Publications by Dr Rogério de Lemos

Self-adaptive systems are able to modify their behaviour and/or structure in response to changes that occur to the system, its environment, or even its goals. In terms of authorisation infrastructures, self-adaptation has shown to be a promising solution for enforcing access control policies and subject access privileges when mitigating insider threat. This paper describes the resilience evaluation of a self-adaptive authorisation infrastructure by simulating a case study related to insider threats. As part of this evaluation, a malicious changeload has been formally defined in order to describe scenarios of abuse in access control. This malicious changeload was then used to stimulate self-adaptation within a federated authorisation infrastructure. The evaluation confirmed the resilience of a self-adaptive authorisation infrastructure in handling abuse of access under repeatable conditions by consistently mitigating abuse under normal and high loads. The evaluation has also shown that self-adaptation had a minimal impact on the authorisation infrastructure, even when adapting authorisation policies while mitigating abuse of access.

Cyber-attacks affect every aspect of our lives. These attacks have serious consequences, not only for cyber-security, but also for safety, as the cyber and physical worlds are increasingly linked. Providing effective cyber-security requires cooperation and collaboration among all the entities involved. Increasing the amount of cyber threat information (CTI) available for analysis allows better prediction, prevention and mitigation of cyber-attacks. However, organizations are deterred from sharing their CTI over concerns that sensitive and confidential information may be revealed to others. We address this concern by providing a flexible framework that allows the confidential sharing of CTI for analysis between collaborators. We propose a five-level trust model for a cloud-edge based data sharing infrastructure. The data owner can choose an appropriate trust level and CTI data sanitization approach, ranging from plain text, through anonymization/pseudonymization to homomorphic encryption, in order to manipulate the CTI data prior to sharing it for analysis. Furthermore, this sanitization can be performed by either an edge device or by the cloud service provider, depending upon the level of trust the organization has in the latter. We describe our trust model, our cloud-edge infrastructure, and its deployment model, which are designed to satisfy the broadest range of requirements for confidential CTI data sharing. Finally we briefly describe our implementation and the testing that has been carried out so far by four pilot projects that are validating our infrastructure.

Although major advances have been made in protection of cloud platforms against malicious attacks, little has been done regarding the protection of these platforms against insider threats. This paper looks into this challenge by introducing self-adaptation as a mechanism to handle insider threats in cloud platforms, and this will be demonstrated in the context of OpenStack. OpenStack is a popular cloud platform that relies on Keystone, its identity management component, for controlling access to its resources. The use of self-adaptation for handling insider threats has been motivated by the fact that self-adaptation has been shown to be quite effective in dealing with uncertainty in a wide range of applications. Insider threats have become a major cause for concern since legitimate, though malicious, users might have access, in case of theft, to a large amount of information. The key contribution of this paper is the definition of an architectural solution that incorporates self-adaptation into OpenStack Keystone in order to handle insider threats. For that, we have identified and analysed several insider threats scenarios in the context of the OpenStack cloud platform, and have developed a prototype that was used for experimenting and evaluating the impact of these scenarios upon the self-adaptive authorisation system for the cloud platforms.

An increasingly important requirement for certain classes of software-intensive systems is the ability to self-adapt their structure and behavior at run-time when reacting to changes that may occur to the system, its environment, or its goals. A major challenge related to self-adaptive software systems is the ability to provide assurances of their resilience when facing changes. Since in these systems, the components that act as controllers of a target system incorporate highly complex software, there is the need to analyze the impact that controller failures might have on the services delivered by the system. In this paper, we present a novel approach for evaluating the resilience of self-adaptive software systems by applying robustness testing techniques to the controller to uncover failures that can affect system resilience. The approach for evaluating resilience, which is based on probabilistic model checking, quantifies the probability of satisfaction of system properties when the target system is subject to controller failures. The feasibility of the proposed approach is evaluated in the context of an industrial middleware system used to monitor and manage highly populated networks of devices, which was implemented using the Rainbow framework for architecture-based self-adaptation.

Complex software-intensive systems are increasingly relied upon for all kinds of activities in society, leading to the requirement that these systems should be resilient to changes that may occur to the system, its environment, or its goals. Traditionally, resilience has been achieved either through: (i)~low-level mechanisms embedded in the implementation (e.g., exception handling, timeouts, redundancies), which are unable to detect subtle but important anomalies (e.g., progressive performance degradation); or (ii)~human oversight, which is costly and unreliable. Architecture-based self-adaptation (ABSA) is regarded as a promising approach to improve the resilience and reduce the development/operation costs of such systems. Although researchers have illustrated the benefits of ABSA through a number of small-scale case studies, it remains to be seen whether ABSA is truly effective in handling changes at run-time in industrial-scale systems. intend to be representative of larger industrial systems, so it remains to be seen whether ABSA is truly effective in such settings. In this paper, we report on our experience applying an ABSA framework (Rainbow) to a large-scale commercial software system, called Data Acquisition and Control Service (DCAS), which is used to monitor and manage highly populated networks of devices in renewable energy production plants. In the approach followed, we have replaced some of the existing adaptive mechanisms embedded in DCAS by those advocated by ABSA proponents. This has allowed us to assess the development costs associated with the reengineering of adaptive mechanisms when using an ABSA solution, and to make effective comparisons, in terms of operational performance, between a baseline industrial system and one that uses ABSA. Our results show that using the ABSA concepts as embodied in Rainbow enabled an independent team of developers to: (i)~effectively implement the adaptation behavior required from such industrial systems; and (ii)~obtain important benefits in terms of maintainability and extensibility of adaptation mechanisms.

Authorization infrastructures are an integral part of any network where resources need to be protected. As networks expand and organizations start to federate access to their resources, authorization infrastructures become increasingly difficult to manage. In this paper, we explore the automatic adaptation of authorization assets (policies and subject access rights) in order to manage federated authorization infrastructures. We demonstrate adaptation through a Self-Adaptive Authorization Framework (SAAF) controller that is capable of managing policy based federated role/attribute access control authorization infrastructures. The SAAF controller implements a feedback loop to monitor the authorization infrastructure in terms of authorization assets and subject behavior, analyze potential adaptations for handling malicious behavior, and act upon authorization assets to control future authorization decisions. We evaluate a prototype of the SAAF controller by simulating malicious behavior within a deployed federated authorization infrastructure (federation), demonstrating the escalation of adaptation, along with a comparison of SAAF to current technology.

Self-Adaptive systems are software-intensive systems endowed with the ability to respond to a variety of changes that may occur in their environment, goals, or the system itself, by adapting their structure and behavior at run-time in an autonomous way. Controllers are complex components incorporated in self-adaptive systems, which are crucial to their function since they are in charge of adapting the target system by executing actions through effectors, based on information monitored by probes. However, although controllers are becoming critical in many application domains, so far very little has been done to assess their robustness. In this paper, we propose an approach for evaluating the robustness of controllers for self-adaptive software systems, aiming to identify faults in their design. Our proposal considers the stateful nature of the controller, and identifies a set of robustness tests, which includes the provision of mutated inputs to the interfaces between the controller and the target system (i.e., probes). The feasibility of the approach is evaluated on Rainbow, a framework for architecture-based self-adaptation, and in the context of the Znn.com case study.

One of the major challenges related to self-adaptive software systems is the provision of assurances that the system is resilient against changes that may occur either in the system or its environment. These assurances should be based on complementary sources of evidence that collectively justify that the system is able to attain the specified levels of resilience. The contribution of this paper is the definition and development of an architecture-based approach that evaluates by comparison the adaptation mechanisms of a self-adaptive software system. The proposed approach relies on the identification of representative environmental and system changeloads (i.e., sequences of changes) used in the run-time stimulation of the system. The system response obtained from this stimulation is collected and aggregated into a probabilistic model that is employed in the evaluation of system resilience. Our approach is intended to be used before deployment, since the process often involves putting the system through adverse conditions which are not adequate when the system is in production. The feasibility and effectiveness of the proposed approach is demonstrated in the context of Rainbow, an architecture-based platform for self- adaptation, and Znn.com, a case study that reproduces the typical infrastructure for a news website.

The self-adaptation of software systems is a complex process that depends on several factors that can change during the system operational lifetime. Hence, it is necessary to define mechanisms for providing a self-adaptive system the capability of generating during run-time the process that controls its adaptation. This paper presents a framework for the automatic generation of processes for self-adaptive software systems based on the use of workflows, model-based and artificial intelligence planning techniques. Our approach can be applied to different application domains, improves the scalability associated with the generation of adaptation plans, and enables the usage of different planning techniques. For evaluating the approach, we have developed a prototype for generating during run-time the workflows that coordinate the architectural reconfiguration of a web-based application.

In this position paper, we argue how architectural abstractions can be effective in developing fault-tolerant software systems. Depending on the fault model and the resources available, different abstractions can be employed for representing architectural issues related to fault tolerance. These architectural abstractions, and their internal views, can be instantiated into concrete components and connectors for designing fault-tolerant software architectures. Since structural and behavioural properties associated with these abstractions are formally specified, the process of verifying and validating software architectures can be automated. In this paper, we focus on two architectural abstractions: the idealised fault-tolerant architectural element (iFTE), which is based on exception handling, and the halt-on-failure architectural element (HoFE), which assumes crash failure semantics.

When building dependable systems by integrating untrusted software components that were not originally designed to interact with each other, it is likely the occurrence of architectural mismatches related to assumptions in their failure behaviour. These mismatches, if not prevented during system design, have to be tolerated during runtime. This paper presents an architectural abstraction based on exception handling for structuring fault-tolerant software systems. This abstraction comprises several components and connectors that promote an existing untrusted software element into an idealised fault-tolerant architectural element. Moreover, it is considered in the context of a rigorous software development approach based on formal methods for representing the structure and behaviour of the software architecture. The proposed approach relies on a formal specification and verification for analysing exception propagation, and verifying important dependability properties, such as deadlock freedom, and scenarios of architectural reconfiguration. The formal models are automatically generated using model transformation from UML diagrams: component diagram representing the system structure, and sequence diagrams representing the system behaviour. Finally, the formal models are also used for generating unit and integration test cases that are used for assessing the correctness of the source code. The feasibility of the proposed architectural approach was evaluated on an embedded critical case study.

The aim of this special issue is to report the state of research and practice on the theme of software components, architectures and reuse. This special issue is comprised of invited papers, and peer-reviewed papers presented at the Brazilian Symposium on Software Components, Architectures and Reuse (SBCARS 2007) (http://www.ic.unicamp.br/sbcars2007), held in Campinas, S˜ao Paulo, Brazil, 29-31 August, 2007. The call for this special issue received 18 submissions: 14 submissions related to extended and revised versions of papers accepted for SBCARS 2007, and 4 invited submissions from well-known researchers in the area. Each of the 18 submissions was reviewed by at least 3 reviewers, and based on the reviewers' recommendations 8 papers were accepted. These papers stand for the high quality of the research being carried out among researchers from Brazil, Canada, France, Italy, Sweden, United Kingdom, and United States.

This paper presents an immune-inspired adaptable error detection (AED) framework for automated teller machines (ATMs). This framework has two levels: one is local to a single ATM, while the other is network-wide. The framework employs vaccination and adaptability analogies of the immune system. For discriminating between normal and erroneous states, an immune-inspired one-class supervised algorithm was employed, which supports continual learning and adaptation. The effectiveness of the proposed approach was confirmed in terms of classification performance and impact on availability. The overall results are encouraging as the downtime of ATMs can de reduced by anticipating the occurrence of failures before they actually occur.

Self-managing or autonomic computing is a highly emerging field having been championed by industry and academia alike. Essentially the management of the system is being handed to the system itself, therefore the issue of trust in terms of the decisions the system makes regarding itself, is of paramount interest. This paper considers four aspects of trust in self-adaptive computing systems with the aim to identify trends and pinpoint areas that require more investigation.

A system's structure enables it to generate its intended behavior from its components' behavior. A well-structured system simplifies relationships among components, which can increase dependability. With software systems, the architecture is an abstraction of the structure. Architectural reasoning about dependability has become increasingly important because emerging applications are increasingly complex. We've developed an architectural approach for effectively representing and analyzing fault-tolerant software systems. The proposed solution relies on exception handling to tolerate faults associated with component and connector failures, architectural mismatches, and configuration faults. Our approach, a specialization of the peer-to-peer architectural style, hides inside the architectural elements the complexities of exception handling and propagation. Our goal is to improve a system's overall reliability and availability by making it tolerant of nonmalicious faults.

Exception handling is a structuring technique that facilitates the design of software systems by encapsulating the process of error recovery. In this paper, we present a systematic approach for incorporating exceptional behaviour in the development of component-based software. The premise of our approach is that components alone do not provide the appropriate means to deal with exceptional behaviour in an effective manner, hence the need to consider the notion of collaborations for capturing the interactive behaviour between components when error recovery involves more than one component. The feasibility of the approach is demonstrated in terms of the mining control system case study

Abstract: In order to facilitate the process of safety analysis of an evolving software system, this paper presents an architectural approach that enhances the safety analysis by providing appropriate abstractions for modelling and analysing interactions between components, since faulty interactions are the usual cause of accidents. For that, instead of considering components as the locus of change, the proposed approach assumes that components remain unchanged while their interactions (captured by connectors) adapt to the different changes made in the system. The behavioural description of connectors is provided in terms of extended time automata, and the safety analysis is performed using model checking, which verifies whether safe behaviour is maintained when interactions between components change. The feasibility of the approach is demonstrated in terms of a case study that deals with the safety procedures associated with the launching of a sounding rocket

This paper considers the problem of integrating Commercial off-the-shelf (COTS) components into systems with high dependability requirements. Such components are built to be reused as black boxes that cannot be modified. The system architect has to rely on techniques that are external to the component for resolving mismatches between the services required and provided that might arise in the interaction of the component and its environment. The paper puts forward an approach that employs the layer-based C2 architectural style for structuring error detection and recovery mechanisms to be added to the component during system integration.

Exception handling is a structuring technique that facilitates the design of systems by encapsulating the process of error recovery. Traditional methods deal with exceptions at late design and implementation phases, hence losing the context of error detection and recovery, and the correlation between exceptions and their handlers. The proposed approach emphasises the separation of treatments of requirements-related, design-related, and implementation-related exceptions during the software lifecycle, by specifying the exceptions and their handlers in the context where faults are identified. The description of exceptional behaviour is supported by a co-operative object-oriented approach that allows the representation of collaborative behaviour between objects at different phases of the software development. The feasibility of the approach is demonstrated in terms of a benchmark case study.

Modern systems need to be able to self-adapt to changes in user needs, and changes affecting the system itself or its environment. Dynamic software product line (DSPL) is an engineering approach for developing self-adaptive systems based on commonalities and variabilities for a family of similar systems. Currently, many DSPL approaches fail to meet all adaptability requirements, and in many cases, they are developed in a such unstructured manner that the controller is not explicitly represented, for example. We specify a two-dimension taxonomy to address basic technical issues for realising variability in DSPLs. The self-adaptation dimension classifies the different design choices for the adaptability requirements. The DSPL variability dimension classifies different design choices for implementing variability schemes and for creating different kinds of feature models. Our study was substantiated by surveying several DSPL approaches, and evaluating and comparing their different design strategies. We also summarise practical issues and difficulties, identify major trends in actual DSPL proposals, and suggest directions for future.

As organisations expand and interconnect, authorisation infrastructures become increasingly difficult to manage. Several solutions have been proposed, including self-adaptive authorisation, where the access control policies are dynamically adapted at run-time to respond to misuse and malicious behaviour. The ultimate goal of self-adaptive authorisation is to reduce human intervention, make authorisation infrastructures more responsive to malicious behaviour. In this chapter, we scope and define the emerging area of self-adaptive authorisation by describing some of its developments, trends and challenges. For that, we start by identifying key concepts related to access control and authorisation infrastructures, and provide a brief introduction to self-adaptive software systems, which provides the foundation for investigating how self-adaptation can enable the enforcement of authorisation policies. The outcome of this study is the identification of several technical challenges related to self-adaptive authorisation, which are classified according to the different stages of a feedback control loop.

This position paper describes how blockchains facilitate the implementation of distributed self-adaptive systems. We demonstrate how the master/slave decentralised control pattern for self-adaptive systems, integrated with a permissioned blockchain, can protect nodes of a network against attacks by continuously adapting the membership of an access control list. Whenever malicious behaviour is detected, consensus on an updated access control list is reached, and that node is removed from the network. Using a smart home, as an example, we demonstrate that a permissioned blockchain is able to maintain a consistent view of a network of Internet of Things (IoT) devices in the presence of malicious nodes.

Increasing numbers of Small and Medium Enterprises (SME) are outsourcing or hosting their services on different Cloud Service Providers (CSP). They are also using different security services from these CSPs such as firewalls, intrusion detection/prevention systems and anti-malware. Although for the SMEs the main purpose of using these security services is to protect their cyber assets, either physical or virtual, from security threats and compromises, a very useful and valuable by-product of these security services is the wealth of Cyber Threat Information (CTI) that is collected over time. However, a common problem faced by SMEs is that they lack the resources and expertise for monitoring, analysing and reacting to any security notifications, alerts or events generated by the security services they have subscribed to. An obvious solution to this problem is that the SMEs outsource this problem to a cloud based service as well, by sharing their CTI with this service and allowing it to analyse the information and generate actionable reports or patches. The more CTI obtained from different SMEs, the better the analysis result. In this paper, we try to address some of the privacy and confidentiality issues that arise as a result of different SMEs sharing their CTI with such a third party analysis service for the aggregate analysis scenario we just described. We present the design and architecture of our solution that aims to allow SMEs to perform policy-based sharing of CTI, while also offering them flexible privacy and confidentiality controls.

The important concern for modern software systems is to become more cost-effective, while being versatile, flexible, resilient, dependable, energy-efficient, customisable, configurable and self-optimising when reacting to run-time changes that may occur within the system itself, its environment or requirements. One of the most promising approaches to achieving such properties is to equip software systems with self-managing capabilities using self-adaptation mechanisms. Despite re-cent advances in this area, one key aspect of self-adaptive systems that remains to be tackled in depth is the provision of assurances, i.e., the collection, analysis and synthesis of evidence that the system satisfies its stated functional and non-functional requirements during its operation in the presence of self-adaptation. The provision of assurances for self- adaptive systems is challenging since run-time changes introduce a high degree of uncertainty. This paper on research challenges complements previous roadmap papers on software engineering for self-adaptive systems covering a different set of topics, which are related to assurances, namely, perpetual assurances, composition and decomposition of assurances, and assurances obtained from control theory. This research challenges paper is one of the many results of the Dagstuhl Seminar 13511 on Software Engineering for Self-Adaptive Systems: Assurances which took place in December 2013.

In the feedback control loop, uncertainty is associated to different sources (e.g., the environment), and appears in different forms (e.g., as noise in variables or imperfections in techniques being used). In the MAPE-K control loop, uncertainty is normally handled by the decision maker at the Plan stage. However, depending on the complexity of the stages of the MAPE-K control loop, uncertainties need also to be handled at other stages, depending on the uncertainties associated with that stage. Moreover, uncertainties may also propagate between the stages of the control loop, which might affect how uncertainties are handled. In this position paper, we claim that uncertainties should be identified and handled at the different stages of the feedback control loop. We propose an approach for the identification of internal and external sources of uncertainty for a given stage, and we promote error propagation analysis as a method for analysing the propagation of uncertainties between stages. In terms of tradeoff analysis, which can take place at any stage of the MAPE-K control loop, such an approach provides a clear benefit since it leads to a more accurate estimation of the system quality attributes because uncertainties are handled in the context where they arise.

n this paper, we discuss how for self-adaptive systems some activities that traditionally occur at development-time are moved to run-time. Responsibilities for these activities shift from software engineers to the system itself, causing the traditional boundary between development-time and run-time to blur. As a consequence, we argue how the traditional software engineering process needs to be reconceptualized to distinguish both development-time and run-time activities, and to support designers in taking decisions on how to properly engineer such systems.Furthermore, we identify a number of challenges related to this required reconceptualization, and we propose initial ideas based on process modeling. We use the Software and Systems Process Engineering Meta-Model (SPEM) to specify which activities are meant to be performed off-line and on-line, and also the dependencies between them. The proposed models should capture information about the costs and benefits of shifting activities to run-time, since such models should support software engineers in their decisions when they are engineering self-adaptive systems.

The goal of this roadmap paper is to summarize the state-of-the-art and identify research challenges when developing, deploying and managing self-adaptive software systems. Instead of dealing with a wide range of topics associated with the field, we focus on four essential topics of self-adaptation: design space for self-adaptive solutions, software engineering processes for self-adaptive systems, from centralized to decentralized control, and practical run-time verification & validation for self-adaptive systems. For each topic, we present an overview, suggest future directions, and focus on selected challenges. This paper complements and extends a previous roadmap on software engineering for self-adaptive systems published in 2009 covering a different set of topics, and reflecting in part on the previous paper. This roadmap is one of the many results of the Dagstuhl Seminar 10431 on Software Engineering for Self-Adaptive Systems, which took place in October 2010.

The autonomic management of federated authorization infrastructures (federations) is seen as a means for improving the monitoring and use of a service provider's resources. However, federations are comprised of independent management domains with varying scopes of control and data ownership. The focus of this paper is on the autonomic management of federated identity providers by service providers located in other domains, when the identity providers have been diagnosed as the source of abuse. In particular, we describe how an autonomic controller, external to the domain of the identity provider, exercises control over the issuing of privilege attributes. The paper presents a conceptual design and implementation of an effector for an identity provider that is capable of enabling cross-domain autonomic management. The implementation of an effector for a SimpleSAMLphp identity provider is evaluated by demonstrating how an autonomic controller, together with the effector, is capable of responding to malicious abuse.

The provision of assurances for self-adaptive systems presents its challenges since uncertainties associated with its operating environment often hamper the provision of absolute guarantees that system properties can be satisfied. In this paper, we define an approach for the verification of self-adaptive systems that relies on stimulation and probabilistic model-checking to provide levels of confidence regarding service delivery. In particular, we focus on resilience properties that enable us to assess whether the system is able to maintain trustworthy service delivery in spite of changes in its environment. The feasibility of our proposed approach for the provision of assurances is evaluated in the context of the Znn.com case study.

This chapter considers the problem of optimally selecting services during run-time with respect to their non-functional attributes and costs. Commercial pressures for reducing the cost of managing complex software systems are changing the way in which systems are designed and built. The reason behind this shift is the need for dealing with changes efficiently and effectively, which may include removing the human operator from the process of decision-making. In service-oriented computing, in particular, the run-time selection and integration of services may soon become a reality since services are readily available. Assuming that each component service has a specific functional and non-functional profile, the challenge now is to define a decision maker that is able to select services that satisfy the system requirements and optimise the quality of services under cost constraints. The approach presented in this chapter describes a game theoretic solution by formulating the problem as a bargaining game.

This paper considers the representation of different software fault tolerance techniques as a product line architecture (PLA) for promoting the reuse of software artifact. The proposed PLA enables to specify a series of closely related architectural applications, which is obtained by identifying variation points associated with design decisions regarding software fault tolerance. These decisions are used to choose the appropriate technique depending on the features selected, e.g, the number of redundant resources, or the type of adjudicator. The proposed approach also comprises the formalisation of the PLA, using B-method and CSP, for systematising the verification of fault-tolerant software systems at the architectural level. The properties verified cover two complementary contexts: the selection of the correct architectural variabilities for instantiating the PLA, and also the properties of the chosen fault tolerance techniques.

Abstract. It is commonly agreed that a self-adaptive software system is one that can modify itself at run-time due to changes in the system, its requirements, or the environment in which it is deployed. A cursory review of the software engineering literature attests to the wide spectrum of software systems that are described as self-adaptive. The way self-adaptation is conceived depends on various aspects, such as the users ' requirements, the particular properties of a system, and the characteristics of the environment. In this paper, we propose a classification of modeling dimensions for self-adaptive software systems. Each modeling dimension describes a particular facet of the system that is relevant to self-adaptation. The modeling dimensions provide the engineers with a common set of vocabulary for specifying the self-adaptive properties under consideration and select suitable solutions. We illustrate how the modeling dimensions apply to several application scenarios. Keywords: Self-Adaptive, Self-*, Dynamic Adaptation, Modeling 1.

The self-adaptation of a software system is a complex process that depends on the system requirements, its operational state and environment, which may change during the system operational lifetime. Hence, the process for coordinating the self-adaptation should also be adaptable to changes that may occur during run-time. As a means for coordinating the self-adaptation process of software systems, the proposed approach employs workflows that are dynamically generated for dealing with the variability associated with the self-adaptation process. In this context, our aim is to define and develop techniques for automatically generate workflows for coordinating the self-adaptation of software systems. For demonstrating the feasibility of the proposed approach, architectural reconfiguration of software systems is used as an example, whereby the reconfiguration is managed by workflows that are dynamically generated depending on the availability of resources.

The goal of this roadmap paper is to summarize the state-of-the-art and to identify critical challenges for the systematic software engineering of self-adaptive systems. The paper is partitioned into four parts, one for each of the identified essential views of self-adaptation: modelling dimensions, requirements, engineering, and assurances. For each view, we present the state-of-the-art and the challenges that our community must address. This roadmap paper is a result of the Dagstuhl Seminar 08031 on "Software Engineering for Self-Adaptive Systems," which took place in January 2008.

Many architecture-centred approaches have been proposed for constructing dependable component-based systems. However, few of them provide an integrated solution for their development that combines fault prevention, fault removal, and fault tolerance techniques. This paper proposes a rigorous development approach based on an architectural abstraction, which combines formal methods and robustness testing. The architectural abstraction assumes a crash failure semantics, and when it is instantiated as an architectural element provides the basis for architecting fault tolerant systems. The architecture is formally specified using the B-method and CSP. Assurances that the software system is indeed dependable are obtained by combining formal specification for removing ambiguities from the architectural representation, and robustness testing for validating the source code against its software architecture. The feasibility of the proposed approach is illustrated in the context of a financial critical system.

The use of exception handling mechanisms to develop robust software systems in a non-systematic manner can be a source of many design faults. This paper presents a rigorous development approach based on formal methods, which allows to systematise the verification of the system's abnormal behaviour at the architectural level. Our solution is based on the specification and verification of architectural scenarios, which describe both exception control flows and exception handlers involving architectural elements (components and connectors). We also adopt an architectural abstraction for guiding the internal structure of the architectural elements. The verification process is conducted using the ProB model checker, which combines the use of set-theory (B-Method) and a process algebra (CSP). The feasibility of our approach was evaluated by a case study from the financial domain.

The incorporation of fault tolerance into systems normally increases their complexity, which consequently makes their analysis more difficult. This paper discusses how architectural abstractions can be effective in developing fault-tolerant software systems. Depending on the fault model and the resources available, different abstractions can be employed for representing issues that are related to fault tolerance, such as error detection, and error and fault handling. These architectural abstractions, and their internal views, can be instantiated into concrete components and connectors for designing fault-tolerant software architectures. Since structural and behavioural properties associated with these abstractions are formally specified, the process of verifying and validating software architectures can be automated. In this paper, we show how appropriate architectural abstractions and a recursive process can facilitate the architectural modelling and analysis of fault-tolerant software systems. The feasibility of the proposed approach is demonstrated in the context of a critical real-time application.

This paper considers the notion of the immune system as an information processing system for the purpose of data fusion. As the study of the brain inspired the development of neural networks, the immune system has inspired the development of a wide variety of algorithms. In this position paper, we argue how the various processes of molecular interaction and fusion in the biological immune system can produce analogous behavior for the fusing of data in an artificial context. We provide a mapping between several analogous immunological and artificial immune processes to illustrate this point, and discuss what an immune inspired data fusion system might look like.

The increased use of ubiquitous computing devices is resulting in networks that are highly mobile, well connected and growing in processing and storage capabilities. The nature of these ubiquitous systems, however, also increases the risk of building systems that are undependable and potentially insecure. This paper investigates the use of autonomous agents combined with an intrusion tolerance technique for providing secure and dependable storage for ad hoc networks. The proposed approach is based on the fragmentation-redundancy-scattering (FRS) technique that is able to tolerate both accidental and intentional faults by fragmenting confidential information into insignificant fragments, and by scattering these fragments in a redundant fashion across a network. Two algorithms that are able to maintain a constant number of fragments replicas were developed for this study: one based on the game of life, and the other based on roaming ants. Both algorithms were simulated in NetLogo, and simulated further in a cluster of computers for evaluation of their scalability.

The provision of services despite the presence of faults is known as fault tolerance. One of its associated activities is fault handling, which aims to prevent the reactivation of already located faults. System reconfiguration, one of the steps of fault handling, is a complex cooperative activity involving several participants, thus should be designed in a structured fashion. This position paper describes how coordinated atomic actions (CAactions) and exception handling can be applied to the architectural reconfiguration of systems.

Although it would be desirable for any system to have self-* capabilities when faced with changes that might occur either in the system or its environment, there is a certain classes of systems in which the incorporation of such capabilities would be difficult to justify. These systems are mainly those that uncertainties in their behaviours are not desirable. In this paper, we discuss how the expected degree of autonomy of a system is related to the way in which a system is described, either process or data. The discussion is presented in the context of predictability. The type of system being considered are mission-critical system that are likely to restrict the degree of uncertainty associated with their behaviour, or the infrastructure that enables this behaviour.

This paper presents an immune-inspired adaptable error detection (AED) framework for Automated Teller Machines (ATMs). This framework two levels, one level is local to a single ATM, while the other is a network-wide adaptable error detection. It employs ideas from vaccination, and adaptability analogies of the immune system. For discriminating between normal and erroneous states, an immune inspired one-class supervised algorithm was employed, which supports continual learning and adaptation. The effectiveness of the local AED was confirmed by its ability of detecting potential failures on an average 3 hours before the actual occurrence. This is an encouraging result in terms of availability, since measures can be devised for reducing the downtime of ATMs.

Commercial off-the-shelf (COTS) software components are built to be used as black boxes that cannot be modified. The specific context in whichthese COTS components are employed is not known to their developers. Whenintegrating such COTS components into systems, which have high dependability requirements, there may be mismatches between the failure assumptions of these components and the rest of the system. For resolving these mismatches, system integrators must rely on techniques that are external to the COTS software components. In this paper, we combine the concepts of an idealised architectural component and protective wrappers to develop an architectural solution that provides an effective and systematic way for building dependable software systems from COTS software components.

This paper considers the problem of integrating commercial off-the-shelf (COTS) software components into systems with high dependability requirements. These components, by their very, nature, are built to be reused as black boxes that cannot be modified. Instead, the system architect has to rely? on techniques external with respect to the component for resolving mismatches of the services required and provided that might arise in the interaction of the component and its environment. This paper proposes an architectural solution to turning COTS components into idealised fault-tolerant COTS components by adding protective wrappers to them.

Component-based software built from reusable software components is being used in a wide range of applications that have high dependability requirements. In order to achieve the required levels of dependability, it is necessary to incorporate into these complex systems means for coping with software faults. However, the problem is exacerbated if we consider the current trend of integrating off-the-shelf software components, from independent sources, which allow neither code inspection nor changes. To leverage the dependability properties of these systems, we need solutions at the architectural level that are able to guide the structuring of unreliable components into a fault-tolerant architecture. In this paper, we present an approach for structuring fault-tolerant component-based systems based on the C2 architectural style.

The integrity of complex software systems built from existing components is becoming more dependent on the integrity of the mechanisms used to interconnect these components and, in particular, on the ability of these mechanisms to cope with architectural mismatches that might exist between components. There is a need to detect and handle (i.e. to tolerate) architectural mismatches during runtime because in the majority of practical situations it is impossible to localize and correct all such mismatches during development time. When developing complex software systems, the problem is not only to identify the appropriate components, but also to make sure that these components are interconnected in a way that allows mismatches to be tolerated. The resulting architectural solution should be a system based on the existing components, which are independent in their nature, but are able to interact in well-understood ways. To find such a solution we apply general principles of fault tolerance to dealing with architectural mismatches.

Considering the current trend of building systems from existing components that allow neither code inspection nor change, the solution for enabling dynamic adaptation of software systems should not be intrusive in the way that components should be designed. The architectural approach for treating faults described in this paper, instead of providing mechanisms and techniques at the component level, it relies on the interactions between components for obtaining flexible software structures that are nevertheless robust to the occurrence of undesirable events.

The immune system is a remarkable natural system that is proving to be of great inspiration to computer scientists and engineers alike. This paper discusses the role that the immune system can play in the development of fault tolerant embedded systems. Initial work in the area has highlighted the use of the immune process of negative selection, and more importantly the concept of self/non-self discrimination in the application of artificial immune systems in fault tolerance. This paper reviews those works, highlights issues relating to the way in which this area is approached, and raises important points that need to be considered before effective immune inspired fault tolerant systems can be constructed.

The complexity of systems and the way they work together will require new approaches for their development and operation, since conventional deterministic approaches may not be sufficient for enabling the provision of services expected from these systems. Several new approaches have emerged recently from different areas, such as, biologically inspired computing, agent technology, and software engineering, just to mention a few. Whether these approaches are able to meet the stringent requirements usually associated with dependable computing is still open to debate. Hence this Panel, which aims to discuss the promises and challenges of novel approaches for dependable computing. Next, in order to set the context of this Panel, some of these approaches are briefly presented.

The immune system is a remarkable and complex natural system, which has been shown to be of interest to computer scientists and engineers alike. This paper reports an on-going investigation into the usefulness of the negative selection metaphor for immune inspired fault tolerance. Various procedures to generate detectors for the negative selection algorithm are reviewed and compared in terms of time and space complexity for the production of competent detectors. A new algorithm has been identified and implemented. Experimentation was undertaken, and an analysis is presented on the effectiveness of the various algorithms. The outcome of this empirical analysis reveals that trade-offs have to be made in the choice of algorithm based on the time and space complexities, as well as the detection rate.

This paper describes an architectural approach that facilitates the modelling and analysis of dependable systems that are built from untrustworthy components whose designs, we assume, cannot be changed. The approach is based on the definition of an architectural style in which connectors are considered as first class entities, which embody the description of collaborative behaviour between components. This style is shown to be particularly suitable for describing system components that have to evolve in order for the system to provide dependable services. The feasibility of the proposed architectural style in dealing with evolving dependable systems is demonstrated in terms of the gas station case study.

Exception handling is a structuring technique that facilitates the design of systems by encapsulating the process of error recovery. In this paper, we present a systematic approach for incorporating exceptional behaviour in the development of component-based software. The premise of our approach is that components alone do not provide the appropriate means to deal with exceptional behaviour in an effective manner. Hence the need to consider the notion of collaborations for capturing the interactive behaviour between components, when error recovery involves more than one component. The feasibility of the approach is demonstrated in terms of the case study of the mining control system.

The safety analysis of an evolving software system has to consider the impact that changes might have on the software components, and to provide confidence that the risk is acceptable. If the impact of a change is not thoroughly analysed, accidents can occur as a result of faulty interactions between components, for example. However, the process of safety analysis can be enhanced if appropriate abstractions are provided for modelling and analysing software components and their interactions. Instead of considering components as the locus of change, the proposed approach assumes that components remain unchanged while their interactions (i.e. connectors) adapt to the different requirements needs. The safety analysis is the performed using model checking to verify whether safe behaviour is maintained when interactions between components change. The feasibility of the approach is demonstrated in terms of a case study that deals with the safety procedures associated with the launching of a sounding rocket.

Adaptive systems should be able to adapt to changes that occur in their operating environment without any external human intervention. Software architectures for such systems should be flexible enough to allow components to change their pattern of collaboration depending on the environmental changes and goals of the system, without changing the actual components themselves. This paper describes a co-operative object-oriented style that is able to represent software architectures for adaptive systems. The connectors in this style, described as co-operations, embody the description of complex interacting behaviour between the architectural components. Depending on the environmental changes, the behavioural adaptability in a co-operative object-oriented architecture is achieved by replacing the connectors. The applicability of the architectural style is demonstrated in terms of a case study of a control system that has to adjust the height of a vehicle's suspension to different road conditions.

Architectural description languages (ADLs) are used within the software engineering community to support the description of high-level structure, or architecture, of software systems. A major advantage of this is the ability to analyze and evaluate trade-off among alternative solutions. This chapter will discuss the role of ADLs for representing and analyzing the architecture of software systems. Since ADLs vary considerably on the modeling aspects that they cover, we will focus our discussions on how ADLs support structuring dependability issues.

Architectural description languages (ADLs) are used within the software engineering community to support the description of high-level structure, or architecture, of software systems. A major advantage of this is the ability to analyze and evaluate trade-off among alternative solutions. This chapter will discuss the role of ADLs for representing and analyzing the architecture of software systems. Since ADLs vary considerably on the modeling aspects that they cover, we will focus our discussions on how ADLs support structuring dependability issues.

Analysing complex evasion and obfuscation techniques is crucial for creating more robust defences against malware. String obfuscation is an easy-to-implement technique that hides information, such as domain names, registry keys, etc. Its detection and removal allow malware to be more accurately analysed. This paper proposes a new method for generating detectors for string obfuscation in binary executables. This is achieved by combining features extracted from the assembly of a binary, and its respective control flow graph and the directed graph derived from the control flow graph. Our method generates highly efficient detectors tailored for string obfuscation achieving more than 90% across all evaluation metrics.

In a typical Security Operations Centre (SOC), detection methods for malicious transactions are usually resource intensive, requiring a large team to monitor traffic, which is not ideal for efficient and effective decisions. This paper presents the MAE-NAE FRAMEWORK, consisting of two autoencoders and an adjudicator, which is fast and accurate, but not resource intensive. One autoencoder is trained on malicious data, while the other is trained on normal data. The adjudicator classifies transactions into malicious, normal or novel, depending on the confidence level. Although autoencoders are widely used for novelty detection, they have not been used to identify novelty in network traffic, which is the key goal of MAE-NAE FRAMEWORK. This allows the provision of a triage system that identifies transactions as novel for which the confidence level in classifying either normal or malicious is low. For evaluating the MAE-NAE FRAMEWORK, we have used the KDDCUP99 benchmark dataset with a simple linear adjudicator. The MAE-NAE FRAMEWORK can classify 94.73% of data as normal or malicious leaving 5.27% of the transactions as novel. We have compared our solution against various solutions within the literature, and the MAE-NAE FRAMEWORK is more effective in classifying transactions.

Recent advances in generative AI and machine learning have stirred up fears about the unbridled adoption of autonomous, self-adaptive decision mechanisms in socio-technical systems. This vision paper explores the critical relationship between software-intensive systems and the empowerment of humans as individuals and society. We highlight the need for human empowerment within the context of self-adaptive socio-technical systems (SASTSs), which require mechanisms for balancing of diverse needs, values, and ethics on the individual, community, and societal levels. We propose an architecture comprised of Connector and Mediator elements, and third-party auditing, to support interactions and ensure preservation of human needs, values, and ethics. We use an example of Robot-Assisted A&E Triage system to motivate and illustrate our work and discuss some open challenges for future research.

Nature has an excellent track record in solving problems, and while biological inspired approaches draw inspiration from nature, they should not emulate it blindly. What works for nature may not work for computer systems - bio-inspired computing comes to the rescue. In this position paper, we look into the problem of bio-inspired computing from two perspectives, that of models and algorithms. In the context of self-adaptive software systems, the challenge is to come up with approaches that are able to generate specific solutions on demand and during operational-time.

If software self-adaptation has to be widely adopted by industry, we need to think big, embrace complexity, provide easily deployed and cost-effective solutions, and justify trust. On fairness, MAPE-K should not solely take the blame. MAPE-K is one of the many interpretations of feedback loops apply to systems for which mathematical models - mostly based on control theory, are difficult to be synthesised. MAPE-K has provided a basic and widely accepted framework for justifying the deployment of feedback loops in software systems. Undoubtedly, it has helped to promote and advance the whole area, but now more concrete and resilient solutions are necessary. This position paper argues that, first, industry has been adopting software self-adaptation, perhaps in a way that may not be recognised by the academic community, second, generic solutions are unfeasible since every software system brings its own challenges, and thirdly, the generic stages associated with a feedback loop, like MAPE-K, are insufficient to solve specific challenges.

In self-adaptive software systems, generic controllers can be configured parametrically according to system needs, even though their reuse is restricted because of the wide range of services that can be provided by each of the stages of a feedback control loop, like MAPE-K. Rainbow is a typical example of such a generic, monolithic controller. This paper advocates controllers that are structurally flexible, and which are composed from micro-controllers, each providing specific services (e.g., based on microservices). To provide evidence on the feasibility of our approach, we compare three different architectural configurations for the controller: monolithic, decentralised, and decentralised with a meta-controller. Results from our experiments indicate that even though the decentralised configuration with a meta-controller demanded more computational resources, it performed comparatively well when compared to the other configurations. We conclude that a multi-layered controller design, based on micro-controllers, provides the basis for defining structurally flexible controllers at operational-time, and may promote reuse at development-time.

The main goal of any feedback control system is essentially to remove humans from the loop. This has always been the goal in the engineering of control systems. The MAPE-K loop is the embodiment of a feedback control loop in self-adaptive software systems, but the complete removal of humans from the control loop has not been thoroughly debated. One of the reasons is that, software systems are social-technical systems, and as such, humans need to be considered right from the inception of such systems, otherwise their deployment is bound to fail. However, as software self-adaptation progresses, enabling to place higher assurances on the deployment of these systems to the point humans become dispensable, some ethical questions need to be raised. Similar questions have been raised in past when the first automatic systems became intrinsic to the industrial fabric. The difference between then and now is that then the impact was confined to portions of the society, but now the implications are much wider, if we consider, in particular, software systems that are able to change themselves. If humans are not aware of those changes, and their implications, humans cease to be in tune with the system they are operating, and inevitably accidents will ensue. The point of no return in self-adaptive software systems refers to the moment in their technical maturity when any human involvement with the operation of a system is perceived to create more harm than benefit. Confronted with this situation, software engineers need start asking themselves some basic ethical questions. Do we really need to consider humans as an integral part of self-adaptive software systems? If humans are removed from the control loop, what kind of assurances will be needed for society to accept such systems?

Sharing Cyber Threat Intelligence (CTI) is a key strategy for improving cyber defense, but there are risks of breaching regulations and laws regarding privacy. With regulations such as the General Data Protection Regulation (GDPR) that are designed to protect citizens' data privacy, the managers of CTI datasets need clear guidance on how and when it is legal to share such information. This paper defines the impact that GDPR legal aspects may have on the sharing of CTI. In addition, we define adequate protection levels for sharing CTI to ensure compli- ance with the GDPR. We also present a model for evaluating the legal require- ments for supporting decision making when sharing CTI, which also includes advice on the required protection level. Finally, we evaluate our model using use cases of sharing CTI datasets between entities.

Machine learning tools, like deep neural networks, are perceived to be black boxes. That is, the only way of changing their internal data models is to retrain these models using different inputs. This is ineffective in dynamic systems that are prone to changes, like concept drift. A new promising solution is transparent artificial intelligence, based on the notions of interpretation and explanation, whose objective is to correlate the internal data models with predictions. The research question being addressed is whether we can have a self-adaptive machine learning system that is able to interpret and explain its data model in order for it to be controlled. In this position paper, we present our initial thoughts whether this can be achieved.

In this paper, we discuss the impact that technical debt (TD) may have on MSA regarding some quality attributes, like security, and hypothesise how self-adaptation could be useful in dealing with some aspects of TD.

Self-adaptive systems are able to modify their behaviour and/or structure in response to changes that occur to the system itself, its environment, or even its goals. In terms of authorisation infrastructures, self-adaptation has been shown to provide runtime capabilities for specifying and enforcing access control policies and subject access privileges, with a goal to mitigate insider threat. The evaluation of self-adaptive authorisation infrastructures, particularly, in the context of insider threats, is challenging because simulation of malicious behaviour can only demonstrate a fraction of the types of abuse that is representative of the real-world. In this paper, we present an innovative approach based on an ethical game of hacking, protected by an authorisation infrastructure. A key feature of the approach is the ability to observe user activity pre- and post-adaptation when evaluating runtime consequences of self- adaptation. Our live experiments captured a wide range of unpredictable changes, including malicious behaviour related to the exploitation of known vulnerabilities. As an outcome, we demonstrated the ability of our self-adaptive authorisation infrastructure to handle malicious behaviour given the existence of real and intelligent users, in addition to capturing how users responded to adaptation.

This paper introduces an adaptive framework that makes use of ensemble classification and self-training to maintain high classification performance in datasets affected by concept drift without the aid of external supervision to update the model of a classifier. The updating of the model of the framework is triggered by a mechanism that infers the presence of concept drift based on the analysis of the differences between the outputs of the different classifiers. In order to evaluate the performance of the proposed algorithm, comparisons were made with a set of unsupervised classification techniques and drift detection techniques. The results show that the framework is able to react more promptly to performance degradation than the existing methods and this leads to increased classification accuracy. In addition, the framework stores a smaller amount of instances with respect to a single-classifier approach.

Self-adaptive access control, in which self-* properties are applied to protecting systems, is a promising solution for the handling of malicious user behaviour in complex infrastructures. A major challenge in self-adaptive access control is ensuring that chosen adaptations are valid, and produce a satisfiable model of access. The contribution of this paper is the generation, transformation and verification of Role Based Access Control (RBAC) models at run-time, as a means for providing assurances that the adaptations to be deployed are valid. The goal is to protect the system against insider threats by adapting at run-time the access control policies associated with system resources, and access rights assigned to users. Depending on the type of attack, and based on the models from the target system and its environment, the adapted access control models need to be evaluated against the RBAC metamodel, and the adaptation constraints related to the application. The feasibility of the proposed approach has been demonstrated in the context of a fully working prototype using malicious scenarios inspired by a well documented case of insider attack.

Authorization systems are an integral part of any network where resources need to be protected. They act as the gateway for providing (or denying) subjects (users) access to resources. As networks expand and organisations start to federate access to their resources, authorization infrastructures become increasingly difficult to manage. In this paper, we explore the potential of self-adaptive authorization as a means to automate the management of the access control configuration. We propose a Self-Adaptive Authorization Framework (SAAF) that is capable of managing any policy based distributed RBAC/ABAC authorization infrastructure. SAAF relies on a feedback control loop to monitor decisions (by policy decision points) of a target authorization infrastructure. These decisions are analysed to form a view of the subjects behaviour to decide whether to adapt the target authorization infrastructure. Adaptations are made in order to either endorse or restrict the identified behaviour, e.g. by loosening or tightening the current authorization policy. We demonstrate in terms of representative scenarios SAAFs ability for detecting abnormal behaviour, such as, misuse of access to system resources, proposing solutions that either prevent/endorse such behaviour, applying a cost function to each of these solutions, and executing the adaptive changes against a target authorization infrastructure.

This paper presents an architectural approach based on exception handling for structuring faulttolerant software systems. We introduce the concept of an idealised fault tolerant architectural element (iFTE) that clearly separates the normal and exceptional behaviours of architectural elements. An advantage of the proposed architectural solution is that it can be instantiated into components and connectors. The feasibility of the proposed architectural approach is evaluated in terms of a simple case study.

Although there is a large body of research in dependability, architectural level reasoning about dependability is only just emerging as an important theme in software development. This is due to the fact that dependability concerns are often left until too late in the process of development. In addition, the complexity of emerging applications and the trend of building trustworthy systems from existing untrustworthy components are urging dependability concerns to be considered at the architectural level.

In principle, it would have been desirable for any system to have self-* capabilities when faced with changes that might occur either in the system or its environment. However, these capabilities are difficult to incorporate in certain classes of systems, mainly those in which uncertainties in their behaviours are not desirable. In this position paper, we discuss how the expected degree of autonomy of a system is related to the way in which a system can be described. The discussion is presented in the context of predictability and the assurances associated with the accuracy of that predictability. The subject of this paper are those systems known to be critical in the services they deliver, and which cannot incorporate high degree of uncertainty.

This work describes an approach for the validation of a software system responsible for the destruction of the sounding rocket VS-40X. The process of validation uses three different techniques ranging from the automatic state exploration to the laborious failure analysis. The purpose of the exercise was to obtain diverse arguments in the provision of evidence that the safety properties of the sounding rocket destruction system are always maintained. The software system is modeled using a co-operative architecture, which contains abstractions for modeling and analyzing the interactions between components. The safety analysis is performed using model checking, a technique that exhaustedly explores the state space to determine whether the system satisfies a safety property. The combination of co-operative architectures and model checking has shown effective when modeling and analyzing the interactive behavior between components. However, caution must be taken over the (false) confidence that can be obtained when employing solely model checking for the safety analysis. In order to compensate this deficiency we have to seek diverse sources of evidence to build trustworthy arguments about the safety of the system. The model checking was substantiated using laborious deductive and inductive analysis techniques.

A Cooperative Action (CO action) is a modelling abstraction for representing collaborative behaviour between objects at different phases of the software development. In this paper, the original definition of a cooperative object-oriented approach for software development is extended in order to include the description of exceptional behaviour. Unlike the traditional methods that usually deal with exceptions at late design and implementation phases, the proposed approach emphasises the separation of treatments of application-related, design-related, and implementation-related exceptions during the software lifecycle. The feasibility of the approach is demonstrated in terms of a benchmark case study.

In protection systems, when traditional technology is replaced by software, the functionality and complexity of the system is likely to increase. The quantitative evidence normally provided for safety certification of traditional systems cannot be relied upon in software-based systems. Instead there is a need to provide qualitative evidence. As a basis for the required qualitative evidence, we propose an object-based approach that allows modelling of both the application and software domains. From the object class model of a system and a formal specification of the failure properties of its components, we generate a graph of failure propagation over object classes, which is then used to generate a graph in terms of object instances in order to conduct fault tree analysis. The model is validated by comparing the resulting minimal cut sets with those obtained from the fault tree analysis of the original system. The approach is illustrated on a case study based on a protection system from...

A method is describe of predicting the probable future condition of one or more components within an apparatus comprising a plurality of sensors arranged to monitor the operation of components of the apparatus and a control means arranged to receive said information from said plurality of sensors. The method comprises receiving said sensor information; analyzing the information to ascertain sensor patterns from said sensor information; comparing said sensor patterns with detectors, which are predefined patterns, indicative of the future condition of said one or more components within the apparatus; and classifying said sensor patterns as being indicative of future failure of a component or not based upon a comparison of sensor patterns with said detectors.

A method is described for determining the cause of an error state for one or more components within an apparatus. The apparatus comprises a plurality of sensors arranged to monitor the operation of components of the apparatus and a control means arranged to receive said information from said plurality of sensors. The method comprises analysing said sensor information in the form of an error log to ascertain sensor patterns from said sensor information comparing said sensor patterns with detectors, which are predefined patterns, indicative of the condition of said one or more components within the apparatus and classifying said sensor patterns as being indicative of said error state of a component or not based upon a comparison of sensor patterns with said detectors.