Partition scheduling plays a crucial role in ensuring temporal determinism and fault isolation in real-time operating systems. However, its correctness is difficult to guarantee through traditional testing due to the complexity of timing interactions and the need for exhaustive state exploration. Therefore, a rigorous and systematic verification approach is essential to ensure system design correctness under all execution scenarios.This paper presents a formal modeling and verification methodology for partition scheduling in operating systems, based on timed automata. The proposed model is developed and systematically verified using UPPAAL. It comprises four key components-Partition, Scheduler, TimeSynchronizer, and ErrorHandler-which collectively capture task execution flows, scheduling policies, clock synchronization, and fault-handling mechanisms. A comprehensive set of verification properties is defined using Linear Temporal Logic (LTL) to formally specify the system's temporal behaviors and safety requirements. The verification results confirm that the proposed approach effectively verifies partition switching correctness, time consistency enforcement, and exception recovery. This method provides a rigorous and practical formal foundation for modeling and analyzing real-time scheduling systems.
The social isolation measures resulting from the COVID-19 outbreak changed work practices in various sectors, especially with the shift to working from home. However, the implications of the pandemic on the maintenance and evolution of open-source software (OSS) still deserve further studies. In this paper, we analyze the effects of COVID-19 on the development activity of OSS and how social isolation changed the productivity of OSS contributors. We conducted a mixed-method study composed of (i) a mining software repositories analysis of 155 popular and active OSS projects on GitHub, selected from an initial dataset of 1500 repositories based on activity thresholds (commits, pull requests, and size), and (ii) a survey with 57 core developers identified using an established literature-based heuristic. The mining study analyzed commits, code churn, pull requests, and pull request latency to assess changes before and after the pandemic, applying statistical tests and a mixed-effects Regression Discontinuity Design. The survey collected self-reported perceptions of productivity and engagement during the pandemic, enabling triangulation with repository activity trends. Our results show that while core developers' productivity remained stable, there was a sustained decline in newcomer participation and a temporary increase in core developer turnover. In the early days of the outbreak, we observed an increase in accepted pull requests, followed by a stabilization of most activity metrics. Some findings are supported by our survey study, whose results indicate that most of our survey respondents consider that COVID-19 did not change their productivity substantially. These findings offer insights into OSS resilience and sustainability in the face of large-scale disruptions, contributing to a broader understanding of the outbreak's impact and providing actionable lessons for managing distributed development in crisis scenarios.
In the cloud era, cloud application programming interface (API), as the best carrier for service delivery, capability replication, and data output, has become the core element of service-oriented software development. The existing cloud API recommendation methods adhere to a common paradigm: leveraging perceived quality of service and keyword matching to generate high-quality, single-function results, while overlooking the objective needs for function-guided complementary cloud APIs in service-oriented software development. Function-guided complementary cloud API recommendation aims to generate cloud APIs that are frequently co-invoked in conjunction with those API having given function, thereby satisfying the joint interests of developers. To this end, we proposed a function-guided extended latent Dirichlet allocation (ELDA) model for complementary cloud API recommendation. Specifically, we first conduct an analysis of real-world data from the cloud API ecosystems to illustrate both the necessity for complementary cloud API recommendations and the objective existence of a head effect within these APIs. Then we conceptualize the complementary relationship between a function and cloud APIs by treating the function as a document, with the corresponding cloud APIs represented as words within that document. Furthermore, we extend the classic latent Dirichlet allocation model by introducing two additional factors: (1) cloud API popularity and (2) functional sensitivity. These factors are designed to capture head effects within complementary cloud APIs. Additionally, we train both a positive and a negative ELDA model using the respective positive and negative corpus sets obtained. Furthermore, complementary cloud APIs relevant to the targeted function are generated by integrating the results from both the positive and negative ELDA models. Finally, experiments were conducted on two real-world cloud API datasets. The results demonstrate that the performance of ELDA surpasses that of the comparative methods. Sensitivity analysis of hyperparameters and case study findings further validate the effectiveness and practicality of ELDA.
Continuous deployment is a significant trend in software development, yet its adoption and potential benefits within the public sector remain under-researched. This paper examines a case study of continuous deployment implementation in a public sector project undertaken by Solita, a software development company, for a client utilizing agile methodologies. The study provides a comprehensive overview of the motivations, benefits, and challenges encountered during continuous deployment adoption. This study contributes to the growing body of knowledge on continuous deployment by providing valuable insights into its application within the public sector context, offering practical recommendations for overcoming challenges and achieving successful implementation.
In software-based small- and medium-sized enterprises (SMEs), enhancing individual performance (IP) of employees, particularly software engineers, is essential for organizational growth. Rather than relying on general strategies, firms increasingly focus on specific personal and professional factors influencing productivity. Trait emotional intelligence (Trait EI), including key dimensions like motivation, stress tolerance, and optimism, has emerged as a significant predictor of IP. In parallel, digital competence (DComp) has become indispensable due to the rapid evolution of technological systems. Employees with higher digital skills are better equipped to manage digital tools and adapt to innovations, leading to improved efficiency. Additionally, social support (SS) within organizations from supervisors, peers, and team members has been shown to enhance job satisfaction, engagement, and overall output. Despite growing interest, current literature lacks empirical frameworks that integrate these constructs in the SME software sector. This study proposes and validates a conceptual model to investigate the influence of Trait EI on software engineers' IP, with DC and SS serving as mediating factors. The findings offer practical implications for developing emotional and DC within tech-driven SMEs to foster performance and growth.
Cybersecurity risks are increasing in frequency and complexity, but many organizations struggle to plan and implement adequate protections at all stages of the software development life cycle (SDLC). Security is frequently added at the end of development (afterthought), and making effective use of safeguard space is difficult for IT leaders. The purpose of this study is to produce an all-encompassing framework to adopt and ensure security throughout each phase of the SDLC, from planning through maintenance. The aim is to minimize vulnerabilities and improve the resilience of software by making “security by design” a structure that not only adopts security elegantly as a living document but also is built to be part of the development process. This study adopted a mixed-methods approach. The initial stage of inquiry involved a systematic literature review (SLR) to identify common cybersecurity issues associated with each SDLC phase. The SLR was followed by an empirical survey of 71 software professionals from a variety of organizations. The survey was designed to gather perceived threats, current practices, and challenges associated with software development for survey participants' organizations. The data collected were analyzed and reviewed statistically, through chi-square tests and ANOVA, to profile the variance relative to the size of the organization, geographic region, and experience level of the practitioner. The results noted several high-risk challenges across the SDLC: underfunded security controls, imprecise requirements, insecure architecture, software bugs (i.e., injection vulnerabilities), inadequate testing, misconfigured production environments, and unreliable maintenance. The proposed framework provides cybersecurity mitigation techniques for each stage of the SDLC, such as leveraging security-oriented design patterns, secure coding policies (i.e., input validation and authentication protocols), robust testing (i.e., penetration testing and code review), and continuous monitoring after deployment. The implementation of these measures leads to a significant risk reduction in the overall organizational security posture. The framework is a formalized end-to-end approach to secure software development by embedding security throughout the cycle. Embedding security as a part of the process versus an afterthought at every stage of the cycle creates a risk reduction impact. This integrated approach also provides organizations with the opportunity to foresee and mitigate events earlier in the cycle, along with general compliance mandates (i.e., GDPR, HIPAA, and PCI-DSS), to provide more resilient, trustworthy software systems.
Autonomous vehicles play a crucial role in alleviating traffic congestion and eliminating traffic accidents. To ensure the safety and reliability of autonomous driving systems, comprehensive testing must be conducted before their deployment on public roads. Currently, testing methods primarily focus on simple scenarios involving safety violations, generating test cases based on traffic accident and traffic regulation violation scenarios. However, under complex traffic environments and driving conditions, the automatic generation of traffic regulation violation test cases to identify regulatory violations by autonomous vehicles remains insufficiently explored. In response, we propose a method for testing violations by autonomous vehicles-PathCovAVTest-which generates violation scenarios through traffic regulation scenario models to evaluate both safety violations and traffic regulation violations of the autonomous driving system. First, we design a fitness function for a genetic algorithm based on a Petri net-based traffic regulation scenario model. This function considers the safety of collisions between autonomous vehicles and other traffic participants, as well as the similarity between vehicle trajectory paths and path state sequences. The evolutionary process then produces test cases that represent traffic regulations, aimed at uncovering violations by autonomous vehicles. Simulation experiments conducted on Baidu Apollo, an industrial-grade platform, demonstrate that PathCovAVTest can effectively identify 16 types of violations committed by autonomous vehicles. Furthermore, compared with baseline methods, PathCovAVTest detects more traffic regulation violations by autonomous driving systems and improves the efficiency of generating unique violation scenarios.
The Cloud-Edge continuum enhances application performance by bringing computation closer to data sources. However, it presents considerable challenges in managing resources and determining application service placement, as these tasks require analyzing diverse, dynamic environments characterized by fluctuating network conditions. Addressing these challenges calls for tools combining simulation and emulation of Cloud-Edge systems to rigorously assess novel application and resource management strategies. In this paper, we introduce ECLYPSE, a Python-based framework that enables the simulation and emulation of the Cloud-Edge continuum via adaptable resource allocation and service placement models. ECLYPSE features an event-driven architecture for dynamically adapting network configurations and resources. It also supports seamless transitions between simulated and emulated setups, thus enabling the execution of experiments in simulated, emulated, and hybrid settings. In this work, we illustrate and assess ECLYPSE capabilities over three use cases, demonstrating the framework's effectiveness in rapid prototyping across diverse scenarios.
Smart contracts executed on blockchains are interactive programs where external actors generate events that trigger function invocations. Events can be emitted by participants asynchronously. However, some functionalities should be restricted to participants inhabiting specific roles in the system, which might be dynamically adjusted while the system evolves. We argue that current smart contract languages adopting imperative programming paradigms require additional complicated access control code. Furthermore, smart contracts are often developed and evolved independently and cannot share a joint access control policy. This makes it challenging to ensure the correctness of access control properties and to maintain correctness when the contracts are adapted. We propose using dynamic condition response (DCR) graphs for role-based and declarative access control for smart contracts and techniques for test-driven modelling and refinement of DCR graphs to support the safe design and evolution of smart contracts. We show that they allow for capturing and visualizing a form of dynamic access control where access rights evolve as the contract state progresses. Their use supports the straightforward declaration of access control rights, improved code auditing, test-driven modelling, and safe evolution of smart contracts and improves users' understanding.
Good component-based design for software projects is a desired property both for development and maintenance. The C++ programming language inherited the “translation unit” model from C, where every source file is individually compiled with no knowledge about other parts of the project. This model has several drawbacks, and C++20 Modules is the Standard's answer for them. Moreover, Modules allows a cleaner encapsulation of concern. This paper investigates a semi-automatic modularization method to refactor existing C++ projects. Our approach uses dependency analysis and clustering to organize elements of an existing project into modules, without domain-specific information. Based on our study of two medium-size open-source projects from disjoint domains and vastly distinct architecture, upgrading existing software systems to the new Modules feature is limited by the existing design of the project's architecture. To fully facilitate the use of Modules in a project, it is likely that both project-internal and user-facing interfaces must be changed.
Although JavaScript dominates modern software development, research on its quality attributes remains scarce, despite the fundamental differences that distinguish it from other languages. This motivates dedicated research related to JavaScript quality attributes and metrics. This paper aims to identify (a) the quality attributes of the JavaScript language that are mainly studied and (b) the quality metrics that are used to quantify them. Additionally, the paper provides information on the tools that can be used to measure quality metrics. To achieve these goals, we have conducted a mapping study on seven journals and eight conferences of high quality. A total of 142 primary studies, published between 2002 and February 2025, have been selected and analyzed, to identify and classify software metrics to high-level quality attributes, as described in ISO/IEC 25010:2011. Maintainability, Security, Reliability, and Usability quality attributes are the most studied ones. Furthermore, 78 generic and 48 JavaScript-specific metrics were identified. A wide dispersion of metrics has been identified for assessing each quality attribute, based on different development tasks. Moreover, a variety of tools and benchmarks were identified. A clear research trend in JavaScript quality assessment related to issues that involve software reuse, code testing, and dynamic code analysis has been identified. Yet differences among primary studies in quality assessment and quantification, along with tool adoption indicate the need for further exploration of these recurring topics.
Automotive SPICE for Cybersecurity incorporates the Cybersecurity Risk Management process (MAN.7), aligning with the Risk Assessment methods defined in ISO/SAE 21434:2021 (Clause 15). Both standards provide guidance on conducting Threat Analysis and Risk Assessments (TARA). However, they do not specify how to integrate the determination of attack feasibility when multiple TARAs emerge across different development phases. This paper explores how the concept of freedom from interference can facilitate a unified approach to determining attack feasibility in such scenarios.
Effective management of software assets in their whole lifespan is the main goal of software asset management (SAM) and is a contemporary organizational practice. It includes a range of tasks such as purchasing, implementing, and maintaining software inside a company. SAM seeks to minimize the risks and expenses related to software ownership while ensuring that software resources are used as efficiently as possible to support business activities. Recently, a great increase in the use of this technique has occurred, especially in large-scale enterprises where the complexity and diversity of software assets have faced major hurdles. The proposed study presents an overview of the analysis of the recent approaches and hurdles in the area of SAM. Because big software companies have access to a multitude of resources and experience, maximizing the reuse of software assets inside these organizations is a common topic of academic and industrial study. Through the integration of several important attributes from previous research endeavors, the current study seeks to determine the most common attributes for the research. The study aims to contribute to the area by integrating the Analytical Hierarchy Process (AHP) along with the Weighted Aggregated Sum Product Assessment (WASPAS) approaches to give a rigorous and systematic way to analyze and rate the prominent qualities for selection of the most appropriate choice among the available alternatives.
Modern software development faces a critical bottleneck in manually prioritizing the overwhelming volume of issues generated in platforms like Jira and GitHub. This labor-intensive process leads to delays, increased costs, inconsistent handling, and developer burnout, worsened by the lack of standardized priority labels. This paper investigates the potential of automated issue priority classification using state-of-the-art Transformer models to alleviate this burden. We evaluate the performance of models like BERT, DeBERTa, and ModernBERT, comparing them against general large language models (LLMs) such as GPT-3.5, Qwen2.5-3B and Llama-3.2-3B, using curated datasets derived from public Jira and GitHub repositories. Our research addresses the effectiveness of these models for their generalization capabilities on out-of-distribution projects, the impact of fine-tuning, and performs a detailed performance comparison across different priority levels and model types. Results demonstrate that Transformer models, particularly ModernBERT, achieve high classification performance (e.g., accuracy > 81%), significantly outperforming the evaluated general LLMs (accuracy 75%) for this specific task. We find that binary classification is more effective than multilabel approaches, models generalize well to unseen projects, and performance is further enhanced by fine-tuning. Key contributions include the provision of cleaned, labeled datasets and a comprehensive evaluation confirming the viability and benefits of using specialized Transformer models for automated issue priority suggestion, offering a path to improved efficiency and resource allocation in software development workflows.
Manual analysis of diagrams and legend sheets in engineering projects is time consuming and needs automation. The lack of standardized legend formats complicates creating a general method for automated information extraction. Existing approaches require training and custom rules for each project. This study proposes a novel solution combining optical character recognition with vision language models and multimodal prompt engineering to automate information extraction from diverse legend sheets without training. It integrates legend information with information extracted from diagrams, unlike studies that only focus on diagrams. Our study shows that VLMs, guided by multimodal prompts, can accurately extract information from diverse legend sheets, enabling automatic information extraction in diagrams across engineering projects. We validate our method through a case study involving the extraction of instruments from piping and instrumentation diagrams (P&IDs) and their legends across three projects with varied formats and standards. The proposed method achieved 100% accuracy in legend classification and information extraction, and 99.68% precision and 95.91% recall in generating instrument listings. The results demonstrate the effectiveness of our approach, significantly enhancing the accuracy and efficiency of information extraction from diagrams. This method can be adapted to different legend formats and diagrams, providing a versatile solution for various industries.
Requirements prioritization provides a structured way to rank and sequence requirements, which is particularly important in large-scale ERP systems where development tasks are distributed among multiple teams. Prerequisite requirements often depend on one another and must be implemented in a specific order. Improper handling of these dependencies can delay project timelines, yet limited research addresses this challenge. This study aims to develop a systematic approach to prioritize requirements in order to minimize dependencies and improve the timely completion of the project. The Analytical Hierarchical Process (AHP) combined with spanning tree methodology was applied to analyze requirement dependencies. In addition, the NA technique was used to classify prioritized requirements into distinct categories. ODOO ERP requirements served as the case study for evaluation. The proposed methodology produced a prioritized list of requirements grouped into categories, which significantly reduced inter-dependencies and improved the organization of requirements. Minimizing requirement dependencies through structured prioritization enhances the reliability and timely completion of software development projects. In the ODOO ERP case study, the suggested approach reduced 90% of dependencies. Priority grouping showed that the top 25 requirements eliminated 90% of dependencies, while the top 20 and 15 removed 82% and 67% respectively. This reduction lowered the projected project delay rate from about 25% to under 5%, confirming the approach's practical effectiveness and scalability for large ERP projects.
Enterprise Information System (EIS) streamlines business processes and enhances productivity by integrating various functions. However, conventional development methods are labor-intensive, time-consuming, and error-prone, often necessitating a design model from requirements for implementation. Existing solutions focus on auto-generating code from Object-Oriented (OO) design models, but specifying the design model from a validated requirements model requires more effort due to information gaps between requirements and design. This paper introduces RM2EIS, an approach that automatically generates EIS from contract-based requirements models, which include use case diagrams, conceptual class diagrams, and use case definitions specified by system sequence diagrams and contracts. System operation contracts are formally specified using pre- and post-conditions written in OCL. We conducted nine case studies to evaluate RM2EIS. The results indicate that the time of the generation including modeling and validation by RM2EIS is at least twice as fast as the design and implementation of developers. Moreover, the generated EIS outperforms the developer-implemented systems in functionality and is close to the non-functional aspects like performance.
This paper addresses the challenge of automating process-centric quality assurance (QA) in safety-critical domains, where compliance with regulations is crucial. Currently, QA engineers manually check compliance using tedious methods like browsing engineering artifacts and ad-hoc scripts. Automated support could improve efficiency, but it requires constraints to be written in structured, executable forms (e.g., in the Object Constraint Language, OCL), whereas engineers prefer natural language. To bridge this gap, we propose the use of large language models (LLMs) to generate OCL from natural language, enhanced by schema-based prompting and domain-specific language (DSL)-based repairs. Unlike prior work focused on UML models, this work applies OCL to software process QA. Evaluating six LLMs, we find o1-mini and Codestral perform best, with our automatic repairs ensuring constraint executability for 22%-44% of an LLM's generated OCL constraints that would otherwise remain nonexecutable due to errors.
Microservice bad smells, arising from poor design and development practices, can severely degrade system quality if unaddressed. While rule-based detection methods exist, their applicability is limited by subjective metric thresholds and the difficulty in defining certain bad smells, particularly complex microservice bad smells that are challenging to express through rules or involve high subjectivity. These smells often involve multiple services or manifest across multiple layers within a service, making them particularly challenging to detect using traditional methods. Without efficient and accurate detection mechanisms, the self-healing capabilities of microservices during operation and continuous evolution will also be compromised. Given the promise of machine learning in code smell detection, this study empirically evaluates its performance in detecting complex microservice bad smells. We employ two sampling techniques and eight classification models on 1180 samples from 55 systems, generating 45 detection models and identifying top classifiers for seven complex microservice bad smell types. We compare machine learning with rule-based methods for high-subjectivity smells, analyze performance gaps, and propose a MAPE-K-based conceptual framework for runtime detection and refactoring. Finally, we discuss the necessity for future research.
Software effort estimation (SEE) determines the effort necessary to develop software. The researchers have been tending to SEE issues since the 1960s, and several methods have been created until the formulation of the function point (FP) and constructive cost estimation (COCOMO) methods. However, these methods are only useful for procedurally developed software, not modern object-oriented (OO) software. Because the use case is the widely used unit of an OO system, particularly in scenarios requiring structured and early-stage effort estimation, using the use case point (UCP) approach will help get accurate results. The UCP approach consists of size estimation (in UCP) and effort estimation with calculated size. This study focuses on effort estimation when the size (in UCP) is already known. The productivity of a project is one of the main components for estimating effort from the given size. The classical SEE models based on UCP utilized a fixed number of productivity values. So, the validity of classical approaches is a subject of disapproval because of static productivity values. Purposefully, we proposed a rank-based weighted ensemble model for productivity prediction that allows us to use flexible productivity values. We used learning techniques such as simple linear regression (SLR), Least Absolute Shrinkage and Selection Operator Regression (LR), ridge regression (RR), elastic net regression (ER), K-nearest neighbor (KNN), decision tree (DT), support vector regression (SVR), multilayer perceptron (MLP), bagging, and adaptive boosting for productivity prediction and compared them with the proposed model. Further, we used existing UCP prediction models and compared the proposed approach with them.
