Background: Researchers dealing with software engineering often express some concern about the lack of a core theory for this discipline. In fact, even the most basic concepts of software engineering—like the organization of software development life cycles—are usually described informally, with no reference to an underlying theory. Methods: In this paper, a well-known model for requirements and specifications is used as a basis for a rigorous and uniform description of software development activities. Results: The proposed approach proved suitable to describe the most popular software life cycles, as well as to describe the properties of software development activities. The proposed approach was also used to describe the properties of the software product in a way that is precise enough to support the definition of metrics. Conclusions: The proposed approach seems suitable for describing most software engineering issues and reasoning about them.
Vision–Language Models (VLMs) have emerged as powerful tools for image understanding tasks, yet their practical deployment remains hindered by significant architectural heterogeneity across model families. This paper introduces UVLM (Unified Vision–Language Model), a pip-installable Python (v3.9+) package that provides a unified interface for loading, configuring, and running multiple VLM architectures on custom image analysis tasks. UVLM currently supports two major model families which differ fundamentally in their vision encoding, tokenization, and decoding strategies: LLaVA-NeXT and Qwen2.5-VL. The package abstracts these differences behind a single inference function and eliminates all architecture-specific code from the user’s workflow. UVLM is organized as eight modular Python components (model loading, dual-backend inference, response parsing, consensus validation, batch processing, prompt assembly, model registry, and utilities) and can be deployed in three modes: Google Colab for zero-install cloud access, local Jupyter notebooks for on-premises GPU use, and as a programmatic API for integration into automated pipelines. Key features include a multi-task prompt builder supporting four response types (numeric, category, boolean, text), a consensus validation mechanism based on majority voting, a flexible token budget (up to 1500 tokens) for custom reasoning strategies, and built-in truncation detection. The package is designed for extensibility: adding a new VLM family requires implementing one backend-specific inference section and adding entries to the model registry, without modifying any other module. An illustrative example on 120 street-view images across 16 model configurations is provided to demonstrate the software’s evaluation workflow.
Autonomous Cyber–Physical Systems (CPS) must jointly satisfy energy efficiency, accuracy, and real-time constraints, which are typically treated separately in existing methods. This paper proposes a verifiable service-oriented CPS framework for energy-aware autonomous navigation using a high-fidelity cyber–physical twin. The approach integrates physics-based Model Predictive Control (MPC) with explicit power modeling (P=F·v) and Dubins curve-based trajectory generation under the 5C (connection, conversion, cyber, cognition, and configuration) architecture using CARLA for synchronized cyber–physical interaction. The proposed method achieves 30.7% reduction in mean power consumption and 12.5% reduction in total energy usage while maintaining sub-centimeter tracking error (<0.05 m). Mission duration increases by 26.3% with only 7% computational overhead, confirming real-time feasibility. The framework provides a verifiable CPS methodology that unifies physics-based control, digital twin synchronization, and service-oriented design for energy-aware autonomous navigation.
Socio-technical congruence (STC) theory posits that software development effectiveness depends on the degree to which developer coordination aligns with technical requirements. However, much existing research treats congruence as a static project attribute, overlooking the dynamic coordination needs that arise during periods of intensive development. This study addresses this gap by examining development bursts, brief episodes of significant technical change and collaboration that alter coordination demands. Using fixed-effects regression models, the analysis examines 45,981 development bursts from 6401 open-source software projects. The findings show that higher burst intensity is positively associated with both congruence and delivery throughput, suggesting that effective collaboration often centers on shared integration challenges. Conversely, higher coordination complexity is associated with lower congruence and reduced delivery reliability, indicating that the main risks associated with bursts stem from structural rather than purely volumetric factors. Team experience also mitigates the negative effects of complexity on congruence, highlighting the importance of accumulated coordination capability. However, after accounting for demand-side factors, the relationship between congruence and delivery reliability becomes negative, indicating that congruence observed during bursts reflects not only alignment quality but also coordination burden. These findings extend STC theory by reconceptualizing congruence as a dynamic state and emphasizing the need to understand its evolution in high-frequency coordination contexts.
Decision-making is a central activity in agile software engineering (SE), yet research on how decisions are made and supported in agile contexts remains fragmented across models, methods, roles, and lifecycle stages. While prior studies have examined isolated aspects such as prioritization or planning, a comprehensive synthesis of decision-making as a phenomenon in agile SE is lacking. This systematic literature review addresses this gap by consolidating and structuring existing research on agile decision-making and to identify dominant patterns, gaps, and future research directions. A systematic search was conducted in IEEE Xplore, ACM Digital Library, Scopus, and Web of Science, complemented by backward and forward snowballing, covering publications from 2014 to 2024. In total, 42 studies were included and analyzed using a structured coding scheme covering decision models, methods, actors, lifecycle contexts, and research methodologies. The results reveal a strong concentration of analytical and hybrid decision-making models in planning and requirements activities, while decision-making in coding, testing, and operations remains underexplored. Software developers are the most frequently studied decision-making actors, whereas managers are mainly discussed as external stakeholders rather than active decision-makers within agile workflows. The main contributions of this study are the following: a structured synthesis of agile decision-making research over multiple analytical dimensions, the identification of key research gaps in lifecycle coverage and actor perspectives, and the proposal of a coherent nomenclature for decision-making in agile SE. These contributions provide a foundation for future empirical studies and support the development of more comprehensive theories of decision-making in agile software engineering organizations.
Machine learning-based systems are increasingly deployed in high-stakes domains, such as healthcare, finance, law, and e-commerce, where their predictions directly influence critical decisions. Although these systems offer powerful data-driven support, they also introduce serious concerns related to fairness, bias, and discrimination. As a result, detecting and addressing unfairness in machine learning software has become a central research challenge. This study presents a systematic mapping of research on software unfairness detection in machine learning systems, with the aim of consolidating existing fairness definitions, identifying major problem types, examining testing approaches, reviewing commonly used datasets, and highlighting open research gaps. A structured search was conducted across five major digital libraries and additional sources, covering publications from 2010 to 2025. From 1805 initially identified records, 67 primary studies met the inclusion and quality assessment criteria. The findings show that research activity has grown significantly since 2019, reaching a peak in 2022. Most studies were published in conference proceedings, accounting for 52% of the primary studies, followed by journals and workshop proceedings, which accounted for 42% and 6% of the primary studies. The literature encompasses multiple research themes, with 36% of the primary studies focusing on the analysis of existing fairness methods, 22% addressing bias mitigation strategies, 30% investigating testing techniques, and 12% proposing or evaluating evaluation frameworks. Fairness testing was conducted across multiple testing levels, including unit, integration, and system testing. Integration-level testing was the most prevalent, accounting for approximately 37.9% of the studies, followed by system-level testing at 27.3% and unit-level testing at 12.1%. Additionally, 22.7% of the studies applied fairness testing across more than one testing level. Frequently used datasets included COMPAS, Adult Census Income, and German Credit. Widely adopted tools, such as IBM AI Fairness 360, Themis, and Aequitas, were also identified. Overall, the systematic mapping study (SMS) highlights the progress made in fairness research while emphasizing the need for stronger integration of fairness into practical machine learning development.
Large language models (LLMs) have demonstrated strong capability for code understanding and vulnerability detection. However, most existing approaches rely on static prompting and treat the model as a passive predictor, limiting adaptability under uncertainty, particularly in embedded and cyber-physical systems (CPS). This paper introduces adaptive self-prompting as a core mechanism for agentic LLM-based fault detection in C-language embedded code. We propose two complementary frameworks: Agentic Retrieval-Augmented Generation (A-RAG), which performs confidence-triggered, reasoning-conditioned retrieval from CWE and SEI CERT knowledge bases at inference time, and Agentic Supervised Fine-Tuning (A-SFT), which internalizes improvements through a self-evaluation sweep that refines instructions and training exemplars during fine-tuning. Experiments are conducted on a unified dataset constructed from the Toyota ITC benchmark and a curated subset of Big-Vul aligned to embedded code-relevant CWE categories. Results show that adaptive self-prompting substantially improves predictive performance and error calibration compared to static Retrieval-Augmented Generation (RAG), conventional fine-tuning, and encoder-based baselines, achieving up to 86.3% F1 score while significantly reducing high-confidence misclassifications. These findings demonstrate that confidence-aware reflection and adaptive reasoning enhance both robustness and safety in LLM-based fault detection for embedded and CPS software.
Artificial Intelligence Chatbots based on Large Language Models are becoming important cornerstones in education, professional, and personal contexts. Users frequently disclose sensitive information without the necessary awareness of how their data is processed, stored, and later used, creating risks of unintended exposure and violation of data protection regulations such as GDPR and the EU AI Act. In this paper, we present a dynamic privacy-by-design framework that introduces a novel privacy-oriented middleware layer between the users and the AI Chatbots. Our framework intercepts user prompts, detects and sanitizes sensitive information, and enables explicit user control over data retention and disclosure through our dedicated Information Manager Dashboard. To develop our framework around real-world needs, we conducted a survey with 83 participants investigating privacy concerns, regulatory awareness, and preferences for transparency and control in conversational AI. Our results indicate that better and more transparent privacy safeguards can be achieved without significantly compromising usability or performance, supporting the development of trustworthy and user-centric AI chatbots. We also evaluate our solution against other state-of-the-art implementations and relevant metrics.
Web Application Programming Interfaces (Web APIs) have become fundamental components of modern software ecosystems. At the same time, they have emerged as major attack surfaces in web applications and distributed services. Although many web API vulnerabilities are well documented, a critical gap remains in understanding how insecure development practices, usability limitations, and developer-related issues contribute to recurring API security problems. To address this gap, this study presents a systematic review of web API security research using a PRISMA-guided methodology and a taxonomy-driven analytical approach. The review synthesizes findings from 50 selected studies covering web API architectural styles, usability concerns, authentication and access-control weaknesses, and common vulnerabilities. These vulnerabilities include SQL Injection (SQLi), Cross-Site Scripting (XSS), Broken Authentication, and Denial-of-Service (DoS) attacks within the context of the OWASP API Security Top 10 framework. The findings indicate that recurring web API vulnerabilities are associated not only with technical weaknesses but also with API usability issues, insecure development practices, inconsistent security guidance, and increasing implementation complexity. The review also identifies persistent research gaps involving usability-security integration, API evolution, secure-by-design development practices, and empirical validation of security tools and frameworks. By synthesizing these dimensions into a unified conceptual perspective, this study provides researchers and practitioners with a clearer understanding of the factors contributing to web API insecurity. The study also highlights directions for developing more resilient and developer-aware API security practices.
Refactoring is essential for developing maintainable software. Using Large Language Models in software engineering is widespread, but compared to well-established domains such as code generation, reliable refactoring is still relatively underexplored. In this paper, we perform a broad analysis on the refactoring capabilities of small open-weight language models (SLMs) by evaluating 12 models on 3453 Python programs. Our study focuses on the two defining aspects of refactoring: behavior preservation and code quality improvement. We evaluate these properties using unit tests and various code metrics. Across models ranging from 0.5B to 8 B parameters, most models improve code quality. Larger models are more reliable, as they preserve behavior more consistently. Reasoning models often make more significant changes while refactoring. Allowing models to generate reasoning traces improves performance, but only for models larger than 4B. For smaller models, reasoning in fact reduces refactoring reliability. The difficulty of the underlying task affects refactoring performance, with more complex tasks associated with higher failure rates. Our results indicate that current open SLMs can support refactoring tasks, especially larger ones with reasoning capabilities, but they are best used with human oversight.
This paper advances a theoretical argument that generative AI is accelerating the democratization of computational thinking and, in turn, reshaping education, professional practice, and the nature of computing itself. Traditionally, computational thinking has been closely tied to learning to program, thereby limiting who could effectively employ it. The emergence of large language models (LLMs) challenges this linkage by decoupling many forms of computational problem solving from direct programming. In response to this shift, the paper explores the implications for curriculum design and workforce roles through a theoretical and interpretive lens. Drawing on prior literature, historical context, and illustrative examples from recent scholarship and practice, we develop a conceptual account of AI-augmented computing. We argue that LLMs lower barriers to entry by abstracting away much of manual coding and reallocating effort toward problem framing, prompt engineering, oversight, and validation. We further argue that this transition is redistributing computational skills across disciplines, positioning prompt engineering as an emerging engineering practice, and increasing pressure on universities to redesign curricula around AI literacy, fluency, and mastery.
We investigate interaction effects of system attributes—age and volatility—and team attributes—instability and skill-diversity—on software maintenance productivity in the context of lifecycle maintenance involving multiple serial tasks (projects), unlike extant work’s focus on single maintenance tasks. Given the knowledge intensity of software maintenance, we apply knowledge creation theory to identify knowledge needs and challenges that system and team attributes create, then develop two theoretical predictions. First, team attributes adversely affect maintenance productivity while system attributes do not exhibit direct negative effects. Second, interactions of system and team attributes have offsetting (substitutive) effects on productivity since their knowledge needs and challenges overlap. We test our predictions using archival data on three years of maintenance work across 426 mission-critical systems at a Fortune 100 company, encompassing over 7500 maintenance tasks executed by thousands of maintainers. Our analysis yields two key insights. First, interactions diminish substantially the strong negative direct effects of team instability and skill-diversity on maintenance productivity—by as much as 20%. System volatility exhibits a small direct effect (0.38% productivity decline), while system age shows no significant direct effect. Second, interaction effects indicate that productivity declines as instable and skill-diverse teams are sharper when working on younger and less volatile systems—the opposite of conventional wisdom. For example, assigning a team with above-average instability to an above-average age system improves productivity by 3.06% through substitutive effects. Our findings demonstrate that congruence between system and team attributes can improve maintenance productivity, with substantial economic implications: organizations should strategically match team configurations to system characteristics rather than attempting to eliminate team instability or diversity universally.
Amid the wave of digital transformation and customer service automation, traditional chatbots are increasingly challenged by their inability to handle unstructured data and complex queries. This issue is particularly critical in the import trade industry, where customer service representatives must respond promptly to diverse inquiries involving quality anomalies, order tracking, and product substitution. Existing rule-based or keyword-driven chatbots often fail to provide accurate responses, resulting in reduced customer satisfaction and increased operational burdens. This study proposes and implements a “Retrieval-Augmented Generation (RAG)-based Customer Service Chatbot,” integrating the RAG framework with a Neo4j-based knowledge graph, specifically tailored for the import trade domain. The system constructs a dedicated QA dataset, knowledge graph, and dynamic learning mechanism. It semantically vectorizes internal documents, meeting records, quality assurance procedures, and historical dialogues, establishing interrelated knowledge nodes to enhance the chatbot’s comprehension and response accuracy. The study also incorporates GPT-based response evaluation and a high-score caching strategy, enabling dynamic learning and knowledge enhancement. Experiments were conducted using 101 representative enterprise-level queries across six categories, reflecting real-world operational scenarios and inquiry needs. The results demonstrate that the combination of knowledge graphs and RAG technology effectively reduces AI hallucinations and improves response coverage and accuracy, thereby addressing complex problems in customer service applications. This paper not only presents a feasible AI implementation model for the import trading industry but also offers a practical architectural reference for domain-specific knowledge management in the import trade and allied sectors.
While anonymity is often considered as a binary property that is either satisfied or not satisfied, a closer analysis shows that there are different degrees of anonymity and that an appropriate degree of anonymity must be selected depending on application and context. For this purpose, different models have been developed that allow for defining the degree of anonymity needed for a given application and evaluating whether this required degree has been achieved. The current paper identifies the properties that such a model of anonymity should satisfy and evaluates the most common models based on these properties, thereby providing a basis for implementing anonymity in software development and verifying that an adequate degree of anonymity has been achieved in a particular application. To achieve this, the paper starts with an outline of the reasons for creating anonymity models and the legal framework of anonymity. Subsequently, the main threats to and relevant properties of anonymity are identified. In the main body of the paper, the available models of anonymity are then summarized and evaluated against these properties.
We propose a set of design principles to guide the design of a programming language intended for general, practical use. These principles center around supporting the development of robust programs, supporting independent development, the evolution of separate components of an application, and developing programs with adequate performance. We identify one key principle, interface integrity, as the most important characteristic of declarative programming languages. Following these principles has led to the development of the Wybe programming language, which provides a range of features common in functional, procedural, and logic programming languages. In particular, we argue that it provides much of the benefit of declarative programming languages, while providing much of the flexibility of imperative programming.
The increasing adoption of artificial intelligence (AI) in smart learning environments has heightened the need for systematic, reliable testing of AI-driven educational applications. Existing studies primarily rely on benchmark accuracy, manual testing, or user-based assessment, offering limited insight into robustness, coverage, and failure behavior. These limitations are driven by the lack of standardized intelligence quality criteria, inadequate test automation support, complex diversity in Q&A tasks, and the difficulty of automatically validating test results in smart learning applications. This paper investigates model-based AI testing for Q&A-based smart learning applications, using ChatGPT (GPT-5) as a case study to evaluate its intelligence quality in college algebra question answering tasks that support student learning. A three-dimensional (3D) AI testing framework structures testing along input, context, and output dimensions to enable model-driven test generation, controlled contextual variation, and consistent validation. College algebra problems selected from a standard undergraduate textbook are used to construct representative test cases. Controlled image-based data augmentation and structured similarity-based validation mechanisms are employed to support automated test execution and result analysis. Empirical results demonstrate that the proposed approach improves intelligence quality coverage and provides more diagnostic insight than ad hoc evaluation methods.
Prompt specifications for multi-agent large language model (LLM) systems carry data contracts and integration logic across interdependent files but are rarely subjected to structured-inspection rigor. We report a single-system case study of iterative, agent-driven auditing applied to AEGIS (Autonomous Engineering Governance and Intelligence System), a seven-lane production pipeline whose 7152-line specification surface was audited across nine rounds, surfacing 51 consistency defects (per-round counts of 15, 8, 12, 2, 8, 1, 4, 1, 0). We present a seven-category post hoc taxonomy with explicit coding rules, non-monotonic convergence consistent with cascading edits and audit-scope expansion, and a locked audit protocol. We further report two partial replications on a public synthetic mini-specification: a cross-LLM panel of four frontier vendors (OpenAI, Anthropic, Google, xAI; 12 traces; multi-vendor union detects all five seeded defects) and an inter-rater reliability check on a stratified subsample (Cohen's κ = 0.80 on category, 0.46 on severity). The full reproducibility bundle accompanies the submission.
The increasing decentralization of industrial processes in Industry 4.0 necessitates the distribution and coordination of resources such as machines, materials, expertise, and knowledge across organizations in a value chain. To facilitate effective operations in such distributed environments, it is essential to digitize processes and resources, establish interconnectedness, and implement a scalable management approach. The present paper addresses these challenges through the knowledge-based production planning (KPP) system, which was originally developed as a monolithic prototype. It is argued that the KPP-System must evolve towards a service-oriented architecture (SOA) in order to align with distributed and interoperable Industry 4.0 requirements. The paper provides a comprehensive overview of the motivation and background of KPP, identifies the key research questions that are to be addressed, and presents a conceptual design for transitioning KPP into an SOA. The approach under discussion is notable for its consideration of compatibility with the Arrowhead Framework (AF), a consideration that is intended to ensure interoperability with smart production environments. The contribution of this work is the first architectural concept that demonstrates how KPP components can be encapsulated as services and integrated into local cloud environments, thus laying the foundation for adaptive, ontology-based process planning in distributed manufacturing. In addition to the conceptual architecture, the first implementation phase has been conducted to validate the proposed approach. This includes the realization and evaluation of the mediator-based service layer, which operationalizes the transformation of planning data into semantic function blocks (FBs) and enables the interaction of distributed services within the envisioned SO-KPP architecture. The implementation demonstrates the feasibility of the service-oriented transformation and provides a functional proof of concept for ontology-based integration in future adaptive production planning systems.
Background: The implementation of Large Language Models (LLMs) in software engineering has provided new and improved approaches to code synthesis, testing, and refactoring. However, even with these new approaches, the practical efficacy of LLMs is restricted due to their reliance on user-given prompts. The problem is that these prompts can vary a lot in quality and specificity, which results in inconsistent or suboptimal results for the LLM application. Methods: This research therefore aims to alleviate these issues by developing an LLM-based code assistance prototype with a framework based on Retrieval-Augmented Generation (RAG) that automates the prompt-generation process and improves the outputs of LLMs using contextually relevant external knowledge. Results: The tool aims to reduce dependence on the manual preparation of prompts and enhance accessibility and usability for developers of all experience levels. The tool achieved a Code Correctness Score (CCS) of 162.0 and an Average Code Correctness (ACC) score of 98.8% in the refactoring task. These results can be compared to those of the generated tests, which scored CCS 139.0 and ACC 85.3%, respectively. Conclusions: This research contributes to the growing list of Artificial Intelligence (AI)-powered development tools and offers new opportunities for boosting the productivity of developers.
Current research in consent management techniques focuses on isolated aspects of data security, privacy, or auditability, but important issues like (i) dynamically integrating regulatory updates into form generation, (ii) support in content generation with verifiable audit trails, and (iii) tools that make compliance reasoning transparent for non-legal users are not yet addressed. This paper introduces CONSENT, an architecture that integrates AI-based consent reasoning using Large Language Models (LLMs) for automated consent-form drafting and compliance evaluation, alongside blockchain technology for secure and auditable storage. The architecture builds on prior work to address the aforementioned issues by introducing three supporting mechanisms: (a) Specialized AI models coordinated through expert routing which coordinate subtasks such as automation in form generation and regulatory compliance, (b) Retrieval-Augmented Generation (RAG) that supports the integration of regulatory updates into forms, and (c) Explainable AI (XAI) for the reasoning behind form content and compliance assessments. CONSENT architecture is evaluated through 250 test cases and a pilot case study for clinical trial consent management involving 20 engineers and attorneys, who evaluated the prototype on form quality (i.e., coherence, conciseness, factuality, fluency, and relevance) as well as time and effort efficiency. Results show that CONSENT substantially reduces the manual effort in consent-form creation while providing transparent, audit-ready compliance assessments, highlighting its potential for dynamic, user-centric consent management.
