Search

Nearly all facets of our everyday life strongly depend on software-intensive systems. Besides correctness, highly relevant quality properties of these systems include performance, as directly perceived by the user, and maintainability, as an important decision factor for evolution. These quality properties strongly depend on architectural design decisions. Hence, to ensure high quality, research and practice is interested in approaches to analyze the system architecture for quality properties. Therefore, models of the system architecture are created and used for analysis. Many different languages (often defined by metamodels) exist to model the systems and reason on their quality. Such languages are mostly specific to quality properties, tools or development paradigms. Unfortunately, the creation of a specific model for any quality property of interest and any different tool used is simply infeasible. Current metamodels for quality modeling and analysis are often not designed to be extensible and reusable. Experience from generalizing and extending metamodels result in hard to evolve and overly complex metamodels. A systematic way of creating, extending and reusing metamodels for quality modeling and analysis, or parts of them, does not exist yet. When comparing metamodels for different quality properties, however, substantial parts show quite similar language features. This leads to our approach to define the first reference architecture for metamodels for quality modeling and analysis. A reference architecture in software engineering provides a general architecture for a given application domain. In this paper, we investigate the applicability of modularization concepts from object-oriented design and the idea of a reference architecture to metamodels for quality modeling and analysis to systematically create, extend and reuse metamodel parts. Thus, the reference architecture allows to tailor metamodels. Requirements on the reference architecture are gathered from a historically grown metamodel. We specify modularization concepts as a foundation of the reference architecture. Detailed application guidelines are described. We argue the reference architecture supports instance compatibility and non-intrusive, independent extension of metamodels. In four case studies, we refactor historically grown metamodels and compare them to the original metamodels. The study results show the reference architecture significantly improves evolvability as well as need-specific use and reuse of metamodels.

Informatik-Spektrum 44(2), 82-94 (2020). doi:10.1007/s00287-020-01322-y, Published by Springer, New York

Exchanging data between different systems enables us to build new smart services and digitise various areas of our daily life. This digitalisation leads to more efficient usage of resources, and an increased monetary value. However, the connection of different systems also increases the number of potential vulnerabilities. The vulnerabilities on their own might be harmless, but attackers could build attack paths based on the combination of different vulnerabilities. Additionally, attackers might exploit existing access control policies to further propagate through the system. For analysing this dependency between vulnerabilities and access control policies, we extended an architecture description language (ADL) to model access control policies and specify vulnerabilities. We developed an attack propagation analysis operating on the extended ADL, which can help to determine confidentiality violations in a system. We evaluated our approach by analysing the accuracy and the effort compared to a manual analysis using different scenarios in three case studies. The results indicate that our analysis is capable of identifying attack paths and reducing the effort compared to manual detection.

This is the introductory chapter of the book on the Ernst Denert Software Engineering Award 2020. It provides an overview of the 11 nominated PhD theses, the work of the award winner, and the structure of the book.

The security of software-intensive systems is frequently attacked. High fines or loss in reputation are potential consequences of not maintaining confidentiality, which is an important security objective. Detecting confidentiality issues in early software designs enables cost-efficient fixes. A Data Flow Diagram (DFD) is a modeling notation, which focuses on essential, functional aspects of such early software designs. Existing confidentiality analyses on DFDs support either information flow control or access control, which are the most common confidentiality mechanisms. Combining both mechanisms can be beneficial but existing DFD analyses do not support this. This lack of expressiveness requires designers to switch modeling languages to consider both mechanisms, which can lead to inconsistencies. In this article, we present an extended DFD syntax that supports modeling both, information flow and access control, in the same language. This improves expressiveness compared to related work and avoids inconsistencies. We define the semantics of extended DFDs by clauses in first-order logic. A logic program made of these clauses enables the automated detection of confidentiality violations by querying it. We evaluate the expressiveness of the syntax in a case study. We attempt to model nine information flow cases and six access control cases. We successfully modeled fourteen out of these fifteen cases, which indicates good expressiveness. We evaluate the reusability of models when switching confidentiality mechanisms by comparing the cases that share the same system design, which are three pairs of cases. We successfully show improved reusability compared to the state of the art. We evaluated the accuracy of confidentiality analyses by executing them for the fourteen cases that we could model. We experienced good accuracy.

The development of cyber-physical systems typically involves the association between multiple coupled models that capture different aspects of the system and the environment where it operates. Due to the dynamic aspect of the environment, unexpected conditions and uncertainty may impact the system. In this work, we tackle this problem and propose a taxonomy for characterizing uncertainty in coupled models. Our taxonomy extends existing proposals to cope with the particularities of coupled models in cyber-physical systems. In addition, our taxonomy discusses the notion of uncertainty propagation to other parts of the system. This allows for studying and (in some cases) quantifying the effects of uncertainty on other models in a system even at design time. We show the applicability of our uncertainty taxonomy in real use cases motivated by our envisioned scenario of automotive development.

With the increasing demand for customized systems and rapidly evolving technology, software engineering faces many challenges. A particular challenge is the development and maintenance of systems that are highly variable both in space (concurrent variations of the system at one point in time) and time (sequential variations of the system, due to its evolution). Recent research aims to address this challenge by managing variability in space and time simultaneously. However, this research originates from two different areas, software product line engineering and software configuration management, resulting in non-uniform terminologies and a varying understanding of concepts. These problems hamper the communication and understanding of involved concepts, as well as the development of techniques that unify variability in space and time. To tackle these problems, we performed an iterative, expert-driven analysis of existing tools from both research areas to derive a conceptual model that integrates and unifies concepts of both dimensions of variability. In this article, we first explain the construction process and present the resulting conceptual model. We validate the model and discuss its coverage and granularity with respect to established concepts of variability in space and time. Furthermore, we perform a formal concept analysis to discuss the commonalities and differences among the tools we considered. Finally, we show illustrative applications to explain how the conceptual model can be used in practice to derive conforming tools. The conceptual model unifies concepts and relations used in software product line engineering and software configuration management, provides a unified terminology and common ground for researchers and developers for comparing their works, clarifies communication, and prevents redundant developments.

As systems evolve, analysis results based on models of the system must be updated, in many cases as fast as possible. Since usually only small parts of the model change, large parts of the analysis’ intermediate results could be reused in an incremental fashion. Manually invalidating these intermediate results at the right places in the analysis is a non-trivial and error-prone task that conceals the codes intention. A possible solution for this problem is implicit incrementality, i.e., an incremental algorithm is derived from the batch specification, aiming for an increased performance without the cost of degraded maintainability. Current approaches are either specialized to a subset of analyses or require explicit state management. In this paper, we propose an approach to implicit incremental model analysis capable of integrating custom dynamic algorithms. For this, we formalize incremental derivation using category theory, gaining type-safety and correctness properties. We implement an extensible implicit incremental computation system and validate its applicability by integrating incremental queries. We evaluate the performance using a micro-benchmark and a community benchmark where the integration of explicit query incrementalization was multiple orders of magnitude faster than rerunning the analysis after every change.

Maintaining an automated production system is a challenging task as it comprises artifacts from multiple disciplines – namely mechanical, electrical, and software engineering. As the artifacts mutually affect each other, even small modifications may cause extensive side effects. Consequently, estimating the maintenance effort for modifications in an automated production system precisely is time consuming and often nearly as complicated as implementing the modifications. In this paper, we present the KAMP4aPS approach for architecture-based change impact analysis in production automation. We propose metamodels to specify the various artifacts of the system and modifications to them, as well as algorithms and rules for change propagation analysis based on the models. We evaluate KAMP4aPS for three different change scenarios based on the established xPPU community case study on production automation. In the case study, we investigate different configurations of metamodels and change propagation rules. Evaluation results indicate the accuracy of change propagation for applying KAMP4aPS to the specific metamodel and rules.

Advances in Artificial Intelligence (AI) are associated with a growing complexity of AI models, at the expense of transparency and comprehensibility. The black-box nature of AI components is of particular concern in safety-critical applications, as it can not be guaranteed whether a prediction is correct or not. Incorrect predictions, however, can have serious consequences, e.g., fatal collisions in autonomous driving. Therefore, we propose a novel method for safeguarding AI black-box components based on monitoring input data by using Self-Adaptive Systems (SAS). The presented concepts serve not only as a starting point for runtime approaches (e.g., models at runtime), but also for design-time approaches. As second contribution, we propose an approach for the validation of reconfiguration strategies of SAS's managing uncertain AI black-box components w.r.t. reliability objectives at design-time. We demonstrate the applicability of our approach by a proof-of-concept.

During the development of large software-intensive systems, developers use several modeling languages and tools to describe a system from different viewpoints. Model-driven and view-based technologies have made it easier to define domain-specific languages and transformations. Nevertheless, using several languages leads to fragmentation of information, to redundancies in the system description, and eventually to inconsistencies. Inconsistencies have negative impacts on the system’s quality and are costly to fix. Often, there is no support for consistency management across multiple languages. Using a single language is no practicable solution either, as it is overly complex to define, use, and evolve such a language. View-based development is a suitable approach to deal with complex systems, and is widely used in other engineering disciplines. Still, we need to cope with the problems of fragmentation and consistency. In this paper, we present the Vitruvius approach for consistency in view-based modeling. We describe the approach by formalizing the notion of consistency, presenting languages for consistency preservation, and defining a model-driven development process. Furthermore, we show how existing models can be integrated. We have evaluated our approach at two case studies from component-based and embedded automotive software development, using our prototypical implementation based on the Eclipse Modeling Framework.

The models and data framework demystifies the different roles that models and data play in software development and operation and clarifies where machine learning and artificial intelligence techniques could be used.

Software engineering faces the challenge of developing and maintaining systems that are highly variable in space (concurrent variations of the system at a single point in time) and time (sequential variations of the system due to its evolution). Recent research aims to address this need by managing variability in space and time simultaneously. However, such research often relies on nonuniform terminologies and a varying understanding of concepts, as it originates from different communities: software product-line engineering and software configuration management. These issues complicate the communication and comprehension of the concepts involved, impeding the development of techniques to unify variability in space and time. To tackle this problem, we performed an iterative, expert-driven analysis of existing tools to derive the first conceptual model that integrates and unifies terminologies and concepts of both dimensions of variability. In this paper, we present the unification process of concepts for variability in space and time, and the resulting conceptual model itself. We show that the conceptual model achieves high coverage and that its concepts are of appropriate granularity with respect to the tools for managing variability in space, time, or both that we considered. The conceptual model provides a well-defined, uniform terminology that empowers researchers and developers to compare their work, clarifies communication, and prevents redundant developments.

Validating the effectiveness of reconfiguration strategies of Self-Adaptive Systems (SAS) regarding their impact on runtime quality properties is a challenging problem at design time. Since quality properties, such as performance or reliability, are effectively observable at runtime, it is inherently difficult to validate reconfiguration strategies at design-time during their design (e.g., during the definition of the software architecture). Furthermore, engineering and validating SAS at design-time involves uncertainties that are difficult to manage due to a dynamic operating environment. Therefore, we propose a novel model-based analysis approach that is driven by a temporal probabilistic model which captures the stochastic nature of the operating environment. The sampled trajectories through the state space serve as a basis for validation. Software engineers benefit from the framework by validating their reconfiguration strategy regarding quality objectives before implementation. The validated strategy serves as starting point for further model-based analyses such as correctness verification of adaptation logic or scenario-based analysis for local optimization.

Advances in Machine Learning (ML) have brought previously hard to handle problems within arm's reach. However, this power comes at the cost of unassured reliability and lacking transparency. Overcoming this drawback is very hard due to the probabilistic nature of ML. Current approaches mainly tackle this problem by developing more robust learning procedures. Such algorithmic approaches, however, are limited to certain types of uncertainties and cannot deal with all of them, e.g., hardware failure. This paper discusses how this problem can be addressed at architectural rather than algorithmic level to assess systems dependability properties in early development stages. Moreover, we argue that Self-Adaptive Systems (SAS) are more suited to safeguard ML w.r.t. various uncertainties. As a step towards this we propose classes of dependability in which ML-based systems may be categorized and discuss which and how assurances can be made for each class.

The need to improve software engineering practices is continuously rising and software development practitioners are highly interested in improving their software systems and the methods to build them. And well, software engineering research has numerous success stories. The Ernst Denert Software Engineering Award specifically rewards researchers that value the practical impact of their work and aim to improve current software engineering practices. This chapter summarizes the awards history as well as the current reward process and criteria.

Multi-view environments for software development allow different views of a software system to be defined to cover the requirements of different stakeholders. One way of ensuring consistency of overlapping information often contained in such views is to project them “on demand” from a Single Underlying Model (SUM). However, there are several ways to construct and adapt such SUMs. This paper presents four archetypal approaches and analyses their advantages and disadvantages based on several new criteria. In addition, guidelines are presented for selecting a suitable SUM construction approach for a specific project.

Automated production systems (aPSs) are often in operation for several decades. Due to a multiplicity of reasons, these assets have to be maintained and modified over the time multiple times and with respect to multiple engineering domains. An increased economic pressure demands to perform these tasks in an optimized way. Therefore, it is necessary to estimate change effects with respect to multidisciplinary interdependences, required surrounding non-functional tasks and the effort and costs included in each step. This paper outlines available cost estimation methods for PLC-based automation and Information Systems (ISs). We introduce Karlsruhe Architectural Maintainability Prediction for aPS (KAMP4aPS), an approach to estimate the necessary maintenance tasks to be performed and their related costs for the domain of aPSs by extending KAMP, which is limited to change propagation analysis on ISs. KAMP requires a metamodel to derive these tasks automatically. Unfortunately, a domain spanning metamodel is missing for aPSs. Hence, we need to develop a part of the metamodel derived from an AutomationML description for the chosen demonstrator at first. Finally, we apply and compare different estimation methods and KAMP4aPS to analyze the exchange of a fieldbus system as exemplary change scenario on a lab size plant to demonstrate the benefits of our discipline-spanning approach.

Model-driven engineering (MDE) has proved to be a useful approach to cope with today’s ever-growing complexity in the development of software systems; nevertheless, it is not widely applied in industry. As suggested by multiple studies, tool support is a major factor for this lack of adoption. In particular, the development of model transformations lacks good tool support. Additionally, modularization techniques are inevitable for the development of larger model transformations to keep them maintainable. Existing tools for MDE, in particular model transformation approaches, are often developed by small teams and cannot keep up with advanced tool support for mainstream general-purpose programming languages, such as IntelliJ or Visual Studio. Internal DSLs are a promising solution to these problems. In this paper, we investigate the impact of design decisions of an internal DSL to the reuse of tool support and modularization concepts from the host language. We validate our findings in terms of understandability, applicability, tool support, and extensibility using three case studies from academia, a model-driven engineering platform, and the industrial automation domain where we apply an implementation of an internal model transformation language on the .NET platform. The results confirm the value of inherited modularity and tool support while conciseness and understandability are still competitive.

Modern software systems are often so complex that a comprehensive description of their functionality lies beyond the representative capabilities of a single paradigm or software description format (i.e. type of model). Therefore, a growing variety of heterogeneous representations (e.g. specifications, models, programs etc.) are typically used in the various phases of software development to describe different aspects of a system's behaviour. These essentially represent different conceptual views of a software system, and usually present overlapping information that needs to be kept consistent. Traditional software engineering environments have implicitly adopted a synthesis-based approach to views in which the different representations of software systems are treated as separate, sovereign artefacts. The properties of the system under development are then inferred by synthesising the information spread over the different views, and the overall coherence of the information is ensured by maintaining a large number of pairwise correspondences between the separate artefacts.

In contrast to other engineering disciplines, software engineering lacks an understanding of the impact of design decisions on system quality properties as well as common standards and community case studies for comparing and evaluating research methods and results. In this paper, we address these shortcomings by offering infrastructure for modeling and analyzing system quality properties. A model-based software architecture simulator avoids costly changes of software after it has been delivered and a community case study enables collaboration between researches and allows for comparing research results.

One of the most common usage scenarios for Cloud-IoT applications is Sensing-as-a-Service, which focuses on the processing of sensor data in order to make it available for other applications. Auto-scaling is a popular runtime management technique for cloud applications to cope with a varying resource demand by provisioning resources in an autonomous manner. However, if an auto-scaling system cannot provide the required resources, e.g., due to cost constraints, the cloud application is overloaded, which impacts its performance and availability. We present a feedback control mechanism to mitigate and recover from overload situations by adapting the send rate of smart devices in consideration of the current processing rate of the cloud application. This mechanism supports a coupling with the widely used threshold-based auto-scaling systems. In a case study, we demonstrate the capability of the approach to cope with overload scenarios in a realistic environment. Overall, we consider this approach as a novel tool for runtime managing cloud applications.

Preservation of confidentiality has become a crucial quality property of software systems that software vendors have to consider in each development phase. Especially, neglecting confidentiality constraints in the software architecture leads to severe issues in later phases that often are hard to correct. In contrast to the implementation phase, there is no support for systematically considering confidentiality in architectural design phases by means of data processing descriptions. To fill this gap, we introduce data flows in an architectural description language to enable simple definition of confidentiality constraints. Afterwards, we transform the software architecture specification to a logic program to find violated confidentiality constraints. In a case study-based evaluation, we apply the analysis to sixteen scenarios to show the accuracy of the approach.

Cloud-loT Applications consist of thousands of smart devices sending sensor data to processing cloud applications. If the processing rate of the cloud application is limited it may be unable to cope with an increasing number of connected devices. If such a situation is not addressed, the cloud application is overloaded with messages, resulting in a high processing delay or loss of data. For this reason we propose a TCP-inspired congestion avoidance which reconfigures the send rate of devices at runtime aiming for a low processing delay and a high throughput. We show, that it is able to avoid congestions by adapting the send rate of devices to a fair share of the processing rate of the cloud application.

Modelling is central for business process and software architecture documentation and analysis. However, business processes and software architectures are specified with their own highly developed languages, methods and tools. There are approaches in the literature for modelling privacy and security issues using existing business process or architecture modelling languages to express different requirements by enriching these languages with annotations. Nevertheless, there is a lack of formalization and therefore the potential use for tool-based analyses are limited. In addition, the continuity between business and software models is not granted, but when modelling compliance requirements like privacy, traceability is very important, e.g. for compliance checks. In this contribution, approaches for modelling security and privacy in business and software models are examined. One key finding is that there is currently no comprehensive modelling approach which covers the necessary aspects and perspectives. This could include processes as well as, for example, organizational and data structure questions. In conclusion, we suggest developing a new holistic modelling approach which includes the needed aspects and with a concept for the traceability of the requirements from business models to software architecture models.

The amount of data to be processed by experiments in high energy physics (HEP) will increase tremendously in the coming years. To cope with this increasing load, most efficient usage of the resources is mandatory. Furthermore, the computing resources for user jobs in HEP will be increasingly distributed and heterogeneous, resulting in more difficult scheduling due to the increasing complexity of the system. We aim to create a simulation for the WLCG helping the HEP community to solve both challenges: a more efficient utilization of the grid and coping with the rising complexity of the system. There is currently no simulation in existence which helps the operators of the grid to make the correct decisions while optimizing the load balancing strategy. This paper presents a proof of concept in which the computing jobs at the Tier 1 center GridKa are modeled and simulated. To model the computing jobs we extended the Palladio simulator with a mechanism to simulate load balancing strategies. Furthermore, we implemented an automated model parameter analysis and model creation. Finally, the simulation results are validated using real-word performance data. Our results suggest that simulating larger parts of the grid is feasible and can help to optimize the utilization of the grid.

Managed Software Evolution; Springer 107-139 (2019). doi:10.1007/978-3-030-13499-0_6, Published by Springer

This chapter introduces the book and motivates managed software evolution. Moreover, the structure of the book is outlined.

Managed Software Evolution; Springer 207-253 (2019). doi:10.1007/978-3-030-13499-0_9, Published by Springer

Managed Software Evolution; Springer International Publishing 335-374 (2019). doi:10.1007/978-3-030-13499-0_12, Published by Springer International Publishing

In this chapter we provide an overview on the demonstrators of the SPP1593’s case studies. To study evolution, it is important to collaborate by a joint research that supports sharing of knowledge and resources. In order to support joint research, collaboration and replication in empirical studies based on common evolution scenarios and artefacts are required. These studies are rarely reusable as important artefacts (e.g. requirements, design decisions, architectural knowledge, or context knowledge) are often not provided to the community. To overcome these shortcomings in the SPP1593, two case studies are used: CoCoME, which represents a knowledge base for collaborative empirical research on information system evolution, and the xPPU, which represents a lab-size demonstrator for investigating research on evolution in machine and plant automation. Finally, to blur the boundaries between pure information systems and automated production systems, both case studies were integrated as Industry 4.0 demonstrator.

As long-living systems, automated Production Systems (aPS) have to be adapted due to optimization and inclusion of new features in their life cycle over decades. aPS consist of electrical, mechanical, and software components, which have a complex interaction and mutual dependencies. Consequently, these heterogeneous components have to be maintained together. Thus, the change propagation analysis in aPS is a challenging task. Existing approaches to change impact analysis lack tool-support and require expert knowledge in the aPS, as well as in the machine under study and its environment. This paper presents a tool-supported approach to change propagation analysis in aPS based on initial change requests. Our approach calculates a list of maintainability tasks to implement change requests in control programs deployed on Programmable Logic Controllers (PLC). To evaluate the quality and coverage of the generated task lists, we applied our approach to a community case study.

Software designers often lack an understanding of the effects of design decisions on quality properties of their software. This results in costly and time-consuming trial-and-error testing, delayed and complicated rollouts of the software. In this tool demonstration paper we present an integrated tool environment - the Palladio-Bench - for modeling and analyzing software architectures. The analysis results provided by Palladio support making design decisions by identifying the best-suited design from a set of given alternatives. The demonstration video for the Palladio-Bench can be found at the URL https://youtu.be/vG7WQPcp-uI.

A CloudIoT solution typically connects thousands of IoT things with cloud applications in order to store or process sensor data. In this environment, the cloud applications often consist of microservices which are connected to each other via message queues and must reliably handle a large number of messages produced by the IoT things. The state of a message queue in such a system can be a challenge if the rate of incoming messages continuously exceeds the rate of outgoing messages. This can lead to performance and reliability degradations due to overloaded queues and result in the unavailability of the cloud application. In this paper we present a case study to investigate which performance metrics to be used by a threshold-based auto-scaler for scaling consuming microservices of a message queue in order to prevent overloaded queues and to avoid SLA violations. We evaluate the suitability of each metric for scaling I/O-intensive and compute-intensive microservices with constant and varying characteristics, such as service time. We show, that scaling decisions based on message queue metrics are much more resilient to microservice characteristics variations. In this case, relying on the CPU utilization may result in massive overprovisioning or no scaling decision at all which could lead to an overloaded queue and SLA violations. We underline the benefits of using message queue metrics for scaling decisions instead of the more traditional CPU utilization particularly for I/O-intensive microservices due to the vulnerability to variations in the microservice characteristics.