The introduction of machine learning development paradigm into the automotive software industry has made necessary to update the applicable quality evaluation standards such as Automotive SPICE®. As a result the Automotive SPICE® community timely tackled this challenge with the introduction of the version 4.0 containing a first baseline of process requirements for machine learning engineering. The paper provides a succinct critical analysis of related ASPICE® new content with particular reference to the current state of the art of machine learning development practices. The outcome of this paper aims at being an input for the forthcoming improvement initiatives within the Automotive SPICE working groups.
The rapid integration of Artificial Intelligence (AI) into software systems across many domains, including critical ones such as healthcare, transportation, and public administration, has intensified the need for robust, reliable, and transparent quality evaluation methods. While numerous standards and regulatory initiatives have emerged and many more are being worked on, the current landscape remains fragmented with varying scopes, definitions, and enforcement mechanisms. This paper provides a structured, yet not exhaustive, overview of current international standards, regulatory instruments, and soft-law guidelines relevant to AI-based software quality evaluation. The purpose of this paper is to provide a starting point for practitioners and researchers for understanding the status, as well as the short-coming evolution, of the standards addressing AI-based technologies and for orienting their efforts to contribute to fill the existing lacks and weaknesses in the standard corpus.
Healthcare systems around the world are under pressure to adopt advanced technologies, yet innovation is often stalled by rigid regulatory frameworks, complex procurement procedures, and risk-averse cultures. In contrast, societal crises, such as a pandemic and wartime, catalyze rapid user-driven development and deployment of technologies such as drones, telehealth platforms, and situational awareness systems, demonstrating that even high-risk domains can innovate and rapidly deploy new technologies under extreme conditions. This paper explores what healthcare can learn from these innovation models of social crises, focusing on how agility, minimal viable products (MVPs) and close end-user collaboration can coexist with safety and ethical oversight. By examining real-world cases and drawing parallels with healthcare, we propose actionable strategies to accelerate responsible innovation in healthcare.
Triple-negative breast cancer (TNBC) is an aggressive subtype with poor prognosis and limited treatments, for which accurate pre-operative prediction is essential for guiding therapy. While multiparametric MRI is highly sensitive, its use in multi-center AI workflows is hampered by inter-scanner variability. This study explores Federated Learning with radiomic features from DCE-MRI, and assesses the role of image standardization in improving TNBC classification performance. Data were split across 5 virtual clients to simulate hospitals, each training locally within a federated MLP framework. Results show that image standardization markedly improves TNBC classification, highlighting the role of preprocessing in federated AI pipelines.
The SENTIRE—DPI-uAI project aims to develop an intelligent active hearing protection device for workers in high-noise industrial environments. Combining Internet of Things (IoT) technologies, Machine Learning algorithms, and edge-cloud architectures, SENTIRE enables selective noise filtering to preserve safety-relevant sounds while suppressing harmful ones. At the core of the system are noise-canceling headphones connected via BLE to a wearable device that integrates a DSP module for acoustic signal pre-processing and an embedded CPU for contextual analysis and sound classification. Edge communication is handled via MQTT protocol, while a serverless infrastructure enables interaction with the smart factory. The system demonstrates robust latency and classification performance, confirming the feasibility of selective audio filtering and sub-meter localization accuracy in industrial scenarios [5, 6].
Context: AI technologies are increasingly embedded in products and software engineering processes of industrial IoT, autonomous systems, and cyber-physical systems. It is therefore essential to ensure alignment with safety, reliability, and ethical standards. However, practical software engineering methods for managing misalignment risks remain underdeveloped. Objective: This study aims to explore industry awareness of misalignment risks and current practices for monitoring them within real-world software engineering contexts. Method: We conducted seven interviews with industry professionals to examine perceptions of misalignment risks, gather insights into existing practices, and understand approaches to alignment across various industrial settings. Three recently proposed taxonomies guided our discussions: one on ethical guidelines for trustworthy AI published by the EU, another summarizing identified AI risks, and a third addressing “double-edged components” (aspects of AI systems that can simultaneously yield positive and negative effects.) Results: Our analysis identified common misalignment risks across these settings and revealed limited use of dedicated testing or monitoring for AI alignment. Most organizations rely on general oversight rather than specialized tools. Conclusion: These findings highlight the need to develop tailored governance practices for alignment in industrial software engineering settings.
The C programming language, while offering high performance and low-level control, is memory-unsafe. This makes it prone to programming errors that can result in serious software vulnerabilities and system instability. In this paper, we investigate the feasibility of transitioning a large code base from C to a memory-safe alternative, specifically Rust, in the context of a large company in telecommunications and networking. We explore technical challenges with translation, building on automatic translation with C2Rust, analyze performance impact, and survey developers’ attitudes toward migration. We find that while C2Rust can generate correct code, significant manual effort is required in the translation process, especially to get the benefit of Rust’s safety guarantees. In the internal environment, Rust integration is currently limited, in part by missing compiler support for code closely tied to hardware. Performance results from open-source projects relevant to the company indicate that Rust does not perform significantly worse than C, although further research is needed. Developer attitudes towards a switch were generally positive. Our conclusion is that full migration is currently unfeasible, but gradual adoption is possible. Replication package: https://zenodo.org/records/15754034 .
The Estonian e-government system comprises close to 2000 interfaced information systems that exchange data on the X-tee interoperability layer. To test an information system that uses data received via X-tee as input, test data that resembles real-life data must be obtained. The goal of this study is to identify and describe the existing process of obtaining test data, the supporting factors and challenges that the users of the existing process face, and the impact of the identified challenges on testing. We pose three research questions and answer them with the help of expert knowledge gathered through introspection and an interview study. We found that (i) the current process for obtaining test data is manual and follows varying practices, (ii) the current process relies on humans who can be contacted to acquire test data, it has a range of challenges and the sole supporting factor in the current process is the expert knowledge of humans who create test data, and (iii) the long time and large effort required in the current process to gain even small sets of test data is the challenge that has the most negative effect on testing. We conclude that the current process needs improvement and suggest, in the first stage, the automation of identifying the scope of test data that can be obtained, in second stage, the automatic generation of synthetic test data on demand, and in the final stage, a Synthetic Data Digital Twin as an option to improve the current situation.
Chronic diseases represent a growing challenge for healthcare systems worldwide, particularly in aging populations like Italy, where multimorbidity and functional decline significantly impact care needs. This paper analyzes the epidemiological, clinical, and organizational aspects of chronic disease management, focusing on type 2 diabetes and heart failure. It reviews national care models, including the Chronicity National Plan and Diagnostic-Therapeutic Care Pathways (PDTA), and explores the integration of digital health tools, such as telemedicine, in addressing continuity of care and patient empowerment. Within this framework, the paper presents the TED – The intElligent Doctor at your home project, developed by DIPMED UNISA, as an innovative response to the need for home-based, patient-centered chronic care. TED integrates certified medical devices, telemonitoring platforms, virtual voice assistants, and Internet of Medical Things (IoMT) technologies to enable real-time health monitoring and AI-driven decision support. Designed using a Patient-Centered Design methodology, TED is currently undergoing a controlled clinical trial involving patients with type 2 diabetes and heart failure. The system aims to improve therapeutic adherence, quality of life, and reduce social isolation. In line with Italy’s National Recovery and Resilience Plan (PNRR), TED proposes a scalable, sustainable, and technologically advanced care model for frail and chronic patients.
Although requirements engineering (RE) and user experience (UX) design share similar goals, their processes are typically managed and executed by different roles, often leading to poor requirements communication. To explore communication flows, challenges, and best practices from RE and UX perspectives, we interviewed six experts from four software companies. This article presents our study’s design and findings, comprising two communication flows illustrating requirements elicitation and communication processes in two distinct project contexts (“new development” versus “ongoing development”). Additionally, we discuss key insights from our qualitative analysis. The study’s results are intended to serve as an impetus for future research and guide practitioners to enhance collaboration between the two disciplines.
The rapid growth of renewable energy sources is accelerating the transition towards decentralised electricity systems. However, the variable nature of such sources and user consumption profiles present a significant challenge to achieving a sustainable energy balance. This paper introduces an innovative software system for adaptive energy management in Energy Communities, where a data-driven aggregator collects energy data, defines flexible threshold-based balancing strategies, and coordinates user actions by means of a gamified mobile application. Hence, users would become active participants in the balancing process. We evaluated the proposed system using simulations based on publicly available data. The results showed that our system can be effectively used to address energy fluctuations through coordinated data-driven responses, harnessing the potential of a renewable energy infrastructure.
In high-stakes domains like medicine, AI systems must do more than generate fluent responses—they must ensure that clinical reasoning is safe, auditable, and grounded in verified knowledge. This paper presents a comparative analysis of reasoning outputs produced by large language models and by curated, ontology-grounded AI systems. We use KaiMed—a hybrid multi-agent platform built on GPT-4o-mini and structured medical knowledge—as a representative of the latter approach. Unlike single-model pipelines, KaiMed decomposes reasoning into modular, role-specific agents specialized in diagnosis, treatment planning, literature validation, and safety filtering. Each agent operates over a semantically structured knowledge base, comprising a proprietary clinical ontology and two curated layers: a graph of clinical trials and a semantic retriever built on peer-reviewed literature. This architecture enables traceable, constraint-aware, and clinically aligned reasoning. Our hypothesis is that in medicine, the source, structure, and semantic integrity of knowledge are not technical details—they are prerequisites for reliability and trust. We evaluate both systems on complex prompts in two domains: Inflammatory Bowel Disease (IBD) and Chronic Rhinosinusitis with Nasal Polyps (CRSwNP). Results show that while GPT-4o-mini generates plausible responses, it lacks epistemic grounding and fails to surface non-obvious or investigational options. KaiMed, by contrast, consistently produces evidence-aligned, phenotype-specific recommendations—demonstrating that in Clinical AI, the key differentiator is not model size, but the structure and orchestration of knowledge.
Continuous Integration and Continuous Deployment (CI/ CD) pipelines have grown in popularity in recent years and are essential in streamlining the process of development and deployment of high quality software. However, developers often overlook security concerns in CI/CD pipelines, opening the door to many vulnerabilities. This paper presents an empirical investigation of nine security misconfigurations sourced from a comprehensive review of security guidelines, developer blogs, GitHub documentation, and prior research. To study the presence, co-occurrence and yearly trends of these security misconfigurations within current CI/CD practices, we analyzed a large dataset containing the most recent version of over 200 000 GitHub workflow specification files, taken from open source repositories. To aid us in this study, we developed Soteria, a static analysis tool equipped with custom detectors that can systematically identify security misconfigurations. Given that less than 1
In agile software development, user stories (US) and acceptance criteria (AC) are popular ways of recording requirements. While guidelines have been proposed in the literature to assess the quality of US and AC, their correct application remains a manual task. In this work, we designed both a machine learning (ML) and a natural language processing (NLP) classifier for automatically assessing agile software requirements following quality indicators found in the literature. We evaluated their performance to improve the quality of requirements in a user study, as well as the users’ perceptions on the usage of such tools as writing aids. While improvements were notable in the quality of requirements written by participants, the improvements were more marginal when using the NLP classifier compared to the ML one. However, participants reported more satisfaction towards the NLP classifier for its “explainability” compared to the ML one.
Quantum computing allows for processing information exponentially faster than classical computing, which opens opportunities in many software applications. Nevertheless, the transition to this completely different programming paradigm, with counterintuitive quantum concepts, presents substantial difficulties for software engineers when developing quantum programs. In this tutorial, we present an introductory course on quantum computing and quantum software engineering frameworks and propose exercises on writing, executing, and analyzing quantum circuits.
Self-Driving Cars (SDCs) require extensive testing in a simulator, which can be costly in terms of time. To optimize the test process, simple and straightforward test cases should be excluded, while challenging test cases should be selected. This study addresses the test selection problem for lane-keeping systems of self-driving cars. Road segment features, such as angles and lengths, were extracted and treated as sequences, enabling classification of the test cases as PASS or FAIL using a Long Short-Term Memory (LSTM) model, named ITS4SDC. The ITS4SDC model is compared against a range of traditional machine learning-based classifiers. Results indicate that the ITS4SDC model outperforms machine learning-based methods in accuracy and precision while exhibiting comparable performance in recall. A follow-up analysis demonstrated the robustness of the ITS4SDC model regarding changes in the Out-Of-Bound (OOB) measure which was used to distinguish PASS from FAIL cases. This work presents a novel LSTM-based approach that solves the problem of selecting test cases in the context of simulation-based testing of SDCs. The proposed solution is effective and robust.
DevOps practices have been widely studied since 2009, nonetheless automated generation of Continuous Integration and Continuous Delivery (CI/CD) pipelines from high-level software architecture models remain underexplored. This paper addresses that gap through Model-Driven DevOps with AI (MDDOAI), a model-to-code approach that automates pipeline synthesis from architectural intent and enriches the output with context engineering method. The solution combines ATL based model transformations with Acceleo-driven code generation to produce deployable CI/CD configurations. For Quality Evaluation the approach includes runtime as validation and unsupervised code regeneration to ensure LLM produced pipelines meet functional requirements. A working prototype demonstrates the feasibility of scalable, model-driven pipeline automation, improving maintainability in modern DevOps environments.
[Context] User Stories (USs) are a popular notation for writing requirements in Agile software development. USs are often stored in Issue Tracking Systems (ITSs) and are a starting point for defining software development tasks. [Problem] While writing high-quality requirements statements is a typical concern when authoring requirements specification documents, this is less the case when writing USs in an ITS. This may also be the attributed to the fact that practitioners are not familiar with techniques for improving the quality of their USs. [Method] As part of previous research in a large organization, we found that practitioners were eager to learn how to write better USs and asked four Agile teams to participate in a study aimed at improving that practice. We conducted canonical action research where these teams were offered a lightweight intervention in the form of guidelines for writing USs—based on the Quality User Story (QUS) framework—, which they could use to reflect upon the quality of their USs. [Findings] The share of atomic and minimal violations decreased through the use of the intervention and, for the former, the positive effects lasted even after the intervention period ended. However, practitioners did not agree with all the guidelines and argued that violating the criteria can sometimes benefit them in terms of clarity and time spent. These results call for better contextualization of research on user story quality, which we initiate by proposing revised formulations of our guidelines.
Behavior-Driven Development (BDD) is an agile practice used to specify expected system behavior for validating a feature. BDD utilizes scenarios written in structured natural language which, when combined with a user story, express a functional requirement more concisely. However, BDD scenarios often suffer from ambiguity, redundancy, and lack of focus, which limits their effectiveness in validating intended requirements. A recently introduced evaluation framework called Quality Attributes-Based Guidelines for Evaluation (QABAGE), defines seven key attributes, namely Uniqueness, Integrity, Essentiality, Singularity, Completeness, Clarity, and Focus, to improve the quality of BDD scenarios. Although QABAGE has undergone preliminary ex-ante evaluation with software engineering experts, establishing its acceptance and practical utility is still an ongoing process. Effective design and implementation of such frameworks aiming to enhance software engineering practices require both ex-ante and iterative ex-post evaluations to assess their impact across different contexts and conditions. Building on prior research, we empirically evaluate QABAGE by analyzing scenarios first without and then with the framework, combined with semi-structured interviews to assess its perceived structure and utility. The findings suggest that using QABAGE as a guiding framework enhances the Essentiality and Completeness of BDD scenarios, with participants reporting clearer, more readable scenarios and reduced ambiguity during the scenario-writing process. However, challenges emerged in applying Singularity, particularly in decomposing complex functionalities into distinct, manageable elements within a single scenario. This paper provides insights for improving BDD practices and highlights the need for techniques that bridge technical and non-technical stakeholder communication.
In a large-scale software development product development organization, we found that most developers, although experienced, were lacking architectural knowledge of the specific developed product. As a remedy, we evaluated whether we could stimulate learning the product architecture by conducting training in how to use the product’s distributed tracing platform, built on the OpenTelemetry standard and the open-source Jaeger Tracing visualization tool. We planned and participated in a training event, where parts of the organization explored, using experiential learning, how to set up and use tracing to troubleshoot a realistic fault scenario we prepared. Respondents were asked to rate the tool according to the Technology Adoption Model (TAM), and responses were collected on Likert-type scales, analyzed, and summarized using a Bayesian workflow. Even as tool usage post-training was low, respondents still had a positive attitude toward using the tool, valued the experiential training, and expressed a strong intent to use the tool for program comprehension.
