@article {19104,
	title = {Evidence Management for Compliance of Critical Systems with Safety Standards: A Survey on the State of Practice},
	journal = {Information and Software Technology},
	volume = {60},
	year = {2015},
	month = {April 2015},
	pages = {1-15},
	publisher = {Elsevier},
	address = {Science Direct},
	abstract = {Context: Demonstrating compliance of critical systems with safety standards involves providing convincing evidence that the requirements of a standard are adequately met. For large systems, practitioners need to be able to effectively collect, structure, and assess substantial quantities of evidence.Objective: This paper aims to provide insights into how practitioners deal with safety evidence management for critical computer-based systems. The information currently available about how this activity is performed in the industry is very limited.Method: We conducted a survey to determine practitioners{\textquoteright} perspectives and practices on safety evidence management. A total of 52 practitioners from 15 countries and 11 application domains responded to the survey. The respondents indicated the types of information used as safety evidence, how evidence is structured and assessed, how evidence evolution is addressed, and what challenges are faced in relation to provision of safety evidence.Results: Our results indicate that (1) V\&amp;V artefacts, requirements specifications, and design specifications are the most frequently used safety evidence types, (2) evidence completeness checking and impact analysis are mostly performed manually at the moment, (3) text-based techniques are used more frequently than graphical notations for evidence structuring, (4) checklists and expert judgement are frequently used for evidence assessment, and (5) significant research effort has been spent on techniques that have seen little adoption in the industry. The main contributions of the survey are to provide an overall and up-to-date understanding of how the industry addresses safety evidence management, and to identify gaps in the state of the art.Conclusion: We conclude that (1) V\&amp;V plays a major role in safety assurance, (2) the industry will clearly benefit from more tool support for collecting and manipulating safety evidence, and (3) future research on safety evidence management needs to place more emphasis on industrial applications.},
	keywords = {safety assurance, safety certification, safety evidence, Safety-critical systems, state of the practice.},
	doi = {doi:10.1016/j.infsof.2014.12.002},
	url = {http://www.sciencedirect.com/science/article/pii/S0950584914002560},
	author = {Nair, Sunil and Jose Luis {de la Vara} and Sabetzadeh, Mehrdad and Falessi, Davide}
}
@article {Simula.simula.1990,
	title = {Traceability and SysML Design Slices to Support Safety Inspections: a Controlled Experiment},
	journal = {ACM Transactions on Software Engineering and Methodology},
	volume = {23},
	number = {9},
	year = {2014},
	publisher = {ACM},
	address = {New York},
	abstract = {Certifying safety-critical software and ensuring its safety requires checking the conformance between safety requirements and design. Increasingly, the development of safety-critical software relies on modeling, and the System Modeling Language (SysML) is now commonly used in many industry sectors. Inspecting safety conformance by comparing design models against safety requirements requires safety inspectors to browse through large models and is consequently time consuming and error-prone. To address this, we have devised a mechanism to establish traceability between (functional) safety requirements and SysML design models to extract design slices (model fragments) that filter out irrelevant details but keep enough context information for the slices to be easy to inspect and understand. In this paper, we report on a controlled experiment assessing the impact of the traceability and slicing mechanism on inspectors\&$\#$39; conformance decisions and effort. Results show a significant decrease in effort and an increase in decisions\&$\#$39; correctness and level of certainty.},
	author = {Briand, Lionel and Falessi, Davide and Nejati, Shiva and Sabetzadeh, Mehrdad and Yue, Tao}
}
@techreport {25311,
	title = {An Extended Systematic Literature Review on Provision of Evidence for Safety Certification},
	number = {2013-02},
	year = {2013},
	note = {This technical report is an early version of a published journal article. The published article can be found here:https://www.simula.no/publications/extended-systematic-literature-review-provision-evidence-safety-certification},
	publisher = {Simula Research Laboratory},
	author = {Nair, Sunil and Jose Luis {de la Vara} and Sabetzadeh, Mehrdad and Falessi, Davide}
}
@article {Simula.simula.2028,
	title = {A Goal-Based Approach for Qualification of New Technologies: Foundations, Tool Support, and Industrial Validation},
	journal = {Reliability Engineering and System Safety (RESS)},
	number = {119},
	year = {2013},
	publisher = {Elsevier},
	abstract = {New technologies typically involve innovative aspects that are not addressed by the existing normative standards and hence are not assessable through common certification procedures. To ensure that new technologies can be implemented in a safe and reliable manner, a specific kind of assessment is performed, which in many industries, e.g., the energy sector, is known as Technology Qualification (TQ). TQ aims at demonstrating with an acceptable level of confidence that a new technology will function within specified limits. Expert opinion plays an important role in TQ, both to identify the safety and reliability evidence that needs to be developed, and to interpret the evidence provided. Since there are often multiple experts involved in TQ, it is crucial to apply a structured process for eliciting expert opinions, and to use this information systematically when analyzing the satisfaction of a technology\&$\#$39;s safety and reliability objectives. In this article, we present a goal-based approach for TQ. Our approach enables analysts to quantitatively reason about the satisfaction of a technology\&$\#$39;s overall goals and further to identify the aspects that must be improved to increase goal satisfaction. The approach is founded on three main components: goal models, expert elicitation, and probabilistic simulation. We describe a tool, named Modus, that we have developed in support of our approach. We provide an extensive empirical validation of our approach through two industrial case studies and a survey.},
	doi = {10.1016/j.ress.2013.05.005},
	author = {Sabetzadeh, Mehrdad and Falessi, Davide and Briand, Lionel and Di Alesio, Stefano}
}
@techreport {RESSJ2013,
	title = {Management of Evidence for Compliance With Safety Standards: a Survey on the State of Practice},
	number = {2012-27},
	year = {2013},
	publisher = {Simula Research Laboratory},
	abstract = {In many domains such as avionics, railway, and automotive, safety-critical systems must comply with prescribed measures for safety, usually presented in the form of safety standards. Demonstrating compliance with a safety standard involves providing convincing evidence that the requirements envisaged by the standard are adequately met. Real systems are large and thus require collecting and managing large quantities of evidence throughout their lifecycle. Lack of knowledge on how to collect, structure, and assess evidence can lead to certification risks. This paper aims to provide insights into how practitioners deal with safety evidence management. Specifically, we report on a survey conducted with the goal of determining practitioners\&$\#$39; practices and perspectives on safety evidence management. A total of 52 practitioners from 15 countries and 11 application domains responded to the survey, indicating what types of information constitute evidence for safety, how evidence is structured and assessed, how evidence evolution is addressed, and what challenges they face with regards to providing evidence. The paper further analyses the commonalities across different application domains and compares the results against the state of the art. The results notably indicate that practitioners currently undertake an extensive amount of manual work while collecting and manipulating evidence information. This can be both costly and error-prone, thus suggesting the need for better tool-support for evidence management.},
	author = {Nair, Sunil and Jose Luis {de la Vara} and Sabetzadeh, Mehrdad and Falessi, Davide}
}
@inproceedings {EmpiRE2013,
	title = {Specifying a Framework for Evaluating Requirements Engineering Technology: Challenges and Lessons Learned},
	journal = {3rd International Workshop on Empirical Requirements Engineering (EmpiRE 2013)},
	year = {2013},
	publisher = {IEEE},
	type = {Workshop},
	abstract = {Evaluating requirements engineering technology is a challenging activity. It becomes even more difficult when having to evaluate the technology and thus to show its suitability in real settings, as access to industrial resources might be limited and the target domain might be complex or very sensitive. This paper reports on our experience in specifying an evaluation framework for requirements engineering technology. The technology aims to improve safety assurance and certification practices, and is being developed in the scope of a large-scale European research project. We focus on presenting the challenges encountered and the lessons learned while specifying the framework. These lessons summarise how we addressed, plan to address, or propose to address the challenges. This information can be useful for other researchers and practitioners that have to evaluate requirements engineering technology in general, and with industry and for safety assurance and certification in particular.},
	author = {Jose Luis {de la Vara} and Falessi, Davide and Verhulst, Eric},
	editor = {Daneva, M. and Conte, T. and Marczak, S. and Susi, A. and Pastor, O. and Marchetto, A.}
}
@article {Simula.approve.88,
	title = {The Value of Design Rationale Information},
	journal = {ACM Transactions on Software Engineering and Methodology},
	volume = {22},
	year = {2013},
	publisher = {ACM},
	abstract = {A complete and detailed Design Rationale Documentation (DRD) could support many software development activities, such as an impact analysis or a major redesign. However, a full DRD is too onerous for systematic industrial use as it is not cost-effective to write, maintain, or read. The key idea investigated in this paper is that DRD should be adopted only to the extent required to support activities particularly difficult to enact or in need of significant improvement in a particular context. The aim of this paper is to empirically investigate the possibility to customize the DRD by documenting only the information that will probably be required for executing an activity. This customization strategy relies on the hypothesis that the value of a DRD information item depends on its category (e.g. Assumptions, Related requirements, etc.) and on the activity it is meant to support. This hypothesis is investigated through two controlled experiments involving a total of seventy-five post-graduate master students as experimental subjects. The value of DRD information was shown to significantly depend on its category and, within the same category, on the activity it supports. Furthermore, our results show that, on average among activities, documenting only the information that has been required at least half of the time (i.e., the information that will probably be required in the future) generates a customized DRD containing about half the information of a full documentation. Such a significant reduction of information to document is expected to mitigate the effects of inhibitors that are currently preventing practitioners from documenting the rationale of their design decisions.},
	author = {Falessi, Davide and Briand, Lionel Claude and Cantone, Giovanni and Capilla, Rafael and Kruchten, Philippe}
}
@article {Simula.approve.66,
	title = {Empirical Principles and an Industrial Case Study in Retrieving Equivalent Requirements Via Natural Language Processing Techniques},
	journal = {IEEE Transactions on Software Engineering},
	volume = {39},
	number = {1},
	year = {2012},
	pages = {18-44},
	publisher = {IEEE},
	abstract = {Though very important in software engineering, linking artifacts of the same type (clone detection) or different types (traceability recovery) is extremely tedious, error-prone and requires significant effort. Past research focused on supporting analysts with mechanisms based on Natural Language Processing (NLP) to identify candidate links. Because a plethora of NLP techniques exists, and their performances vary among contexts, it is important to define and use reliable approaches for selecting the right NLP for the task at hand. In this paper we propose a novel analysis procedure to evaluate the performance of NLP techniques; the procedure aims at alleviating the influence of the adopted dataset on the results and is independent of both the type of artifacts being linked and the type of analyzed NLP. The paper presents a case study that applies the analysis procedure to characterize a large number of NLP techniques for identifying equivalent requirements in the context of an Italian company in the defense and aerospace domain. Major results from the case study include: i) the performances among NLP techniques vary significantly; ii) NLP techniques that are able to detect similarity even when the terms are not identical resulted in worst performances; iii) the combination of NLP techniques significantly improves the benefits of adopting any single NLP; iv) only the 12\% of NLP provide different information.},
	doi = {10.1109/TSE.2011},
	author = {Falessi, Davide and Cantone, Giovanni and Canfora, Gerardo}
}
@inproceedings {comparch2012,
	title = {Interoperability Among UML Tools: an Industrial Case Study},
	journal = {CompArch 2012},
	year = {2012},
	pages = {5-8},
	publisher = {ACM},
	type = {Conference},
	address = {New York, NY, USA},
	abstract = {Large companies like SELEX Sistemi Integrati, consists of several departments (or units), more or less related to each other. In general, every large project is developed by several teams, each team with its own expertise like concurrency, data distribution, etc. These teams may use different UML modeling tools due to their different needs. For example a team may tend to use an open source UML modeling tool like Eclipse, whereas another team may prefer a more stable and consolidated tool like Rational Rose because there are old artifacts (developed with such a tool) that can be reused or because the tool vendor provides a high quality support. Technology changes, this in turn implies that modeling tools evolve and thus the need of the modeling tools users. The life of a large project, like the development of air traffic control system, spans several years. During these years the modeling tools evolve in different versions, providing always more features and hence becoming always more appealing to use. Given the above mentioned circumstances, it is obvious that the interoperability among UML modeling tools is vital to support the development of large projects. With the term interoperability among UML tools we refer to the possibility to develop models and diagrams using a given UML modeling tool, and, in case of absence of any formal error, to be able to evolve theses artifact in another UML modeling tool. The present study reports the solution adopted and the experience gained in SELEX Sistemi Integrati in transferring models and diagrams between Rational Rose 2002 and Artisan Studio 7.},
	isbn = {978-1-4503-1349-0},
	doi = {10.1145/2304636.2304639},
	author = {Barbi, Emanuela and Cantone, Giovanni and D{\textquoteright}Angi{\`o}, Alessandro and Falessi, Davide and Sabbatino, Vincenzo}
}
@inproceedings {sose2012,
	title = {A Model-Driven Approach for Configuring and Deploying Systems of Systems},
	journal = {7th IEEE International Conference System of Systems},
	year = {2012},
	pages = {214-218},
	publisher = {IEEE},
	type = {Conference},
	abstract = {On the one side, the system of systems (SoS) concept, originally suggested as a method to describe the use of different systems interconnected to achieve a specific goal, has grown in its myriad of definitions and concepts. Nevertheless, a common defining attribute of a SoS that critically differentiates it from a single monolithic system is interoperability, or lack thereof, among the constituent parts (i.e., systems). On the other side, model driven engineering has gained increasing interest in the industry as a way to express and analyze system requirements, specifications, architectures, and designs. Model driven engineering consists in developing models before the actual artifact products are designed and then transform the models to the actual artifacts in an automated way. It is therefore obvious how the application of model driven engineering is a perfect solution for defining and analyzing the communications among the systems constituting the SoS.},
	doi = {10.1109/SYSoSE.2012.6384139},
	author = {Barbi, Emanuela and Cantone, Giovanni and Falessi, Davide and Rizzuto, Marco and Sabbatino, Vincenzo and Scarrone, Stefano},
	editor = {Jamshidi, Mo and Sacile, Roberto and Henshaw, Michael}
}
@inproceedings {researchbased,
	title = {Research-Based Innovation: a Tale of Three Projects in Model-Driven Engineering},
	journal = {Model Driven Engineering Languages and Systems, 15th International Conference, MODELS 2012},
	volume = {7590},
	year = {2012},
	pages = {793-809},
	publisher = {Springer Berlin Heidelberg},
	type = {Conference},
	abstract = {In recent years, we have been exploring ways to foster a closer collaboration between software engineering research and industry both to align our research with practical needs, and to increase awareness about the importance of research for innovation. This paper outlines our experience with three research projects conducted in collaboration with the industry. We examine the way we collaborated with our industry partners and describe the decisions that contributed to the effectiveness of the collaborations. We report on the lessons learned from our experience and illustrate the lessons using examples from the three projects. The lessons focus on the applications of Model-Driven Engineering (MDE), as all the three projects we draw on here were MDE projects. Our goal from structuring and sharing our experience is to contribute to a better understanding of how researchers and practitioners can collaborate more effectively and to gain more value from their collaborations.},
	keywords = {Conference},
	doi = {10.1007/978-3-642-33666-9\_50},
	author = {Falessi, Davide and Nejati, Shiva and Sabetzadeh, Mehrdad and Yue, Tao},
	editor = {Briand, Lionel}
}
@article {Simula.simula.1122,
	title = {A SysML-Based Approach to Traceability Management and Design Slicing in Support of Safety Certification: Framework, Tool Support, and Case Studies},
	journal = {Information and Software Technology},
	volume = {54},
	number = {6, June 2012},
	year = {2012},
	pages = {569-590},
	publisher = {Butterworth-Heinemann/ Elsevier },
	abstract = {Traceability is one of the basic tenets of all safety standards and a key prerequisite for software safety certification. In the current state of practice, there is often a significant traceability gap between safety requirements and software design. Poor traceability, in addition to being a non-compliance issue on its own, makes it difficult to determine whether the design fulfills the safety requirements, mainly because the design aspects related to safety cannot be clearly identified. The goal of this article is to develop a framework for specifying and automatically extracting design aspects relevant to safety requirements. This goal is realized through the combination of two components: (1) A methodology for establishing traceability between safety requirements and design, and (2) an algorithm that can extract for any given safety requirement a minimized fragment (slice) of the design that is sound, and yet easy to understand and inspect. We ground our framework on System Modeling Language (SysML). The framework includes a traceability information model, a methodology to establish traceability, and mechanisms for model slicing based on the recorded traceability information. The framework is implemented in a tool, named SafeSlice. We prove that our slicing algorithm is sound for temporal safety properties, and argue about the completeness of slices based on our practical experience. We report on the lessons learned from applying our approach to two case studies, one benchmark and one industrial case. Both studies indicate that our approach substantially reduces the amount of information that needs to be inspected for ensuring that a given (behavioral) safety requirement is met by the design.},
	author = {Nejati, Shiva and Sabetzadeh, Mehrdad and Falessi, Davide and Briand, Lionel Claude and Thierry, Coq}
}
@inproceedings {19466,
	title = {Combining Goal Models, Expert Elicitation, and Probabilistic Simulation for Qualification of New Technology},
	journal = {The 13th IEEE International High Assurance Systems Engineering Symposium (HASE 2011)},
	year = {2011},
	type = {Conference},
	abstract = {New technologies typically involve innovative aspects that are not addressed by the existing normative standards and hence are not assessable through common certification procedures. To ensure that new technologies can be implemented in a safe and reliable manner, a specific kind of assessment is performed, which in many industries, e.g., the energy sector, is known as Technology Qualification (TQ). TQ aims at demonstrating with an acceptable level of confidence that a new technology will function within specified limits. Expert opinion plays an important role in TQ, both to identify the safety and reliability evidence that needs to be developed, and to interpret the evidence provided. Hence, it is crucial to apply a systematic process for eliciting expert opinions, and to use the opinions for measuring the satisfaction of a technology\&$\#$39;s safety and reliability objectives. In this paper, drawing on the concept of assurance cases, we propose a goal-based approach for TQ. The approach, which is supported by a software tool, enables analysts to quantitatively reason about the satisfaction of a technology\&$\#$39;s overall goals and further to identify the aspects that must be improved to increase goal satisfaction. The three main components enabling quantitative assessment are goal models, expert elicitation, and probabilistic simulation. We report on an industrial pilot study where we apply our approach for assessing a new offshore technology.},
	doi = {10.1109/HASE.2011.22},
	author = {Sabetzadeh, Mehrdad and Falessi, Davide and Briand, Lionel and Di Alesio, Stefano and McGeorge, Dag and {\r A}hjem, Vidar and Borg, Jonas}
}
@techreport {25316,
	title = {Combining Goal Models, Expert Elicitation, and Probabilistic Simulation for Qualification of New Technology},
	number = {2011-09},
	year = {2011},
	note = {This technical report is an early version of a published conference paper. The published paper can be found here:https://www.simula.no/publications/combining-goal-models-expert-elicitation-and-probabilistic-simulation-qualification-new},
	publisher = {Simula Research Laboratory},
	author = {Sabetzadeh, Mehrdad and Falessi, Davide and Lionel C. {Briand} and McGeorge, Dag and {\r A}hjem, Vidar and Borg, Jonas}
}
@article {Simula.simula.213,
	title = {Decision-Making Techniques for Software Architecture Design: a Comparative Survey},
	journal = {ACM Computing Surveys},
	volume = {43},
	number = {4},
	year = {2011},
	publisher = {ACM},
	abstract = {The architecture of a software intensive system can be defined as the set of relevant design decisions that affect the qualities of the overall system functionality; therefore, architectural decisions are eventually crucial to the success of a software project. The software engineering literature describes several techniques to choose among architectural alternatives, but it gives no clear guidance on which technique is more suitable than another, and in which circumstances. As such, there is no systematic way for software engineers to choose among decision-making techniques for resolving tradeoffs in architecture design. In this paper, we provide a comparison of existing decision-making techniques, aimed to guide architects in their selection. Results show that there is no \&ldquo;best\&rdquo; decision-making technique; however, some techniques are more susceptible to specific difficulties. Hence, architects should choose a decision-making technique based on the difficulties that they wish to avoid. This paper represents a first attempt to reason on meta-decision-making, i.e., the issue of deciding how to decide.},
	doi = {10.1145/1978802.1978812 },
	author = {Falessi, Davide and Cantone, Giovanni and Kazman, Rick and Kruchten, Philippe}
}
@article {Simula.simula.182,
	title = {Planning for Safety Evidence Collection: a Tool-Supported Approach Based on Modeling of Standards Compliance Information},
	journal = {IEEE Software},
	volume = {pp},
	number = {99},
	year = {2011},
	publisher = {IEEE},
	abstract = {Safety-critical software-dependent systems such as those found in the avionics, automotive, maritime, and energy domains often need to be certified by a licensing or regulatory body based on one or more safety standards. Safety standards often do not specify the details of the evidence that needs to be collected for the certification of a particular system because these standards need to remain generic and applicable to a wide variety of systems and domains. Without an upfront agreement between the system supplier and the certifier about the details of the evidence that needs to be collected, there will invariably be important omissions in the evidence information provided by the supplier, which need to be remedied after the fact and at significant costs. In this paper, we present a flexible and tool-supported approach for assisting suppliers and certifiers in developing an agreement about the evidence necessary to demonstrate compliance to a safety standard. Our approach is model-based; specifically, the safety standard of interest is expressed via an information model. This helps manage the complexity of safety standards, provides precise interpretation for the standards, and ensures the completeness and consistency of the generated agreement.},
	author = {Falessi, Davide and Sabetzadeh, Mehrdad and Briand, Lionel Claude and Turella, Emanuele and Coq, Thierry and Rajwinder Kaur {Panesar-Walawege}}
}
@techreport {Simula.simula.820,
	title = {Research-Based Innovation: a Tale of Three Projects in Model-Driven Engineering},
	number = {2011-18},
	year = {2011},
	month = {October},
	publisher = {Simula Research Laboratory},
	abstract = {Engineering research needs to be informed by (or based on) industrial needs to have impact, and industrial innovation depends on research to fill the gaps in knowledge and to pave the way for better tools, technologies, and services. In the past few years, we have been exploring ways to foster a closer collaboration between research and industry both to align our research with practical needs, and to further increase awareness about the important role that software engineering research plays as an enabler for innovation. This paper outlines our experiences with three recent and successful research projects conducted in collaboration with the maritime and energy industry. We take a retrospective approach to examine the way we collaborated with our industry partners and elaborate the decisions that we believe contributed to the effectiveness of the collaborations. We report the lessons learned from our experience and illustrate these lessons using examples from the three projects. The lessons focus on the applications of Model-Driven Engineering (MDE), as all the three projects we draw on here were MDE projects. Our goal from structuring and sharing our experience is to contribute to a better understanding of how researchers and practitioners can collaborate more effectively and to gain more value from their collaborations.},
	author = {Briand, Lionel and Falessi, Davide and Nejati, Shiva and Sabetzadeh, Mehrdad and Yue, Tao}
}
@inproceedings {Simula.simula.970,
	title = {SafeSlice: a Model Slicing and Design Safety Inspection Tool for SysML.},
	journal = {SIGSOFT/FSE{\textquoteright}11 19th ACM SIGSOFT Symposium on the Foundations of Software Engineering (FSE-19) and ESEC{\textquoteright}11: 13rd European Software Engineering Conference (ESEC-13)},
	year = {2011},
	publisher = {ACM},
	type = {Conference},
	abstract = {Software safety certification involves checking that the software design meets the (software) safety requirements. In practice, inspections are one of the primary vehicles for ensuring that safety requirements are satisfied by the design. Unless the safety-related aspects of the design are clearly delineated, the inspections conducted by safety assessors would have to consider the entire design, although only small fragments of the design may be related to safety. In a model-driven development context, this means that the assessors have to browse through large models, understand them, and identify the safety-related fragments. This is time-consuming and error-prone, specially noting that the assessors are often third party regulatory bodies who were not involved in the design. To address this problem, we describe in this paper a prototype tool called, SafeSlice, that enables one to automatically extract the safety-related slices (fragments) of design models. The main enabler for our slicing technique is the traceability between the safety requirements and the design, established by following a structured design methodology that we propose. Our work is grounded on SysML, which is being increasingly used for expressing the design of safety-critical systems. We have validated our work through two case studies and a control experiment which we briefly outline in the paper.},
	isbn = {978-1-4503-0443-6},
	author = {Falessi, Davide and Nejati, Shiva and Sabetzadeh, Mehrdad and Briand, Lionel and Messina, Antonio},
	editor = {Andreas Zeller Tib {Gyim{\'o}thy}}
}
@techreport {Simula.simula.193,
	title = {A SysML-Based Approach to Traceability Management and Design Slicing in Support of Safety Certification: Framework, Tool Support, and Case Studies},
	number = {2011-01},
	year = {2011},
	month = {January},
	publisher = {Simula Research Laboratory},
	abstract = {Context: Traceability is one of the basic tenets of all software safety standards and a key prerequisite for certification of software. Despite this, the safety-critical software industry is still suffering from a chronic lack of guidelines on traceability. An acute traceability problem that we have identified through observing software safety certification processes has to do with the link between safety requirements and software design. In the current state of practice, this link often lacks sufficient detail to support the systematic inspections conducted by the certifiers of the software safety documentation. As a result, the suppliers often have to remedy the traceability gaps after the fact which can be very expensive and the outcome often is far from satisfactory. Objective: The objective of this article is developing a framework to enable systematic and efficient software design inspections during safety certification. In particular, the framework enables safety engineers and certifiers to extract design slices (model fragments) that filter out irrelevant details but keep enough context information for the slices to be easy to inspect and understand. This helps reduce cognitive load and thus makes it less likely that serious safety issues would be overlooked. Method: Our framework is grounded on SysML which is rapidly becoming the notation of choice for developing safety-critical systems. The framework includes a traceability information model, a methodology to establish traceability, and mechanisms to use traceability for extracting slices of models relevant to a particular safety requirement. The framework is implemented in a tool, named SafeSlice, that supports establishing the traceability links envisaged by the methodology, automated consistency checking of these links, and automated generation of SysML design slices. Results: We provide a formal proof that our slicing algorithm is sound for temporal safety properties, and argue about the completeness of the slices based on our practical experience. We report on the lessons learned from applying our approach to two case studies, one benchmark case and one industrial case. Both case studies indicate that our approach offers benefits by substantially reducing the amount of information that needs to be inspected in order to ensure that a given safety requirement is met by the design.},
	author = {Nejati, Shiva and Sabetzadeh, Mehrdad and Falessi, Davide and Briand, Lionel Claude and Coq, Thierry}
}
@book {Simula.approve.36,
	title = {11th International Conference on Product Focused Software Development and Process Improvement (PROFES2010) - Second Proceeding: Short Papers, Doctoral Symposium and Workshops},
	year = {2010},
	month = {June},
	publisher = {Universitalia},
	isbn = {978-88-6507-067-3},
	author = {Falessi, Davide and Zhang, He and Hall, Tracy and H{\"o}st, Martin and Niazi, Mahmood and Mishra, Alok}
}
@article {Simula.simula.209,
	title = {Applying Empirical Software Engineering to Software Architecture: Challenges and Lessons Learned},
	journal = {Empirical Software Engineering},
	volume = {15},
	number = {3},
	year = {2010},
	pages = {250-276},
	publisher = {Springer},
	abstract = {In the last 15 years, software architecture has emerged as an important software engineering field for managing the development and maintenance of large, software-intensive systems. Software architecture community has developed numerous methods, techniques, and tools to support the architecture process (analysis, design, and review). Historically, most advances in software architecture have been driven by talented people and industrial experience, but there is now a growing need to systematically gather empirical evidence about the advantages or otherwise of tools and methods rather than just rely on promotional anecdotes or rhetoric. The aim of this paper is to promote and facilitate the application of the empirical paradigm to software architecture. To this end, we describe the challenges and lessons learned when assessing software architecture research that used controlled experiments, replications, expert opinion, systematic literature reviews, observational studies, and surveys. Our research will support the emergence of a body of knowledge consisting of the more widely-accepted and well-formed software architecture theories.},
	doi = {10.1007/s10664-009-9121-0},
	author = {Falessi, Davide and Muhammad Ali {Babar} and Cantone, Giovanni and Kruchten, Philippe}
}
@inproceedings {Simula.approve.24,
	title = {A Comprehensive Characterization of NLP Techniques for Identifying Equivalent Requirements},
	journal = {International Symposium on Empirical Software Engineering and Measurement (ESEM 2010)},
	year = {2010},
	publisher = {ACM},
	type = {Conference},
	abstract = {[Context] Though very important in software engineering, linking artifacts of the same type (clone detection) or of different types (traceability recovery) is extremely tedious, error-prone and requires significant effort. Past research focused on supporting analysts with mechanisms based on Natural Language Processing (NLP) to identify candidate links. Because a plethora of NLP techniques exists, and their performances vary among contexts, it is important to characterize them according to the provided level of support. [Objective] The aim of this paper is to characterize a comprehensive set of NLP techniques according to the provided level of support to the human analyst in detecting equivalent requirements. [Method] The characterization consists on a case study, featuring real requirements, in the context of an Italian company in the defense and aerospace domain. [Results] The major result from the case study is that simple NLP are more precise than complex ones.},
	isbn = {978-1-4503-0039-1},
	author = {Falessi, Davide and Cantone, Giovanni and Canfora, Gerardo},
	editor = {Succi, Giancarlo and Morisio, Maurizio and Nagappan, Nachi}
}
@article {Simula.simula.211,
	title = {Peaceful Coexistence: Agile Developer Perspectives on Software Architecture},
	journal = {IEEE Software},
	volume = {27},
	number = {2},
	year = {2010},
	pages = {23-25},
	publisher = {IEEE},
	abstract = {A study of the relationship between agile methods and software architecture surveyed 72 IBM software developers. Results suggest that the two approaches are compatible. In particular, agile developers perceived architectural principles as important and supportive to agile values, rather than contrasting or neutral to them. This positive perception of software architectural principles and practice bodes well for future efforts to integrate agile and architecture practices.},
	doi = {10.1109/MS.2010.49},
	author = {Falessi, Davide}
}
@techreport {Simula.simula.277,
	title = {The Value of Design Rationale Information},
	number = {2010-13},
	year = {2010},
	publisher = {Simula Research Laboratory},
	abstract = {A complete and detailed Design Rationale Documentation (DRD) could support many software development activities, such as an impact analysis or a major redesign. However, a full DRD is too onerous for systematic industrial use as it is not cost-effective to write, maintain, or read. The key idea investigated in this paper is that DRD should be adopted only to the extent required to support activities particularly difficult to enact or in need of significant improvement in a particular context. The aim of this paper is to empirically investigate the possibility to customize the DRD by documenting only the information that will probably be required for executing an activity. This customization strategy relies on the hypothesis that the value of a DRD information item depends on its category (e.g. Assumptions, Related requirements, etc.) and on the activity it is meant to support. This hypothesis is investigated through two controlled experiments involving a total of seventy-five post-graduate master students as experimental subjects. The value of DRD information was shown to significantly depend on its category and, within the same category, on the activity it supports. Furthermore, our results show that, on average among activities, documenting only the information that has been required at least half of the time (i.e., the information that will probably be required in the future) generates a customized DRD containing about half the information of a full documentation. Such a significant reduction of information to document is expected to mitigate the effects of inhibitors that are currently preventing practitioners from documenting the rationale of their design decisions.},
	author = {Falessi, Davide and Briand, Lionel and Cantone, Giovanni and Capilla, Rafael and Kruchten, Philippe}
}
@techreport {Simula.SE.681,
	title = {The Impact of Automated Support for Linking Equivalent Requirements Based on Similarity Measures},
	number = {2009-08},
	year = {2009},
	publisher = {Simula Research Laboratory},
	abstract = {When developing systems of systems, requirements tend to be redundant especially when running large numbers of projects, with many requirements per project, and diverse sources of requirements. It is therefore necessary to consolidate requirements by identifying the ones that are equivalent in order to avoid redundant work. The aim of this paper is to evaluate requirement similarity measurement to support analysts when linking equivalent requirements. The evaluation is conducted based on the requirements management process of an Italian company in the defense and aerospace domain. Our empirical investigation combines a controlled experiment with graduate students and an industrial case study. Results clearly show that one cannot expect any significant advantage in general. The level of support provided by similarity measures significantly depends on their level of credibility, that is the extent to which similarity measurement reliably indicates the equivalence of requirements. On average, given the credibility distribution observed in our industrial case study, showing similarity measurement to analysts is expected to: 1) improve by 20\% the number of equivalence links identified per minute and 2) decrease by 40\% the number of incorrect links. Finally, we investigate whether there is an effective way to combine human judgment and similarity measurement to effectively determine equivalence links. Based on machine learning, our approach yielded positive results both in terms of the correctness of the links and the speed at which they are established. Moreover, this hybrid solution is effective even when the credibility of similarity measurement is half the average we observed in our industrial case study. In conclusion, our results confirm and complement past empirical studies on the practical benefit, in terms of both quality and speed, of adopting requirement similarity measurement for linking equivalent requirements.},
	author = {Falessi, Davide and Briand, Lionel and Cantone, Giovanni}
}
@inbook {Simula.simula.440,
	title = {Exploring Feasibility of Software Defects Orthogonal Classification},
	booktitle = {Communications in Computer and Information Science},
	year = {2008},
	pages = {136-152},
	publisher = {Springer},
	organization = {Springer},
	chapter = {1},
	isbn = {978-3-540-70621-2},
	author = {Falessi, Davide and Cantone, Giovanni},
	editor = {Filipe, Joaquim and Shishkov, Boris and Helfert, Markus}
}
@inproceedings {Simula.simula.476,
	title = {Implementing Product Line Engineering in Industry: Feedback From the Field to Research},
	journal = {Product-Focused Software Process Improvement, LNCS},
	volume = {5089/2008},
	year = {2008},
	publisher = {Springer},
	type = {Conference},
	abstract = {Software product line engineering refers to methods (tools and techniques) for creating sets of similar software systems by taking advantage of their commonalities and predicted variabilities. After successfully installing product line engineering in practice, organizations typically experience a great improvement with respect to productivity or quality. Product line engineering is a proactive and strategic approach towards software reuse that requires the involvement of whole organizations to be successful. Implementing product line engineering in practice thus corresponds to identifying a strategy that transforms an existing organization into an organization that is fully centered around their product line(s), Although this transformation impacts nearly everything in an organization, it is often realized in an incremental way to manage risks and to ensure that production continues during the change process. This workshop aims at a great collection of experience reports in implementing product line engineering in practice. The reports should expose best practices and typical challenges of transferring product line technology into practice. During the workshop we will also try to identify proven first steps that make a first, successful step towards the ultimate vision of product line engineering.},
	isbn = {978-3-540-69564-6},
	author = {Falessi, Davide and Muthig, Dirk},
	editor = {Outi Salo Andre {Jedlitschka}}
}
@book {Simula.simula.438,
	title = {Product Focused Software Process Improvement 2008- Short Paper Session Proceeding},
	year = {2008},
	publisher = {Universitalia},
	isbn = {8895244133},
	author = {Falessi, Davide and Heidrich, Jens}
}
@inproceedings {Simula.simula.478,
	title = {Value-Based Design Decision Rationale Documentation: a Replicated Experiment},
	journal = {Proceedings of the 3rd international workshop on Sharing and reusing architectural knowledge},
	year = {2008},
	publisher = {ACM},
	type = {Conference},
	abstract = {ABSTRACT The explicit documentation of the rationale of design decisions is a practice generally encouraged but rarely implemented in industry because of a variety of inhibitors. Known methods for Design Decisions Rationale Documentation (DDRD) are aimed to maximize the benefits for practitioners who should utilize the DDRD by imposing the burden on the developers of documenting all the potentially useful information. In our view, the adoption of a tailored DDRD, consisting only of the required set of information, would mitigate the effects of DDRD inhibitors. This paper focuses on confirming empirically the feasibility of a valuebased approach for documenting the rationale behind design decisions, and the importance of different DDRD information categories. In this context, this work describes a replicated experiment carried out at the University Rey Juan Carlos of Madrid (Spain) aimed to validate previous results from an analogous study conducted at the University of Roma Tor Vergata (Italy). Results confirm that the level of utility related to the same category of DDRD information significantly changes depending on its purpose.},
	isbn = {978-1-60558-038-8},
	author = {Falessi, Davide and Capilla, Rafael and Cantone, Giovanni},
	editor = {Avgeriou, Paris and Lago, Patricia and Kruchten, Philippe}
}
@inproceedings {Simula.simula.442,
	title = {Value-Based Design Decision Rationale Documentation: Principles and Empirical Feasibility Study},
	journal = {Seventh Working IEEE/IFIP Conference on Software Architecture},
	year = {2008},
	publisher = {IEEE},
	type = {Conference},
	abstract = {The explicit documentation of the rationale of design decisions is a practice generally encouraged, but rarely implemented in industry because of a variety of inhibitors. Methods proposed in the past for Design Decisions Rationale Documentation (DDRD) aimed to maximize benefits for the DDRD consumer by imposing on the producer of DDRD the burden to document all the potentially useful information. We propose here a compromise which consists in tailoring DDRD, based on its intended use or purpose. In our view, the adoption of a tailored DDRD, consisting only of the required set of information, would mitigate the effects of DDRD inhibitors. The aim of this paper is twofold: i) to discuss the application of Value-Based Software Engineering principles to DDRD, ii) to describe a controlled experiment to empirically analyze the feasibility of the proposed method. Results show that the level of utility related to the same category of DDRD information significantly changes depending on its purpose; such result is novel and it demonstrates the feasibility of the proposed valuebased DDRD.},
	isbn = {978-0-7695-3092-5},
	author = {Falessi, Davide and Cantone, Giovanni and Kruchten, Philippe},
	editor = {Kruchten, Philippe and Garlan, David and Woods, E{\'o}in}
}
@inproceedings {Simula.simula.454,
	title = {A Comparison of Structured Analysis and Object Oriented Analysis: an Experimental Study},
	journal = {International Conference on Software and Data Tecnologies 2007},
	year = {2007},
	publisher = {INSTICC Press},
	type = {Conference},
	abstract = {Despite the fact that object oriented paradigm is actually widely adopted for software analysis, design, and implementation, there are still a large number of companies that continue to utilize the structured approach to develop software analysis and design. The fact is that the current worldwide agreement for object orientation is not supported by enough empirical evidence on advantages and disadvantages of object orientation vs. other paradigms in different phases of the software development process. In this work we describe an empirical study focused on comparing the time required for analyzing a data management system by using both object orientation and a structural technique. We choose the approach indicated by the Rational Unified Process, and the Structured Analysis and Design Technique, as instances of object oriented and structured analysis techniques, respectively. The empirical study that we present considers both an uncontrolled and a controlled experiment with Master students. Its aim is to analyze the effects of those techniques to software analysis both for software development from scratch, and enhancement maintenance, respectively. Results show no significant difference in the time required for developing or maintaining a software application by applying those two techniques, whatever is the order of their application. However we found two major tendencies regarding object orientation: 1) it is more sensitive to subjects{\textquoteright} peculiarities, and 2) it is able to provide some reusability advantages already at the analysis level. Since such result concerns a one-hour-size enhancement maintenance, we expect significant benefits from using object orientation, in case of real-size extensions.},
	isbn = {978-989-8111-05-0},
	author = {Falessi, Davide and Cantone, Giovanni and Grande, Claudio},
	editor = {Filipe, Joaquim and Shishkov, Boris and Helfert, Markus}
}
@inproceedings {Simula.simula.444,
	title = {Do Software Architecture Design Methods Meet Architects{\textquoteright} Needs?},
	journal = {Sixth Working IEEE/IFIP Conference on Software Architecture},
	year = {2007},
	publisher = {IEEE},
	type = {Conference},
	abstract = {Several Software Architecture Design Methods (SADM) have been published, reviewed, and compared. But these surveys and comparisons are mostly centered on intrinsic elements of the design method, and they do not compare them from the perspective of the actual needs of software architects.We would like to analyze the completeness of SADM from an architect{\textquoteright}s point of view. To do so, we define nine categories of software architects{\textquoteright} needs, propose an ordinal scale for evaluating the degree to which a given SADM meets the needs, and then apply this to a small set of SADMs. The contribution of the paper is twofold: (i) to provide a different and useful frame of reference for architects to select SADM, and (ii) to suggest SADM areas of improvements. We found two answers to our question: {\textquotedblleft}do architectural design methods meet the needs of the architect?{\textquotedblright} Yes, all architect{\textquoteright}s needs are met by one or another SADM, but No, no architectural design method meets simultaneously all the needs of an architect. This approach may lead to improvements of existing SADMs.},
	isbn = {978-0-7695-2744-4},
	author = {Falessi, Davide and Cantone, Giovanni and Kruchten, Philippe},
	editor = {Paulish, Dan and Gorton, Ian and Tyree, Jeff and Soni, Dilip}
}
@inproceedings {Simula.simula.452,
	title = {Issues in Applying Empirical Software Engineering to Software Architecture},
	journal = {First European Conference on Software Architecture},
	volume = {LNCS 4758/2007},
	year = {2007},
	publisher = {Springer},
	type = {Conference},
	abstract = {Empirical software engineering focuses on the evaluation of software engineering technologies, such as processes and tools, by comparing related sets of data. It has contributed a valuable body of knowledge in several areas such as Software Economics and Software Quality, which in turn drove important advances in related tools and techniques. Unfortunately this is not (yet) the case for software architecture, where empirical studies are still few. Such a condition demands for further empirical research efforts on the topic of software architecture and suggests specific areas of improvement. In this paper we discuss several essential, innovative, and maybe provocative, questions such as: Why do we have so few applications of empirical software engineering on software architecture? Which are the main difficulties? What can we do?},
	isbn = {9783540751311},
	author = {Falessi, Davide and Kruchten, Philippe and Cantone, Giovanni},
	editor = {Carlos Enrique {Cuesta} and Marcos, Esperanza and Oquendo, Flavio}
}
@inproceedings {Simula.simula.458,
	title = {Design Decision Rationale: Experiences and Towards a Systematic Use},
	journal = {ACM SIGSOFT Software Engineering Notes},
	volume = {31},
	number = {5},
	year = {2006},
	publisher = {ACM},
	type = {Conference},
	abstract = {Design decisions crucially influence the success of every software project. While the resulting design is typically documented quite well, the situation is usually different for the underlying rationale and decision-making process. Despite being recognized as a helpful approach in general, the explicit documentation of Design Decision Rationale (DDR) is not yet largely utilized due to some inhibitors (e.g., additional documentation effort). Experience with other qualities, e.g. software reusability, evidently shows that an improvement of these qualities only pays off on a large scale and therefore has to be pursued in a strategic, pre-planned, and carefully focused way. In this paper we argue that this also has to be considered for documenting DDR. To this end the paper presents: (i) the Decision, Goal, and Alternatives (DGA) DDR framework, (ii) experience in dealing with DGA, (iii) motivators and inhibitors of using DDR, and (iv) an approach for systematic DDR use that follows value-based software engineering principles.},
	isbn = {10.1145/1163514.1178642},
	doi = {10.1145/1163514.1178642},
	author = {Falessi, Davide and Cantone, Giovanni and Becker, Martin},
	editor = {Paris Avgeriou P {Lago}}
}
@inproceedings {Simula.simula.484,
	title = {Documenting Design Decision Rationale to Improve Individual and Team Design Decision Making: an Experimental Evaluation},
	journal = {ISESE {\textquoteright}06 Proceedings of the 2006 ACM/IEEE international symposium on Empirical software engineering},
	year = {2006},
	publisher = {ACM},
	type = {1},
	abstract = {Individual and team decision-making have crucial influence on the level of success of every software project. Even though several studies were already conducted, which concerned design decision rationale documentation approaches, a few of them focused on performances and evaluated them in laboratory. This paper proposes a technique to document design decision rationale, and evaluates experimentally the impact such a technique has on effectiveness and efficiency of individual/team decision-making in presence of requirement changes. The study was conducted as a controlled experiment. Fifty post-graduate Master students performed in the role of experiment subjects. Documented design decisions regarding the Ambient Intelligence paradigm constituted the experiment objects. Main results of the experiment show that, for both individual and team-based decision-making, effectiveness significantly improves, while efficiency remains unaltered, when decision-makers are allowed to use, rather not use, the proposed design rationale documentation technique.},
	isbn = {1-59593-218-6},
	author = {Falessi, Davide and Becker, Martin and Cantone, Giovanni},
	editor = {Jos{\'e} Carlos Mal {Wohlin}}
}
@inproceedings {Simula.simula.482,
	title = {Exploring Feasibility of Software Defects Orthogonal Classification},
	journal = {International Conference on Software and Data Tecnologies (ICSOFT 2006)},
	year = {2006},
	publisher = {INSTICC Press 2006},
	type = {1},
	abstract = {Defect categorization is the basis of many works that relate to software defect detection. The assumption is that different subjects assign the same category to the same defect. Because this assumption was questioned, our following decision was to study the phenomenon, in the aim of providing empirical evidence. Because defects can be categorized by using different criteria, and the experience of the involved professionals in using such a criterion could affect the results, our further decisions were: (i) to focus on the IBM Orthogonal Defect Classification (ODC); (ii) to involve professionals after having stabilized process and materials with students. This paper is concerned with our basic experiment. We analyze a benchmark including two thousand and more data that we achieved through twenty-four segments of code, each segment seeded with one defect, and by one hundred twelve sophomores, trained for six hours, and then assigned to classify those defects in a controlled environment for three continual hours. The focus is on: Discrepancy among categorizers, and orthogonality, affinity, effectiveness, and efficiency of categorizations. Results show: (i) training is necessary to achieve orthogonal and effective classifications, and obtain agreement between subjects, (ii) efficiency is five minutes per defect classification in the average, (iii) there is affinity between some categories.},
	isbn = {972-8865-69-4},
	author = {Falessi, Davide and Cantone, Giovanni},
	editor = {Filipe, Joaquim and Shishkov, Boris and Helfert, Markus}
}
