Due to the increasing amount of software and hardware in connected and autonomous cars, the attack surface is growing, which increases the risk of security attacks. Researchers proposed machine learning or deep learning techniques to identify threats in in-vehicle networks. However, using these techniques is not enough to support the automotive industry since new processes or techniques must be conceptualized to make automotive systems more secure. Therefore, this research work presents a methodology, Quantum-based Automotive Threat Intelligence and Countermeasures (QUANTICAR), that integrates quantum optimization for CAN bus Intrusion Detection and the National Vulnerability Database (NVD) to understand the automotive attacks. In the first phase, QUANTICAR identifies the different types of attacks and then, based on the specific attack class, extracts new knowledge using the NVD. This contributes not only to improving attack detection but also to developing an Automotive Knowledge Base that can support developers and security experts in the secure development of automotive components in compliance with ISO/SAE 21434.

In the dynamic landscape of Quantum Software Engineering (QSE), ensuring the integrity of sensitive data is critical, which stipulates integrating security and privacy measures during the Quantum Software Development Life Cycle (QDLC) rather than providing cost-inefficient post-production software fixes. This paper proposes a Quantum Privacy Knowledge Base (QPKB) and Quantum Privacy-Oriented Software Development (QPOSD) approach that integrates privacy and security protocols into quantum hybrid software development, complementing existing software development processes. QPKB is formalized as the interrelationship between five key elements: Quantum Privacy by Design principles, Quantum Privacy Design Strategies, Quantum Privacy Patterns, Quantum Bugs and Vulnerabilities, and Quantum Hybrid Context. The step-by-step methodology for QPOSD spans analysis, design, coding, verification and validation, and deployment phases. With the help of a scenario, we demonstrate how QPOSD can effectively integrate security and privacy imperatives in QDLC. This study acts as a starting point for serving operational guidelines for quantum development teams, providing strategies for integrating privacy and security measures into QSE practices.

Currently and in the near future, Smart Cities are vital to enhance urban living, address resource challenges, optimize infrastructure, and harness technology for sustainability, efficiency, and improved quality of life in rapidly urbanizing environments. Owing to the high usage of networks, sensors, and connected devices, Smart Cities generate a massive amount of data. Therefore, Smart City security concerns encompass data privacy, Internet-of-Things (IoT) vulnerabilities, cyber threats, and urban infrastructure risks, requiring robust solutions to safeguard digital assets, citizens, and critical services. Some solutions include robust cybersecurity measures, data encryption, Artificial Intelligence (AI)-driven threat detection, public–private partnerships, standardized security protocols, and community engagement to foster a resilient and secure smart city ecosystem. For example, Security Information and Event Management (SIEM) helps in real-time monitoring, threat detection, and incident response by aggregating and analyzing security data. To this end, no integrated systems are operating in this context. In this paper, we propose a Hybrid Quantum-Classical Architecture for bolstering Smart City security that exploits Quantum Machine Learning (QML) and SIEM to provide security based on Quantum Artificial Intelligence and patterns/rules. The validity of the hybrid quantum-classical architecture was proven by conducting experiments and a comparison of the QML algorithms with state-of-the-art AI algorithms. We also provide a proof of concept dashboard for the proposed architecture.

Abstract The Information Security Management Systems (ISMS) are global and risk-driven processes that allow companies to develop their cybersecurity strategy by defining security policies, valuable assets, controls, and technologies for protecting their systems and information from threats and vulnerabilities. Despite the implementation of such management infrastructures, incidents or security breaches happen. Each incident has associated a level of severity and a set of mitigation controls, so in order to restore the ISMS, the appropriate set of controls to mitigate their damage must be selected. The time in which the ISMS is restored is a critical aspect. In this sense, classic solutions are efficient in resolving scenarios with a moderate number of incidents in a reasonable time, but the response time increases exponentially as the number of incidents increases. This makes classical solutions unsuitable for real scenarios in which a large number of incidents are handled and even less appropriate for scenarios in which security management is offered as a service to several companies. This paper proposes a solution to the incident response problem that acts in a minimal amount of time for real scenarios in which a large number of incidents are handled. It applies quantum computing, as a novel approach that is being successfully applied to real problems, which allows us to obtain solutions in a constant time regardless of the number of incidents handled. To validate the applicability and efficiency of our proposal, it has been applied to real cases using our framework (MARISMA).

In the last years, the raise of Artificial Intelligence (AI), and its pervasiveness in our lives, has sparked a flourishing debate about the ethical principles that should lead its implementation and use in society. Driven by these concerns, we conduct a rapid review of several frameworks providing principles, guidelines, and/or tools to help practitioners in the development and deployment of Responsible AI (RAI) applications. We map each framework w.r.t. the different Software Development Life Cycle (SDLC) phases discovering that most of these frameworks fall just in the Requirements Elicitation phase, leaving the other phases uncovered. Very few of these frameworks offer supporting tools for practitioners, and they are mainly provided by private companies. Our results reveal that there is not a "catching-all" framework supporting both technical and non-technical stakeholders in the implementation of real-world projects. Our findings highlight the lack of a comprehensive framework encompassing all RAI principles and all (SDLC) phases that could be navigated by users with different skill sets and with different goals.

Abstract Background.Dead code is a code smell. It can refer to code blocks, fields, methods, etc. that are unused and/or unreachable—e.g., if a method is unused and/or unreachable, it is a dead method. Past research has shown that the presence of dead code in source code harms its comprehensibility and maintainability. Nevertheless, there is still little empirical evidence on the spread of this code smell in the source code of commercial and open-source software applications. Aims.Our goal is to gather, through an exploratory study, empirical evidence on the spread and evolution of dead methods in open-source Java desktop applications. Method.We quantitatively analyzed the commit histories of 23 open-source Java desktop applications, whose software projects were hosted onGitHub. To investigate the spread and evolution of dead methods, we focused on dead methods detected at a commit level. The total number of analyzed commits in our study is 1,587. The perspective of our exploratory study is that of both practitioners and researchers. Results.We can summarize the most important take-away results as follows:(i)dead methods affect open-source Java desktop applications;(ii)dead methods generally survive for a long time before being “buried” or “revived;”(iii)dead methods that are then revived tend to survive less, as compared to dead methods that are then buried;(iv)dead methods are rarely revived; and(v)most dead methods are stillborn, rather than becoming dead later. Given the exploratory nature of our study, we believe that its results will help researchers to conduct more resource- and time-demanding research on dead methods and, in general, on dead code. Conclusions.We can conclude that developers should carefully handle dead code (and thus dead methods) since it is harmful, widespread, rarely revived, and survives for a long time in software applications.

Remote usability testing is performed by evaluators who are in different physical locations from the participants (synchronous remote testing) and possibly operating at different times (asynchronous remote testing). The tools developed in recent years to support remote tests exploit web technology based on HTML5 and JavaScript ES6 and thus enable previously unexplored scenarios. However, studies providing evidence on the benefits or drawbacks of utilizing recent web-based tools have not yet been reported in the literature. This article sheds some light on the impact of such tools on asynchronous remote usability testing of websites by reporting an experimental study with 100 participants and 15 evaluators to compare real-time laboratory tests with asynchronous remote tests. The study investigates: 1) how the metrics results of asynchronous remote usability tests performed through a web-based tool differ from those of usability tests conducted in real-time laboratory settings; and 2) how the experience of participants differs in the two types of tests. The lessons learned in the study are instrumental in informing the design of future tools. Some results of particular interest indicate that the web technology used by the tool for asynchronous remote testing affects task execution times and participants’ satisfaction. Another indication is that slow internet connections must be managed in asynchronous remote testing; slow connections introduce delays when transferring large amounts of collected data, which, together with the lack of human support, make participants of asynchronous remote tests more prone to feel negative emotions.

Background: Dead code is a code smell. It can refer to code blocks, variables, parameters, fields, methods, classes, etc. that are unused and/or unreachable. Aim: Results from past empirical studies indicate that dead code is widespread in both desktop and web-based software applications. Also, researchers have shown that both comprehensibility and maintainability of source code are negatively affected when dead code is present. Nevertheless, we still know little about maintenance operations involving dead code. Method: We conducted an exploratory empirical study on 13 open-source Java desktop applications, whose software projects were hosted on GitHub, to provide preliminary evidence on whether, and to what extent, developers modify dead code—more specifically, dead methods—when they deal with the maintenance of open-source Java desktop applications. Results: The most important results of our study can be summarized as follows: (i) developers modify dead methods; (ii) dead methods are modified to a different extent as compared to alive methods; (iii) developers spend time modifying dead methods that are removed in subsequent commits; and (iv) developers modify dead methods that are later revived to a different extent as compared to dead methods that are later removed. Conclusions: One of the conclusions of our study is: developers should remove dead methods, whose presence and purpose are not properly documented, to avoid unnecessary modifications to dead methods during the maintenance of software applications.

Background. Dead code is a code smell. It can refer to code blocks, fields, methods, etc. that are unused and/or unreachable. Empirical evidence shows that dead code harms source code comprehensibility and maintainability in software applications. Researchers have gathered little empirical evidence on the spread of dead code in software applications. Moreover, we know little about the role of this code smell during software evolution.

Abstract In recent years, we have been witnessing a rapid increase of research on exergames—i.e., computer games that require users to move during gameplay as a form of physical activity and rehabilitation. Properly balancing the need to develop an effective exercise activity with the requirements for a smooth interaction with the software system and an engaging game experience is a challenge. Model-driven software engineering enables the fast prototyping of multiple system variants, which can be very useful for exergame development. In this paper, we propose a framework, PhyDSLK, which eases the development process of personalized and engaging Kinect-based exergames for rehabilitation purposes, providing high-level tools that abstract the technical details of using the Kinect sensor and allows developers to focus on the game design and user experience. The system relies on model-driven software engineering technologies and is made of two main components: (i) an authoring environment relying on a domain-specific language to define the exergame model encapsulating the gameplay that the exergame designer has envisioned and (ii) a code generator that transforms the exergame model into executable code. To validate our approach, we performed a preliminary empirical evaluation addressing development effort and usability of the PhyDSLK framework. The results are promising and provide evidence that people with no experience in game development are able to create exergames with different complexity levels in one hour, after a less-than-two-hour training on PhyDSLK. Also, they consider PhyDSLK usable regardless of the exergame complexity.

Abstract In the context of digital transformation, companies are increasingly forced to develop, manage and continually align IT and business. Companies have found in Enterprise Architecture (EA) a valuable tool to represent and manage IT and business in a holistic way by establishing connections among technology concerns and business/strategical/motivational ones. EA modelling is one of the most critical tasks in this context to represent accurate models that make the difference in the decision‐making and governance processes of the company. In most of the cases, EA models are manually defined by experts which is usually error‐prone and time‐consuming. Thus, the constant business and IT realignment through manual modelling becomes complex and expensive. This research presents ArchiRev, an extensible reverse engineering method that automate the extraction of EA models (using ArchiMate language) by analysing different information systems artefacts. This proposal has been validated through an industrial case study in the context of a C#‐based system of an Italian ship refurbishment company. The study has demonstrated the effectiveness (based in the opinion of some business experts) and efficiency of the method. The main implication is that EA modelling can be accelerated, whereas subjectivity and errors introduced by experts might be reduced.

Nowadays, the dimension and complexity of software development projects increase the possibility of cyber-attacks, information exfiltration and data breaches. In this context, developers play a primary role in addressing privacy requirements and, consequently security, in software applications. Currently, only general guidelines exist that are difficult to put in operation due to the lack of the required security skills and knowledge, and to the use of legacy software development processes that do not deal with privacy and security aspects. This paper presents a knowledge base, the Privacy Knowledge Base (PKB), and the VIS-PRISE prototype (Visually Inspection to Support Privacy and Security) a visual tool that support developers' decisions to integrate privacy and security requirements in all software development phases. An initial experimental study with junior developers is also presented.

Test-Driven Development (TDD) is an incremental approach to software development. Despite it is claimed to improve both quality of software and developers’ productivity, the research on the claimed effects of TDD has so far shown inconclusive results. Some researchers have ascribed these inconclusive results to the negative affective states that TDD would provoke. A previous (baseline) experiment has, therefore, studied the affective reactions of (novice) developers—i.e., 29 third-year undergraduates in Computer Science (CS)—when practicing TDD to implement software. To validate the results of the baseline experiment, we conducted a replicated experiment that studies the affective reactions of novice developers when applying TDD to develop software. Developers in the treatment group carried out a development task using TDD, while those in the control group used a non-TDD approach. To measure the affective reactions of developers, we used the Self-Assessment Manikin instrument complemented with a liking dimension. The most important differences between the baseline and replicated experiments are: (i) the kind of novice developers involved in the experiments—third-year vs. second-year undergraduates in CS from two different universities; and (ii) their number—29 vs. 59. The results of the replicated experiment do not show any difference in the affective reactions of novice developers. Instead, the results of the baseline experiment suggest that developers seem to like TDD less as compared to a non-TDD approach and that developers following TDD seem to like implementing code less than the other developers, while testing code seems to make them less happy.

In this study, we collected evidence from empirical studies published over two decades-from 1995 to 2018-to answer the following general research question: "What is the current existing empirical evidence concerning the use of software modeling to support source code maintenance?" We carried out a systematic literature review on research published in relevant journals, as well as conference and workshop proceedings, to investigate various aspects of our general research question. Although there is a common belief that software models are beneficial for source code maintainability, this aspect has been scarcely investigated in the literature and only a few empirical studies have been conducted in an industrial context. Moreover, most of the used models are UML. As so, our study shows that there is a small body of research related to this field.

The current Internet of Things (IoT) market proposes a wide variety of devices with complex design and different functionality. In addition, the same IoT device can be used in different domains, from home to industry, to healthcare. The management of such devices occurs in different ways, for example through visual interaction using high level programming languages (e.g. Event-Condition-Action rules) or through high level API. Generally, end users are not technical experts and are not able to configure their IoT devices, thus they need external tools (or visual interaction paradigm) to exploit and better control them. In this work, we present a model for IoT devices which allows to assess those devices and their suitability for a certain domain according to four dimensions: communication, target, data manipulation and development. The model aims at better understanding the device capabilities and, consequently, facilitating the choice of the devices that better suit the domain in which they should be used.

Background: Test-Driven Development (TDD) is an agile software development practice, which is claimed to boost both external quality of software products and developers' productivity.

The current Internet of Things (IoT) trend is constantly bringing on the mass market new and more powerful devices. Such availability lead end users to find many kind of IoT devices with ease, but, their limited interoperability, lead them to confusion and frustration. As a matter of fact, many different and incompatible standards and heterogeneous applications made available by the producer, do not help end users to choose the right device to his/her needs. Other aspects such as the possibility for the end users to develop custom solutions, to improve the device functionalities, are considered secondary to the device characteristics. Moreover the data security, including the data privacy, is not considered as well. In this Work in progress paper we propose a model, to assess an IoT device according to its characteristics. The end user, by instantiating the model on a selected device, can get a score that can be exploited in the evaluation of its suitability in a particular domain.

This paper presents the findings of a survey on the use of UML in software maintenance, carried out with 178 professionals working on software maintenance projects in 12 different countries. As part of long-term research we are carrying out to investigate the benefits of using UML in software maintenance, the main objectives of this survey are: 1) to explore whether UML diagrams are being used in software industry maintenance projects; 2) to see what UML diagrams are the most effective for software maintenance; 3) to find out what the perceived benefits of using UML diagrams are; and 4) to contextualize the kind of companies that use UML documentation in software maintenance. Some complementary results based on the way the documentation is used (whether it is UML-based or not) during software maintenance are also presented.

Reverse engineering of business process enables business process to be discovered and retrieved from existing information systems, which embed many business rules that are not available anywhere else. These techniques are especially useful when business process models are unavailable, outdated, or misaligned because of uncontrolled maintenance. Reverse engineering techniques obtain well-designed business processes, but these are often retrieved with harmful quality faults as a consequence of the abstraction. Clustering techniques are then applied to reduce these quality faults and improve the understandability and modifiability of business process models. Regrettably, the most challenging concern is how to determine the similarity between two business activities to be clustered. Formal ontologies help to represent the essential concepts and constraints of a universe of discourse and determine the similarity in accordance with the given ontology. This paper shows how to compute and use the ontology-based similarity within a clustering algorithm whose aim is to improve the quality of business process models previously obtained from legacy information systems by reverse engineering. The principal contribution of this paper is the usage of an ontology-based similarity function and its application to 43 business process models retrieved from four real-life information systems. Copyright © 2014 John Wiley & Sons, Ltd.

Context: technology transfer and innovation dissemination are key success factors for an enterprise. The shift to a new software technology determines inevitable changes to ingrained and familiar processes and at the same time leads to changes in practices, requires training and commitment on behalf of technical staff and management. As so, it cannot leave out neither organizational nor technical factors. Objective: our conjecture is that the process of innovation dissemination is facilitated if the new technology is supported by empirical evidence. In this sense, Empirical Software Engineering (ESE) serves as support for transferring an innovation, either it being a process or product, within production processes. Method: this paper investigates the relation between empirical studies and technical/organizational factors in order to identify the most suitable empirical study for disseminating an innovation in an enterprise. The analysis has been carried out with respect to empirical studies carried out during a ten year time span within the Software Engineering Research LABoratory (SERLAB), at the University of Bari. Results: the results point out that a critical factor in designing empirical studies is the quality model, i.e. measurement program defined by researchers during the study and used to collect relevant information on the effectiveness and efficacy of the innovation being transferred, in order to gain commitment on behalf of stakeholders who will finally adopt the technology. Conclusion: the study outcomes provide an empirically founded guideline that can be used when choosing the most appropriate approach for addressing an innovation.

Software process monitoring is a complex activity. Recently many authors have been suggesting the use of Statistical Process Control (SPC) for software process monitoring while others have pointed out potential pitfalls in using this approach. SPC is often used "as is" without the appropriate customizations or extensions to software, given the peculiarities and differences of software processes compared to manufacturing ones. As so the starting point to understand how and whether SPC can be used in software is to understand its contribution in monitoring processes. This work puts together experience collected by the authors in using SPC in industrial contexts, points out the main issues concerning software process monitoring and highlights how the technique addresses them. The main contribution of the paper is to formalize and put a set of guidelines together in a disciplined process for guiding practitioners in correctly using SPC during process monitoring.

This paper reports on a controlled experiment that investigates the influence of stereotypes in UML sequence diagrams. The comprehension of UML sequence diagrams with and without stereotypes is analyzed from three different perspectives: semantic comprehension, retention and transfer. The experiment was carried out with 77 undergraduate students of Computer Science from the University of Bari in Italy. The results obtained show a slight tendency in favor of the use of stereotypes in facilitating the comprehension of UML sequence diagrams. Further replications are needed to obtain more conclusive results.

Objective: Evaluate the value of a product line in terms of maintainability, extensibility and configurability with refer to the interested stakeholders: customers, maintainers, producers. Rationale: There are values that customers constantly require in a modern software application. Some of these values are supported by product lines. Nevertheless, in the industrial and scientific communities the conjecture that customer values clash with those of producers/maintainers is diffused. Design of Study: we have designed and carried out a case study in an industrial context on an ongoing project to verify the validity of a product line in creating value for stakeholders. So data was collected as the project was being executed along a nine month period. Then, descriptive statistics and hypothesis testing were carried out. Results: experience acquired during the execution of an industrial project has allowed the authors to point out the differences between program families and software product lines. Also, the case study has shown how product lines contribute to stakeholder value proposition elicitation and reconciliation. Conclusions: This study has represented a first step towards analyzing the value that product lines represent for various stakeholders.

Effort estimation is a long faced problem, but, in spite of the amount of research spent in this field, it still remains an open issue in the software engineering community. In two previous works the authors proposed an approach named dynamic calibration for effort estimation of software projects. In this paper they present a tool named SPEED that implements the dynamic calibration approach

Dynamic calibration (DC), presented by the authors in previous works has proved to be a flexible approach for massive maintenance software project estimation, able to recalibrate an estimation model in use according to relevant process performance changes pointed out by the project manager. Nevertheless, it results quite subjective in its application and tightly based on manager experience. In this work the authors present an improvement of the approach based on the use of statistical process control (SPC) technique. SPC is a statistically based method able to quickly highlight shift in process performances. It is well known in manufacturing contexts and it has recently emerged in the software engineering community. In this work, authors have integrated SPC in DC as decision support tool for identifying when recalibration of the estimation model must be carried out. This extension makes DC less "person-based", more deterministic and transferable in its use than the previous version. The extended approach has been experimented on industrial data related to a renewal project and the results compared with both, a concurrent approach such as analogy based estimation and its previous version. The results are encouraging and stimulate further investigation.

Software reuse can become a key factor for improving and guaranteeing software quality, when adopted systematically all along the software process. The main characteristic of reuse-oriented processes is that they require a common repository for storing, searching and retrieving software modules. Moreover, reuse occurs systematically and is an integrated part of the process. Previous works of the same authors have empirically shown that the full reuse maintenance model (FRM) slows down quality degradation following to maintenance interventions on a software system. This work is a further step in the investigation towards demonstrating how reuse oriented development (ROD) impacts on software quality; how it favors FRM model; and finally, whether reuse-oriented development influences productivity, and as so, is more efficient. This has been done through a case study carried out on two ongoing industrial projects. Results are positive and support our research hypotheses.

Effort estimation is a long faced problem, but, in spite of the amount of research spent in this field, it still remains an open issue in the software engineering community. This is true especially in the case of renewal of legacy systems, where the current and well established approaches also fail. This paper presents an application of the method named dynamic calibration for effort estimation of renewal projects together with its experimental validation. The approach satisfies all the requirements of the estimation models. The results obtained by applying dynamic calibration are compared with those obtained with a competitor method: estimation by analogy. The results are shown to be promising although further experimentation on field is needed.

During its life, a legacy system is subjected to many maintenance activities, which cause degradation of the quality of the system: When this degradation exceeds a critical threshold, the legacy system needs to be reengineered. In order to preserve the asset represented by the legacy system, the familiarity with it gained by the system's maintainers and users, and the continuity of execution of current operations during the reengineering process, the system needs to be reengineered gradually. Moreover, each program needs to be reengineered within a short period of time. The paper proposes a reengineering process model, which is applied to an in-use legacy system to confirm that the process satisfies previous requirements and to measure its effectiveness. The reengineered system replaced the legacy one to the satisfaction of all the stakeholders; the reengineering process also had a satisfactory impact on the quality of the system. Finally, this paper contributes to validate the cause-effect relationship between the reengineering process and overcoming the aging symptoms of a software system.

Subcontracting is one of the challenges modern software engineering must face. The need for decision models to guide software engineers in identifying when it is advisable and how to divide a contract, which risks it involves and which actions should be adopted to control them, is continuously increasing. Many researchers have proposed and experimented with these decision models from various viewpoints. We feel the need for a method able to merge and formalize these experiences in order for them to be reused by the entire community. This work presents an approach for formalizing such experience. It also proposes a decision model for dividing a contract according to its characteristics and to the cooperating organizations. This decision model, together with others present in the literature, have been integrated and formalized in an experience package.

A transferable quality model must be general. This implies that only the high level characteristics can be transferred into different settings and that the refinement of the characteristics into metrics must be operated according to the context peculiarities. In spite of the amount of quality models and approaches to quality models definition presented in literature, there are no experiences reported showing the same quality model reused in different environments. This statement needs further investigation. The aim of this work is to present an experience on the field that involves two industrial projects in which the same quality model was used. The study confirms the need to modify the quality model, not only in the metrics but also in the measurement processes and in the interpretation of the resulting measures as side effects.

A large software project may be distributed over multiple sites when the organization believes that there are not enough people to staff a single collocated team. However, previous empirical research in the context of telecommunication organizations has shown that distance may increase cycle time and costs. We report on a large software massive maintenance project in the information systems domain, which in part has been carried out on a single site and in part across multiple sites of the same organization. We performed a comparative postmortem analysis of the two parts. Our results show that, with respect to cycle time and cost no significant differences exist among the distributed and collocated work. Indeed there is a significant difference in communication during the project. This implies that for massive maintenance activities the distribution over multiple sites can be really helpful.

This paper describes a process of gradual reengineering of the procedural components of a legacy system. The process is integrated and completed by the data reengineering process analyzed in a previous paper by the same authors. The proposed method enables the legacy system to be gradually emptied into the reengineered system, without needing to either duplicate the legacy system or freeze it. The process consists of evolving the legacy system components toward firstly a restored system and then toward the reengineered system. Meanwhile, the legacy system can coexist with both the restored and the reengineered parts. By the end of the process, a single system will be in existence: the reengineered one. The method has been applied to reengineer a real system and demonstrated its ability to: support gradual reengineering, maintain the system at work during the process, minimize the need to freeze maintenance requests, renew the operative environment of the reengineered system with respect to the legacy system and, finally, eliminate all the system's aging symptoms.

The paper presents a method for dynamic effort estimation, together with its supporting tool, and experimental validation on a renewal project of a very aged software system. Method characteristics such as dynamic tuning and fine granularity allow the tool to quickly react to process variations. The experimental validation shows how the combination of meaningful predictors and fine grain calibration is effective for understanding the enacted process and its implicit changes, or controlling the efficacy of explicit process changes. The study also confirms that the estimation model is process-dependent and then cannot be reused for other processes, albeit similar.