AQCLab is a laboratory for software and data quality evaluation in conformance to the ISO/IEC 25000 series of standards. As such, requirements are a fundamental element in the evaluations that are carried out, as they are the input for software Functional Suitability and Data Quality, two of the types of evaluation carried out by the laboratory. Software Maintainability evaluations are also carried out by the laboratory, where the requirements on applicable metrics and thresholds to be met have been established by the laboratory.Furthermore, the laboratory's personnel possess considerable expertise in the domain of auditing software lifecycle processes, which has enabled them to observe how requirements are managed in multiple companies.In this article, we present the experience of AQCLab over the years, in the capacity of software product and data quality evaluators and software development process auditors, with regard to the manner in which our clients manage and define requirements. This has led us to the realization that these practices are often neglected.

In an era dominated by technological integration, Artificial Intelligence (AI) is pivotal across various sectors, driving significant advancements and demanding robust quality measures for its implementations. This paper introduces a novel AI maturity assessment framework designed in alignment with International Standards provided by ISO (International Organization for Standardization) and IEC (International Electrotechnical Commission), specifically with the ISO/IEC 33000 family of standards for process assessment. Our framework aims to provide AI system developers with a structured tool for continuous improvement of their development processes, thereby enhancing the reliability and efficacy of AI applications. To demonstrate the applicability of our proposed framework, we have validated it through a case study in the automotive sector. Specifically, the framework was employed to assess and enhance an AI project to develop a mechanism to determine vehicle behavior from sensor data within the constraints of onboard devices. Our findings identify key improvement points contributing to the iterative enhancement of AI system quality in engineering applications.

ABSTRACT Software development has a relevant human side, and this could, for example, imply that developers' feelings have an impact on certain aspects of software development such as quality, productivity, or performance. This paper explores the effects of toxic emotions on code quality and presents the SentiQ tool, which gathers and analyzes sentiments from commit messages (obtained from GitHub) and code quality measures (obtained from SonarQube). The SentiQ tool we proposed performs a sentiment analysis (based on natural language processing techniques) and relates the results to the code quality measures. The datasets extracted are then used as the basis on which to conduct a preliminary case study, which demonstrates that there is a relationship between toxic comments and code quality that may affect the quality of the whole software project. This has resulted in the drafting of a predictive model to validate the correlation of the impact of toxic comments on code quality. The main implication of this work is that these results could, in the future, make it possible to estimate code quality as a function of developers' toxic comments.

Abstract Quantum computing is gaining an increasing interest since it can solve certain problems exponentially faster than classical computing. Thus, many organizations are researching and launching investments for integrating quantum software into their existing systems. Software modernization (as based on Model-Driven Engineering) has been proposed to migrate from/to the so-called hybrid software systems, which integrate classical and quantum software. In that process, both, reverse engineering and restructuring phases, have already been investigated. However, forward engineering phase for generating hybrid source code from high-level design models has not yet been addressed. Thus, this research proposes a quantum code generation technique from extended UML design models. It consists of a set of Model-to-Text transformations (defined through Epsilon Generation Language) to generate both Python and Qiskit code, which, respectively, integrate classical and quantum code. The transformation has been validated through a multi-case study with 7 hybrid software systems modeled in UML, which demonstrated that the transformation is effective and efficient. The implication of this work is that the software modernization process for hybrid software systems can be completed by tackling forward engineering phase, and that Model-Driven Engineering can therefore globally facilitate industry adoption of quantum software.

ABSTRACT Background Quantum Computing (QC) represents a disruptive paradigm in computing, with significant implications across various domains such as medicine, logistics, chemistry, and defense. However, quantum software development—the discipline that enables the exploitation of QC's potential—faces considerable challenges due to the inherent complexity of quantum mechanics. Objective This work aims to facilitate the systematic development of quantum software by introducing a method aligned with classical software engineering principles, particularly the analysis and synthesis phases, through the automated generation and optimization of quantum circuit components. Methods The proposed approach focuses on the automated generation of quantum circuit components whose behavior can be formally described using truth tables. To this end, (i) a set of algorithms for the automatic generation of components is introduced, (ii) an optimization algorithm is developed to improve the efficiency of the generated components, and (iii) an automated support system is provided, allowing users to specify truth tables through multiple modeling strategies. Results The resulting system enables a structured and automated process for building reusable quantum circuit components, reducing manual effort and supporting higher abstraction levels in quantum programming. The design of the system adheres to foundational principles of Software Engineering, including agnosticism and automatic code generation. Conclusions This proposal contributes to quantum software development by providing a practical, engineering‐driven methodology for generating and optimizing quantum circuit components, thereby improving the efficiency, scalability, and accessibility of quantum programming practices.

As quantum computers advance, the complexity of the software they can execute increases as well. To ensure this software is efficient, maintainable, reusable, and cost-effective—key qualities of any industry-grade software—mature software engineering practices must be applied throughout its design, development, and operation. However, the significant differences between classical and quantum software make it challenging to directly apply classical software engineering methods to quantum systems. This challenge has led to the emergence of Quantum Software Engineering (QSE) as a distinct field within the broader software engineering landscape. In this work, a group of active researchers analyze in depth the current state of QSE research. From this analysis, the key areas of QSE are identified and explored in order to determine the most relevant open challenges that should be addressed in the next years. These challenges help identify necessary breakthroughs and future research directions for advancing QSE.

Quantum computing is a young discipline that specializes in the construction of hardware and software using the quantum properties of nature, to solve problems of higher complexity that classical computing cannot address, in multiple business areas. The most important computing revolution of the last 60 years has begun because of the integration of classical computing, quantum computing and artificial intelligence. In this paper, we present a pragmatic survey of the main quantum computing areas, focusing in particular on software and the need for real Quantum Software Engineering (QSE) to produce quantum software with sufficient quality and productivity, which is the fundamental axis for the diffusion of quantum computing.

This paper introduces a strategy for identifying design patterns in quantum circuits. The foundation of this approach relies on using the information procured from both the segmentation and the analysis of these circuits as primary data. The approach of the methodology is based on the novel interpretation of quantum circuit components through the lens of an automaton. Additionally, the method entails the generation of input symbols for this finite automaton. The symbols are derived from the matching process between design patterns and components of quantum circuits. Two tool prototypes, QPainter and QCDPDTool, have been developed to represent quantum circuits graphically and automatically detect quantum patterns. Using them, the primary reasoning process is carried out by an automaton that can manage representations of quantum circuit components. A suite of experiments on a set of quantum circuit sequences reveals promising results and offers empirical support for our approach. Furthermore, we explore how these experimental findings can be leveraged to improve the efficacy of design pattern identification in quantum circuits.

This is the “quantum decade” when quantum computers are proving to be more useful for some types of processing than their classical counterparts. The solutions of the future will combine classical IT with quantum algorithms and applications. However, there is very little work that addresses this issue. Each manufacturer provides specific tools for their products, which makes integration between quantum and classical systems a costly and time-consuming process. We believe that we should follow good software engineering principles and best practices to build platforms and tools that insulate software and systems engineers from implementation details and provide them with adequate support. In this paper we propose qSOA® as a mechanism for the dynamic integration of hybrid (quantum/classical) software systems and present in detail an SDK for Python. qSOA® provides a set of well-defined functions with which a classical system can access quantum products as if they were a piece of classical software, accessing the use case and not its complexities. In addition to some examples that illustrates its operation in real cases, we present the evaluation of qSOA® by 200 quantum software developers in a workshop in collaboration with AWS Braket.

Abstract DevOps has emerged as a practical approach to the interaction between development and operations. This approach has been extended to the interaction with business functions, generating the term BizDevOps. Although many proposals and tools support BizDevOps from a technical viewpoint, there has been no significant improvement in management aspects, such as evaluating the practices and processes involved in the area. This paper presents two case studies on the assessment of BizDevOps practices using MMBDO (Maturity Model for BizDevOps), a maturity model for BizDevOps based on international ICT standards. The case studies were conducted in two organizations with different profiles: a large multinational ICT company with a unit specialized in providing DevOps to the rest of the company and a small software development company that implements DevOps practices as part of its development system. The evidence we obtained in the case studies supports the adequacy of MMBDO for assessing the maturity of BizDevOps in real companies. Also, the combination of the two case studies supports the adequacy of the model for being used in companies with different sizes and levels of maturity. MMBDO is an adequate proposal for assessing the maturity of BizDevOps in software organizations and a suitable tool for process improvement.

Abstract Blockchain is a cross‐cutting technology allowing interactions among untrusted entities in a distributed manner without the need for involving a trusted third party. Smart contracts (i.e., programs running on the blockchain) enabled organizations to envision and implement solutions to real‐world problems in less cost and time. Given the immutability of blockchain and the lack of best practices for properly designing and developing smart contracts, it is crucial to assure smart contract quality before deployment. With the help of an exploratory survey involving developers and researchers, this paper identifies the practices and tools used to develop, implement, and evaluate smart contracts. The survey received 55 valid responses. Such responses indicate that (i) inefficiencies may occur during the development cycle of a smart contract, especially regarding requirements specification, design, and testing phases, and (ii) the lack of a shared standard to evaluate the functional quality of implemented smart contracts. To start coping with these issues, the adoption of functional suitability assessment measures recommended by the ISO/IEC 25000 standard, widely used in software engineering, is proposed by adapting them to the context of smart contracts. Through some examples, the manuscript also illustrates how to measure the functional completeness and correctness of smart contracts. The proposed procedure to measure smart contract functional suitability brings advantages to both developers and users of decentralized finance or non‐fungible tokens platforms, data marketplaces, or shipping and real estate services, just to mention a few. In particular, it helps (i) better outline the responsibilities of smart contracts, (ii) uncover errors and deficiencies of smart contracts in the early stages, and (iii) ensure that the established requirements are met.

Abstract Quantum computing is expected to exponentially outperform classic computing on a broad set of problems, including encryption, machine learning, and simulations. It has an impact yet to explore on all software lifecycle's processes and techniques. Testing quantum software raises a significant number of challenges due to the unique properties of quantum physics—such as superposition and entanglementand the stochastic behavior of quantum systems. It is, therefore, an open research issue. In this work, we offer a systematic mapping study of quantum software testing engineering, presenting a comprehensive view of the current state of the art. The main identified trends in testing techniques are (1) the statistic approaches based on repeated measurements and (2) the use of Hoare‐like logics to reason about software correctness. Another relevant line of research is reversible circuit testing, which is partially applicable to quantum software unitary testing. Finally, we have observed a flourishing of secondary studies and frameworks supporting testing processes from 2018 onwards.

Data quality evaluation is built upon data quality measurement results. “Data quality evaluation” uses the “data quality rules” representing the risk appetite of the organization to decide on the usability of the data; “data quality measurement” uses the business rules describing the “data requirements” or “data specifications” to determine the validity of the data. Consequently, to conduct meaningful and useful data quality evaluations, business rules must be first completely identified and captured at the beginning of the evaluation to perform sound measurements. We propose that the evaluation leads to better and more interpretable and useful results when the potential contribution of these business rules to the measurement of the data quality characteristics is first evaluated, avoiding the inclusion in the evaluation of those not having potential contribution and the resulting waste of resources. Considering this, we feel that for a better management of business rules for data quality evaluation, it makes sense to group all business rules having an important contribution to the evaluation of data quality characteristics, something that other business rules management methodologies have not covered yet. Through our experiences in conducting industrial projects of data quality evaluations we identified six problems when collecting and grouping the business rules. These problems make data quality evaluation processes less efficient and more costly. The main contribution of this paper is a methodology to systematically collect, group and validate the business rules to avoid or to alleviate these problems. For the sake of generalization, comparability, and reusability, we propose to do the grouping for data quality characteristics and properties defined in ISO/IEC 25012 and ISO/IEC 25024, respectively. Lastly, we validate the methodology in three case studies of real projects. From this validation, it is possible to raise the conclusion that the methodology is useful, applicable in the real world, and valid to capture and group the business rules used as a basis for data quality evaluation.

Sustainability is not a trend; more and more areas of knowledge defend it and apply it among their main characteristics. The area of Information Technology (IT) has not been left behind and, through the so-called Green IT, advocates for a more sustainable environment. Organizations around the world are realizing that Green IT is an important asset that produces great benefits at ecological, social, and economic level. For this reason, we have developed a revised version of the “Governance and Management Framework for Green IT”. With this new version we intend to offer a more complete and solid guide that helps organizations to gradually implement, assess, and improve those characteristics of governance and management that are the basis of the processes and practices of Green IT. This proposal has been empirically validated through a case study and the results obtained demonstrate the validity, usefulness, and applicability of the framework for organizations.

Enterprise architecture has become an important driver to facilitate digital transformation in companies, since it allows to manage IT and business in a holistic and integrated manner by establishing connections among technology concerns and strategical/motivational ones. Enterprise architecture modelling is critical to accurately represent business and their IT assets in combination. This modelling is important when companies start to manage their enterprise architecture, but also when it is remodelled so that the enterprise architecture is realigned in a changing world. Enterprise architecture is commonly modelled by few experts in a manual way, which is error-prone and time-consuming and makes continuous realignment difficult. In contrast, other enterprise architecture modelling proposal automatically analyses some artefacts like source code, databases, services, etc. Previous automated modelling proposals focus on the analysis of individual artefacts with isolated transformations toward ArchiMate or other enterprise architecture notations and/or frameworks. We propose the usage of Knowledge Discovery Metamodel (KDM) to represent all the intermediate information retrieved from information systems' artefacts, which is then transformed into ArchiMate models. Thus, the core contribution of this paper is the model transformation between KDM and ArchiMate metamodels. The main implication of this proposal is that ArchiMate models are automatically generated from a common knowledge repository. Thereby, the relationships between different-nature artefacts can be exploited to get more complete and accurate enterprise architecture representations.

Abstract Quantum computing has experienced a breakthrough. Several companies are taking up the challenge of designing and manufacturing quantum computers, and the supply of tools for quantum software development is growing all the time. This article addresses quantum software development toolkits and introduces the ‘QuantumPath’ platform. In developing QuantumPath, our aim is to fulfil certain principles such as: agnosticism, extensibility, integration, independency, optimisation, scalability, security, usability and software engineering support. This article presents both the architecture itself as well as the main tools that compose QuantumPath, in order to illustrate the support which platform provides to the development and execution of quantum software.

Abstract Quantum computing is now a reality, and its incomparable computational power has led companies to show a great interest in being able to work with quantum software in order to support part of their current and future business operations. However, the quantum computing paradigm differs significantly from its classical counterparts, which has brought about the need to revolutionise how the future software is designed, built, and operated in order to work with quantum computers. Since companies cannot discard all their current (and probably mission-critical) information systems, they must adapt their classical information systems to new specific quantum applications, thus evolving towards hybrid information systems. Unfortunately, there are no specific methods with which to deal with this challenge. We believe that reengineering, and more specifically, software modernisation using model-driven engineering principles, could be useful as regard migrating classical systems and existing quantum programs towards hybrid information systems. This paper, therefore, presents QRev, a reverse engineering tool that analyses quantum programs developed in Q# in order to identify its components and interrelationships, and then generates abstract models that can be used in software modernisation processes. The platform-independent models are generated according to the Knowledge Discovery Metamodel (KDM) standard. QRev is validated in a case study involving five quantum programs in order to demonstrate its effectiveness and scalability. The main implication of the study is that QRev can be used in order to attain KDM models, which can subsequently be employed to restructure or add new quantum functionality at a higher abstraction level, i.e. independently of the specific quantum technology.

In order to improve and sustain their competitiveness over time, organisations nowadays need to undertake different initiatives to adopt frameworks, models and standards that will allow them to align and improve their business processes. In spite of these efforts, organisations may still encounter governance and management problems. This is whereRisk Management (RM)can play a major role, since its purpose is to contribute to the creation and preservation of value in the context of the organisation's processes. RM is a complex and subjective activity that requires experience and a high level of knowledge about risks, and it is for this reason that standardisation institutions and researchers have made great efforts to define initiatives to overcome these challenges. However, the RM field nevertheless presents a lack of uniformity in its terms and concepts, due to the different contexts and scopes of application, a situation that can generate ambiguities and misunderstandings. To address these issues, this paper aims to present an ontology calledSRMO (Software Risk Management Ontology), which seeks to unify the terms and concepts associated with RM and provide an integrated and holistic view of risk. In doing so, the Pipeline framework has been applied in order to assure and verify the quality of the proposed ontology, and it has been implemented in Protégé and validated by means of competency questions. Three application scenarios of this ontology demonstrating their usefulness in the software engineering field are presented in this paper. We believe that this ontology can be useful for organisations that are interested in: (i) establishing an RM strategy from an integrated approach, (ii) defining the elements that help to identify risks and the criteria that support decision-making in risk assessment, and (iii) helping the involved stakeholders during the process of risk management.

Together with many success stories, promises such as the increase in production speed and the improvement in stakeholders’ collaboration have contributed to making agile a transformation in the software industry in which many companies want to take part. However, driven either by a natural and expected evolution or by contextual factors that challenge the adoption of agile methods as prescribed by their creator(s), software processes in practice mutate into hybrids over time. Are these still agile? In this article, we investigate the question: what makes a software development method agile? We present an empirical study grounded in a large-scale international survey that aims to identify software development methods and practices that improve or tame agility. Based on 556 data points, we analyze the perceived degree of agility in the implementation of standard project disciplines and its relation to used development methods and practices. Our findings suggest that only a small number of participants operate their projects in a purely traditional or agile manner (under 15 percent). That said, most project disciplines and most practices show a clear trend towards increasing degrees of agility. Compared to the methods used to develop software, the selection of practices has a stronger effect on the degree of agility of a given discipline. Finally, there are no methods or practices that explicitly guarantee or prevent agility. We conclude that agility cannot be defined solely at the process level. Additional factors need to be taken into account when trying to implement or improve agility in a software company. Finally, we discuss the field of software process-related research in the light of our findings and present a roadmap for future research.

Technical Debt management is an important aspect in the training of Software Engineering students. In this paper we study the effect of two assessment strategies in an educational context: One based on penalisation, the other based on rewards. Both are applied to assignments where the students develop a project focusing on keeping a low technical debt level, and obtaining a high quality code. We describe the design, tools and context of the strategies applied. SonarQube, a tool commonly used in production environments, is used for measuring the metrics. The penalisation strategy is based on a SonarQube quality gate. The reward strategy is based on a contest, where an automatic judge tool is devised to provide an online leaderboard with a classification based on the SonarQube metrics. An empirical study is conducted to determine which of the strategies works better to help the students/trainees keep the Technical Debt low. Statistically significant results are obtained in 5 of the 8 analysed metrics, showing that the reward strategy works much better. The effect size of the executed statistical tests is analysed, resulting in medium and large effect size in the majority of the analysed metrics.

Abstract In the context of digital transformation, companies are increasingly forced to develop, manage and continually align IT and business. Companies have found in Enterprise Architecture (EA) a valuable tool to represent and manage IT and business in a holistic way by establishing connections among technology concerns and business/strategical/motivational ones. EA modelling is one of the most critical tasks in this context to represent accurate models that make the difference in the decision‐making and governance processes of the company. In most of the cases, EA models are manually defined by experts which is usually error‐prone and time‐consuming. Thus, the constant business and IT realignment through manual modelling becomes complex and expensive. This research presents ArchiRev, an extensible reverse engineering method that automate the extraction of EA models (using ArchiMate language) by analysing different information systems artefacts. This proposal has been validated through an industrial case study in the context of a C#‐based system of an Italian ship refurbishment company. The study has demonstrated the effectiveness (based in the opinion of some business experts) and efficiency of the method. The main implication is that EA modelling can be accelerated, whereas subjectivity and errors introduced by experts might be reduced.

A Software Process Line (SPrL) is potentially suitable for constructing software development methodologies by reusing core assets. However, adopting this approach without prior assessment of its suitability can lead to failure. The aim of this paper is to identify a set of requirements that can be used for deciding whether to adopt the SPrL approach in an organization. Identification of the requirements was accomplished in two stages: the characteristics important in method tailoring were first identified via a Systematic Mapping Study (SMS) that focused on analyzing 43 primary studies; the degree of importance of the identified characteristics was then determined using a questionnaire survey in which 31 experts participated. By analyzing the results of the SMS and the survey, we have identified 12 product-related, 22 project-related, and 10 organization-related requirements. In addition to these requirements, we have also identified two relevant requirements by studying previous research on Software Product Lines (SPL) and Business Process Lines (BPL). The requirements thus identified can help organizations decide on whether to adopt the SPrL approach: the more an organization satisfies the requirements, the more frequently method tailoring occurs in that organization, and hence, the more justified it is to adopt the SPrL approach.

Abstract Global software development (GSD) has become a rising software development model in the last few years. Although much research has been performed in terms of GSD management, GSD governance research is scarce at the present time and presents multiple challenges that need to be addressed. In this paper, a systematic mapping study has been conducted, the aim of which was to discover the main issues dealt with in GSD governance literature, as well as to point out the particular research gaps that are still present in this domain. This allowed us to find out new challenges to be addressed, along with possible solutions to these. The results reveal a lack of research in key aspects such as tools, culture, people, and information, all of which provides a great opportunity for future approaches while also highlighting new opportunities in GSD governance research.

Sustainability is a problem that is increasingly worrying organisations around the world, which has led them to adopt sustainable practices in their processes. From the point of view of one of the areas that have had the greatest impact in recent times in organisations, the area of information technology (IT), different sustainable practices have arisen in isolation, known as Green IT practices. So, a framework that organises and establishes these practices (until now isolated) is necessary in order to implement, assess, and improve the Green IT in organisations in an efficient, gradual, and integrated way. In this study, the authors propose a maturity model based on capability maturity model integration (CMMI), through which it is intended to help organisations gradually implement and improve through different levels of maturity, the governance and management of Green IT. The validations of this proposal carried out through experts and practical cases demonstrate the usefulness of this proposal when implementing, assessing, and improving the Green IT in organisations.

Abstract Code cloning can seriously affect software quality. Code clones are various fragments of syntactically or semantically equivalent code. Some authors argue that code clones have a negative impact on maintainability and understandability, since clones propagate defects and make it mandatory to pay attention to several copies. However, other authors believe clones are not necessarily bad, since self‐admitted clones favor system stability and allow developers to move projects forward. Although some root causes and effects of cloning have been widely studied, there is not much relevant work analyzing how certain projects context factors impact on code cloning. This work presents an empirical validation of six open source projects by considering certain factors from Git repositories measured throughout a total of 70 releases for the 6 systems. The factors analyzed were the number of commits and committers per release, the average size of the commits and the size of the system in each release. The main conclusion obtained from the study is that, while the number of commits and committers and the system size do not significantly affect cloning, larger commits lead to a higher cloning ratio. These insights contribute to predicting and preventing code cloning, thus enabling a software quality improvement.

The successful execution of a Business Process implies to use data with an adequate level of quality, thereby enabling the output of processes to be obtained in accordance with users requirements. The necessity to be aware of the data quality in the business processes is known, but the problem is how the incorporation of data quality management can affect and increase the complexity of the software development that supports the business process life-cycle. In order to gain advantages that data quality management can provide, organizations need to introduce mechanisms aimed at checking whether data satisfies the established data-quality requirements. Desirably, the implementation, deployment and use of these mechanisms should not interfere into the regular working of the business processes. In order to enable this independence, we propose the PAIS-DQ framework as an extension of the classical Process-Aware Information System (PAIS) proposal. The PAIS-DQ addresses the concerns related to data quality management activities by minimizing the required time for the software developers. In addition, with the aim of guiding developers in the use of PAIS-DQ, a methodology has been also provided to facilitate organizations to deal with complex concerns. The methodology renders our proposal applicable in practice, and has been applied to a case study where a service architecture implementing the standard ISO/IEC 8000-100:2009 parts 100 to 140 is included.

Quality demands on current and future software systems need to address diverse quality characteristics considered important for the diversity of stakeholders. Dealing with software quality may require achieving a balance between relevant quality characteristics. Current literature shows that software organizations barely handle them. However, the lack of management of these interactions may be a causal factor in failed projects. In this paper, we present a process for monitoring interactions between quality requirements based on an interaction model of quality characteristics. This process is part of the SQIMF framework and supports the identification and characterization of the interactions between quality requirements. An exploratory case study was conducted in order to understand the factors that could influence the interactions that occur.

The installation of Intelligent Pavement (IPavement) in cities highlights the obvious need for the development of software services that can be offered by this technology. These services should be developed in conformance with international quality standards such as ISO/IEC 25000, which make it possible to give assurance that the services must established quality requirements. This paper therefore presents the environment for the quality certification of the services developed for the IPavement, created by the authors. This environment is formed by an assessment process, a quality model, and set of assessment tools. The results of a case study carried out to evaluate the quality of a service developed for IPavement are also set out; this study has tested the practical application of the environment created and has proven the need to develop tools to assist in the evaluation of the quality IPavement services.

Context: One of the chief challenges of Global Software Development (GSD) is for globally, culturally and linguistically diverse team members to communicate effectively. Failing to meet this challenge can lead to misunderstandings that impede project success. To prepare practitioners for remote and diverse forms of communication we have developed VENTURE: a simulation-based training platform that aims to increase cultural awareness.

Context: A Serious Game (SG) is a game for purposes other than entertainment [12]. SGs are currently in widespread use and their popularity has begun to steadily increase; their application areas now extend not only to education, but also to military, health and corporate [9] [12] sectors. SGs are of vital importance at present, as they can be a means to achieve relevant goals from both a personal and an institutional point of view. This may take place in fields as diverse as defense, education, scientific exploration, health care, emergency management, city planning, engineering, religion, and politics. The number of users of these systems grows each day, signifying that their impact is very high, and it is precisely for this reason that more extensive research on SG quality is needed.

Improving a particular quality characteristic in a software product may have a negative impact on the others. The literature shows that few organizations handle interactions between quality characteristics; this neglect may be a causal factor in failed projects. That led us to propose a process framework to support organizations that want to manage the interactions between quality characteristics. In this paper, we present the methods that may be used when the process framework is deployed. The methods were extracted from a published mapping study on software quality trade-offs. They were classified with regard to the particular context facet addressed and the specific decision-making approach used. Our contribution is a set of methods to manage interaction between quality characteristics, organized into a software process framework.

The evaluation of educational approaches is frequently challenging as it involves humans and requires the consideration of several angles depending on the educational objectives. On occasions, these objectives involve academic and industrial environments, thus implying additional challenges. Education in Global Software Development (GSD) has recently became important for companies that offer GSD training in specific GSD areas such as cultural, linguistic, leadership, negotiation or communication skills. We have developed a training framework based on simulation with the aim of providing GSD interaction training. This framework addresses various kinds of problems related to communication barriers. However, discovering the needs and requirements of both academia and industry is a key success factor when seeking an effective educational solution. This paper presents a multi-phased methodology that has been employed to: 1) research the training requirements in the field; 2) design the training framework based on these findings; 3) evaluate the adequacy of the framework using an Expert Feedback study and a subsequent Heuristic Evaluation; 4) prove that the framework can actually generate learning; 5) conduct a market-focused study to evaluate the commercial options of the framework and 6) define future work to fulfil commercial requirements and improve effectiveness.

Universities are starting to offer courses in Global Software Development (GSD) as a way to prepare future practitioners for challenges found in organizational settings. Companies also provide GSD training especially to new recruits who might lack skills in how to effectively communicate with people from different cultures and different first languages. However this training is costly and not necessarily tailored to the specific needs of the organization or individual practitioner. With a focus on GSD education, we have developed a training framework based on simulation that addresses different kinds of GSD problems. The framework allows course leaders to design training scenarios to fit their precise needs for improved communication and cultural awareness. This paper presents a market-focused study aimed at discovering the requirements for a commercial GSD education tool. We studied the market options, identified key stakeholders, and conducted interviews with senior managers from three multinational companies. The study helped us to gain a deeper understanding of current training trends, needs and gaps according to key stakeholders. Finally, outcomes provided us with directions for future tool development. Results indicate that industry find cultural differences a more pressing problem than linguistic differences. Although industry tends to use traditional (classroom based) training methods for raising cultural awareness, they perceive that interaction simulation is a viable alternative. Performance and potential cost savings are key drivers for commercialising prototype tools. Conducting market-focussed research can help to ensure our future research is relevant, and meets the needs of industry.

Simulation has been applied in several Software Engineering fields, and is shown to be a useful method in industrial training. As part of our research work, we have used simulation to provide training in Global Software Development (GSD). We have developed a platform to strengthen GSD skills by simulating realistic settings in which learners interact with Virtual Agents of differing cultures. Thus, learners will experience multi-cultural problems and will develop specific GSD communication skills. The development of these skills must, however, be accurately assessed, bearing in mind that the training is aimed at learners with different characteristics and skills. In this paper we present an assessment process based on educational theory adapted to our simulation-based training environment. Methods to minimize the instructors' effort and tailor the assessment to specific training needs are proposed. The assessment process has been evaluated by 34 potential users. Results indicate that the assessment method yields meaningful results and proof of learning. Also that automated assessment can be achieved with minimal intervention from the instructor. Though tailored for GSD, this method could be applied to other domains, in both industry and academia.

Reverse engineering of business process enables business process to be discovered and retrieved from existing information systems, which embed many business rules that are not available anywhere else. These techniques are especially useful when business process models are unavailable, outdated, or misaligned because of uncontrolled maintenance. Reverse engineering techniques obtain well-designed business processes, but these are often retrieved with harmful quality faults as a consequence of the abstraction. Clustering techniques are then applied to reduce these quality faults and improve the understandability and modifiability of business process models. Regrettably, the most challenging concern is how to determine the similarity between two business activities to be clustered. Formal ontologies help to represent the essential concepts and constraints of a universe of discourse and determine the similarity in accordance with the given ontology. This paper shows how to compute and use the ontology-based similarity within a clustering algorithm whose aim is to improve the quality of business process models previously obtained from legacy information systems by reverse engineering. The principal contribution of this paper is the usage of an ontology-based similarity function and its application to 43 business process models retrieved from four real-life information systems. Copyright © 2014 John Wiley & Sons, Ltd.

Software maintenance is recognized as an important knowledge area within the most common international curricula in software engineering. Despite this fact, and its importance in the industry, software maintenance and supporting techniques such as reengineering are hardly ever taught in practical lessons. This paper presents a reengineering teaching experience conducted during two last years in lab sessions by using reverse engineering and code generation tools. The experience was carried out by merging traditional methods (such as teaching lessons) with a practical exercise in laboratory. The teaching-learning process was qualitative- and quantitatively assessed by comparing results between an initial and final evaluation, as well as between the experiences conducted during two last years with different syllabus of courses. In fact, the effect of the experience in both syllabi proved to be effective. The reported results show that students do not know reengineering as a software maintenance technique although their satisfaction with the experience was high or very high (62%) or medium (30%). The key learned lessons are that students recognized the usage of reengineering tools as very convenient for their performance as future practitioners and the need to devote additional time in classroom to learn such tools.

Global Software Development (GSD) is set to be the paradigm that will support software industries in the increasingly globalized 21st century. It opens the door to companies from emerging countries to compete for their own gap in the market. It does, however, still bring some challenges with it. It must integrate different cultures, work styles, and work timetables in the same development process. In fact, GSD methodologies do indeed include specific activities to coordinate different work teams, but they fail precisely where any other methodology does: in the need to be truly useful by meeting the distinct cultural requirements of every organization involved, all at the same time. Up to now, process tailoring has been managed through variability mechanisms. Since these successfully merge original structure with cultural assets, they are also useful for adjusting global methodologies so that they suit each particular development context. This paper presents a case study of the use of the Variant-Rich Process paradigm (VRP) to support tailoring in a GSD methodology. It reveals the suitability of the VRP mechanisms, given that they support the two tailoring dimensions a GSD project involves, i.e., they take into account the circumstances of the entire global project, as well as the need to fit the internal characteristics of each organization; furthermore, they save effort in the tailoring process.

Concept location is a key activity during software modernization since it allows maintainers to exactly determine what pieces of source code support a specific concept. Real-world business processes and information systems providing operational IT support for respective processes can be misaligned as a consequence of uncontrolled maintenance over time. When concepts supported by an information system are getting outdated or misaligned, concept location becomes a time-consuming and error-prone task. Moreover, enterprise information systems (which implement business processes) embed significant business knowledge over time that is neither present nor documented anywhere else. To support the evolution of existing information systems, the embedded knowledge must first be retrieved and depicted in up-to-date business process models and then be mapped to the source code. This paper addresses this issue through a concept location approach that considers business activities as the key concept to be located and discovers different partial business process views for each piece of source code. Thus, the concept location problem becomes the problem of extracting such views. This approach follows model-driven development principles and an automatic model transformation is implemented to facilitate its adoption. Moreover, a case study involving two real-life information system demonstrates its feasibility.

Business process modeling is recognized as a key part of the business process lifecycle. It is during this stage that a conceptual model is produced by collecting business process requirements and representing them with a specific business process notation. While there has been much research into process modeling techniques, little has taken place with regard to the characteristics that should be considered for an effective assessment of the models' quality. This paper presents a synthesis of quality characteristics for business process models, based on a systematic review of the relevant literature. It then goes on to describe a reference model for the quality assessment of business process models, and to relate the aforementioned quality characteristics to existing relevant process model measures. These relations may help organizations to guide the improvement of their business process models according to their chosen quality characteristics.

ABSTRACT Databases are considered to be a valuable asset for organizations because they contain all those organizations’ persistent pieces of data. Both databases and the information systems that use them undergo erosion as a consequence of uncontrolled maintenance over time. However, when information systems evolve to become modernized versions of them, existing databases must not be discarded because they contain much valuable business knowledge that is not present anywhere else. Some of the software industry's current demands, such as time‐to‐market developments and the provision of software as services entail additional challenges in the reuse of legacy systems during software modernization. This paper addresses this problem and proposes a reengineering process that follows model‐driven development principles to recover Web services from legacy databases. The Web services that are mined manage access to legacy databases without discarding them. Legacy databases can thus be used by modernized information systems in service‐oriented environments. The adoption of this process is facilitated by the implementation of a support tool, which is used to conduct an industrial case study involving a real‐life legacy database. The study demonstrates that the proposal reduces development efforts and improves the return of investment by extending the lifespan of legacy databases. Copyright © 2012 John Wiley & Sons, Ltd.

SUMMARY This paper tackles the need for universities and practitioners to train their students and engineers in the new challenges that global software development entails, which are principally related to communication, collaboration and cultural differences. Teaching the necessary skills requires practical experience. However, training in educational environments is difficult, and some challenging issues must still be confronted. We have focused our work on the development of a virtual training environment that can simulate global software development scenarios involving virtual agents (VAs) from different cultures. The VAs interact with learners, who use typical communication tools to solve predefined problems. This environment considers common problems caused by distance and cultural differences when using English as a means of communication. It allows learners to train at any time, because the VAs are always available, and it also permits them to play different roles in the various stages of the project. In this paper, we depict the design and development of the tool, as well as an initial evaluation. Copyright © 2011 John Wiley & Sons, Ltd.

SUMMARY Software maintenance is an important, indeed vital, activity for software companies. For many organizations, including small firms, it is also a business opportunity. In the quest to help companies of this type, for whom strengthening their maintenance process is a chief concern, we present Agile_MANTEMA. This is a methodological proposal for software maintenance, one which focuses on small companies. The methodology defines an agile maintenance strategy, setting out in detail what is to be carried out, when, how and by whom; that is to say, it seeks to give a detailed guide for the implementation of the maintenance process in these kinds of companies. Agile_MANTEMA also establishes a set of elements, such as types of maintenance, service levels and capability levels, which aim to: (i) handle the complexity that is inherent to the maintenance process and (ii) allow a small company to define its own maintenance process, taking into account its particular characteristics and needs. In an effort to improve their maintenance process, two small firms conducted an improvement project in which Agile_MANTEMA was used. The experiences reported by these companies tell us that this methodology offers a strategy that can be useful, practical and suitable for small companies as they tackle software maintenance. Copyright © 2011 John Wiley & Sons, Ltd.

SUMMARY Business processes have become one of the key assets of organization, since these processes allow them to discover and control what occurs in their environments, with information systems automating most of an organization's processes. Unfortunately, and as a result of uncontrolled maintenance, information systems age over time until it is necessary to replace them with new and modernized systems. However, while systems are aging, meaningful business knowledge that is not present in any of the organization's other assets gradually becomes embedded in them. The preservation of this knowledge through the recovery of the underlying business processes is, therefore, a critical problem. This paper provides, as a solution to the aforementioned problem, a model‐driven procedure for recovering business processes from legacy information systems. The procedure proposes a set of models at different abstraction levels, along with the model transformations between them. The paper also provides a supporting tool, which facilitates its adoption. Moreover, a real‐life case study concerning an e‐government system applies the proposed recovery procedure to validate its effectiveness and efficiency. The case study was carried out by following a formal protocol to improve its rigor and replicability. Copyright © 2011 John Wiley & Sons, Ltd.

Business process mining is a powerful tool to retrieve the valuable business knowledge embedded in existing information systems. The effectiveness of this kind of proposal is usually evaluated using recall and precision, which respectively measure the completeness and exactness of the retrieved business processes. Since the effectiveness assessment of business process mining is a difficult and error-prone activity, the main hypothesis of this work studies the possibility of obtaining thresholds to determine when recall and precision values are appropriate. The business process mining technique under study is MARBLE, a model-driven framework to retrieve business processes from existing information systems. The Bender method was applied to obtain the thresholds of the recall and precision measures. The experimental data used as input were obtained from a set of 44 business processes retrieved with MARBLE through a family of case studies carried out over the last two years. The study provides thresholds for recall and precision measures, which facilitates the interpretation of their values by means of five linguistic labels that range from low to very high. As a result, recall must be high (with at least a medium precision above 0.56), and precision must also be high (with at least a low recall of 0.70) to ensure that business processes were recovered (by using MARBLE) with an effectiveness value above 0.65. The thresholds allowed us to ascertain with more confidence whether MARBLE can effectively mine business processes from existing information systems. In addition, the provided results can be used as reference values to compare MARBLE with other similar business process mining techniques.

There are many companies doing software development in a distributed way nowadays, due to the great benefits that it provides, however, this type of development also leads to multiple complications such as deteriorated communications. Among the most widespread methodologies for software development is the Rational Unified Process (RUP). However, in recent decades a series of methodologies have emerged, called "agile methodologies", which aim to develop software quickly, focusing on people and frequent delivery of software. Of the existing agile methodologies, Scrum is one of the most widely-applied, due to its ability to complement other methods and processes. For this reason, the strategies proposed by Scrum may be suitable for the distributed management and deployment of the phases and disciplines of RUP. In this paper we present a methodology based on the integration of RUP and Scrum, called scRumUP, which has been so designed as to be appropriate in a distributed environment.

Modernization of legacy information systems is usually triggered by the need of introducing new business requirements or due to the technology obsolescence. During modernization software projects, there exists a lot of business knowledge that was embedded in source code owing to progressive maintenance, which is not present anywhere else. In order to preserve embedded business knowledge this paper presents MARBLE, a tool to recover business processes from legacy information systems. MARBLE provides an extensible framework, thus it is developed as an Eclipse™ plugin to ensure its future extension. So far, MARBLE supports Java-based system and focuses mainly on legacy source code. To facilitate its adoption in the industry, MARBLE has been applied in some real-life modernization projects, which demonstrated that MARBLE is suitable to retrieve business processes and facilitated its continuous improvement to reach an appropriate maturity level.

In this paper we propose an educational framework for designing training courses which focus specifically on the problems entailed in Global Software Development (GSD). The main issues involved are related to cultural, language and communication problems. The principal element of the framework is VENTURE; a virtual training tool that enables learners to get immersed in realistic GSD scenarios. Using this tool, learners will come face to face with collaborative, organizational and technical problems of GSD by interacting with virtual participants in a simulation of people working together from locations that are distant from each other. By means of this framework we also establish the theoretical contents and procedures which would customize the courses for use in university settings or Master programs. We therefore consider that VENTURE is a suitable platform for developing the students' skills in GSD and we believe that it will allow them to deal with real-world problems, thereby minimizing the effort and costs involved in course design.

The quality of conceptual models directly affects the quality of the understanding of the application domain and the quality of the final software products that are ultimately based on them. This paper describes a systematic literature review (SLR) of peer-reviewed conference and journal articles published from 1997 through 2009 on the quality of conceptual models written in UML, undertaken to understand the state-of-the-art, and then identify any gaps in current research. Six digital libraries were searched, and 266 papers dealing specifically with the quality of UML models were identified and classified into five dimensions: type of model quality, type of evidence, type of research result, type of diagram, and research goal. The results indicate that most research focuses on semantic quality, with relatively little on semantic completeness; as such, this research examines new modeling methods vs. quality frameworks and metrics, as well as quality assurance vs. understanding quality issues. The results also indicate that more empirical research is needed to develop a theoretical understanding of conceptual model quality. The classification scheme developed in this paper can serve as a guide for both researchers and practitioners.

The information society is becoming increasingly dependent on systems for managing and analyzing the risk to which its main information assets are exposed and having access to these systems has become vital for the evolution of SMEs. However, this type of company requires the systems to be adapted to their special characteristics and to be optimized from the point of view of resources required to set them up and maintain them. This article presents a proposed method for carrying out risk analysis adaptation, which is suitable for SMEs, set within the framework of the methodology for security management in small and medium-sized enterprises (MSM2-SME). This model is being applied directly to real cases, and therefore its application is constantly being improved.

Global Software Development (GSD) is a recent trend that allows team members to be located on different remote sites, thus forming a network of virtual teams working on the same projects which confront the typical problems caused by distance. The stakeholders involved in the project must be trained to deal with communication difficulties such as those related to cultural and language differences or the appropriate use of groupware tools when English is used as the lingua franca. We present a simulator which allows universities and companies to train students or inexpert engineers in the new challenges introduced by GSD, thus avoiding the problems that this activity entails in real settings. Our proposal places non-native English speakers in predefined virtual GSD scenarios in which they will interact with virtual agents of different cultures that play different roles in the project.

A framework (methods and tool) for training and developing skills needs in global software development.

In recent years, the evolution of Global Software Development (GSD) has grown both rapidly and significantly, and although the efficiency of this new type of development has been proven, some challenging issues must still be confronted. Of all these, our research line is focused on designing the specific training that members of virtual teams must receive. Universities and companies therefore need to design training schemas to deal with the specifics of GSD, which are principally related to communication difficulties and time and cultural differences. In this work we present the findings of a Systematic Literature Review in the field of GSD training and teaching. Our intention is twofold: on the one hand we wish to discover the existing strategies and proposals available up to the present day, and on the other hand we wish to identify the open challenges, that will be helpful for practitioners and researchers in the future.

The current challenges in Global Software Development (GSD) necessitate support from software tools with special features. In this work, we explain which features are desirable for these tools in the context of GSD and how these features are related to the principal challenges in this environment. We shall therefore present a survey of the tools that provide these features. The tools included in the survey were classified through the use of the ISO/IEC 12207 standard processes to determine which process is supported by each tool. A classification of the tools according to their features is also included, in which the specific features of each tool are shown.

Abstract ISO has recently published Part 7 of the ISO/IEC 15504 standard, with the aim of determining the extent to which an organization consistently implements processes that contribute to achievement of its business goals. This new Part 7 of ISO/IEC 15504 has addressed issues related to the assessment of organizational maturity, as the CMMI‐DEV model also does. Recently, growing interest has been shown towards the need to harmonize different improvement models or standards, thereby presenting an integrated vision about them. All this being so and in an effort to offer information on how the maturity levels described in these two models are related, we have carried out the harmonization of these two models. It is based, firstly, on a mapping between processes of ISO 12207:08 and process areas of CMMI‐DEV, and in second place, on a matching between processes of ISO 12207:08 and ISO 15504‐5. For this work, we have taken into account the latest versions of the models, and defined a suitable process to carry out the mapping in a systematic way. We established differences and similarities between the maturity levels (and their processes) described in these models, our goal being to support organizations which are interested in tackling organizational maturity. Copyright © 2009 John Wiley & Sons, Ltd.

Information security is a crucial aspect for enterprises that has to be considered as a strong requirement from the early stages of the development process and Data Warehouses (DWs) manage highly important information used to make strategic decisions which has to be protected from unauthorized users. In order to develop secure DWs we have proposed a Model Driven Architecture (MDA) composed of several secure metamodels at different abstraction levels and transformations between them. Lately, a specialization of this architecture considering a multidimensional approach towards On-Line Analytical Processing (OLAP) tools has been defined, but the support to automatically transform complex security rules has not been dealt with so far. This paper analyzes this lack and defines improvements in our metamodels and a set of transformations between models in order to fulfill our MDA approach.

Data Warehouses (DWs) manage crucial information for enterprises which must be protected from unauthorized accesses. The question of which security issues are present in all stages of the DW design is therefore of great importance when considering these security constraints in design decisions. We have used the Model Driven Architecture (MDA) approach to propose an MDA architecture with which to develop secure DWs, which defines secure models at different abstraction levels along with their automatic transformation between models. Our approach considers a multidimensional path towards On-Line Analytical Processing (OLAP) tools, but did not, until now, support the transformation of complex security rules from conceptual models. After carrying out a modification of our conceptual metamodel to support a better representation of security rules and to define several sets of transformation rules, this paper shows how to transform these security rules through an example.

Security and requirements engineering are one of the most important factor of success in the development of a software product line due to the complexity and extensive nature of them, given that a weakness in security can cause problems throughout all the products of a product line. However, without a CARE (Computer-Aided Requirements Engineering) tool, the application of any security requirements engineering process or methodology is much more difficult because it has to be manually performed. Therefore, in this paper, we will present a prototype of SREPPLineTool, which provides automated support to facilitate the application of the security quality requirements engineering process for software product lines, SREPPLine. SREPPLineTool simplifies the management of security requirements in product lines by providing us with a guided, systematic and intuitive way to deal with them from the early phases of product lines development, simplifying the management and the visualization of the artefacts variability and traceability links and the integration of the security standards, as well as the management of the security reference model proposed by SREPPLine. Finally we shall illustrate the application of SREPPLineTool by describing a simple example as a preliminary validation of it

Global software development projects deal with a variety of challenges, particularly those concerning communication and language differences. Bearing this in mind, processes that are crucially based on communication, such as requirements elicitation, must be specially rethought to minimize critical situations. Since effective communication would help to reduce misunderstandings among stakeholders, and therefore help to achieve more committed requirements, we propose a framework for global requirements elicitation focused on minimizing the most frequent problems in GSD. Both the proposal and the preliminary results of a controlled experiment are presented in this paper.

Improving communication and knowledge sharing are the main challenges in global software development projects. Since stakeholders in such environments must communicate by means of groupware tools, our research focuses on analyzing peoplepsilas preferences, according to their cognitive characteristics, in order to discover behaviour patterns that will help us to define the best choice for them. In this paper we present a methodology for groupware selection for a given group of people, along with some preliminary results of a controlled experiment.

This paper presents a recommendation algorithm with which to recommend Knowledge Objects within a Community of Practice (CoP). It is based on a trust model that takes into account not only previous experience of a Knowledge Source, but also the position of the respective member in the community, along with that member's level of expertise. Furthermore, the system attempts to emulate the principle of human intuition. The combination of these factors, which can be adjusted by means of weight factors, enables the system to make decisions based on a calculated trust value even if a new member is introduced into the community or the entire community is newly created. To demonstrate the capabilities of this algorithm, a tool employing a multi-agent architecture has been developed which is also presented.

At present, the quality of software artefacts is an increasing concern for software development organizations. It is widely acknowledged that the quality of the software product that is finally implemented is influenced to an enormous extent by the quality of software artefacts (commonly models) that are produced throughout the software development process. Quality assessment and assurance techniques must therefore be applied from the early development stages onwards. The quality of the models is gaining even more relevance with the appearance of the Model Driven Development Model paradigm, which consists in the production of software as successive transformations of models. Although some methodologies for evaluating the quality of software artefacts do exist, all of them are isolated proposals, which focus on specific artefacts and apply specific assessment techniques. There is no generic and flexible methodology that allows the quality assessment of any kind of software artefact, regardless of type, much less a tool that supports it. When tackling this problem in this paper, we propose an integrated environment called “CQA-ENV”, consisting of a) Methodology for the continuous quality assessment of software artefacts, based on the ISO 14598 standard and other relevant proposals, 2) A set of tools that supports such methodology, which is composed of a vertical tool (CQA-Tool) that supports the methodology, along with several specific tools for the assessment of the different software artefacts. Current evaluation tools will also be able to be plugged into this generic tool. Moreover, the CQA-Tool provides a capacity for building a catalogue of assessment techniques that integrates available assessment techniques (e.g. metrics, checklists, modelling conventions, guidelines, etc.) for each software artefact. CQA-ENV can also be used by companies that offer software quality assessment services, especially for clients who are software development organisations, outsourcing software construction, thus obtaining an independent quality evaluation of the software products they acquire. Software development organisations that perform their own evaluation will be able to use it as well.

Knowledge is a key asset in software engineering. Facilitating access to the knowledge that software engineers require for the task at hand can therefore bring many benefits. To accomplish this, it is important to understand how knowledge flows through the organization, to identify problems that may hinder a suitable flow, and to define strategies with which to address them. Process modeling has proved to be a useful technique for analyzing knowledge flows. Traditional process modeling languages do not, however, provide primitives to explicitly represent the knowledge involved in the processes within the models. In this paper, we illustrate how the Software Process Engineering Metamodel (SPEM) can be adapted, to be used as a process modeling language for analyzing knowledge flows in software processes. We have extended SPEM to represent knowledge and its sources in process models in an explicit way. We also discuss the experiences obtained from using this extension in a software organization and the lesson we have learned from it.

Abstract Although powerful, mutation is a computationally very expensive testing technique. In fact, its three main stages (mutant generation, mutant execution and result analysis) require many resources to be successfully accomplished. Thus, researchers have made important efforts to reduce its costs. This paper represents an additional effort in this sense. It describes the results of two experiments in which, by means of combining the original set of mutants and therefore obtaining a new set of mutants—each one with two faults—the number of mutants used is reduced to half. Results lead to believe that mutant combination does not decrease the quality of the test suite, whereas it supposes important savings in mutant execution and result analysis. Copyright © 2008 John Wiley & Sons, Ltd.

Data Warehouses (DW) manage historical information for the decision making process and for enterprises, it is vitally important to consider security requirements from the earliest stages of the development process. OLAP tools are the most used tools for implementing and consulting DWs and it is necessary to define security measures to avoid that users can access unauthorized information by executing queries. We have created a MDA architecture for developing secure DW and in this paper, we will propose how to implement the security measures defined at upper abstraction levels using our approach into SQL Server Analysis Services 2008.

The use of ontologies for representing knowledge provides us with organization, communication and reusability. Information security is a serious requirement which must be carefully considered. Concepts and relations managed by any scientific community need to be formally defined and ontological engineering supports their definition. In this paper, the method of systematic review is applied with the purpose of identifying, extracting and analyzing the main proposals for security ontologies. The main identified proposals are compared using a formal framework and we conclude by stating their early state of development and the need of additional research efforts.

Software product line engineering has proven to be one of the most successful paradigms for developing a diversity of similar software applications and software-intensive systems at low costs, in short time, and with high quality, by exploiting commonalities and variabilities among products to achieve high levels of reuse. At the same time, due to the complexity and extensive nature of product line development, security and requirements engineering are critical success factors in the development of a software product line. However, most of the current product line practices in requirements engineering do not adequately address the security requirements engineering. Therefore, in this paper we will propose a security requirements decision model driven by security standards along with a security variability model to manage the variability of the security requirements related artefacts. The aim of this approach is to deal with security requirements from the early stages of the product line development in a systematic way, in order to facilitate the conformance to the most relevant security standards with regard to the management of security requirements, such as ISO/IEC 27001 and ISO/IEC 15408.

Mobile Grid, in relevance to both Grid and Mobile Computing, is a full inheritor of Grid with the additional feature of supporting mobile users and resources in a seamless, transparent, secure and efficient way. Security of these systems, due to their distributed and open nature, receives great interest. A formal approach to security in the software life cycle is essential to protect corporate resources. However, little thought has been given to this aspect of software development. Due to its criticality, security should be integrated as a formal approach in the software life cycle. A methodology of development for secure mobile Grid computing based systems is defined, that is to say, an engineering process that defines the steps to follow so that starting from the necessities to solve, we can design and construct a secure Grid system with support for mobile devices that is able to solve and cover these necessities.

Data warehouse (DW) systems integrate data from heterogeneous sources and are used by decision makers to analyze the status and the development of an organization. Traditionally, requirement analysis approaches for DWs have focused purely on information needs of decision makers, without considering other kinds of requirements such as security or performance. But modeling these issues in the early stages of the development is a cornerstone for building a DW that satisfies user expectations. In this paper, we define the two kinds of requirements for data warehousing as information and quality-of-service requirements and combine them in a comprehensive approach based on MDA (model driven architecture). This allows a separation of concerns to model requirements without losing the connection between information and quality-of-service, also in the following conceptual or logical design stages. Finally, in this paper, we introduce a security requirement model for data warehousing, and a three-step process for modeling security requirements, thus illustrating the applicability of our approach with an example.

The need for an explicit common terminology within Empirical Software Engineering (an ESE-Glossary of terms) was highlighted in the ISERN 2007 meeting [2]. The goal was to define a glossary of terms related to ESE based on an initial glossary published in http://lens-ese.cos.ufrj.br/wikiese. This initial glossary was built manually, based on expert knowledge. However, owing to the dynamic nature of the research works in ESE, this glossary must be dynamically updated with information extracted from the relevant documents in the research domain. Automation is, therefore, mandatory. We propose a text mining technique for the automatic extraction of the most relevant terms used in ESE documents. Our technique also provides the relationships between terms, with the degree of affinity between them. Our approach could, therefore, be useful in the improvement of the initial glossary of terms and in discovering relationships between terms.

The requirements elicitation process is that which is the most critical in software development. For this reason it is necessary to train professionals in the skills needed to confront this process. Traditionally this has not been an easy task and with the arrival of new paradigms such as Global Software Development (GSD) it has become more difficult. It thus becomes necessary to rely on new methods and tools which should support this process in a GSD environment. In this work we outline the characteristics of a simulator for the education and training of global requirements engineering and indicate the competences that this simulator would allow us to develop.

The majority of the current product line practices in requirements engineering do not adequately address security requirements engineering despite the fact that security requirements engineering is both a central task and a critical success factor in product line development due to the complexity and extensive nature of product lines. Therefore, our contribution is to present and to demonstrate the applicability of our proposed security quality requirements engineering process (SREPPLine), which is based on a security requirements decision model driven by security standards along with a security variability model. We shall demonstrate our proposal by describing part of a real case study as a preliminary validation of these models. The final aim of this approach is to deal with security requirements variability from the early stages of the product line development in a systematic way, in order to facilitate conformance of the products with the most relevant security standards with regard to the management of security requirements, such as ISO/IEC 27001 and ISO/IEC 15408

In this paper we summarize a study to define the competencies that a GSD engineer should have in order to face the problems of working with people of different customs and using technology to communicate.

Abstract In recent years, the Internet has experienced a boom as an information source. The use of search engines is the most common way of finding this information. This means that less visible contents (for search engines) are increasingly difficult or even almost impossible to find. Thus, Web users are forced to accept alternative services or contents only because they are visible and offered to users by search engines. If a company's Web site is not visible, that company is losing clients. Therefore, it is fundamental to assure that one's Web site will be indexed and, consequently, visible to as many Web users as possible. To quantitatively evaluate the visibility of a Web site, this article introduces a method that Web administrators may use. The method consists of four activities and several tasks. Most of the tasks are accompanied by a set of defined measures that can help the Web administrator determine where the Web design is failing (from the positioning point of view). Some tools that can be used for the determination of the measure values also are referenced in the description of the method. The method is furthermore accompanied by examples to help in understanding how to apply it.

Data warehouses (DWs) store historical and aggregated information, extracted from multiple heterogeneous, autonomous and distributed sources of information, therefore it is essential to specify security measures from early stages of DW design and to enforce them. Several proposals on DW development have arisen in the last couple of years. However, few approaches represent security measures in the DW conceptual model starting from early stages of development of a DW project. In addition, these security measures cannot be automatically represented at logical level, so heuristic design guides for such transformations have appeared. This paper presents a framework based on model driven architecture (MDA) for the development of secure data warehouses that covers all the phases of design (conceptual, logical and physical) and embeds security measures in all of them. Moreover, transformations between models are clearly and formally established by using query/view/transformation (QVT), to obtain consequently a traceability of the security rules from the early stages of development to the final implementation

Security represents a crucial aspect in the development of data warehouses (DWs), since they contain confidential data. It becomes therefore necessary to specify security and audit requirements for the multidimensional modelling, that cannot be directly transferred to the relational model of the DW. The standard framework for software development model driven architecture (MDA) allows us to define transformations between models by proposing query/view/transformations (QVT). This proposal allows the definition of formal, elegant and unequivocal transformations between platform independent model (PIM) and platform specific model (PSM). This paper employs QVT to establish a set of relations that allows us to transform security information embedded in the DWs multidimensional conceptual model to a relational logical scheme

Security is a crucial aspect for the development of data warehouses (DW) because they contain sensitive information. The application of the model driven architecture (MDA) in the secure modeling of DWs allows obtaining the secure logical scheme from the conceptual model. In this paper, we apply the query/view/transformations (QVT) language to the development of a secure DW by means of a case study. First, we introduce the case study related to a typical sanitary system. Afterwards, with the application of a set of QVT relations, we transform all the captured security and audit requirements from the multidimensional conceptual model of the DW, to the logical level, by means of the construction of a snowflake model. From this scheme it turns out easier to obtain code for a specific platform that implements security and audit aspects

In this paper, we briefly introduce a controlled experiment to investigate the selection of alternative transformation rules through which to obtain UML class diagrams from a Requirements Model. The main goal of this experiment was to determine which of the transformation rules for structural relationships between classes (association (Al), aggregation (A2) and association class (A3)) produces the UML class diagram that is easiest to understand. More details about the transformations and about the experiment are provided. We focus upon the understandability of UML class diagrams because it is well recognized that if a model is easier to understand it will be easier to maintain, reuse, etc.

Data Warehouses (DW), Multidimensional (MD) databases, and On-Line Analytical Processing (OLAP) applications provide companies with many years of historical information for the decision-making process. Owing to the relevant information managed by these systems, they should provide strong security and confidentiality measures from the early stages of a DW project in the MD modeling and enforce them. In the last years, there have been some proposals to accomplish the MD modeling at the conceptual level. Nevertheless, none of them considers security measures as an important element in their models, and therefore, they do not allow us to specify confidentiality constraints to be enforced by the applications that will use these MD models. In this paper, we present an Access Control and Audit (ACA) model for the conceptual MD modeling. Then, we extend the Unified Modeling Language (UML) with this ACA model, representing the security information (gathered in the ACA model) in the conceptual MD modeling, thereby allowing us to obtain secure MD models. Moreover, we use the OSCL (Object Security Constraint Language) to specify our ACA model constraints, avoiding in this way an arbitrary use of them. Furthermore, we align our approach with the Model-Driven Architecture, the Model-Driven Security and the Model-Driven Data Warehouse, offering a proposal highly compatible with the more recent technologies.

Developing knowledge management systems is a complicated task since it is necessary to take into account how the knowledge is generated, how it can be distributed in order to reuse it, and other aspects related to the knowledge flows. On the other hand, many technical aspects should also be considered such as what knowledge representation or retrieval technique is going to be used. To find a balance between both aspects is important if we want to develop a successful system. However, developers often focus on technical aspects, giving less importance to knowledge issues. In order to avoid this, we have developed a model to help computer science engineers to develop these kinds of systems. In our proposal we first define a knowledge life cycle model that, according to literature and our experience, ponders all the stages that a knowledge management system should give support to. Later, we describe the technology (software agents) that we recommend to support the activities of each stage. The article explains why we consider that software agents are suitable for this end and how they can work in order to reach their goals. Moreover, a prototype that uses these agents is also described.

After years of experience in object-oriented design, software engineers have accumulated a great deal of knowledge in the design and construction of object-oriented systems: important contributions to this field including principles, heuristics, lessons learned, bad smells, refactorings, and so on, with the resultant major improvements in software development. However, this large body of knowledge is still not well organized, its terminology is ambiguous, and it is very difficult to make practical use of the contributions made. In this regard, we believe it is important to define an ontology in order to structure and unify design knowledge, since a good understanding of the experience derived from practical work is critical for software engineers. This ontology could be used to improve communication between software engineers, inter-operability among designs, design re-usability, design knowledge searching and specification, software maintenance, knowledge acquisition, etc. In the ontology we incorporate knowledge specific to both domain and technology. Such an organized body of knowledge could also be used for registering and documenting design rationale issues.

Abstract This article presents the technical and functional descriptions of a tool specifically designed for database re‐engineering. As is well known, re‐engineering is the process of (1) applying reverse engineering to a software product to obtain higher‐level specifications and (2) using these specifications as the starting point for the development of a new version of the system. Thus, the complete process can be seen as a sequence of transformation functions that operate on the different sets involved in the whole process. The starting point of the re‐engineering process is the physical schema of the database which is translated into a vendor‐independent metamodel (the logical schema) and then translated into a class diagram representing a possible conceptual schema of the database. This diagram is then taken as the starting point for the code generation process, which produces an executable application for four possible different platforms. Copyright © 2007 John Wiley & Sons, Ltd.

Abstract This article presents two tools to generate test cases, one for Java programs and one for .NET programs, as well as a structured testing process whereby such tools can be used in order to help in process automation. The main innovation in this work is the joint use of diverse techniques and technologies, which have been separately applied to test automation: reflection to extract the class structure; regular expressions to describe test templates and test cases; JUnit and NUnit as test case execution frameworks; mutation and MuJava as test case quality measurers; serialization to deal with the parameters of complex data types; and once more, reflection, to facilitate the test engineer in the task of writing the oracle. Finally, the article presents an experiment carried out to validate the work. Copyright © 2006 John Wiley & Sons, Ltd.

Nowadays, security solutions are focused mainly on providing security defences; instead of solving one of the main reasons for security problems that refers to appropriate information systems (IS) design. Fortunately there are several standards, like the Common Criteria, which help to deal with the security requirements along all the IS development cycle. In this paper a comparative analysis of eight different relevant technical proposals, which place great importance on the establishing of security requirements in the development of IS, is carried out. And they provide some significant contributions in aspects related to security. Nevertheless, they only satisfy partly the necessary criteria for the establishment of security requirements, with guarantees and integration in the development of IS. Thus we conclude that they are not specific enough for dealing with security requirements in the first stages of IS development in a systematic and intuitive way.

Business processes are important for companies because they allow us to obtain an advanced marketplace position, and then, these enterprises can optimize and assure the quality of their products and services. Moreover, business processes are important for software developers, because they can capture from them the necessary requirements for software design and creation. At the same time, organizations have been opened and this implies more vulnerability. In spite of all these facts, security is an aspect that has been scarcely dealt with in the business process modeling. In this paper, we summarize our UML 2.0 profile for secure business process modeling through activity diagrams, and we apply this approach to a typical health-care business process.

Security and reliability issues are rarely considered at the initial stages of software development and are not part of the standard procedures in development of software and services. Security patterns are a recent development as a way to encapsulate the accumulated knowledge about secure systems design, and security patterns are also intended to be used and understood by developers who are not security professionals. In this paper, we compare several security patterns to be used when dealing with application security, following an approach that we consider important for measuring the security degree of the patterns, and indicating a fulfilment or not of the properties and attributes common to all security systems.

For enterprises to be able to properly use information and communications technologies, it is necessary to have guides, metrics and tools that allow us to always know the level of our security and the points in which we are not covering it. In small and medium-size enterprises, the application of security standards has an additional problem, that is, the fact that they do not have enough resources to perform an appropriate management. In this article we analyze some of the existing maturity models and we compare them to the maturity model we are applying in practice. Finally we introduce a first approach to a scoreboard which is being developed as part of a security management tool for IT systems. This approach is being directly applied to real cases and it is obtaining a constant improvement in its application.

Data warehouses (DWs) contained high sensitive data, and therefore, it is essential to specify security measures from the early stages of the DW design and enforce them. Access control models for transactional (relational) databases, based on tables, columns and rows, are not appropriate for DWs. Instead, security and audit rules defined for DWs must be specified based on the multidimensional (MD) modeling used to design data warehouses. So far, very few approaches represent security measures in the conceptual modeling of data warehouses form the early stages of a DW project. Moreover these security measures cannot be directly represented in the relational model for data warehouses, thereby having a semantic gap between the conceptual and logical schemas. In this paper, we present an extension of the relational model to consider security and audit measures represented in the conceptual modeling. To accomplish this, we based on the relational package of the common warehouse metamodel (CWM) and extend it to properly represent all security and audit rules defined in the conceptual modelling of data warehouses. Finally, to show the benefit of our approach, we apply our proposal to a health care case study.

In most real world data warehouses (DWs) projects, security aspects are issues that usually rely on DBMS administrators. We argue that the design of security aspects should be considered together with the conceptual modeling of DWs from the early stages of a DW project, and being able to attach user security information to the basic structures of a multidimensional (MD) model (e.g. dimensions, facts, attributes, and so on). In this way, we would be able to generate this information in a semi or automatic way into a target platform and the final DW will better suit user security requirements. In this paper, we will present an extension of the Unified Modeling Language (UML) using a UML profile to represent multidimensional and security aspects of our conceptual modeling. Our approach proposes the use of UML packages in order to group classes together into higher level units creating different levels of abstraction, and therefore, simplifying the final model. In this way, when modeling complex and large DWs systems, the designer is not restricted to use flat UML class diagrams. Finally, we would show an example to illustrate the applicability of our proposal.

The use of passwords is the most common method to carry out the authentication of users in information systems. For this reason, quality in the password management is a need to reach reasonable levels in the typical objectives of security. In this paper, we propose a set of metrics of password policies based on the most outstanding factors in this authentication mechanism. Together with the metrics, we propose a quality indicator derived from these metrics that allows us to have a global vision of the quality of the password management policy used. Finally, we indicate the future works to be performed to check the validity and usefulness of the proposed metrics.

In the software measurement context, there exists a lack of consensus among the concepts and terminology used. Even inconsistencies and terminology conflicts can be detected among standards. For this reason, a software measurement ontology (SMO) has come into existence with the aim of providing a coherent software measurement terminology. In this paper, an example of the use of SMO as framework for the definition of a portlet functionality model is presented. Attributes, measures as well as indicators have been identified for the portlet functionality following the SMO

Global software development projects face up a variety of challenges respect to communication and control that need to be solved or, at least, minimized. For that reason, processes crucially based on communication, like software requirements elicitation; have to be rethought in such a new context. Since requirement elicitation is a human-centred process, we propose using techniques from the field of cognitive psychology to define a strategy for selecting technology. With this goal, this paper introduces our approach and illustrates how cognitive styles might be used to improve a distributed process by selecting suitable groupware tools and elicitation techniques according to the characteristics of stakeholders

Advances in technology and the use of the Internet have favoured the appearance of a great variety of Web applications, among them Web Portals. These applications are important information sources and/or means of accessing information. Many people need to obtain information by means of these applications and they need to ensure that this information is suitable for the use they want to give it. In recent years, several research projects were conducted on topic of Web Data Quality. However, there is still a lack of specific proposals for the data quality of portals. In this paper we introduce a model for the data quality in Web portals.

In the last few years, the field of Web services (WS) security has evolved rapidly producing an impressive number of WS-based security standards. This fact has caused that organizations are still reticent about adopting technologies based on this paradigm due to the learning curve necessary to integrate security into their practical deployments. In this paper, we present PWSSec (process for Web services security) as a process that enables the integration of a set of specific stages into the traditional phases of WS-based systems development providing them with security. PWSSec is composed of three stages, WSSecReq (Web services security requirements), WSSecArch (Web services security architecture) and WSSecTech (Web services security technologies) that allow the specification of WS-specific security requirements, the definition of the WS-based security architecture and the identification of the security standards that the security architecture must deploy, respectively

This paper presents an empirical study analysing the relationship between a set of metrics for Fourth–Generation Languages (4GL) programs and their maintainability. An analysis has been made using historical data of several industrial projects and three different approaches: the first one relates metrics and maintainability based on techniques of descriptive statistics, and the other two are based on Data Mining techniques. A discussion on the results obtained with the three techniques is also presented, as well as a set of equations and rules for predicting the maintenance effort in this kind of programs. Finally, we have done experiments about the prediction accuracy of these methods by using new unseen data, which were not used to build the knowledge model. The results were satisfactory as the application of each technique separately provides useful perspective for the manager in order to get a complementary insight from data.

Abstract This article presents the results and lessons learned in the application of the Framework for the Modelling and Measurement of Software Processes (FMESP) in a software company dedicated to the development and maintenance of software for information systems. The aim of FMESP is to provide companies with a conceptual and technological framework for the management of their process models and measurement models in an integrated way. Modelling and measurement are two key factors to promote continuous process improvement. As a result, important benefits were obtained. The company improved the maturity of its processes which allowed it to obtain the ISO 9000 certification. From a research point of view, Action‐Research was successfully applied and as a result the framework was improved and important feedback was obtained, bringing to light new important issues which will be tacked in future work. Copyright © 2005 John Wiley & Sons, Ltd.

Different modeling approaches have been proposed to overcome every design pitfall of the development of the different parts of a data warehouse (DW) system. However, they are all partial solutions which deal with isolated aspects of the DW and do not provide designers with an integrated and standard method for designing the whole DW (ETL processes, data sources, DW repository and so on). On the other hand, the Model Driven Architecture (MDA) is a standard framework for software development that addresses the complete life cycle of designing, deploying, integrating, and managing applications by using models in software development. In this paper, we describe how to align the whole DW development process to MDA. Then, we define MD2A (MultiDimensional Model Driven Architecture), an approach for applying the MDA framework to one of the stages of the DW development: multidimensional (MD) modeling. First, we describe how to build the different MDA artifacts (i.e. models) by using extensions of the Unified Modeling Language (UML). Secondly, transformations between models are clearly and formally established by using the Query/View/Transformation (QVT) approach. Finally, an example is provided to better show how to apply MDA and its transformations to the MD modeling.

This paper presents a tool specifically designed for database reengineering. As is well known, reengineering is the process of (1) applying reverse engineering to a software product to get higher-level specifications, and (2) using these specifications as the starting point for the development of a new version of the system. Thus, the complete process can be seen as a sequence of transformation functions that operate on the different sets of artifacts involved in the whole process. The starting point of the reengineering process is the physical schema of the database, which is translated into a vendor-independent metamodel; then, this is translated into a class diagram representing the possible conceptual schema used during the development of the database. This diagram is then taken as the starting point for the code generation process, which produces an executable application for four possible different platforms.

In this paper, and following other proposals, we present a model for classifying the research works done on the software architecture field. We also present some examples of classification. The final objective is not only to have a global vision about the research in this area but also to know where works is lacking.

Evolving software's design requires that the members of the team acquire a deep and complete knowledge of the domain, the architectural components, and their integration. Such information is scarcely addressed within the design documentation and it is not trivial to derive it. A strategy for enforcing the consciousness of such hidden aspects of software's design is needed. One of the expected benefits of pair programming is fostering (tacit) knowledge building between the components of the pair and fastening its diffusion within the project's team. We have applied the paradigm of pair programming to the design phase and we have named it ‘pair designing’. We have realized an experiment and a replica in order to understand if pair designing can be used as an effective means for diffusing and enforcing the design knowledge while evolving the system's design. The results suggest that pair designing could be a suitable means to disseminate and enforce design knowledge. Copyright © 2005 John Wiley & Sons, Ltd.

The complexity of software artifacts is widely believed to be an important determinant of maintenance effort. This paper conducts an experimental analysis of the impact of complexity on the maintenance of the Unified Modeling Language (UML) class diagrams. This represents an analysis of the effect of an internal quality attribute on an external quality attribute. A range of complexity metrics are proposed based on an ontological analysis of the UML language and previous research. The relative influence of these metrics on maintenance effort is then evaluated using a laboratory experiment. A within-subjects design was used, with subjects required to modify a range of UML class diagrams with different levels of complexity. Only two of the metrics emerged as significant determinants of maintenance effort: number of methods and number of associations. Together these explain around 28% of the variation in maintenance effort. While these findings are encouraging, further research is necessary to explore the ability of these metrics to predict maintenance effort. Copyright © 2005 John Wiley & Sons, Ltd.

Different proposals exist to represent the software maintenance process. However most of them are very informal or too focussed on a specific goal. We have developed a semi-formal ontology where the main concepts, according to the literature related to software maintenance, have been described. This ontology, besides representing static aspects, also represents dynamic issues related to the management of software maintenance projects. In order to develop an ontology a suitable methodology should also be followed. REFSENO was the methodology used in this work. The ontology that this work presents is not a preliminary idea but it has already been used in software maintenance environments, such as MANTIS, which is currently working successfully.

While various articles about fuzzy entity relationship (ER) and enhanced entity relationship (EER) models have recently been published, not all examine how the constraints expressed in the model may be relaxed. In this paper, our aim is to relax the constraints which can be expressed in a conceptual model using the modeling tool, so that these constraints can be made more flexible. We will also study new constraints that are not considered in classic EER models. We use the fuzzy quantifiers which have been widely studied in the context of fuzzy sets and fuzzy query systems for databases. In addition, we shall examine the representation of these constraints in an EER model and their practical repercussions. The following constraints are studied: the fuzzy participation constraint, the fuzzy cardinality constraint, the fuzzy completeness constraint to represent classes and subclasses, the fuzzy cardinality constraint on overlapping specializations, fuzzy disjoint and fuzzy overlapping constraints on specializations, fuzzy attribute-defined specializations, fuzzy constraints in union types or categories and fuzzy constraints in shared subclasses. We shall also demonstrate how fuzzy (min, max) notation can substitute the fuzzy cardinality constraint but not the fuzzy participation constraint. All these fuzzy constraints have a new meaning, they offer greater expressiveness in conceptual design, and are included in the so-called fuzzy EER model.

Information technology misuse has increased the vulnerability of personal data, which has lead to growing concern about issues of personal privacy among political leaders, IT managers, information security consultants and the millions of people currently online. Many countries have developed, or are preparing, laws and regulations to combat the related threats and to guarantee personal data protection. Despite efforts to construct secure systems, few papers have, as yet, focused on security from the very outset of the system development life-cycle. This paper presents a pragmatic proposal to incorporate the legal and regulatory measures to guarantee personal data protection as a part of the requirements engineering process, instead of an addendum to system deployment. The authors investigate how recent efforts in the requirements engineering field can contribute to improving security issues in information systems, in particular those dealing with personal data. A reusable collection of security requirements and, as a novelty, personal data protection requirements (including information on related software components links) are provided. The pre-defined requirements, together with a simple process model based on requirements reuse, provide a strategy that organizations can use to become privacy-compliant.

Abstract This article explains our experience of using Action Research to develop a software maintenance methodology involving two organizations: a group of university researchers and a software services organization. The concept of ‘methodology’ comprises a wide set of elements whose identification, definition and integration is not a trivial task, due to the magnitude of the project and to the different nature of the organizations. The use of Action Research was a key factor in the progress of the research and has been essential in the adoption of the methodology within the software services organization. Copyright © 2002 John Wiley & Sons, Ltd.

Metrics are useful mechanisms for assuring database quality. However, it is necessary to prove the practical utility of the metrics because they must be used in real life. Consequently if the metrics are not useful from a practical point of view, they must be rejected. We present the metrics we have proposed for controlling the quality of relational databases and we present the case study developed in a Spanish enterprise aimed at discovering if the metrics are really useful in relation to the purpose for which they were designed, that is to say the control of quality.

The paper presents an empirical study on the correlation of simple code metrics and maintenance necessities. The goal of the work is to provide a method for the estimation of maintenance in the initial stages of outsourcing maintenance projects, when the maintenance contract is being prepared and there is very little available information on the software to be maintained. The paper shows several positive results related to the mentioned goal.

It is generally accepted in the information system (IS) field that IS quality is highly dependent on the decisions made early in the development life cycle. The construction of conceptual data models is often an important task of this early development. Therefore, improving the quality of conceptual data models will be a major step towards the quality improvement of the IS development. Several quality frameworks for conceptual data models have been proposed, but most of them lack valid quantitative measures in order to evaluate the quality of conceptual data models in an objective way. In this article we will define measures for the structural complexity (internal attribute) of entity relationship diagrams (ERD) and use them for predicting their maintainability (external attribute). We will theoretically validate the proposed metrics following Briand et al.'s framework with the goal of demonstrating the properties that characterise each metric. We will also show how it is possible to predict each of the maintainability sub-characteristics using a prediction model generated using a novel method for induction of fuzzy rules.

Abstract In this paper we present MANTOOL, an automatic tool for managing the software maintenance process according to MANTEMA, a rigorous methodology for maintenance. After explaining briefly the MANTEMA structure, the article explains how MANTOOL allows users to manage modification requests following the different stages of the methodology, showing it with some examples. The data saved in MANTOOL can be used to extract different kinds of reports and to do estimations of future maintenance interventions. The paper also includes some experience reports about the construction and application of MANTEMA and MANTOOL, and some reflections on the benefits of its use. Copyright © 2001 John Wiley & Sons, Ltd.