Preprint: 

Extending Decision Maps for Sustainable Safety and Security in Self-Adaptive Systems

Sustainability refers to a system's ability to maintain its functionality and endure over time. Hence, sustainability is a highly desirable property of software systems, including Self-Adaptive Systems (SASs). SASs can change (adapt) their behavior at runtime to continue achieving their objectives despite external or internal impacts. SASs' intended long-term system behavior can be expressed through a sustainability-driven visual modeling notation called Decision Maps (DMs). Although DMs have been proven helpful, they lack adequate modeling support for safety and security concerns.

We address this limitation by extending the current notation for sustainability-driven modeling of SASs to better accommodate the unique characteristics of safety and security scenarios. First, we introduce an additional modeling dimension to account for safety incidents. Second, we adopt a fine-grained divide-and-conquer approach, modeling from distinct temporal security viewpoints ("security modes") to address security. We employ the extended DM notation in a real-world use case scenario provided by our industry partner to assess its feasibility and suitability for practitioners. Our results indicate that our modeling notation helps capture security and safety scenarios more accurately and provides holistic support for the self-adaptation life cycle phases.

Preprint: 

On the JI-RADAR: Uncovering Sustainability Tool Support for Requirements Engineering

Context: Software-intensive systems are integral to nearly all facets of modern society. Consequently, both their sustainability and their role in facilitating sustainable processes must be established by design. Software sustainability is defined as "the preservation of the long-term and beneficial use of software, and its appropriate evolution, in a context that continuously changes".

RE Problem & Motivation: Regulatory initiatives increasingly require (software) organizations to integrate sustainability into their day-to-day business and operational processes. The United Nations 2030 Agenda formulated 17 Sustainable Development Goals (SDGs), while the EU passed the Corporate Sustainability Reporting Directive (CSRD), which requires companies to publish and audit sustainability-related information. Regulations and laws require organizations in the software development sector to disclose both qualitative and quantitative sustainability metrics, among other obligations. Consequently, integrating sustainability reporting processes into the software development life cycle becomes increasingly important. RE processes often lack systematic methods to elicit, analyze, and prioritize sustainability requirements alongside functional and non-functional requirements, and studies indicate that tool support for this integration remains limited.

To address this gap, we introduce JI-RADAR, which supports stakeholders involved in system design (e.g., developers, requirements engineers, project managers, and usability engineers) by providing practical tools to integrate sustainability into the RE process. We extend the widely used Atlassian Jira platform by implementing a ready-to-use plugin that can be directly adopted in industrial practice.

Preprint: 

Transforming Privacy Artifacts into Accessible Reports for Non-Technical Stakeholders

The transition toward Industry 5.0 is reshaping industrial work environments with an emphasis on human-centricity, enabling close collaboration between humans and machines to enhance productivity and flexibility. However, such systems typically require monitoring of human workers and operators, often involving sensitive data, raising significant privacy concerns. As a result, affected workers and unions frequently reject human-machine collaboration features due to a lack of transparency regarding privacy threats and implemented mitigation strategies. To enable early stakeholder involvement, establish trust, and support informed decision-making, privacy implications must be communicated in a way understandable to non-technical stakeholders. Yet, current Requirements Engineering (RE) practices provide limited methodological support for making privacy threats and mitigations accessible to non-technical stakeholders (e.g., individual workers or their representative unions).

In this RE@Next paper, we propose a conceptual framework that guides software design from human monitoring-related use cases and requirements to informed decision-making guidance focusing on non-technical stakeholders. Building on principles such as Privacy by Design, the framework leverages Large Language Models (LLMs) to transform technical artifacts into accessible privacy reports. We share initial insights from two industry use cases, evaluate the quality of the generated reports, and outline future research directions toward integrating privacy transparency into RE processes for human-centric industrial systems.

Preprint: 

HM-Req: A Framework for Embedding Values within CPS Human Monitoring Requirements

Monitoring humans, for example, their movement or location, is essential for safe and efficient human-machine collaboration in Cyber-Physical Systems (CPS). This information allows CPS to ensure safety properties, adapt their behaviour dynamically, and coordinate with humans. To ensure that the design of a CPS respects ethical principles and the privacy of its stakeholders, system requirements, particularly those related to human monitoring, must reflect the human values of all involved stakeholders. However, human values are often underrepresented in Software Engineering -- particularly during requirements elicitation and system design, crucial phases when introducing ethically critical functionality. Stakeholder values are often implicit and conflicting, yet rarely systematically captured. Furthermore, unstructured natural language requirements introduce ambiguity and vagueness, complicating conflict resolution.

To address these problems, we propose HM-Req, a novel requirements elicitation framework including a Controlled Natural Language (CNL) for defining human monitoring requirements. These requirements are then augmented with human values from relevant stakeholders and integrated into a Value Dashboard to detect potential conflicts that require further discussion and resolution. Validation results, applying the CNL to different datasets and conducting a survey and expert interview, confirms the CNL's ability to capture diverse human monitoring requirements and show HM-Req's usefulness for requirements elicitation activities.

Preprint: 

Bringing AI into the Classroom: A Structured Approach for Integrating AI into Software Engineering Education

The recent emergence of generative AI and Large Language Models (LLMs), particularly following the release of ChatGPT in late 2022, has significantly impacted both academic research and industrial practice. This development has vast potential to impact educational practices across various domains, particularly within computer science and software engineering courses. Unfortunately, there is still a lack of actionable guidance on how to integrate AI technology coherently into computer science curricula.

In this paper, we therefore introduce the concept of AI-Blueprints, a structured approach to integrating AI-related topics and activities into various computer science courses. We describe our approach and outline a structured process for creating new blueprints. Our vision is to provide these blueprints as open educational resources, allowing educators to adapt and integrate AI into diverse courses and topics. As a preliminary validation, we conducted semi-structured interviews with six university-level educators, collecting feedback on how our blueprints could help to integrate AI topics into existing courses. Based on this feedback, we lay out plans for future research and expanding our AI-Blueprint concept.

Preprint: 

Design and Deployment of a Course-Aware AI Tutor in an Introductory Programming Course

The recent emergence of generative AI and Large Language Models (LLMs), particularly following the release of ChatGPT in late 2022, has significantly impacted both academic research and industrial practice. This development has vast potential to impact educational practices across various domains, particularly within computer science and software engineering courses. Unfortunately, there is still a lack of actionable guidance on how to integrate AI technology coherently into computer science curricula.

In this paper, we therefore introduce the concept of AI-Blueprints, a structured approach to integrating AI-related topics and activities into various computer science courses. We describe our approach and outline a structured process for creating new blueprints. Our vision is to provide these blueprints as open educational resources, allowing educators to adapt and integrate AI into diverse courses and topics. As a preliminary validation, we conducted semi-structured interviews with six university-level educators, collecting feedback on how our blueprints could help to integrate AI topics into existing courses. Based on this feedback, we lay out plans for future research and expanding our AI-Blueprint concept.

Preprint: 

Uncovering Failures in Cyber-Physical System State Transitions: A Fuzzing-Based Approach Applied to sUAS

The increasing deployment of small Uncrewed Aerial Systems (sUAS) in diverse and often safety-critical environments demands rigorous validation of onboard decision logic under various conditions. In this paper, we present SaFUZZ, a state-aware fuzzing pipeline that validates core behavior associated with state transitions, automated failsafes, and human operator interactions in sUAS applications operating under various timing conditions and environmental disturbances.

We create fuzzing specifications to detect behavioral deviations, and then dynamically generate associated Fault Trees to visualize states, modes, and environmental factors that contribute to the failure, thereby helping project stakeholders to analyze the failure and identify its root causes. We validated SaFUZZ against a real-world sUAS system and were able to identify several points of failure not previously detected by the system's development team. The fuzzing was conducted in a high-fidelity simulation environment, and outcomes were validated on physical sUAS in a real-world field testing setting. The findings from the study demonstrated SaFUZZ's ability to provide a practical and scalable approach to uncovering diverse state transition failures in a real-world sUAS application.

Preprint: 

A Survey on Feedback Types in Automated Programming Assessment Systems

With the recent rapid increase in digitization across all major industries, acquiring programming skills has increased the demand for introductory programming courses. This has further resulted in universities integrating programming courses into a wide range of curricula, including not only technical studies but also business and management fields of study.

Consequently, additional resources are needed for teaching, grading, and tutoring students with diverse educational backgrounds and skills. As part of this, Automated Programming Assessment Systems (APASs) have emerged, providing scalable and high-quality assessment systems with efficient evaluation and instant feedback. Commonly, APASs heavily rely on predefined unit tests for generating feedback, often limiting the scope and level of detail of feedback that can be provided to students. With the rise of Large Language Models (LLMs) in recent years, new opportunities have emerged as these technologies can enhance feedback quality and personalization.

To investigate how different feedback mechanisms in APASs are perceived by students, and how effective they are in supporting problem-solving, we have conducted a large-scale study with over 200 students from two different universities. Specifically, we compare baseline Compiler Feedback, standard Unit Test Feedback, and advanced LLM-based Feedback regarding perceived quality and impact on student performance.

Results indicate that while students rate unit test feedback as the most helpful, AI-generated feedback leads to significantly better performances. These findings suggest combining unit tests and AI-driven guidance to optimize automated feedback mechanisms and improve learning outcomes in programming education.

We performed an initial validation, investigating the applicability of SustainScrum on an open-source, publicly available requirements data set for agile development.

A Model-Based Framework for Exploring Human-Machine Teaming Requirements in Cyber-Physical Systems

As Cyber-Physical Systems (CPS) become more prevalent in a wide variety of domains, they are increasingly enriched with digital intelligence. Consequently, the role of humans, as well as their interplay with automation, have become important facets of CPS development, which has driven research in Human-Machine Interaction and Teaming. As technology and possible interaction patterns continuously evolve, requirements and system design become moving targets.

This makes it challenging to manage complexity, unless the right degree of abstraction is found. Stakeholders involved in development may also easily lose track of the different perspectives and needs, i.e., of the perception of future CPS-supported work realities. Therefore, in this paper, we present a structured design process, using adaptable models to capture role-specific behaviors, communication, and interaction details. Our approach aims to guide stakeholders and establish a traceable engineering process with transparent, informed decisions.

We propose a model-based framework for exploring Human-Machine Teaming requirements in the context of CPS. Our layered methodology encompasses defining the system scope, exploring automation scenario variants, detailing functional requirements, and finding an early candidate design. It enables continuous stakeholder control of a CPS development process based on Human-Machine Teaming requirements. A first demonstration and evaluation show its feasibility and applicability in a real-world context.

Preprint: 

SAFER-D: A Self-Adaptive Security Framework for Distributed Computing Architectures

The rise of the Internet of Things and Cyber-Physical Systems has introduced new challenges on ensuring secure and robust communication. The growing number of connected devices increases network complexity, leading to higher latency and traffic. Distributed computing architectures (DCAs) have gained prominence to address these issues. This shift has significantly expanded the attack surface, requiring additional security measures to protect all components -- from sensors and actuators to edge nodes and central servers. Recent incidents highlight the difficulty of this task: Cyberattacks, like distributed denial of service attacks, continue to pose severe threats and cause substantial damage.

Implementing a holistic defense mechanism remains an open challenge, particularly against attacks that demand both enhanced resilience and rapid response. Addressing this gap requires innovative solutions to enhance the security of DCAs.

In this work, we present our holistic self-adaptive security framework which combines different adaptation strategies to create comprehensive and efficient defense mechanisms. We describe how to incorporate the framework into a real-world use case scenario and further evaluate its applicability and efficiency. Our evaluation yields promising results, indicating great potential to further extend the research on our framework.