In the rapidly evolving landscape of software engineering, the demand for robust and secure systems has become increasingly critical. This is especially true for self-adaptive systems due to their complexity and the dynamic environments in which they operate. To address this issue, we designed and developed the SAFT-GT toolchain that tackles the multifaceted challenges associated with ensuring both safety and security. This paper provides a comprehensive description of the toolchain’s architecture and functionalities, including the Attack-Fault Trees generation and model combination approaches. We emphasize the toolchain’s ability to integrate seamlessly with existing systems, allowing for enhanced safety and security analyses without requiring extensive modifications and domain knowledge. Our proposed approach can address evolving security threats, including both known vulnerabilities and emerging attack vectors that could compromise the system. As a use case for the toolchain, we integrate it into the feedback loop of self-adaptive systems. Finally, to validate the practical applicability of the toolchain, we conducted an extensive user study involving domain experts, whose insights and feedback underscore the toolchain’s relevance and usability in real-world scenarios. Our findings demonstrate the toolchain’s effectiveness in real-world applications while highlighting areas for future improvements. The toolchain and associated resources are available in an open-source repository to promote reproducibility and encourage further research in this field.

As quantum software grows in complexity, the classical simulation of quantum computers becomes infeasible. This article presents the key challenges in testing large-scale quantum software and offers software engineering perspectives for addressing them.

Background: Research software is a unique subset of software that supports modern research in various domains of science, engineering, and the humanities. As computing has come to play a central role in research and shaping the well-being of society— research software engineering (RSEng) has emerged as a growing movement that addresses increasing demands for research software quality by adopting applicable best practices from the wider software engineering domain. Meanwhile, the growing importance of research software has heightened software security concerns, which will only intensify if not proactively addressed. Understanding the security culture of the RSE community—encompassing their behaviors, competencies, and values—is essential for effectively addressing research software security. Aims: This study aims to characterize the security culture of the research software engineering community. Methods: We conducted a survey to broadly characterize the security culture of open-source software. We surveyed 104 RSE community members regarding their attitudes, behaviors, competencies, subjective norms, governance, and communication toward security. Upon completion, we presented our findings to the RSE community for informal feedback and insight. Results: Our study establishes a baseline of the RSE community’s security culture. Despite sharing many attributes, our analysis indicates that the security culture of the RSE community merits further attention from researchers. In our first presentations to the RSE community, RSEs found our findings both surprising and interesting, and offered insight potentially explaining the difference. Based on our findings and RSE community feedback, we developed guidance for RSEs and allied professionals (such as in SE research and software security) to advance the state of the art in research software security through RSE security champions. Conclusion: We conclude that the RSE community has a unique security culture that shows room for improvement in both training and community support. This gap motivates future works that meet the needs and constraints of the research software domain.

Large Language Models (LLMs) are promising machine learning (ML) tools for fault detection in software engineering but require large datasets for adapting them for downstream tasks. To address data scarcity in public and industrial repositories, we generate synthetic faults by mutating C++ code in SAP HANA, creating high-quality training data with clear cause-effect linkages. This dataset enables ML models to predict crash causes, stack traces, and detect failing test cases, enhancing debugging and improving CI/CD processes. Our discussion highlights the practical benefits and applications of ML-based fault prediction in large industrial projects.

Quantum computing has the potential to revolutionize various industries by solving complex problems beyond the capabilities of classical systems. However, the practical realization of these advancements depends on robust hybrid software capable of adapting to highly dynamic execution environments. Fluctuating resource availability, quantum noise, and hardware constraints in distributed systems present significant challenges, making self-adaptation mechanisms essential for optimizing performance, ensuring reliability, and maintaining scalability. Traditional static approaches to software design are insufficient in such unpredictable settings, requiring runtime adaptation strategies that continuously monitor and adjust system behavior. Frameworks such as autonomic computing models and dynamic software architectures provide viable solutions for managing uncertainty and improving computational efficiency. By integrating self-adaptive capabilities, hybrid quantum software can dynamically respond to execution constraints, enhance system resilience, and support real-world applications, ensuring that quantum computing can effectively complement classical computing to address the growing demands of high-performance computation.

CONTEXT: Digital Twins (DTs) undergo a rapid shift from monolithic cyber-physical systems to distributed, cloud-native stacks. While the elasticity of public cloud providers benefits this transition—opaque, provider-specific pricing renders economically viable deployment, especially across federated clouds, difficult.OBJECTIVES: This work aims to enable cost-aware deployment of Digital Twins across federated cloud providers by modeling DTs as multi-layered architectures and optimizing service selection per layer to minimize operational expenses.METHODS: We introduce Twin2Clouds, a cost-driven DT engineering framework that (1) organizes DT functionality into five cloud-oriented layers to help engineers map twin components to suitable cloud services, (2) offers cloud-agnostic cost and pricing primitives that capture heterogeneous pricing schemes across providers and services, and (3) integrates these elements in a cost-aware deployment model that predicts cloud costs and prescribes a reproducible deployment plan selecting the lowest-cost services for each layer.RESULTS: A quantitative evaluation of three real-world scenarios, ranging from a large smart building (30,000 devices) to a smart home (100 devices), demonstrates that Twin2Clouds consistently outperforms single-provider baselines. Depending on scale and workload, monthly costs decrease by an average of 24.6% and up to 79% compared with single-cloud alternatives.CONCLUSION: Twin2Clouds equips DT engineers with a practical, vendor-neutral method for navigating today’s complex cloud landscape and for realizing scalable, sustainable, and economically viable Digital Twins.

Modern software systems undergo frequent updates, continuously evolving with new versions and variants to offer new features, improve functionality, and expand usability. Given the rapid pace of software evolution, organizations require effective tools and methods to mitigate the challenges associated with these changes, also called deltas. To address these challenges, the international SmartDelta Project joined industry and academia to develop and test solutions for incremental development and quality assurance. This paper provides insights into the SmartDelta project achievements and highlights one main contribution: the SmartDelta Methodology, a domain-unspecific concept for delta management in incremental software engineering. This methodology enables companies to identify gaps in their continuous engineering environment across six stages and helps to discover new tools in various technical areas. Additionally, the paper presents seven selected tools at different stages of the methodology.

A novel approach pyStorageLess introduces storage interoperability for serverless functions in federated serverless infrastructures. The serverless functions are deployed only once, and the storage can be dynamically linked to the functions at runtime by the user through control data inputs while invoking the serverless functions. pyStorageLess uses the Von Neumann approach to abstract the function to have computing resources, memory, storage, and input/output data, regardless of the provider that hosts each part. pyStorageLess splits data inputs into value and control, allowing users to dynamically attach the storage at runtime. With such extreme flexibility, users may distribute parts of the function across different providers to improve performance.

Research software has been categorized in different contexts to serve different goals. We start with a look at what research software is before we discuss the purpose of research software categories. We propose a multidimensional categorization of research software. We present a template for characterizing such categories. As selected dimensions, we present our proposed role-based, readiness-based, developer-based, and dissemination-based categories. Since our work has been inspired by various previous efforts to categorize research software, we discuss them as related works. We characterize all of these categories via the previously introduced template to enable a systematic comparison. We report on the multidimensional categorization of selected research software examples.

Question-and-answer platforms such as Stack Overflow are an important way for software developers to share and retrieve knowledge. However, reusing poorly understood code can lead to serious problems, such as bugs or security vulnerabilities. To better understand how code comments affect the perceived helpfulness of Stack Overflow answers, we conducted an online experiment simulating a Stack Overflow environment (n=91). The results indicate that both block and inline comments are perceived as significantly more helpful than uncommented source code. Moreover, novices rated code snippets with block comments as more helpful than those with inline comments. Interestingly, other surface features, such as the position of an answer and its answer score, were considered less important. Moreover, the content of Stack Overflow has been a major source for training large language models. AI-based coding assistants such as GitHub Copilot, which are based on these models, are changing the way Stack Overflow is used. However, our findings have implications beyond Stack Overflow. First, they may help to improve the relevance also of other community-driven platforms, which provide human advice and explanations of code solutions, complementing AI-based support for software developers. Second, since chat-based AI tools can be prompted to generate code in different ways, knowing which properties influence perceived helpfulness can lead to more targeted prompting strategies to generate readable code snippets.

The increasing complexity and adoption of machine learning (ML) pipelines has led to a rising demand for effective visualization tools. This paper presents a comprehensive review of existing tools for visualizing data flow in machine learning (ML) pipelines. We highlight the tools’ purposes, integration methods, and visualization techniques. We collected and analyzed 22 open-source tools and concepts, analyzing their features and classifying them based on their primary purpose. Our analysis revealed five main purposes of visualization tools: exploration, explanation, visual development, comparison, monitoring. We provide an analysis of their integration methods, from standalone visual interfaces to code-level libraries, as well as a review of various visualization techniques, including Directed Acyclic Graphs (DAGs), pipeline matrices, and annotated visualizations. Our findings highlight the importance of visualization in enhancing the interpretability and efficiency of ML workflows. Moreover, the paper provides key limitations and challenges in current visualization methods to promote future research directions enhancing the usability and functionality of ML pipeline visualization tools.

Fulfilling non-functional requirements (NFRs) is essential for the success of software systems. Nevertheless, NFRs are often treated second class when compared to functional requirements in development projects. To better understand the nature and effects of this imbalance, we explore the under-documentation of NFRs as an Indicator of Technical Debt. To achieve our aim, we exploit responses from an independently sourced global survey on requirements engineering: NaPiRE 2018. We analyze the responses under the assumption that NFRs related to quality attributes considered important must be documented. First, we retrieve data about the degree of documentation of NFRs and the perceived importance of quality attributes as defined by the standard ISO25010. Then, we check whether NFRs related to important quality attributes are reported as documented. If they are not, we consider this to be an indication of Technical Debt. Results from the statistical analysis are compared to findings from the literature. Our first finding is that there is no uniform pattern of what respondents consider to be important or unimportant quality attributes. However, the majority of respondents indicated that NFRs related to Maintainability, Reliability, Usability, and Performance were considered important. While the majority of responses confirm our expectation that NFRs related to quality attributes considered important are documented and NFRs related to quality attributes considered unimportant are not, there are responses indicating that NFRs related to important quality attributes are actually not documented. According to our assumption, these responses point to the existence of Technical Debt. As a side-product of our analysis, we also noted the existence of NFRs considered unimportant and documented. The presence of Technical Debt in NFR documentation may create different types of problems with several unwanted consequences, such as dissatisfied customers and inefficient development. Assuming that Technical Debt correlates with insufficiently documented NFRs of important quality attributes, we conclude that more effort should be spent by development organisations on adequate documentation of NFRs. It will pay off.

Ensuring the correct and safe behavior of a spacecraft is a main objective in space-system design. Since spacecraft consist of highly complex and tightly integrated components developed by large teams of engineers from various different disciplines, this is a challenging task. Increasingly, formal verification methods such as model checking are applied to establish the correctness of safety-critical parts or subsystems. Generally, the often limited scalability of model checking due to the state-space explosion problem hinders the wide-spread adoption of this technique. In this paper, we systematically examine the scalability of model checking for verifying behavioral models that arise within early space-system design phases. For this, we created a representative model for the mode management of a satellite that can be scaled in terms of its size and the complexity of interactions between system components. The model can be transformed into the input languages of various model-checking tools, which enables a comparative study of various model-checking algorithms and also facilitates analyzing the impact of different communication schemes on the scalability. The evaluation shows promising results regarding the applicability of model checking within the spacecraft design process.

Better software drives better research, a fundamental principle in the research software engineering community. Similarly, better architecture underpins better software, a core belief in the software engineering research community. Therefore, we advocate and emphasize the importance of designing robust architectures for research software to elevate the quality of research outcomes, and illustrate this with two case studies.

Text mining techniques, particularly those leveraging machine learning for natural language processing, have gained significant attention for qualitative data analysis in software testing. However, their complexity and lack of transparency can pose challenges, especially in safety-critical domains where simpler, interpretable solutions are often preferred unless accuracy is heavily compromised. This study investigates the trade-offs between complexity, effort, accuracy, and utility in text mining and clustering techniques, focusing on their application for detecting functional dependencies among manual integration test cases in safety-critical systems. Using empirical data from an industrial testing project at ALSTOM Sweden, we evaluate various string distance methods, NCD compressors, and machine learning approaches. The results highlight the impact of preprocessing techniques, such as tokenization, and intrinsic factors, such as text length, on algorithm performance. Findings demonstrate how text mining and clustering can be optimized for safety-critical contexts, offering actionable insights for researchers and practitioners aiming to balance simplicity and effectiveness in their testing workflows.

Automated test generation is an area that has seen a lot of research and development, resulting in many test automation methods and tools for test design. However, practitioners often face challenges in adopting these tools. This is not only due to the immaturity of some tools but also because of varying perspectives, confusing terminology, and, most importantly, the lack of a clear framework to guide the selection of the most suitable approach for their needs. We propose a taxonomy that characterizes the methods for automated test generation. The taxonomy was constructed using a process that involved analyzing secondary studies on automated test generation and existing taxonomies in the scientific literature. Direct observations and iterative refinements were included, followed by validation through conceptual evaluation and practitioner feedback. The resulting dimensions characterize automated test generation and its use in software testing. The taxonomy is organized into several dimensions: software artifact (i.e., type, notation, interfaces), test generation (i.e., objectives, methods, and monitoring), test execution, and test oracle. We demonstrate the taxonomy’s use by applying it to several automated test-generation tools. This paper provides the necessary concepts and a generic process for categorizing and assessing automated test generation approaches.

Context: Machine learning (ML)-enabled systems are being increasingly adopted by companies aiming to enhance their products and operational processes. Objective: This paper aims to deliver a comprehensive overview of the current status quo of engineering ML-enabled systems and lay the foundation to steer practically relevant and problem-driven academic research. Method: We conducted an international survey to collect insights from practitioners on the current practices and problems in engineering ML-enabled systems. We received 188 complete responses from 25 countries. We conducted quantitative statistical analyses on contemporary practices using bootstrapping with confidence intervals and qualitative analyses on the reported problems using open and axial coding procedures. Results: Our survey results reinforce and extend existing empirical evidence on engineering ML-enabled systems, providing additional insights into typical ML-enabled systems project contexts, the perceived relevance and complexity of ML life cycle phases, and current practices related to problem understanding, model deployment, and model monitoring. Furthermore, the qualitative analysis provides a detailed map of the problems practitioners face within each ML life cycle phase and the problems causing overall project failure. Conclusions: The results contribute to a better understanding of the status quo and problems in practical environments. We advocate for the further adaptation and dissemination of software engineering practices to enhance the engineering of ML-enabled systems.

Research software engineering research aims at understanding and improving how software is developed for research.