The definitive version can be found at : http://onlinelibrary.wiley.com/ Copyright Wiley [Full text of this article is not available in the UHRA]

Web services provide the potential to offer interoperability of distributed business-to-business application integration between autonomous organisations, regardless of platforms, operating systems or languages. For both user and vendor organisations, this raises immediate problems of trust, security, privacy and prevention of malicious attacks. Until these problems are addressed and solved properly, the use of Web services will be severely restricted because no-one will trust them. We describe in this paper a service-oriented architecture and an attack-tolerant information retrieval (ATIR) service which tackles certain classes of privacy problems. In particular, we address the problem of protecting a user against malicious attacks upon an information service when the user retrieves some information from the service. Although there have been many theoretical solutions to certain aspects of this problem, the results have yet to be adapted to real systems. We report our experience of integrating the ATIR service with Taverna, a popular workflow system used amongst the UK e-science/grid computing community, to support secure information retrieval in the biology context. Performance studies show that the overhead of ATIR server-side processing is trivial (<5%) in comparison with the total processing time of the integrated Taverna. Our experimental results also show that the major processing overhead is caused by the Taverna enactor operations which consume no less than 50% of the total processing time.

This paper reports on our experiences with using the emerging Web service technologies and tools to create a demonstration information broker system as part of our research into information management in a distributed environment. To provide a realistic context, we chose to study the use of information in the healthcare domain, and this context sets some challenging parameters and constraints for our research and for the demonstration system. In this paper, we both report on the extent to which existing Web service technologies have proved to be mature enough to meet these requirements, and also assess their current limitations.

We address the problem of large-scale data integration, where the data sources are unknown at design time, are from autonomous organisations, and may evolve. Experiments are described involving a demonstrator system in the field of health services data integration within the UK. Current Web services technology has been used extensively and largely successfully in these distributed prototype systems. The work shows that Web services provide a good infrastructure layer, but integration demands a higher level "broker" architectural layer; the paper identifies eight specific requirements for such an architecture that have emerged from the experiments, derived from an analysis of shortcomings which are collectively due to the static nature of the initial prototype. The way in which these are being met in the current version in order to achieve a more dynamic integration is described.

Program and system comprehension are vital parts of the software maintenance process. We discuss the need for both perspectives and describe two methods that may be integrated to provide a smooth transition in understanding from the system level to the program level. Results from a qualitative survey of expert industrial software maintainers, their information needs and requirements when comprehending software are initially presented. We then review existing software tools which facilitate system level and program comprehension. Two successful methods from the fields of data mining and concept assignment are discussed, each addressing some of these requirements. We also describe how these methods can be coupled to produce a broader software comprehension method which partly satisfies all the requirements. Future directions including the closer integration of the techniques are also identified.

In the application domain of online information services such as online census information, health records and real-time stock quotes, there are at least two fundamental challenges: the protection of users' privacy and the assurance of service availability. We present a fault-tolerant scheme for private information retrieval (FT-PIR) that protects users' privacy and ensure service provision in the presence of malicious server failures. An error detection algorithm is introduced into this scheme to detect the corrupted results from servers. The analytical and experimental results show that the FT-PIR scheme can tolerate malicious server failures effectively and prevent any information of users front being leaked to attackers. This new scheme does not rely on any unproven cryptographic premise and the availability of tamperproof hardware. An implementation of the FT-PIR scheme on a distributed database system suggests just a modest level of performance overhead.

Several private information retrieval (PIR) schemes were proposed to protect users' privacy when sensitive information stored in database servers is retrieved. However, existing PIR schemes assume that any attack to the servers does not change the information stored and any computational results. We present a novel fault-tolerant PIR scheme (called FT-PIR) that protects users' privacy and at the same time ensures service availability in the presence of malicious server faults. Our scheme neither relies on any unproven cryptographic assumptions nor the availability of tamper-proof hardware. A probabilistic verification function is introduced into the scheme to detect corrupted results. Unlike previous PIR research that attempted mainly to demonstrate the theoretical feasibility of PIR, we have actually implemented both a PIR scheme and our FT-PIR scheme in a distributed database environment. The experimental and analytical results show that only modest performance overhead is introduced by FT-PIR while comparing with PIR in the fault-free cases. The FT-PIR scheme tolerates a variety of server faults effectively. In certain fail-stop fault scenarios, FT-PIR performs even better than PIR. It was observed that 35.82% less processing time was actually needed for FT-PIR to tolerate one server fault.

The urgent need to change software easily to meet evolving business requirements requires a radical shift in the development of software, with a more demand-centric view leading to software which will be delivered as a service, within the framework of an open marketplace. We describe a service architecture and its rationale, in which components may be bound instantly, just at the time they are needed and then the binding may, be disengaged. This allows highly flexible software services to be evolved in "internet time". The paper focuses on early results: some of the aims have been demonstrated and amplified through an experimental implementation based on e-Speak, an existing and available technology. It is concluded that technology such as e-Speak provides a useful infrastructure that rapidly enabled us to demonstrate the basic operation and viability of our approach.

There is an urgent industrial need for new approaches to software evolution that will lead to far faster implementation of software changes. For the past 40 years, the techniques, processes and methods of software development have been dominated by supply side issues, and as a result the software industry is oriented towards developers rather than users. Existing software maintenance processes are simply too slow to meet the needs of many businesses. To achieve the levels of functionality, flexibility and time to market of changes and updates required by users, a radical shift is required in the development of software, with a more demand-centric view leading to software which will be delivered as a service, within the framework of an open marketplace. Although there are some signs that this approach is being adopted by industry, it is in a very limited and restricted form. We summarise research that has resulted in a long term strategic view of software engineering innovation. Based on this foundation, we describe more recent work that has resulted in an innovative demand-led model for the future of software. We describe a service architecture in which components may be bound instantly, just at the time they are needed and then the binding may be disengaged. Such ultra late binding requires that many non-functional attributes of the software are capable of automatic negotiation and resolution. Some of these attributes have been demonstrated and amplified through a prototype implementation based on existing and available technology.

The aim of the panel session is to clarify issues involved in software evolution, but more particularly, to identify and explore promising solutions and research directions, in order to identify strategic goals for the research community and solution visions for practitioners.By evolution, we mean a stage of software lifecycle where the software undergoes substantial changes and this also includes iterative software development and/or agile software processes.

For the past 40 years, the techniques, processes and methods of software development have been dominated by supply-side issues, giving rise to a software industry oriented towards developers rather than users. To achieve the levels of functionality, flexibility and time-to-market required by users, a radical shift is required in the development of software, with a more demand-centric view, leading to software which will be delivered as a service within the framework of an open marketplace. Already, there are some signs that this approach is being adopted by industry, but in a very limited way. We summarise research and a research method which has resulted in a long-term strategic view of software engineering innovation. Based on this foundation, we describe more recent work, which has resulted in an innovative demand-side model for the future of software. We propose a service architecture in which components may be bound instantly, just at the time they are needed, and then the binding may be discarded. A major benefit of this approach is that it leads to highly flexible and agile software that should be able to meet rapidly changing business needs.

The transformation of a recursive program to an iterative equivalent is a fundamental operation in computer science. In the reverse direction, the task of reverse engineering (analysing a given program in order to determine its specification) can be greatly ameliorated if the program can be re-expressed in a suitable recursive form. However, the existing recursion removal transformations, such as the techniques discussed by Knuth [1] and Bird [2], can only be applied in the reverse direction if the source program happens to match the structure produced by a particular recursion removal operation. In this paper we describe a much more powerful recursion removal and introduction operation which describes its source and target in the form of an action system (a collection of labels and calls to labels). A simple, mechanical restructuring operation can be applied to a great many iterative programs, which will put them in a suitable form for recursion introduction. Our transformation generates strictly more iterative versions than the standard methods, including those of Knuth and Bird [1, 2]. With the aid of this theorem we prove a (somewhat counterintuitive) result for programs that contain sequences of two or more recursive calls: under a reasonable commutativity condition, ‘depth-first’ execution is more general than ‘breadth-first’ execution. In ‘depth-first’ execution, the execution of each recursive call is completed, including all sub-calls, before execution of the next call is started. In ‘breadth-first’ execution, each recursive call in the sequence is partially executed but any sub-calls are temporarily postponed. This result means that any breadth-first program can be reimplemented as a corresponding depth-first program, but the converse does not hold. We also treat the case of ‘random-first’ execution, where the execution order is implementation dependent. For the more restricted domain of tree searching we show that a ‘breadth-first’ search is the most general form. We also give two examples of recursion introduction as an aid to formal reverse engineering.

Program transformations have been advocated as a method for accomplishing reverse engineering. The hypothesis is that the original source code can be progressively transformed into alternative forms, but with the same semantics. At the end of the process, an equivalent program is acquired, but one which is much easier to understand and more maintainable. We have been undertaking an extensive programme of research over twelve years into the design and development of transformations for the support of software maintenance. The paper very briefly explains the theory, practice and tool support for transformational systems, but does not present new theoretical results. The main results are on an analysis of the strengths and weaknesses of the approach, based on experience with case studies and industrial applications. The evaluation framework used (called DERE) is that presented in [5]. It is hoped that the results will be of benefit to industry, who might be considering using the technolog...

Conventionally, maintainability is seen as an attribute of software; measures which aim to quantify maintainability are all expressed in terms of attributes of the source code or related documentation. Such metrics do not correspond with intuition, and fail in important ways; for example they are not used by industry in assessing lifecycle costs. Maintainability is related to the skills of the maintenance team, the tools available, the maturity of the process and so on. We propose a new model, which takes a systemic view of the maintenance process and organisation as well as the software. The changing relationships between components of the model are identified as key properties for assessing maintainability. We suggest empirical approaches which could use the model to quantify maintainability. We hope the model could be used for assessing the effect of evolution, not only in the software, but in its environment.

We describe a formal approach to the modelling of existing concurrent software systems, together with a theory of program equivalence and refinement. From this basis, we show how correctness-preserving transformations and refinements may be developed and proved, allowing us to change the structure of concurrent programs whilst preserving their functional behaviour. We then demonstrate the application of transformations to a simple concurrent program implementing a mutual exclusion algorithm, to illustrate its restructuring into a simpler form, and outline how the formal modelling of the program allows us to derive safety and liveness properties

In (Smith et al., 1995), a proposal was made for constructing highly adaptable software based on an architecture that uses distributed agents. In this paper a case study is described which follows this approach. The important contribution lies in developing a model of the application domain, in this case the relational database domain, which is then available for a domain agent to manipulate in developing strategies for changing the application software. The application domain is modelled as a set of entities related by constraints of different types. Domain adaptability is accomplished through both the creation of new entities and new constraints between entities. Why and how this approach is different from existing approaches to adapting databases is explained. Initial results have produced a domain model which makes explicit the potential points of adaptability in the domain being modelled, making it easier to adapt software. Additionally, the use of agent interaction protocols provides a basis for research into inter-operability between separate domains.

The authors present the DREAM (Data Reverse Engineering and Abstraction Mechanism) method for restructuring program data to meet the changing demands upon it. It is important that data changes are made correctly to avoid undesirable effects on the operation of the program and to minimise effort in maintenance. To facilitate this program transformations are used to manipulate the code, allowing the maintainer to concentrate upon the restructuring strategy without having to worry about the correctness of changes. Restructuring of programs containing discrete types is examined within the paper. This allows work to be focussed upon a small subset of commonly available data types to make development of solutions feasible and to provide a starting point for the development of a generic method which covers other types.

We describe a formal based approach to reverse engineering programs with concurrent constructs. This has been a topic which has not previously been addressed, yet is required for safety critical systems and many others. To achieve this we have used a transformation based approach which has been successful in coping with sequential systems. To accommodate concurrency we have extended the core kernel language (WSL) and introduce and then prove new transformations. We then describe preliminary results. The novel aspects of this work are the application of formal program transformations to the maintenance of concurrent software, and the use of modern type theory and type checking/proof tools to extend our existing method and the tool to new domains, namely concurrency and safety critical systems.

We address two problems concerned with the maintenance of safety-critical software. Firstly, we analyse the new issues required for the reverse engineering of real-time existing code to extract high level designs. Secondly, we present a possible design abstraction mechanism that can be used for safety-critical software. We use formal transformations both in the reverse engineering of systems involving temporal constraints, and in the definition of the abstract representation. We present a design framework and the results of initial experiments. The contributions are: (1) the requirements analyses for reverse engineering safety-critical systems, (2) the use of very-high-level domain languages, and (3) formal transformations as the unifying technology.

Current solution strategies for coping with maintenance tend to be based around formalising and making explicit the interfaces between components. This can help to localise changes, and hence make a contribution to coping with the problem of altering systems in response to change. We investigate an alternative approach, using concepts from distributed artificial intelligence. We assume that software components do not have to have rigid interfaces; they can negotiate, make decisions, etc. The role of the maintainer is changed; we shift part of the responsibility for decision-making etc. onto the software itself using concepts from adaptive and self-modifying systems. Some of the work that would have been done during evolutionary development (i.e. maintenance) is now done during run-time. So, we have real evolution. New techniques are now required to deal with this new situation: the modelling of negotiation, feedback, system stability etc. is as important as the modelling of services and functions. Analytical techniques for understanding a system and its environment are central; analysis is carried out principally with regard for the goals that the system is expected to fulfil. The paper provides the outline of a new future strategy for software maintenance. These ideas result from some recent work carried out at the Centre for Software Maintenance at Durham.

We describe a solution to the acquisition of entity relationship attribute (ERA) diagrams from data-intensive source code. In such programs, relationships between data items are often represented within imperative code, as well as within data structures, and we show that reverse engineering can be improved if both are used. This distinguishes our work from others in the field. Our method is based on formal transformations. We identify imperative constructs which improve the high-level ERA models that it is possible to capture. Suitable transformations are then briefly summarised. A series of experiments with industrial COBOL programs is described. Our results show that code-embedded relations can usefully be incorporated into data intensive reverse engineering, and enhance the designs extracted.

There is a vast collection of operational software systems which are vitally important to their users, yet are becoming increasingly difficult to maintain, enhance, and keep up to date with rapidly changing requirements. For many of these so-called legacy systems, the option of throwing the system away and rewriting it from scratch is not economically viable. Methods are therefore urgently required which enable these systems to evolve in a controlled manner. The approach described in this paper uses formal proven program transformations, which preserve or refine the semantics of a program while changing its form. These transformations are applied to restructure and simplify the legacy systems and to extract higher-level representations. By using an appropriate sequence of transformations, the extracted representation is guaranteed to be equivalent to the code. The method is based on a formal wide spectrum language, called WSL, with an accompanying formal method. Over the last ten years we have developed a large catalog of proven transformations, together with mechanically verifiable applicability conditions. These have been applied to many software development, reverse engineering, and maintenance problems. In this paper, we focus on the results of using this approach in the reverse engineering of medium scale, industrial software, written mostly in languages such as assembler and JOVIAL. Results from both benchmark algorithms and heavily modified, geriatric software are summarized. We conclude that formal methods have an important practical role in software evolution.

Abstract A method is described for obtaining useful information from legacy code. The approach uses formal proven program transformations, which preserve or refine the semantics of a construct while changing its form. The applicability of a transformation in a particular syntactic context is checked before application. By using an appropriate sequence of transformations, the extracted representation is guaranteed to be equivalent to the code. In this paper, we focus on the results of using this approach in the reverse‐engineering of medium‐scale, industrial software, written mostly in languages such as assembler and JOVIAL. Results from both benchmark algorithms and heavily modified, geriatric software are summarized. It is concluded that the approach is viable, for self‐contained code, and that useful design information may be extracted from legacy systems at economic cost. We conclude that formal methods have an important practical role in the reverse‐engineering process.

The paper, following the theme set out in a previous paper by K.H. Bennett et al. (see ibid., 1992) provides more results of the research programme on reverse engineering. It concentrates on dealing with data-intensive programs such as those written in COBOL. The problems with data-intensive programs are addressed, our solutions to these problems are discussed, a prototype built on our approach is described and the results of the experiments are presented. It is concluded that formal transformations provide a way of combining design decisions which have become instantiated in both the code and the data structures.>

Existing systems may be considered as an asset and the software manager should consider seriously the risks of maintenance and ensure that the value of software is maximized in terms of customer benefit. Work aimed at improving the management of software maintenance activities by means of a substantial industrial trial evaluation that focused on improvements to aspects of maintenance management planning and control is reported. The results of the trial have led to the development of an integrated risk management process. It is concluded that risk management is an essential element of software maintenance management best-practice.>

A novel method is described for perfective maintenance of software which has been developed from specifications using formal transformations. The list of applied transformations provides a suitable derivation history to use when changes are made to the software. A comparison is made between sequential transformations and standard proof-based refinement techniques for providing this derivation history, based upon the case study of a library system. When using criteria such as scaleability, speed, ease, design improvements and software quality, transformations are a more favorable basis of refinement. The method produces software which is well structured and highly maintainable.>

An outline of the principles and design features of the Maintainer's Assistant is presented. The main results presented concern the method by which the previously developed theoretical approach has been interpreted to provide the means to address the reverse engineering of real-world programs of medium size, written in IBM 370 Assembler. In particular, the use of appropriate metrices to guide the user during the process of program transformation is described. Results are given to show the success of the tool when it has been applied to real code.>

The authors report on their work to data on a collaborative project which has the objective of improving industrial software maintenance management through the design and introduction of a comprehensive process model. A framework based on their experience of developing and using different types of process models is presented; this approach enables process models to be developed and used by managers in a beneficial manner to meet organizational objectives and improve existing processes.>

After four years acting as Joint Editor, Me1 Colter has decided that it is time to step down.Dr Colter is one of the group who originally conceived the idea of a Journal about software maintenance, and he was a key person in seeing the Journal through its launch and becoming established as the most significant periodical dedicated to the field of software maintenance.We are fortunate however that Me1 is able to stay on the Editorial Board, where we look forward to his ever valuable contributions and input.I am delighted that Professor Ned Chapin from California State University, and InfoSci Inc. will be taking over as Joint Editor.Professor Chapin has an international reputation in software maintenance, having authored six books and more than 100 papers on software topics.He is a well known speaker at software maintenance conferences and will be a major asset to the Journal.Ned has expressed his wish to join me in expressing appreciation for the splendid job done by Me1 Colter in seeing the Journal through its early years, and establishing high standards for the work published in it.Ned has started searching especially for papers to fulfill more of the 'practice' part of the Journal's sub-heading of 'Research and Practice'.He has available for any prospective authors a set of suggestions on what points to cover and how to present them.He also has people available, willing to give some assistance to anyone who would like it in preparing a practice paper for the Journal.Assistance is available for the asking.Software maintenance is undertaken everyday in a great variety of situations wherever computer implemented information systems have taken root.With the pace of modern life, change presses relentlessly upon information systems and their users.The result is a tremendous and rich diversity of software maintenance experience.The Journal cannot hope to cover it all.It can strive to present significant, insightful, and thought provoking reports, analyses, proposals, and research findings.The result can communicate a balanced view with breadth and depth of coverage valuable to all who are affected by software maintenance.Ned Chapin proposes to strive for that objective.Finally Ned welcomes hearing from anyone interested in software maintenance.He can be reached by mail (PO Box 71 17,

Abstract A new Special Interest Group in Software Maintenance has been formed in Europe. The idea was initially proposed by the European Commission, which is funding two maintenance projects through the ESPRIT II collaborative programme of Information Technology Research. Membership is open to anyone (European or otherwise) interested in software maintenance. This short article summarizes the objectives and operation of the Special Interest Group. The two ESPRIT software maintenance projects are called MACS and REDO. Between them, these projects bring together researchers and practitioners across the whole of Europe. The belief was (and is) that with this as a basis, there would be many people and organisations who are not yet directly involved, but who would wish to participate in a maintenance‐oriented organisation.

Abstract A compiler maps abstract data and control structures into equivalent representations at the order code level of a computer. When a program written in a high level language fails, there is presented the problem of interpreting the state of the abstract (high level) machine in terms of the state of the physical machine which is all that is available. This interpretation is undertaken by a program usually known as a run‐time diagnostics package. In this paper a novel package is described which provides diagnostics for dynamically created data structures in addition to the usual facilities. It has been implemented for the language Pascal and has been used successfully for 18 months.

Abstract A run‐time diagnostics system has been described that allows the user to interrogate a program fully in source language terms. In particular, dynamically created data structures are catered for. The diagnostics system allows all objects including those created dynamically to be interrogated and can display a graphical representation of linked data structures. This paper describes the implementation of such a system with the language Pascal on a GEC 4080.

Abstract This paper describes a message transport policy for the Cambridge Ring which introduces contention for the receiver. A simulation model is presented which makes worst case assumptions for transmission rates. The results of running this simulation model are presented in terms of the delays experienced by messages crossing the ring given a certain discrete distribution of message sizes. Three variations of the policy are compared under different loadings of the ring caused by the number of nodes using the ring and by message creation rates at each node.

Iterative binary multiplication can be speeded up by examining two or more bits of the multiplier in each cycle. Freeman (1967) has described an exact method for calculating the resultant gain in multiplication speed, based on the use of a discrete-time finite state system model. We have used Freeman's model to evaluate the gain in speed for various combinations of two design parameters—the maximum number of shifts per cycle, and the available multiples of the multiplicand. It is shown that a greater performance improvement is obtained by increasing the former parameter rather than the latter.