Software architecture documentation is essential for system comprehension, yet it is often unavailable or incomplete. While recent LLM-based techniques can generate documentation from code, they typically address local artifacts rather than producing coherent, system-level architectural descriptions. This paper presents a structured process for automatically generating system-level architectural documentation directly from GitHub repositories using Large Language Models. The process, called CIAO (Code In Architecture Out), defines an LLM-based work-flow that takes a repository as input and produces system-level architectural documentation following a template derived from ISO/IEC/IEEE 42010, SEI Views & Beyond, and the C4 model. The resulting documentation can be directly added to the target repository. We evaluated the process through a study with 22 developers, each reviewing the documentation generated for a repository they had contributed to. The evaluation shows that developers generally perceive the produced documentation as valuable, comprehensible, and broadly accurate with respect to the source code, while also highlighting limitations in diagram quality, high-level context modeling, and deployment views. We also assessed the operational cost of the process, finding that generating a complete architectural document requires only a few minutes and is inexpensive to run. Overall, the results indicate that a structured, standards-oriented approach can effectively guide LLMs in producing system-level architectural documentation that is both usable and cost-effective.

• Propose a novel noise-reduction-oriented super-resolution framework tailored for precision agriculture applications. • Introduce a Gaussian-based saliency map generation method to guide object-aware SR reconstruction. Design a multitask learning architecture that jointly predicts high-resolution images and saliency maps to enhance edge and contour understanding. • Integrate a saliency-guided segmentation post-processing technique to automatically select optimally enhanced high-resolution outputs. • Achieve state-of-the-art PSNR performance in noise reduction across four benchmark datasets and one agriculture-related dataset. Low-resolution images significantly degrade the performance of vision systems in real-world settings. While super-resolution techniques improve image details, they often introduce additional noise, complicating tasks like detection and recognition. Thus, it is crucial to develop methods that enhance image quality while reducing noise. This paper presents a novel solution focused on noise reduction, integrating Super-Resolution (SR) reconstruction, Multitask Learning (MTL), and Saliency-Guided Segmentation (SGS) for effective post-processing. When generating high-resolution images, existing SR methods struggle with noise at object boundaries and edges. Our model learns a supplementary task to create blending saliency objects into high-resolution images, thus improving the understanding of object boundaries, edges, and contours, while leading to notable noise reduction. Experimental results show that SUNRISE achieves the highest PSNR on benchmark datasets, including SET5 (33.44 dB), SET14 (32.17 dB), BSD100 (31.87 dB), and Urban100 (31.81 dB), outperforming state-of-the-art methods such as FxSR, DualFormer, SROOE, and WGSR by up to 1.5 dB. On the Saffron Flower Dataset, SUNRISE achieves a PSNR of 33.36, an SSIM of 0.824, MSE of 35.957, and LPIPS of 0.232, demonstrating superior pixel-level fidelity, structural preservation, and perceptual similarity in agricultural images. These results confirm that SUNRISE effectively reduces noise while preserving fine details, thereby enhancing downstream vision tasks like object detection. The code is available at https://github.com/tmtgssi/SUNRISE

Context: Large Language Models (LLMs) are increasingly deployed in high-risk settings, where harmful or unethical outputs remain a risk. Adversarial prompting (“jailbreaks”) can circumvent default safeguards. Emerging regulation (e.g., the EU AI Act) demands proactive controls that verify outputs before delivery. Objectives: We present and evaluate D-SHIELD, a plugin-based safeguard that separates generation from validation via a stateless, decontextualized validator. Objectives are to assess alignment with expert judgments, evaluate end-to-end mitigation on publicly sourced jailbreaks, compare with representative plugin-based defenses, and examine a lightweight configuration optimized for cost without reducing protection. Methods: D-SHIELD routes candidate responses from the user-facing LLM to a secondary, decontextualized LLM operating in isolation (no prompt or conversation context) to classify each response based on indications of prohibited content derived from the EU AI Act, The General-Purpose AI Code of Practice, GDPR, and provider policies. This decontextualized design intentionally prevents prompt contamination, adversarial framing, and conversational drift from influencing the validation decision, addressing key weaknesses of context-aware validators. We create an expert-labeled dataset from designed jailbreaks for direct comparison with the decontextualized validator’s classification. We then embed the validator in a working prototype and evaluate on publicly sourced jailbreaks. Finally, we conduct a comparative study against baseline jailbreak-mitigation techniques and analyze a lightweight guard variant. Results: The decontextualized validator closely aligns with expert decisions, especially for explicit harms, while adopting a conservative stance on borderline cases. In prototype evaluation on publicly sourced jailbreaks, the safeguard blocked most harmful responses. Compared with baselines, D-SHIELD yields fewer successful attacks under a common benchmark. The lightweight variant delivers comparable protection at markedly lower cost. Conclusion: Decontextualized, output-level validation provides an effective, regulation-aligned solution for LLM safety. Restricting the validator to the generated text complements input-level defenses and supports practical deployment, particularly in a lightweight configuration.

Modern digital systems pose risks to humans, society, and the environment. There is a flourishing of guidelines, recommendations, laws, and regulations, but also of standards that try to regulate and alleviate the lack of good practices for the governance, management, and quality of AI systems. However, having just a mark certifying that the system passed some checks is not enough and is fragile to the ethics washing problem. The objective of this work is to go beyond compliance to standards toward an ethics label that enables users to understand the impact of systems on human, societal, and environmental values, both during system development and usage. To build the ethics label, we analyze guidelines, recommendations, laws and regulations, and quality standards. We validate the proposed ethics label through (i) a proof-of-concept application to the social assistive robotics domain, and (ii) interviews with experts from both academia and industry. We contribute an ethics label for modern digital systems that promote transparency and user awareness, and enable users to select systems that meet their subjective ethical preferences. We discuss the problem of ethics washing and propose an ethics label as a means to foster transparency and raise user awareness.

Background. Autonomous systems, whether AI-enabled or not, are ubiquitous and pervasive in our daily lives. While their adoption and use bring many benefits, they also pose significant ethical challenges. Objective. The objective of this work is to contribute a reference architecture for ethical-aware autonomous systems, focusing on their interaction and collaboration with humans, being them proactive, reactive or passive in the interaction with the systems. Method. To define the architecture, we analyzed scientific papers in the field, guidelines and recommendations, as well as laws and regulations. We then applied this acquired knowledge to build the reference architecture. The results of this work were validated through expert interviews and a scenario-based evaluation. Results. We contribute (i) a definition of ethical-aware autonomous systems, (ii) requirements for ethical-aware autonomous systems, and (iii) a reference architecture for ethical-aware autonomous systems. Our reference architecture is intended to help system and software engineers to design autonomous or intelligent systems that should interact and operate with humans in ethically sensitive contexts such as healthcare, social robotics, and assistive technologies. Conclusion. We believe that this work will assist software architects and engineers in designing and developing autonomous systems that should interact and collaborate with humans while respecting values important to individuals, society, and the environment.

Machine learning components are being deployed across nearly every business sector and their importance is continually growing. However, the engineering practices for building these systems remain poorly understood compared to those for conventional software systems. This work provides practical guidance to support architects in designing and implementing machine learning-intensive systems, and identifies areas where there are gaps in understanding and achievement. Building on our prior research, we developed a checklist of quality concerns for architects of machine learning-intensive systems. This checklist was iteratively refined through expert interviews and subsequently validated in a workshop with experienced architects. The main result of this work is a comprehensive list of 40 checks, organized into two main categories and 16 subcategories. Also, we present the results of a workshop where the importance and degree of achievement of each check was assessed by 25 practicing architects of ML-intensive systems. The findings of this study contribute to a better understanding of the unique challenges of ML-intensive systems and offer initial guidance to practitioners, and researchers on areas where future work should be directed. The findings of this study offer valuable support to architects in addressing the unique challenges of ML-intensive systems and provide guidance to practitioners and researchers in terms of where future work should be focused.

Real-time cyber-physical systems in aerospace and other safety-critical domains require deterministic task execution under strict certification constraints. Although static time-triggered scheduling fulfills these requirements, its manual configuration remains error-prone and limits scalability. This article proposes an automated framework that generates optimized schedules for fixed-priority, fully preemptive systems based on the Thales Alenia Space—Italia real-time platform. A simulator that replicates the scheduling semantics of the target platform is implemented, enabling precise analysis and validation of a given schedule plan. The scheduling problem is formulated as a bilevel optimization solved via soft-computing techniques, while a complementary mixed-integer linear programming formulation provides performance bounds. The approach is validated on an industrial satellite case study, demonstrating a significant reduction in preemptions and improved timing consistency compared to manually engineered schedules.

The growing need to test systems post-release has led to extending testing activities into production environments, where uncertainty and dynamic conditions pose significant challenges. Field testing approaches, especially Self-Adaptive Testing in the Field (SATF), face hurdles like managing unpredictability, minimizing system overhead, and reducing human intervention, among others. Despite its importance, SATF remains underexplored in the literature. This work introduces AdapTA (Adaptive Testing Approach), a novel SATF strategy tailored for testing Body Sensor Networks (BSNs). BSNs are networks of wearable or implantable sensors designed to monitor physiological and environmental data. AdapTA employs an ex-vivo approach, using real-world data collected from the field to simulate patient behavior in in-house experiments. Field data are used to derive Discrete-Time Markov Chain (DTMC) models, which simulate patient profiles and generate test input data for the BSN. The BSN’s outputs are compared against a proposed oracle to evaluate test outcomes. AdapTA’s adaptive logic continuously monitors the system under test and the simulated patient, triggering adaptations as needed. Results demonstrate that AdapTA achieves greater effectiveness compared to a non-adaptive version of the proposed approach across three adaptation scenarios, emphasizing the value of its adaptive logic.

International audience

After more than thirty-five years of research and development in software architecture, several fundamental challenges remain unsolved. First, despite the importance of having a well-defined architecture description aligned with the system, inconsistencies and misalignments are still prevalent. Second, although numerous languages exist to describe architectures, none have achieved widespread use or recognition as a de facto standard. Third, while architecture is dynamic and evolving, with architectural decisions often made by non-architect stakeholders, there are no universally accepted methodologies to capture emergent aspects and incorporate them into the architecture.In this paper, we explore the emerging concept of architecture as code. Inspired by the success of infrastructure as code, which enables infrastructure management in a codified, automated, and repeatable manner, architecture as code aims to bring similar benefits to software architecture. To the best of our knowledge, this is the first scientific paper to study this concept in depth within the context of software architecture, providing a comprehensive description and analysis of its characteristics. We also investigate how architecture as code is implemented and applied in practice.

Abstract Robots often need to be reconfigurable—to customize, calibrate, or optimize robots operating in varying environments with different hardware. A particular challenge in robotics is the automated and dynamic reconfiguration to load and unload software components, as well as parameterizing them. Over the last decades, a large variety of software reconfiguration techniques has been presented in the literature, many specifically for robotics systems. Also many robotics frameworks support reconfiguration. Unfortunately, there is a lack of empirical data on the actual use of reconfiguration techniques in real robotics projects and on their realization in robotics frameworks. To advance reconfiguration techniques and support their adoption, we need to improve our empirical understanding of them in practice. We present a study of automated reconfiguration at runtime in the robotics domain. We determine the state-of-the art by reviewing 78 relevant publications on reconfiguration. We determine the state-of-practice by analyzing how four major robotics frameworks support reconfiguration, and how reconfiguration is realized in 48 robotics (sub-)systems. We contribute a detailed analysis of the design space of reconfiguration techniques. We identify trends and research gaps. Our results show a significant discrepancy between the state-of-the-art and the state-of-practice. While the scientific community focuses on complex structural reconfiguration, only parameter reconfiguration is widely used in practice. Our results support practitioners to realize reconfiguration in robotics systems, as well as they support researchers and tool builders to create more effective reconfiguration techniques that are adopted in practice.

Body Sensor Networks (BSNs) offer a cost-effective way to monitor patients’ health and detect potential risks. Despite the growing interest attracted by BSNs, there is a lack of testing approaches for them. Testing a Body Sensor Network (BSN) is challenging due to its evolving nature, the complexity of sensor scenarios and their fusion, the potential necessity of third-party testing for certification, and the need to prioritize critical failures given limited resources. This paper addresses these challenges by proposing three BSN testing approaches: PASTA, ValComb, and TransCov. These approaches share common characteristics, which are described through a general framework called GATE4BSN. PASTA simulates patients with sensors and models sensor trends using a Discrete Time Markov Chain (DTMC). ValComb explores various health conditions by considering all sensor risk level combinations, while TransCov ensures full coverage of DTMC transitions. We empirically evaluate these approaches, comparing them with a baseline approach in terms of failure detection. The results demonstrate that PASTA, ValComb, and TransCov uncover previously undetected failures in an open-source BSN and outperform the baseline approach. Statistical analysis reveals that PASTA is the most effective, while ValComb is 76 times faster than PASTA and nearly as effective.

As testified by new regulations like the European AI Act, worries about the human and societal impact of (autonomous) software technologies are becoming of public concern. Human, societal, and environmental values, alongside traditional software quality, are increasingly recognized as essential for sustainability and long-term well-being. Traditionally, systems are engineered taking into account business goals and technology drivers. Considering the growing awareness in the community, in this article, we argue that engineering of systems should also consider human, societal, and environmental drivers. Then, we identify the macro and technological challenges by focusing on humans and their role while co-existing with digital systems. The first challenge considers humans in a proactive role when interacting with digital systems, i.e., taking initiative in making things happen instead of reacting to events. The second concerns humans having a reactive role in interacting with digital systems, i.e., humans interacting with digital systems as a reaction to events. The third challenge focuses on humans with a passive role, i.e., they experience, enjoy or even suffer the decisions and/or actions of digital systems. The fourth challenge concerns the duality of trust and trustworthiness, with humans playing any role. Building on the new human, societal, and environmental drivers and the macro and technological challenges, we identify a research roadmap of digital systems for humanity. The research roadmap is concretized in a number of research directions organized into four groups: development process, requirements engineering, software architecture and design, and verification and validation.

The rise of AI-based and autonomous systems is raising concerns and apprehension due to potential negative repercussions arising from their behavior or decisions. These systems must be designed to comply with the human contexts in which they will operate. To this extent, Townsend et al. (2022) introduce the concept of SLEEC (social, legal, ethical, empathetic, or cultural) rules that aim to facilitate the formulation, verification, and enforcement of the rules AI-based and autonomous systems should obey. They lay out a methodology to elicit them and to let philosophers, lawyers, domain experts, and others to formulate them in natural language. To enable their effective use in AI systems, it is necessary to translate these rules systematically into a formal language that supports automated reasoning. In this study, we first conduct a linguistic analysis of the SLEEC rules pattern, which justifies the translation of SLEEC rules into classical logic. Then we investigate the computational complexity of reasoning about SLEEC rules and show how logical programming frameworks can be employed to implement SLEEC rules in practical scenarios. the result is a readily applicable strategy for implementing AI systems that conform to norms expressed as SLEEC rules.

The software of critical systems, such as automotive, is increasingly required to change and evolve after production. In the automotive domain, this is a consequence of self-driving and connected cars, which continuously collect data from the field that is then exploited to produce safer and more advanced and reliable versions of the used algorithms or AI modules. Consequently, there exists a need for techniques and tools to facilitate incremental and Continuous Compliance with safety and security standards. This paper focuses on software architectural metrics that can be used for Continuous Compliance in the automotive domain. Our initial stride involved a literature review to find metrics capable of assessing software architectures. Subsequently, in collaboration with architecture, safety, and security experts in the automotive domain, we proposed a framework defining the characteristics these metrics must possess for continuous evaluation of software architectural compliance. The framework was used to characterize 48 metrics gathered from the literature review and to associate them with a score expressing their suitability to be used in software architecture Continuous Compliance processes.

Software architectures are pivotal in the success of software-intensive systems and serve as foundational elements that significantly impact the overall software quality. Reference architectures abstract software elements, define main responsibilities and interactions within a domain, and guide the architectural design of new systems. Using reference architectures offers advantages like enhanced interoperability, cost reduction through reusability, decreased project risks, improved communication, and adherence to best practices. However, these benefits are most pronounced when software architectures align with reference architectures. Deviations from prescribed reference architectures can nullify these benefits. Uncontrolled misalignment can become prohibitively expensive, necessitating costly redevelopments, with maintenance costs reaching up to 90% of development costs. Conformance-checking processes and identifying and resolving violations in the software architecture are essential to mitigate misalignment. To address these challenges, we introduce the concept of continuous conformance that is expressed as a distance function, together with a process supporting it. Continuous conformance quantifies the degree to which a software architecture adheres to a designated reference architecture. The conformance concept enables multi-level, incremental, and non-blocking checking and restoration tasks and allows the check of partial architectures without obstructing the design process. We operationalize this process through an assistive modeling tool to architect an Internet of things-based system.

Marine in-situ data is collected by sensors mounted on fixed or mobile systems deployed into the ocean. This type of data is crucial both for the ocean industries and public authorities, e.g., for monitoring and forecasting the state of marine ecosystems and/or climate changes. Various public organizations have collected, managed, and openly shared in-situ marine data in the past decade. Recently, initiatives like the Ocean Decade Corporate Data Group have incentivized the sharing of marine data of public interest from private companies aiding in ocean management. However, there is no clear understanding of the impact of data quality in the engineering of systems, as well as on how to manage and exploit the collected data. In this paper, we propose main architectural decisions and a data flow-oriented component and connector view for marine in-situ data streams. Our results are based on a longitudinal empirical software engineering process, and driven by knowledge extracted from the experts in the marine domain from public and private organizations, and challenges identified in the literature. The proposed software architecture is instantiated and exemplified in a prototype implementation.

Machine learning is increasingly used in a wide set of applications ranging from recommendation engines to autonomous systems through business intelligence and smart assistants. Designing and developing machine learning systems is a complex process that can be eased by leveraging effective design decisions tackling the most important challenges and by having a good system and software architecture. The research goal of this work is to identify common challenges, best design practices, and main software architecture design decisions of machine learning enabled systems from the point of view of researchers and practitioners. We performed a mixed method including a systematic literature review and expert interviews. We started with a systematic literature review. From an initial set of 3038 studies, we selected 41 primary studies, which we analysed according to a data extraction, analysis, and synthesis process. In addition, we conducted 12 expert interviews that involved researchers and professionals with machine learning expertise from 9 different countries. We identify 35 design challenges, 42 best practices and 27 design decisions when architecting machine learning systems. By eliciting main design challenges, we contribute to best practices and design decisions. In addition, we identify correlations among design challenges, decisions and best practices. We believe that practitioners and researchers can benefit from this first and comprehensive analysis of current software architecture design challenges, best practices, and design decisions.

We are increasingly surrounded by systems connecting us with the digital world and facilitating our life by supporting our work, leisure, activities at home, health, and so on. These systems are pressed by two forces. On the one side, they operate in environments that are increasingly challenging due to uncertainty and uncontrollability. On the other side, they need to evolve, often in a continuous fashion, to meet changing needs, to offer new functionalities, or also to fix emerging failures. To make the picture even more complex, these systems rarely work in isolation and often need to collaborate with other systems, as well as humans. All such facets call for moving their validation during operation, as offered by approaches called testing in the field. In this article, we observe that even the field-based testing approaches should change over time to follow and adapt to the changes and evolution of collaborating systems or environments or users’ behaviors. We provide a taxonomy of this new category of testing that we call self-adaptive testing in the field (SATF) , together with a reference architecture for SATF approaches. To achieve this objective, we surveyed the literature and collected feedback and contributions from experts in the domain via a questionnaire and interviews.

Scenario-based testing for automated driving systems (ADS) must be able to simulate traffic scenarios that rely on interactions with other vehicles. Although many languages for high-level scenario modelling have been proposed, they lack the features to precisely and reliably control the required micro-simulation, while also supporting behavior reuse and test reproducibility for a wide range of interactive scenarios. To fill this gap between scenario design and execution, we propose the Simulated Driver-Vehicle (SDV) model to represent and simulate vehicles as dynamic entities with their behavior being constrained by scenario design and goals set by testers. The model combines driver and vehicle as a single entity. It is based on human-like driving and the mechanical limitations of real vehicles for realistic simulation. The model leverages behavior trees to express high-level behaviors in terms of lower-level maneuvers, affording multiple driving styles and reuse. Furthermore, optimization-based maneuver planners guide the simulated vehicles towards the desired behavior. Our extensive evaluation shows the model’s design effectiveness using NHTSA pre-crash scenarios, its motion realism in comparison to naturalistic urban traffic, and its scalability with traffic density. Finally, we show the applicability of our SDV model to test a real ADS and to identify crash scenarios, which are impractical to represent using predefined vehicle trajectories. The SDV model instances can be injected into existing simulation environments via co-simulation.

This paper proposes an evaluation framework for autonomous systems, called LENS. It is an instrument to make an assessment of a system through the lens of abilities related to adaptation and smartness. The assessment can then help engineers understand in which direction it is worth investing to make their system smarter. It also helps to identify possible improvement directions and to plan for concrete activities. Finally, it helps to make a re-assessment when the improvement has been performed in order to check whether the activity plan has been accomplished.Given the high variability in the various domains in which autonomous systems are and can be used, LENS is defined in abstract terms and instantiated to a specific and important class of medical devices, i.e., Programmable Electronic Medical Systems (PEMS). The instantiation, called LENSPEMS, is validated in terms ofapplicability, i.e., how it is applicable to real PEMS,generalizability, i.e., to what extent LENSPEMSis generalizable to the PEMS class of systems, andusefulness, i.e., how it is useful in making an assessment and identifying possible directions of improvement towards smartness.

Robotic systems are becoming pervasive and adopted in increasingly many domains, such as manufacturing, healthcare, and space exploration. To this end, engineering software has emerged as a crucial discipline for building maintainable and reusable robotic systems. The field of robotics software engineering research has received increasing attention, fostering autonomy as a fundamental goal. However, robotics developers are still challenged trying to achieve this goal given that simulation is not able to deliver solutions to realistically emulate real-world phenomena. Robots also need to operate in unpredictable and uncontrollable environments, which require safe and trustworthy self-adaptation capabilities implemented in software. Typical techniques to address the challenges are runtime verification, field-based testing, and mitigation techniques that enable fail-safe solutions. However, there is no clear guidance to architect ROS-based systems to enable and facilitate runtime verification and field-based testing. This paper aims to fill in this gap by providing guidelines that can help developers and quality assurance (QA) teams when developing, verifying or testing their robots in the field. These guidelines are carefully tailored to address the challenges and requirements of testing robotics systems in real-world scenarios. We conducted (i) a literature review on studies addressing runtime verification and field-based testing for robotic systems, (ii) mined ROS-based applications repositories, and (iii) validated the applicability, clarity, and usefulness via two questionnaires with 55 answers overall. We contribute 20 guidelines: 8 for developers and 12 for QA teams formulated for researchers and practitioners in robotic software engineering. Finally, we map our guidelines to open challenges thus far in runtime verification and field-based testing for ROS-based systems and, we outline promising research directions in the field.Guidelines website and replication package:https://ros-rvft.github.io.

Advances in Artificial Intelligence (AI), and in particular in Machine Learning (ML), are introducing profound changes to scholarly submissions across publication venues, affecting in particular the contributions that are being submitted to Software Engineering (SE) conferences and journals. In this context, it is not always clear whether manuscripts submitted to SE venues under the umbrella term SE for AI are indeed relevant to SE, in the sense that they explicitly contain contributions to the SE body of knowledge. This leads to recurring discussions on whether certain AI-related submissions are appropriate to SE venues, or should instead be submitted to other journals and conferences, including AI or ML-specific ones. In this editorial, we discuss the kinds of AI-related contributions that are a better fit-and a less good fit-for publication in the IEEE Transactions on Software Engineering.

Engineering digital twins following standardised reference architectures is an upcoming requirement for ensuring their adoption and facilitating their creation, processing, and integration. The ISO 23247 standard proposes a reference architecture for digital twins in manufacturing, including an entity-based reference model and a functional view specified in terms of functional entities. During our experience with projects in the field, we noticed that standards, and in particular the ISO 23247 standard, are not completely followed. In this paper, we analyse to what extent digital twin architectures documented in the literature are aligned with the reference architecture presented in the ISO 23247 standard. We achieved this through a mixed-methods research methodology that includes the analysis of 29 digital twin architectures in the manufacturing domain resulting from a systematic literature review of 140 peer-reviewed studies, a survey with 33 respondents, and four semi-structured, in-depth expert interviews. On the basis of our findings, practitioners and researchers can reflect, discuss, and plan actions for future research and development activities.

The importance of software architecture is largely recognized also in iterative and agile development settings. However, it is quite complex to provide evidence that an architecture is of good quality and that the architectural decisions are appropriate, correct, or optimal. Architecture evaluation aims at showing and providing confidence that design decisions contribute to fulfilling the stakeholder concerns. Some architecture evaluation methods are scenario-based and aim at balancing many potentially conflicting quality attributes. Other works focus on a specific quality attribute and provide metrics to measure it.In this paper we survey the state of the art in metrics for evaluating quality attributes of architectures. The elicited metrics are organized into a catalog, which associates them with the specific quality attributes they aim to measure. We contribute also an MDE framework that generates web views facilitating the analysis of architectures. In this way, researchers and practitioners can easily retrieve the metrics that are appropriate to their specific needs. The catalog of metrics and quality attributes is released to the research community and open to contributions from experts and practitioners.

Background: In-situ marine data has a low reusability rate, primarily due to differences in data usage objectives among stakeholders in data ecosystems. The extreme cost of collecting and maintaining in-situ marine data threatens the sustainable usage of the ocean. Aims: This paper provides an overview of current data and data quality (DQ) requirements. We also investigate limitations in the current practices that obstruct data reusability. The ultimate objective is to improve data requirements elicitation, leading to enhanced data reusability. Method: We interviewed 14 marine practitioners and researchers from 7 organizations with extensive experience in collecting, managing, and utilizing in-situ marine data. Results: We identify 9 representative use cases in the fishery, energy, and marine sciences industries, as well as their data and DQ requirements. The results give guidance to data producers to produce data meeting demands of a wider range of data consumers. At the same time, data consumers can refer to the compilation to identify existing data suiting their needs. Furthermore, we recommend a roadmap taken into account during requirements elicitation to improve 6 limitations in the current practices that obstruct data reusability.

Robots artificially replicate human capabilities thanks to their software, the main embodiment of intelligence. However, engineering robotics software has become increasingly challenging. Developers need expertise from different disciplines as well as they are faced with heterogeneous hardware and uncertain operating environments. To this end, the software needs to be variable-to customize robots for different customers, hardware, and operating environments. However, variability adds substantial complexity and needs to be managed-yet, ad hoc practices prevail in the robotics domain, challenging effective software reuse, maintenance, and evolution. To improve the situation, we need to enhance our empirical understanding of variability in robotics. We present a multiple-case study on software variability in the vibrant and challenging domain of service robotics. We investigated drivers, practices, methods, and challenges of variability from industrial companies building service robots. We analyzed the state-of-the-practice and the state-of-the-art-the former via an experience report and eleven interviews with two service robotics companies; the latter via a systematic literature review. We triangulated from these sources, reporting observations with actionable recommendations for researchers, tool providers, and practitioners. We formulated hypotheses trying to explain our observations, and also compared the state-of-the-art from the literature with the-state-of-the-practice we observed in our cases. We learned that the level of abstraction in robotics software needs to be raised for simplifying variability management and software integration, while keeping a sufficient level of customization to boost efficiency and effectiveness in their robots' operation. Planning and realizing variability for specific requirements and implementing robust abstractions permit robotic applications to operate robustly in dynamic environments, which are often only partially known and controllable. With this aim, our companies use a number of mechanisms, some of them based on formalisms used to specify robotic behavior, such as finite-state machines and behavior trees. To foster software reuse, the service robotics domain will greatly benefit from having software components-completely decoupled from hardware-with harmonized and standardized interfaces, and organized in an ecosystem shared among various companies.

The ocean is vital for humankind but may cause catastrophes when unhealthy. Although there have been efforts to build ocean monitoring systems, the understanding of the underwater environment is limited due to the cost and challenges of obtaining real-time marine data. One potential solution is to build stationary ocean observation systems based on wireless communication due to its affordable cost. In this study, we divide these systems into three components: 1) underwater data acquisition; 2) network communication; and 3) data management. We investigate the engineering challenges associated with each component, the causes, and how they relate. The literature has not discussed the technical issues of building stationary smart ocean monitoring systems entirely based on wireless communication yet. This article fills that research gap by conducting semi-structured interviews with 17 experts knowledgeable about underwater sensors, underwater acoustic communication, offshore network communication, and underwater data usage. The identified challenges are compared with the literature to assess whether our findings are novel or are a confirmation of what have been already found in prior publications. The Internet of Things (IoT) used in smart city platforms is quite advanced, but the Internet of Underwater Things (IoUT) employed in smart ocean monitoring systems has several unresolved issues; although IoT is viewed as a foundation for IoUT. Therefore, we compare fundamental differences between the technologies used in the smart city and the smart ocean domains, explaining why some of our identified challenges are unique in the marine context.

Artificial intelligence (AI) in its various forms finds more and more its way into complex distributed systems. For instance, it is used locally, as part of a sensor system, on the edge for low-latency high-performance inference, or in the cloud, e.g. for data mining. Modern complex systems, such as connected vehicles, are often part of an Internet of Things (IoT). This poses additional architectural challenges. To manage complexity, architectures are described with architecture frameworks, which are composed of a number of architectural views connected through correspondence rules. Despite some attempts, the definition of a mathematical foundation for architecture frameworks that are suitable for the development of distributed AI systems still requires investigation and study. In this paper, we propose to extend the state of the art on architecture framework by providing a mathematical model for system architectures, which is scalable and supports co-evolution of different aspects for example of an AI system. Based on Design Science Research, this study starts by identifying the challenges with architectural frameworks in a use case of distributed AI systems. Then, we derive from the identified challenges four rules, and we formulate them by exploiting concepts from category theory. We show how compositional thinking can provide rules for the creation and management of architectural frameworks for complex systems, for example distributed systems with AI. The aim of the paper is not to provide viewpoints or architecture models specific to AI systems, but instead to provide guidelines based on a mathematical formulation on how a consistent framework can be built up with existing, or newly created, viewpoints. To put in practice and test the approach, the identified and formulated rules are applied to derive an architectural framework for the EU Horizon 2020 project “Very efficient deep learning in the IoT” (VEDLIoT) in the form of a case study.

Abstract Reference architectures (RAs) are successfully used to represent families of concrete software architectures in several domains such as automotive, banking, and the Internet of Things. RAs inspire architects when designing concrete architectures, and they help to guarantee compliance with architectural decisions, regulatory requirements, as well as architectural qualities. Despite their importance, reference architectures still suffer from a number of open technical issues, including (i) the lack of a common interpretation, a precise notation for their representation and documentation, and (ii) the lack of conformance mechanisms for checking the compliance of concrete architectures to their related reference architecture, architectural decisions, regulatory requirements, etc. This paper addresses these two issues by introducing a model-driven approach that leverages (i) a domain-independent metamodel for the representation of reference architectures and (ii) the combination of model transformation and weaving techniques for the automatic conformance checking of concrete architectures. We evaluate the applicability, effectiveness, and generalizability of our approach using illustrative examples from the web browsers and automotive domains, including an assessment from an independent practitioner.

Computing systems form the backbone of many areas in our society, from manufacturing to traffic control, healthcare, and financial systems. When software plays a vital role in the design, construction, and operation, these systems are referred to as software-intensive systems. Self-adaptation equips a software-intensive system with a feedback loop that either automates tasks that otherwise need to be performed by human operators or deals with uncertain conditions. Such feedback loops have found their way to a variety of practical applications; typical examples are an elastic cloud to adapt computing resources and automated server management to respond quickly to business needs. To gain insight into the motivations for applying self-adaptation in practice, the problems solved using self-adaptation and how these problems are solved, and the difficulties and risks that industry faces in adopting self-adaptation, we performed a large-scale survey. We received 184 valid responses from practitioners spread over 21 countries. Based on the analysis of the survey data, we provide an empirically grounded overview the of state of the practice in the application of self-adaptation. From that, we derive insights for researchers to check their current research with industrial needs, and for practitioners to compare their current practice in applying self-adaptation. These insights also provide opportunities for applying self-adaptation in practice and pave the way for future industry-research collaborations.

With many applications across domains as diverse as logistics, healthcare, and agriculture, service robots are in increasingly high demand. Nevertheless, the designers of these robots often struggle with specifying their tasks in a way that is both human-understandable and sufficiently precise to enable automated verification and planning of robotic missions. Recent research has addressed this problem for the functional aspects of robotic missions through the use ofmission specification patterns. These patterns support the definition of robotic missions involving, for instance, the patrolling of a perimeter, the avoidance of unsafe locations within an area, or reacting to specific events. Our article introduces a catalog ofQUantitAtive RoboTic mission spEcificaTion patterns(QUARTET) that tackles the complementary and equally important challenge of specifying the reliability, performance, resource usage, and other key quantitative properties of robotic missions. Identified using a methodology that included the analysis of 73 research papers published in 17 leading software engineering and robotics venues between 2014–2021, our 22 QUARTET patterns are defined in a tool-supported domain-specific language. As such, QUARTET enables: (i) the precise definition of quantitative robotic-mission requirements and (ii) the translation of these requirements into probabilistic reward computation tree logic (PRCTL), supporting their formal verification and automated planning of robotic missions. We demonstrate the applicability of QUARTET by showing that it supports the specification of over 95% of the quantitative robotic mission requirements from a systematically selected set of recent research papers, of which 75% can be automatically translated into PRCTL for the purposes of verification through model checking and mission planning.

In this paper, we analyse trends and challenges that the automotive domain is living the last years. We then focus on the agile transformation and the need to compliance with safety and security standards. Finally, we discuss on the significance of continuous compliance.

The IEEE International Conference on Software Architecture is the premier venue for practitioners and researchers interested in software architecture, in component-based software engineering and in quality aspects of software and how these relate to the design of software. ICSA has a strong tradition as a working conference, where researchers meet practicing software architects who can explain the problems they face in their day-to-day duties, and who can influence the future of the field.

Testing in the field is gaining momentum, as a means to detect those failures that escape in-house testing by continuing the testing even while a system is operating in production. Among several approaches that are proposed, this paper focuses on the important notion of self-adaptivity of testing in the field, as such techniques need to adapt in many ways their strategy to the context and the emerging behaviors of the system under test. In this work, we investigate the topic by conducting a scoping review of the literature on self-adaptive testing in the field. We rely on a taxonomy organized in some categories that include the object to adapt, the adaptation trigger, the temporal characteristics, the realization issues, the interaction concerns, the type of field-based approach, and the impact/cost. Our study sheds light on self-adaptive testing in the field by identifying related key concepts and key characteristics and extracting some knowledge gaps to better guide future research.

Self-adaptation equips a software system with a feedback loop that automates tasks that otherwise need to be performed by operators. Such feedback loops have found their way to a variety of practical applications, one typical example is an elastic cloud. Yet, the state of the practice in self-adaptation is currently not clear. To get insights into the use of self-adaptation in practice, we are running a large-scale survey with industry. This paper reports preliminary results based on survey data that we obtained from 113 practitioners spread over 16 countries, 62 of them work with concrete self-adaptive systems. We highlight the main insights obtained so far: motivations for self-adaptation, concrete use cases, and difficulties encountered when applying self-adaptation in practice. We conclude the paper with outlining our plans for the remainder of the study.

The increasing importance of automation and smart capabilities for factories and other industrial systems has led to the concept of Industry 4.0 (I4.0). This concept aims at creating systems that improve the vertical and horizontal integration of production through (i) comprehensive and intelligent automation of industrial processes, (ii) informed and decentralized real-time decision making, and (iii) stringent quality requirements that can be monitored at any time. The I4.0 infrastructure, supported in many cases by robots, sensors, and algorithms, demands highly skilled workers able to continuously monitor the quality of both the items to be produced and the underlying production processes. While the first attempts to develop smart factories and enhance the digital transformation of companies are under way, we need adequate methods to support the identification and specification of quality attributes that are relevant to I4.0 systems. Our main contribution is to provide a refined version of the ISO 25010 quality model specifically tailored to those qualities demanded by I4.0 needs. This model aims to provide actionable support for I4.0 software engineers that are concerned with quality issues. We developed our model based on an exhaustive analysis of similar proposals using the design science method as well as expertise from seasoned engineers in the domain. We further evaluate our model by applying it to two important I4.0 reference architectures further clarifying its application.

In automotive, stage-gate processes have previously been the norm, with architecture created mainly during an early phase and then used to guide subsequent development phases. Current iterative and Agile development methods, where the implementation evolves continuously, changes the role of architecture. We investigate how architecture evaluation can provide useful feedback during development of continuously evolving systems. Starting from the Architecture Tradeoff Analysis Method (ATAM), we performed architecture evaluation, both in a national research project led by an automotive Original Equipment Manufacturer (OEM), and at the OEM, in the context of continuous development. This allows us to include the experience of several architects from different organizations over several years. Using data produced during the evaluations we perform a post-hoc analysis to derive initial findings. We then validate and refine these findings through a series of focus groups with architects and industry experts. We propose principles of continuous evaluation and evolution of architecture, and based on these discuss a roadmap for future research. In iterative development settings, the needs are different from what typical architecture evaluation methods provide. Our principles show the importance of dedicated feedback-loops for continuous evolution of systems and their architecture.

Abstract Mobile robots operate in various environments (e.g. aquatic, aerial, or terrestrial), they come in many diverse shapes and they are increasingly becoming parts of our lives. The successful engineering of mobile robotics systems demands the interdisciplinary collaboration of experts from different domains, such as mechanical and electrical engineering, artificial intelligence, and systems engineering. Research and industry have tried to tackle this heterogeneity by proposing a multitude of model-driven solutions to engineer the software of mobile robotics systems. However, there is no systematic study of the state of the art in model-driven engineering (MDE) for mobile robotics systems that could guide research or practitioners in finding model-driven solutions and tools to efficiently engineer mobile robotics systems. The paper is contributing to this direction by providing a map of software engineering research in MDE that investigates (1) which types of robots are supported by existing MDE approaches, (2) the types and characteristics of MRSs that are engineered using MDE approaches, (3) a description of how MDE approaches support the engineering of MRSs, (4) how existing MDE approaches are validated, and (5) how tools support existing MDE approaches. We also provide a replication package to assess, extend, and/or replicate the study. The results of this work and the highlighted challenges can guide researchers and practitioners from robotics and software engineering through the research landscape.

When designing complex automotive systems in practice, employed technologies and architectural decisions need to reflect business goals. While the software architecture community has acknowledged the need to align business goals with architectural decisions, there is a lack of practical approaches to achieve this alignment. In this paper, we intend to close this gap by providing a systematic approach for architecture-business alignment. The approach describes how to align architecture with business concerns by eliciting goals, identifying quality attributes, and deriving architectural tactics. We iteratively developed and evaluated the approach together with an international automotive manufacturer. We show the application of the proposed approach within our participating company leveraging a use case related to software-over-the-air technologies. The proposed approach is perceived as beneficial by our participants, since it provides a structured mechanism to align architecture and business goals by determining key architectural concerns as quality attributes and tactics.

During the COVID-19 pandemic, many researchers all over the world have offered their time and competencies to face the heavy consequences of the disease. This is the case of a group of physicists, engineers, and physicians that around the middle of March 2020 started to develop a simplified mechanical lung ventilator, called MVM (Mechanical Ventilator Milano), to answer the high request of ventilators for Acute Respiratory Distress Syndrome (ARDS) in intensive care units. A prototype was ready in around one month. Since medical software malfunctions can lead to injuries or death of patients, before marketing MVM ventilators and distributing them in hospitals, software certification in accordance with the IEC 62304 standard was mandatory to guarantee system reliability. The team was then complemented by computer scientists specifically devoted to this task. The software re-engineering process, which lasted around two months from the end of the prototype, brought to a strong re-implementation of the device software components, which involved all the stakeholders in a continuous integration setting. In this paper, we report the experience of the MVM control SW re-engineering necessary to show evidence that the SW adheres to the standards and to consequently obtain the certification. We share results and lessons learned from this social project, where more than 100 volunteer researchers worked towards software certification at the extreme of their strength to get a real device finished in a rush since strongly required to support physicians in treating COVID-19 patients.

Abstract Mobile robots are becoming increasingly important in society. Fulfilling complex missions in different contexts and environments, robots are promising instruments to support our everyday live. As such, the task of defining the robot’s mission is moving from professional developers and roboticists to the end-users. However, with the current state-of-the-art, defining missions is non-trivial and typically requires dedicated programming skills. Since end-users usually lack such skills, many commercial robots are nowadays equipped with environments and domain-specific languages tailored for end-users. As such, the software support for defining missions is becoming an increasingly relevant criterion when buying or choosing robots. Improving these environments and languages for specifying missions toward simplicity and flexibility is crucial. To this end, we need to improve our empirical understanding of the current state-of-the-art of such languages and their environments. In this paper, we contribute in this direction. We present a survey of 30 mission specification environments for mobile robots that come with a visual and end-user-oriented language. We explore the design space of these languages and their environments, identify their concepts, and organize them as features in a feature model. We believe that our results are valuable to practitioners and researchers designing the next generation of mission specification languages in the vibrant domain of mobile robots.

Mobile and general-purpose robots increasingly support everyday life, requiring dependable robotics control software. Creating such software mainly amounts to implementing complex behaviors known as missions. Recognizing this need, a large number of domain-specific specification languages has been proposed. These, in addition to traditional logical languages, allow the use of formally specified missions for synthesis, verification, simulation or guiding implementation. For instance, the logical language LTL is commonly used by experts to specify missions as an input for planners, which synthesize a robot's required behavior. Unfortunately, domain-specific languages are usually tied to specific robot models, while logical languages such as LTL are difficult to use by non-experts. We present a catalog of 22 mission specification patterns for mobile robots, together with tooling for instantiating, composing, and compiling the patterns to create mission specifications. The patterns provide solutions for recurrent specification problems; each pattern details the usage intent, known uses, relationships to other patterns, and—most importantly—a template mission specification in temporal logic. Our tooling produces specifications expressed in the temporal logics LTL and CTL to be used by planners, simulators or model checkers. The patterns originate from 245 mission requirements extracted from the robotics literature, and they are evaluated upon a total of 441 real-world mission requirements and 1251 mission specifications. Five of these reflect scenarios defined with two well-known industrial partners developing human-size robots. We further validate our patterns’ correctness with simulators and two different types of real robots.

Driven by software, the automotive domain is living an unprecedented revolution with original equipment manufacturers increasingly becoming software companies. Vehicle electrical and electronic software architectures are considered means for addressing several concerns, which span from safety to security, through electrification and autonomy. Such architectures serve also as pivotal means for enabling communication between an original equipment manufacturer and suppliers (tier 1 and 2 companies) within the automotive ecosystem. In the automotive domain, software architectures include (at least) three different views of descending abstraction: functional, logical, and technical. In this work, we focus on the technical view with a two-folded contribution. On the one hand, we propose a feature model of technical architectures for automotive systems. On the other hand, starting from the elicited feature model, we present three technical reference architectures able to guide three generations of automotive systems. We evaluate the contribution of this work by means of a focus group validation session and short semi-structured interviews with automotive experts and practitioners.

We address the problem of automatically constructing a formal robotic mission specification in a logic language with precise semantics starting from an informal description of the mission requirements. We present CROME (Contract-based RObotic Mission spEcification), a framework that allows capturing mission requirements in terms of goals by using specification patterns, and automatically building linear temporal logic mission specifications conforming with the requirements. CROME leverages a new formal model, termed Contract-based Goal Graph (CGG), which enables organizing the requirements in a modular way with a rigorous compositional semantics. By relying on the CGG, it is then possible to automatically: i) check the feasibility of the overall mission, ii) further refine it from a library of pre-defined goals, and iii) synthesize multiple controllers that implement different parts of the mission at different abstraction levels, when the specification is realizable. If the overall mission is not realizable, CROME identifies mission scenarios, i.e., sub-missions that can be realizable. We illustrate the effectiveness of our methodology and supporting tool on a case study.

Robots that support humans by performing useful tasks (a.k.a., service robots) are booming worldwide. In contrast to industrial robots, the development of service robots comes with severe software engineering challenges, since they require high levels of robustness and autonomy to operate in highly heterogeneous environments. As a domain with critical safety implications, service robotics faces a need for sound software development practices. In this paper, we present the first large-scale empirical study to assess the state of the art and practice of robotics software engineering. We conducted 18 semi-structured interviews with industrial practitioners working in 15 companies from 9 different countries and a survey with 156 respondents from 26 countries from the robotics domain. Our results provide a comprehensive picture of (i) the practices applied by robotics industrial and academic practitioners, including processes, paradigms, languages, tools, frameworks, and reuse practices, (ii) the distinguishing characteristics of robotics software engineering, and (iii) recurrent challenges usually faced, together with adopted solutions. The paper concludes by discussing observations, derived hypotheses, and proposed actions for researchers and practitioners.

Abstract Developing robotic applications is a complex task, which requires skills that are usually only possessed by highly-qualified robotic developers. While formal methods that help developers in the creation and design of robotic applications exist, they must be explicitly customized to be impactful in the robotics domain and to support effectively the growth of the robotic market. Specifically, the robotic market is asking for techniques that: (i) enable a systematic and rigorous design of robotic applications though high-level languages; and (ii) enable the automatic synthesis of low-level controllers, which allow robots to achieve their missions. To address these problems we present the PuRSUE (Planner for RobotS in Uncontrollable Environments) approach, which aims to support developers in the rigorous and systematic design of high-level run-time control strategies for robotic applications. The approach includes PuRSUE-ML a high-level language that allows for modeling the environment, the agents deployed therein, and their missions. PuRSUE is able to check automatically whether a controller that allows robots to achieve their missions might exist and, then, it synthesizes a controller. We evaluated how PuRSUE helps designers in modeling robotic applications, the effectiveness of its automatic computation of controllers, and how the approach supports the deployment of controllers on actual robots. The evaluation is based on 13 scenarios derived from 3 different robotic applications presented in the literature. The results show that: (i) PuRSUE-ML is effective in supporting designers in the formal modeling of robotic applications compared to a direct encoding of robotic applications in low-level modeling formalisms; (ii) PuRSUE enables the automatic generation of controllers that are difficult to create manually; and (iii) the plans generated with PuRSUE are indeed effective when deployed on actual robots.

Traceability is crucial for many activities in software and systems engineering including monitoring the development progress, and proving compliance with standards. In practice, the use and maintenance of trace links are challenging as artifacts undergo constant change, and development takes place in distributed scenarios with multiple collaborating stakeholders. Although traceability management in general has been addressed in previous studies, there is a need for empirical insights into the collaborative aspects of traceability management and how it is situated in existing development contexts. The study reported in this paper aims to close this gap by investigating the relation of collaboration and traceability management, based on an understanding of characteristics of the development effort. In our multiple exploratory case study, we conducted semi-structured interviews with 24 individuals from 15 industrial projects. We explored which challenges arise, how traceability management can support collaboration, how collaboration relates to traceability management approaches, and what characteristics of the development effort influence traceability management and collaboration. We found that practitioners struggle with the following challenges: (1) collaboration across team and tool boundaries, (2) conveying the benefits of traceability, and (3) traceability maintenance. If these challenges are addressed, we found that traceability can facilitate communication and knowledge management in distributed contexts. Moreover, there exist multiple approaches to traceability management with diverse collaboration approaches, i.e., requirements-centered, developer-driven, and mixed approaches. While traceability can be leveraged in software development with both agile and plan-driven paradigms, a certain level of rigor is needed to realize its benefits and overcome challenges. To support practitioners, we provide principles of collaborative traceability management. The main contribution of this paper is empirical evidence of how culture, processes, and organization impact traceability management and collaboration, and principles to support practitioners with collaborative traceability management. We show that collaboration and traceability management have the potential to be mutually beneficial—when investing in one, also the other one is positively affected.

The automotive domain is rapidly changing in the last years. Among the different challenges OEMs (i.e. the vehicle manufacturers) are facing, vehicles are evolving into systems of systems. In fact, over the last years vehicles have evolved from disconnected and “blind” systems to systems that are (i) able to sense the surrounding environment and (ii) connected with other vehicles, the city, pedestrians, cyclists, etc. Future transportation systems can be seen as a System of Systems (SoS). In an SoS, constituent systems, i.e. the units that compose an SoS, can act as standalone systems, but their cooperation enables new emerging and promising scenarios. While this trend creates new opportunities, it also poses a risk to compromise key qualities such as safety, security, and privacy. In this paper we focus on the automotive domain and we investigate how to engineer and architect cars in order to build them as constituents of future transportation systems. Our contribution is an architectural viewpoint for System of Systems, which we demonstrate based on an automotive example. Moreover, we contribute a functional reference architecture for cars as constituents of an SoS. This reference architecture can be considered as an imprinting for the implementations that would be devised in specific projects and contexts. We also point out the necessity for a collaboration among different OEMs and with other relevant stakeholders, such as road authorities and smart cities, to properly engineer systems of systems composed of cars, trucks, roads, pedestrians, etc. This work is realized in the context of two Swedish projects coordinated by Volvo Cars and involving some universities and research centers in Sweden and many suppliers of the OEM, including Autoliv, Arccore, Combitech, Cybercom, Knowit, Prevas, ÅF-Technology, Semcom, and Qamcom.

The need to support software architecture evolution has been well recognized, even more since the rise of agile methods. However, assuring the conformance between architecture descriptions and the implementation remains challenging. Inconsistencies emanate among multiple architecture descriptions, and between architecture descriptions and code. As a consequence, architecture descriptions are not always trusted and used to the extent that their authors wish for. In this paper, we present two surveys with 93 and 72 participants to examine architectural inconsistencies, with a focus on how they evolve over time and can be mitigated using practical guidelines. We identified the importance of capturing emerging elements to keep the architecture description consistent with the implementation, and consider the current-state and future-state architecture separately. Consequences of inconsistencies typically arise at later stages, especially if an architecture description concerns multiple teams. Our guidelines suggest to limit the upfront architecture to stable decisions, while paying attention to concerns that matter across team borders. In the ideal case, companies should aim to integrate architects into the teams to capture emerging aspects with time.

Practitioners struggle with creating and evolving an architecture when developing complex and safety-critical systems in large-scale agile contexts. A key issue is the trade-off between upfront planning and flexibility to embrace change. In particular, the coordination of interfaces is an important challenge, as interfaces determine and regulate the exchange of information between components, subsystems, and systems, which are often developed by multiple teams. In a fast-changing environment, boundary objects between teams can provide the sufficient stability to align software or systems, while maintaining a sufficient degree of autonomy. However, a better understanding of interfaces as boundary objects is needed to give practical guidance. This paper presents an exploratory case study with an automotive OEM to identify characteristics of different interfaces, from non-critical interfaces that can be changed frequently and quickly, to those that are critical and require more stability and a rigorous change process. We identify what dimensions impact how interfaces are changed, what categories of interfaces exist along these dimensions, and how categories of interfaces change over time. We conclude with suggestions for practices to manage the different categories of interfaces in large-scale agile development.

Mobile robots are increasingly used in our everyday life to autonomously realize missions. A variety of languages has been proposed to support roboticists in the systematic development of robotic applications, ranging from logical languages with well-defined semantics to domain-specific languages with user-friendly syntax. The characteristics of both of them have distinct advantages, however, developing a language that combines those advantages remains an elusive task. We present PROMISE, a novel language that enables domain experts to specify missions on a high level of abstraction for teams of autonomous robots in a user-friendly way, while having well-defined semantics. Our ambition is to permit users to specify high-level goals instead of a series of specific actions the robots should perform. The language contains a set of atomic tasks that can be executed by robots and a set of operators that allow the composition of these tasks in complex missions. The language is supported by a standalone tool that permits mission specification through a textual and a graphical interface and that can be integrated within a variety of frameworks. We integrated PROMISE with a software platform providing functionalities such as motion control and planning. We conducted experiments to evaluate the correctness of the specification and execution of complex robotic missions with both simulators and real robots. We also conducted two user studies to assess the simplicity of PROMISE. The results show that PROMISE effectively supports users to specify missions for robots in a user-friendly manner.

Automotive manufacturers have historically adopted rigid requirements engineering processes. This allowed them to meet safety-critical requirements when producing a highly complex and differentiated product out of the integration of thousands of physical and software components. Nowadays, few software-related domains are as rapidly changing as the automotive industry. In particular, the needs of improving development speed are increasingly pushing companies in this domain toward new ways of developing software. In this paper, we investigate how the goal to increase development speed impacts how requirements are managed in the automotive domain. We start from a manager perspective, which we then complement with a more general perspective. We used a qualitative multiple-case study, organized in two steps. In the first step, we had 20 semi-structured interviews, at two automotive manufacturers. Our sampling strategy focuses on manager roles, complemented with technical specialists. In the second step, we validated our results with 12 more interviews, covering nine additional respondents and three recurring from the first step. In addition to validating our qualitative model, the second step of interviews broadens our perspective with technical experts and change managers. Our respondents indicate and rank six aspects of the current requirements engineering approach that impact development speed. These aspects include the negative impact of a requirements style dominated by safety concerns as well as decomposition of requirements over many levels of abstraction. Furthermore, the use of requirements as part of legal contracts with suppliers is seen as hindering fast collaboration. Six additional suggestions for potential improvements include domain-specific tooling, model-based requirements, test automation, and a combination of lightweight upfront requirements engineering preceding development with precise specifications post-development. Out of these 12 aspects, seven can likely be addressed as part of an ongoing agile transformation. We offer an empirical account of expectations and needs for new requirements engineering approaches in the automotive domain, necessary to coordinate hundreds of collaborating organizations developing software-intensive and potentially safety-critical systems.

Summary Agile methods are increasingly introduced in automotive companies in the attempt to become more efficient and flexible in the system development. The adoption of agile practices influences communication between stakeholders and makes companies rethink the management of artifacts and documentation like requirements, safety compliance documents, and architecture models. Practitioners aim to reduce irrelevant documentation but face a lack of guidance to determine what artifacts are needed and how they should be managed. This paper presents artifacts, challenges, guidelines, and practices for the continuous management of systems engineering artifacts in automotive based on a theoretical and empirical understanding of the topic. In collaboration with 53 practitioners from six automotive companies, we conducted a design‐science study involving interviews, a questionnaire, focus groups, and practical data analysis of a systems engineering tool. The guidelines suggest the distinction between artifacts that are shared among different actors in a company (boundary objects) and those that are used within a team (locally relevant artifacts). We propose an analysis approach to identify boundary objects and three practices to manage systems engineering artifacts in industry.

Robotic applications are typically realized using ad hoc and domain-specific solutions, which challenges the engineering and cross-project reuse of such applications. Especially in complex scenarios, where self-adaptive robots collaborate among themselves or with humans, the effective and systematic engineering of such applications is becoming increasingly important. Such scenarios require decentralized software architectures that foster fault-tolerant ways of managing large teams of (possibly) heterogeneous robots. To the best of our knowledge, no existing architecture for robot applications supports decentralized and self-adaptive collaboration. To address this gap, we conducted a design science study with 21 practitioners and experts in the field of robotics to develop an architecture fulfilling these requirements through several iterations. We present SERA, an architecture for robot applications that supports human-robot collaboration, as well as adaptation and coordination of single- and multi-robot systems in a decentralized fashion. SERA is based on layers that contain components that manage the adaptation at different levels of abstraction and communicate through well-defined interfaces. We successfully validated SERA by considering a set of real scenarios, by both using simulators and real robots, by involving robotic experts, and by benchmarking it with state-of-the-art solutions.

Automotive companies increasingly include proven agile methods in their plan-driven system development. The adoption of agile methods impacts not only the way individuals collaborate, but also the management of artifacts like requirements, test cases, safety documentation, and models. While practitioners aim to reduce unnecessary documentation, there is a lack of guidance for automotive companies with respect to what artifacts are needed and how to manage them. To close this knowledge gap and create practical guidelines, we conducted a design-science study together with 53 practitioners from six automotive companies. Using interviews, surveys, and focus groups, we analyzed categories of artifacts and practical challenges to create applicable guidelines to collaboratively manage artifacts in agile automotive contexts. Our findings indicate that different practices are required to manage artifacts that are shared among different teams within the company (boundary objects) and those that are relevant within a specific team (locally relevant artifacts).

Context: Historically, automotive manufacturers have adopted rigid requirements engineering processes, which allowed them to meet safety-critical requirements while integrating thousands of physical and software components into a highly complex and differentiated product. Nowadays, needs of improving development speed are pushing companies in this domain towards new ways of developing software. Objectives: We aim at obtaining a manager perspective on how the goal to increase development speed impacts how software intense automotive systems are developed and their requirements managed. Methods: We used a qualitative multiple-case study, based on 20 semi-structured interviews, at two automotive manufacturers. Our sampling strategy focuses on manager roles, complemented with technical specialists. Results: We found that both a requirements style dominated by safety concerns, and decomposition of requirements over many levels of abstraction impact development speed negatively. Furthermore, the use of requirements as part of legal contracts with suppliers hiders fast collaboration. Suggestions for potential improvements include domain-specific tooling, model-based requirements, test automation, and a combination of lightweight pre-development requirements engineering with precise specifications post-development. Conclusions: We offer an empirical account of expectations and needs for new requirements engineering approaches in the automotive domain, necessary to coordinate hundreds of collaborating organizations developing software-intensive and potentially safety-critical systems.

The practice of Continuous Integration (CI) has a big impact on how software is developed today. Shortening integration and feedback cycles promises to increase software quality, feature throughput, and customer satisfaction. Thus, it is not a surprise that companies try to embrace CI in domains where it is rather difficult to implement.

UAV-based systems are systems that are composed of a team of drones, various devices (like movable cameras, sensors), and human agents, which collaborate each other to accomplish defined missions. Since humans are constituent part of these systems, UAV-based systems are both mission-critical and safety-critical. Moreover, these systems are requested to operate in potentially unpredictable and unknown environments. A model of the environment describing, e.g. obstacles, no-fly zones, wind and weather conditions might be available, however, the assumption that such model is both correct and complete is often wrong. In this paper, we describe a novel approach for managing the run-time adaptation of UAV-based systems. Our approach is based on a generic collective adaptation engine that addresses collective adaptation problems in a decentralized fashion, operates at run-time, and enables the addition of new entities at any time. Moreover, our approach dynamically understands which parts of the system should be selected to solve an adaptation issue. The feasibility and scalability of the approach have been empirically evaluated in the context of a private company surveillance scenario.

Along with technological developments and increasing competition there is a major incentive for companies to produce and market high quality products before their competitors. In order to conquer a bigger portion of the market share, companies have to ensure the quality of the product in a shorter time frame. To accomplish this task companies try to automate their test processes as much as possible. It is critical to investigate and understand the problems that occur during different stages of test automation processes. In this paper we report on a case study on automatic analysis of non-functional test results. We discuss challenges in the face of continuous integration and deployment and provide improvement suggestions based on interviews at a large company in Sweden. The key contributions of this work are filling the knowledge gap in research about performance regression test analysis automation and providing warning signs and a road map for the industry.

Multicopters are increasingly popular since they promise to simplify a myriad of everyday tasks. Currently, vendors provide low-level APIs and basic primitives to program multicopters, making mission development a task-specific and error-prone activity. As a consequence, current approaches are affordable only for users that have a strong technical expertise. Then, software engineering techniques are needed to support the definition, development, and realization of missions at the right level of abstraction and involving teams of autonomous multicopters that guarantee the safety today's users expect. In this paper we describe a tool that enables end-users with no technical expertise, e.g., firefighters and rescue workers, to specify missions for a team of multicopters. The detailed flight plan that each multicopter must perform to accomplish the specified mission is automatically generated by preventing collisions between multicopters and obstacles, and ensuring the preservation of no-fly zones.

The automotive industry is currently going through an enormous change, transitioning from being pure hardware and mechanical companies to becoming more software focused. Currently, software development is embedded into a V-Model process that defines how software requirements are extracted from system requirements. In recent years, OEMs have come to recognize the importance and opportunities offered by software, which include better management and shorter time-to-market of distinguishing features. Strategies to better utilize software include in-house software development and new ways to collaborate with suppliers. However, in their effort to take advantage of these opportunities, engineers struggle with the formal process imposed on software development. In this paper, we investigate the impact of this struggle on the flow of requirements, including challenges and practices. We found that new ways of working with requirements had emerged that are partly not supported, partly hindered by the old tooling and processes for requirements engineering. Requirements flow both vertical and horizontal in the organization and across the supply-chain. Support for the new way of working should allow us to refine requirements iteratively throughout their life-cycle, handle the discussion of rationales, and to manage assumptions. We found strategies of achieving this to differ not only between OEMs, but also between different divisions inside the OEMs.

To investigate the new requirements and challenges of architecting often safety critical software in the automotive domain, we have performed two case studies on Volvo Car Group and Volvo Group Truck Technology. Our findings suggest that automotive software architects produce two different architectures (or views) of the same system. The first one is a high-level descriptive architecture, mainly documenting system design decisions and describing principles and guidelines that should govern the overall system. The second architecture is the working architecture, defining the actual blueprint for the implementation teams and being used in their daily work. The working architecture is characterized by high complexity and considerably lower readability than the high-level architecture. Unfortunately, the team responsible for the high-level architecture tends to get isolated from the rest of the development organization, with few communications except regarding the working architecture. This creates tensions within the organizations, sub-optimal design of the communication matrix and limited usage of the high-level architecture in the development teams. To adapt to the current pace of software development and rapidly growing software systems new ways of working are required, both on technical and on an organizational level.

Abstract Free and Open‐Source Software (FOSS) Linux distributions are among the most complex modern software systems. They are made of thousands of components (software packages) evolving rapidly without centralized coordination. The upgrade of FOSS systems is managed by meta‐installers, which solve package dependencies and conflicts and lead the system to a new system configuration by installing or removing packages. Current tools are able to predict a very limited set of upgrade faults before deployment, and this leaves a wide range of faults unpredicted. In this paper, we focus on faults that remain unpredicted, for example, missing packages, packages that are not properly installed, and missing services, with the aim of providing a solution for them. Specifically, in this paper, we propose a model‐driven approach and supporting tools to prevent specific classes of system configuration faults before performing the real upgrade. Once the system configuration is represented as a model, the configuration model is evaluated by means of queries, each devoted to discover a specific class of faults. The approach is intrinsically extensible so that user communities can add new queries when new classes of faults are identified. The approach has been validated by executing the fault detector on configuration models in which faults have been intentionally injected and by analyzing produced results. Copyright © 2015 John Wiley & Sons, Ltd.

Formal methods offer an effective means to assert the correctness of software systems through mathematical reasoning. However, the need to formulate system properties in a purely mathematical fashion can create pragmatic barriers to the application of these techniques. For this reason, Dwyer et al. invented property specification patterns which is a system of recurring solutions to deal with the temporal intricacies that would make the construction of reactive systems very hard otherwise. Today, property specification patterns provide general rules that help practitioners to qualify order and occurrence, to quantify time bounds, and to express probabilities of events. Nevertheless, a comprehensive framework combining qualitative, real-time, and probabilistic property specification patterns has remained elusive. The benefits of such a framework are twofold. First, it would remove the distinction between qualitative and quantitative aspects of events; and second, it would provide a structure to systematically discover new property specification patterns. In this paper, we report on such a framework and present a unified catalogue that combines all known plus 40 newly identified or extended patterns. We also offer a natural language front-end to map patterns to a temporal logic of choice. To demonstrate the virtue of this new framework, we applied it to a variety of industrial requirements, and use PSPWizard, a tool specifically developed to work with our unified pattern catalogue, to automatically render concrete instances of property specification patterns to formulae of an underlying temporal logic of choice.

Software is increasingly produced according to a certain goal and by integrating existing software produced by third-parties, typically black-box, and often provided without a machine readable documentation. This implies that development processes of the next future have to explicitly deal with an inherent incompleteness of information about existing software, notably on its behaviour. Therefore, on one side a software producer will less and less know the precise behaviour of a third party software service, on the other side she will need to use it to build her own application. In this paper we present an innovative development process to automatically produce dependable software systems by integrating existing services under uncertainty and according to the specied goal. Moreover, we (i) discuss important challenges that must be faced while producing the kind of systems we are targeting, (ii) give an overview of the state of art related to the identied challenges, and finally (iii) provide research directions to address these challenges.

Many times we are faced with the proliferation of definitions, concepts, languages, and tools in certain (research) topics. But often there is a gap between what is provided by existing technologies and what is needed by their users. The strengths, limitations, and needs of the available technologies can be dubious. The same applies to software architectures, and specifically to languages designed to represent architectural models. Tens of different architectural languages have been introduced by the research and industrial communities in the last two decades. However, it is unclear if they fulfill the user's perceived needs in architectural description. As a way to plan for next generation languages for architectural description, this study analyzes practitioners' perceived strengths, limitations, and needs associated with existing languages for software architecture modeling in industry. We run a survey by interviewing 48 practitioners from 40 different IT companies in 15 countries. Each participant is asked to fill in a questionnaire of 51 questions. By analyzing the data collected through this study, we have concluded that 1) while practitioners are generally satisfied with the design capabilities provided by the languages they use, they are dissatisfied with the architectural language analysis features and their abilities to define extra-functional properties; 2) architectural languages used in practice mostly originate from industrial development instead of from academic research; 3) more formality and better usability are required of an architectural language.

Software systems increasingly require to deal with continuous evolution. In this paper we present the EVOSS tool that has been defined to support the upgrade of free and open source software systems. EVOSS is composed of a simulator and of a fault detector component. The simulator is able to predict failures before they can affect the real system. The fault detector component has been defined to discover inconsistencies in the system configuration model. EVOSS improves the state of the art of current tools, which are able to predict a very limited set of upgrade faults, while they leave a wide range of faults unpredicted.

In the next future we will be surrounded by a virtually infinite number of software applications that provide computational software resources in the open Globe. This will radically change the way software will be produced and used. Users will be keen on producing their own piece of software, by also reusing existing software, to better satisfy their needs, therefore with a goal oriented, opportunistic use in mind. The produced software will need to be able to evolve, react and adapt to a continuously changing environment, while guaranteeing dependability. The strongest adversary to this view is the lack of knowledge on the software's structure, behavior, and execution context. Despite the possibility to extract observational models from existing software, a producer will always operate with software artifacts that exhibit a degree of uncertainty in terms of their functional and non functional characteristics. We believe that uncertainty can only be controlled by making it explicit and by using it to drive the production process itself. In this paper, we introduce a novel paradigm of software production process that explores available software and assesses its degree of uncertainty in relation to the opportunistic goal G, assists the producer in creating the appropriate integration means towards G, and validates the quality of the integrated system with respect to G and the current context.

Despite the flourishing of languages to describe software architectures, existing Architecture Description Languages (ADLs) are still far away from what it is actually needed. In fact, while they support a traditional perception of a Software Architecture (SA) as a set of constituting elements (such as components, connectors and interfaces), they mostly fail to capture multiple stakeholders concerns and their design decisions that represent a broader view of SA being accepted today. Next generation ADLs must cope with various and ever evolving stakeholder concerns by employing semantic extension mechanisms.

Most practising software architects operate within an architecture framework which is a coordinated set of viewpoints, models and notations prescribed for them. Whereas architecture frameworks are defined to varying degrees of rigour and offer varying levels of tool support, they tend to be closed: constituent elements are defined in different non-standard ways, they are not re-usable, and the creation of other frameworks requires a complete rework.With the aim to manage this issue, this paper presents MEGAF, an infrastructure for realizing architecture frameworks, which can be used to create architecture descriptions. It builds upon the conceptual foundations of ISO/IEC 42010 for architecture description. MEGAF is realized through megamodeling techniques and is implemented via Eclipse plugins.

Many architectural languages have been proposed in the last 15 years, each one with the chief aim of becoming the ideal language for specifying software architectures. What is evident nowadays, instead, is that architectural languages are defined by stakeholder concerns. Capturing all such concerns within a single, narrowly focused notation is impossible. At the same time, it is also impractical to define and use a "universal" notation, such as UML. As a result, many domain-specific notations for architectural modeling have been proposed, each one focusing on a specific application domain, analysis type, or modeling environment. As a drawback, a proliferation of languages exists, each one with its own specific notation, tools, and domain specificity. No effective interoperability is possible to date. Therefore, if a software architect has to model a concern not supported by his own language/tool, he has to manually transform (and, eventually, keep aligned) the available architectural specification into the required language/tool. This paper presents DUALLy, an automated framework that allows architectural languages and tools interoperability. Given a number of architectural languages and tools, they can all interoperate thanks to automated model transformation techniques. DUALLy is implemented as an Eclipse plugin. Putting it in practice, we apply the DUALLy approach to the Darwin/FSP ADL and to a UML2.0 profile for software architectures. By making use of an industrial complex system, we transform a UML software architecture specification in Darwin/FSP, make some verifications by using LTSA, and reflect changes required by the verifications back to the UML specification.

DUALLY is a framework that allows architectural languages interoperability through automated model transformation techniques. Any transformation among ADLs is defined in DUALLY by passing through A0that is an extensible semantic core set of modeling elements. In this paper we describe the integration of AADL and the corresponding OSATE tool-set in DUALLY. Once AADL is hooked to A0, it is automatically integrated with the network of languages already integrated in DUALLY. In particular, we show how it is possible, in an easy way, to obtain a UML specification and to model check AADL and behavioral annex specifications through LTSA.

Web-services are broadly considered as an effective means to achieve interoperability between heterogeneous parties of a business process and offer an open platform for developing new composite web-services out of existing ones. In the literature many approaches have been proposed with the aim to automatically compose web-services. All of them assume that, along with the web-service signature, some information is provided about how clients interacting with the web-service should behave when invoking it.

Introduced in the early stages of software development, the Charmy framework assists the software architect in making and evaluating architectural choices. Rarely, the software architecture of a system can be established once and forever. Most likely poorly defined and understood architectural constraints and requirements force the software architect to accept ambiguities and move forward to the construction of a suboptimal software architecture. Charmy aims to provide an easy and practical tool for supporting the iterative modeling and evaluation of software architectures. From an UML-based architectural design, an executable prototype is automatically created. Charmy simulation and model checking features help in understanding the functioning of the system and discovering potential inconsistencies of the design. When a satisfactory and stable software architecture is reached, Java code conforming to structural software architecture constraints is automatically generated through suitable transformations. The overall approach is tool supported.

Nowadays different notations for architectural modeling have been proposed, each one focussing on a specific application domain, analysis type, or modeling environment. No effective interoperability is possible to date. DUALLY is an automated framework that aims to offer an answer to this need allowing architectural languages and tools interoperability. DUALLY has been implemented as an Eclipse plugin and it is based on model transformation techniques. This demonstration paper shows DUALLY by applying its approach to two outstanding architectural description languages.

Simulation is a mean for verifying the quality of an architectural specification. Some approaches have been proposed in the past. Each approach has its own internal simulation engine, and allows for certain types of simulations. Goal of this paper is to propose SASlM, a software architecture-level simulation technique for modeling and simulating architectural specifications. It improves existing techniques, by permitting various kinds of simulation, and making use of SPIN as external simulator. This allows a real and useful integration between simulation and exhaustive verification. The paper discusses SASlM and compares it with existing techniques.

Although useful and increasingly put into regular use, current collaborative working environment (CWE) solutions have several limitations and relevant needs for further research. Most systems address either rather traditional and rigid intra-organizational collaboration scenarios or, at the opposite, completely free and unstructured open communitiespsilas interactions. Emerging dynamic, flexible and ad-hoc collaboration schemes are hardly or not supported at all. Typically, explicit representation of the collaboration context, of workerspsila and teampsilas goals and the semantics of underlying business process are not addressed, and this makes difficult to ensure the context and process awareness, personalisation and collaboration support required in knowledge-rich interactions. Aiming at getting collaborative working environments free from rigid constraints, POPEYE considers P2P over wireless ad hoc groups, where fixed infrastructure is not a prerequisite, where virtual communities can emerge spontaneously and share data with the appropriate quality of service for business applications (persistence, synchronisation, security,....).

Fault tolerance engineering has been advocated as one of the main approaches to ensuring the overall system dependability. The 2nd International Workshop on Engineering Fault Tolerant Systems (EFTS 2007) aims to investigate how fault tolerance mechanisms can be taken into account when engineering complex software systems and to improve our understanding of where and how fault-tolerance should be integrated in the software life-cycle. The focus of the workshop is on developing novel models to be applied at different abstraction levels (requirements, architecture and design models for fault tolerance, together with new implementation schemes), innovative technologies (tools and frameworks for implementing distributed fault tolerant systems) and advanced verification environments (to assess the achieved level of fault tolerance and to evaluate the dependability properties of the systems). Recently there has been a growing interest in the areas directly related and overlapping with fault tolerance, such as self-healing, resilience, self-adaptation and self-management. The topics related to engineering of systems with such properties are in the scope of the workshop as the intention is to improve the current understanding of how fault tolerance engineering can benefit from research on these areas.

While typical solutions focus on fault tolerance (and specifically, exception handling) during the design and implementation phases of the software life-cycle (e.g., Java and Windows NT exception handling), more recently the need for explicit exception handling solutions during the entire life cycle has been advocated by some researchers. Several solutions have been proposed for fault tolerance via exception handling at the software architecture and component levels. This paper describes how the two concepts of fault tolerance and software architectures have been integrated so far. It is structured in two parts (overview on fault tolerance and exception handling, and integrating fault tolerance into software architecture) and is based on a survey study on architecting fault tolerant systems where more than fifteen approaches have been analyzed and classified. This paper concludes by identifying those issues that remain still open and require deeper investigation.

This paper presents an implementation framework, called CAA-DRIP, that has been defined to allow a straightforward implementation of dependable distributed applications designed using the coordinated atomic action (CAA) paradigm. CAAs provide a coherent set of concepts adapted to the design of fault tolerant distributed systems that includes: structured transactions, distribution, cooperation, competition, and forward and backward error recovery mechanisms triggered by exceptions. DRIP (dependable remote interacting processes) is an efficient Java implementation framework, which provides support for implementing "dependable multiparty interactions (DMI)" which includes a general exception handling mechanism. As DMI has a softer exception handling semantics with respect to CAA semantics, a CAA design can be implemented by DRIP. The aim of the CAA-DRIP framework is to provide a set of Java classes that allows programmers to implement only the semantics of CAAs with the same terminology and concepts at the design and implementation levels. The new framework simplifies the implementation phase and at the same time reduces the size of the final system since it requires fewer number of instances for creating a CAA at runtime. Details of these improvements as well as a precise description of the CAAs behaviour in terms of state charts, which is used as a reference model to define the CAA-DRIP framework, are presented in this paper

CHARMY is a framework for designing and validating architectural specifications. In the early stages of the software development process, the CHARMY framework assists the software architect in the design and validation phases. To increase its usability in an industrial context, the tool allows the use of UML-like notations to graphically design the system. Once the design is done, a formal prototype is automatically created for simulation and analysis purposes. The framework provides extensibility mechanisms to enable the introduction of new design and analysis features.

Many formal languages have been proposed so far to describe software architectures (SA), but only very few of them are still supported and used in practical contexts. Many UML profiles and extensions have been provided when UML became a standard, in order to model as much as possible architectural concepts. They allow for an easy integration in industrial processes, however, different analysis techniques and domains still require different notations. In fact, since different communities require different information to be put into a diagram, depending on which architectural design aspects should be represented and analyzed, the idea of an unified UML language for SA is not adequate. Building on these considerations, we propose DUALLY, a core set of UML concepts, well suited for SA modeling, together with a framework which provides extensibility mechanisms to adapt the initial notation, in order to meet different needs.

In this paper we present a compositional reasoning to verify middleware-based software architecture descriptions. We consider a nowadays typical software system development, namely the development of a software application A on a middleware M. Our goal is to efficiently integrate verification techniques, like model checking, in the software life cycle in order to improve the overall software quality. The approach exploits the structure imposed on the system by the software architecture in order to develop an assume-guarantee methodology to reduce properties verification from global to local. We apply the methodology on a non-trivial case study namely the development of a Gnutella system on top of the SIENA event-notification middleware.

In recent years the necessity for handling different aspects of the system separately has introduced the need to represent SA (software architectures) from different viewpoints. In particular, behavioral views are recognized to be one of the most attractive features in the SA description, and in practical contexts, state diagrams and scenarios are the most widely used tools to model this view. Although very expressive, this approach has two drawbacks: system specification incompleteness and view consistency. Our work can be put in this context with the aim of managing incompleteness and checking view conformance: we propose the use of state diagrams and scenario models for representing system dynamics at the architectural level; they can be incomplete and we want to prove that they describe, from different viewpoints, the same system behavior. To reach this goal, we use the SPIN model checker and we implement a tool to manage the translation of architectural models in Promela and LTL.