In this dissertation I introduce SpecDB, a database created to represent and host software specifications in a machine-readable format. The specifications represented in SpecDB are for the purpose of unit testing database operations. A structured representation aids in the processes of both automated software testing and software code generation, based on the actual software specifications. I describe the design of SpecDB, the underlying database that can hold the specifications required for unit testing database operations.Specifications can be fed directly into SpecDB, or, if available, the formal specifications can be translated to the SpecDB representation. An algorithm that translates formal specifications to the SpecDB representation is described. The Z formal specification language has been chosen as an example for the translation algorithm. The outcome of the translation algorithm is a set of machine-readable formal specifications.To demonstrate the use of Sp ecDB, two automated tools are presented. The first automatically generates database constraints from represented business rules in SpecDB. This constraint generator gives the advantage of enforcing some business rules at the database level for better data quality. The second automated application of SpecDB is a reverse engineering tool that logs the actual execution of the program from the code. By Automatically comparing the output of this tool to the specifications in SpecDB, errors of commission are highlighted that might otherwise not be identified. Some errors of commission including coding unspecified behavior together with correct coding of the specifications cannot be discovered through black box testing techniques, since these techniques cannot observe what other modifications or outputs have happened in the background. For example, black box, functional testing techniques cannot identify an error if the software being tested produced the correct specified output but mor e over, sent classified data to insecure locations. Accordingly, the decision of whether a software application passed a test depends on whether it coded all the specifications and only the specifications for that unit. Automated tools, using the reverse engineering application introduced in this dissertation, can thus automatically make the decision whether the software passed a test or not based on the provided specifications.

Behavior-Driven Development (BDD) is an emerging agile development approach where all stakeholders (including developers and customers) work together to write user stories in structured natural language to capture a software application's functionality in terms of re- quired "behaviors". Developers then manually write "glue" code so that these scenarios can be executed as software tests. This glue code represents individual steps within unit and acceptance test cases, and tools exist that automate the mapping from scenario descriptions to manually written code steps (typically using regular expressions). Instead of requiring programmers to write manual glue code, this thesis investigates a practical approach to con- vert natural language scenario descriptions into executable software tests fully automatically. To show feasibility, we developed a tool called Kirby that uses natural language processing techniques, code information extraction and probabilistic matching to automatically gener- ate executable software tests from structured English scenario descriptions. Kirby relieves the developer from the laborious work of writing code for the individual steps described in scenarios, so that both developers and customers can both focus on the scenarios as pure behavior descriptions (understandable to all, not just programmers). Results from assessing the performance and accuracy of this technique are presented. / Master of Science

No description available.

Pour réduire les coûts des systèmes embarqués, ces derniers sont livrés avec des micro-processeurs peu puissants. Ces processeurs sont dédiés à l'exécution de tâches calculatoires dont certaines, comme la transformée de Fourier rapide, peuvent s'avérer exigeantes en termes de ressources de calcul. Afin que les implémentations de ces algorithmes soient efficaces, les programmeurs utilisent l'arithmétique à virgule fixe qui est plus adaptée aux processeurs dépourvus d'unité flottante. Cependant, ils se retrouvent confrontés à deux difficultés: D'abord, coder en virgule fixe est fastidieux et exige que le programmeur gère tous les détails arithmétiques. Ensuite, et en raison de la faible dynamique des nombres à virgule fixe par rapport aux nombres flottants, les calculs en fixe sont souvent perçus comme intrinsèquement peu précis. La première partie de cette thèse propose une méthodologie pour dépasser ces deux limitations. Elle montre comment concevoir et mettre en œuvre des outils pour générer automatiquement des programmes en virgule fixe. Ensuite, afin de rassurer l'utilisateur quant à la qualité numérique des codes synthétisés, des certificats sont générés qui fournissent des bornes sur les erreurs d'arrondi. La deuxième partie de cette thèse est dédiée à l'étude des compromis lors de la génération de programmes en virgule fixe pour les briques d'algèbre linéaire. Des données expérimentales y sont fournies sur la synthèse de code pour la multiplication et l'inversion matricielles. / To be cost effective, embedded systems are shipped with low-end micro-processors. These processors are dedicated to one or few tasks that are highly demanding on computational resources. Examples of widely deployed tasks include the fast Fourier transform, convolutions, and digital filters. For these tasks to run efficiently, embedded systems programmers favor fixed-point arithmetic over the standardized and costly floating-point arithmetic. However, they are faced with two difficulties: First, writing fixed-point codes is tedious and requires that the programmer must be in charge of every arithmetical detail. Second, because of the low dynamic range of fixed-point numbers compared to floating-point numbers, there is a persistent belief that fixed-point computations are inherently inaccurate. The first part of this thesis addresses these two limitations as follows: It shows how to design and implement tools to automatically synthesize fixed-point programs. Next, to strengthen the user's confidence in the synthesized codes, analytic methods are suggested to generate certificates. These certificates can be checked using a formal verification tool, and assert that the rounding errors of the generated codes are indeed below a given threshold. The second part of the thesis is a study of the trade-offs involved when generating fixed-point code for linear algebra basic blocks. It gives experimental data on fixed-point synthesis for matrix multiplication and matrix inversion through Cholesky decomposition.

Empreendimentos hospitalares são reconhecidos pela complexidade que está associada a todas as fases de seu ciclo de vida: projeto, construção e operação. Os projetos da saúde são altamente influenciados por regulamentações locais. Estes conjuntos de códigos e legislações contém informações prescritivas e são importantes ao projeto, uma vez que as especificações são, usualmente, definidas de acordo com os critérios neles contidos. Ao longo do processo de desenvolvimento de produto, as especificações devem ser verificadas frente aos requisitos extraídos destas regulamentações. Este processo, se realizado manualmente, tende a ser demorado e propenso a erros. Tentativas de desenvolvimento de sistemas de verificação automatizada não se mostraram completamente satisfatórias. Muitos dos problemas estão relacionados à forma como novas abordagens são concebidas, muitas vezes desenvolvidas de acordo com métodos codificados e fragmentados, e à tipologia de informação que está nas normas e regulamentações. A abordagem metodológica utilizada nesta pesquisa foi a Design Science Research. Como artefato, foi desenvolvido um framework com base na abordagem semântica, para fornecer suporte ao desenvolvimento de sistemas de verificação automatizada, com ênfase em requisitos regulamentares no contexto de projetos de edificações hospitalares. As principais contribuições teóricas deste estudo, portanto, estão relacionadas às taxonomias e às transformações da informação, bem como às relações entre os constructos utilizados. Os resultados indicam que a natureza das regulamentações possui impacto significativo na possibilidade de tradução em regra lógica parametrizável. Apesar de a automação ser desejável, os resultados deste estudo indicam, ainda, que atualmente nem todos os requisitos podem ser completamente traduzidos em termos de processamento e verificação automatizados. Apesar de este fato diminuir o nível geral de automatização no processo, ele pode trazer benefícios ao contexto de projetos da saúde. O atendimento de alguns dos requisitos depende em um certo grau, em critérios subjetivos, que estão relacionados à interpretação humana e à criatividade. / Healthcare facilities are recognized for the complexity associated to all phases of their lifecycle: design, construction and operation. The design of healthcare projects is highly influenced by local healthcare regulations. These legislations usually contain prescriptive information and play an important role, as design specifications should be defined based on the criteria defined therein. In the design phase, during the product development process, requirements extracted from legal regulations must be verified against design specifications. This process, if done manually, tends to be time consuming and error prone. Attempts to develop automated rule checking systems for healthcare projects have not been fully successful. Most flaws appear to be related to the way new approaches are conceived, being mostly developed according to hard-coded and fragmented approaches, and the typology of information bounded by the regulations. The methodological approach adopted in this investigation was the Design Science Research. The main outcome of this research study is a semantic-based framework, devised to support the development of automated rule checking systems, focused on regulatory requirements of healthcare building design. The main theoretical contributions of this research work are concerned with the taxonomies and information transformation, as well as the relationships among the constructs involved. The results indicate that the nature of regulations have a major impact on the possibility of translating them into logic rules. Even though automation is desirable, the findings of this study also indicate that currently not all requirements can be fully translated into rules for automated processing and checking. Although this decreases the overall degree of automation in the process, this fact may provide benefits to the healthcare context. The fulfillment of some requirements to some extend should rely on subjective criteria, which depends on human interpretation and creativity.

Empreendimentos hospitalares são reconhecidos pela complexidade que está associada a todas as fases de seu ciclo de vida: projeto, construção e operação. Os projetos da saúde são altamente influenciados por regulamentações locais. Estes conjuntos de códigos e legislações contém informações prescritivas e são importantes ao projeto, uma vez que as especificações são, usualmente, definidas de acordo com os critérios neles contidos. Ao longo do processo de desenvolvimento de produto, as especificações devem ser verificadas frente aos requisitos extraídos destas regulamentações. Este processo, se realizado manualmente, tende a ser demorado e propenso a erros. Tentativas de desenvolvimento de sistemas de verificação automatizada não se mostraram completamente satisfatórias. Muitos dos problemas estão relacionados à forma como novas abordagens são concebidas, muitas vezes desenvolvidas de acordo com métodos codificados e fragmentados, e à tipologia de informação que está nas normas e regulamentações. A abordagem metodológica utilizada nesta pesquisa foi a Design Science Research. Como artefato, foi desenvolvido um framework com base na abordagem semântica, para fornecer suporte ao desenvolvimento de sistemas de verificação automatizada, com ênfase em requisitos regulamentares no contexto de projetos de edificações hospitalares. As principais contribuições teóricas deste estudo, portanto, estão relacionadas às taxonomias e às transformações da informação, bem como às relações entre os constructos utilizados. Os resultados indicam que a natureza das regulamentações possui impacto significativo na possibilidade de tradução em regra lógica parametrizável. Apesar de a automação ser desejável, os resultados deste estudo indicam, ainda, que atualmente nem todos os requisitos podem ser completamente traduzidos em termos de processamento e verificação automatizados. Apesar de este fato diminuir o nível geral de automatização no processo, ele pode trazer benefícios ao contexto de projetos da saúde. O atendimento de alguns dos requisitos depende em um certo grau, em critérios subjetivos, que estão relacionados à interpretação humana e à criatividade. / Healthcare facilities are recognized for the complexity associated to all phases of their lifecycle: design, construction and operation. The design of healthcare projects is highly influenced by local healthcare regulations. These legislations usually contain prescriptive information and play an important role, as design specifications should be defined based on the criteria defined therein. In the design phase, during the product development process, requirements extracted from legal regulations must be verified against design specifications. This process, if done manually, tends to be time consuming and error prone. Attempts to develop automated rule checking systems for healthcare projects have not been fully successful. Most flaws appear to be related to the way new approaches are conceived, being mostly developed according to hard-coded and fragmented approaches, and the typology of information bounded by the regulations. The methodological approach adopted in this investigation was the Design Science Research. The main outcome of this research study is a semantic-based framework, devised to support the development of automated rule checking systems, focused on regulatory requirements of healthcare building design. The main theoretical contributions of this research work are concerned with the taxonomies and information transformation, as well as the relationships among the constructs involved. The results indicate that the nature of regulations have a major impact on the possibility of translating them into logic rules. Even though automation is desirable, the findings of this study also indicate that currently not all requirements can be fully translated into rules for automated processing and checking. Although this decreases the overall degree of automation in the process, this fact may provide benefits to the healthcare context. The fulfillment of some requirements to some extend should rely on subjective criteria, which depends on human interpretation and creativity.

Empreendimentos hospitalares são reconhecidos pela complexidade que está associada a todas as fases de seu ciclo de vida: projeto, construção e operação. Os projetos da saúde são altamente influenciados por regulamentações locais. Estes conjuntos de códigos e legislações contém informações prescritivas e são importantes ao projeto, uma vez que as especificações são, usualmente, definidas de acordo com os critérios neles contidos. Ao longo do processo de desenvolvimento de produto, as especificações devem ser verificadas frente aos requisitos extraídos destas regulamentações. Este processo, se realizado manualmente, tende a ser demorado e propenso a erros. Tentativas de desenvolvimento de sistemas de verificação automatizada não se mostraram completamente satisfatórias. Muitos dos problemas estão relacionados à forma como novas abordagens são concebidas, muitas vezes desenvolvidas de acordo com métodos codificados e fragmentados, e à tipologia de informação que está nas normas e regulamentações. A abordagem metodológica utilizada nesta pesquisa foi a Design Science Research. Como artefato, foi desenvolvido um framework com base na abordagem semântica, para fornecer suporte ao desenvolvimento de sistemas de verificação automatizada, com ênfase em requisitos regulamentares no contexto de projetos de edificações hospitalares. As principais contribuições teóricas deste estudo, portanto, estão relacionadas às taxonomias e às transformações da informação, bem como às relações entre os constructos utilizados. Os resultados indicam que a natureza das regulamentações possui impacto significativo na possibilidade de tradução em regra lógica parametrizável. Apesar de a automação ser desejável, os resultados deste estudo indicam, ainda, que atualmente nem todos os requisitos podem ser completamente traduzidos em termos de processamento e verificação automatizados. Apesar de este fato diminuir o nível geral de automatização no processo, ele pode trazer benefícios ao contexto de projetos da saúde. O atendimento de alguns dos requisitos depende em um certo grau, em critérios subjetivos, que estão relacionados à interpretação humana e à criatividade. / Healthcare facilities are recognized for the complexity associated to all phases of their lifecycle: design, construction and operation. The design of healthcare projects is highly influenced by local healthcare regulations. These legislations usually contain prescriptive information and play an important role, as design specifications should be defined based on the criteria defined therein. In the design phase, during the product development process, requirements extracted from legal regulations must be verified against design specifications. This process, if done manually, tends to be time consuming and error prone. Attempts to develop automated rule checking systems for healthcare projects have not been fully successful. Most flaws appear to be related to the way new approaches are conceived, being mostly developed according to hard-coded and fragmented approaches, and the typology of information bounded by the regulations. The methodological approach adopted in this investigation was the Design Science Research. The main outcome of this research study is a semantic-based framework, devised to support the development of automated rule checking systems, focused on regulatory requirements of healthcare building design. The main theoretical contributions of this research work are concerned with the taxonomies and information transformation, as well as the relationships among the constructs involved. The results indicate that the nature of regulations have a major impact on the possibility of translating them into logic rules. Even though automation is desirable, the findings of this study also indicate that currently not all requirements can be fully translated into rules for automated processing and checking. Although this decreases the overall degree of automation in the process, this fact may provide benefits to the healthcare context. The fulfillment of some requirements to some extend should rely on subjective criteria, which depends on human interpretation and creativity.

The need for automated methods for identifying refactoring items is prelevent in many software projects today. Symptoms of refactoring needs is the concept of code smells within a software system. Recent studies have used single model machine learning to combat this issue. This study aims to test the possibility of improving machine learning code smell detection using ensemble methods. Therefore identifying the strongest ensemble model in the context of code smells and the relative sensitivity of the strongest perfoming ensemble identified. The ensemble models performance was studied by performing experiments using WekaNose to create datasets of code smells and Weka to train and test the models on the dataset. The datasets created was based on Qualitas Corpus curated java project. Each tested ensemble method was then compared to all the other ensembles, using f-measure, accuracy and AUC ROC scores. The tested ensemble methods were stacking, voting, bagging and boosting. The models to implement the ensemble methods with were models that previous studies had identified as strongest performer for code smell identification. The models where Jrip, J48, Naive Bayes and SMO. The findings showed, that compared to previous studies, bagging J48 improved results by 0.5%. And that the nominally implemented baggin of J48 in Weka follows best practices and the model where impacted negatively. However, due to the complexity of stacking and voting ensembles further work is needed regarding stacking and voting ensemble models in the context of code smell identification.

Carefully scanning and analysing web- applications is important, in order to avoid potential security vulnerabilities, or at least reduce them. Traditional code reviewing methods, such as manual code reviews, have various drawbacks when performed on large codebases. Therefore it is appropriate to explore automated code reviewing tools and study their performance and reliability. The literature study helped identify various prerequisites, which facilitated the application of automated code reviewing tools. In a case study, two static analysis tools, CodeQL and Semgrep, were used to find security risks in three open source web- applications with already known vulnerabilities. The result of the case study indicates that the automated code reviewing tools are much faster and more efficient than the manual reviewing, and they can detect security vulnerabilities to a certain acceptable degree. However there are vulnerabilities that do not follow a pattern and are difficult to be identified with these tools, and need human intelligence to be detected. / Det är viktigt att skanna och analysera webbapplikationer noggrant för att undvika potentiella säkerhetsproblem eller åtminstone minska dem. Traditionella kodgranskningsmetoder, såsom manuella kodgranskningar, har olika nackdelar när de utförs på stora kodbaser. Därför är det lämpligt att utforska automatiserade verktyg för kodgranskning och studera deras prestanda och tillförlitlighet. Litteraturstudien hjälpte till att identifiera olika förutsättningar, som underlättade tillämpningen av automatiserade kodgranskningsverktyg. I en fallstudie användes två statiska analysverktyg, CodeQL och Semgrep, för att hitta säkerhetsrisker i tre open sourcewebbapplikationer med redan kända sårbarheter. Resultatet av fallstudien indikerar att de automatiska kodgranskningsverktygen är mycket snabbare och effektivare än de manualla kodgranskningar och att de kan upptäcka säkerhetsproblem i viss acceptabel grad. Det finns emellertid sårbarheter som inte följer ett mönster och som är svåra att identifiera med dessa verktyg, och behöver mänsklig intelligens för att upptäckas.