Abstract: Trends such as the Internet of Things lead to a growing number of networked devices and to a variety of communication systems. Adding self-adaptive capabilities to these communication systems is one approach to reducing administrative effort and coping with changing execution contexts. Existing frameworks can help reducing development effort but are neither tailored toward the use in communication systems nor easily usable without knowledge in self-adaptive systems development. Accordingly, in previous work, we proposed REACT, a reusable, model-based runtime environment to complement communication systems with adaptive behavior. REACT addresses heterogeneity and distribution aspects of such systems and reduces development effort. In this article, we propose REACT-ION - an extension of REACT for situation awareness. REACT-ION offers a context management module that is able to acquire, store, disseminate, and reason on context data. The context management module is the basis for (i) proactive adaptation with REACT-ION and (ii) self-improvement of the underlying feedback loop. REACT-ION can be used to optimize adaptation decisions at runtime based on the current situation. Therefore, it can cope with uncertainty and situations that were not foreseeable at design time. We show and evaluate in two case studies how REACT-ION's situation awareness enables proactive adaptation and self-improvement.

Abstract: We have developed model-based adaptation, an approach that leverages models of software and its environment to enable automated adaptation. The goal of our approach is to build long-lasting mobile software systems that can effectively adapt to changes in their environment.

Abstract: Self-adaptive systems have the ability to adapt themselves to changes in the environment and internal dynamics to achieve particular goals. Self-adaptation is typically realized using control loops. When systems are large, complex, and heterogeneous, a single control loop may not be sufficient. Given the central role control loops play in the way we conceptualize, design, and implement self-adaptive systems, their patterns of interaction should be made explicit to foster comprehension and analysability, and to serve as the basis for developing guidelines and documenting common design choices for engineers. Because of the diversity of ways that existing self-adaptive systems organize the various self-adaptation activities, it is timely to reflect on these systems to: (a) consolidate the knowledge in this area, and (b) to develop a systematic approach for describing different control schema. In this paper, we contribute with a simple notation for describing control schema with multiple control loops, which we believe helps in achieving (b), and we use this notation to describe a number of existing self-adaptation patterns, to begin to fulfill (a). From our study, we outline numerous remaining research challenges and future work in this area.

Abstract: The goal of this roadmap paper is to summarize the state-of-the-art and identify research challenges when developing, deploying and managing self-adaptive software systems. Instead of dealing with a wide range of topics associated with the field, we focus on four essential topics of self-adaptation: design space for self-adaptive solutions, software engineering processes for self-adaptive systems, from centralized to decentralized control, and practical run-time verification & validation for self-adaptive systems. For each topic, we present an overview, suggest future directions, and focus on selected challenges. This paper complements and extends a previous roadmap on software engineering for self-adaptive systems published in 2009 covering a different set of topics, and reflecting in part on the previous paper. This roadmap is one of the many results of the Dagstuhl Seminar 10431 on Software Engineering for Self-Adaptive Systems, which took place in October 2010.

Abstract: Dynamically bound systems are those software systems which are able to incorporate executable components into themselves during execution. Such systems are clearly very flexible; however they suffer from problems associated with this flexibility. These problems, which are similar to some of the problems addressed by configuration management, include how to locate and select components, how to manage change to components, how to verify the consistency of configurations of the systems and how to determine the actual system configuration. This paper describes some of the systems which support dynamic binding and discusses some of their associated prob- lems. An approach to the design of configuration management facilities for dynamically bound systems is then outlined. This approach involves the detailed modelling of dynamic binding in a range of systems supporting this notion and the integration of this model with the relevant aspects of a model of configuration management developed by Wiebe. Finally, the paper foreshadows some ways in which the previously mentioned problems with dynamically bound systems can be addressed.

Abstract: As software systems grow in size and complexity their design problem extends beyond algorithms and data structures to issues of system design. This area receives little or no treatment in existing computer science curricula. Although courses about specific systems are usually available there is no systematic treatment of the organizations used to assemble components into systems. These issues - the software architecture level of software design - are the subject of a new course that we taught for the first time in Spring 1992. This paper describes the motivation for the course, the content and structure of the current version, and our plans for improving the next version.

Abstract: The Robot Operating System (ROS) is the de facto framework for building open-source robotic software systems. Developers architect their system by using reusable components, connecting them via config- uration files and source code. These architectures evolve as developers add, remove, and modify components, connections, and configurations. These changes can lead to architectural misconfigurations detectable by specification languages and analysis tools. However, these focus on snapshots in time without considering how architectures evolve. By un- derstanding this evolution, we can help specification writers estimate the maintenance burden of their descriptions and promote tools toward the most change-prone elements. To that end, we conduct an empirical study of architectural evolution in open-source ROS systems. We develop a differential, cross-language architectural recovery tool that extracts components, connections, and configurations from source code and apply it to 294 repositories, with 1728 packages across 9914 releases, spanning ROS 1 and ROS 2 in C/C++, Python, and XML. As ROS repositories aggregate multiple packages at different maturity stages, we analyze evolution at the repository and package levels. We find that evolution di- verges across levels, with repositories remaining addition-dominant while mature packages consolidate by removing connections and configurations. Furthermore, changes co-occur across elements: component removals are associated with the removal of their connections and configurations.

Abstract: Component-based robot software frameworks, such as the Robot Operating System (ROS), allow developers to quickly compose and execute systems by focusing on configuring and integrating reusable, off-the-shelf components. However, these components often lack documentation on how to configure and integrate them correctly. Even when documentation exists, its natural language specifications are not enforced, resulting in misconfigurations that lead to unpredictable and potentially dangerous robot behaviors. In this work, we introduce ROSpec, a ROS-tailored domain-specific language designed to specify and verify component configurations and their integration. ROSpec’s design is grounded in ROS domain concepts and informed by a prior empirical study on misconfigurations, allowing the language to provide a usable and expressive way of specifying and detecting misconfigurations. At a high level, ROSpec verifies the correctness of argument and component configurations, ensures the correct integration of components by checking their communication properties, and checks if configurations respect the assumptions and constraints of their deployment context. We demonstrate ROSpec’s ability to specify and verify components by modeling a medium-sized warehouse robot with 19 components, and by manually analyzing, categorizing, and implementing partial specifications for components from a dataset of 182 misconfiguration questions extracted from a robotics Q&A platform.

Abstract: Component-based architectures in robotics, like the Robot Operating System (ROS), simplify system development by integrating reusable, off-the-shelf components. However, these components often lack sufficient documentation on their use and the architectures they form, leading to architectural misconfigurations. General-purpose Architectural Description Languages (ADLs) effectively provide properties to detect misconfigurations but are burdensome to use, as they require mapping new language-specific concepts to the ROS domain. This work introduces rospec, a novel ADL embedding ROS-specific knowledge to help developers specify and detect architectural misconfigurations. By mapping the language's syntax with ROS concepts, we argue that practitioners can more easily understand and reason about specifications written in the language. We provide an example and compare it with a general-purpose ADL.

Abstract: The Robot Operating System (ROS) is a highly popular framework and ecosystem that allows developers to build robot software systems from reusable, off-the-shelf components. Systems are often built by customizing and connecting components into a working ensemble via configuration files. While reusable components allow developers to quickly prototype working robots in theory, in practice, ensuring that those components are configured and connected appropriately is fundamentally challenging, as evidenced by the large number of questions asked on developer forums. Developers must be careful to abide by the assumptions of individual components, which are often unchecked and unstated when building their systems. Failure to do so can result in misconfigurations that are only discovered once the robot is deployed in the field, at which point errors may lead to unpredictable and dangerous behavior. Despite misconfigurations having been studied in the broader context of software engineering, robotics software (and ROS in particular) poses domain-specific challenges with potentially disastrous consequences. To understand and improve the reliability of ROS projects, it is critical to identify the types of misconfigurations developers face. To that end, we study ROS Answers, a Q&A platform, to identify and categorize misconfigurations during ROS development. We then conduct a literature review to assess the coverage of these misconfigurations using existing detection techniques. In total, we find 12 high-level categories and 50 sub-categories of misconfigurations. Of these categories, 27 are not covered by existing techniques. To conclude, we discuss how to tackle those misconfigurations in future work.

Abstract: Robotics systems are complex, safety-critical systems that can con- sist of hundreds of software components that interact with each other dynamically during run time. Software components of robot- ics systems often exhibit reactive, periodic, and state-dependent behavior. Incorrect component composition can lead to unexpected behavior, such as components passively waiting for initiation mes- sages that never arrive. Model-based software analysis is a common technique to identify incorrect behavioral composition by checking desired properties of given behavioral models that are based on component state machines. However, writing state machine models for hundreds of software components manually is a labor-intensive process. This motivates work on automated model inference. In this paper, we present an approach to infer behavioral models for systems based on the Robot Operating System (ROS) using static analysis by exploiting assumptions about the usage of the ROS API and ecosystem. Our approach is based on searching for common behavioral patterns that ROS developers use for implementing reac- tive, periodic, and state-dependent behavior using the ROS frame- work API. We evaluate our approach and our tool ROSInfer on five complex real-world ROS systems with a total of 534 components. For this purpose we manually created 155 models of components from the source code to be used as a ground truth and available data set for other researchers. ROSInfer can infer causal triggers for 87 % of component architectural behaviors in the 534 components.

Abstract: Robot systems are growing in importance and complexity. Ecosystems for robot software, such as the ROS, provide libraries of reusable software components that can be configured and composed into larger systems. To support compositionality, ROS uses late binding and architecture configuration via "launch files" that describe how to initialize the components in a system. However, late binding often leads to systems failing silently due to misconfiguration, for example by misrouting or dropping messages entirely.

In this paper we present ROSDiscover, which statically recovers the run-time architecture of ROS systems to find such architecture misconfiguration bugs. First, ROSDiscover constructs component level architectural models (ports, parameters) from source code. Second, architecture configuration files are analyzed to compose the system from these component models and derive the connections in the system. Finally, the reconstructed architecture is checked against architectural rules described in first-order logic to identify potential misconfigurations.

We present an evaluation of ROSDiscover on real world, off-the-shelf robotic systems, measuring the accuracy, effectiveness, and practicality of our approach. To that end, we collected the first data set of architecture configuration bugs in ROS from popular open-source systems and measure how effective our approach is for detecting configuration bugs in that set.

Abstract: Trends such as the Internet of Things or edge computing lead to a growing number of networked devices. Hence, it is becoming increasingly important to manage communication systems at runtime. Adding self-adaptive capabilities is one approach to reduce administrative effort and cope with changing execution contexts. Existing frameworks for building self-adaptive software can help to reduce development effort in general. Yet, they are neither tailored towards the use in communication systems nor easily usable without profound knowledge in self-adaptive systems development. In this paper, we propose REACT, a reusable, model-based runtime environment to complement communication systems with adaptive behavior. It addresses the heterogeneity and distribution aspects of networks and reduces development effort. REACT empowers developers of communication systems to add adaptive behavior without having experience in self-adaptive systems development. We show the effectiveness and efficiency of our prototype in an experimental evaluation based on two distinct use cases from the communication systems domain: cloud resource management and software-defined networking. The first use case includes a comparison with Rainbow, which represents a state-of-the-art model-based framework for building self-adaptive systems. The second use case applies REACT in a sophisticated, real-world communication system scenario.

Abstract: Modern cyber-physical systems (e.g., robotics systems) are typically composed of physical and software components, the characteristics of which are likely to change over time. Assumptions about parts of the system made at design time may not hold at run time, especially when a system is deployed for long periods (e.g., over decades). Self-adaptation is designed to find reconfigurations of systems to handle such run-time inconsistencies. Planners can be used to find and enact optimal reconfigurations in such an evolving context. However, for systems that are highly configurable, such planning becomes intractable due to the size of the adaptation space. To overcome this challenge, in this paper we explore an approach that (a) uses machine learning to find Pareto-optimal configurations without needing to explore every configuration, and (b) restricts the search space to such configurations to make planning tractable. We explore this in the context of robot missions that need to consider task timeliness and energy consumption. An independent evaluation shows that our approach results in high quality adaptation plans in uncertain and adversarial environments.

Abstract: In this paper, we envision a world where a software engineer could take an existing software system, specify, for a set of properties of interest, an objective, conditions for change, and strategies for their adaptation and, within a few man weeks, make that system self-adaptive where it was not before. We describe how our approach generalizes to different classes of systems and holds promise for cost-effective, dynamic system self-adaptation to become an engineering reality.

Abstract: Ubiquitous computing poses a number of challenges for software architecture. One of the most important is the ability to design software systems that accommodate dynamically-changing resources. Resource variability arises naturally in a ubiquitous computing setting through user mobility (a user moves from one computing environment to another), and through the need to exploit time-varying resources in a given environment (such as wireless bandwidth). Traditional approaches to handling resource variability in applications attempt to address the problem by imposing uniformity on the environment. We argue that those approaches are inadequate, and describe an alternative architectural framework that is better matched to the needs of ubiquitous computing. A key feature of the architecture is that user tasks become first class entities. User proxies, or Auras, use models of user tasks to set up, monitor and adapt computing environments proactively. The architectural framework has been implemented and currently being used as a central component of Project Aura, a campus-wide ubiquitous computing effort.

Abstract: An increasingly important requirement for software systems is the capability to adapt at run time in order to accommodate varying resources, system errors, and changing requirements. For such self-repairing systems, one of the hard problems is determining when a change is needed, and knowing what kind of adaptation is required. Recently several researchers have explored the possibility of using architectural models as a basis for run time monitoring, error detection, and repair. Each of these efforts, however, has demonstrated the feasibility of using architectural models in the context of a specific style. In this paper we show how to generalize these solutions by making architectural style a parameter in the monitoring/repair framework and its supporting infrastructure. The value of this generalization is that it allows one to tailor monitoring/ repair mechanisms to match both the properties of interest (such as performance or security), and the available operators for run time adaptation.

Abstract: Dynamically composed software systems are constructed as they execute. Although these systems are of increasing importance and arise in a number of application areas, configuration management tools do not provide much support for them. This paper presents progress towards providing enhanced configuration management techniques for dynamically composed systems. The paper commences with an example of dynamically composed systems, which is used to motivate the relevance of dynamically composed systems, and to highlight various design issues and requirements for configuration management in this domain. A model, and its associated notation DCDL, is then presented to describe particular aspects of the example. This model seamlessly integrates the notions of consistency, specified in terms of complete configurations, and version families, which are relevant to the incomplete configurations of crucial importance in understanding configurations of dynamically composed systems. DCDL is then used to provide insight into the requirements for configuration management tools for dynamically composed systems.

Abstract: Dynamically composed systems are able to incorporate new components as they execute. Therefore, configurations of these systems are not fully elaborated until at least the time that they are executed, and they are perhaps never fully elaborated. Such incomplete configurations are termed partially bound configurations. Although partially bound, it is still important to be able to analyse these configurations to ascertain whether they meet certain assumptions about their composition. We are endevouring to provide such support for the construction of dynamically composed systems through the application of configuration management concepts. One way in which these concepts can be applied in this domain is to explicitly state such assumptions and hence be able to validate partially bound configurations against these assumptions; in this way, inconsistencies can be reported as soon as they arise. This paper disucsses the issues involved in providing this kind of consistency mechanism for dynamically composed systems.

Abstract: In a ubiquitous computing environment augmented reality would be an ideal choice for a display for the user. An augmented reality display assists users by adding computer generated information to their perception of reality, thus making it ideal for ubiquitous computing. Unfortunately augmented reality is technically difficult and costly to implement even when the application is designed for its use from the ground up. However, many of the necessary devices for a low fidelity implementation of augmented reality are readily available in a ubiquitous computing environment. Our research focuses on using Aura, a ubiquitous computing framework, to marshal the available devices in the environment. These devices can then be connected within the framework to provide an augmented reality display to the user at the best fidelity possible, given the available resources in a user's environment.

Abstract: To understand the context of current research, it is essential to understand how current results evolved from early fundamental papers. These classic papers develop timeless ideas that transcend technology changes, and the ideas embodied in their solutions often apply to current problems (and, indeed, are reinvented by researchers who are ignorant of the classic literature).

Criteria for selection of the papers in the Canon include

• Papers are selected for their overall significance. The papers should usually be the principal or definitive papers about an idea, rather than expository papers written after the idea has matured (these may appear in other reading lists). A rule of thumb is that the paper in the Canon should be the one you'd cite as the fundamental paper in its area.
• Classic, timeless papers prove their significance over time. It follows that the papers of the Canon will generally be published a minimum of 12-15 years ago.
• Some of the entries may be books. In these cases, the books should be important in their own right, but the entry should highlight one or a few specific passages in the book to focus on. Students should develop a sense of the rest of the book as well.
• Because the size of the Canon is limited, authors will rarely be represented by multiple papers, and redundancy will generally be avoided.
• All students should be familiar with all the papers, and the SE Research Core course should cover them. In practice this limits the size of the Canon to about 25 papers.

The Carnegie Mellon Software Engineering faculty has selected this set of papers as a canonical collection of significant classic papers that balances completeness with reasonable size. All our software engineering students should read and understand these papers (or selections from books). Notes in this document explain the significance of the papers. We will endeavor to cover them in the Core Course in Software Engineering Research, and other courses may feel free to assume that students have read them.

Abstract: The ability to update a software system as it is being used is increasingly important and manifests itself in systems that must be maintained while executing, in systems where choices about which components comprise a system are deferred until their use, and where systems can be customised. Systems that fit one or more of these characteristics we call Dynamically Composed Systems (DCSs). Although some attention has been given to providing tools to support dynamic updates, and models of such dynamic updates have been constructed, little work as been done in examining this from a configuration management perspective. This paper describes a model of configuration management for dynamically composed systems, based on an existing model of configuration management for statically composed systems. The model includes a dynamic configuration description language, DCDL, and a formalization in terms of many-sorted algebraic specification techniques. The use of this model to design tools to support configuration management for dynamically composed systems is then discussed.