relevant for another market segment or when updates of features need to be transferred to related products in the ecosystem. We describe and motivate research challenges based on the industrial ecosystem of an industry partner. We outline the key elements and operations of our approach, including an implementation in our FORCE2development environment. We demonstrate application scenarios from the well-known Pick-and-Place Unit (PPU) system as a proof of concept.

This paper presents an approach for deriving a state transition model which represents the behavior of a control component using symbolic execution. Symbolic execution is a technique for executing a program using symbolic values for unknowns. It explores execution paths in a program and then uses a SAT/SMT solver to prove that paths are feasible. Further, the approach allows using constraints on the environment and simplifications with a widening operator similar to abstract interpretation.We present the formal foundation of the approach, depict the the tool implementation, present results from a preliminary evaluation, and discuss various application scenarios.

Feature models are frequently used to capture the knowledge about configurable software systems and product lines. However, feature modeling of large-scale systems is challenging as models are needed for diverse purposes. For instance, feature models can be used to reflect the perspectives of product management, technical solution architecture, or product configuration. Furthermore, models are required at different levels of granularity. Although numerous approaches and tools are available, it remains hard to define the purpose, scope, and granularity of feature models. This paper first reports results and experiences of an exploratory case study on developing feature models for two large-scale industrial automation software systems. We report results on the characteristics and modularity of the feature models, including metrics about model dependencies. Based on the findings from the study, we developed FORCE, a modeling language, and tool environment that extends an existing feature modeling approach to support models for different purposes and at multiple levels, including mappings to the code base. We demonstrate the expressiveness and extensibility of our approach by applying it to the well-known Pick and Place Unit example and an injection molding subsystem of an industrial product line. We further show how our approach supports consistency between different feature models. Our results and experiences show that considering the purpose and level of features is useful for modeling large-scale systems and that modeling dependencies between feature models is essential for developing a system-wide perspective.

The papers in this special section focus on information technology in industrial automation applications. Information technologies play a crucial role in the current and future developments of industrial automation. There are numerous strategic agendas on future manufacturing that have appeared recently worldwide and all of them emphasize the role of information technologies in automation in shaping up the future of production industries. For example, according to the German development agenda Industrie 4.0, the main driving force of the new industrial revolution is the Internet of things (IoT) and Cyber-Physical Systems (CPS). The IoT concept is becoming a major driver for many industrial applications. In manufacturing, it leads to flattening of the control pyramid, thus, increasing flexibility and enabling unprecedented level of production flexibility and adaptability, making it possible and feasible to produce products in smaller amounts, with shorter time to markets and higher economic efficiency. In the manufacturing environment, CPS comprise smart machines, storage systems, and production facilities capable of autonomously exchanging information, triggering actions, and controlling each other independently. The research community effort has been focusing on systems interoperability, performance, and efficiency of the design process, as well as assurance in the correctness of systems behavior.

Today's software systems need to be highly flexible and managing their variability plays an essential role during development. Variability-aware program analysis techniques have been proposed to support developers in understanding code-level variability by analyzing the space of program variants. Such techniques are highly beneficial, e.g., when determining the impact of changes during maintenance and evolution. Two strategies have been proposed in the literature to make existing program analysis techniques variability-aware:(i) program analysis can be lifted by considering variability already in the parsing stage; or(ii) analysis can be delayed by considering and recovering variability only when needed. Both strategies have advantages and disadvantages, however, a systematic comparison is still missing. The contributions of this paper are an in-depth comparison of SPLLIFT and COACH, two existing approaches representing these two strategies, and an analysis and discussion of the trade-offs regarding precision and run-time performance. The results of our experiment show that the delayed strategy is significantly faster but typically less precise. Our findings are intended for researchers and practitioners deciding which strategy to select for their purpose and context.

Static code analysis techniques examine programs without actually executing them. The main benefits lie in improving software quality by detecting problematic code constructs and potential defects in early development stages. Today, static code analysis is a widely used quality assurance technique and numerous tools are available for established programming languages like C/C++, Java, or C#. However, in the domain of programmable logic controller (PLC) programming, static code analysis tools are still rare, although many properties of PLC programming languages are beneficial for static analysis techniques. Therefore, an approach and tool for static code analysis of IEC 61131-3 programs has been developed which is capable of detecting a range of issues commonly occurring in PLC programming. The approach employs different analysis methods, like pattern-matching on program structures, control flow and data flow analyses, and, especially, call graph and pointer analysis techniques. Based on results from an initial analysis project, where common issues for static analysis of PLC programs have been investigated, this paper illustrates adoption and extensions of analysis techniques for PLC programs and presents results from large-scale industrial application.

Slicing-based change impact analysis is an important and established technique to assess the effects of modifications to source code. Program slicing is usually done by performing a graph reachability analysis on a system dependence graph representing the control and data flow dependencies between statements. However, analyzing large-scale software systems can lead to performance issues, resulting in huge dependence graphs and long analysis times. In this paper we present an approach that exploits the modularity of large-scale systems to first perform program analysis for individual modules, and later compose the pre-computed analysis results. However, partitioning a system dependence graph is not straightforward, as it carries presence conditions representing variability. We thus use placeholders that are resolved when composing the pre-computed SDG modules during configuration-aware program analysis. Our approach is particularly useful in the context of product lines, when product variants are derived by composing modules depending on specific customer requirements. We present preliminary results of an evaluation based on a product line from an industrial partner.

Due to increased market demands for highly customized and machine-specific solutions in manufacturing, industrial software systems are often developed as software product lines (SPL) and organized as software ecosystems (SECO) with internal and external developers composing individual solutions based on a common technological platform. In such settings, software development usually occurs in a multistage process: system variants initially derived from a platform are adapted and extended to meet specific requirements. This common approach, however, results in significant challenges for software development and maintenance. In this paper we review key challenges we have been observing when investigating our industrial partner's software ecosystems. We then present a feature-oriented development approach we have been developing to tackle those. Our approach is backed with static analysis methods to deal with system variants and versions created in software maintenance.

Feature models are commonly used in industrial contexts to guide and automate the derivation of product variants. However, in real-world product lines the derivation process goes beyond selecting and composing product features. Specifically, developers often perform clone-and-own reuse, i.e., they copy, modify, and extend existing code to provide the functionality required by customers. Clones are created at different levels of granularity, ranging from individual features to entire systems. Refactoring and reverse engineering approaches have been proposed for dealing with cloned product variants. However, managing clones has not been addressed in the context of feature models. For instance, if clones are created to address customer requirements in specific product variants, the connection to the original feature models is frequently lost. We thus present a modeling approach based on prototypes, i.e., prefabricated objects from which clones are created. Our approach allows to manage prototypes and their clones at the levels of products, components, and features. We use compliance levels to define the required level of consistency between prototypes and clones. We further adapt an existing consistency checking framework for detecting inconsistent clones when the product line evolves. Our approach uses feature-to-code mappings to determine the impact of changes on code elements. We present a case study illustrating prototypes, clones, and compliance levels in selected development scenarios of our industry partner's product line. We also discuss the use of static code analysis techniques to support engineers in determining the impact of changed prototypes on affected clones, an area we plan to address in our future work.

Static code analysis techniques are widely and successfully used for mainstream programming languages. However, domain-specific languages and company-specific variations of languages often lack the same level of support. An example is the domain of industrial automation, where programmable logic controller programs are mainly written in languages conforming to the IEC 61131-3 standard, a non-mainstream family of languages. This experience paper reports about the development of a program analysis framework for the IEC 61131-3 languages. We use OMG's Abstract Syntax Tree Meta-Model (ASTM) as an abstract representation and show our extensions of this model to represent the different IEC 61131-3 languages. Using this representation our approach generates Jimple code, an intermediate representation used by the Soot program analysis framework. We use Soot's standard analysis methods to compute a system dependence graph, which is then used for change impact analysis. We apply our approach to industrial-size product lines of our industry partner to demonstrate its correctness and performance. Finally, we discuss experiences and lessons learned intended for developers of program analysis methods for nonmainstream languages.

Understanding variability is essential to allow the configuration of software systems to diverse requirements. Variability-aware program analysis techniques have been proposed for analyzing the space of program variants. Such techniques are highly beneficial, e.g., to determine the potential impact of changes during maintenance. This paper presents an interprocedural and configuration-aware change impact analysis (CIA) approach for determining possibly impacted products when changing source code of a product family. The approach further supports engineers, who are adapting specific product variants after an initial pre-configuration. The approach can be adapted to work with different variability mechanism, it provides more precise results than existing CIA approaches, and it can be implemented using standard control flow and data flow analysis. Using an industrial product line we report evaluation results on the benefit and performance of the approach.

Feature models are frequently used to capture the knowledge about configurable software systems and product lines. However, feature modeling of large-scale systems is challenging as many models are needed for diverse purposes. For instance, feature models can be used to reflect the perspectives of product management, technical solution architecture, or product configuration. Furthermore, models are required at different levels of granularity. Although numerous approaches and tools are available, it remains hard to define the purpose, scope, and granularity of feature models. In this paper we thus present experiences of developing feature models for two large-scale industrial automation software systems. Specifically, we extended an existing feature modeling tool to support models for different purposes and at multiple levels. We report results on the characteristics and modularity of the feature models, including metrics about model dependencies. We further discuss lessons learned during the modeling process.

Dynamic program analysis is a technique which records a program execution for the purpose of analyzing its behavior and building high-level models and views. This paper presents an approach to build a high-level model of the behavior of a PLC program component as observed in a program execution. Based on a deterministic record and replay technique, a model is synthesized which represents the transition behavior, timing information, and input output behavior of the component. Then this model can be used to check other executions of the same or similar programs for compliance with the model. We present the synthesis techniques and two variants of trace analysis algorithms.

Software engineering methods for analyzing and managing variable software systems rely on accurate feature-to-code mappings to relate high-level variability abstractions, such as features or decisions, to locations in the code where variability occurs. Due to the continuous and long-term evolution of many systems such mappings need to be extracted and updated automatically. However, current approaches have limitations regarding the analysis of highly-configurable systems that rely on different variability mechanisms. We present a novel approach that exploits the synergies between program analysis and doffing techniques to reveal feature-to-code mappings for highly-configurable systems. We demonstrate the feasibility of our approach with a set of products from a real-world product line in the domain of industrial automation.

In software ecosystems (SECOs) both internal and external developers build software solutions for specific market segments based on common technological platforms. Despite a significant body of research on SECOs there is still a need to empirically investigate the characteristics of SECOs in specific industrial environments to understand and improve development processes. In particular, when defining software processes understanding the roles of the participants in the SECO is crucial. This paper thus reports results of an exploratory case study in the industrial automation domain. We explore two research questions on SECO characteristics and discuss research issues we derived from our analyses. While our study confirms key SECO characteristics reported in the literature we also identify additional properties relevant for development processes in the domain of industrial automation.

Application engineers frequently create customer-specific products in two stages: the required software components are first selected to create an initial product which is then evolved by refining the selected features and adapting the code to meet the customers' requirements. For instance, developers frequently set configuration options in the code to adjust the product. However, given that such changes are often necessary in the entire code base it is hard to know which part of the code is still relevant for the chosen configuration options. This means that engineers need to understand and maintain a lot of code that is potentially inactive in a particular product variant. Existing approaches provide only partial solutions: for instance, feature-to-code mappings do not adequately consider complex code dependencies of the implemented features. Static analysis techniques provide better results but usually do not consider variability aspects. We present an approach to automatically identify inactive code in product variants using a configuration-aware code analysis technique. We demonstrate the flexibility of our approach by customizing it to a product line of an industry partner in the domain of industrial automation. We further evaluate the approach to demonstrate its effectiveness, accuracy, and performance.

A call graph of a program represents the information which executable program element calls which other executable program elements. Based on the call graph, points-to sets can be computed, which represent the memory locations a reference variable can possibly point to. Call graph and points-to sets provide important information for static program analysis. This is especially true for PLC programs which heavily use pointer variables. However, due to the complexity of the algorithms, call graph and points-to analysis methods are not widely available in static analysis. In this paper, we present an approach for call graph and points-to analysis of IEC 61131-3 programs. We present the algorithm for computing call graph and points-to sets and its implementation in a tool environment, show several different application scenarios, and present first results from industrial application.

This paper presents an approach to reverse engineering and dynamic analysis of the reactive behavior of PLC programs. Based on execution traces, it is shown how to derive a state model representation of the reactive program behavior and how this model supports dynamic program analysis. In particular, the state model is used for mining execution patterns which occur repeatedly in a program execution. We discuss the key ideas of the approach, the various analysis and visualization methods available, and results from a case study.

Behavioral event contracts constrain the ordering of input events received and possible output events returned from a software component. Interface automata as introduced by de Alfaro and Henzinger are a light-weight formalism that allow capturing such temporal aspects of software component interfaces and the associated theory allows answering such fundamental questions as interface compatibility, component composition, and refinement. The work presented in this paper applies the results from the theory of interface automata in a hierarchical design and verification approach for IEC 61499 automation solutions. IEC 61499 adapters and service sequences are used for specification of rich behavioral component interfaces. In this approach, components are built hierarchically in master-slave arrangements where each component defines a provided interface contract for its upper-level and specifies required interface contracts for its subcomponents. Verification methods allows verifying if a component uses all its subcomponents according to their contracts, allows checking if a concrete component satisfies a given contract, and allows computing an abstraction of a component representing its externally visible behavior.

The IEC 61499 modeling language pursues a component-based approach with modular building blocks coupled by ports and arranged in a hierarchical manner. Like similar approaches, the IEC 61499 language does not define how functional hierarchies of upper- and lower-level functional entities should be built. In this paper we outline structuring principles for IEC 61499 programs with purely hierarchical control architectures. We present elementary design guidelines for structuring automation solutions in several hierarchical layers, outline which elements of the IEC 61499 language to use, discuss patterns that arise when implementing hierarchical control solutions, and illustrate the approach with a case study.

This paper describes a tool for offline debugging and trace visualization of PLC applications. Based on trace data obtained by a deterministic replay technology for multi-threaded Soft PLC applications, the tool allows visualizing an application run in its various aspects and on various levels of abstraction. Each view shows a different level of detail, allowing the user to dive into the program from high-level views showing abstract program behavior to low-level views showing each executed statement or variable value in detail. With a set of views the tool supports the user to get an overview of the program execution, to identify abnormal program behavior, to discover the causes for program failures, and finally to locate defects in the source code. The paper presents the conceptional background of the approach, shows how program runs can be visualized, and how they can be analysed in detail. Then it demonstrates how the the tool supports a debugging process by an illustrative example.

Static code analysis techniques analyze programs by examining the source code without actually executing them. The main benefits lie in improving software quality by detecting potential defects and problematic code constructs in early development stages. Today, static code analysis is widely used and numerous tools are available for established programming languages like C/C++, Java, C# and others. However, in the domain of PLC programming, static code analysis tools are still rare. In this paper we present an approach and tool support for static code analysis of PLC programs. The paper discusses opportunities static code analysis can offer for PLC programming, it reviews techniques for static analysis, and it describes our tool that implements a rule-based analysis approach for IEC 61131-3 programs.

Deterministic replay debugging is an approach to finding bugs in deployed software. It records an application run in the field so that it can deterministically be replayed offline in a development system for debugging purposes. To enable deterministic replay debugging, it is necessary to record all external influences and sources of nondeterminism in the original program run. From that trace log and from a known initial state, the program can be replayed deterministically without requiring any connection to the original environment. In this paper, we present a solution for deterministic replay debugging of hard real-time multitasking SoftPLC applications written in the IEC 61131-3 languages. By taking advantage of the special properties of these programs and by careful engineering, our technique allows recording a SoftPLC application run in the field with minimal overhead and obeying real-time constraints. In later phases, which are offline, the original program run is reconstructed from the minimal information recorded so it can be replayed for debugging. In comparison to previous work, our solution has several advantages: Instead of recording task scheduling information, it reconstructs the task interleaving based on data dependencies, thereby significantly simplifying the recording phase. Additionally, it incorporates a technique for periodically capturing the complete internal state of the system, which can later be used as a starting point for replay. We present the conceptual basis of our approach, a tool chain which provides deterministic replay debugging to the user as a set of fully automated tools, and an evaluation as well as an industrial case study for validating the approach.

Monaco is a domain-specific language for machine automation programming. It has been developed with the objective to empower domain experts with limited programming capabilities. Its main language features are an imperative notation for reactive systems, concepts for describing asynchronous event handling in a concise way, and a state-of-the-art component approach. Monaco is a programming language with a Pascal-like syntax, but also comes with a visual programming environment. In this paper we review the language Monaco, show the visual representation scheme, report on the programming environment and compare our visual notation to Statecharts.

Perceiving agents have a limited sensitivity to distinguish input stimuli. Whatever the cause random noise, limited numbers of sensing elements, intentional desensitization formulation of such behavioral phenomena at the system level has not attracted much interest. This work is a first attempt to formalize the limited-sensitivity abstraction and to explore its implications for systems modeling and simulation, both conceptual and practical. In this article, a system theoretic formalization of perceiving agents called quantized systems is provided, linking them with discrete event modeling paradigms and exploring their approximation capability and message reduction in distributed simulation.

A variety of information systems methodologies for information systems analysis have been proposed. Though each methodology has its own effective concepts and tools, there still does not seem to exist a rigorous model of a business system. In this paper a general model of business systems is proposed. The model describes the whole mechanism of typical routine processing of business tasks with slips and business papers. Furthermore it can be used to examine the ability and limitation of popular tools. The model proposed is called a business transaction system. It consists of both static and dynamic structures. The former depicts the interconnection of the transactions and file system in a business system. The dynamic structure is constructed as a state space representation by introducing a state space, and then the resultant dynamic system is a discrete event system. The state space consists of the file system and schedule of transactions processing. The model provides answers to some questions about the nature of information systems methodologies.