Abstract Context: Novices programming robotic systems’ behavior, like quadcopter missions, face several challenges and require adequate support to overcome initial barriers. One approach to support novices is to display multiple representations such as graphical previews along with the code editor. Such supportive representations, however, also pose challenges for novices: finding corresponding information in the code and in the preview. To facilitate this, mapping aids can be implemented to clarify the connections between code and preview and foster a deeper understanding. Using output-directed programming, that is, adding the ability to reverse expression evaluation in the domain-specific language, is a promising basis for easily creating and implementing mapping aids. Objective: We investigated, whether mapping aids based on output-directed programming can improve learning language semantics and overall program correctness and how these mapping aids support novices while implementing quadcopter missions. Method: In our study, we tested $$N=82$$ participants while interacting and learning in an online programming environment. Using our 2x2 between-subject design study, we investigated the effects of two mapping aids: highlighting (supports to find element-based connections in the environment) and dynamic linking (supports finding similarities on the semantic level of the content) on program correctness including a typical error, learning outcomes as well as traces of learning strategies. Results: While highlights were more helpful for implementing the quadcopter missions (mission 1: $$p=.008$$ **, $$\eta ^2_{\small \textit{partial}}=.091$$ ), dynamic linking improved learning outcomes on the comprehension ( $$F(1,75)=5.61$$ , $$p=.020$$ *, $$\eta ^2_{\small \textit{partial}} =.070$$ ) and application level ( $$F(1,75)=4.08$$ , $$p=.047$$ *, $$\eta ^2_{\small \textit{partial}} =.052$$ ). Traces of learning strategies were related to higher program correctness (organizing (changes in the preview)): $$r=.553$$ , $$p<.001$$ ***; elaborating (time engaging in the task)): $$r=.639$$ $$p<.001$$ ***) and higher learning outcomes (organizing: $$r=.400$$ , $$p<.001$$ ***; elaborating : $$r=.404$$ , $$p<.001$$ ***). Conclusions: Implementing mapping aids through output-directed programming supports novices in developing a better semantic understanding of the domain specific language. Depending on the program tasks, different mapping aids might be effective. Based on traces of learning strategies while programming, adaptive interactive programming environments might support users individually.

• The SAFT-GT toolchain enables semi-automatic Attack-Fault Tree generation for enhanced safety and security assessment in self-adaptive systems. • The toolchain efficiently integrates into the feedback loop of self-adaptive systems, allowing for dynamic updates based on security assessments. • A user study with domain experts confirms the toolchain’s relevance and practical applicability in real-world scenarios. • Performance experiments demonstrate that the Attack-Fault Tree generation pipeline operates within feasible time constraints, supporting real-time applications. • The complete toolchain and resources are provided for download, fostering further research and collaboration in the field. In the rapidly evolving landscape of software engineering, the demand for robust and secure systems has become increasingly critical. This is especially true for self-adaptive systems due to their complexity and the dynamic environments in which they operate. To address this issue, we designed and developed the SAFT-GT toolchain that tackles the multifaceted challenges associated with ensuring both safety and security. This paper provides a comprehensive description of the toolchain’s architecture and functionalities, including the Attack-Fault Trees generation and model combination approaches. We emphasize the toolchain’s ability to integrate seamlessly with existing systems, allowing for enhanced safety and security analyses without requiring extensive modifications and domain knowledge. Our proposed approach can address evolving security threats, including both known vulnerabilities and emerging attack vectors that could compromise the system. As a use case for the toolchain, we integrate it into the feedback loop of self-adaptive systems. Finally, to validate the practical applicability of the toolchain, we conducted an extensive user study involving domain experts, whose insights and feedback underscore the toolchain’s relevance and usability in real-world scenarios. Our findings demonstrate the toolchain’s effectiveness in real-world applications while highlighting areas for future improvements. The toolchain and associated resources are available in an open-source repository to promote reproducibility and encourage further research in this field.

Configurable systems typically consist of reusable assets that have dependencies between each other. To specify such dependencies, feature models are commonly used. As feature models in practice are often complex, automated reasoning is typically employed to analyze the dependencies. Here, the de facto standard is translating the feature model to conjunctive normal form (CNF) to enable employing off-the-shelf tools, such as SAT or #SAT solvers. However, modern feature-modeling dialects often contain constructs, such as cardinality constraints, that are ill-suited for conversion to CNF. This mismatch between the input of reasoning engines and the available feature-modeling dialects limits the applicability of the more expressive constructs. In this work, we shorten this gap between expressive constructs and scalable automated reasoning. Our contribution is twofold: First, we provide a pseudo-Boolean encoding for feature models, which facilitates smaller representations of commonly employed constructs compared to Boolean encoding. Second, we propose a novel method to compile pseudo-Boolean formulas to Boolean d- DNNFs. With the compiled d-DNNFs, we can resort to a plethora of efficient analyses already used in feature modeling. Our empirical evaluation shows that our proposal substantially outperforms the state-of-the-art based on CNF inputs for expressive constructs. For every considered dataset representing different feature models and feature-modeling constructs, the feature models can be significantly faster translated to pseudo-Boolean than to CNF. Overall, deriving d-DNNFs from a feature model with the targeted expressive constraints can be substantially accelerated using our pseudo-Boolean approach. For instance, the Boolean approach only scales for group cardinalities with up-to 13 features while pseudo-Boolean d-DNNF compilation can compile cardinalities with thousands of features. Furthermore, our approach is competitive on feature models with only basic constructs.

Context: Various approaches aim to support program comprehension by automatically detecting algorithms in source code. However, no empirical evaluations of their helpfulness have been performed. Objective: To empirically evaluate how algorithm labels — which include the algorithm’s name and additional information — impact program comprehension in terms of correctness and time. Method: We conducted a controlled experiment with 56 participants, where the experimental group received code with labeled algorithms. The groups completed exercises designed to measure program comprehension as well as a post-questionnaire on label helpfulness, use cases for algorithm recognition, and reasons for self-implementation of algorithms in practice. Results: Annotating source code with algorithm labels significantly improves program comprehension (p=0.040), with a median improvement of 6 points (~23%), but does not affect completion times (p=0.991). Qualitative analysis revealed that a majority of participants perceived the labels as helpful, especially for recognizing the codes intent. Participants also proposed use cases such as error detection, optimization, and library replacement. Reasons for self-implementing algorithms included library inadequacies, performance needs and avoiding dependencies or licensing costs. Conclusion: This study shows that algorithm labels improve program comprehension, especially for developers with medium programming experience. Our qualitative analysis also sheds light on how participants benefit from the labels, further use cases for algorithm recognition and motivations behind self-implementing algorithms.

The R programming language is primarily designed for statistical computing and mostly used by researchers without a background in computer science. R provides a wide range of dynamic features and peculiarities that are difficult to analyze statically like dynamic scoping and lazy evaluation with dynamic side effects. At the same time, the R ecosystem lacks sophisticated analysis tools that support researchers in understanding and improving their code. In this paper, we present a novel static dataflow analysis framework for the R programming language that is capable of handling the dynamic nature of R programs and produces the dataflow graph of given R programs. This graph can be essential in a range of analyses, including program slicing, which we implement as a proof of concept. The core analysis works as a stateful fold over a normalized version of the abstract syntax tree of the R program, which tracks (re-)definitions, values, function calls, side effects, external files, and a dynamic control flow to produce one dataflow graph per program. We evaluate the correctness of our analysis using output equivalence testing on a manually curated dataset of 779 sensible slicing points from executable real-world R scripts. Additionally, we use a set of systematic test cases based on the capabilities of the R language and the implementation of the R interpreter and measure the runtimes well as the memory consumption on a set of 4,230 real-world R scripts and 20,815 packages available on R’s package manager CRAN. Furthermore, we evaluate the recall of our program slicer, its accuracy using shrinking, and its improvement over the state of the art. We correctly analyze almost all programs in our equivalence test suite, preserving the identical output for 99.7 % of the manually curated slicing points. On average, we require 576 ms to analyze the dataflow and around 213 kB to store the graph of a research script. This shows that our analysis is capable of analyzing real-world sources quickly and correctly. Our slicer achieves an average reduction of 84.8 % of tokens indicating its potential to improve program comprehension.

Abstract In a collaborative multi-user model-driven engineering context, it becomes important to track who changed what model part how and why. Operation-based versioning addresses this need by persisting a meaningful edit history which enables a single user to navigate through a model’s evolution over time, to analyze arbitrary previous model versions, or to trace the impact of an operation. However, to load a distinct prior version, it must be restored by reapplying all previous operations, which is time-consuming and, thus, interrupts a user’s workflow. Caching with a fixed distance between caches helps to overcome this problem to the cost of increasing memory requirements. Further, there is no caching approach supporting branches, merges, and possibly resolved conflicts. We propose two advanced caching strategies for operation-based versioning capable of the previously mentioned features: zonal and adaptive caching. Both strategies reduce the memory in use by not applying the same static distance between two caches across the whole edit history. Instead, the distance increases depending on a version’s age and its distance to a branch’s head. Both strategies aim to reduce the restoration time of arbitrary prior versions below a threshold to not interrupt a user’s flow of thought. Zonal caching employs predefined distances compatible with a broad range of model sizes. In contrast, adaptive caching derives the distances individually depending on the initial time to load the model on a user’s computer and the model’s size.We conducted controlled experiments with models of varying sizes and compared the time to restore model versions and the memory in use for no caching, caching with static distances, zonal, and adaptive strategies on different computers. The developed strategies decrease the time to restore a version remarkably while using less memory than static caching. Our results show that for all considered systems and models individual adaptive caching reduces memory usage even further compared to zone-based caching while still satisfying application responsiveness requirements.

Context Many researchers rely on the R programming language to perform their statistical analyses and visualizations in the form of R scripts. However, recent research and experience show, that many of these scripts contain problems. From being hard to comprehend by combining several analyses and plots into a single source file to being non-reproducible, with a lack of analysis tools supporting the writing of correct and maintainable code. Objective In this work, we address the problem of comprehending and maintaining R scripts by proposing flowR, a program slicer and static dataflow analyzer for the R programming language, which can be integrated directly into Visual Studio Code. Given a set of variables of interest, like the generation of a single figure in a script, flowR automatically reduces the program to the parts relevant for the output of interest, like the value of a variable. Method First, we use static program analysis to construct a detailed dataflow graph of the R script. The analysis supports loops, function calls, side effects, sourcing external files, and even redefinitions of R's primitive constructs. Subsequently, we calculate the program slice by solving a reachability problem on the graph, collecting all required parts and presenting them to the user. Results Providing several interactive ways of slicing the program, we require an average of 16 ms to calculate the slice on a given dataflow graph, reducing the code by around 94% of tokens.

Context: Technically sophisticated systems are the result of the joint work of several domain experts. However, the more people collaborate, the more important it becomes to make the model evolution and its single edit operations accessible and comprehensible for involved stakeholders. Objective: We developed the textual and semantic aware query language EditQL. It enables domain experts to search for model versions, changes, and causing edit operations within a model's edit history. Based on an operation-based versioning system, the query language covers both edit operations and all model states. Method: We systematically elaborate the requirements of a query language for edit histories. Based on this, we present a DSL integrated into an existing modeling tool. We conducted a mixed-methods usability study with 15 participants in which they had to answer various questions about a model's evolution using EditQL. Results: All participants agreed on the usefulness of the query language, particularly the possibility of querying for semantic changes in the model. The measured System Usability Scale (SUS) scores range from OK to good. In addition, we identified a set of possible improvements. Conclusion: The study confirmed that EditQL and the underlying concepts are suitable tools to help domain experts understand the evolution of a model.

Context The R programming language has a huge and active community, especially in the area of statistical computing. Its interpreted nature allows for several interesting constructs, like the manipulation of functions at run-time, that hinder the static analysis of R programs. At the same time, there is a lack of existing research regarding how these features, or even the R language as a whole are used in practice. Objective In this paper, we conduct a large-scale, static analysis of more than 50 million lines of real-world R programs and packages to identify their characteristics and the features that are actually used. Moreover, we compare the similarities and differences between the scripts of R users and the implementations of package authors. We provide insights for static analysis tools like the lintr package as well as potential interpreter optimizations and uncover areas for future research. Method We analyze 4 230 R scripts submitted alongside publications and the sources of 19 450 CRAN packages for over 350 000 R files, collecting and summarizing quantitative information for features of interest. Results We find a high frequency of name-based indexing operations, assignments, and loops, but a low frequency for most of R's reflective functions. Furthermore, we find neither testing functions nor many calls to R's foreign function interface (FFI) in the publication submissions. Conclusion R scripts and package sources differ, for example, in their size, the way they include other packages, and their usage of R's reflective capabilities. We provide features that are used frequently and should be prioritized by static analysis tools, like operator assignments, function calls, and certain reflective functions like load.

Several profilers for general-purpose languages like Java offer visualizations to support users in understanding the execution of a program and identifying the causes of a performance issue. Unfortunately, these performance visualizations are difficult to reuse in profilers for declarative model transformations since they cannot display transformation-specific information. For example, a profiler for a declarative model transformation language must provide information on the traversal of the input model since it impacts the performance but is hidden from the developer. Moreover, the respective visualization must scale for input models that consist of several thousand model elements. Hence, we developed performance visualizations for the declarative model transformation language Henshin that provide insights into the transformation execution. Subsequently, we performed a mixed methods study with 18 Henshin novices to evaluate the effectiveness of our visualizations. In our study, the participants tried to improve the execution performance of four transformations by performing a root cause analysis using our visualizations. The results of our study show that depending on the task, between 16 and 18 participants understood the execution of a transformation correctly based on our visualizations. Moreover, between 12 and 18 participants proposed effective optimizations using our visualizations.

Self-adaptive cloud systems dynamically adapt their configuration to achieve Service Level Objectives (SLOs), for example, to ensure a response time below a certain threshold, in changing environments. However, understanding these recon-figurations is challenging. To address this issue, we introduce ADVISE, a visualization tool for reconfigurations in self-adaptive systems. Our adaption approach leverages the Palladio ecosystem to predict system performance and plan optimal reconfigurations by exploring the state space. The optimal path in the state space graph, determined by a utility value based on the SLOs, represents the ideal policy. Our tool provides real-time visualizations of performance predictions and reconfiguration plans aiding developers in managing and optimizing system behavior effectively. We enable both the analysis of individual states and the examination of paths within the state space graph, enabling users to analyze not only single adaptation decisions but also the overall reconfiguration behavior. Video URL: [1]

Abstract Context Dedicated model transformation languages are claimed to provide many benefits over the use of general purpose languages for developing model transformations. However, the actual advantages and disadvantages associated with the use of model transformation languages are poorly understood empirically. There is little knowledge and even less empirical assessment about what advantages and disadvantages hold in which cases and where they originate from. In a prior interview study, we elicited expert opinions on what advantages result from what factors surrounding model transformation languages as well as a number of moderating factors that moderate the influence. Objective We aim to quantitatively asses the interview results to confirm or reject the influences and moderation effects posed by different factors. We further intend to gain insights into how valuable different factors are to the discussion so that future studies can draw on these data for designing targeted and relevant studies. Method We gather data on the factors and quality attributes using an online survey. To analyse the data and examine the hypothesised influences and moderations, we use universal structure modelling based on a structural equation model. Universal structure modelling produces significance values and path coefficients for each hypothesised and modelled interdependence between factors and quality attributes that can be used to confirm or reject correlation and to weigh the strength of influence present. Results We analyzed 113 responses. The results show that the MTL capabilities Tracing and Reuse Mechanisms are most important overall. Though the observed effects were generally 10 times lower than anticipated. Furthermore, we found that moderation effects need to be individually assessed for each influence on a quality attribute. The moderation effects of a single moderating variable vary significantly for each influence, with the strongest effects being 1000 times higher than the weakest. Conclusion The empirical assessment of MTLs is a complex topic that cannot be solved by looking at a single stand-alone factor. Our results provide clear indication that evaluation should consider transformations of different sizes and use-cases that go beyond mapping one elements attributes to another. Language development on the other hand should focus on providing practical, transformation specific reuse mechanisms that allow MTLs to excel in areas such as maintainability and productivity compared to GPLs.

Model transformation languages are domain-specific languages used to define transformations of models. These transformations consist of the translation from one modeling formalism into another or just the updating of a given model. Such transformations are often described declaratively and are often implemented based on very small models that cover the language of the input model. As a result, transformation developers are often unable to assess the time required to transform a larger model. Hence, we propose a prediction approach based on machine learning which uses a set of model characteristics as input and provides a prediction of the execution time of a transformation defined in the Atlas Transformation Language (ATL). In our previous work (Groner et al., 2023), we already showed that support vector regression in combination with a model characterization based on the number of model elements, the number of references, and the number of attributes is the best choice in terms of usability and prediction accuracy for the transformations considered in our experiments. Our previous approach cannot predict the performance of transformations correctly which transform attributes whose values have an arbitrary size, like string attributes. Therefore, we investigate in this work whether an extension of our feature sets that describes the average size of string attributes can help to overcome this weakness. Our results show that the random forest approach in combination with model characterizations based on the number of model elements, the number of references, the number of attributes, and the average size of string attributes filtered by the 85th percentile of their variance is the best choice in terms of the simple way to describe a model and the quality of the obtained prediction. With this combination, we obtained a mean absolute percentage error (MAPE) of 5.07% over all modules and a MAPE of 4.82% over all modules excluding the transformation for which our previous approach failed. Whereas, we obtained previously a MAPE of 38.48% over all modules and a MAPE of 4.45% over all modules excluding the transformation for which our previous approach failed.

Abstract Modeling is often associated with complex and heavy tooling, leading to a negative perception among practitioners. However, alternative paradigms, such as everything-as-code or low-code, are gaining acceptance due to their perceived ease of use. This paper explores the dichotomy between these perceptions through the lens of “modeler experience” (MX). MX includes factors such as user experience, motivation, integration, collaboration and versioning, and language complexity. We examine the relationships between these factors and their impact on different modeling usage scenarios. Our findings highlight the importance of considering MX when understanding how developers interact with modeling tools and the complexities of modeling and associated tooling.

Model transformation languages are special-purpose languages, which are designed to define transformations as comfortably as possible, i.e., often in a declarative way. Typically, developers create their transformations based on small input models which systematically cover the language of the input models. This makes it difficult for the developers to estimate how the transformations would perform for a large and diverse set of input models.

Cyber–physical systems (CPS) are increasingly self-adaptive, i.e. they have the ability to introspect and change their behavior. This self-adaptation process must be considered when modeling the safety and security aspects of the system. This study collects and compares security attacks and safety hazards on self-adaptive systems (SAS) described in the literature. In addition, mitigation and treatment strategies, as well as the modeling and analysis approaches, are investigated. We conducted a systematic literature review on 21 selected papers. The selection process included a database search on four scientific databases using a common search string (1430 papers), forward and backward snowballing (1402 papers), and filtering the results based on predefined inclusion and exclusion criteria. The coding scheme to analyze the content of the papers was obtained through research questions, existing domain-specific taxonomies, and open coding. Safety and security are not jointly modeled in the context of self-adaptive systems. The adaptation process is often not considered in the attack and hazard analysis due to naïve assumptions and modeling. The proposed approaches are mostly verified and validated through simulation often using simple use cases and scenarios. A thorough and joint modeling approach for safety and security in self-adaptive systems is still an open challenge that needs to be addressed. Further work is needed to address the gap between safety and security modeling in self-adaptive systems. Editor’s note: Open Science material was validated by the Journal of Systems and Software Open Science Board.

There is consensus across the automotive industry that Automated Driving Systems and automated vehicles challenge the way how quality assurance and, particularly, testing must be performed. However, there is a lack of up-to-date empirical studies that substantiate this concern. We conducted interviews with several experts from industry and research to systematically identify challenges as well as improvement opportunities in methods and tools. We report in this paper on 31 challenges that we identified in the areas of scenario- and simulation-based testing, test automation, and test execution. One recurrent challenge expressed by many experts is the problem how to translate a desired condition to be tested into an executable scenario model. This is not alone a question of scripting the scenario, but also of considering a vehicle under test that might try to evade the desired test condition.

Self-adaptive systems offer several attack surfaces due to the communication via different channels and the different sensors required to observe the environment. Often, attacks cause safety to be compromised as well, making it necessary to consider these two aspects together. Furthermore, the approaches currently used for safety and security analysis do not sufficient take into account the intermediate steps of an adaptation. Current work in this area ignores the fact that a self-adaptive system also reveals possible vulnerabilities (even if only temporarily) during the adaptation. To address this issue, we propose a modeling approach that takes into account the different relevant aspects of a system, its adaptation process, as well as safety hazards and security attacks. We present several models that describe different aspects of a self-adaptive system and we outline our idea of how these models can then be combined into an Attack-Fault Tree. This allows modeling aspects of the system on different levels of abstraction and co-evolve the models using transformations according to the adaptation of the system. Finally, analyses can then be performed as usual on the resulting Attack-Fault Tree.

Context: Modeling industrial systems is mostly done collaboratively. In such a scenario, a model is modified by multiple people over a possibly long period of time. In consequence, modelers have to be able to understand a model’s evolution and, in particular, what elements of a model have changed, how, why, when, and by whom. Objective: We derive six distinct user goals and systematically design a graphical modeling languageagnostic set of tools that support users in achieving these goals. Method: We implement those tools and integrate them into an existing graphical modeling tool for technology roadmaps. To measure the tools’ usability, we conducted a mixed-methods study with participants of different levels of experience. With the set of developed tools at hand, in different scenarios, participants had to answer several questions regarding the evolution of a model. Results: The SUS score for assessing usability ranged from 80 to 95, indicating good to excellent usability. Task completeness (measured per scenario) ranged from 92% to 100%. Further, participants emphasized the added value of the tools while completing the scenarios. Conclusion: Although participants stated that the set of tools can be classified as expert tools, the developed tools achieve the goal of enabling users to comprehend changes made by others and trace the impacts of operations.

Abstract Context Model driven development envisages the use of model transformations to evolve models. Model transformation languages, developed for this task, are touted with many benefits over general purpose programming languages. However, a large number of these claims have not yet been substantiated. They are also made without the context necessary to be able to critically assess their merit or built meaningful empirical studies around them. Objective The objective of our work is to elicit the reasoning, influences and background knowledge that lead people to assume benefits or drawbacks of model transformation languages. Method We conducted a large-scale interview study involving 56 participants from research and industry. Interviewees were presented with claims about model transformation languages and were asked to provide reasons for their assessment thereof. We qualitatively analysed the responses to find factors that influence the properties of model transformation languages as well as explanations as to how exactly they do so. Results Our interviews show, that general purpose expressiveness of GPLs, domain specific capabilities of MTLs as well as tooling all have strong influences on how people view properties of model transformation languages. Moreover, the Choice of MTL , the Use Case for which a transformation should be developed as well as the Skill s of involved stakeholders have a moderating effect on the influences, by changing the context to consider. Conclusion There is a broad body of experience, that suggests positive and negative influences for properties of MTLs. Our data suggests, that much needs to be done in order to convey the viability of model transformation languages. Efforts to provide more empirical substance need to be undergone and lacklustre language capabilities and tooling need to be improved upon. We suggest several approaches for this that can be based on the results of the presented study.

Abstract Model transformations are among the key concepts of model-driven engineering (MDE), and dedicated model transformation languages (MTLs) emerged with the popularity of the MDE pssaradigm about 15 to 20 years ago. MTLs claim to increase the ease of development of model transformations by abstracting from recurring transformation aspects and hiding complex semantics behind a simple and intuitive syntax. Nonetheless, MTLs are rarely adopted in practice, there is still no empirical evidence for the claim of easier development, and the argument of abstraction deserves a fresh look in the light of modern general purpose languages (GPLs) which have undergone a significant evolution in the last two decades. In this paper, we report about a study in which we compare the complexity and size of model transformations written in three different languages, namely (i) the Atlas Transformation Language (ATL), (ii) Java SE5 (2004–2009), and (iii) Java SE14 (2020); the Java transformations are derived from an ATL specification using a translation schema we developed for our study. In a nutshell, we found that some of the new features in Java SE14 compared to Java SE5 help to significantly reduce the complexity of transformations written in Java by as much as 45%. At the same time, however, the relative amount of complexity that stems from aspects that ATL can hide from the developer, which is about 40% of the total complexity, stays about the same. Furthermore we discovered that while transformation code in Java SE14 requires up to 25% less lines of code, the number of words written in both versions stays about the same. And while the written number of words stays about the same their distribution throughout the code changes significantly. Based on these results, we discuss the concrete advancements in newer Java versions. We also discuss to which extent new language advancements justify writing transformations in a general purpose language rather than a dedicated transformation language. We further indicate potential avenues for future research on the comparison of MTLs and GPLs in a model transformation context.

The declarative graph transformation language Henshin transforms instance models represented as graphs by applying a series of basic steps that match and replace structural patterns on parts of models. These simple transformation rules are then combined into control flow constructs similar to those of imperative programming languages to create more complex transformations. However, defects in the structure of control flow or in transformation rules might misschedule the application of operations, resulting in basic steps to be inapplicable or produce incorrect output. Understanding and fixing these bugs is complicated by the fact that pattern matching in rules is non-deterministic. Moreover, some control flow structures employ a nondeterministic choice of alternatives. This makes it challenging for developers to keep track of all the possible execution paths and interactions between them. For conventional programming languages, techniques have been developed to execute a program symbolically. By abstracting over the concrete values of variables in any actual run, generalized knowledge is gained about the possible behavior of the program. This can be useful in understanding problems and fixing bugs. In this paper, we present an approach to symbolically execute graph transformations for a subset of Henshin, using symbolic path constraints based on the cardinalities of graph pattern occurrences in the model.

Abstract There exists a plethora of claims about the advantages and disadvantages of model transformation languages compared to general-purpose programming languages. With this work, we aim to create an overview over these claims in the literature and systematize evidence thereof. For this purpose, we conducted a systematic literature review by following a systematic process for searching and selecting relevant publications and extracting data. We selected a total of 58 publications, categorized claims about model transformation languages into 14 separate groups and conceived a representation to track claims and evidence through the literature. From our results, we conclude that: (i) the current literature claims many advantages of model transformation languages but also points towards certain deficits and (ii) there is insufficient evidence for claimed advantages and disadvantages and (iii) there is a lack of research interest into the verification of claims.

Abstract Automotive test case specifications document test cases to be performed for a specific test object at a defined test level. They are a fundamental part of a structured automotive testing process, as required by the ISO 26262. The aim of our research is to identify challenges from a practitioner’s point of view that lead to poor quality of test case specifications and thus negatively impact time, cost, and probability of defect detection. We designed an exploratory case study to systematically identify challenges focusing on (C) creation, (P) processing, and (Q) quality assurance related aspects of test case specifications. We conducted 17 semi-structured interviews covering a German OEM as well as three of its automotive suppliers and analyzed them qualitatively. We investigated causes and consequences arising from the challenges. Additionally, we conducted a descriptive survey to assess frequency and criticality. The identified challenges were summarized in a taxonomy consisting of nine main categories: (1) availability and (2) content-related problems with input artifacts, problems related to (3) a lack of knowledge, (4) the test case description, (5) the test case specification content, (6) processes, (7) communication, (8) quality assurance, and (9) tools. The challenges were assessed by 26 internal and 10 external employees. Hence, we identified differences between these groups in terms of access to documents, incomplete requirements, scope of model series, process, and tool-related aspects. Overall, the study results underline the necessity of quality assurance measures for test case specifications. Based on the assessments, our research indicates a broad range of test case description related challenges that are promising candidates for improving test case specification quality.

The introduction of major innovations in industry requires a collaboration across the whole supply chain. A common way to organize such a collaboration is the use of technology roadmaps, which act as an industry-wide long-term planning tool. Technology roadmaps are used to identify industry needs, estimate the availability of technological solutions, and identify the need for innovation in the future. Roadmaps are inherently both time-dependent and based on uncertain values, i.e., properties and structural components can change over time. Current approaches for model-driven engineering do not inherently support these aspects. We present a novel model-driven approach treating those aspects as first-class citizens. To address the problem of missing support for time in the context of roadmap modeling, we introduce the concepts of a common global time, time-dependent properties, and time-dependent availability. This includes requirements, properties, and the structure of the model or its components as well. These concepts result in a continuous range of various valid models over time instead of a single valid model at a certain point of time. We present concepts for an interactive graphical user interface to enable the user to efficiently interact with those models. We illustrate the application of these concepts on an industrial example of a next generation electrical fuse.

Model-Driven Software Engineering (MDSE) is a widely used approach to deal with the increasing complexity of software. This increasing complexity also leads to the fact that the models used and the model transformations applied become larger and more complex as well. This means that the execution performance of model transformations is gaining in importance. While improving the performance of model transformation execution engines has been a focus of the MDSE-community in the past, there does not exist any empirical study on how developers of model transformation deal with performance issues. Consequently, we conducted an exploratory mixed method study consisting of a quantitative online survey and a qualitative interview study. We used a questionnaire to investigate whether the performance of a transformation is actually important for transformation developers and whether they have already tried to improve the performance of a model transformation. Subsequently, we conducted semi-structured interviews based on the answers to the questionnaire to investigate how transformation developers deal with performance issues, what causes and solutions they found and also what they think could help them to easier find causes. The results of the quantitative online survey show that 43 of 81 participants have already tried to improve the performance of a transformation and 34 of the 81 are sometimes or only rarely satisfied with the execution performance. Based on the answers from our 13 interviews, we identified different strategies to prevent or find performance issues in model transformations as well as different types of causes of performance issues and solutions. Finally, we compiled a collection of additional tool features perceived helpful by the interviewees to address performance issues.

Automotive Test Case Specifications (TestSpecs) are a fundamental part of a structured test process in the automotive domain. For system and integration tests, acceptance and customer experience test cases are executed manually by human testers in a prototype vehicle. To ensure that these test cases are understood by humans, they are usually described in natural language, which often leads to ambiguities, misunderstandings, or incomplete test cases. In addition, the description of test cases vary significantly depending on the system to be tested and the respective test level. Test Designers want individual assistance in documenting their test cases with respect to system-specific characteristics, instead of using programming languages or standardized languages such as UML. Thus, Domain Specific Languages (DSLs) are a possible solution to satisfy this demand and to improve the quality of test cases, for example in terms of preciseness, uniformity, and completeness. The contribution of this paper is a systematic approach to support the development of system-specific automotive Testing DSLs that achieve high acceptance by test designers and testers. Therefore, we focus on the analysis phase in the DSL development process. We adapted domain analysis activities and defined a domain analysis method tailored to the analysis of automotive TestSpecs. We demonstrate the applicability of our method by means of five different automotive systems. Our evaluation shows that the derived system-specific Testing DSLs cover between 70% and 95% of the test steps contained in TestSpecs with only 11 to 35 conceptual templates. Moreover, a usability study with practitioners revealed a good usability of the Testing DSLs and the corresponding tool as well as that this eases the specification of test cases.

Several studies report that the use of model-centric methods in the automotive domain is widespread and offers several benefits. However, existing work indicates that few modelling frameworks explicitly include requirements engineering (RE), and that natural language descriptions are still the status quo in RE. Therefore, we aim to increase the understanding of current and potential future use of models in RE, with respect to the automotive domain. In this paper, we report our findings from a multiple-case study with two automotive companies, collecting interview data from 14 practitioners. Our results show that models are used for a variety of different purposes during RE in the automotive domain, e.g. to improve communication and to handle complexity. However, these models are often used in an unsystematic fashion and restricted to few experts. A more widespread use of models is prevented by various challenges, most of which align with existing work on model use in a general sense. Furthermore, our results indicate that there are many potential benefits associated with future use of models during RE. Interestingly, existing research does not align well with several of the proposed use cases, e.g. restricting the use of models to informal notations for communication purposes. Based on our findings, we recommend a stronger focus on informal modelling and on using models for multi-disciplinary environments. Additionally, we see the need for future work in the area of model use, i.e. information extraction from models by non-expert modellers.

Test case specifications are a fundamental part of a structured test process and required by standards like ISO 26262 in the automotive domain. Test cases are usually derived from requirements and provide a necessary basis for test implementation and execution. The aim of this work is to gain insights into the creation and processing of test case specifications from a practitioner's point of view. We decided on an explorative case study to identify challenges related to three problem areas: creation, processing and quality assessment related aspects of test case specifications. We conducted 17 semi-structured interviews covering a German OEM and three automotive suppliers. Afterwards, we analyzed the collected data qualitatively to identify challenges as well as causes and consequences arising from them. The identified challenges were categorized in a taxonomy consisting of nine main categories: (1) availability and (2) content-related problems with input artifacts, problems related to (3) a lack of knowledge, (4) the test case description, (5) the content of a test case specification, (6) quality assurance, (7) processes, (8) communication, and (9) tools. Overall, we observed a present awareness of the identified challenges, which is evident from different solutions to handle these challenges. Nevertheless, some of the current solutions are not efficient and still require a lot of manual work, for instance phrasing-based problems in test cases.

Project success in the automotive industry is highly influenced by requirements engineering (RE), for which communication and organisation structure play a major role, much due to the scale and distribution of these projects. However, empirical research is scarce on these aspects of automotive RE and warrants closer examination. Therefore, the purpose of this paper is to identify problems or challenges in automotive RE with respect to communication and organisation structure. Using a multiple-case study approach, we collected data via 14 semi-structured interviews at one car manufacturer and one supplier. We tested our findings from the case study with a questionnaire distributed to practitioners in the automotive industry. Our results indicate that it is difficult but increasingly important to establish communication channels outside the fixed organisation structure and that responsibilities are often unclear. Product knowledge during early requirements elicitation and context knowledge later on is lacking. Furthermore, abstraction gaps between requirements on different abstraction levels leads to inconsistencies. For academia, we formulate a concrete agenda for future research. Practitioners can use the findings to broaden their understanding of how the problems manifest and to improve their organisations.

Summary Automated measurement programs are an efficient way of collecting, processing, and visualizing measures in large software development companies. The number of measurements in these programs is usually large, which is caused by a diversity of the needs of the stakeholders. In this paper, we present the application of the self‐healing concepts to assure the availability of measurements to the stakeholders without the need for effort‐intensive and costly manual interventions of the operators. We study the measurement infrastructure at one of the development units of a large infrastructure provider. In this paper, we present how the Monitor, Analyze, Plane, and Execute with Knowledge model was instantiated in a simplistic manner to reduce the need for manual intervention in the operation of the measurement systems. Based on the experiences from the 2 cases studied in this paper, we show how an evolution toward self‐healing measurement systems is done both with a dedicated failure taxonomy and with an effective straightforward handling of the most common errors in the execution. The mechanisms studied and presented in this paper show that self‐healing provides significant improvements to the operation of the measurement program and reduces the need for daily oversight by an operator for the measurement systems.

One domain-specific modeling environment is centered around a domain-specific meta-model which defines syntax (modeling elements, e.g., classes) for the domain models. However, in order for the system designers to be able to construct meaningful models, semantics of the domain-specific meta-model needs to be described as well. This semantics is often provided in a form of informal natural language specifications that contain a set of design requirements, each describing the intended use of one or more modeling elements. Intuitively, introduction of new concepts into the modeling environment is expected to require changes in both meta-modeling syntax and informal semantics in such a way that their co-evolution is highly correlated. In order to test this hypothesis, we analyzed the relation between added classes, attributes, and connectors, as meta-modeling syntax, and modified/added design requirements, as meta-modeling semantics, in a case study of the AUTOSAR meta-modeling environment. We found that new AUTOSAR concepts usually require both new modeling elements and new design requirements, but surprisingly adding more elements is not always followed by more requirements. This finding is also validated by the moderately strong correlation between the evolution of these two AUTOSAR meta-modeling artifacts (Spearman's rho 0,63 and Kendall's tau 0,49). For system designers, this means that both meta-modeling syntax and informal semantics is important to be considered in the analysis of domain-specific meta-model evolution, but it may not be enough for understanding the use of all modeling elements. For designers responsible for the maintenance of domain-specific meta-models, this means that more effort shall be put into describing the semantics of all introduced modeling elements.

Formalising requirements has the potential to solve problems arising from deficiencies in natural language descriptions. While behavioural requirements are rarely described formally in industry, increasing complexity and new safety standards have renewed the interest in formal specifications. The goal of this paper is to explore how behavioural requirements for embedded systems can be formalised and aligned with verification tasks. Over the course of a 2.5-year project with industry, we modelled existing requirements from a safety-critical automotive software function in several iterations. Taking practical limitations and stakeholder preferences into account, we explored the use of models on different abstraction levels. The final model was used to generate test cases and was evaluated in three interviews with relevant industry practitioners. We conclude that models on a high level of abstraction are most suitable for industrial requirements engineering, especially when they need to be interpreted by other stakeholders.

Programmers use diverse tools for code understanding to access various types of context information like interface definitions, revision histories, and debugging values. Integrated development environments support specialized visualization mechanisms for such context types. While these mechanisms in principle enable programmers to access required information, the diversity of visualizations as well as the distance between code locations and related information may slow down development. We present a generic approach to embed various types of context uniformly into the main source code view in close proximity to the relevant source code by using a concept called code portals. Furthermore, embedded content can be organized and manipulated directly using operations already familiar to programmers. We illustrate the approach using different types of context, and present preliminary results of a qualitative study indicating that our approach is usable and improves program comprehension and productivity in general. The approach is implemented in a prototypical source code editor.

Modern integrated development environments offer a diverse set of features to improve code comprehension. However, varying interaction mechanisms and visualizations, as well as the on-screen distance between source code and relevant information can slow down programmers. We present INLINE, a stand-alone source code editor providing a novel concept called code-portals to embed additional textual content inside its main source code view in a uniform and non-intrusive way. We have adapted common code comprehension features and evaluated our approach in a qualitative usability study. A screencast highlighting the features of INLINE is available at: http://www.uni-ulm.de/en/in/pm/research/projects/inline.html.

Meta-modeling has been a topic of interest in the modeling community for many years, yielding substantialnumber of papers describing its theoretical concepts. Many of them are aiming to solve the problem of traditionalUML based domain-specific meta-modeling related to its non-compliance to the strict meta-modelingprinciple, such as the deep meta-modeling approach. In this paper, we show the practical use of meta-modelsin the automotive development process based on AUTOSAR and visualize places in the AUTOSAR metamodelwhich are broken according to the strict meta-modeling principle. We then explain how the AUTOSARmeta-modeling environment can be re-worked in order to comply to this principle by applying three individualapproaches, each one combined with the concept of Orthogonal Classification Architecture: UML extension,prototypical pattern and deep instantiation. Finally we discuss the applicability of these approaches in practiceand contrast the identified issues with the actual problems faced by the automotive meta-modeling practitioners.Our objective is to bridge the current gap between the theoretical and practical concerns in meta-modeling.

Comprehension of a program, either written by oneself or by someone else, is an important part of the daily life of a programmer. While many approaches support program comprehension of object-oriented programming languages, e.g., by providing slicing or reengineering the program into visual designs, there are fewer research activities targeting functional programming languages. For the specific case of Haskell programs, we see a need in program comprehension to understand how functions interact with each other with respect to the data and its type they exchange. In this paper, we present an approach to aid in understanding by providing an automatic transformation of Haskell programs into data-flow diagrams. These data-flow diagrams visualize the manipulation of values by the different functions which comprise the program. Because types are a very important part of writing and understanding Haskell programs, the data-flows in the diagrams are explicitly enriched with type information. This allows us to display intermediary types that usually are not visible to the programmer. The approach is based on category theory and illustrated by examples.

The software architecture of automotive software systems on the European market and wider is designed following the AUTOSAR standard. This requires continuous adoption of new AUTOSAR releases in the development projects in order to enable new innovative solutions in cars. Under these circumstances, the analysis of impact of the AUTOSAR meta-model changes on the modeling tools used in the development is crucial for avoiding delays and increased cost. However due to tens of new features combined with thousands of meta-model changes between consecutive releases of AUTOSAR, tool support is needed for such analysis. In this paper we present a systematic method and a tool - ARCA - for automated analysis of the AUTOSAR meta-model changes. The tool is able to identify relevant changes affecting modeling tools used by different roles in the development process and present the optimal set of new features to be adopted in the projects. The goal of the tool is to enable faster and cheaper software innovation cycles in cars.

Continuous software engineering refers to the organizational capability to develop, release and learn from software in very short rapid cycles, typically hours, days or a very small numbers of weeks. This requires not only agile processes in teams but in the complete research and development organization. Additionally, the technology used in the different development phases, like requirements engineering and system integration, must support the quick development cycles. Finally, automatic live experimentation for different system alternatives enables fast gathering of required data for decision making. The workshop, the second in the series after the first one at ICSE 2014, aims to bring the research communities of the aforementioned areas together to exchange challenges, ideas, and solutions to bring software engineering a step further to being a holistic continuous process. The workshop program is based on eight papers selected in the peer-review process and supplemented by interaction and discussions at the workshop. The topics range from agile methods, continuous software engineering practices to specific techniques, like visualization and testing.

Automated machines and plants are operated for some decades and undergo an everlasting evolution during this time. In this paper, we present three related open evolution challenges focusing on software evolution in the domain of automated production systems, i.e. evolution and co-evolution of (interdisciplinary) engineering models and code, quality assurance as well as variant and version management during evolution.

Domain Specific Languages (DSLs) are an established means of reducing the gap between problem and solution domains. DSLs increase productivity and improve quality as they can be tailored to exactly fit the needs of the problem to be solved. A DSL can have multiple notations including textual and graphical notations. In some cases, one of these notations for a DSL is enough but there are many cases where a single notation does not suffice and there is a demand to support multiple notations for the same DSL. UML profile is one of several approaches used to define a DSL, however most UML tools only come with graphical editors. In this paper, we present our approach and industrial experience on integrating textual and graphical editors for a UML profile-based DSL. This work was conducted as part of an explorative study at Ericsson. The main aim of the study was to investigate how to introduce a textual editor to an already existing UML profile-based DSL in an Eclipse environment. We report on the challenges of integrating textual and graphical editors for UML profile-based DSLs in practice, our chosen approach, specific constraints and requirements of the study.

Coping with evolution in automated production systems implies a cross-disciplinary challenge along the system's life-cycle for variant-rich systems of high complexity. The authors from computer science and automation provide an interdisciplinary survey on challenges and state of the art in evolution of automated production systems. Selected challenges are illustrated on the case of a simple pick and place unit. In the first part of the paper, we discuss the development process of automated production systems as well as the different type of evolutions during the system's life-cycle on the case of a pick and place unit. In the second part, we survey the challenges associated with evolution in the different development phases and a couple of cross-cutting areas and review existing approaches addressing the challenges. We close with summarizing future research directions to address the challenges of evolution in automated production systems.

Measurement in software engineering is an important activity for successful planning and management of projects under development. However knowing what to measure and how is crucial for the correct interpretation of the measurement results. In this paper, we assess the applicability of a number of software metrics for measuring a set of meta-model properties - size, length, complexity, coupling and cohesion. The goal is to identify which of these properties are mostly affected by the evolution of industrial meta-models and also which metrics should be used for their successful monitoring. In order to assess the applicability of the chosen set of metrics, we calculate them on a set of releases of the standardized meta-model used in the development of automotive software systems - the AUTOSAR meta-model - in a case study at Volvo Car Corporation. To identify the most applicable metrics, we used Principal Component Analysis (PCA). The results of these metrics shall be used by software designers in planning software development projects based on multiple AUTOSAR meta-model versions. We concluded that the evolution of the AUTOSAR meta-model is quite even with respect to all 5 properties and that the metrics based on fan-in complexity and package cohesion quantify the evolution most accurately.

Technical systems contain mechanical, electrical, and software parts. Consequently, they are developed by engineers of the respective disciplines. However, current industrial practice as well as existing development processes do not account for the required tight integration between the engineers of the different disciplines. Processes become even more complex, when self-adaptive systems are built. In this paper, we present a development process for self-adaptive mechatronic systems which particularly addresses the integration between the disciplines concerned with the development of software, namely control and software engineering. We illustrate the process by presenting examples from the development of autonomous railway vehicles which build convoys to improve energy efficiency.

Modern technical systems are increasingly built to exhibit self-x properties as, e.g., self-healing or self-optimization. For this, they require adaptation at runtime. This is even true for embedded or mechatronic systems which often operate in safety-critical environments. There, the effects of the adaptation with respect to safety must be analyzed carefully. However, not all parameters needed for safety analyses, e.g., the concrete system architecture, are known at design time. Consequently, safety analyses need to be executed during runtime. Current approaches of runtime safety analysis typically react to anomalies that already occurred in the system. Thus, unsafe system states cannot be excluded completely. We present a runtime safety analysis that prevents system states with an unacceptable risk that have not yet occurred. For this, we generate the reachable component structures at runtime and analyze them with respect to risk. The system is modified such that component structures with an unacceptable risk are not reachable any more and are thus prevented.

Hardware failures in autonomous and distributed software systems create the need for self-healing activities. This work addresses the problem of redeploying software components affected by a hardware failure, while respecting several runtime constraints. In contrast to existing approaches, we do not only compute a new feasible system configuration, but make use of AI planning in order to derive a sequence of concrete deployment and undeployment actions that achieve this state. We also distinguish between application of every intermediate plan found and the single application of the final plan. These two plan application strategies are described and evaluated along with our novel solution approach.

The next generation of advanced mechatronic systems is expected to use its software to exploit local and global networking capabilities to enhance their functionality and to adapt their local behavior when beneficial. Such systems will therefore include complex hard real-time coordination at the network level. This coordination is further reflected locally by complex reconfiguration in form of mode management and control algorithms. We present in this paper the integration of two tools which allow the integrated specification of real-time coordination and traditional control engineering specifically targeting the required complex reconfiguration of the local behavior.

No abstract available

Current techniques for the verification of software as e.g. model checking are limited when it comes to the verification of complex distributed embedded real-time systems. Our approach addresses this problem and in particular the state explosion problem for the software controlling mechatronic systems, as we provide a domain specific formal semantic definition for a subset of the UML 2.0 component model and an integrated sequence of design steps. These steps prescribe how to compose complex software systems from domain-specific patterns which model a particular part of the system behavior in a well-defined context. The correctness of these patterns can be verified individually because they have only simple communication behavior and have only a fixed number of participating roles. The composition of these patterns to describe the complete component behavior and the overall system behavior is prescribed by a rigorous syntactic definition which guarantees that the verification of component and system behavior can exploit the results of the verification of individual patterns.

How do you organize an "industrial strength" one semester educational programming project for up to 200 second year students? This paper reports on four years of experience with such projects at the University of Paderborn and the University of Braunschweig. Key properties of our project design are: starting with an existing large application, regular hard deadlines with peer reviews and presentations to a large audience, working in groups, applying project and configuration management tools, a standard system architecture with interchangeable components and competing software agents, quality assurance and standard conformance testing through final overall system integration spanning all groups, and exposure to real-world project threats.