Awareness of the importance of systems and software traceability, as well as tool support for traceability, have improved over the years. But an effective solution for traceability must align and integrate with an organization’s engineering processes. Specifically, the phases of the traceability process model (traceability strategy, creation, use and maintenance of traceability) must be aligned with the organization’s engineering processes. Previous research has discussed the benefits of integrating traceability into the configuration management process. In this paper, we propose Change Request management using traceability data. In our approach, new Change Requests (CRs) are created from the traceability model of the corresponding project. The created CRs contain a portion of the project’s overall traceability model that is relevant to that change. A proof-of-concept issue tracking system is proposed that uses a traceability model at its core.

Rolls-Royce Control Systems supplies engine control and monitoring systems for aviation applications, and is required to design, certify, and deliver these to the highest level of safety assurance. To allow Rolls-Royce to develop safe and robust systems, which continue to increase in complexity, model-based techniques are now a critical part of the software development process. In this paper, we discuss the experiences, challenges and lessons learnt when developing a bespoke domain-specific modelling workbench based on open-source modelling technologies including the Eclipse Modelling Framework (EMF), Xtext, Sirius and Epsilon. This modelling workbench will be used to architect and integrate the software for all future Rolls-Royce engine control and monitoring systems.

Model-Based Development (MBD) is widely used for embedded controls development, with MATLAB/Simulink being one of the most used environments in the automotive industry. Simulink models are the primary design artifact and as with all software, must be constantly maintained and evolved over their lifetime. It is necessary to develop models that support likely changes in order to assist with evolution/maintenance processes. In order to do so, the types of frequently performed changes must be understood and appropriate language mechanisms must be available to support these changes. However, Simulink model changes are currently not well understood. We analyze a real industrial software repository of our industrial partner and its version control system to provide insights into the likely changes for Simulink. The intent with this analysis includes providing guidance on how Simulink is used in industrial practice and how particular model changes can impact system evolution.

Abstract Scalable performance is a major challenge with current model management tools. As the size and complexity of models and model management programs increases and the cost of computing falls, one solution for improving performance of model management programs is to perform computations on multiple computers. In this paper, we demonstrate a low-overhead data-parallel approach for distributed model validation in the context of an OCL-like language. Our approach minimises communication costs by exploiting the deterministic structure of programs and can take advantage of multiple cores on each (heterogeneous) machine with highly configurable computational granularity. Our performance evaluation shows that the implementation is extremely low overhead, achieving a speed up of 24.5 $$\times $$ × with 26 computers over the sequential case, and 122 $$\times $$ × when utilising all six cores on each computer.

Open-source model management frameworks such as OCL and ATL tend to focus on manipulating models built atop the Eclipse Modelling Framework (EMF), a de facto standard for domain specific modelling. MATLAB Simulink is a widely used proprietary modelling framework for dynamic systems that is built atop an entirely different technical stack to EMF. To leverage the facilities of open-source model management frameworks with Simulink models, these can be transformed into an EMF-compatible representation. Downsides of this approach include the synchronisation of the native Simulink model and its EMF representation as they evolve; the completeness of the EMF representation, and the transformation cost which can be crippling for large Simulink models. We propose an alternative approach to bridge Simulink models with open-source model management frameworks that uses an "on-the-fly" translation of model management constructs into MATLAB statements. Our approach does not require an EMF representation and can mitigate the cost of the upfront transformation on large models. To evaluate both approaches we measure the performance of a model validation process with Epsilon (a model management framework) on a sample of large Simulink models available on GitHub. Our previous results suggest that, with our approach, the total validation time can be reduced by up to 80%. In this paper, we expand our approach to support the management of Simulink requirements and dictionaries, and we improve the approach to perform queries on collections of model elements more efficiently. We demonstrate the use of the Simulink requirements and dictionaries with a case study and we evaluate the optimisations on collection queries with an experiment that compares the performance of a set of queries on models with different sizes. Our results suggest an improvement by up to 99% on some queries.

Conservative execution, end-to-end traceability, and context-aware resource handling are desirable features in model management build processes. Yet, none of the existing MDE-dedicated build tools (e.g. MTC-Flow, MWE2) support such features. An initial investigation of general-purpose build tools (e.g. ANT, Gradle) to assess whether we could build a workflow engine with support for these desirable features on top of it revealed limitations that could act as roadblocks for our work. As such, we decided to design and implement a new MDE-focused build tool (ModelFlow) from scratch to avoid being constrained by assumptions and technical constraints of these tools. We evaluated whether this decision was sensible by attempting to replicate its behaviour with Gradle in a typical model-driven engineering scenario. The evaluation highlighted scenarios where Gradle could not be extended to achieve the desirable behaviour which validates the decision to not base ModelFlow on top of it.

The wide use of robotic systems contributed to developing robotic software highly coupled to the hardware platform running the robotic system. Due to increased maintenance cost or changing business priorities, the robotic hardware is infrequently upgraded, thus increasing the risk for technology stagnation. Reducing this risk entails migrating the system and its software to a new hardware platform. Conventional software engineering practices such as complete re-development and code-based migration, albeit useful in mitigating these obsolescence issues, they are time-consuming and overly expensive. Our RoboSMi model-driven approach supports the migration of the software controlling a robotic system between hardware platforms. First, RoboSMi executes static analysis on the robotic software of the source hardware platform to identify platform-dependent and platform-agnostic software constructs. By analysing a model that expresses the architecture of robotic components on the target platform, RoboSMi establishes the hardware configuration of those components and suggests software libraries for each component whose execution will enable the robotic software to control the components. Finally, RoboSMi through code-generation produces software for the target platform and indicates areas that require manual intervention by robotic engineers to complete the migration. We evaluate the applicability of RoboSMi and analyse the level of automation and performance provided from its use by migrating two robotic systems deployed for an environmental monitoring and a line following mission from a Propeller Activity Board to an Arduino Uno.

Mining software repositories at a large scale typically requires substantial computational and storage resources. This creates an increasing need for repository mining programs to be executed in a distributed manner, such that remote collaborators can contribute local computational and storage resources. In this paper we present Crossflow, a novel framework for building polyglot distributed repository mining programs. We demonstrate how Crossflow offers delegation of mining jobs to remote workers and can cache their results, how such workers are able to implement advanced behavior like load balancing and rejecting jobs they either cannot perform or would execute sub-optimally, and how workers of the same analysis program can be written in different programing languages like Java and Python, executing only relevant parts of the program described in that language.

Abstract In 2017 and 2018, two events were held—in Marburg, Germany, and San Vigilio di Marebbe, Italy, respectively—focusing on an analysis of the state of research, state of practice, and state of the art in model-driven engineering (MDE). The events brought together experts from industry, academia, and the open-source community to assess what has changed in research in MDE over the last 10 years, what challenges remain, and what new challenges have arisen. This article reports on the results of those meetings, and presents a set of grand challenges that emerged from discussions and synthesis. These challenges could lead to research initiatives for the community going forward.

Abstract UML profiles offer an intuitive way for developers to build domain-specific modelling languages by reusing and extending UML concepts. Eclipse Papyrus is a powerful open-source UML modelling tool which supports UML profiling. However, with power comes complexity, implementing non-trivial UML profiles and their supporting editors in Papyrus typically requires the developers to handcraft and maintain a number of interconnected models through a loosely guided, labour-intensive and error-prone process. We demonstrate how metamodel annotations and model transformation techniques can help manage the complexity of Papyrus in the creation of UML profiles and their supporting editors. We presentJorvik, an open-source tool that implements the proposed approach. We illustrate its functionality with examples, and we evaluate our approach by comparing it against manual UML profile specification and editor implementation using a non-trivial enterprise modelling language (Archimate) as a case study. We also perform a user study in which developers are asked to produce identical editors using both Papyrus andJorvikdemonstrating the substantial productivity and maintainability benefits thatJorvikdelivers.

While the majority of research on Model-Based Software Engineering revolves around open-source modelling frameworks such as the Eclipse Modelling Framework, the use of commercial and closed-source modelling tools such as RSA, Rhapsody, MagicDraw and Enterprise Architect appears to be the norm in industry at present. This technical gap can prohibit industrial users from reaping the benefits of state-of-the-art research-based tools in their practice. In this paper, we discuss an attempt to bridge a proprietary UML modelling tool (PTC Integrity Modeller), which is used for model-based development of safety-critical systems at Rolls-Royce, with an open-source family of languages for automated model management (Epsilon). We present the architecture of our solution, the challenges we encountered in developing it, and a performance comparison against the tool’s built-in scripting interface. In addition, we use the bridge in a real-world industrial case study that involves the coordination with other bridges between proprietary tools and Epsilon.

The need for levels of availability and scalability beyond those supported by relational databases has led to the emergence of a new generation of purpose-specific databases grouped under the term NoSQL. In general, NoSQL databases are designed with horizontal scalability as a primary concern and deliver increased availability and fault tolerance at a cost of temporary inconsistency and reduced durability of data. To balance the requirements for data consistency and availability, organisations increasingly migrate towards hybrid data persistence architectures comprising both relational and NoSQL databases. The consensus is that this trend will only become stronger in the future; critical data will continue to be stored in ACID (largely relational) databases while non-critical data will be progressively migrated to high-availability NoSQL databases. Designing and deploying a hybrid data persistence architecture that involves a combination of relational and NoSQL databases is a complex, technically challenging and error-prone task. In this paper we outline a model-based methodology developed in the context of the EC-funded H2020 TYPHON project for designing, developing, querying and evolving such scalable architectures for persistence, analytics and monitoring of large volumes of hybrid (relational, graph-based, document-based, natural language, etc.) data, in a systematic and disciplined manner.

An assurance case (AC) captures explicit reasoning associated with assuring critical properties, such as safety. A vital attribute of an AC is that it facilitates the identification of fallacies in the validity of any claim. There is considerable published research related to confidence in ACs, which primarily relate to a measure of soundness of reasoning. Evaluation of an AC is more general than measuring confidence and considers multiple aspects of the quality of an AC. Evaluation criteria thus play a significant role in making the evaluation process more systematic. This paper contributes to the identification of effective evaluation criteria for ACs, the rationale for their use, and initial tests of the criteria on existing ACs. We classify these criteria as to whether they apply to the structure of the AC, or to the content of the AC. This paper focuses on safety as the critical property to be assured, but only a very small number of the criteria are specific to safety, and can serve as placeholders for evaluation criteria specific to other critical properties. All of the other evaluation criteria are generic. This separation is useful when evaluating ACs developed using different notations, and when evaluating ACs against safety standards. We explore the rationale for these criteria as well as the way they are used by the developers of the AC and also when they are used by a third-party evaluator.

MATLAB/Simulink is a tool for dynamic system modelling widely used across industries such as aerospace and automotive. Model management languages such as OCL, ATL and the languages of the Epsilon platform enable the validation, model-to-model, model-to-text transformation of models but tend to focus on the Eclipse Modelling Framework (EMF), a de facto standard for domain specific modelling. As Simulink models are built on an entirely different technical stack, the current solution to manipulate them using such languages requires their transformation into an EMF-compatible representation. This approach is expensive as (a) the cost of the transformation can be crippling for large models, (b) it requires the synchronisation of the native Simulink model and its EMF counterpart, and (c) the EMF-representation may be an incomplete copy of the model potentially hampering model management operations. In this paper we propose an alternative approach that uses the MATLAB API to bridge Simulink models with existing model management languages that relies on the "on-the-fly" translation of model management language constructs into MATLAB/Simulink commands. Our approach not only eliminates the cost of the transformation and of the co-evolution of the EMF-compatible representation but also enables full access to all the aspects of Simulink models. We evaluate the performance of both approaches using a set of model validation constraints executed on a sample of the largest Simulink models available on GitHub. Our evaluation suggests that the on-the-fly translation approach can reduce the model validation time by up to 80%.

Large-scale software repository mining typically requires substantial storage and computational resources, and often involves a large number of calls to (rate-limited) APIs such as those of GitHub and StackOverflow. This creates a growing need for distributed execution of repository mining programs to which remote collaborators can contribute computational and storage resources, as well as API quotas (ideally without sharing API access tokens or credentials). In this paper we introduce Crossflow, a novel framework for building distributed repository mining programs. We demonstrate how Crossflow can delegate mining jobs to remote workers and cache their results, and how workers can implement advanced behaviour such as load balancing and rejecting jobs they cannot perform (e.g. due to lack of space, credentials for a specific API).

In this paper we propose a domain specific language that enables the description and execution of model management workflows. Our language declares tasks and resources involved in a multi-step model management process and resolves the execution behaviour and order based on dependencies among these components. We describe the abstract and a concrete syntax of the language along with its execution semantics. Then, we demonstrate how the language interpreter can orchestrate and execute a selection model management tasks through a case study of a workflow that generates a graphical editor from a metamodel.

Although Model-Based Software Engineering (MBE) is a widely accepted Software Engineering (SE) discipline, no agreed-upon core set of concepts and practices (i.e., a Body of Knowledge) has been defined for it yet. With the goals of characterizing the contents of the MBE discipline, promoting a global consistent view of it, clarifying its scope with regard to other SE disciplines, and defining a foundation for the development of educational curricula on MBE, this paper proposes the contents for a Body of Knowledge for MBE. We also describe the methodology that we have used to come up with the proposed list of contents, as well as the results of a survey study that we conducted to sound out the opinion of the community on the importance of the proposed topics and their level of coverage in the existing SE curricula.

Recent research in scalable model-driven engineering now allows very large models to be stored and queried. Due to their size, rather than transferring such models over the network in their entirety, it is typically more efficient to access them remotely using networked services (e.g. model repositories, model indexes). Little attention has been paid so far to the nature of these services, and whether they remain responsive with an increasing number of concurrent clients. This paper extends a previous empirical study on the impact of certain key decisions on the scalability of concurrent model queries on two domains, using an Eclipse Connected Data Objects model repository, four configurations of the Hawk model index and a Neo4j-based configuration of the NeoEMF model store. The study evaluates the impact of the network protocol, the API design, the caching layer, the query language and the type of database and analyses the reasons for their varying levels of performance. The design of the API was shown to make a bigger difference compared to the network protocol (HTTP/TCP) used. Where available, the query-specific indexed and derived attributes in Hawk outperformed the comprehensive generic caching in CDO. Finally, the results illustrate the still ongoing evolution of graph databases: two tools using different versions of the same backend had very different performance, with one slower than CDO and the other faster than it.

Flexible or bottom-up model-driven engineering (MDE) is an emerging approach to domain and systems modelling. Domain experts, who have detailed domain knowledge, typically lack the technical expertise to transfer this knowledge using traditional MDE tools. Flexible MDE approaches tackle this challenge by promoting the use of simple drawing tools to increase the involvement of domain experts in the language definition process. In such approaches, no metamodel is created upfront, but instead the process starts with the definition of example models that will be used to infer the metamodel. Pre-defined metamodels created by MDE experts may miss important concepts of the domain and thus restrict their expressiveness. However, the lack of a metamodel, that encodes the semantics of conforming models has some drawbacks, among others that of having models with elements that are unintentionally left untyped. In this paper, we propose the use of classification algorithms to help with the inference of such untyped elements. We evaluate the proposed approach in a number of random generated example models from various domains. The correct type prediction varies from 23 to 100% depending on the domain, the proportion of elements that were left untyped and the prediction algorithm used.

Mining data from remote repositories, such as GitHub and StackExchange, involves the execution of requests that can easily reach the limitations imposed by the respective APIs to shield their services from overload and abuse. Therefore, data mining clients are left alone to deal with such protective service policies which usually involves an extensive amount of manual implementation effort. In this work we present RestMule, a framework for handling various service policies, such as limited number of requests within a period of time and multi-page responses, by generating resilient clients that are able to handle request rate limits, network failures, response caching, and paging in a graceful and transparent manner. As a result, RestMule clients generated from OpenAPI specifications (i.e. standardized REST API descriptors), are suitable for intensive data-fetching scenarios. We evaluate our framework by reproducing an existing repository mining use case and comparing the results produced by employing a popular hand-written client and a RestMule client.

We present the Epsilon Pattern Language (EPL), a textual language that supports expressing and detecting patterns on models conforming to arbitrary metamodels and captured using diverse modelling technologies. EPL provides out-of-the-box integration with existing languages that target a wide range of related model management activities (such as model validation, model-to-model and model-to-text transformation), thus enabling code reuse and seamless runtime interoperability across complex Model-Driven Engineering workflows. We discuss the syntax and semantics of EPL, its supporting development tools, and demonstrate how instances of patterns detected using EPL can be consumed and further processed by other model management programs.

Since its infancy, Model Driven Engineering (MDE) research has primarily focused on technical issues. Although it is becoming increasingly common for MDE research papers to evaluate their theoretical and practical solutions, extensive usability studies are still uncommon. We observe a scarcity of User eXperience (UX)-related research in the MDE community, and posit that many existing tools and languages have room for improvement with respect to UX [26], [44], [37], where UX is a key focus area in the software development industry. We consider this gap a fundamental problem that needs to be addressed by the community if MDE is to gain widespread use. In this vision paper, we explore how and where UX fits into MDE by considering motivating use cases that revolve around different dimensions of integration: model integration, tool integration, and integration between process and tool support. Based on the literature and our collective experience in research and industrial collaborations, we propose future directions for addressing these challenges.

While the majority of research on Model-Based Software Engineering revolves around open-source modelling frameworks such as EMF, the use of commercial and closed-source modelling tools such as RSA, Rhapsody, MagicDraw and PTC Integrity Modeller appears to be the norm in industry at present. This technical gap can prohibit industrial users from reaping the benefits of state-of-the-art research-based tools in their practice. In this paper, we discuss an attempt to bridge a proprietary UML modelling tool (PTC Integrity Modeller), which is used for model-based development of safety-critical systems at Rolls-Royce, with an open-source family of languages for automated model management (Epsilon). We present the architecture of our solution, the challenges we encountered in developing it, and a performance comparison against the tool's built-in scripting interface.

Domain experts typically have detailed knowledge of the concepts that are used in their domain; however they often lack the technical skills needed to translate that knowledge into model-driven engineering (MDE) idioms and technologies. Flexible or bottom-up modelling has been introduced to assist with the involvement of domain experts by promoting the use of simple drawing tools. In traditional MDE the engineering process starts with the definition of a metamodel which is used for the instantiation of models. In bottom-up MDE example models are defined at the beginning, letting the domain experts and language engineers focus on expressing the concepts rather than spending time on technical details of the metamodelling infrastructure. The metamodel is then created manually or inferred automatically. The flexibility that bottom-up MDE offers comes with the cost of having nodes in the example models left untyped. As a result, concepts that might be important for the definition of the domain will be ignored while the example models cannot be adequately re-used in future iterations of the language definition process. In this paper, we propose a novel approach that assists in the inference of the types of untyped model elements using Constraint Programming. We evaluate the proposed approach in a number of example models to identify the performance of the prediction mechanism and the benefits it offers. The reduction in the effort needed to complete the missing types reaches up to 91.45% compared to the scenario where the language engineers had to identify and complete the types without guidance.

Models are an important tool in conquering the increasing complexity of modern software systems. Key industries are strategically directing their development environments towards more extensive use of modeling techniques. MiSE 2015 aimed to understand, through critical analysis, the current and future uses of models in the engineering of software-intensive systems. The MiSE workshop series has proven to be an effective forum for discussing modeling techniques from both the MDE and software engineering perspectives. An important goal of this workshop is to foster exchange between these two communities. In 2015 the focus was on considering the current state of tool support and the challenges that need to be addressed to improve the maturity of tools. There was also analysis of successful applications of modeling techniques in specific application domains, with attempts to determine how the participants' experiences can be carried over to other domains.

Spreadsheets are heavily used in industry, becausethey are easily written and adjusted, using an intuitive visual interface. They often start out as simple tools; however, over time spreadsheets can become increasingly complex, up to the point where they become complicated and inflexible. In many ways, spreadsheet are similar to software: both concern the storage and manipulation of data and the presentation of results to the user. Because of this similarity, many methods and techniques from software engineering can be applied to spreadsheets. The role of SEMS, the International Workshop on Software Engineering Methods in Spreadsheets is to explore the possibilities of applying successful methods from software engineering to spreadsheets. Some, like testing and visualization, have been tried before and can be built upon. For methods that have not yet been tried on spreadsheets, SEMS will serve as a platform for early feedback. The SEMS program included an industrial keynote, "spreadsheet stories" (success or failure), short and long research papers,a good mix of industrial and academic researchers, as well as lively discussion and debate.

Purpose – This paper aims to classify different types of “user-visible cryptography” and evaluate the value of user-visible cryptographic mechanisms in typical email and web scenarios for non-expert IT users. Design/methodology/approach – The authors review the existing literature, and then identify user stories typical to their users of interest. They analyse the risks, mitigations of risks and the limits of those mitigations in the user stories. Findings – The scenarios identified suggest that background, opportunistic encryption has value, but more explicit, user-visible cryptographic mechanisms do not provide any further mitigation. Other mechanisms beyond technological mitigations provide the required mitigation for the users. Research limitations/implications – Further work should be carried out on the trust issues with trusted third parties, as they are intrinsic to global, automated cryptographic mechanisms. The authors suggest that deployed systems should rely on automation rather than explicit user involvement; further work on how best to involve users effectively remains valuable. Practical implications – Deployed systems should rely on automation rather than explicit user dialogues. This follows from recognised aspects of user behaviour, such as ignoring dialogues and unconsciously making a holistic assessment of risk that is mostly mitigated by social factors. Social implications – The user populations concerned rely significantly on the existing legal and social infrastructure to mitigate some risks, such as those associated with e-commerce. Guarantees from third parties and the existence of fallback procedures improve user confidence. Originality/value – This work uses user stories as a basis for a holistic review of the issues surrounding the use of cryptography. The authors concentrate on a relatively large population (non-expert IT users) carrying out typical tasks (web and email).

Analysis of resource usage and precise correlation with the workload that triggered it is essential in order to conduct capacity planning in computing environments. Virtualisation enables resource optimisation and is widely used in grid, cluster and cloud computing. We present an automated approach for resource usage analysis in a virtualised environment that can support capacity planning for web applications. The approach uses Domain Specific Modelling Languages (DSMLs) and model management techniques, which support tool interoperation and provide precise ways for describing resource and request logs and requirements, and automatically generate different outputs that feed into the capacity planning process. The approach is demonstrated using a proof-of-concept example involving a media streaming web application, and the results of the analysis are presented and discussed.

Agile development processes and User Centred Design (UCD) integration have been gaining increased interest, in part due to the complementarity of the techniques, the benefits each can apply to the other, and the challenges associated with their combination. This paper describes a Systematic Literature Review (SLR) that was conducted on Agile and UCD integration. The aim of this SLR was to identify various challenging factors that restrict Agile and User Centred Design Integration (AUCDI) and explore the proposed practices to deal with them. The study included a total of 71 papers and excluded 80 papers published from the year 2000 till 2012. AUCDI challenges and their respective proposed practices and success factors were synthesized. A description and taxonomy of AUCDI challenges and its respective success factors and practices were reported. Practitioners can utilise the results in identifying potential AUCDI challenges and practices or success factors to deal with them.

In nature the diversity of species and genes in ecological communities affects the functioning of these communities. Biologists have found out that more diverse communities appear to be more productive than less diverse communities. Moreover such communities appear to be more stable in the face of perturbations. In this paper, we draw the analogy between ecological communities and Open Source Software (OSS) ecosystems, and we investigate the diversity and structure of OSS communities. To address this question we use the MSR 2014 challenge dataset, which includes data from the top-10 software projects for the top programming languages on GitHub. Our findings show that OSS communities on GitHub consist of 3 types of users (core developers, active users, passive users). Moreover, we show that the percentage of core developers and active users does not change as the project grows and that the majority of members of large projects are passive users.

The ultimate aim of business/mission software is to help implement the business value or mission imperatives. For critical business/mission applications, high-level strategies need to play a crucial role in the development and validation of software requirement, so that the requirements and the produced software can closely align with the business/mission objectives and effectively contribute to the business/mission success. In this paper, we propose a strategy-guided method for the development and validation of requirements. We firstly articulate the dimensions of strategy and concept model for connecting strategies and requirements. We then present the approaches for the requirements development and validation, based on the relationship between the elements of strategies and requirements. This strategy-guided method addresses the paradigms for both the market-oriented and customer-specific software development. We also give an example illustrating the strategy perspectives and the resulting requirements.

Models are an important tool in conquering the increasing complexity of modern software systems. Key industries are strategically directing their development environments towards more extensive use of modeling techniques. This workshop sought to understand, through critical analysis, the current and future uses of models in the engineering of software-intensive systems. The MISE-workshop series has proven to be an effective forum for discussing modeling techniques from the MDD and the software engineering perspectives. An important goal of this workshop was to foster exchange between these two communities. The 2013 Modeling in Software Engineering (MiSE) workshop was held at ICSE 2013 in San Francisco, California, during May 18–19, 2013. The focus this year was analysis of successful applications of modeling techniques in specific application domains to determine how experiences can be carried over to other domains. Details are available at: https://sselab.de/lab2/public/wiki/MiSE/index.php.

Modelling plays a vital and pervasive role in software engineering: it provides means to manage complexity via abstraction, and enables the creation of larger, more complex systems. Search-based software engineering (SBSE) offers a productive and proven approach to software engineering through automated discovery of near-optimal solutions to problems, and has proven itself to be effective on a wide variety of software-and systems engineering problems. CMSBSE 2013 was a forum allowing researchers from both communities to meet, discuss synergies and differences, and present topics related to the intersection of search and modelling. Particular goals of CMSBSE were to highlight that SBSE and modelling have substantial conceptual and technical synergy, and to identify and present opportunities in which they can be combined, whilst also aiming to grow the community working in this area.

Probabilistic testing techniques that sample input data at random from a probability distribution can be more effective at detecting faults than deterministic techniques. However, if overly large (and therefore expensive) test sets are to be avoided, the probability distribution from which the input data is sampled must be optimised to the particular software-under-test. Such an optimisation process is often resource-intensive. In this paper, we present a prototypical cloud platform-and architecture-that permits the optimisation of such probability distributions in a scalable, distributed and robust manner, and thereby enables cost-effective probabilistic testing.

Model-to-text (M2T) transformation is an important model management operation, as it is used to implement code and documentation generation; model serialisation (enabling model interchange); and model visualisation and exploration. Despite the creation of the MOF Model-To-Text Transformation Language (MOFM2T) in 2008, many very different M2T languages exist today. Because there is little interoperability between M2T languages and rewriting an existing M2T transformation in a new language is costly, developers face a difficult choice when selecting a M2T language. In this paper, we use domain analysis to identify a preliminary feature model for M2T languages. We demonstrate the appropriateness of the feature model by describing two different M2T languages, and discuss potential applications for a tool-supported and model-driven approach to describing the features of M2T languages.

The INESS (Integrated European Signalling System) Project, funded by the FP7 programme of the European Union, aims to provide a common, integrated, railway signalling system within Europe. INESS experts have been using the Executable UML (xUML) language to model an executable specification of the proposed system. Due to safety-critical aspects of these systems, one key idea is to formally analyse them. In this context, we have been working with other universities on different translation-based methods that enable the formal verification of xUML models. At the core of this approach is a verification framework based on model transformation technology, used to implement an automatic and transparent verification method for xUML. Since a translation-based approach is used, a key aspect to achieve transparency is the automatic generation of counter-examples for verified properties that have a false result during the analysis, in terms of the original xUML model. We describe in this paper how we achieve this using model transformation technology.

Model Driven Engineering promotes models as the core assets of projects and hence model transformations become first-class citizens in this approach. Likewise, the development of large scale transformations necessitates a systematic engineering process and supporting modelling notations. However, although many languages have been proposed to implement transformations, few allow their specification at a higher level of abstraction. In this paper we present a visual, formal, declarative specification language to express model-to-model transformations and their correctness properties. The language supports the two main approaches to model-to-model transformation -- trace-based and traceless -- with a unified formal semantics. Moreover, we provide a compilation of specifications into OCL as this has many practical applications, e.g. it allows injecting assertions and correctness properties for automated testing of transformation implementations based on OMG standards.

Abstract The use of digital document management and processing is increasing. Traditional workflows of paper forms are being replaced by electronic workflows of digital documents. These workflows often require multiple signatures to be added to the documents for authorization and/or integrity. We describe examples of digital workflows that illustrate problems with digital signatures: i.e. the use of digital signatures across entire documents results in signatures that can be unnecessarily invalidated by subsequent modification of the document. We propose the use of fragment signatures, which reduce unnecessary invalidation of signatures and enable greater concurrency in workflows. Our approach is document‐centric and does not use a centralized database. We report on an implementation that allows fragment signatures over document fragments as well as the attachment (or embedding) of other documents. This allows collaborative or cooperative editing to occur on parts of a document without disturbing unrelated signatures. We describe the lessons learned from our deployments and offer further ways to embed such signatures into other document types. Copyright © 2010 John Wiley & Sons, Ltd.

Model management is the discipline of managing artefacts used in Model-Driven Engineering (MDE). A model management framework defines and implements the operations (such as transformation or code generation) required to manipulate MDE artefacts. Modern approaches to model management generally implement these operations via domain-specific languages (DSLs). This paper presents and compares the principles behind three approaches to implementing DSLs for model management and identifies some of the key differences between DSL engineering in general and for model management. It then shows how theory relates to practice by illustrating how DSL design and implementation approaches have been used in practice to build working languages from the Epsilon model management framework. A set of questions for guiding the development of new model management DSLs is summarised, and data on development costs for the different approaches is presented.

The Eclipse graphical modeling framework (GMF) provides substantial infrastructure and tooling for developing diagram-based editors for modelling languages atop the Eclipse platform. It is widely accepted that implementing a visual editor using the built-in GMF facilities is a particularly complex and error-prone task and requires a steep learning curve. We present an approach that raises the level of abstraction at which a visual editor is specified. The approach uses annotations at the metamodel level. Annotations are used for producing the required low-level intermediate GMF models necessary for generating an editor via model-to-model transformations.

A software development process is effectively an abstract form of model transformation, starting from an end-user model of requirements, through to a system model for which code can be automatically generated. The success (or failure) of such a transformation depends substantially on obtaining a correct, well-formed initial model that captures user concerns. Model-based testing automates black box testing based on the model of the system under analysis. This paper proposes and evaluates a novel model-based testing technique that aims to reveal specification/requirement-related errors by generating test cases from a test model and exercising them on the design model. The case study outlined in the paper shows that a separate test model not only increases the level of objectivity of the requirements, but also supports the validation of the system under test through test case generation. The results obtained from the case study support the hypothesis that there may be discrepancies between the formal specification of the system modeled at developer end and the problem to be solved, and using solely formal verification methods may not be sufficient to reveal these. The approach presented in this paper aims at providing means to obtain greater confidence in the design model that is used as the basis for code generation.

Model-driven engineering (MDE) introduces additional challenges for managing evolution. For example, a metamodel change may affect instance models. Existing tool supported approaches for updating models in response to a metamodel change assume extra effort from metamodel developers. When no existing approach is applicable, metamodel users must update their models manually, an error prone and tedious task. In this paper, we describe the technical challenges faced when using the eclipse modeling framework (EMF) and existing approaches for updating models in response to a metamodel change. We then motivate and describe alternative techniques, including: a mechanism for loading, storing and manipulating inconsistent models; a mapping of inconsistent models to a human-usable notation for semi-automated and collaborative co-evolution; and integration with an inter-model reference manager, achieving automatic consistency checking as part of metamodel distribution.

Abstract We present a new concurrency model for the Eiffel programming language. The model is motivated by describing a number of semantic problems with the leading concurrency model for Eiffel, namely SCOOP. Our alternative model aims to preserve the existing behaviour of sequential programs and libraries wherever possible. Comparison with the SCOOP model is made. The concurrency aspects of the alternative model are presented in CSP along with a model of exceptions. The results show that while the new model provides increased parallelism, this comes with the price of increased overhead due to lock management.

No abstract available.

We present a set of novel features that we have recently incorporated to model management languages of the Epsilon platform. We provide a detailed discussion on the usefulness of each feature and present motivating scenarios that highlight the benefits they deliver to programmatic model management.

With the advent of domain specific languages for model engineering, detecting inconsistencies between models is becoming increasingly challenging. Nowadays, it is not uncommon for models participating in the same development process to be captured using different modelling languages and even different modelling technologies. We present a classification of the types of relationships that can arise between models participating in a software development process and outline the types of inconsistencies each relationship can suffer from. From this classification we identify a set of requirements for a generic inconsistency detection and reconciliation mechanism and use a case study to demonstrate how those requirements are implemented in the Epsilon validation language (EVL), a task-specific language developed in the context of the Epsilon GMT component.

Modern systems modelling languages frequently support the use of multiple views in order to provide flexible, extensible, and rich mechanisms for capturing system characteristics. Architectural description languages (ADLs) often provide many useful capabilities but fail to provide support for ensuring view consistency simply because they present a single view of the system. An ADL used for building dependable systems must provide multiple views. For these kinds of systems, ensuring view consistency is critical so as to provide guarantees about the system as a whole. In this paper, we outline an architectural modelling language, AIM, which supports multiple views, but we focus on its first-class support for dependency links, which are used to ensure view consistency. We illustrate the principles on examples from a real engine control system.

Model-driven software development (MDSD) is a class of approaches to building software systems that rely on the use of so-called models, i.e. descriptions of interesting characteristics of systems. MDSD has become increasingly popular and widespread with the ascendance of the Unified Modelling Language (UML) as the de facto standard modelling language. There are a variety of different approaches to MDSD, including the Object Management Group's Model-Driven Architecture (MDA), which supports a particular kind of model (those written in languages that conform to the OMG's MOF standard), a particular approach to using models (via transformation), and a specific reliance on standards (such as MOF, UML, and XMI). This book gives a thorough and general overview of MDSD, including an introduction to MDA, and covering the full process, from modelling through to implementation of models. It aims to explain the key characteristics of MDSD to a variety of interested and experienced parties: domain experts (e.g. business analysts, certification authorities), software engineers, programmers, and managers. The authors are practitioners with a wealth of industrial experience in MDSD. Both are also involved in cutting-edge research and development in this area, particularly in the well-known openArchitectureWare open-source project. There are many books that touch on aspects of MDSD. However, there are very few that are targeted at an experienced audience while attempting to thoroughly cover the fundamental ideas of MDSD and the advanced research topics. Part I concentrates on the fundamental definitions, terminology, and concepts that pervade MDSD. It attempts, and generally succeeds, in distilling the principles of MDSD, while not getting bogged down in the acronyms. It also links modelling ideas with other hot topics, such as domain-specific languages, generative programming, and software factories. However, this part of the book, which includes meta-programming and agile development, seems too broad for someone with only cursory familiarity with the area. Part II concentrates on a key topic in the book, domain architectures. The focus here is on a critical problem, aligning architectural modelling and development with more general MDSD techniques, such as the use of UML, domain-specific languages, code generation, and metamodelling. Constructing domain-specific languages for particular architectures is discussed, as is the problem of building transformations. A helpful section concentrates on advice on building general transformations, and distills a number of elegant principles. The main concern I have with this part of the book is that it jumps around quite a bit: metamodelling is discussed and then building domain architectures (where transformations are introduced). After code generation is discussed, transformations are discussed again. Some restructuring and rationalization would have improved readability here. Part III brings in the important process and engineering aspects. This part of the book concentrates on issues that are often overlooked in MDSD textbooks, and provides substantial pragmatic advice on key issues in applying MDSD in anger: how to test the models produced using MDSD; how to validate models; how to manage different versions of models; and best practices. This part of the book is very clear and well organized, and particularly benefits from detailed case studies illustrating the best practices. Part IV concludes the book with a discussion on management issues. This includes a thorough overview of organization (i.e. how to assign roles in MDSD), product development models, quality, and adoption strategies. The latter chapter is particularly distinctive. I very much like the emphasis on risk analysis within the management framework, and this is a particular novelty of the textbook. An important point is that case studies appear in all parts of the book and attempt to illustrate all of the ideas that are introduced. The case studies themselves are challenging, non-trivial, and realistic. The book attempts, quite successfully, to present a large number of complex ideas, practices, and tools in short order. It is a practical book, and the fact that it considers management, advanced concepts such as domain-specific languages and domain architectures, and integrates substantial case studies make it of particular value to engineers and researchers. However, the book is not well suited to novices, or probably even to engineers and researchers without a great deal of experience in modelling and model-driven development. It is unsuitable for novices because it lacks a good conceptual model for MDSD. The book would be improved by including a conceptual model that describes the basic principles underlying MDSD, outlines the standards (and their relationships to the principles), and then explains how tools and related topics (like domain-specific languages and agile development) fit in to support these standards. The breadth of the book is both a strength and a weakness. While it thoroughly covers many techniques, it presents a broad swath of ideas and concepts without sufficient guidance on where to start. More guidance very early on in the book, on how to understand the tangled web of concepts and techniques presented, is needed. Similarly, the case studies in the book are both a strength and a weakness. The case studies are excellent—and non-trivial—but they are all quite similar. It would have been interesting to see MDSD applied to very different systems, e.g. a large-scale safety critical system, a real-time distributed system. I think the case studies do make a strong argument for the value of MDSD, but some readers who work in these domains will remain unconvinced. Finally, in Chapter 18, an attempt is made to provide evidence that there is a strong economic argument to use MDSD. I found this argument somewhat unconvincing, predominantly because it is based on limited (and less than diverse) data, and the analysis is predominantly qualitative. I think the case for MDSD can and has been made more rigorously, and managers should be made aware of this evidence. Despite these concerns, the book does have substantial value to experienced researchers and engineers who are likely already familiar with many of the ideas in MDSD. The book does coherently collect a large number of ideas in a single place, which is valuable. I would not recommend this book for use as a textbook directly, although it would have a substantial role to play as a supplementary textbook in an advanced course on software engineering.

Modern online multiplayer games are complex heterogeneous distributed systems comprised of servers and untrusted clients, which are often engineered under considerable commercial pressures. Under these conditions, security breaches allowing clients to employ illegal behaviours have become common; current commercial approaches have limited capabilities for reacting rapidly to such threats. This paper presents an approach to the detection of a cheating player, and describes a proof-of-concept system designed to detect cheating play (specifically wall-hacking) through the analysis of player behaviour. This approach differs from current methods in that it does not rely on knowledge about specific vulnerabilities and their method of exploitation in order to protect the system, but instead monitors player behaviour for indications of cheating play. Statistical evidence is presented which shows that the proof-of-concept correctly distinguishes between most cheating and non-cheating players.

The Knowledge engineering (KE) techniques are essentially based on the knowledge transfer approach, from domain experts directly to systems. However, this has been replaced by the modelling approach which emphasises using conceptual models to model the problem-solving skill of the domain expert. This paper discusses extending the Unified Modelling Language by means of a profile for modelling knowledge-based system in the context of Model Driven Architecture (MDA) framework. The profile is implemented using the executable Modelling Framework (XMF) Mosaic tool. A case study from the health care domain demonstrates the practical use of this profile; with the prototype implemented in Java Expert System Shell (Jess). The paper also discusses the possible mapping of the profile elements to the platform specific model (FSM) of Jess and provides some discussion on the Production Rule Representation (FRR) standardisation work.

Abstract The current informal semantics of the simple concurrent object-oriented programming (SCOOP) mechanism for Eiffel is described. We construct and discuss a model using the process algebra CSP. This model gives a more formal semantics for SCOOP than existed previously. We implement the model mechanically via a new tool called CSPsim. We examine two semantic variations of SCOOP: when and how far to pass locks, and when to wait for child calls to complete. We provide evidence that waiting for child calls to complete both unnecessarily reduces parallelism without any increase in safety and increases deadlocks involving callbacks. Through the creation and analysis of the model, we identify a number of ambiguities relating to reservations and the underlying run-time system and propose means to resolve them.

Model-driven development, using languages such as UML and BON, often makes use of multiple diagrams (e.g., class and sequence diagrams) when modeling systems. These diagrams, presenting different views of a system of interest, may be inconsistent. A metamodel provides a unifying framework in which to ensure and check consistency, while at the same time providing the means to distinguish between valid and invalid models, that is, conformance. Two formal specifications of the metamodel for an object-oriented modeling language are presented, and it is shown how to use these specifications for model conformance and multiview consistency checking. Comparisons are made in terms of completeness and the level of automation each provide for checking multiview consistency and model conformance. The lessons learned from applying formal techniques to the problems of metamodeling, model conformance, and multiview consistency checking are summarized.

A secure system is one that is protected against specific undesired outcomes.Delivering a secure system, and particularly a secure web application, is not easy.Integrating general-purpose information systems development methods withsecurity development activities could be a useful means to surmount thesedifficulties Agile processes, such as Extreme Programming, are of increasing interest insoftware development. Most significantly for web applications, agile processesencourage and embrace requirements change, which is a desirable characteristicfor web application development.In this paper, we present an agile process to deliver secure web applications.The contribution of the research is not the development of a new method or processthat addresses security concerns. Rather, we investigate general-purpose informationsystemdevelopment methods (e.g., Feature-Driven Development (FDD)) and mature security methods, namely risk analysis, and integrate them to address the development of secure web applications. The key features of our approach are(1) a process capable of dealing with the key challenges of web applicationsdevelopment, namely decreasing life-cycle times and frequently changing requirements; and (2) an iterative approach to risk analysis that integrates security design throughout the development process.

Abstract. We present a refinement calculus for transforming object-oriented (OO) specifications (or ‘contracts’) of classes into executable Eiffel programs. The calculus includes the usual collection of algorithmic refinement rules for assignments, if-statements, and loops. However, the calculus also deals with some of the specific challenges of OO, namely rules for introducing feature calls and reference types (involving aliasing). The refinement process is compositional in the sense that a class specification is refined to code based only on the specifications (not the implementations) of the classes that the specification depends upon. We discuss how automated support for such a process can be developed based on existing tools. This work is done in the context of a larger project involving methods for the seamless design of OO software in the graphical design notation BON (akin to UML). The goal is to maintain model and source code integrity, i.e., the software developer can work on either the model or the code, where (ideally) changes in one view are reflected instantaneously and automatically in all views.

We contrast modelling languages that are founded on the use of a single model with those founded on use of multiple models. We propose that to best support the seamless and reversible development of reliable software, languages that follow the single-model principle are superior. We define this principle precisely, and discuss when it is insufficient, particularly for early requirements engineering.

The predicative programming design calculus is integrated with an object-oriented method that uses a subset of the Unified Modelling Language. The integration is carried out so as to make the calculus and refinement techniques more applicable to the development of large-scale object-oriented software. The two methods are integrated using a meta-method for formal method integration based on heterogeneous notations. We demonstrate how the methods being integrated complement each other and outline the use of the integrated method in a case study.

The article shows how to make a transition from the Z formal notation to the Business Object Notation (BON). It is demonstrated that BON has the expressive power of Z, with the additional advantages of object-orientation and a supporting seamless development method. The transition is illustrated for some widely used Z constructs. The translation lays the groundwork for a semi-automated tool for extracting classes from Z specifications.

Abstract. We outline an extendible approach for combining formal methods – such as Z, Morgan's refinement calculus, and predicative programming – based on composing specifications written in similar formal languages. We discuss how algorithm refinement can be extended to such a setting, and outline some examples of using integrated formal methods. We also provide justifications for why using combinations of similar methods might be helpful.