Programming environments typically separate the world of static code from the dynamic execution of programs. Developers must switch between writing code and observing its execution, often with limited tools to understand the relationship between code changes and runtime behavior. Several paradigms and approaches exist to bridge this gap, including exploratory programming for comparing code variants, live programming for immediate feedback, and omniscient debugging for exploring execution history. However, existing solutions tend to focus on specific aspects and one specific paradigm rather than providing a fully integrated environment with multiple capabilities. This paper introduces Programming, a novel approach that unifies these paradigms to create a programming model for exploring both code modifications and execution flow. At the core of our approach is a trace mechanism that captures not only execution state but also the corresponding code changes, enabling developers to explore programs in both space (code variants) and time (execution flow). As a proof of concept, we implemented a Python library supporting SpaceTime Programming and applied it in two contexts: a live omniscient debugger and a Pygame game development tool, showcased through a Flappy Bird-like game. We further evaluated SpaceTimePy on five real-world Python projects, finding performance overhead ranging from 35

Software engineering is the invisible infrastructure of the digital age. Every breakthrough in artificial intelligence, quantum computing, photonics, and cybersecurity relies on advances in software engineering, yet the field is too often treated as a supportive digital component rather than as a strategic, enabling discipline. In policy frameworks, including major European programmes, software appears primarily as a building block within other technologies, while the scientific discipline of software engineering remains largely absent. This position paper argues that the long-term sustainability, dependability, and sovereignty of digital technologies depend on investment in software engineering research. It is a call to reclaim the identity of software engineering.

Context: Digital Twins (DTs) have gained significant momentum over the past decade, reshaping industrial practices across various sectors, including manufacturing, construction, and infrastructure management. While this rapid adoption has driven innovation in cyber–physical integration, the scientific foundations and engineering principles of DTs are still being actively developed. Objective: Although foundational contributions to model-based engineering (MBE) for digital twins exist, mainly in the form of conceptual frameworks, critical dimensions, such as traceability and federation, remain underexplored. This study aims to provide a comprehensive overview of the state of the art in model-based digital twin engineering, with a focused investigation of these two pivotal concerns. Methods: We conducted a multivocal literature review including 20 peer-reviewed publications and 56 gray literature sources, complemented by a survey of 51 expert stakeholders. The survey was administered during an open session of the MATISSE project plenary meeting, which included both consortium members and external participants from academia and industry. This mixed-method approach was designed to capture both academic and practitioner perspectives on the enablers and barriers to traceability and federation in DTs. Results: Our study reveals how traceability and federation are currently conceptualized, supported, and challenged within model-based DT engineering. We synthesize a landscape of relevant modeling languages, tools, application domains, and technical enablers, and identify key limitations and research gaps. Furthermore, we evaluate existing MBE solutions in light of industrial needs, distinguishing between areas of maturity and those requiring further innovation. The survey results should be interpreted in light of the sampling context, as the respondent pool mainly reflects researchers and early adopters. Conclusion: This work offers evidence-informed guidance for researchers and practitioners by identifying concrete opportunities for improving traceability and federation in DTs. Our findings point to standardized modeling approaches, cross-domain interoperability, and AI-supported traceability mechanisms as promising directions warranting further investigation. Future research priorities include the development of protocols for federated DT systems and the adoption of a system-of-systems perspective to address complex industrial and societal challenges.

Empirical software engineering research often depends on datasets of code repository artifacts, where sampling strategies are employed to enable large-scale analyses. The design and evaluation of these strategies are critical, as they directly influence the generalizability of research findings. However, sampling remains an underestimated aspect in software engineering research: we identify two main challenges related to (1) the design and representativeness of sampling approaches, and (2) the ability to reason about the implications of sampling decisions on generalizability. To address these challenges, we propose a Domain-Specific Language (DSL) to explicitly describe complex sampling strategies through composable sampling operators. This formalism supports both the specification and the reasoning about the generalizability of results based on the applied sampling strategies. We implement the DSL as a Python-based fluent API, and demonstrate how it facilitates representativeness reasoning using statistical indicators extracted from sampling workflows. We validate our approach through a case study of MSR papers involving code repository sampling. Our results show that the DSL can model the sampling strategies reported in recent literature.

Nowadays, global connectivity generates tremendous amounts of data and increases the need for Real-Time Systems (RTS). These systems consist of hardware and software components that execute tasks under strict timing constraints and are used in a wide variety of applications, such as connected vehicles, smart homes, e-health, and Industry 4.0. While RTS offer enormous opportunities to improve our lives, they also introduce significant security risks. However, the literature has largely neglected time-aware security in periodic task-based RTS, even though time is a crucial factor that directly affects system security. To address this gap, we propose Sock, a clock-based modeling language and toolchain that enables developers to design, execute, and reason about periodic task-based RTS. The operational semantics of Sock are specified using finite state machines equipped with logical clocks for tasks and resource operations. Sock allows the analysis of schedulability and the observation of security-related properties. It integrates confidentiality-preserving mechanisms and supports the simulation of temporal attacks and countermeasures. We evaluate Sock through a set of synthetic task sets and a realistic automotive-inspired case study on which we executed temporal attacks, and show that Sock preserves task schedulability and confidentiality, and reveals abnormal system behavior.

With the rise of Industry 4.0 driven by the integration of Cyber-Physical Systems (CPS) and the Internet of Things (IoT), the use of Digital Twins (DTs) has significantly increased over the past decade, as they provide detailed insights and support well-informed decision-making. However, the lack of standardized methodologies, in addition to the time and resources involved for building them remains an important challenge. Building on the idea that engineering models of the physical twin (PT) are often available, we propose a tool-supported framework that automates the derivation of DTs by leveraging existing structural and behavioral models of the PT and extending them with additional models to build a comprehensive DT. To demonstrate the feasibility of our approach, we applied it to four different use cases, in which we automatically derived DT instances from (1) models of their PT, (2) configuration of our generic framework and (3) minimal ad hoc additional development for connecting the DT to the PT. These experiments illustrate the applicability of our framework for building DTs in contexts that satisfy our assumptions and requirements. By simply configuring the framework, we are able to derive a DT aligned with its operational purpose.

Tracking vulnerabilities inherited from third-party open-source software is a well-known challenge, often addressed by tracing the threads of dependency information. However, vulnerabilities can also propagate through forking: a code repository forked after the introduction of a vulnerability, but before it is patched, may remain vulnerable long after the vulnerability has been fixed in the initial repository. History analysis approaches are used to track vulnerable software versions at scale. However, such approaches fail to track vulnerabilities in forks, leaving fork maintainers to identify them manually. This paper presents a global history analysis approach to help software developers identify one-day (known but unpatched) vulnerabilities in forked repositories. Leveraging the global graph of public code, as captured by the Software Heritage archive, our approach propagates vulnerability information at the commit level and performs automated impact analysis. Starting from 7162 repositories with vulnerable commits listed in OSV, we propagate vulnerability information to 2.2 million forks. We evaluate our approach by filtering forks with significant user bases whose latest commit is still potentially vulnerable, manually auditing the code, and contacting maintainers for confirmation and responsible disclosure. This process identified 135 high-severity one-day vulnerabilities, achieving a precision of 0.69, with 9 confirmed by maintainers.

Digital Twins (DTs) are a key technology for smart ecosystems to provide accurate digital representation of their constituents, e.g., smart buildings, farms, transportation, and citizens, as well as synchronization between the digital and the real subject, and the exploration of what-if scenarios and tradeoff reasoning. To cope with emerging complex socio-technical ecosystems, we need to bring DTs together, which is a challenging endeavor. After giving a historical overview of system adaptation, we review the many enabling technologies that can help with DT integration. Using a smart city as an illuminating example to highlight scenarios that require integration of DTs, we discuss a model-based conceptual framework that identifies DT integration strategies and elaborate on nine key integration challenges that still need to be addressed. We call on the DT community to investigate these challenges.

There is a growing interest in the energy impact of computing-related activities, which is expected to increase in the coming years. Modern software development usually relies on Continuous Integration (CI) to support short iterations, where code changes are integrated on a daily basis. The implementation of CI workflows usually relies on build automation tools, (e.g. Apache Maven or Gradle), to automate several activities such as testing or compiling. The large adoption of CI practices raises concerns about the impact of such tasks usually run on cloud environments, where the underlying hardware and its associated energy consumption remain intangible to developers. To better understand the energy footprint related to modern software development, it is essential to investigate the energy profile of the tasks managed by Apache Maven and Gradle. To achieve such goal, we performed a large-scale study with 1167 CI workflows implemented through GitHub Actions and mined from popular Java projects hosted on GitHub. After executing them locally, in a controlled environment, we analyzed in depth the energy profile of 183 355 tasks managed by Apache Maven and Gradle. These tasks represent a quarter of the total energy consumption associated with the CI workflows. We found that tasks from workflows of small-sized projects do not necessarily consume less energy than tasks from workflows of medium-sized and large-sized projects. We also found that testing-related tasks consume the most energy, and that the larger the project, the higher the percentage of energy consumption related to testing. Moreover, tasks of different categories have a different profile regarding energy consumption per task and per unit of time.

As society transitions from traditional engineered physical systems to software-driven ecosystems, the demand for adaptive, cost-effective, and rapidly evolving technologies continues to rise. Digital Twins (DTs) have recently emerged as a key architectural and conceptual tool to address these needs by decoupling high-level system control and decision making from physical operations. By integrating deductive engineering models with inductive, data-driven insights, DTs offer powerful capabilities for simulation, prediction, and adaptive system management. However, despite their promise, current DT implementations often remain fragmented, domain-specific, and expensive to build and maintain. This paper proposes a research agenda for a structured and principled approach to the engineering of digital twins (EDT), grounded in established software and systems engineering practices. Our goal is to empower the creation of digital twins that are scalable, reusable, and trustworthy. Building on the capabilities outlined by the Digital Twin Consortium, we offer a complementary perspective by identifying key research challenges associated with their integration in the context of digital twin engineering. In addition, we examine the engineering lifecycle of DT systems and present a comprehensive research agenda for the EDT community.

Language models are promising solutions for tackling increasing complex problems. In software engineering, they recently attracted attention in code assistants, with programs automatically written in a given programming language from a programming task description in natural language. They have the potential to save time and effort when writing code. However, these systems are currently poorly understood, preventing them from being used optimally. In this paper, we investigate the various input parameters of two language models, and conduct a study to understand if variations of these input parameters (e.g. programming task description and the surrounding context, creativity of the language model, number of generated solutions) can have a significant impact on the quality of the generated programs. We design specific operators for varying input parameters and apply them over two code assistants (Copilot and Codex) and two benchmarks representing algorithmic problems (HumanEval and LeetCode). Our results showed that varying the input parameters can significantly improve the performance of language models. However, there is a tight dependency when varying the temperature, the prompt and the number of generated solutions, making potentially hard for developers to properly control the parameters to obtain an optimal result. This work opens opportunities to propose (automated) strategies for improving performance.

Engineering Digital Twins (EDT) presents a multifaceted challenge that extends beyond managing the lifecycle of a Digital Twin (DT) to include its continuous, dynamic interaction with the lifecycle of the actual object, system, or process it represents, referred to as the Actual Twin (AT). The relationship between the lifecycles of DT and AT necessitates a rethinking of the software development lifecycle of DTs. This vision paper examines the deeply intertwined lifecycles of DT and AT, arguing that effective methods for EDT must embrace the mutual and adaptive evolution of both over time. We propose placing evolution at the core of EDT. We identify key triggers of DT evolution, examine the engineering dimensions involved, and explore how the best practices, technologies, and tools of DevOps can support this evolution. Finally, we discuss current challenges and opportunities in the field. This paper serves as a call to action for the EDT community to adopt evolution as a crucial factor and core principle in EDT.