Recent advancements in video diffusion models have established a strong foundation for developing world models with practical applications. The next challenge lies in exploring how an agent can leverage these foundation models to understand, interact with, and plan within observed environments. This requires adding more controllability to the model, transforming it into a versatile game engine capable of dynamic manipulation and control. To address this, we investigated three key conditioning factors: camera, context frame, and text, identifying limitations in current model designs. Specifically, the fusion of camera embeddings with video features leads to camera control being influenced by those features. Additionally, while textual information compensates for necessary spatiotemporal structures, it often intrudes into already observed parts of the scene. To tackle these issues, we designed the Spacetime Epipolar Attention Layer, which ensures that egomotion generated by the model strictly aligns with the camera’s movement through rigid constraints. Moreover, we propose the CI2V-adapter, which uses camera information to better determine whether to prioritize textual or visual embeddings, thereby alleviating the issue of textual intrusion into observed areas. Through extensive experiments, we demonstrate that our new model EgoSim achieves excellent results on both the RealEstate and newly repurposed Epic-Field datasets. For more results, please refer to https://egosim.github.io/EgoSim/.

This article introduces climate data practices as a conceptual lens for HCI research and design toward social and environmental justice. We offer a working definition of this approach, which we locate at the intersection of critical data studies and practice theory. Drawing from a collaborative and multi-sited study of activists, city staff, and non-profit organizations, we present six examples of climate data practices as a means of illustrating the approach as well as the diversity of issues that it may usefully surface. Through these examples, we demonstrate that a data practices approach foregrounds the local, relational, and plural qualities of climate data. Finally, we connect data practices to two related concepts—scenes and infrastructures—which together offer a framework to guide critical interrogation of the social and political life of data, and support the design of data practices that serve broader goals of social and environmental justice.

Recent works in video prediction have mainly focused on passive forecasting and low-level action-conditional pre-diction, which sidesteps the learning of interaction between agents and objects. We introduce the task of semantic action-conditional video prediction, which uses semantic action labels to describe those interactions and can be regarded as an inverse problem of action recognition. The challenge of this new task primarily lies in how to effectively inform the model of semantic action information. Inspired by the idea of Mixture of Experts, we embody each abstract label by a structured combination of various visual concept learn-ers and propose a novel video prediction model, Modular Action Concept Network (MAC). Our method is evaluated on two newly designed synthetic datasets, CLEVR-Building- Blocks and Sapien-Kitchen, and one real-world dataset called Tower-Creation. Extensive experiments demonstrate that MAC can correctly condition on given instructions and generate corresponding future frames without need of bounding boxes. We further show that the trained model can make out-of-distribution generalization, be quickly adapted to new object categories and exploit its learnt features for object detection, showing the progression towards higher-level cognitive abilities. More visualizations can be found at http://www.pair.toronto.edu/mac/.

Stolen passwords, compromised medical records, taking the internet out through video cameras– cybersecurity breaches are in the news every day. Despite all this, the practice of cybersecurity today is generally reactive rather than proactive. That is, rather than improving their defenses in advance, organizations react to attacks once they have occurred by patching the individual vulnerabilities that led to those attacks. Researchers engineer solutions to the latest form of attack. What we need, instead, are scientifically founded design principles for building in security mechanisms from the beginning, giving protection against broad classes of attacks. Through scientific measurement, we can improve our ability to make decisions that are evidence-based, proactive, and long-sighted. Recognizing these needs, the US National Security Agency (NSA) devised a new framework for collaborative research, the “Lablet” structure, with the intent to more aggressively advance the science of cybersecurity. A key motivation was to catalyze a shift in relevant areas towards a more organized and cohesive scientific community. The NSA named Carnegie Mellon University, North Carolina State University, and the University of Illinois – Urbana Champaign its initial Lablets in 2011, and added the University of Maryland in 2014.

It is commonly thought that CS grades are bimodal. We statistically analyzed 778 distributions of final course grades from a large research university, and found only 5.8% of the distributions passed tests of multimodality. We then devised a psychology experiment to understand why CS educators believe their grades to be bimodal. We showed 53 CS professors a series of histograms displaying ambiguous distributions and asked them to categorize the distributions. A random half of participants were primed to think about the fact that CS grades are commonly thought to be bimodal; these participants were more likely to label ambiguous distributions as "bimodal". Participants were also more likely to label distributions as bimodal if they believed that some students are innately predisposed to do better at CS. These results suggest that bimodal grades are instructional folklore in CS, caused by confirmation bias and instructor beliefs about their students.

How to increase diversity in computer science is an important open question in CS education. A number of best practices have been suggested based on case studies; however, for scaling these efforts up in a sustainable fashion, it remains unclear which types of initiatives are most effective in which contexts. We examine gender diversity initiatives in CS education from a policy analysis perspective, adapting McDonnell and Elmore's 1987 notion of policy instruments, wherein the initiative is the unit of analysis. We present a conceptual framework for categorizing the different policy instruments by a cross of 'leverage' and 'targetedness', and discuss how different types of initiatives will scale. We argue that universally-targeted, high-leverage initiatives are most important for scaling up diversity initiatives in CS education, with medium-leverage being a stepping stone to high leverage change.

Sustainability has emerged as a broad concern for society. Many engineering disciplines have been grappling with challenges in how we sustain technical, social and ecological systems. In the software engineering community, for example, maintainability has been a concern for a long time. But too often, these issues are treated in isolation from one another. Misperceptions among practitioners and research communities persist, rooted in a lack of coherent understanding of sustainability, and how it relates to software systems research and practice. This article presents a cross-disciplinary initiative to create a common ground and a point of reference for the global community of research and practice in software and sustainability, to be used for effectively communicating key issues, goals, values and principles of sustainability design for software-intensive systems.The centrepiece of this effort is the Karlskrona Manifesto for Sustainability Design, a vehicle for a much needed conversation about sustainability within and beyond the software community, and an articulation of the fundamental principles underpinning design choices that affect sustainability. We describe the motivation for developing this manifesto, including some considerations of the genre of the manifesto as well as the dynamics of its creation. We illustrate the collaborative reflective writing process and present the current edition of the manifesto itself. We assess immediate implications and applications of the articulated principles, compare these to current practice, and suggest future steps.

Modern computational science is largely a model-building activity. At first sight, the models that scientists construct seem to differ radically from those used in model-based engineering. Scientists tend to build indicative (‘how things are’) models of the world using sets of continuous equations, while engineers tend to build optative (‘how things should be’) models of the world using structural and procedural abstractions. But a closer look reveals many fascinating similarities. In this talk, I will explore the relationship between the two types of modelling, drawing on my field studies of how climate modellers work. I'll begin with an overview of what a climate model is and how it is used. I'll then dive deeper into the engineering challenges of constructing a climate model, including the challenges of coupling disparate model components, dealing with model versioning and model management issues, and the role that climate models play in enabling collaborative work. In the process, I hope to inspire people to explore how ideas from model-based software engineering might contribute to scientific modelling in general, and, more specifically, to the societal grand challenge of climate change.

We present a history of female participation in North American CS, with a focus on the social forces involved. For educators to understand the status quo, and how to change it, we must understand the historical forces that have led us here. We begin with the female ''computers'' of the 19th century, then cover the rise of computing machines, establishment of CS, and a history of CS education with regard to gender. In our discussion of academic CS, we contemplate academic generations of female computer scientists and describe their differential experiences.

Comparing and contrasting different solution approaches is known in math education and cognitive science to increase student learning -- what about CS? In this experiment, we replicated work from Rittle-Johnson and Star, using a pretest--intervention--posttest--follow-up design (n=241). Our intervention was an in-class workbook in CS2. A randomized half of students received questions in a compare-and-contrast style, seeing different code for different algorithms in parallel. The other half saw the same code questions sequentially, and evaluated them one at a time. Students in the former group performed better with regard to procedural knowledge (code reading & writing), and flexibility (generating, recognizing & evaluating multiple ways to solve a problem). The two groups performed equally on conceptual knowledge. Our results agree with those of Rittle-Johnson and Star, indicating that the existing work in this area generalizes to CS education.

From an ongoing research project on teaching hash tables using worked examples, we present four preliminary observations. First, that rather than there being a small set of common misconceptions, student misconceptions are diverse and often unique to the student. Second, that students' naive language about hash tables when given a pretest is influenced by words from the Internet (e.g. "hashtag"). Third, we observed that students' language on concept questions evolves with repeated testing, becoming more conceptually accurate but technically less precise. And finally, that students' code code correctness is not correlated to code style, but is correlated to how students performed on the concept questions.

Inflo is a web tool that introduces new ways to collaboratively construct and deconstruct logical arguments drawn as visual dataflow graphs. Inflo graphs are dynamic: nodes are logical propositions that can contain computations based on other nodes. Inflo nodes and graphs have URLs, permitting sharing via blogs, e-mails, papers, etc. People can collaboratively construct, refine, and adapt/reuse arguments by making changes to shared nodes. Combining community-curated nodes and using Inflo's nodes for computation, back-of-the-envelope calculations can rapidly be made.

Flow and causal loop diagrams can be used by content creators to illustrate how variables in a system impact one another. Such diagrams are used in educational settings to illustrate concepts like food cycles in an ecosystem and energy flows in climate models. We demonstrate how our tool, InfloGraphic, can produce interactive diagrams either by augmenting existing static diagrams produced using common tools users may already be familiar and have available such as the Gimp or Adobe Photoshop or by using a preexisting image or web page. Content consumers can use these interactive diagrams to visualize how changes to one part of a system can ripple through a system.

Model Management addresses the problem of managing an evolving collection of models by capturing the relationships between models and providing well-defined operators to manipulate them. In this paper, we describe two such operators for manipulating feature specifications described using hierarchical state machine models: Match, for finding correspondences between models, and Merge, for combining models with respect to known or hypothesized correspondences between them. Our Match operator is heuristic, making use of both static and behavioral properties of the models to improve the accuracy of matching. Our Merge operator preserves the hierarchical structure of the input models, and handles differences in behavior through parameterization. This enables us to automatically construct merges that preserve the semantics of hierarchical state machines. We report on tool support for our Match and Merge operators, and illustrate and evaluate our work by applying these operators to a set of telecommunication features built by AT&T.

Inflo is a web-based tool designed to support quantitative decision-making problems such as carbon calculators. Using the dataflow programming paradigm, Inflo provides an extensible environment for end-user programming. Inflo is built around the idea of collaboration and openness for opportunistic code-reuse and unplanned code sharing.

This workshop will explore the contributions that software research can make to the challenge of tackling climate change. Software is a critical enabling technology in nearly all aspects of climate change, from the computational models used by climate scientists to improve our understanding of the impact of human activities on earth systems, through to the information and control systems needed to build an effective carbon-neutral society. The intent of the workshop is to explore how software research can contribute to this challenge, to build a community of researchers interested in responding to the challenge, and to map out a research agenda.

Software development is an evolutionary process. Requirements of a system are often incomplete or inconsistent, and hence need to be extended or modified over time. Customers may demand new services or goals that often lead to changes in the design and implementation of the system. These changes are typically very expensive. Even if only local modifications are needed, manually applying them is time-consuming and and error-prone. Thus, it is essential to assist users in propagating changes across requirements, design, and implementation artifacts. In this paper, we take a model-based approach and provide an automated algorithm for propagating changes between requirements and design models. The key feature of our work is explicating relationships between models at the requirements and design levels. We provide conditions for checking validity of these relationships both syntactically and semantically. We show how our algorithm utilizes the relationships between models at different levels to localize the regions that should be modified. We use the IBM Trade 6 case study to demonstrate our approach.

Replications play an important role in verifying empirical results. In this paper, we discuss our experiences performing a literal replication of a human subjects experiment that examined the relationship between a simple test for consistent use of mental models, and success in an introductory programming course. We encountered many difficulties in achieving comparability with the original experiment, due to a series of apparently minor differences in context. Based on this experience, we discuss the relative merits of replication, and suggest that, for some human subjects studies, literal replication may not be the the most effective strategy for validating the results of previous studies.

Model-based development involves construction, integration, and maintenance of complex models. One of the key problems in model-based development is composing a set of distributed models into a single seamless model. In this paper we propose a declarative approach for model composition, which augments and strengthens existing structural and heuristic approaches. In our approach, the desired model compositions are constrained by a set of declarative properties, which drive the merge process. Only model compositions that satisfy the specified properties and, possibly, additional model composition restrictions are automatically generated and presented to the model analyst for a review and further modifications. Since our framework is iterative, properties and restrictions can be reviewed and refined as well. We illustrate our ideas by defining a proof-of-concept prototype implementation of the declarative model composition framework using the Alloy Analyzer.

We present TReMer+, a tool for consistency checking of distributed models (i.e., models developed by distributed teams). TReMer+ works by first constructing a merged model before checking consis-tency. This enables a flexible way of verifying global consistency properties that is not possible with other existing tools.

Software development involves the creation and use of many related models yet there are few tools that address the issue of how to work with and manage such collections of models, or "multimodels." We propose a formal multimodeling framework that allows specialized model relationship types to be defined on existing types of models and provides a new type of model with a formal semantics called a macromodel. Macromodels can be used to enhance multimodel development, comprehension, consistency management and evolution. A preliminary evaluation of the framework is done using a detailed example from the telecommunications domain.

We introduce an extractive approach to building a product line's requirements assets. We define the functional requirements profiles (FRPs) according to the linguistic characterization of a domain's action-oriented concerns, and show that FRPs can be extracted from a document based on domain-aware lexical affinities that bear a 'verb - direct object' relation. The validated FRPs are then amenable to semantic case analysis so as to uncover the variation structures. Finally, merging FRPs helps discover the requirements interdependencies. We use orthogonal variability modeling to represent the product line's external variability and constraints. We apply our approach to an auto-marker product line. The study shows our approach complements domain analysis by quickly offering insights into system functionalities and product line variabilities.

We propose an on-demand clustering framework for analyzing the functional requirements in a product line. Our approach is novel in that the objects to be clustered capture the domain's action themes at a primitive level, and the essential attributes are uncovered via semantic analysis. We provide automatic support to complement domain analysis by quickly identifying important entities and functionalities. A second contribution is our recognition of stakeholders' different goals in cluster analysis, e.g., feature identification for users versus system decomposition for designers. We thus advance the literature by examining requirements clusters that overlap and those causing a minimal information loss, and by facilitating the discovery of product line variabilities. A proof-of-concept example is presented to show the applicability and usefulness of our approach.

If designers of modelling languages want their creations to be used in real software projects, the communication qualities of their languages need to be evaluated, and their proposals must evolve as a result of these evaluations. A key quality of communication artifacts is their comprehensibility. We present a flexible framework to evaluate the comprehensibility of model representations that is grounded on the underlying theory of the language to be evaluated, and on theoretical frameworks in cognitive science.

Model Management addresses the problem of managing an evolving collection of models, by capturing the relationships between models and providing well-defined operators to manipulate them. In this paper, we describe two such operators for manipulating hierarchical Statecharts: Match, for finding correspondences between models, and Merge, for combining models with respect to known correspondences between them. Our Match operator is heuristic, making use of both static and behavioural properties of the models to improve the accuracy of matching. Our Merge operator preserves the hierarchical structure of the input models, and handles differences in behaviour through parameterization. In this way, we automatically construct merges that preserve the semantics of Statecharts models. We illustrate and evaluate our work by applying our operators to AT&T telecommunication features.

A key problem in model-based development is merging a set of distributed models into a single seamless model. To merge a set of models, we need to know how they are related. In this position paper, we discuss the methodological aspects of describing the relationships between models. We argue that relationships between models should be treated as first-class artifacts in the merge problem and propose a general framework for model merging based on this argument. We illustrate the usefulness of our framework by instantiating it to the state-machine modelling domain and developing a flexible tool for merging state-machines.

This full day tutorial introduces the use of empirical methods appropriate to research in automated software engineering. Using a blend of lecture and discussion, it aims to provide ASE researchers and practitioners with a foundation for conducting and critiquing empirical studies. The tutorial covers of the principal methods applicable to ASE: controlled experiments, quasi-experiments, case studies, survey research, ethnographies, and action research and relates these methods to relevant metatheories in the philosophy and sociology of science. The tutorial presents techniques applicable to each of the steps of a research project, including formulating research questions, theory building, data analysis (using both qualitative and quantitative methods), building evidence, assessing validity, and publishing. The tutorial is relevant for researchers, who will be able to conduct and write more credible empirical studies; for reviewers who will be able to provide qualified judgments of papers; and for practitioners, who will be able to more effectively interpret published results within the context of their own organizations

Small companies form a large part of the software industry, but have mostly been overlooked by the requirements engineering research community. We know very little about the techniques these companies use to elicit and track requirements and about their contexts of operations. This paper presents preliminary results from an ongoing exploratory case study of requirements management in seven small companies, which found that (a) successful small companies exhibit a huge diversity of requirements practices that work well enough for their contexts; (b) these companies display strong cultural cohesion; (c) the principal of the company tends to retain control of the requirements processes long after other tasks have been delegated; and (d) the evidence rejects the simplistic view of a current "software crisis", as requirements errors for these companies, though problematic, are rarely catastrophic. We develop a number of hypotheses to explain these findings.

Requirements elicitation involves the construction of large sets of conceptual models. An important step in the analysis of these models is checking their consistency. Existing research largely focuses on checking consistency of individual models and of relationships between pairs of models. However, such strategy does not guarantee global consistency. In this paper, we propose a consistency checking approach that addresses this problem for homogeneous models. Given a set of models and a set of relationships between them, our approach works by first constructing a merged model and then verifying this model against the consistency constraints of interest. By keeping proper traceability information, consistency diagnostics obtained over the merge are projected back to the original models and their relationships. The paper also presents a set of reusable expressions for defining consistency constraints in conceptual modelling. We demonstrate the use of the developed expressions in the specification of consistency rules for class and ER diagrams, and i* goal models.

Aspects promote a clear separation of concerns so that tangled and scattered concerns are modularized throughout software development. We propose a framework to trace aspects identified during goal-oriented requirements analysis to code and testing. Two types of checks are performed to validate the resulting system in light of stakeholders' crosscutting concerns. One ensures that systems with and without aspects have the same functionality defined by the hard goals. The other checks whether the weaved system with aspects indeed improves system qualities in terms of the degree of softgoal satisfaction. We demonstrate the approach using an open-source e-commerce platform.

The topic of this full-day tutorial was the correct use and interpretation of case studies as an empirical research method. Using an equal blend of lecture and discussion, it gave attendees a foundation for conducting, reviewing, and reading case studies. There were lessons for software engineers as researchers who conduct and report case studies, reviewers who evaluate papers, and practitioners who are attempting to apply results from papers. The main resource for the course was the book Case Study Research: Design and Methods by Robert K. Yin. This text was supplemented with positive and negative examples from the literature.

Terminological interference occurs in requirements engineering when stakeholders vary in the concepts they use to understand a problem domain, and the terms they use to describe those concepts. This paper investigates the use of Kelly's Repertory Grid Technique (RGT) to explore stakeholders' varying interpretations of the labels attached to softgoals in a goal model. We associate softgoals with stakeholders' personal constructs, and use the tasks that contribute to these goals as elements that stakeholders can rate using their constructs. By structurally exchanging grids data among stakeholders, we can compare their conceptual and terminological structures, and gain insights into relationships between problem domain concepts.

Software merging is a common and essential activity during the lifespan of large-scale software systems. Traditional textual merge techniques are inadequate for detecting syntactic merge conflicts. In this paper, we propose a domain-independent approach for syntactic software merging that exploits the graph-based structure(s) of programs. We use morphisms between fuzzy graphs to capture the relationships between the structural elements of the programs to be merged, and apply a truth ordering lattice to express inconsistencies and evolutionary properties as we compute the merge. We demonstrate the approach with a three-way consolidation merge in a commercial software system; in particular, we show how analyzing merged call structures can help developers gain a better understanding and control of software evolution.

Interviews with stakeholders can be a useful method for identifying user needs and establishing requirements. However, interviews are also problematic. They are time consuming and may result in insufficient, irrelevant or invalid data. Our goal is to re-examine the methodology of interview design, to determine how various contextual factors affect the success of interviews in requirements engineering. We present a case study of a Web conferencing system used by a support group for spousal caregivers of people with dementia. Two sets of interviews were conducted to identify requirements for a new version of the system. Both sets of interviews had the same information elicitation goals, but each used different interview tactics. A comparison of the participants' responses to each format offers insights into the relationship between the interview context and the relative success of each interview technique for eliciting the desired information. As a result of what we learned, we propose a framework to help analysts design interviews and chose tactics based on the context of the elicitation process. We call this the contextual risk analysis framework.

The use of viewpoints has long been proposed as a technique to structure evolving requirements models. In theory, viewpoints should provide better stakeholder traceability, and the ability to discover important requirements by comparing viewpoints. However, this theory has never been tested empirically. This paper reports on an exploratory case study of a key hypothesis of the viewpoints theory, namely that by creating separate viewpoint models to represent different stakeholder contributions, and explicitly merging them, important hidden requirements can be discovered. The case study compared two modelling teams using the i* notation to capture requirements for new Web-based counselling services for a large charitable organisation. One team used viewpoints; the other did not. The conclusions include that viewpoint merging improves the understanding of the problem domain, but is very time consuming. The process of merging was more important than the merged product. The study also indicates a need for better model management tools, as both teams encountered difficulty in managing large, evolving models.

We investigate the personalization capabilities of common personal software systems. We use a typical e-mail client as an example of such a system, and examine the configuration screens it offers to its users. We discover that each configuration value reflects each of the ways with which the user goals can be satisfied. Thus, we construct a goal model in which alternative ways for satisfying high level goals are matched with alternative system configurations. This way, automatic configuration of the system by reasoning about the overlaying goal model can be achieved. We find that the vast majority of the configuration options that refer to system functionality can be configured using this method, facilitating thereby the personalization tasks for users with no technical background, and ensuring, at the same time, consistency and meaningfulness in the configuration result.

View merging, also called view integration, is a key problem in conceptual modeling. Large models are often constructed and accessed by manipulating individual views, but it is important to be able to consolidate a set of views to gain a unified perspective, to understand interactions between views, or to perform various types of end-to-end analysis. View merging is complicated by inconsistency of views. Once views are merged, it is useful to be able to trace the elements of the merged view back to their sources. In this paper, we propose a framework for merging incomplete and inconsistent graph-based views. We introduce a formalism, called annotated graphs, which incorporates a systematic annotation scheme capable of modeling incompleteness and inconsistency as well as providing a built-in mechanism for stakeholder traceability. We show how structure-preserving maps can capture the relationships between disparate views modeled as annotated graphs, and provide a general algorithm for merging views with arbitrary interconnections. We use the i* modeling language (Yu, 1997) as an example to demonstrate how our approach can be applied to existing graph-based modeling languages.

View merging is an important activity in any conceptual modeling language. It is often desirable to combine a set of views to gain a unified perspective, to test hypotheses about how views are related, or to perform various types of analysis. A major challenge for view merging is toleration of incompleteness and inconsistency: views may be inconclusive, and may have conflicts over the concepts being modeled or how they are structured. Drawing on the theory developed in our earlier work (2003), we present a view merging tool, called iVuBlender, that allows for explicit modeling of incompleteness and inconsistency and provides a framework for interconnecting and merging incomplete and inconsistent views.

Anchoring and adjustment is a form of cognitive bias that affects judgments under uncertainty. If given an initial answer, the respondent seems to use this as an 'anchor', adjusting it to reach a more plausible answer, even if the anchor is obviously incorrect. The adjustment is frequently insufficient and so the final answer is biased. In this paper, we report a study to investigate the effects of this phenomenon on software estimation processes. The results show that anchoring and adjustment does occur in software estimation, and can significantly change the resulting estimates, no matter what estimation technique is used. The results also suggest that, considering the magnitude of this bias, software estimators tend to be too confident of their own estimations.

The topic of this paper was the correct use and interpretation of case studies as an empirical research method. Using an equal blend of lecture and discussion, it gave a foundation for conducting, reviewing, and reading case studies. There were lessons for software engineers as researchers who conduct and report case studies, reviewers who evaluate papers, and practitioners who are attempting to apply results from papers. The main resource for the course was the book Case Study Research: Design and Methods by Robert K. Yin. This text was supplemented with positive and negative examples from the literature.

This paper describes our multi-valued symbolic model-checker XChek. XChek is a generalization of an existing symbolic model-checking algorithm for a multi-valued extension of the temporal logic CTL. Multi-valued model-checking supports reasoning with values other than just TRUE and FALSE.

Benchmarks have been used in computer science to compare the performance of computer systems, information retrieval algorithms, databases, and many other technologies. The creation and widespread use of a benchmark within a research area is frequently accompanied by rapid technical progress and community building. These observations have led us to formulate a theory of benchmarking within scientific disciplines. Based on this theory, we challenge software engineering research to become more scientific and cohesive by working as a community to define benchmarks. In support of this challenge, we present a case study of the reverse engineering community, where we have successfully used benchmarks to advance the state of research.

Eliciting the requirements for a proposed system typically involves different stakeholders with different expertise, responsibilities, and perspectives. Viewpoints-based approaches have been proposed as a way to manage incomplete and inconsistent models gathered from multiple sources. In this paper, we propose a category-theoretical framework for the analysis of fuzzy viewpoints. Informally, a fuzzy viewpoint is graph in which the elements of a lattice are used to specify the amount of knowledge available about the details of nodes and edges. By defining an appropriate notion of morphism between fuzzy viewpoints, we construct categories of fuzzy viewpoints and prove that these categories are (finitely) complete. We then show how colimits can be employed to merge the viewpoints and detect the inconsistencies that arise independent of any particular choice of viewpoint semantics. We illustrate an application of the framework through a case-study showing how fuzzy viewpoints can serve as a requirements elicitation tool in reactive systems.

This article introduces the concept of multi-valued model-checking and describes a multi-valued symbolic model-checker, ΧChek. Multi-valued model-checking is a generalization of classical model-checking, useful for analyzing models that contain uncertainty (lack of essential information) or inconsistency (contradictory information, often occurring when information is gathered from multiple sources). Multi-valued logics support the explicit modeling of uncertainty and disagreement by providing additional truth values in the logic.This article provides a theoretical basis for multi-valued model-checking and discusses some of its applications. A companion article [Chechik et al. 2002b] describes implementation issues in detail. The model-checker works for any member of a large class of multi-valued logics. Our modeling language is based on a generalization of Kripke structures, where both atomic propositions and transitions between states may take any of the truth values of a given multi-valued logic. Properties are expressed in ΧCTL, our multi-valued extension of the temporal logic CTL.We define the class of logics, present the theory of multi-valued sets and multi-valued relations used in our model-checking algorithm, and define the multi-valued extensions of CTL and Kripke structures. We explore the relationship between ΧCTL and CTL, and provide a symbolic model-checking algorithm for ΧCTL. We also address the use of fairness in multi-valued model-checking. Finally, we discuss some applications of the multi-valued model-checking approach.

In requirements elicitation, different stakeholders often hold different views of how a proposed system should behave, resulting in inconsistencies between their descriptions. Consensus may not be needed for every detail, but it can be hard to determine whether a particular disagreement affects the critical properties of the system. We describe the Xbel framework for merging and reasoning about multiple, inconsistent state machine models. Xbel permits the analyst to choose how to combine information from the multiple viewpoints, where each viewpoint is described using an underlying multi-valued logic. The different values of our logics typically represent different levels of agreement. Our multi-valued model checker, Xchek, allows us to check the merged model against properties expressed in a temporal logic. The resulting framework can be used as an exploration tool to support requirements negotiation, by determining what properties are preserved for various combinations of inconsistent viewpoints.

No abstract available.

Multiple viewpoints are often used in Requirements Engineering to facilitate traceability to stakeholders, to structure the requirements process, and to provide richer modelling by incorporating multiple conflicting descriptions. In the latter case, the need to reason with inconsistent models introduces considerable extra complexity. This paper describes an empirical study of the utility of multiple world reasoning (using abduction) for domain modelling. In the study we used a range of different models (ranging from correct to very incorrect), different fanouts, different amounts of data available from the domain, and different modelling primitives for representing time. In the experiments there was no significant change in the expressive power of models that incorporate multiple conflicting viewpoints. Whilst this does not negate the advantages of viewpoints during requirements elicitation, it does suggest some limits to the utility of viewpoints during requirements modelling. 1. Int...

This paper describes a feasibility study into the use of a formal requirements modeling method (SCR) to assist with independent verification and validation of change requests for space shuttle flight software. The goal of the study was to determine whether a formal modeling technique could automate some of the manual analysis tasks performed on change requests, including consistency checking. To analyze the change request, the key part of the original functionality was modeled in SCR. The model was then updated to reflect the proposed changes. Tool support was used to perform consistency checking and to validate the model against domain properties. The study showed that as an analysis tool, formal modeling offers some advantages over inspection-based approaches. However, the problem of analyzing change requests is sufficiently different from other requirements modeling tasks that some specialist tools will be needed. The paper ends with a discussion of the demands of these needs.

Structure is important in large specifications for understanding, testing and managing change. Category theory has been explored as framework for providing this structure, and has been successfully used to compose specifications. This work has typically adopted a "correct-by-construction" approach: components are specified, proved correct and then composed together in such a way as to preserve their properties. However, in a large project, it is desirable to be able to mix specification and composition steps such that, at any particular moment in the process, we may have established only some of the properties of the components and some of the composition relations. In this paper, we propose adaptations to the categorical framework in order to manage evolving specifications. We demonstrate the utility of the framework on the analysis of a part of a software change request for the Space Shuttle.

The paper describes three case studies in the lightweight application of formal methods to requirements modeling for spacecraft fault protection systems. The case studies differ from previously reported applications of formal methods in that formal methods were applied very early in the requirements engineering process to validate the evolving requirements. The results were fed back into the projects to improve the informal specifications. For each case study, we describe what methods were applied, how they were applied, how much effort was involved, and what the findings were. In all three cases, formal methods enhanced the existing verification and validation processes by testing key properties of the evolving requirements and helping to identify weaknesses. We conclude that the benefits gained from early modeling of unstable requirements more than outweigh the effort needed to maintain multiple representations.

This paper describes our work exploring the suitability of formal specification methods for independent verification and validation (IV&V) of software specifications for large, safety critical systems. An IV&V contractor often has to perform rapid analysis on incomplete specifications, with no control over how those specifications are represented. Lightweight formal methods show significant promise in this context, as they offer a way of uncovering major errors, without the burden of full proofs of correctness. We describe an experiment in the application of the method SCR to testing for consistency properties of a partial model of the requirements for fault detection isolation and recovery on the space station. We conclude that the insights gained from formalizing a specification is valuable, and it is the process of formalization, rather than the end product that is important. It was only necessary to build enough of the formal model to test the properties in which we were interested. Maintenance of fidelity between multiple representations of the same requirements (as they evolve) is still a problem, and deserves further study.

In an evolving specification, considerable effort is spent handling recurrent inconsistencies. Detecting and resolving inconsistencies is only part of the problem: a resolved inconsistency might not stay resolved. Frameworks in which inconsistency is tolerated help by allowing resolution to be delayed. However, evolution of a specification may affect both resolved and unresolved inconsistencies. We address these problems by explicitly recording relationships between partial specifications (ViewPoints), representing both resolved and unresolved inconsistencies. We assume that ViewPoints will often be inconsistent with one another, and we ensure that a complete work record is kept, detailing any inconsistencies that have been detected, and what actions, if any, have been taken to resolve them. The work record is then used to reason about the effects of subsequent changes to ViewPoints, without constraining the development process.

It is shown how domain modelling can be used within requirements engineering to reveal the conceptual models used by the participants, and relate these to one another. Existing elicitation techniques used in AI adopt a purely cognitive stance, in that they model a single problem-cognitive stance, and ignore the social and organizational context. A framework for representing alternative, conflicting viewpoints in a single domain model is described. The framework is based on the development of a hierarchy of viewpoint descriptions, where lower levels of the hierarchy contain the conflicts. The hierarchies can be viewed in a number of ways, and allow the participants to develop an understanding of each other's perspective. The framework is supported by a set of tools for developing and manipulating these hierarchies.>