Florian Angerer

A case study on software ecosystem characteristics in industrial automation software

In software ecosystems (SECOs) both internal and external developers build software solutions for specific market segments based on common technological platforms. Despite a significant body of research on SECOs there is still a need to empirically investigate the characteristics of SECOs in specific industrial environments to understand and improve development processes. In particular, when defining software processes understanding the roles of the participants in the SECO is crucial. This paper thus reports results of an exploratory case study in the industrial automation domain. We explore two research questions on SECO characteristics and discuss research issues we derived from our analyses. While our study confirms key SECO characteristics reported in the literature we also identify additional properties relevant for development processes in the domain of industrial automation.

Custom-developed vs. model-based configuration tools: experiences from an industrial automation ecosystem

High demands regarding the variability of automation software motivate organizations to automate the configuration process. In practice, this often leads to the development of custom configuration tools designed specifically for configuring the automation software they were developed for. This approach works well as long as both, the development of the software and the configurator are under the full control of the organization. However, software platforms are increasingly open, i.e., key customers add capabilities and thereby change the platforms variability. Often, these customers create a new platform themselves, which they offer to their customers. Moving from a closed platform to a software ecosystem means that development and variability management happen at multiple layers involving multiple teams with different backgrounds. This poses new requirements regarding the flexibility of configuration tools. In this paper, we report experiences and issues with a custom-developed configurator currently in use in an industrial automation software ecosystem. We describe how a model-based tool can be applied to address these issues and provide a scenario-based comparison of the custom-developed solution and the model-based configurator.

Opportunities and challenges of static code analysis of IEC 61131-3 programs

Static code analysis techniques analyze programs by examining the source code without actually executing them. The main benefits lie in improving software quality by detecting potential defects and problematic code constructs in early development stages. Today, static code analysis is widely used and numerous tools are available for established programming languages like C/C++, Java, C# and others. However, in the domain of PLC programming, static code analysis tools are still rare. In this paper we present an approach and tool support for static code analysis of PLC programs. The paper discusses opportunities static code analysis can offer for PLC programming, it reviews techniques for static analysis, and it describes our tool that implements a rule-based analysis approach for IEC 61131-3 programs.

Software Evolution in an Industrial Automation Ecosystem: An Exploratory Study

In software ecosystems (SECOs) both internal and external engineers develop software solutions for specific market segments and customers based on common technological platforms. SECOs pose new challenges for software engineering as the platforms are evolved by different development teams and communities. Despite a significant body of research only few empirical results are available on software evolution in SECOs. This paper reports results of an exploratory case study on change characteristics in an industrial automation SECO. We apply Buckley et al.s framework of software change to characterize evolution in an industrial automation SECO. We further discuss evolution challenges we derived from our analyses.

Configuration-Aware Change Impact Analysis (T)

Understanding variability is essential to allow the configuration of software systems to diverse requirements. Variability-aware program analysis techniques have been proposed for analyzing the space of program variants. Such techniques are highly beneficial, e.g., to determine the potential impact of changes during maintenance. This paper presents an interprocedural and configuration-aware change impact analysis (CIA) approach for determining possibly impacted products when changing source code of a product family. The approach further supports engineers, who are adapting specific product variants after an initial pre-configuration. The approach can be adapted to work with different variability mechanism, it provides more precise results than existing CIA approaches, and it can be implemented using standard control flow and data flow analysis. Using an industrial product line we report evaluation results on the benefit and performance of the approach.

Recovering Feature-to-Code Mappings in Mixed-Variability Software Systems

Software engineering methods for analyzing and managing variable software systems rely on accurate feature-to-code mappings to relate high-level variability abstractions, such as features or decisions, to locations in the code where variability occurs. Due to the continuous and long-term evolution of many systems such mappings need to be extracted and updated automatically. However, current approaches have limitations regarding the analysis of highly-configurable systems that rely on different variability mechanisms. We present a novel approach that exploits the synergies between program analysis and doffing techniques to reveal feature-to-code mappings for highly-configurable systems. We demonstrate the feasibility of our approach with a set of products from a real-world product line in the domain of industrial automation.

Points-to analysis of IEC 61131-3 programs: Implementation and application

A call graph of a program represents the information which executable program element calls which other executable program elements. Based on the call graph, points-to sets can be computed, which represent the memory locations a reference variable can possibly point to. Call graph and points-to sets provide important information for static program analysis. This is especially true for PLC programs which heavily use pointer variables. However, due to the complexity of the algorithms, call graph and points-to analysis methods are not widely available in static analysis. In this paper, we present an approach for call graph and points-to analysis of IEC 61131-3 programs. We present the algorithm for computing call graph and points-to sets and its implementation in a tool environment, show several different application scenarios, and present first results from industrial application.

Where has all my memory gone?: determining memory characteristics of product variants using virtual-machine-level monitoring

Non-functional properties such as memory footprint have recently gained importance in software product line research. However, determining the memory characteristics of individual features and product variants is extremely challenging. We present an approach that supports the monitoring of memory characteristics of individual features at the level of Java virtual machines. Our approach provides extensions to Java virtual machines to track memory allocations and deal-locations of individual features based on a feature-to-code mapping. The approach enables continuous monitoring at the level of features to detect anomalies such as memory leaks, excessive memory consumption, or abnormal garbage collection times in product variants. We provide an evaluation of our approach based on different product variants of the DesktopSearcher product line. Our experiment with different program inputs demonstrates the feasibility of our technique.

Supporting Program Analysis for Non-Mainstream Languages: Experiences and Lessons Learned

Static code analysis techniques are widely and successfully used for mainstream programming languages. However, domain-specific languages and company-specific variations of languages often lack the same level of support. An example is the domain of industrial automation, where programmable logic controller programs are mainly written in languages conforming to the IEC 61131-3 standard, a non-mainstream family of languages. This experience paper reports about the development of a program analysis framework for the IEC 61131-3 languages. We use OMGs Abstract Syntax Tree Meta-Model (ASTM) as an abstract representation and show our extensions of this model to represent the different IEC 61131-3 languages. Using this representation our approach generates Jimple code, an intermediate representation used by the Soot program analysis framework. We use Soots standard analysis methods to compute a system dependence graph, which is then used for change impact analysis. We apply our approach to industrial-size product lines of our industry partner to demonstrate its correctness and performance. Finally, we discuss experiences and lessons learned intended for developers of program analysis methods for nonmainstream languages.

Static Code Analysis of IEC 61131-3 Programs: Comprehensive Tool Support and Experiences from Large-Scale Industrial Application

Static code analysis techniques examine programs without actually executing them. The main benefits lie in improving software quality by detecting problematic code constructs and potential defects in early development stages. Today, static code analysis is a widely used quality assurance technique and numerous tools are available for established programming languages like C/C++, Java, or C#. However, in the domain of programmable logic controller (PLC) programming, static code analysis tools are still rare, although many properties of PLC programming languages are beneficial for static analysis techniques. Therefore, an approach and tool for static code analysis of IEC 61131-3 programs has been developed which is capable of detecting a range of issues commonly occurring in PLC programming. The approach employs different analysis methods, like pattern-matching on program structures, control flow and data flow analyses, and, especially, call graph and pointer analysis techniques. Based on results from an initial analysis project, where common issues for static analysis of PLC programs have been investigated, this paper illustrates adoption and extensions of analysis techniques for PLC programs and presents results from large-scale industrial application.