arXiv subjects

Stefan Wagner

Publications and source records attributed to Stefan Wagner.

At least 163 records · Page 9Linked to original sources

arXiv2018

Verlässliche Software im 21. Jahrhundert

Software is the main innovation driver in many different areas, like cloud services, autonomous driving, connected medical devices, and high-frequency trading. All these areas have in common that they require high dependability. In this paper, we discuss challenges and research directions imposed by these new areas on guaranteeing the dependability. On the one hand challenges include characteristics of the systems themselves, e. g., open systems and ad-hoc structures. On the other hand, we see new aspects of dependability like behavioral traceability.

cs.SE↗

arXiv2018

The extended flare in CTA 102 in 2016 and 2017 within a hadronic model through cloud ablation by the relativistic jet

The flat spectrum radio quasar CTA 102 (redshift 1.037) exhibited a tremendously bright 4-months long outburst from late 2016 to early 2017. In a previous paper, we interpreted the event as the ablation of a gas cloud by the relativistic jet. The multiwavelength data have been reproduced very well within this model using a leptonic emission scenario. Here we expand that work by using a hadronic scenario, which gives us greater freedom with respect to the location of the emission region within the jet. This is important, since the inferred gas cloud parameters depend on the distance from the black hole. While the hadronic model faces the problem of invoking super-Eddington jet luminosities, it reproduces well the long-term trend and also days-long subflares. While the latter result in inferred cloud parameters that match those expected for clouds of the broad-line region, the long-term trend is not compatible with such an interpretation. We explore the possibilities that the cloud is from the atmosphere of a red giant star or comes from a star-forming region that passes through the jet. The latter could also explain the much longer-lasting activity phase of CTA 102 from late 2015 till early 2018.

astro-ph.HE↗

arXiv2018

Too Trivial To Test? An Inverse View on Defect Prediction to Identify Methods with Low Fault Risk

Background. Test resources are usually limited and therefore it is often not possible to completely test an application before a release. To cope with the problem of scarce resources, development teams can apply defect prediction to identify fault-prone code regions. However, defect prediction tends to low precision in cross-project prediction scenarios. Aims. We take an inverse view on defect prediction and aim to identify methods that can be deferred when testing because they contain hardly any faults due to their code being "trivial". We expect that characteristics of such methods might be project-independent, so that our approach could improve cross-project predictions. Method. We compute code metrics and apply association rule mining to create rules for identifying methods with low fault risk. We conduct an empirical study to assess our approach with six Java open-source projects containing precise fault data at the method level. Results. Our results show that inverse defect prediction can identify approx. 32-44% of the methods of a project to have a low fault risk; on average, they are about six times less likely to contain a fault than other methods. In cross-project predictions with larger, more diversified training sets, identified methods are even eleven times less likely to contain a fault. Conclusions. Inverse defect prediction supports the efficient allocation of test resources by identifying methods that can be treated with less priority in testing activities and is well applicable in cross-project prediction scenarios.

cs.SE↗

arXiv2018

Asheetoxy: A Taxonomy for Classifying Negative Spreadsheet-related Phenomena

Spreadsheets (sometimes also called Excel programs) are powerful tools which play a business-critical role in many organizations. However, due to faulty spreadsheets many bad decisions have been taken in recent years. Since then, a number of researchers have been studying spreadsheet errors. However, one issue that hinders discussion among researchers and professionals is the lack of a commonly accepted taxonomy. Albeit a number of taxonomies for spreadsheet errors have been proposed in previous work, a major issue is that they use the term error that itself is already ambiguous. Furthermore, to apply most existing taxonomies, detailed knowledge about the underlying process and knowledge about the "brain state" of the acting spreadsheet users is required. Due to these limitations, known error-like phenomena in freely available spreadsheet corpora cannot be classified with these taxonomies. We propose Asheetoxy, a simple and phenomenon-oriented taxonomy that avoids the problematic term error altogether. An initial study with 7 participants indicates that even non-spreadsheet researchers similarly classify real-world spreadsheet phenomena using Asheetoxy.

cs.SE↗

arXiv2018

How Usable are Rust Cryptography APIs?

Context: Poor usability of cryptographic APIs is a severe source of vulnerabilities. Aim: We wanted to find out what kind of cryptographic libraries are present in Rust and how usable they are. Method: We explored Rust's cryptographic libraries through a systematic search, conducted an exploratory study on the major libraries and a controlled experiment on two of these libraries with 28 student participants. Results: Only half of the major libraries explicitly focus on usability and misuse resistance, which is reflected in their current APIs. We found that participants were more successful using rust-crypto which we considered less usable than ring before the experiment. Conclusion: We discuss API design insights and make recommendations for the design of crypto libraries in Rust regarding the detail and structure of the documentation, higher-level APIs as wrappers for the existing low-level libraries, and selected, good-quality example code to improve the emerging cryptographic libraries of Rust.

cs.CR↗

arXiv2018

Usability and Security Effects of Code Examples on Crypto APIs - CryptoExamples: A platform for free, minimal, complete and secure crypto examples

Context: Cryptographic APIs are said to be not usable and researchers suggest to add example code to the documentation. Aim: We wanted to create a free platform for cryptographic code examples that improves the usability and security of created applications by non security experts. Method: We created the open-source web platform CryptoExamples and conducted a controlled experiment where 58 students added symmetric encryption to a Java program. We then measured the usability and security. Results: The participants who used the platform were not only significantly more effective (+73 %) but also their code contained significantly less possible security vulnerabilities (-66 %). Conclusions: With CryptoExamples the gap between hard to change API documentation and the need for complete and secure code examples can be closed. Still, the platform needs more code examples.

cs.CR↗

arXiv2018

Model-Based Safety-Cases for Software-Intensive Systems

Safety cases become increasingly important for software certification. Models play a crucial role in building and combining information for the safety case. This position paper sketches an ideal model-based safety case with defect hypotheses and failure characterisations. From this, open research issues are derived.

cs.SE↗

arXiv2018

Evaluating Maintainability Prejudices with a Large-Scale Study of Open-Source Projects

Exaggeration or context changes can render maintainability experience into prejudice. For example, JavaScript is often seen as least elegant language and hence of lowest maintainability. Such prejudice should not guide decisions without prior empirical validation. We formulated 10 hypotheses about maintainability based on prejudices and test them in a large set of open-source projects (6,897 GitHub repositories, 402 million lines, 5 programming languages). We operationalize maintainability with five static analysis metrics. We found that JavaScript code is not worse than other code, Java code shows higher maintainability than C# code and C code has longer methods than other code. The quality of interface documentation is better in Java code than in other code. Code developed by teams is not of higher and large code bases not of lower maintainability. Projects with high maintainability are not more popular or more often forked. Overall, most hypotheses are not supported by open-source data.

cs.SE↗

arXiv2018

Poster: Identification of Methods with Low Fault Risk

Test resources are usually limited and therefore it is often not possible to completely test an application before a release. Therefore, testers need to focus their activities on the relevant code regions. In this paper, we introduce an inverse defect prediction approach to identify methods that contain hardly any faults. We applied our approach to six Java open-source projects and show that on average 31.6% of the methods of a project have a low fault risk; they contain in total, on average, only 5.8% of all faults. Furthermore, the results suggest that, unlike defect prediction, our approach can also be applied in cross-project prediction scenarios. Therefore, inverse defect prediction can help prioritize untested code areas and guide testers to increase the fault detection probability.

cs.SE↗

arXiv2018

Combining STPA and BDD for Safety Analysis and Verification in Agile Development: A Controlled Experiment

Context: Agile development is in widespread use, even in safety-critical domains. Motivation: However, there is a lack of an ap- propriate safety analysis and verification method in agile development. Objective: In this paper, we investigate the use of Behavior Driven De- velopment (BDD) instead of standard User Acceptance Testing (UAT) for safety verification with System-Theoretic Process Analysis (STPA) for safety analysis in agile development. Method: We evaluate the effect of this combination in a controlled experiment with 44 students in terms of productivity, test thoroughness, fault detection effectiveness and com- munication effectiveness. Results: The results show that BDD is more effective for safety verification regarding the impact on communication effectiveness than standard UAT, whereas productivity, test thorough- ness and fault detection effectiveness show no statistically significant difference in our controlled experiment. Conclusion: The combination of BDD and STPA seems promising with an enhancement on communica- tion, but its impact needs more research.

cs.SE↗

arXiv2018

An Exploratory Study of Applying a Scrum Development Process for Safety-Critical Systems

Agile techniques recently have received attention in developing safety-critical systems. However, a lack of empirical knowledge of performing safety assurance techniques in practice, especially safety analysis into agile development processes prevents further steps. In this article, we aim at investigating the feasibility and the effects of our S-Scrum development process, and stepwise improving and proposing an Optimized S-Scrum development process for safety-critical systems in a real environment. We conducted an exploratory case study in a one-year student project "Smart Home" at the University of Stuttgart, Germany. We participated in the project and collected quantitative and qualitative data from questionnaire, interviews, participant observation, physical artifacts, and documentation review. Furthermore, we evaluated the Optimized S-Scrum in industry by conducting interviews. The first-stage results showed that by integrating STPA (System-Theoretic Process Analysis) can ensure the safety during each sprint and enhance the safety of delivered products, while the agility of S-Scrum is slightly worse than the original Scrum. Six challenges have been explored: Management changes the team's priorities during an iteration; Disturbed safety-related communication; Non-functional requirements are determined too late; Insufficient upfront planning; Insufficient well-defined completion criteria; Excessive time to perform upfront planning. We investigated further the causalities and optimizations. The second-stage results revealed that the safety and agility have been improved after the optimizations. We have gained a positive assessment and suggestions from industry. The optimized S-Scrum is feasible for developing safety-critical systems concerning the capability to ensure safety and the acceptable agility in a student project. Further attempt is still needed in industrial projects.

cs.SE↗

arXiv2018

Are There Functionally Similar Code Clones in Practice?

Having similar code fragments, also called clones, in software systems can lead to unnecessary comprehension, review and change efforts. Syntactically similar clones can often be encountered in practice. The same is not clear for only functionally similar clones (FSC). We conducted an exploratory survey among developers to investigate whether they encounter functionally similar clones in practice and whether there is a difference in their inclination to remove them to syntactically similar clones. Of the 34 developers answering the survey, 31 have experienced FSC in their professional work, and 24 have experienced problems caused by FSCs. We found no difference in the inclination and reasoning for removing FSCs and syntactically similar clones. FSCs exist in practice and should be investigated to bring clone detectors to the same quality as for syntactically similar clones, because being able to detect them allows developers to manage and potentially remove them.

cs.SE↗

arXiv2018

Poster: Communication in Open-Source Projects--End of the E-mail Era?

Communication is essential in software engineering. Especially in distributed open-source teams, communication needs to be supported by channels including mailing lists, forums, issue trackers, and chat systems. Yet, we do not have a clear understanding of which communication channels stakeholders in open-source projects use. In this study, we fill the knowledge gap by investigating a statistically representative sample of 400 GitHub projects. We discover the used communication channels by regular expressions on project data. We show that (1) half of the GitHub projects use observable communication channels; (2) GitHub Issues, e-mail addresses, and the modern chat system Gitter are the most common channels; (3) mailing lists are only in place five and have a lower market share than all modern chat systems combined.

cs.SE↗

arXiv2018

Highly sensitive electromechanical piezoresistive pressure sensors based on large-area layered PtSe$_{2}$ films

Two-dimensional (2D) layered materials are ideal for micro- and nanoelectromechanical systems (MEMS/NEMS) due to their ultimate thinness. Platinum diselenide (PtSe$_{2}$), an exciting and unexplored 2D transition metal dichalcogenides (TMD) material, is particularly interesting because its scalable and low temperature growth process is compatible with silicon technology. Here, we explore the potential of thin PtSe$_{2}$ films as electromechanical piezoresistive sensors. All experiments have been conducted with semimetallic PtSe$_{2}$ films grown by thermally assisted conversion of Pt at a CMOS-compatible temperature of 400°C. We report high negative gauge factors of up to -84.8 obtained experimentally from PtSe$_{2}$ strain gauges in a bending cantilever beam setup. Integrated NEMS piezoresistive pressure sensors with freestanding PMMA/PtSe$_{2}$ membranes confirm the negative gauge factor and exhibit very high sensitivity, outperforming previously reported values by orders of magnitude. We employ density functional theory (DFT) calculations to understand the origin of the measured negative gauge factor. Our results suggest PtSe$_{2}$ as a very promising candidate for future NEMS applications, including integration into CMOS production lines.

cond-mat.mtrl-sci↗

arXiv2018

A Systematic Review of Productivity Factors in Software Development

Analysing and improving productivity has been one of the main goals of software engineering research since its beginnings. A plethora of studies has been conducted on various factors that resulted in several models for analysis and prediction of productivity. However, productivity is still an issue in current software development and not all factors and their relationships are known. This paper reviews the large body of available literature in order to distill a list of the main factors influencing productivity investigated so far. The measure for importance here is the number of articles a factor is mentioned in. Special consideration is given to soft or human-related factors in software engineering that are often not analysed with equal detail as more technical factors. The resulting list can be used to guide further analysis and as basis for building productivity models.

cs.SE↗

arXiv2018

Challenges of the Dynamic Detection of Functionally Similar Code Fragments

Classic clone detection approaches are hardly capable of finding redundant code that has been developed independently, i.e., is not the result of copy&paste. To automatically detect such functionally similar code of independent origin, we experimented with a dynamic detection approach that applies random testing to selected chunks of code similar to Jiang&Su's approach. We found that such an approach faces several limitations in its application to diverse Java systems. This paper details on our insights regarding these challenges of dynamic detection of functionally similar code fragments. Our findings support a substantiated discussion on detection approaches and serve as a starting point for future research.

cs.SE↗

arXiv2017

Spreadsheet Guardian: An Approach to Protecting Semantic Correctness throughout the Evolution of Spreadsheets

Spreadsheets are powerful tools which play a business-critical role in many organizations. However, many bad decisions taken due to faulty spreadsheets show that these tools need serious quality assurance. Furthermore, while collaboration on spreadsheets for maintenance tasks is common, there has been almost no support for ensuring that the spreadsheets remain correct during this process. We have developed an approach named Spreadsheet Guardian which separates the specification of spreadsheet test rules from their execution. By automatically executing user-defined test rules, our approach is able to detect semantic faults. It also protects all collaborating spreadsheet users from introducing faults during maintenance, even if only few end-users specify test rules. To evaluate Spreadsheet Guardian, we implemented a representative testing technique as an add-in for Microsoft Excel. We evaluated the testing technique in two empirical evaluations with 29 end-users and 42 computer science students. The results indicate that the technique is easy to learn and to apply. Furthermore, after finishing maintenance, participants with spreadsheets "protected" by the technique are more realistic about the correctness of their spreadsheets than participants who employ only "classic", non-interactive test rules based on static analysis techniques. Hence, we believe Spreadsheet Guardian can be of use for business-critical spreadsheets.

cs.SE↗

arXiv2017

Can clone detection support quality assessments of requirements specifications?

Due to their pivotal role in software engineering, considerable effort is spent on the quality assurance of software requirements specifications. As they are mainly described in natural language, relatively few means of automated quality assessment exist. However, we found that clone detection, a technique widely applied to source code, is promising to assess one important quality aspect in an automated way, namely redundancy that stems from copy&paste operations. This paper describes a large-scale case study that applied clone detection to 28 requirements specifications with a total of 8,667 pages. We report on the amount of redundancy found in real-world specifications, discuss its nature as well as its consequences and evaluate in how far existing code clone detection approaches can be applied to assess the quality of requirements specifications in practice.

cs.SE↗