Software Process Model (SPM) is an abstraction of the software development process over time to assist in managing the process. SPM has attracted significant attention from researchers and practitioners in the past decades. Due to the complexity of SPM, building a practical process model often requires collaboration between academia and industry. Unfortunately, there are few empirical studies on SPM conducted in collaboration with enterprises. In this paper, we report on the challenges and solutions encountered while modeling software processes based on our collaboration with a global enterprise. These experiences are valuable to both researchers and practitioners. We presented the modeling process in detail and collected all the interview records during collaboration. As a result of building an SPM in the enterprise, we identify seven challenges and discussed solutions for each of them. The fundamental issue with SPM remains the quality and availability of data, even within industry settings. To enhance the value and applicability of models, we propose a checklist for building simulation models. The checklist can be used by modelers and practitioners to verify details that are easily overlooked during the modeling process. Our experience report provides a practical reference with researchers and practitioners who are interested in modeling software process.
Several arguments support the proposition that corporations can be viewed as cognitive entities. But accepting that corporations perform cognitive functions raises questions about how we might describe and assess those functions. In this paper I propose that we can address such questions by viewing corporate cognition in terms of capabilities that are adapted from human cognition. To illustrate this idea, I use the concept of schemas, a human cognitive capability identified by Piaget, which I recast as a corporate cognitive capability. To develop this example, I review schemas as understood in psychology; use scenarios from corporate settings to motivate their relevance to corporations; and describe a hypothetical capability for corporate cognitive schemas using a template that addresses common concerns in enterprise capability modeling. This example gives support to the idea that cognitive capabilities are relevant on the corporate level. It shows that a corporate cognitive capabilities can be practically modeled like conventional business capabilities and that corporate cognitive capabilities can be related to business goals. This work points to a path for practical investigations and applications of a view of corporations as cognitive entities. It further opens a new domain for software process programming.
In microservice platforms with high number of users and heavy traffic, it is necessary to monitor the system, take quick action against errors and ensure the maintainability of the system. However, debugging on these platforms can take a long time. This difficulty arises from the need of understanding the behavior of microservices and detecting their interactions. In this study, which aims to increase the efficiency of DevOps engineers on the work/time unit, it was observed that providing microservice flows and interactions saves operations teams a significant amount of time during debugging. Accordingly, the study focused on microservice interactions and anomaly detection. Firstly, using the log patterns extracted from the microservice logs, different machine learning models were created to predict the previous and next microservices with which the current microservices interacted at a certain moment, and their performances were compared. Then, anomalous data were injected into the microservice logs, models were developed to detect these data and their performances were compared. In the experiments, unsupervised and supervised algorithms are used with 6 different datasets, and successful estimation results were obtained that can contribute positively to the debugging process.
Multi-modeling is an approach within the MDE realm that promotes the development of complex systems by decomposing them in sets of heterogeneous models. These models are defined using different modeling languages and constructed using diverse tools. They represent different but often interdependent views. However, the models of a system are far from being static. They change to accommodate new requirements, functionality improvements, bug fixes, and other evolution events. These changes represent a challenge w.r.t. consistency. This is especially true in security-critical scenarios. Indeed, security information is often integrated within the systems models so that security requirements are met following what is called "security-by-design". In such scenarios, the security concern of the systems models must remain consistent across changes so that security properties continue to hold. In order to tackle this problem, we propose a methodology to enhance the (multi)model-based design phase of a system development process. It comprises the creation of a security federation in which security dependencies between the different models are reified and equipped with security rules expressing security consistency requirements. Then, whenever a model is changed, the security rules are evaluated to monitor the consistency of security across the system models. We evaluate the capabilities of this methodology by a prototype implementation and its application to different use cases.
Many organizations implementing DevOps are adopting DORA metrics to measure their capabilities. Surveys are commonly used to gather the DORA metric data. The data are typically captured only in longer intervals, and on the team level, omitting important details on individual software systems. In this paper, we present a solution that enables completely automated measurement and calculation of the DORA metrics from DevOps tooling on individual microservices level, and in real-time.We evaluated the developed solution in an industrial case study consisting of 37 microservices over a four-week period. The evaluation demonstrated the ability for a completely automated DORA metrics calculation which provides much greater transparency for data-driven decision-making and optimizations on a more fine-granular level allowing teams to continually improve their software processes and outputs.
In large-scale projects operated in regulated environments, standard development processes are employed to meet strict compliance demands. Since such processes are usually complex, providing process users with access to their required process, which should be tailored to a project’s needs is a challenging task that requires proper tool support. In this paper, we present a process ecosystem in which software processes are provided as web-based services. We outline the general idea, describe the modeling approach, and we illustrate the concept’s realization using a proof-of-concept case based on a large software process line that is mandatory to use for IT projects in the German public sector. The suitability is evaluated with three experts that valued the improved accessibly and usability of the process and the end-user support tool.
In regulation-intensive domains, software engineering organizations need to demonstrate compliance with process and traceability guidelines. To this end, novel approaches have emerged that support these activities via the automatic checking of constraints. Yet, engineers still need to decide how to fix violated constraints. While some general-purpose state-of-the-art constraint-checking approaches provide basic support for fixing constraint violations, the provided fixing recommendations often lack crucial details. The approaches typically do not analyze the overall constraint to identify which constraint sub-expressions put a restriction on the possible fixing action. For example, a fix suggests “set the parent of requirement R1 to an issue” rather than additionally stating that the “issue needs to be of type ’Change Request’ and in state ’Released” ’. Engineers, therefore, require mental effort to identify such restrictions by analyzing the constraint in detail or require extra time to try out which action completely fixes the constraint violation. In this paper, we propose a mechanism that determines restrictions automatically. We assessed the relevance of our mechanism by inspecting historical engineering data at our industry partner ACME-ATC and found that 92% of actions that engineers executed to fix a violation were non-trivial, i.e., were subject to a restriction. In a controlled experiment, we then obtained preliminary confirmation that our produced restrictions are readable and helpful: on average, participants could complete tasks with restriction details quicker than tasks without restriction details.
Over the years, a substantial body of knowledge of software process improvement (SPI) was accumulated that, among other things, includes numerous success factors that companies should consider when conducting improvement activities. The number of success factors is large and quite often, multiple success factors with similar names and descriptions are available to address a specific phenomenon. This raises the question whether all the success factors are unique and, if not, which ones are actually the same. In this paper, we aim to structure the body of knowledge on success factors in SPI. We conducted a systematic literature review on 103 publications that mention 1.320 success factors. A multi-staged manual and AI-supported analysis reduced the number of success factors to 124, which we categorize into 42 general success factor classes. For 20 of these general success factor classes, we observed a stable number of publications over a period of almost 30 years that, however, show only few success factors constantly studied and re-discovered. A high number of synonyms shows that this area of SPI needs consolidation for which we lay the foundation by providing a big picture and identifying the most relevant success factors as a starting point.
Post-deployment monitoring (PDM) occurs in the late stages of a DevSecOps (DSO) pipeline. Its role in DSO is critical in providing feedback loops on system performance leading to desirable changes achieving long-term system and application sustainment. Containers are the de-facto deployed artifacts in DSO for diverse forms of systems and applications including AI models. Long-term sustainment of containerized AI models requires appropriate metrics for the successful maintenance of optimal container and model computing performance and correct model inference. There is no agreed upon set of metrics that should always be present when monitoring a deployed containerized AI model. The current literature and practice can benefit from a standard baseline of metrics for long-term monitoring of containerized AI models focused on computing and inference. In this paper, we propose a candidate baseline of metrics for consideration as a standard across PDM for any containerized AI model. We present a proof-of-concept (PoC) that implements a baseline of metrics for the continuous monitoring of an operationally deployed containerized AI model. The baseline represents the minimal metrics required for any containerized model deployed and actively operating to ensure successful long-term monitoring and support of optimal operation and performance. The metrics focus on container operation, model operation, and model inference. This paper also details the raw data required for the metrics along with a PoC which demonstrates container engineering for their acquisition. The paper illustrates the baseline as a mix of dynamic metrics that are customized for each problem class (e.g., object detection, regression) and data modality together with static metrics that should be present for any containerized model. The paper further shows that a containerized AI model can be engineered to produce these metrics and describes the benefits of a standardized baseline of metrics to aid in the reduction of power consumption in the global digital enterprise.
One distinctive characteristic of software is its malleability and succeeding opportunity and also need for a constant change. However, in certain types of software, many agencies in the public sector are bound by the laws on competition and financed by governmental budgeting processes. Consequently, the acquiring agencies adapt their processes to what the existing systems allow due to complexities in making changes and modifications. In this paper, we study the relation of public sector software acquisition and delivery, and the continuously changing nature of software. Then, we analyse pain points of evolving software in public sector information systems, and propose technical artefacts to improve the status quo. Finally, to add flexibility to public sector information systems’ acquisition and evolution, we elaborate a novel architectural pattern called Mosaic architecture, based on macroservices, which allows independent subcontracting, development, and deployment. The approach is demonstrated with a real-world industrial study from a public service that has been sketched applying the macroservice principles.
The success of a software organization relies heavily on the quality of its products and services, which in turn are influenced by the knowledge, capability, and experience of the software engineers involved in development processes. It is popular to apply quantitative assessments of software engineers for quality assurance. However, the extent to which it benefits software organizations and how it can be effectively implemented in industrial settings remains unclear. One global Information and Communications Technology (ICT) enterprise has implemented a quantitative assessment practice of software engineer’s outputs to improve its engineering capability and product and service quality. To investigate the benefits and experiences of adopting this practice in industrial settings, we conducted an empirical study using a mixed-method approach (i.e., archive analysis, interviews, and surveys). The results indicate that this practice can benefit the ICT enterprise in terms of standardizing development processes, optimizing team structures, and offering suggestions for training and management, etc. Meanwhile, this paper reports on the best practices to tackle the challenges during the adoption of the practice in the ICT enterprise, e.g., customization for teams and synergy of quantitative and qualitative assessment. In addition, we discuss the implications and recommendations of institutionalizing quantitative engineer assessment in software organizations. For organizations intending to improve software quality from the human aspect, this study provides empirical references on how to implement quantitative engineer assessment meanwhile mitigate potential risks.
In software projects, stakeholders can give valuable feedback on software demonstrations. Demonstrating software early and responding to feedback is crucial in agile development. However, it is difficult for stakeholders who are not on-site customers but end users, marketing people, or designers, etc. to give feedback in an agile development environment. Successful Graphical User Interface (GUI) tests, which show the working GUI with expected software behaviors, can be documented and then demonstrated for feedback. In our new concept, GUI tests are recorded, extended, and demonstrated as videos. A GUI test is divided into several GUI unit tests, which are specified in Gherkin, a semi-structured natural language. For each GUI unit test, a video is generated during test execution. Test steps specified in Gherkin are traced and highlighted in the video. Stakeholders review these generated videos and provide feedback, e.g., on misunderstandings of requirements or on inconsistencies. To evaluate the impact of videos in identifying inconsistencies, we asked 22 participants to identify inconsistencies between (1) given requirements in regular sentences and (2) demonstrated behaviors from videos with Gherkin specifications or from Gherkin specifications alone. Our results show that participants tend to identify more inconsistencies from demonstrated behaviors which are not in accordance with given requirements. They tend to recognize inconsistencies more easily through videos than through Gherkin specifications alone. We conclude that GUI test videos can help stakeholders give feedback more effectively. By obtaining early feedback, inconsistencies can be resolved, thus contributing to higher stakeholder satisfaction.
The microservice architecture enables organizations to shorten development cycles and deliver cloud-native applications rapidly. However, it also brings security concerns that need to be addressed by developers. Therefore, security testing in microservices becomes even more critical. Recent research papers indicate that security testing of microservices is often neglected for reasons such as lack of time, lack of experience in the security domain, and absence of automated test environments. Even though several security scanning tools exist to detect container, containerized workload management (Kubernetes), and network issues, none individually is sufficient to cover all security problems in microservices. Using multiple scanning tools increases the complexity of analyzing findings and mitigating security vulnerabilities. This paper presents a fully automated test tool suite that can help developers address security issues in microservices and resolve them. It targets to reduce time and effort in security activities by encapsulating open-source scanning tools into one suite and providing improved feedback. The developed security scanning suite is named Pomegranate. To develop Pomegranate, we employed Design Science and conducted our investigation in Ericsson. We have evaluated our tool using a static approach. The evaluation results indicate that the Pomegranate could be helpful to developers by providing simplified and classified outputs for security vulnerabilities in microservices. More than half of the practitioners who give us feedback found Pomegranate helpful in detecting and mitigating security problems in microservices. We conclude that a fully automated test tool suite can help developers to address most security issues in microservices. Based on the findings in this paper, the direction for future work is to conduct a dynamic validation of Pomegranate in a live project.
The rapid growth of software industry has led to a significant increase in the production of a variety of data during software development process, highlighting the apparent need for improved data quality management. As an effective means of software process research and practice, Software Process Simulation Modeling (SPSM) requires large amount and high quality data that precisely depicts what happens during the development process. Accordingly, process simulation models can be used as a reference framework for assessing the issues in data management and data governance from a process perspective. The objective of the work reported in this paper is to provide insights into the data issues in real-world industrial settings and the corresponding coping strategies for software process modelers in particular in order to assist them in preparing and assessing data for their simulation models when conducting effective SPSM in the real-world settings. This paper reports on an empirical investigation that applies software process simulation practices to study the data issues and the data governance strategies based on an industrial case from one global ICT enterprise. As the outcome, a refined process for data preparation is presented, along with a taxonomy of the data issues and the corresponding coping strategies. This paper also explores traceability recovery approaches to mine more accurate process state information from software artifacts and analyzes the impact of the recovered data traceability information by evaluating the improved fidelity of the process simulation model.
Smart contracts executed on blockchains are interactive programs where external actors generate events that trigger function invocations. Events can be emitted by participants asynchronously. However, some functionalities should be restricted to participants inhabiting specific roles in the system, which might be dynamically adjusted while the system evolves. We argue that current smart contract languages adopting imperative programming paradigms require additional complicated access control code. Furthermore, smart contracts are often developed independently and cannot share a joint access control policy. We propose to use Dynamic Condition Response Graphs for role-based and declarative access control for smart contracts. We show that they allow to capture and visualize a form of dynamic access control where access rights evolve as the contract state progresses. Their use supports straight-forward declaration of access control rights, improved code auditing, programming error reduction and improves users' understanding of smart contracts.
Modern software development practices automate software integration and reduce repetitive software engineering work. Automation reduces the time it takes from defining software requirements to deploying the software in production. However, when it comes to database applications, the database integration and deployment are often executed manually, making it costly and error-prone. To mitigate this, we extended current software development methodologies by designing a CI/CD pipeline that takes into consideration the database setting. We report on two industrial case studies in which we implemented a newly designed pipeline and we measure the benefits of integration and deployment automation in database development projects. From a quantitative perspective, we found that introducing CI/CD pipelines reduces failed deployments, improves stability and increases the number of executed deployments. From a qualitative perspective, we interviewed the developers before and after the implementation of the CI/CD pipeline and the results show the CI/CD pipeline brings clear benefits to the development team (i.e., reduced cognitive load). This finding puts current database release practices driven by business expectations such as fixed release windows in question.
Code reviews, while effective, can be crippled by process smells if not performed correctly. A typical process smell that harms the efficacy of code reviews is the 'Looks Good To Me' (LGTM) smell, wherein a reviewer approves a code review task without reviewing the code attentively. Low-quality code reviews can be harmful, as they can cause bugs to slip into a product codebase leading to potentially severe consequences. In this paper, we propose an innovative solution to potentially minimize the occurrence of the LGTM smell commonly found in code reviews. We built a tool that is a proof-of-concept implementation of our solution, which incorporates the concept of mutation testing into code reviews. It provides a platform where pull request authors can apply mutations to the pull request code in GitHub. Reviewer attention and review efficacy are measured based on their mutation score. To the best of our knowledge, our proof of concept implementation is the first-ever code review tool that uses the concept of mutation testing. We validated our proposed solution with eight developers and received promising results.
Containerization allows developers to define the execution environment in which their software needs to be installed. Docker is the leading platform in this field, and developers that use it are required to write a Dockerfile for their software. Writing Dockerfiles is far from trivial, especially when the system has unusual requirements for its execution environment. Despite several tools exist to support developers in writing Dockerfiles, none of them is able to generate entire Dockerfiles from scratch given a high-level specification of the requirements of the execution environment. In this paper, we present a study in which we aim at understanding to what extent Deep Learning (DL), which has been proven successful for other coding tasks, can be used for this specific coding task. We preliminarily defined a structured natural language specification for Dockerfile requirements and a methodology that we use to automatically infer the requirements from the largest dataset of Dockerfiles currently available. We used the obtained dataset, with 670,982 instances, to train and test a Text-to-Text Transfer Transformer (T5) model, following the current state-of-the-art procedure for coding tasks, to automatically generate Dockerfiles from the structured specifications. The results of our evaluation show that T5 performs similarly to the more trivial IR-based baselines we considered. We also report the open challenges associated with the application of deep learning in the context of Dockerfile generation.
Agile methods are well-known approaches in software development and used in various settings, which may vary wrt. organizational size, culture, or industrial sector. One important facet for the successful use of agile methods is the strong focus on social aspects. We know, that cultural values influence the behaviour of humans. Thus, an in-depth understanding of the influence of cultural aspects on agile methods is necessary to be able to adapt agile methods to various cultural contexts. In this paper we focus on an enabler to this problem. We want to better understand the influence of cultural factors on agile practices. The core contribution of this paper is MoCA: A model describing the impact of cultural values on agile elements.
The purpose of this paper is to advance the idea that corporations can be regarded as artificial cognitive entities. Viewed as black boxes, corporations can be seen as widely and frequently regulated, regarded, and active in the same ways as conscious, thinking human beings. Viewed as white boxes, corporations can be seen to incorporate structures and functions analogous to those in the human mind that give rise to awareness and cognition, and they may possess other features that contribute to the realization of cognition in ways not found in humans. While there are certainly differences between humans and corporations in the basis and expression of cognition, the study of cognition in corporations is interesting and instructive and can be pursued as a field of inquiry in its own right. The relevance of software and systems process to corporate cognition is fundamental. Put directly, cognition is a process and corporate cognition is programmable. Thus, what we know from software engineering, process programming, and software and systems process engineering should be directly applicable to the programming (broadly construed) of corporate cognitive systems. An assessment framework such as CMMI (perhaps with a grounding on key cognitive capabilities) should remain broadly applicable to corporate cognitive processes and should serve as a guide to applying best practices in an organization. The study of corporations as artificial cognitive entities should lead to results of scientific interest and practical consequence in many areas, including codification and quantification of measures of corporate cognition, better understanding of corporate cognitive mechanisms, identification of best cognitive practices for corporations, broadening of the discipline of cognitive science, and opportunities for synergism with artificial intelligence applications in corporations. The results may be broadly applicable in society in areas of regulation; investing; employment; business contracting, mergers, and acquisitions; and with respect to ESG (Environmental, Social, and Governance) concerns.
