Autonomous systems are increasingly deployed across critical domains, yet research on trustworthy autonomous systems (TAS) appears to lack an agreed-upon, operationalizable taxonomy for trustworthiness characteristics. While trustworthy artificial intelligence (TAI) frameworks offer measurable characteristics with more established metrics, TAS literature tends to be fragmented with high-level models that can be difficult to apply in practice. This paper investigates the extent of alignment in TAS trustworthiness research and identifies potential sources of misalignment, including differences in system definitions, autonomy properties, stakeholder perspectives, and domain requirements. Based on this analysis, we synthesize a foundational two-pillar core of trustworthiness, the system’s ability to dependably do what it is intended to do and the extent to which stakeholders can assess and justify confidence in this behavior. We propose an initial operationalization of this core using characteristics adapted from established TAI frameworks for which metrics and evaluation methods exist, and outline how it can be applied to specific application contexts. An example shows how stakeholder analysis guides characteristic adaptation.

The landscape of modern computing systems is shifting towards architectures built by combining available services under the “everything as a service” paradigm. These architectures are deployed on distributed cloud-edge infrastructures, aiming to provide innovative services to a wide range of users. However, it is crucial for these systems to address environmental sustainability concerns. This poses challenges in operating such systems in open, dynamic, and uncertain environments while minimizing their energy consumption. To tackle these challenges, we propose a decentralized service assembly approach that ensures the assembly is energetically self-sustainable by relying on locally harvested and stored energy. In our contribution, we introduce a general service selection template that enables the derivation of different selection policies. These policies guide the construction and maintenance of the service assembly. To evaluate their effectiveness in meeting the sustainability requirements, we conduct a comprehensive set of simulation experiments, providing valuable insights.

Self-adaptive systems increasingly rely on black-box predictive models, such as Neural Networks, for decision-making and adaptation planning. In this case, adaptation decisions and their potential impact on the surrounding environment are hard to explain. Further, the opaque nature of these models often involves expensive optimization techniques. The computational complexity is a consequence of the inability to directly observe or comprehend the internal mechanisms of the black-box predictive models. This requires iterative methods to explore a possibly large search space and optimize according to many objectives, creating a critical challenge in balancing effectiveness and cost. In this article, we propose explanation-driven self-adaptation, a novel approach that embeds model-agnostic interpretable machine learning techniques into the feedback loop. In particular, we present XDA-II, an extended version of XDA that integrates multiple explanation sources. This new version combines Partial Dependence Plots and Feature Importance to maintain interpretability while boosting efficiency. Beyond interpretability benefits, explanations become instrumental to guide adaptations through white-box optimization, which is more cost-effective than black-box optimization due to the transparency and predictable mathematical properties of the functions involved. Our empirical evaluation using six study subjects shows that XDA-II achieves more efficient convergence towards optimal adaptation solutions compared to four selected baseline methods including existing black-box methods—random search, NSGA-III, and FITEST—and white-box methods—the predecessor XDA.

Falsification is a popular simulation-based testing method for Cyber-Physical Systems to find inputs that violate a formal requirement. It employs optimization algorithms to minimize a robustness metric that defines the satisfaction of a given property over an execution trace. Despite falsification representing an established approach, detecting violations considering many, possibly independent, requirements simultaneously, under flaky simulations is an open problem. We address this problem by proposing a novel approach that combines parametric model checking and many-objective optimization. We use parametric model checking to shift part of the complexity of the problem offline. We pre-compute numeric constraints for the satisfaction of all requirements on a parametric specification of the testing scenario. Flaky violations are then detected using many-objective optimization to explore the space of changing factors in the scenario and push the parameters out of all precomputed constraints. The results of our empirical evaluation using four open-source evaluation subjects with increasing complexity (number of requirements) show that our approach can falsify many requirements simultaneously, without hiding their individual contribution. The effectiveness, in terms of quantity and severity of violations, is significantly higher than random search as well as two selected state-of-the-art baseline approaches. Furthermore, the extra offline computation yields a negligible cost.

The field of uncertainty quantification and mitigation in software-intensive and self-adaptive systems is garnering increased interest, especially with the rise of statistical inference methodologies like Bayesian reasoning. These methods typically address uncertain quality attributes embedded within system models by adjusting model parameters. However, the uncertainty related to selecting a specific system model over plausible alternatives has received limited attention. Our work focuses on self-adaptation, exploring methods to tackle uncertainty in model selection. This includes scenarios where one model is chosen over competing alternatives to encapsulate the system’s understanding and anticipate future observations. Our proposed solution augments the conventional feedback loop of self-adaptive systems by combining Bayesian model averaging to mitigate uncertainty and many-objective optimization to take into account multiple, possibly many, dependability requirements at the same time. We carry out an empirical evaluation to study the effectiveness, cost, and scalability of the proposed approach using two case studies with increasing structural complexity and number of dependability requirements. Results show that our approach based on model averaging is significantly better than model selection in terms of satisfied requirements after adaptation (adaptation success frequency). We also show that our approach can deal with large model spaces ( \(\sim 10^{19}\) ) using efficient sampling methods rather than exhaustive model space exploration.

Self-adaptation equips a software system with a feedback loop that resolves uncertainties during operation and adapts the system to deal with them when necessary. Most self-adaptation approaches today use decision-making mechanisms that select for execution the adaptation option with the best-estimated benefit expressed as a set of adaptation goals. A few approaches also consider the estimated (one-off) cost of executing the candidate adaptation options. We argue that besides benefit and cost, decision-making in self-adaptive systems should also consider the estimated risk the system or its users would be exposed to if an adaptation option were selected for execution. Balancing all three concerns when evaluating the options for adaptation to mitigate uncertainty is essential for satisfying stakeholders’ concerns and ensuring the safety and public acceptance of self-adaptive systems. In this article, we present a reference model for decision-making in self-adaptation that considers the estimated benefit, cost, and risk as core concerns of each adaptation option. Leveraging this model, we then present an ISO/IEC/IEEE 42010 compatible architectural viewpoint that aims at supporting software architects responsible for designing robust decision-making mechanisms for self-adaptive systems. We demonstrate the applicability, usefulness, and understandability of the viewpoint through a case study where participants with experience in the engineering of self-adaptive systems performed a set of design tasks in DeltaIoT, an Internet-of-Things exemplar for research on self-adaptive systems.

Antifragility is one of the terms that have recently emerged with the aim of indicating a direction that should be pursued toward the objective of designing Information and Communications Technology systems that remain trustworthy despite their dynamic and evolving operating context. We present a characterization of antifragility, aiming to clarify from a conceptual viewpoint the implications of its adoption as a design guideline and its relationships with other approaches sharing a similar objective. To this end, we discuss the inclusion of antifragility (and related concepts) within the well-known dependability taxonomy, which was proposed a few decades ago with the goal of providing a reference framework to reason about the different facets of the general concern of designing dependable systems. From our conceptual characterization, we then derive a possible path toward the engineering of antifragile systems.

Employing an agile development methodology, particularly Scrum, in a distributed student project setting is challenging for both teachers and involved students. Allowing distributed student teams to self-organize and assign key Scrum roles using various strategies, specifically regarding the locations of students taking on key roles, increases the complexity of such projects. In addition, the interaction of the Project Owner role with the project customer, which occurs outside the distributed student team, adds a new dimension to this problem. This paper investigates the impact of various key role assignment strategies, and their interactions, on the performance of distributed student projects. Furthermore, we investigate the intensity of collaboration within the distributed team and between key project roles, as well as their impact on project performance. We analyzed data collected on 37 distributed student projects conducted over the course of eight academic years. The results reveal that letting students assign key project roles regardless of their location in the distributed team has no significant impact on the quality of project outcomes. However, a deeper analysis uncovers that more educationally desirable assignments of those roles exist; favoring increased collaboration intensity within distributed student teams.

Identifying self-admitted technical debt (SATD) plays an important role in maintaining software stability and improving software quality. Although existing methods can detect SATD and researchers have identified design debt and requirement debt, an approach to realize multiple classification of SATD, including defect, test, and documentation, is still lacking. In this paper, we combine text generation oversampling and the Convolutional Neural Networks-Gated Recurrent Unit (CNNGRU) model, and propose an approach called SCGRU to classify multiple debt, including defect, test, documentation, design, and requirement. First, SeqGAN-based text generation is employed to generate new samples by learning the original SATD data, thereby increasing the number of SATD samples such as defect debt and reducing data imbalance. Then, we apply the CNNGRU model to refine SATD into multiple classes. An experiment with cross-project identification of 10 projects shows that our approach is more effective than existing methods such as CNN and text mining. The proposed SCGRU approach has strong advantages especially in cases of flawed debt with very unbalanced data such as test debt and documention debt.

Cyber-physical systems often operate in dynamic environments where unexpected events should be managed while guaranteeing acceptable behavior. Providing comprehensive evidence of their dependability under change represents a major open challenge. In this article, we exploit the notion of equilibrium, that is, the ability of the system to maintain an acceptable behavior within its multidimensional viability zone and propose RUNE 2 (RUNtime Equilibrium verification and Enforcement), an approach able to verify at runtime the equilibrium condition and to enforce the system to stay in its viability zone. RUNE 2 includes (i) a system specification that takes into account the uncertainties related to partial knowledge and possible changes; (ii) the computation of the equilibrium condition to define the boundaries of the viability zone; (iii) a runtime equilibrium verification method that leverages Bayesian inference to reason about the ability of the system to remain viable; and (iv) a resilience enforcement mechanism that exploits the posterior knowledge to steer the execution of the system inside the viability zone. We demonstrate both benefits and costs of the proposed approach by conducting an empirical evaluation using two case studies and 24 systems synthetically generated from pseudo-random models with increasing structural complexity.

Self-adaptive systems increasingly rely on machine learning techniques as black-box models to make decisions even when the target world of interest includes uncertainty and unknowns. Because of the lack of transparency, adaptation decisions, as well as their effect on the world, are hard to explain. This often hinders the ability to trace unsuccessful adaptations back to understandable root causes. In this paper, we introduce our vision of explainable self-adaptation. We demonstrate our vision by instantiating our ideas on a running example in the robotics domain and by showing an automated proof-of-concept process providing human-understandable explanations for successful and unsuccessful adaptations in critical scenarios.

Research on uncertainty quantification and mitigation of software-intensive systems and (self-)adaptive systems, is increasingly gaining momentum, especially with the availability of statistical inference techniques (such as Bayesian reasoning) that make it possible to mitigate uncertain (quality) attributes of the system under scrutiny often encoded in the system model in terms of model parameters. However, to the best of our knowledge, the uncertainty about the choice of a specific system model did not receive the deserved attention.

Abstract The speeding growth of the IT market and the spreading of disruptive technologies are leading towards more and more risky operations in need of constant upkeep, monitoring as well as proactive orchestration. On the one hand, the property allowing a system to be catered by automated monitoring and healing technology is defined as observability . On the other hand, appropriate design principles to manifest observability were originally referred as event sourcing by its inventor Martin Fowler and warrant for the aforementioned sustainable software operations. Both event sourcing and observability are complex to leverage on and design for. In an effort to understand more on both concepts, we offer an experience report on their practical use, featuring: (1) a rigorous definition of software architecture observability and a set of principles to design for observability using augmented forms of well‐known design patterns in line with event sourcing; and (2) an impact analysis in the context of a case study. Our study reveals several interesting notions around the concept of observability but our findings also make explicit new architecture trade‐offs that software architects and stakeholders need to consider as first‐class architecture‐level concerns.

Abstract The process of engineering cyber‐physical systems (CPS) is inevitably challenging because of the intrinsic problem of merging the specification of different ensembles that indicate hardware, software, and physical aspects of such systems. This intrinsic complexity is exacerbated when modelling and analysing the performance characteristics of CPS since multiple models need to coexist in order to get meaningful performance indicators. In this paper, we present a case study, a delivery robots system, whose experience is exploited towards building a guided process for engineering CPS through performance‐based modelling and analysis. Model‐based performance results are provided while analysing different design alternatives, thus to support architects in the process of better understanding the performance characteristics of CPS under development.

One of the primary drivers for self-adaptation is ensuring that systems achieve their goals regardless of the uncertainties they face during operation. Nevertheless, the concept of uncertainty in self-adaptive systems is still insufficiently understood. Several taxonomies of uncertainty have been proposed, and a substantial body of work exists on methods to tame uncertainty. Yet, these taxonomies and methods do not fully convey the research community’s perception on what constitutes uncertainty in self-adaptive systems and on the key characteristics of the approaches needed to tackle uncertainty. To understand this perception and learn from it, we conducted a survey comprising two complementary stages in which we collected the views of 54 and 51 participants, respectively. In the first stage, we focused on current research and development, exploring how the concept of uncertainty is understood in the community and how uncertainty is currently handled in the engineering of self-adaptive systems. In the second stage, we focused on directions for future research to identify potential approaches to dealing with unanticipated changes and other open challenges in handling uncertainty in self-adaptive systems. The key findings of the first stage are: (a) an overview of uncertainty sources considered in self-adaptive systems, (b) an overview of existing methods used to tackle uncertainty in concrete applications, (c) insights into the impact of uncertainty on non-functional requirements, (d) insights into different opinions in the perception of uncertainty within the community and the need for standardised uncertainty-handling processes to facilitate uncertainty management in self-adaptive systems. The key findings of the second stage are: (a) the insight that over 70% of the participants believe that self-adaptive systems can be engineered to cope with unanticipated change, (b) a set of potential approaches for dealing with unanticipated change, (c) a set of open challenges in mitigating uncertainty in self-adaptive systems, in particular in those with safety-critical requirements. From these findings, we outline an initial reference process to manage uncertainty in self-adaptive systems. We anticipate that the insights on uncertainty obtained from the community and our proposed reference process will inspire valuable future research on self-adaptive systems.

Teaching Distributed Software Development with real distributed settings is a challenging and rewarding task. Distributed courses are idiosyncratically more challenging than standard local courses. We have experienced this during our distributed course, which has been run for 14 consecutive years. In this article, we present and analyze the emerging diversities specific to distributed project-based courses. We base our arguments on our experience, and we exploit a three-layered distributed course model, which we use to analyze several course elements throughout the 14-years lifetime of our distributed project-based course. In particular, we focus on the changes that the course underwent throughout the years, combining findings obtained from the analyzed data with our own teaching perceptions. Additionally, we propose insights on how to manage the various diversity aspects.

Distributed Software Development course is a joint project-based course involving three universities, from Croatia, Sweden and Italy, running each year since 2003. Distributed student teams work on all phases of a complex software engineering project, solving several challenges of working in a global environment, thus obtaining a valuable experience for their future careers. The course is very well received by both the students and course partners from the industry.

The modeling and analysis of Cyber Physical Systems (CPS) is inevitably challenging due to the intrinsic problem of merging the specification of different ensembles that indicate hardware, software and physical aspects of such systems. This intrinsic complexity is exacerbated in performance engineering since multiple models need to co-exist in order to get meaningful performance indicators. In this paper we introduce a guided process called IMPACt (multI Modelling PerformAnce Cps),which helps architects during the design phase, to better understand the behavior of the system under development and the design choices they made, through performance analysis on results obtained by runnable models derived from system high-level specification.

Summary Modern software systems are required to dynamically adapt to changing workloads, scenarios, and objectives and to achieve a certain Quality of Service (QoS). Guaranteeing QoS requirements is not trivial, as run‐time uncertainty might invalidate the design‐time rationale, where software components have been selected by means of off‐line analysis. In this work, we propose a QoS‐based feedback approach that makes a combined use of design‐time predictions and run‐time measurements to manage QoS data over time and support software architects while selecting software components that best fit QoS requirements. We illustrate the feasibility and efficacy of the approach on a case study, where the quantitative evaluation shows how the analysis effectively identifies the sources of QoS violations and indicates possible solutions to achieve QoS requirements.

Modern applications, e.g., for pervasive computing scenarios, are increasingly reliant on systems built from multiple distributed components, which must be suitably composed to meet some specified functional and non-functional requirements. A key challenge is how to efficiently and effectively manage such complex systems. The use of self-management capabilities has been suggested as a possible way to address this challenge. To cope with the scalability and robustness issues of large distributed systems, self-management should ideally be architected in a decentralized way, where the overall system behavior emerges from local decisions and interactions. Within this context, we propose GOPRIME, a fully decentralized middleware solution for the adaptive self-assembly of distributed services. The GOPRIME goal is to build and maintain an assembly of services that, besides functional requirements, fulfils also global quality-of-service and structural requirements. The key aspect of GOPRIME is the use of a gossip protocol to achieve decentralized information dissemination and decision making. To show the validity of our approach, we present results from the experimentation of a prototype implementation of GOPRIME in a mobile health application, and an extensive set of simulation experiments that assess the effectiveness of GOPRIME in terms of scalability, robustness and convergence speed.

Presents an editorial discusses the current status and activities supported by this publication.

The inherent dynamic nature of Cyber Physical Systems (CPS) requires novel mechanisms to support their evolution over their operation life time. Though typically the development of CPS integrates the software (cyber) design with the physical domain, this contribution concentrates mainly on another essential integration plane: The software design level. This paper presents an approach to support the adaptation process of CPS required by their evolution. It is based on the run-time generation of verified system configurations and their analysis to guide the evolution of the system through correct configurations that meet the functional and timing requirements of the new situations. We show its feasibility by presenting and analyzing the results of the execution for a reduced-scale time-sensitive application that employs a complex verification technique to model functional and temporal aspects of the system.

The design of the embedded software for industrial systems progressively integrates more intelligent functions to ease the integration between the factory floor hardware and operator-friendly control front ends. New software development paradigms such as service oriented architecture (SOA) make it possible by embedding small footprint web servers inside small embedded devices that are connected to the actuators which they control. In general, the timing requirements of such distributed systems are not in the front plane and temporal guarantees provided by most solutions are typically best effort. iLAND is an example of a middleware that supports communication and reconfiguration of distributed services, ensuring temporal correctness. It includes the logic for adapting the architectural structure of a service-based application (i.e., number and connections of the software pieces/functions) to respond to operator requests in a time-deterministic way, focusing only on the temporal correctness. In this paper, we apply the principles of autonomic computing to the middleware design, and we provide a high-level description on how its verification process could be extended beyond the purely temporal properties using more comprehensive formal techniques. We exemplify these ideas with a modified on-line verification manager that suits the needs of a kind of systems with specific timing and functional constraints.

The complexity of modern software systems has grown enormously in the past years with users always demanding for new features and better quality of service. Besides, software is often embedded in dynamic contexts, where requirements, environment assumptions, and usage profiles continuously change. As an answer to this need, it has been proposed the usage of self-adaptive systems. Self-adaptation endows a system with the capability to accommodate its execution to different contexts in order to achieve continuous satisfaction of requirements. Often, self-adaptation process also makes use of runtime model evaluations to decide the changes in the system. However, even at runtime, context information that can be managed by the system is not complete or accurate; i.e, it is still subject to some uncertainties. This work motivates the need for the consideration of the concept of uncertainty in the model-based evaluation as a primary actor, classifies the avowed uncertainties of self-adaptive systems, and illustrates examples of how different types of uncertainties are present in the modeling of system characteristics for availability requirement satisfaction.

In this paper, we focus on the reliability and availability analysis of Web service (WS) compositions, orchestrated via the Business Process Execution Language (BPEL). Starting from the failure profiles of the services being composed, which take into account multiple possible failure modes, latent errors, and propagation effects, and from a BPEL process description, we provide an analytical technique for evaluating the composite process' reliability-availability metrics. This technique also takes into account BPEL's advanced composition features, including fault, compensation, termination, and event handling. The method is a design-time aid that can help users and third party providers reason, in the early stages of development, and in particular during WS selection, about a process' reliability and availability. A non-trivial case study in the area of travel management is used to illustrate the applicability and effectiveness of the proposed approach.

The analysis of non-functional properties of Service-Based Systems (SBSs) is a complex task, mostly because it requires models that encompass the composition of service properties into architectural properties. For example, the reliability of a SBS is given by the composition of service and interconnection reliabilities. Although several approaches have been introduced in the last few years to address these issues, the tradeoff analysis among non-functional properties of software services has not yet been studied enough. The goal of this paper is to introduce a set of optimization models that allow quantifying the costs of service failure repair/mitigation actions aimed at keeping the whole SBS reliability over a certain threshold. On the basis of our previous work in this area, we first introduce an optimization model aimed at selecting either in-house built or provided services with the goal of minimizing the SBS cost while guaranteeing a certain level of reliability. Thereafter we strengthen the reliability constraints, and we build two different optimization models that aim to solve the same problem under new constraints, where one model starts from the solution obtained in the original model and tries to improve it, while the other one looks for an optimal solution in the whole search space. Finally, we introduce a fourth model, based on stochastic optimization, with the goal of rather searching for solutions that explicitly take into account the stochastic nature of the problem and search for new repair/mitigation actions cheaper than the ones identified by the other models. Each optimization model has been experimented on about 300 variations of a nominal model. The experimental results show the efficacy of our optimization models to quantify the costs of different failure repairing/mitigation actions in different contexts.

Engineering high quality software is a tough task. In order to know whether a certain quality attribute has been achieved or degraded, it has to be quantified by analysis or measured. However, determining what to quantify and how these quantities are related to each other is the difficult part. Early analysis of the quality attributes of a software system on the basis of the system's planned architecture allows informed decisions on design trade-offs. Such decisions can be later validated by measurements on the running system.

Software is often embedded in dynamic contexts where it is subjected to high variable, non-stable, and usually bursty workloads. A key requirement for a software system is to be able to self-react to workload changes by adapting its behavior dynamically, to ensure both the correct functionalities and the required performance. Research on fitting variable workload traces into formal models has been carried out using Markovian Modulated Poisson Processes (MMPP). These works concentrate on modeling stable workload states, but accurate modeling of transient times still deserves attention since they are critical moments for the self-adaptation. In this work, we build on research in the area of MMPP trace fitting and we propose a Petri net fine-grained model for highly variable workloads that also accounts for transient times. We analyze differences between models of adaptive software that accurately represent workload state changes and models that do not. We evaluate their performance and availability and compare the results.

Architecting software systems according to the service-oriented paradigm and designing runtime self-adaptable systems are two relevant research areas in today's software engineering. In this paper, we address issues that lie at the intersection of these two important fields. First, we present a characterization of the problem space of self-adaptation for service-oriented systems, thus providing a frame of reference where our and other approaches can be classified. Then, we present MOSES, a methodology and a software tool implementing it to support QoS-driven adaptation of a service-oriented system. It works in a specific region of the identified problem space, corresponding to the scenario where a service-oriented system architected as a composite service needs to sustain a traffic of requests generated by several users. MOSES integrates within a unified framework different adaptation mechanisms. In this way it achieves greater flexibility in facing various operating environments and the possibly conflicting QoS requirements of several concurrent users. Experimental results obtained with a prototype implementation of MOSES show the effectiveness of the proposed approach.

Systematic decision support for architectural design decisions is a major concern for software architects of evolving service-oriented systems. In practice, architects often analyse the expected performance and reliability of design alternatives based on prototypes or former experience. Model-driven prediction methods claim to uncover the tradeoffs between different alternatives quantitatively while being more cost-effective and less error-prone. However, they often suffer from weak tool support and focus on single quality attributes. Furthermore, there is limited evidence on their effectiveness based on documented industrial case studies. Thus, we have applied a novel, model-driven prediction method called Q-ImPrESS on a large-scale process control system consisting of several million lines of code from the automation domain to evaluate its evolution scenarios. This paper reports our experiences with the method and lessons learned. Benefits of Q-ImPrESS are the good architectural decision support and comprehensive tool framework, while one drawback is the time-consuming data collection.

Service-based systems that are dynamically composed at runtime to provide complex, adaptive functionality are currently one of the main development paradigms in software engineering. However, the Quality of Service (QoS) delivered by these systems remains an important concern, and needs to be managed in an equally adaptive and predictable way. To address this need, we introduce a novel, tool-supported framework for the development of adaptive service-based systems called QoSMOS (QoS Management and Optimization of Service-based systems). QoSMOS can be used to develop service-based systems that achieve their QoS requirements through dynamically adapting to changes in the system state, environment, and workload. QoSMOS service-based systems translate high-level QoS requirements specified by their administrators into probabilistic temporal logic formulae, which are then formally and automatically analyzed to identify and enforce optimal system configurations. The QoSMOS self-adaptation mechanism can handle reliability and performance-related QoS requirements, and can be integrated into newly developed solutions or legacy systems. The effectiveness and scalability of the approach are validated using simulations and a set of experiments based on an implementation of an adaptive service-based system for remote medical assistance.

Nowadays requirements related to quality attributes such as performance, reliability, safety and security are often considered the most important requirements for software development projects. To reason about these quality attributes different stochastic models can be used. These models enable probabilistic verification as well as quantitative prediction at design time. On the other hand, these models could be also used to perform runtime adaptation in order to achieve certain quality goals. This workshop aims to provide a forum for researchers in these areas that should help with the adoption of quantitative stochastic models into general software development processes.

Models can help software engineers to reason about design-time decisions before implementing a system. This paper focuses on models that deal with non-functional properties, such as reliability and performance. To build such models, one must rely on numerical estimates of various parameters provided by domain experts or extracted by other similar systems. Unfortunately, estimates are seldom correct. In addition, in dynamic environments, the value of parameters may change over time. We discuss an approach that addresses these issues by keeping models alive at run time and feeding a Bayesian estimator with data collected from the running system, which produces updated parameters. The updated model provides an increasingly better representation of the system. By analyzing the updated model at run time, it is possible to detect or predict if a desired property is, or will be, violated by the running implementation. Requirement violations may trigger automatic reconfigurations or recovery actions aimed at guaranteeing the desired goals. We illustrate a working framework supporting our methodology and apply it to an example in which a Web service orchestrated composition is modeled through a discrete time Markov chain. Numerical simulations show the effectiveness of the approach.

Runtime adaptation is recognized as a viable way for a service-oriented system to meet QoS requirements in its volatile operating environment. In this paper we propose a methodology to drive the adaptation of such a system, that integrates within a unified framework different adaptation mechanisms, to achieve a greater flexibility in facing different operating environments and the possibly conflicting QoS requirements of several concurrent users. To determine the most suitable adaptation action(s), the methodology is based on the formulation and solution of a linear programming problem, which is derived from a behavioral model of the system updated at runtime by a monitoring activity. Numerical experiments show the effectiveness of our approach. Besides the methodology, we also present a prototype tool that implements it.

Autonomic computing is an emergent field for the development of large-scale, self-managing, complex distributed computer-based systems. This paper aims to be a practical approach to Autonomic Computing, by defining and implementing a generic model for autonomic systems, allowing software developers to create autonomic applications using a common and comprehensive infrastructure. In particular, this paper defines a simple but complete model andarchitecture of an autonomic computing element called SelfLet, which could be the building components used to create autonomic systems. SelfLets can be defined by specifying their behaviour, the abilities and goals they need to use and/or provide, and a high-level policy guiding their self-management.

The high heterogeneity and variability of mobile computing environments can adversely affect the performance of applications running in these environments. To tackle this problem, adaptation techniques can be exploited. Adaptation based on code mobility is a possible solution, as it allows to dynamically modify the load of the hosting nodes and the internode traffic, to adapt to the changing characteristics of computing nodes and network links. In this paper we propose a modeling framework to analyze the performance effectiveness of code mobility based adaptation in a mobile computing environment. A distinguishing feature of our framework is the modeling of both physical and logical mobility as something that can be plugged into a pre-existing architecture model, to ease the analysis of the performance impact of both different physical mobility scenarios, and of different adaptation strategies based on code mobility. To enhance the framework usability, we have adopted UML as modeling language, remaining fully compliant with the latest UML 2.0 specification and with the standard UML Profile for Schedulability, Performance and Time Specification.

Adaptable software architectures (SA) have been suggested as a viable solution for the design of distributed applications that operate in a mobile computing environment to cope with the high heterogeneity and variability of this environment. Mobile code techniques can be used to implement this kind of SA since they allow us to dynamically modify the load of the hosting nodes and the internode traffic to adapt to the resources available in the nodes and to the condition of the (often wireless) network link. However, moving code among nodes has a cost (e.g., in terms of network traffic and consumed energy for mobile nodes), so designing an adaptable SA based on mobile code techniques requires a careful analysis to determine its effectiveness from the early design stages. In this respect, our main contribution consists of a methodology, called ASAP (adaptable software architectures performance), to automatically derive, starting from a design model of a mobility-based SA, a Markov model whose solution provides insights about the most effective adaptation strategy based on code mobility in a given execution environment. We assume that the SA model is expressed using the Unified Modeling Language (UML) because of its widespread use in software design, also suggesting some extension to this formalism to better express the "mobility structure" of the application, i.e., which are the mobile components, and the possible targets of their movement.