Search

On-board embedded software developed for spaceflight systems (space software) must adhere to stringent software quality assurance procedures. For example, verification and validation activities are typically performed and assessed by third party organizations. To further minimize the risk of human mistakes, space agencies, such as the European Space Agency (ESA), are looking for automated solutions for the assessment of software testing activities, which play a crucial role in this context. Over the years, mutation analysis has shown to be a promising solution for the automated assessment of test suites; it consists of measuring the quality of a test suite in terms of the percentage of injected faults leading to a test failure. A number of optimization techniques, addressing scalability and accuracy problems, have been proposed to facilitate the industrial adoption of mutation analysis. However, to date, two major problems prevent space agencies from enforcing mutation analysis in space software development. In this paper, we enhance mutation analysis optimization techniques to enable their applicability to embedded software and propose a pipeline that successfully integrates them to address scalability and accuracy issues in this context, as described above. Further, we report on the largest study involving embedded software systems in the mutation analysis literature. Our research is part of a research project funded by ESA ESTEC involving private companies (GomSpace Luxembourg and LuxSpace) in the space sector. These industry partners provided the case studies reported in this paper; they include an on-board software system managing a microsatellite currently on-orbit, a set of libraries used in deployed cubesats, and a mathematical library certified by ESA., Accepted for publication on IEEE TRANSACTIONS ON SOFTWARE ENGINEERING

We present a metamorphic testing tool that alleviates the oracle problem in security testing. The tool enables engineers to specify metamorphic relations that capture security properties of Web systems. It automatically tests Web systems to detect vulnerabilities based on those relations. We provide a domain-specific language accompanied by an Eclipse editor to facilitate the specification of metamorphic relations. The tool automatically collects the input data and transforms the metamorphic relations into executable Java code in order to automatically perform security testing based on the collected data. The tool has been successfully evaluated on a commercial system and a leading open source system (Jenkins). Demo video: https://youtu.be/9kx6u9LsGxs.

Software faults have a relevant impact on today economy. Modern software systems are often composed by different third-party components, of which developers have only a partial knowledge because of the absence of source code or complete specifications. The lack of complete knowledge about the integrated components is the principal cause of faults, and makes fault diagnosis difficult as well. The increase of maintenance costs and services unavailability is one of the consequences of difficult faults diagnosis. Different automatic diagnosis techniques have been developed to support developers in fault diagnosis activities. Unfortunately the existing techniques present several limitations: Log analysis techniques often require log specifications which are often not available; Fault localization techniques require source code which is often not available too; Automated debugging techniques detect faults only if their effects are visible from the application state; Anomaly detection techniques force developers to manually inspect and interpret a huge quantity of suspicious behaviors thus resulting not effective in practice. This PhD Thesis presents a framework for the diagnosis of software functional faults that advances the state of the art by: (1) Identifying and correlating different kinds of software misbehaviors, thus effectively describing faults with heterogeneous causes; (2) Automatically filtering false positives, thus permitting developers to inspect only anomalous behaviors useful to debug the application; (3) Identifying the cause effect relationships between multiple misbehaviors, thus simplifying the diagnosis activity; (4) Automatically interpreting software misbehaviors, thus permitting developers to immediately diagnose the fault; (5) Evaluating the solution with multiple third-party and industrial case studies, thus demonstrating the effectiveness of the solution.

Product Line Engineering (PLE) is a crucial practice in many software development environments where systems are complex and developed for multiple customers with varying needs. At the same time, many business contexts are use case-driven where use cases are the main artifacts driving requirements elicitation and many other development activities. In these contexts, variability information is often not explicitly represented, which leads to ad-hoc change management for use cases, domain models and test cases in product families. In this thesis, we address the problems of modeling variability in requirements with additional traceability to feature models and the manual and error prone requirements configuration and regression testing in product families. We provide the following contributions: - A modeling method for capturing variability information in product line use case and domain models by relying exclusively on commonly used artifacts in use-case driven development, thus avoiding unnecessary modeling overhead. - An approach for automated configuration of product specific use case and domain models that guides customers in making configuration decisions and automatically generates use case diagrams, use case specifications, and domain models for configured products. - A change impact analysis approach for evolving configuration decisions in product line use case models that automatically identifies the impact of decision changes on other decisions, and incrementally reconfigures product specific use case diagrams and specifications for evolving decisions. - An approach for automated classification and prioritization of system test cases in a family of products that automatically classifies and prioritizes, for each new product, system test cases of previous product(s) in a product line, and provides guidance in modifying existing system test cases to cover new use case scenarios that have not been tested in the product line before. All our approaches have been developed and evaluated in close collaboration with our industry partner IEE.