@article {dialesio2015combining,
	title = {Combining Genetic Algorithms and Constraint Programming to Support Stress Testing of Task Deadlines},
	journal = {ACM Transactions on Software Engineering and Methodology (TOSEM)},
	volume = {25},
	year = {2015},
	month = {12/2015},
	pages = {1-37},
	publisher = {ACM},
	abstract = {Tasks in Real Time Embedded Systems (RTES) are often subject to hard deadlines, that constrain how quickly the system must react to external inputs. These inputs and their timing vary in a large domain depending on the environment state, and can never be fully predicted prior to system execution. Therefore, approaches for stress testing must be developed to uncover possible deadline misses of tasks for different input arrival times. In this paper, we describe stress test case generation as a search problem over the space of task arrival times. Specifically, we search for worst case scenarios maximizing deadline misses where each scenario characterizes a test case. In order to scale our search to large industrial-size problems, we combine two state-of-the-art search strategies, namely Genetic Algorithms (GA) and Constraint Programming (CP). Our experimental results show that, in comparison with GA and CP in isolation, GA+CP achieves nearly the same effectiveness as CP and the same efficiency and solution diversity as GA, thus combining the advantages of the two strategies. In light of these results, we conclude that a combined GA+CP approach to stress testing is more likely to scale to large and complex systems.},
	doi = {10.1145/2818640},
	author = {Di Alesio, Stefano and Nejati, Shiva and Briand, Lionel and Gotlieb, Arnaud}
}
@inproceedings {19185,
	title = {Efficient Architecture-Level Configuration of Large-Scale Embedded Software Systems},
	journal = {6th International Conference on Fundamentals of Software Engineering (FSEN). Tehran, Iran, April 22-24},
	year = {2015},
	publisher = {Springer},
	abstract = {Configuration is a recurring problem in many domains. In our earlier work, we focused on architecture-level configuration of large-scale embedded software systems and proposed a methodology that enables engineers to configure products by instantiating a given reference architecture model. Products have to satisfy a number of constraints specified in the reference architecture model. If not, the engineers have to backtrack their configuration decisions to rebuild a configured product that satisfies the constraints. Backtracking configuration decisions makes the configuration process considerably slow. In this paper, we improve our earlier work and propose a backtrack-free configuration mechanism. Specifically, given a cycle-free generic reference architecture model, we propose an algorithm that computes an ordering over configuration parameters that yields a consistent configuration without any need to backtrack. We evaluated our approach on a simplified model of an industrial case study. We show that our ordering approach eliminates backtracking. It reduces the overall configuration time by both reducing the required number of value assignments, and reducing the time that it takes to complete one configuration iteration. Furthermore, we show that the latter has a linear growth with the size of the configuration problem.},
	isbn = {978-3-319-24643-7},
	author = {Behjati, Razieh and Nejati, Shiva}
}
@article {Simula.simula.2598,
	title = {Architecture-Level Configuration of Large-Scale Embedded Software Systems},
	journal = {ACM Transactions on Software Engineering and Methodology},
	volume = {23},
	number = {3},
	year = {2014},
	publisher = {ACM},
	abstract = {Configuration in the domain of integrated control systems (ICS) is largely manual, laborious, and error-prone. In this paper, we propose a model-based configuration approach that provides automation support for reducing configuration effort and the likelihood of configuration errors in the ICS domain. We ground our approach on component-based specifications of ICS families. We then develop a configuration algorithm using constraint satisfaction techniques over finite domains to generate products that are consistent with respect to their ICS family specifications. We reason about the termination and consistency of our configuration algorithm analytically. We evaluate the effectiveness of our configuration approach by applying it to a real subsea oil production system. Specifically, we have rebuilt a number of existing verified product configurations of our industry partner. Our experience shows that our approach can automatically infer up to 50\% of the configuration decisions, and reduces the complexity of making configuration decisions.},
	author = {Behjati, Razieh and Nejati, Shiva and Briand, Lionel Claude}
}
@techreport {Simula.simula.2608,
	title = {Backtrack-Free Consistent Configuration of Highly-Configurable Systems},
	number = {2014-02},
	year = {2014},
	publisher = {Simula Research Laboratory},
	abstract = {Configuration is a recurring problem in many domains. In this paper, we focus on architecture-level configuration of large-scale embedded software systems. In this context, engineers configure products by instantiating a given reference architecture model. The elements in each product instance have to satisfy a number of constraints specified in the reference architecture model. If not, the engineers have to backtrack their configuration decisions to rebuild a configured product satisfying the constraints. Backtracking configuration decisions makes the configuration process considerably slow. In this paper, we propose a backtrack-free configuration mechanism. Specifically, given a generic reference architecture, we provide an ordering over configuration parameters. Utilizing this ordering over parameters, we then propose a configuration algorithm and prove that our algorithm produces consistent products without ever requiring backtracking.},
	author = {Behjati, Razieh and Nejati, Shiva}
}
@misc {Simula.simula.3050,
	title = {Interactive Configuration Verification Using Constraint Programming},
	howpublished = {Lyon, France},
	year = {2014},
	publisher = {CP meets Verification},
	address = {Lyon, France},
	abstract = {Configuration is a recurring problem in many domains. Manual configuration - the common practice in many companies - is time-consuming and error-prone, especially for large-scale systems. During the last three decades, researchers have developed a large number of approaches to automate various configuration use cases. Most of these approaches concern consistency of configuration decisions, and rely on CP or SAT solvers for ensuring consistency. We focus on interactive architecture-level configuration of Cyber-Physical Systems (CPS). In this context, engineers configure products by assigning values to tens of thousands of parameters. Typically, 15 to 20 percent of these parameters are interdependent. Finding consistent values for interdependent parameters without any automated support is challenging. In our interactive configuration approach, we map a configuration problem into a constraint network. During configuration, new variables or constraints may be added to the constraint network. We call this the dynamic growth of the constraint network. To ensure the consistency of configuration decisions, we use constraint propagation over finite domains. However, using constraint propagation, we can only achieve domain consistency, which is an approximation of consistency. Furthermore, the dynamic growth of the constraint network may invalidate some of the earlier configuration decisions. Therefore, in general, backtracking is needed for finding consistent solutions. Backtracking, however, makes the configuration process considerably slow. We eliminate the need for backtracking by imposing some restrictions on the configuration problem (i.e., the model of the product family), and configuring parameters in a certain order. For the latter, we have proposed an algorithm that computes a partial ordering over configurable parameters. We proved that, for configuration problems that conform to the specified restrictions, the ordering approach prevents the need for backtracking, while ensuring consistency. In future, we will study various CPSs to identify what percentage of realistic CPSs conform to the specified restrictions. Furthermore, we will evaluate the improvements that a backtrack-free algorithm can bring about when configuring realistic CPSs.},
	keywords = {Workshop},
	author = {Behjati, Razieh and Nejati, Shiva}
}
@article {Simula.simula.1990,
	title = {Traceability and SysML Design Slices to Support Safety Inspections: a Controlled Experiment},
	journal = {ACM Transactions on Software Engineering and Methodology},
	volume = {23},
	number = {9},
	year = {2014},
	publisher = {ACM},
	address = {New York},
	abstract = {Certifying safety-critical software and ensuring its safety requires checking the conformance between safety requirements and design. Increasingly, the development of safety-critical software relies on modeling, and the System Modeling Language (SysML) is now commonly used in many industry sectors. Inspecting safety conformance by comparing design models against safety requirements requires safety inspectors to browse through large models and is consequently time consuming and error-prone. To address this, we have devised a mechanism to establish traceability between (functional) safety requirements and SysML design models to extract design slices (model fragments) that filter out irrelevant details but keep enough context information for the slices to be easy to inspect and understand. In this paper, we report on a controlled experiment assessing the impact of the traceability and slicing mechanism on inspectors\&$\#$39; conformance decisions and effort. Results show a significant decrease in effort and an increase in decisions\&$\#$39; correctness and level of certainty.},
	author = {Briand, Lionel and Falessi, Davide and Nejati, Shiva and Sabetzadeh, Mehrdad and Yue, Tao}
}
@inproceedings {dialesio2014worstcase,
	title = {Worst-case Scheduling of Software Tasks {\textendash} A Constraint Optimization Model to Support Performance Testing},
	journal = {The 20th International Conference on Principles and Practice of Constraint Programming (CP 2014)},
	year = {2014},
	type = {Conference},
	abstract = {Real-Time Embedded Systems (RTES) in safety-critical domains, such as maritime and energy, must satisfy strict performance requirements to be deemed safe. Therefore, such systems have to be thoroughly tested to ensure their correct behavior even under the worst operating conditions. In this paper, we address the need of deriving worst case scenarios with respect to three common performance requirements, namely task deadlines, response time, and CPU usage. Specifically, we investigate whether this worst-case analysis can be effectively re-expressed as a Constrained Optimization Problem (COP) over the space of possible inputs to the system. Solving this problem means finding the sets of inputs that maximize the chance to violate performance requirements at runtime. Such inputs can in turn be used to test if the target RTES meets the expected performance even in the worst case. We develop an OPL model for IBM ILOG CP Optimizer that implements a task priority-based preemptive scheduling, and apply it to a case study from the maritime and energy domain. Our validation shows that (1) the input to our model can be provided with reasonable effort in an industrial setting, and (2) the COP effectively identifies test cases that maximize deadline misses, response time, and CPU usage.},
	doi = {10.1007/978-3-319-10428-7_58},
	author = {Di Alesio, Stefano and Nejati, Shiva and Briand, Lionel Claude and Gotlieb, Arnaud}
}
@inproceedings {19550,
	title = {Stress Testing of Task Deadlines: A Constraint Programming Approach},
	journal = {The 24th IEEE International Symposium on Software Reliability Engineering (ISSRE 2013)},
	year = {2013},
	type = {Conference},
	abstract = {Safety-critical Real Time Embedded Systems (RTESs) are usually subject to strict timing and performance requirements that must be satisfied for the system to be deemed safe. In this paper, we use effective search strategies whose goal is finding worst case scenarios with respect to deadline misses. Such scenarios can in turn be used to test the target RTES and ensure that it satisfies its timing requirements even under worst case conditions. Specifically, we develop an approach based on Constraint Programming (CP) to automate the generation of test cases that reveal, or are likely to, task deadline misses. We evaluate it through a comparison with a state-of-the-art approach based on Genetic Algorithms (GA). In particular, we compare CP and GA in five case studies for efficiency, effectiveness, and scalability. Our experimental results show that, on the largest and more complex case studies, CP performs significantly better than GA. Furthermore, CP offers some advantages over GA, such as it guarantees a complete search when there is sufficient time, and, being deterministic, it doesn\&$\#$39;t rely on parameters that potentially have a significant effect on the search and therefore need to be tuned. Hence, we conclude that our results are encouraging and suggest this is an advantageous approach for stress testing of RTESs with respect to timing constraints.},
	doi = {10.1109/ISSRE.2013.6698915},
	author = {Di Alesio, Stefano and Nejati, Shiva and Briand, Lionel and Gotlieb, Arnaud}
}
@techreport {Simula.simula.1730,
	title = {Architecture-Level Configuration of Large-Scale Embedded Software Systems},
	number = {2012-19},
	year = {2012},
	publisher = {Simula Research Laboratory},
	abstract = {Configuration in the domain of integrated control systems (ICS) is largely manual, laborious, and error-prone. In this paper, we propose a model-based configuration approach that provides automation support for reducing configuration effort and improving the reliability of configured products in the ICS domain. We ground our approach on component-based specifications of ICS families. We then develop a configuration algorithm using constraint satisfaction techniques over finite domains to generate products that are consistent with respect to their ICS family specifications. We reason about the soundness and termination of our configuration algorithm analytically. We evaluate the effectiveness of our configuration approach by applying it to a real subsea oil production system. Specifically, we have rebuilt a number of existing verified product configurations of our industry partner. Our experience shows that our approach can automatically infer up to 50\% of the configuration decisions, and reduces the complexity of making configuration decisions.},
	author = {Behjati, Razieh and Nejati, Shiva and Briand, Lionel}
}
@techreport {Simula.simula.1168,
	title = {Guided Interactive Configuration of Embedded Software Systems Using Constraint Satisfaction Over Finite Domains},
	number = {2012-05},
	year = {2012},
	publisher = {Simula Research Laboratory},
	abstract = {Modern society is increasingly dependent on highly-configurable software systems, in particular, architecturally configurable software such as that embedded in Integrated Control Systems (ICSs). Configuring ICSs is expensive, time-consuming and error-prone. This is due, in large part, to the fact that the hardware and software configuration processes are, typically, rather isolated from one another, resulting in many configuration errors to be detected only after the integration of software and hardware. In this work, we propose a model-based configuration approach that allows us to configure software in a stepwise manner, to automate some configuration decisions, and to iteratively validate software and hardware configuration decisions. Our approach has two major steps. In the first step (modeling), a generic model describing an ICS family is built. In the second step (configuration), we interactively guide a user to derive a particular product specification complying with the generic model of its ICS family. We use a constraint solver, SICStus Prolog, to evaluate user decisions at each round, to automatically infer configuration decisions and to ensure that software and hardware configurations are consistent. We evaluated our approach by applying it to a real subsea production system. Specifically, we rebuilt a number of existing verified product configurations of our industry partner. Our experience shows that our approach successfully enforces consistency of configurations, can automatically infer up to 50\% of the configuration decisions, and reduces the complexity of making configuration decisions by guiding the user during the configuration process.},
	keywords = {Workshop},
	author = {Behjati, Razieh and Nejati, Shiva and Gotlieb, Arnaud and Yue, Tao and Briand, Lionel}
}
@article {Simula.simula.1066,
	title = {Matching and Merging of Variant Feature Specifications},
	journal = {IEEE Transactions on Software Engineering},
	volume = {38},
	number = {6},
	year = {2012},
	pages = {1355-1375},
	publisher = {IEEE},
	abstract = {Model Management addresses the problem of managing an evolving collection of models, by capturing the relationships between models and providing well-defined operators to manipulate them. In this article, we describe two such operators for manipulating feature specifications described using hierarchical state machine models: Match, for finding correspondences between models, and Merge, for combining models with respect to known or hypothesized correspondences between them. Our Match operator is heuristic, making use of both static and behavioural properties of the models to improve the accuracy of matching. Our Merge operator preserves the hierarchical structure of the input models, and handles differences in behaviour through parameterization. This enables us to automatically construct merges that preserve the semantics of hierarchical state machines. We report on tool support for our Match and Merge operators, and illustrate and evaluate our work by applying these operators to a set of telecommunication features built by AT\&amp;T.},
	author = {Nejati, Shiva and Sabetzadeh, Mehrdad and Chechik, Marsha and Easterbrook, Steve and Zave, Pamela}
}
@inproceedings {Simula.simula.1280,
	title = {Model-Based Automated and Guided Configuration of Embedded Software Systems},
	journal = {ECMFA 2012},
	volume = {7349},
	year = {2012},
	pages = {226-243},
	publisher = {Springer Berlin Heidelberg},
	type = {Conference},
	address = {Berlin Heidelberg},
	abstract = {Configuring Integrated Control Systems (ICSs) is largely manual, time-consuming and error-prone. In this paper, we propose a model-based configuration approach that interactively guides engineers to configure software embedded in ICSs. Our approach verifies engineers{\textquoteright} decisions at each configuration iteration, and further, automates some of the decisions. We use a constraint solver, SICStus Prolog, to automatically infer configuration decisions and to ensure the consistency of configuration data. We evaluated our approach by applying it to a real subsea oil production system. Specifically, we rebuilt a number of existing verified product configurations of our industry partner. Our experience shows that our approach successfully enforces consistency of configurations, can automatically infer up to 50\% of the configuration decisions, and reduces the complexity of making configuration decisions.},
	keywords = {Conference},
	doi = {10.1007/978-3-642-31491-9\_18},
	author = {Behjati, Razieh and Nejati, Shiva and Yue, Tao and Gotlieb, Arnaud and Briand, Lionel Claude},
	editor = {Vallecillo, Antonio and Tolvanen, Juha-Pekka and Kindler, Ekkart and St{\"o}rrle, Harald and Kolovos, Dimitris}
}
@inproceedings {16146,
	title = {Modeling and Analysis of CPU Usage in Safety-Critical Embedded Systems to Support Stress Testing},
	journal = {The ACM/IEEE 15th International Conference on Model Driven Engineering Languages \& Systems (MODELS 2012)},
	year = {2012},
	type = {Conference},
	abstract = {Software safety certification needs to address non-functional constraints with safety implications, e.g., deadlines, throughput, and CPU and memory usage. In this paper, we focus on CPU usage constraints and provide a framework to support the derivation of test cases that maximize the chances of violating CPU usage requirements. We develop a conceptual model specifying the generic abstractions required for analyzing CPU usage and provide a mapping between these abstractions and UML/MARTE. Using this model, we formulate CPU usage analysis as a constraint optimization problem and provide an implementation of our approach in a state-of-the-art optimization tool. We report an application of our approach to a case study from the maritime and energy domain. Through this case study, we argue that our approach (1) can be applied with a practically reasonable overhead in an industrial setting, and (2) is effective for identifying test cases that maximize CPU usage.},
	doi = {10.1007/978-3-642-33666-9_48},
	author = {Nejati, Shiva and Di Alesio, Stefano and Sabetzadeh, Mehrdad and Briand, Lionel Claude}
}
@inproceedings {researchbased,
	title = {Research-Based Innovation: a Tale of Three Projects in Model-Driven Engineering},
	journal = {Model Driven Engineering Languages and Systems, 15th International Conference, MODELS 2012},
	volume = {7590},
	year = {2012},
	pages = {793-809},
	publisher = {Springer Berlin Heidelberg},
	type = {Conference},
	abstract = {In recent years, we have been exploring ways to foster a closer collaboration between software engineering research and industry both to align our research with practical needs, and to increase awareness about the importance of research for innovation. This paper outlines our experience with three research projects conducted in collaboration with the industry. We examine the way we collaborated with our industry partners and describe the decisions that contributed to the effectiveness of the collaborations. We report on the lessons learned from our experience and illustrate the lessons using examples from the three projects. The lessons focus on the applications of Model-Driven Engineering (MDE), as all the three projects we draw on here were MDE projects. Our goal from structuring and sharing our experience is to contribute to a better understanding of how researchers and practitioners can collaborate more effectively and to gain more value from their collaborations.},
	keywords = {Conference},
	doi = {10.1007/978-3-642-33666-9\_50},
	author = {Falessi, Davide and Nejati, Shiva and Sabetzadeh, Mehrdad and Yue, Tao},
	editor = {Briand, Lionel}
}
@article {Simula.simula.1122,
	title = {A SysML-Based Approach to Traceability Management and Design Slicing in Support of Safety Certification: Framework, Tool Support, and Case Studies},
	journal = {Information and Software Technology},
	volume = {54},
	number = {6, June 2012},
	year = {2012},
	pages = {569-590},
	publisher = {Butterworth-Heinemann/ Elsevier },
	abstract = {Traceability is one of the basic tenets of all safety standards and a key prerequisite for software safety certification. In the current state of practice, there is often a significant traceability gap between safety requirements and software design. Poor traceability, in addition to being a non-compliance issue on its own, makes it difficult to determine whether the design fulfills the safety requirements, mainly because the design aspects related to safety cannot be clearly identified. The goal of this article is to develop a framework for specifying and automatically extracting design aspects relevant to safety requirements. This goal is realized through the combination of two components: (1) A methodology for establishing traceability between safety requirements and design, and (2) an algorithm that can extract for any given safety requirement a minimized fragment (slice) of the design that is sound, and yet easy to understand and inspect. We ground our framework on System Modeling Language (SysML). The framework includes a traceability information model, a methodology to establish traceability, and mechanisms for model slicing based on the recorded traceability information. The framework is implemented in a tool, named SafeSlice. We prove that our slicing algorithm is sound for temporal safety properties, and argue about the completeness of slices based on our practical experience. We report on the lessons learned from applying our approach to two case studies, one benchmark and one industrial case. Both studies indicate that our approach substantially reduces the amount of information that needs to be inspected for ensuring that a given (behavioral) safety requirement is met by the design.},
	author = {Nejati, Shiva and Sabetzadeh, Mehrdad and Falessi, Davide and Briand, Lionel Claude and Thierry, Coq}
}
@inproceedings {14931,
	title = {Testing Deadline Misses for Real-Time Systems Using Constraint Optimization Techniques},
	journal = {The 4th Workshop on Constraints in Software Testing, Verification, and Analysis (CSTVA 2012)},
	year = {2012},
	type = {Workshop},
	abstract = {Safety-critical real-time applications are typically subject to stringent timing constraints which are dictated by the surrounding physical environments. Specifically, tasks in these applications need to finish their execution before given deadlines, otherwise the system is deemed unsafe. It is therefore important to test real-time systems for deadline misses. In this paper, we present a strategy for testing real-time applications that aims at finding test scenarios in which deadline misses become more likely. We identify such test scenarios by searching the possible ways that a set of real-time tasks can be executed according to the scheduling policy of the operating system on which they are running. We formulate this search problem using a constraint optimization model that includes (1) a set of constraints capturing how a given set of tasks with real-time constraints are executed according to a particular scheduling policy, and (2) a cost function that estimates how likely the given tasks are to miss their deadlines. We implement our constraint optimization model in ILOG, apply our model to several examples, and report on the performance results.},
	doi = {10.1109/ICST.2012.171},
	author = {Di Alesio, Stefano and Gotlieb, Arnaud and Nejati, Shiva and Briand, Lionel Claude}
}
@techreport {Simula.simula.380,
	title = {An AADL-Based SysML Profile for Architecture Level Systems Engineering: Approach, Metamodels, and Experiments},
	number = {2011-03},
	year = {2011},
	month = {February},
	publisher = {Simula Research Laboratory},
	abstract = {Recent years have seen a proliferation of languages for describing embedded control systems. Some of these languages have emerged from domain-specific frameworks, and some are adaptions or extensions of more general-purpose languages. In this paper, we focus on two widely-used standard languages: the Architecture Analysis and Design Language (AADL) and the Systems Modeling Language (SysML). AADL was born as an avionics-focused domain-specific language and later on has been revised to represent and support a more general category of embedded real-time systems. SysML is an extension of the Unified Modeling Language (UML) intended to support modeling system engineering applications. We propose the ExSAM profile that extends SysML by adding AADL concepts to it with the goal of exploiting the key advantages of both languages in a seamless way. We describe this profile through several examples and compare it with existing alternatives. We have implemented ExSAM using IBM Rational Rhapsody and evaluated its completeness and usefulness through two case studies.},
	author = {Behjati, Razieh and Yue, Tao and Nejati, Shiva and Briand, Lionel Claude and Selic, Bran}
}
@inproceedings {Simula.simula.434,
	title = {Extending SysML With AADL Concepts for Comprehensive System Architecture Modeling},
	journal = {7th European Conference on Modelling Foundations and Applications},
	number = {LNCS 6698},
	year = {2011},
	month = {June},
	pages = {236-252},
	publisher = {Springer},
	type = {Conference},
	address = {Berlin Heidelberg},
	abstract = {Recent years have seen a proliferation of languages for describing embedded systems. Some of these languages have emerged from domain-specific frameworks, and some are adaptions or extensions of more general-purpose languages. In this paper, we focus on two widely-used standard languages: the Architecture Analysis and Design Language (AADL) and the Systems Modeling Language (SysML). AADL was born as an avionics-focused domain-specific language and later on has been revised to represent and support a more general category of embedded real-time systems. SysML is an extension of the Unified Modeling Language (UML) intended to support modeling system engineering applications. We propose the ExSAM profile that extends SysML by adding AADL concepts to it with the goal of exploiting the key advantages of both languages in a seamless way. More precisely, by using one language (ExSAM) and any SysML modeling environment, we should be able to both model system engineering concepts and use AADL analysis tools where needed. We describe this profile through several examples and compare it with existing alternatives. We have implemented ExSAM using IBM Rational Rhapsody and evaluated its completeness and usefulness through two case studies.},
	isbn = {978-3-642-21469-1},
	author = {Behjati, Razieh and Yue, Tao and Nejati, Shiva and Briand, Lionel Claude and Selic, Bran}
}
@techreport {25315,
	title = {Modeling and Analysis of CPU Usage in Safety-Critical Embedded Systems to Support Stress Testing},
	number = {2011-17},
	year = {2011},
	note = {This technical report is an early version of a published conference paper. The published version can be found here:https://www.simula.no/publications/modeling-and-analysis-cpu-usage-safety-critical-embedded-systems-support-stress-testing},
	publisher = {Simula Research Laboratory},
	author = {Nejati, Shiva}
}
@techreport {Simula.simula.820,
	title = {Research-Based Innovation: a Tale of Three Projects in Model-Driven Engineering},
	number = {2011-18},
	year = {2011},
	month = {October},
	publisher = {Simula Research Laboratory},
	abstract = {Engineering research needs to be informed by (or based on) industrial needs to have impact, and industrial innovation depends on research to fill the gaps in knowledge and to pave the way for better tools, technologies, and services. In the past few years, we have been exploring ways to foster a closer collaboration between research and industry both to align our research with practical needs, and to further increase awareness about the important role that software engineering research plays as an enabler for innovation. This paper outlines our experiences with three recent and successful research projects conducted in collaboration with the maritime and energy industry. We take a retrospective approach to examine the way we collaborated with our industry partners and elaborate the decisions that we believe contributed to the effectiveness of the collaborations. We report the lessons learned from our experience and illustrate these lessons using examples from the three projects. The lessons focus on the applications of Model-Driven Engineering (MDE), as all the three projects we draw on here were MDE projects. Our goal from structuring and sharing our experience is to contribute to a better understanding of how researchers and practitioners can collaborate more effectively and to gain more value from their collaborations.},
	author = {Briand, Lionel and Falessi, Davide and Nejati, Shiva and Sabetzadeh, Mehrdad and Yue, Tao}
}
@inproceedings {Simula.simula.970,
	title = {SafeSlice: a Model Slicing and Design Safety Inspection Tool for SysML.},
	journal = {SIGSOFT/FSE{\textquoteright}11 19th ACM SIGSOFT Symposium on the Foundations of Software Engineering (FSE-19) and ESEC{\textquoteright}11: 13rd European Software Engineering Conference (ESEC-13)},
	year = {2011},
	publisher = {ACM},
	type = {Conference},
	abstract = {Software safety certification involves checking that the software design meets the (software) safety requirements. In practice, inspections are one of the primary vehicles for ensuring that safety requirements are satisfied by the design. Unless the safety-related aspects of the design are clearly delineated, the inspections conducted by safety assessors would have to consider the entire design, although only small fragments of the design may be related to safety. In a model-driven development context, this means that the assessors have to browse through large models, understand them, and identify the safety-related fragments. This is time-consuming and error-prone, specially noting that the assessors are often third party regulatory bodies who were not involved in the design. To address this problem, we describe in this paper a prototype tool called, SafeSlice, that enables one to automatically extract the safety-related slices (fragments) of design models. The main enabler for our slicing technique is the traceability between the safety requirements and the design, established by following a structured design methodology that we propose. Our work is grounded on SysML, which is being increasingly used for expressing the design of safety-critical systems. We have validated our work through two case studies and a control experiment which we briefly outline in the paper.},
	isbn = {978-1-4503-0443-6},
	author = {Falessi, Davide and Nejati, Shiva and Sabetzadeh, Mehrdad and Briand, Lionel and Messina, Antonio},
	editor = {Andreas Zeller Tib {Gyim{\'o}thy}}
}
@techreport {Simula.simula.193,
	title = {A SysML-Based Approach to Traceability Management and Design Slicing in Support of Safety Certification: Framework, Tool Support, and Case Studies},
	number = {2011-01},
	year = {2011},
	month = {January},
	publisher = {Simula Research Laboratory},
	abstract = {Context: Traceability is one of the basic tenets of all software safety standards and a key prerequisite for certification of software. Despite this, the safety-critical software industry is still suffering from a chronic lack of guidelines on traceability. An acute traceability problem that we have identified through observing software safety certification processes has to do with the link between safety requirements and software design. In the current state of practice, this link often lacks sufficient detail to support the systematic inspections conducted by the certifiers of the software safety documentation. As a result, the suppliers often have to remedy the traceability gaps after the fact which can be very expensive and the outcome often is far from satisfactory. Objective: The objective of this article is developing a framework to enable systematic and efficient software design inspections during safety certification. In particular, the framework enables safety engineers and certifiers to extract design slices (model fragments) that filter out irrelevant details but keep enough context information for the slices to be easy to inspect and understand. This helps reduce cognitive load and thus makes it less likely that serious safety issues would be overlooked. Method: Our framework is grounded on SysML which is rapidly becoming the notation of choice for developing safety-critical systems. The framework includes a traceability information model, a methodology to establish traceability, and mechanisms to use traceability for extracting slices of models relevant to a particular safety requirement. The framework is implemented in a tool, named SafeSlice, that supports establishing the traceability links envisaged by the methodology, automated consistency checking of these links, and automated generation of SysML design slices. Results: We provide a formal proof that our slicing algorithm is sound for temporal safety properties, and argue about the completeness of the slices based on our practical experience. We report on the lessons learned from applying our approach to two case studies, one benchmark case and one industrial case. Both case studies indicate that our approach offers benefits by substantially reducing the amount of information that needs to be inspected in order to ensure that a given safety requirement is met by the design.},
	author = {Nejati, Shiva and Sabetzadeh, Mehrdad and Falessi, Davide and Briand, Lionel Claude and Coq, Thierry}
}
@inproceedings {Simula.simula.804,
	title = {Using SysML for Modeling of Safety-Critical Software-Hardware Interfaces: Guidelines and Industry Experience},
	journal = {13th IEEE International High Assurance Systems Engineering Symposium (HASE{\textquoteright}11)},
	year = {2011},
	publisher = {IEEE},
	type = {Conference},
	address = {Boca Raton, FL},
	abstract = {Safety-critical embedded systems often need to undergo a rigorous certification process to ensure that the safety risks associated with the use of the systems are adequately mitigated. Interfaces between software and hardware components (SW/HW interfaces) play a fundamental role in these systems by linking the systems{\textquoteright} control software to either the physical hardware components or to a hardware abstraction layer. Subsequently, safety certification of embedded systems necessarily has to cover the SW/HW interfaces used in these systems. In this paper, we describe a Model Driven Engineering (MDE) approach based on the SysML language, targeted at facilitating the certification of SW/HW interfaces in embedded systems. Our work draws on our experience with maritime and energy systems, but the work should also apply to a broader set of domains, e.g., the automotive sector, where similar design principles are used for (SW/HW) interface design. Our approach leverages our previous work on the development of SysML-based modeling and analysis techniques for safety-critical systems. Specifically, we tailor the methodology developed in our previous work to the development of safety-critical interfaces, and provide step-by-step and practical guidelines aimed at providing the evidence necessary for arguing that the safety-related requirements of an interface are properly addressed by its design. We describe an application of our proposed guidelines to a representative safety-critical interface in the maritime and energy domain.},
	author = {Sabetzadeh, Mehrdad and Nejati, Shiva and Briand, Lionel Claude and Anne-Heidi Evensen {Mills}}
}
@inproceedings {Simula.approve.58,
	title = {Reasoning About Consistency in Model Merging},
	journal = {3rd Workshop on Living With Inconsistency in Software Development},
	year = {2010},
	publisher = {CEUR Workshop Proceedings},
	type = {Workshop},
	abstract = {Models undergo a variety of transformations throughout development. One of the key transformations is merge, used when developers need to combine a set of models with respect to the overlaps between them. A major question about model transformations in general, and merge in particular, is what consistency properties are preserved across the transformations and what consistency properties may need to be re-checked (and if necessary, re-established) over the result. In previous work, we developed a technique based on category-theoretic colimits for merging sets of inter-related models. The use of category theory leads to the preservation of the algebraic structure of the source models in the merge; however, this does not directly provide a characterization of the (in)consistency properties that carry over from the source models to the result, because consistency properties are predominantly expressed as logical formulas. Hence, an investigation of the connections between the {\textquoteleft}{\textquoteleft}algebraic{\textquoteright}{\textquoteright} and {\textquoteleft}{\textquoteleft}logical{\textquoteright}{\textquoteright} properties of model merging became necessary. In this paper, we undertake such an investigation and use techniques from finite model theory to show that the use of colimits indeed leads to the preservation of certain logical properties. Our results have implications beyond our merge framework in and are potentially useful for the broad range of techniques in the graph transformation and algebraic specification literature that use colimits as the basis for model manipulations.},
	isbn = {urn:nbn:de:0074-661-4},
	author = {Sabetzadeh, Mehrdad and Nejati, Shiva and Chechik, Marsha and Easterbrook, Steve},
	editor = {Egyed, A. and Lopez-Herrejon, R. and Nuseibeh, B. and Botterweck, G. and Chechik, M. and Hu, Z.}
}
@article {Simula.se.729,
	title = {Runtime Monitoring of Web Service Conversations},
	journal = {IEEE Transactions on Service Computing},
	volume = {2},
	number = {3},
	year = {2009},
	pages = {223-244},
	abstract = {For a system of distributed processes, correctness can be ensured by (statically) checking whether their composition satisfies properties of interest. However, web services are distributed processes that dynamically discover properties of other web services. Since the overall system may not be available statically and since each business process is supposed to be relatively simple, we propose to use runtime monitoring of conversations between partners as a means of checking behavioural correctness of the entire web service system. Specifically, we identify a subset of UML 2.0 Sequence Diagrams as a property specification language and show that it is sufficiently expressive for capturing safety and liveness properties. By transforming these diagrams to automata, we enable conformance checking of finite execution traces against the specification. We show how our language can be used to specify the Specification Property System (SPS). We describe an implementation of our approach as part of an industrial system. Finally, we discuss our experience of specifying and monitoring a number of properties from three existing applications.},
	author = {Simmonds, Jocelyn and Gan, Yuan and Chechik, Marsha and Nejati, Shiva and O{\textquoteright}Farrell, Bill and Litani, Elena and Waterhouse, Julie}
}
@inproceedings {19096,
	title = {A Manifesto for Model Merging},
	journal = {1st International Workshop on Global Integrated Model Management (GaMMa{\textquoteright}06) at the 28th International Conference on Software Engineering},
	year = {2006},
	publisher = {IEEE},
	address = {unknown},
	abstract = {If a modeling task is distributed, it will frequently be neces- sary to merge models developed by di erent team members. Existing approaches to model merging make assumptions about the types of model to be merged, and the nature of the relationship between them. This makes it hard to compare approaches. In this paper, we present a manifesto for re- search on model merging. We propose a framework for com- paring di erent approaches to merging, by treating merge as an algebraic operator over models and model relationships. We specify the algebraic properties of an idealized merge operator, as well as related operators such as match, di , split, and slice. We then show how our framework can be used to compare existing approaches by applying it to two of our own research projects on model merging. We show how this analysis permits a detailed comparison of approaches, reveals the key features of each, and identi es weaknesses that require further research. Most importantly, the frame- work emphasizes the need to make explicit all assumptions about the relationships between models, and indeed to treat model relationships as rst class objects.},
	author = {Brunet, Greg and Chechik, Marcha and Easterbrook, Steve and Nejati, Shiva and Niu, Nan and Sabetzadeh, Mehrdad}
}
