Original published in: Software and systems traceability for safety-critical projects : report from Dagstuhl Seminar 15162 / Cleland-Huang, Jane; Rayadurgam, Sanjai; Mäder, Patrick; Schäfer, Wilhelm. Wadern : Schloss Dagstuhl. 5 (2015), 4, p. 85-86. (Dagstuhl Reports : Dokumentationen zu Dagstuhl-Seminaren und Dagstuhl-Perspektiven-Workshops / Schloss Dagstuhl, Leibniz-Zentrum für Informatik. Wadern : Schloss Dagstuhl. 5 (2015), 4, p. 76-97. DOI: 10.4230/DagRep.5.4.76)

AbstractSupplier of system components face the challenge of customer requirements influencing the property level functional integral product architectures. For this, solution approaches focusing on the re-use of pre-engineered part variants are not applicable. However, to generate a valid product structure, customer-specific properties have to fit modelled product knowledge. Therefore, the approach models a reference class structure and analysis compatibilities on the property level for customer specific inputs concerning explicit product knowledge and constraints.

Service discovery in global software markets is performed by brokers who act as intermediaries between service requesters and service providers. In order to discover services, brokers apply service matching for determining whether the specification of a provided service satisfies the requester's requirements. Brokers can already choose between a lot of different service matching approaches considering different service properties (structural, behavioral, and non-functional properties). Different matching approaches can be combined into configurable matching processes leading to a high matching quality (e.g., accurate matching results). However, this combination and configuration is a manual procedure and has to be repeated for different requesters' or market requirements regarding matching quality. In this paper, we propose our framework MatchBox, which supports a broker in reusing existing matching approaches and combining them in a model-driven way based on a reconfigurable model of the matching process. Using this reconfigurable model, MatchBox takes care of control and dataflow between matching approaches and executes the modeled processes automatically. As a case study, we integrated eleven matchers into MatchBox to demonstrate that it remains flexibility and reduces effort for a broker at the same time.

Today, software components are provided by global markets in the form of services. In order to optimally satisfy service requesters and service providers, adequate techniques for automatic service matching are needed. However, a requester's requirements may be vague and the information available about a provided service may be incomplete. As a consequence, fuzziness is induced into the matching procedure. The contribution of this paper is the development of a systematic matching procedure that leverages concepts and techniques from fuzzy logic and possibility theory based on our formal distinction between different sources and types of fuzziness in the context of service matching. In contrast to existing methods, our approach is able to deal with imprecision and incompleteness in service specifications and to inform users about the extent of induced fuzziness in order to improve the user's decision-making. We demonstrate our approach on the example of specifications for service reputation based on ratings given by previous users. Our evaluation based on real service ratings shows the utility and applicability of our approach.

Cyber-physical systems (CPS) require model checking to guarantee the functional correctness of software models, providing counterexamples in case of violations. Domain-specific model checking (DSMC) allows to apply model checking to specific application domains. DSMC hides the complexity of using a model checker by translating from a domain-specific modeling language (DSML) to the model checker’s input language, and by translating counterexamples back to the domain-specific level. Implementing DSMC is challenging for CPS due to the large differences between DSMLs and the input language of a model checker. In this paper, we present a successful application of DSMC to MECHATRONICUML, a DSML for the software design of CPS, using the model checker UPPAAL. As a key benefit, our approach is able to translate counterexamples back to the domain-specific level even in case of large differences between DSML and the model checker’s input language. We show the correctness of our approach using a case study from the area of car-2-car communication.

Today's mechatronic systems are increasingly interconnected using communication protocols for realizing advanced functionality. Communication protocols underlie hard real-time constraints and need to meet high quality standards for ensuring the safety of the system. A common approach for achieving their necessary quality and mastering their impending complexity is model-driven development. Applying this approach, a developer builds formal models of the communication protocols and applies formal verification techniques (e.g., model checking) for proving that the communication is safe. However, these techniques typically face the state-explosion problem that prevents proofs for large systems like interconnected mechatronic systems. In previous publications, we introduced the MechatronicUML method that provides a compositional verification approach for tackling the state-explosion problem. A key enabler for such an approach is a definition of refinement. In this paper, we extend the compositional verification approach of MechatronicUML in particular by using different kinds of refinement definitions including an automatic selection of the most suitable refinement definition. In addition, we significantly extend an existing approach of test automata construction for refinement checking. Using this approach we can also guarantee that a refined model is constructed correctly concerning the selected and applied refinement definition. We evaluate our approach by an example of an advanced railway transportation system.

The Collaborative Research Centre "On-The-Fly Computing" works on foundations and principles for the vision of the Future Internet. It proposes the paradigm of On-The-Fly Computing, which tackles emerging worldwide service markets. In these markets, service providers trade software, platform, and infrastructure as a service. Service requesters state requirements on services. To satisfy these requirements, the new role of brokers, who are (human) actors building service compositions on the fly, is introduced. Brokers have to specify service compositions formally and comprehensively using a domain-specific language (DSL), and to use service matching for the discovery of the constituent services available in the market. The broker's choice of the DSL and matching approaches influences her success of building compositions as distinctive properties of different service markets play a significant role. In this paper, we propose a new approach of engineering a situation-specific DSL by customizing a comprehensive, modular DSL and its matching for given service market properties. This enables the broker to create market-specific composition specifications and to perform market-specific service matching. As a result, the broker builds service compositions satisfying the requester's requirements more accurately. We evaluated the presented concepts using case studies in service markets for tourism and university management.

This report documents the program and the outcomes of Dagstuhl Seminar 15162 on and Systems Traceability for Safety-Critical Projects. The event brought together researchers and industrial practitioners working in the field of safety critical software to explore the needs, challenges, and solutions for Software and Systems Traceability in this domain. The goal was to explore the gap between the traceability prescribed by guidelines and that delivered by manufacturers, and starting from a clean slate, to clearly articulate traceability needs for safety-critical software systems, to identify challenges, explore solutions, and to propose a set of principles and domain-specific exemplars for achieving traceability in safety critical systems.

Model transformations used in model-driven software development need to be semantics-preserving, i.e., the meaning of a model must not be distorted by the transformation. Testing whether a transformation preserves the dynamic semantics of a model requires oracles such as model checkers, which explore the runtime statespace of models. The high amount of repetitive code to integrate heterogeneous transformation engines and test oracles makes the design of semantics preservation tests a tedious task. In this paper, we apply the approach of model-driven testing to the domain of model transformation. We present a visual domain-specific language for the design of model transformation tests, which reduces test cases to their essential components. Our language enables an immediate execution of test cases with precise validation feedback. We evaluate our approach in terms of a case study based on the MechatronicUML modeling language for the software development of cyber-physical systems.

Distributed systems consist of subsystems that usually need to coordinate with each other. Each subsystem must decide its actions locally, based on its limited knowledge. However, these decisions can be interdependent due to global requirements, i.e., one subsystem may need to know how another one decided. Complex communication can be required to exchange this knowledge. With rising complexity, a correct manual implementation of all subsystems becomes unlikely. Therefore, our goal is to automate the implementation process as far as possible. This paper presents a novel approach for the automatic synthesis of a distributed implementation from a global specification. In our approach, MSDs—a scenario-based specification language—can be used to intuitively, but formally define the requirements. The resulting implementation comprises one automaton for each subsystem, controlling its behavior. Contrary to similar approaches, we automatically add communication behavior to the system only when local knowledge is insufficient.

Service matching approaches determine to what extent a provided service matches a requester's requirements. This process is based on service specifications describing functional (e.g., signatures) as well as non-functional properties (e.g., privacy policies). However, we cannot expect service specifications to be complete as providers do not want to share all details of their services' implementation. Moreover, creating complete specifications requires much effort. In this paper, we propose a novel service matching approach taking into account a service's signatures and privacy policies. In particular, our approach applies fuzzy matching techniques that are able to deal with incomplete service specifications. As a benefit, decision-making based on matching results is improved and service matching becomes better applicable in practice.

Following the conceptual design of the individual modules, the resulting concepts must be integrated and the second phase of the development process, the Design and Development, is begun. This phase consists of individual design and development processes for each module. They are conducted individually in each domain using the results from the Conceptual Design Phase, the Principle Solution, as specifications. If domain-spanning partial models have been engineered, the results must be synchronized.Parallel to the development of the individual modules the results of the domains are integrated into the overall system model in the system integration. These span all of the modules and take the full system into account. During this phase and in these processes, methods are one more chosen using the guidelines as described in Sect. 4.1.

The development of self-optimizing systems is a highly interdisciplinary task, as several domains are involved. Existing design methodologies do not adress this issue, as they focus on the respective domain; a holistic domain-spanning consideration of the system occurs - if at all - only rudimentally. The partial solutions developed by the respective domains may be optimal from the point of view of this domain. However, it does not automatically mean, that the sum of the optimal domain-specific solutions forms the best possible overall solution: ”the whole is more than the sum of its parts”. This especially holds true for the early design phase, the conceptual design. Its result is the so-called principle solution, which is further refined in the domain-specific design and development. Thus, a great need for methods arises which support the domain-spanning conceptual design for self-optimizing systems in a holistic manner. In this chapter we will introduce such methods. In particular, we will explain the specification technique for the domain-spanning description of the principle solution of a self-optimizing system. Furthermore, methods are explained which support the creation of the principle solution. This includes a method to ensure the consistency of application scenarios, a method for the design of the system of objectives, which is crucial for a self-optimizing system, as well as a method for the re-use of proven solutions for recurring problems (solution patterns). Finally, some analysis methods are explained that are performed on the specification of the principle solution. These are: the early analysis of the reliability and the analysis of the economic efficiency.

Die Nähe der Automatisierungstechnik zur Informationstechnik wächst stetig, insbesondere vor dem Hintergrund von Konzepten wie Digitale Fabrik und Industrie 4.0. Mit dem Thema Internet der Dienste und Internet der Dinge wird auf sehr breit gefächerten Anwendungsgebieten das Zusammenwachsen von AT und IT in nahezu allen Branchen vorangetrieben. Der Begriff der Dienste wird vielfältig verwendet und erscheint als Bestandteil von Technologien, die ihrerseits unterschiedliche Zielgebiete und Zuordnungen zu Ebenen der Anwendungssysteme einnehmen. Dieser Beitrag widmet sich der Charakteristik, den Modellen und den Anwendungsgebieten von Diensten in der Automatisierungstechnik. Dabei geht es um die abstrakte Betrachtung von Diensten, wie sie zum Beispiel im Konzept der I40 zu erwarten sind, sowie deren Struktur, Semantik und Anbindung an AT-Geräte und die automatisierte Konfiguration von Dienstsystemen. Der Beitrag stellt den Stand der Diskussion zu diesem Thema dar, der auf dem Tutorium des EKA-Workshops 2014 erreicht worden ist.