Fuzzy Goals for Requirements-driven Adaptation
Luciano Baresi and Liliana Pasquale
Politecnico di Milano
Dip. di Elettronica e Informazione
piazza L. Da Vinci, 32 – 20133, Milano (Italy)
Email: {baresi | pasquale}@elet.polimi.it
Abstract—Self-adaptation is imposing as a key characteristic
of many modern software systems to tackle their complexity
and cope with the many environments in which they can
operate. Self-adaptation is a requirement per-se, but it also
impacts the other (conventional) requirements of the system;
all these new and old requirements must be elicited and
represented in a coherent and homogenous way. This paper
presents FLAGS, an innovative goal model that generalizes
the KAOS model, adds adaptive goals to embed adaptation
countermeasures, and fosters self-adaptation by considering
requirements as live, runtime entities. FLAGS also distinguishes
between crisp goals, whose satisfaction is boolean, and fuzzy
goals, whose satisfaction is represented through fuzzy constraints. Adaptation countermeasures are triggered by violated
goals and the goal model is modified accordingly to maintain a
coherent view of the system and enforce adaptation directives
on the running system. The main elements of the approach are
demonstrated through an example application.
Keywords-Goals, KAOS, Self-Adaptation, Fuzzy Goals
I. I NTRODUCTION
Self-adaptation is becoming a key feature of many software systems to tackle their increasing complexity and cope
with the environments in which they are deployed. Systems
must (self-)adapt because of new business needs, but also
because of the volatility of their environments, which may
lead to violating some requirements satisfied at deployment
time. Many approaches [1], [2] have already tried to embed
self-adaptation capabilities in existing systems or add them
to new ones, but only few attempts [3], [4] have addressed
this problem from the beginning. Adaptation capabilities
should be identified as requirements per-se and must be
related to the other, “conventional”, requirements of the
system. This allows us to identify which requirements need
a specific adaptation when they are not fulfilled satisfactorily and guarantee that adaptations are coherent with the
expectations of the stakeholders.
To address these issues, the paper presents FLAGS (Fuzzy
Live Adaptive Goals for Self-adaptive systems), which is
an innovative goal model able to deal with the challenges
posed by self-adaptive systems. Goal models have been used
This research has been funded by the European Commission, Programmes: IDEAS-ERC, Project 227977 SMScom, and FP7 Network of
Excellence 215483 S-Cube.
Paola Spoletini
Università dell’Insubria
Dip. di Informatica e Comunicazione
via Ravasi, 2 – 21100, Varese (Italy)
Email: [email protected]
for representing systems’ requirements, and also for tracing
them onto their underlying operationalization. However,
goals do not directly address adaptation. To do this, one
should describe how goals cope with changes and how they
can modify themselves and, if needed, the whole goal model.
FLAGS generalizes the basic features of the KAOS
model [5] (i.e., refinement and formalisation), and adds the
concept of adaptive goal. These goals define the countermeasures that one must perform if one or more goals are
not fulfilled satisfactorily. Each countermeasure produces
changes in the goal model. Countermeasures may prevent
the actual violation of a requirement, enforce a particular
goal, or move to a substitute one. The selection at runtime
depends on the satisfaction level of related goals and the
actual conditions of the system and of the environment.
As for goals’ satisfaction, a crisp notion (yes or no) would
not provide the flexibility necessary in systems where some
goals cannot be clearly measured (soft goals), properties
are not fully known, their complete specification —with all
possible alternatives— would be error-prone, and small/transient violations must be tolerated. This is why, besides crisp
goals, we also propose fuzzy goals, specified through fuzzy
constraints, that quantify the degree x (x ∈ [0, 1]) to which
a goal is satisfied/violated.
Moreover, goal models have been traditionally conceived
as design-time abstractions, but this is not enough if we
think of runtime changes and we want to keep the running
system aligned with its business requirements. If we want
to pursue the alignment between requirements and runtime
entities, and we want to delegate decisions about adaptation
to the goal model, we need to turn goals into live entities,
as originally proposed by Kramer and Magee [6]. The idea
is that the runtime infrastructure [7], not presented in this
paper, feeds the goal model and triggers changes in its parts.
These changes are translated into actual adaptation directives
onto the running system.
This paper focuses on the description of fuzzy and adaptive goals; it only provides a general overview of how
these goals can be handled as runtime abstractions. These
concepts are exemplified through a simple laundry system
that controls a set of washing machines. The system must
decide how to use the different machines, select washing
programs, and activate washing cycles. The overall goal is
to minimize energy consumption while accomplishing all
tasks. The paper is organized as follows. Section II motivates
our approach, and introduces the laundry system example.
Section III illustratess the syntax and semantics of the language adopted to formalize fuzzy goals. Section IV describes
adaptive goals and Section V explains the reasons why goals
must be runtime abstractions. Section VI discusses related
proposals and Section VII concludes the paper.
II. OVERALL A PPROACH
This section introduces our approach and the motivations
behind it through a simple laundry system. The aim is to
introduce the key elements and also highlight the reasons
why we decided to extend KAOS.
Figure 1 presents a KAOS model of the laundry system.
The general objective of the system is to wash clothes (goal
G1), which is AND-refined into the following subgoals:
setup the washing machine (goal G1.1), complete a washing
cycle (goal G1.4), consume a small amount of energy (goal
G1.2) and keep the number of clothes that remain to be
washed low (goal G1.3). The setup of a washing machine
requires that clothes be inserted in the drum (goal G1.1.1),
powder be added (goal G1.1.2), a washing program be
selected (goal G1.1.3), and the washing machine be ready
(goal G1.1.4). The completion of a washing cycle requires
that the selected program be started (goal G1.4.1) and that
the washing machine be emptied when it terminates the
execution (goal G1.4.2).
Goals G1.2 and G1.3 are soft goals since there is not
a clear-cut criterion to decide whether they are satisfied
or not, that is, whether the energy consumption is “small”
or the number of dirty clothes is “low”. For this reason,
these goals can only be partially fulfilled. Goal G1.3 is
also in conflict with goal G1.2 (see the dotted line in
Figure 1) since reducing the number of dirty clothes may
imply the execution of more washing programs and thus
more energy. Conflicting goals are usually associated with
different priorities. In our case, goal G1.3 has a higher
priority (p = 4) than goal G1.2 (p = 2), since reducing the
amount of dirty clothes is more important than constraining
energy consumption.
These goals use the following entities: WashingMachine(id, program, powder, drumEmpty, washDuration, sens,
state: {default, free, selected, ready, washCompleted}),
Program(name, duration), EnergyUnits(units), and DirtyClothes(amount). As for events, we have program selected,
which signals that a program is selected for a washing machine, and start program, which indicates that a particular
program has just started on a washing machine.
KAOS allows one to formalize goals in LTL (Linear
Temporal Logic, [8]). For example, Table I presents the
formalization of the goals introduced for the example1 .
1 Operator
@ has the following meaning [5]: @P ≡ •(¬P ) ∧ ◦P
Goal
Formal definition
G1.1.1
wm : W ashingM achine,
@(wm.state = selected) ⇒ ♦t<x (¬wm.drumEmpty)
G1.1.2
wm : W ashingM achine,
@(wm.state = selected) ⇒ ♦t<y (wm.powder)
G1.1.3
wm : W ashingM achine, p : wm.program,
(p.name = “”) ∧ @(wm.state = selected) ⇒
♦t<z (wm.program 6= “” ∧ p.duration > 0)
G1.1.4
wm : W ashingM achine,
((wm.state = selected) ∧ (¬wm.drumEmpty)
∧(wm.program 6= “”) ∧ (wm.powder)) ⇒
◦(wm.state = ready)
G1.2
e : EnergyU nits, (e.units ≤ EM AX )
G1.3
dc : DirtyClothes, (dc.amount < 5)
G1.4.1
wm : W ashingM achine, p : wm.program
@(wm.state = ready) ⇒
♦t≤p.duration (@(wm.sens = “green ”)∧
@(wm.state = washCompleted))
G1.4.2
wm : W ashingM achine,
(wm.state = washCompleted) ⇒
♦(wm.program =“”∧wm.state = f ree∧
¬(wm.powder) ∧ ¬(wm.drumEmpty)
Table I
F ORMALIZATION OF SOME EXAMPLE GOALS .
Goal G1.1.3 must be achieved when a washing machine
has been selected to perform a washing cycle but a washing
program has not been chosen yet. In this case, a washing
program must be selected and its duration must be set properly. This goal is achieved through operation Op3 [Select
Program] defined as follows2 :
Name:
In/Out:
DomPre:
ReqPre:
TrigPre:
ReqPost:
Op3
p : P rogram, wm : W ashingM achine
wm.state = selected
wm.program.name = “”
program selected(wid, p)
wm.program.name = p.name ∧
wm.program.duration = p.duration ∧
wid = wm.id
This operation is activated when a washing program is
selected for a particular washing machine (see T rigP re).
Parameter p of event program selected comprises the
selected washing program (p.name) and its corresponding
duration (p.duration). This information must be assigned to
the washing machine chosen to perform the washing cycle
(see ReqP ost).
Goal G1.4.1 states that if a washing machine becomes
ready to perform a washing program (@(wm.state =
ready)), it must terminate it within a delay lower than that
specified in the program duration (wm.washDuration).
A program is completed when the sensor of the washing
2 Operations are expressed in terms of their input/output entities (In/Out), domain preconditions (DomPre), domain postconditions (DomPost),
required preconditions (ReqPre), triggering preconditions (TrigPre), and
required postconditions (ReqPost).
Figure 1.
The KAOS goal model of the laundry system.
machine becomes green (wm.sens = 0 green0 ). This goal
is achieved through operation Op5 [Wash], which is defined
as follows:
Name:
In/Out:
DomPre:
DomPost:
TrigPre:
ReqPost:
Op5
wm : W ashingM achine
wm.state = ready
wm.state = washCompleted
start program(wid, t) ∧ wm.id = wid
wm(t0 ).sens = “green”∧
∧ t0 − t < wm.program.duration
The operation changes the state of the washing machine from ready to washCompleted (see DomP re and
DomP ost). This operation is triggered when a washing
program is started (event start program(wid, t)) for the
specified washing machine (wm.id = wid).
Goals G1.2 and G1.3 rely on the operations shown in
Figure 1 (i.e., Op1,..., Op6). To enforce the satisfaction
of these goals we must add the following required postconditions to each operation:
ReqPostG1.2 : e.units < EM AX
ReqPostG1.3 : dc.amount < 5
A. From KAOS to FLAGS
If we formalize goals in LTL, we can only assess whether
they are fulfilled or not, and there is no way to say “how
much” a goal is satisfied/violated. This may be sufficient
for hard goals, but it is not satisfactory for soft-goals that
can be satisfied up to a given degree, or when we need to
tolerate small violations. For example, LTL is good for goal
G1.1.3 since we are only interested in knowing whether a
program is selected in z time units. In contrast, the adoption
of LTL to formalize goal G1.4.1 would not be the best option
since we may want to tolerate the case in which the washing
machine terminates a program a bit later than expected
(@(wm.sens = “green”, at time z 0 : z 0 − z = ). This
corresponds to considering these cases as “weak” violations.
Furthermore, if we were able to track the level of satisfaction
of soft goals, like G1.2 and G1.3, we would be able to
adjust the behavior of the system accordingly. For example,
since goal G1.2 (amount of energy consumed) and goal
G1.3 (washed clothes) are in conflict, one may try to find a
compromise between the two. The less critical requirements
(G1.2) can be relaxed more than critical ones (G1.3) to
provide viable solutions.
This is why FLAGS distinguishes between crisp and fuzzy
goals. The fulfillment of the former is boolean, while the
latter can be satisfied up to a certain level (x ∈ [0, 1]). Crisp
goals are rendered in LTL, while our proposal for fuzzy
goals is presented in Section III. These two types of goals
can easily coexist: crisp goals represent firm requirements,
while fuzzy goals are more flexible.
During requirements elicitation we must also define how
the system adapts itself at runtime. For example if goal
G1.4.1 is violated because the washing machine turns off
suddenly during a washing cycle, we must turn the washing
machine on again. We must also restore the system in a
state where the drum is already filled, the powder must be
added and the program set again. This is the goal that states
how the system should adapt itself by applying a suitable
countermeasure, and thus we call it adaptive goal. Each
countermeasure is associated with an event that triggers it
execution (goal G1.4 violated), a condition for its actual
activation (the washing machine turns off suddenly), an
objective it has to achieve (turn on the washing machine),
and a sequence of basic actions that must be performed on
the goal model, and the underlying system, to achieve the
objective.
III. C RISP AND F UZZY G OALS
This section presents the language we propose to specify
goals. Crisp goals are still defined in LTL, while fuzzy goals
use a fuzzy temporal language. The two options are unified
in a single language whose grammar is presented below3 .
3 As commonly done for LTL, we adopt the set of natural numbers as
temporal domain. Furthermore, since we suppose that crisp and fuzzy
untimed formulae are defined over finite domains, universal (∀) and
existential (∃) quantifiers can be added without augmenting the expressive
power of the language.
#
$%
"
#
#
$%
the number is, the worse the violation is. The goal can be
freq ::=
| F<t freq
| G•t freq | G−x freq
|
$% Gfreq $%
("
freq
U
freq
|
treq
|
fprop
# redefined as follows:
&
fprop ::= fprop $%
f fprop | ∼fprop | expr comp expr
::=
expr
const | var | expr&
op$%expr '#
G dirty clothes 5
'#
!#"
!#"
)("
#
comp
::=
|
≺
|
|
|
≈
|
≈
6
language.
use
a
fuzzy
temporal
The
two
options
are
unified
in
reason,
fuzzy
goals
can
be
considered a generalization of crisp
$%
&
$%
!"#
$%"
op
::='#
+language
|
−("
|!#"
∗ | / grammar
below.
a
single
whose
is presented
ones.
$% $%
&
) $%"
#
"
use a fuzzy
temporal language. The two options are unified
in reason,
fuzzy
goalsmembership
can be considered
a generalization
of crisp operator is
and the
function
of the relational
&
!#")
!#")
For example, we can modify the definition of goal G1.3
a single req
language
whose
grammar
is
presented
below.
ones.
::=
treq
|
freq
similar to the fourth function shown in Figure 2(a), where
'#
!#"
) )("
G•t Figure
∈req{G
,
GKAOS
, goal
G>tmodel
G
}.
f|req
is a&
temporal
#
Table we
I), to
into the
account
the of
violation’s
severity
For(see
example,
cantake
modify
definition
goal G1.3
<t
≤t
≥t
freq
::=
Gfreq
|,!#")
F
G•tsystem
freq
|fuzzy
G−x freq
| freq forgoal model for the laundry system
<t
1.::=
The
forfreq
the laundry
treq
| freq
theby
isintothe
amount
dirty
clothes
and the points
(see given
Table
I),domain
to take
the of
violation’s
severity
the
amount
ofaccount
dirty
clothes
(the
higher
the number
freqGfreq
| treqG,
| <t
fprop
mula (see
F
G−x
a crisp
freqUoperators
::=
|F
freq
|G
| ,GU),
| freq temporal
!"#
$%"
<t , G
•t•t,freq
−x freq
::= fprop � fprop | ∼fprop | expr comp expr
KAOS goal model for the laundry
system
in
which
the
membership
function
is
completely
fprop
given
by
the
amount
of
dirty
clothes
(the
higher
the
number
of
dirty
clothes
is,
the
worse
the
violation
is).
Goal
G1.3
is satisfied
U
freq
|
treq
|
fprop
)#
!#")
) (treq)
formula
ortemporal
a fuzzy
untimed
formula
(f prop).
useexpr
a fuzzy
The
options
unified inconst
reason,
fuzzy
goals can
a generalization
ofGoal
crisp G1.3 is
::=
const
| language.
var || ∼fprop
expr
optwo
::=
fprop
� fprop
|expr
expr
compare
expr
of dirty
clothes
is, be
the
worse the
violation
is).
are
those
in
(−∞,
5],
while
it
gradually
decreases
its truth
then
redefined
asconsidered
follows:
The generalrepresents
objective isfprop
to
turn
on
the
washing
machine,
S to goal.
FUGA
goal.
The
general
objective
is
to
turn
on
the
washing
machine,
a::=constant
value
and
indicates
a single
language
grammar
is≈
presented
below. a variable.
ones.
comp
::= 1.�| The
|whose
≺KAOS
�
|op
�
|var
| �≈
expr
const
var
|| expr
expr
Figure
goal
model
for the
laundry system
thenactions
redefined
asfor
follows:
and
the
associated
strategy
defines
a
set
of
basic
actions
that
degree
those
points
in
(5,
∞).
and
the
associated
strategy
defines
a
set
of
basic
that
For
example,
we
can
modify
the
definition
of
goal
G1.3
op
::=
+
|
−
|
∗
|
/
comp
::=
�
|
≺
|
�
|
�
|
≈
|
≈
�
G(dirty
clothes
�
5)
goal.
The
objective
is totreq
turn|are
on
washing
machine,
ing
goals through
LTL
isgeneral
equivalent
toreq
considering
Since
crisp
formulae
LTL
expressions,
there is no need
::=
freqthe
must be and
performed
on the goal
model
to+achieve
this
objective.
be performed
on
goal model to achieve
objective.
(see this
Table
I),clothes
to take�into
account the [9]
violation’s available
severity
::=
| −Gfreq
| a∗set
G(dirty
5) semantics
Different
for fuzzy
freq
::=
| |must
F/
freq
|actions
G•t freq that
| Gthe
−x freq | freq
thetoassociated
defines
of<t basic
toexpressions.
pnsidering
This
way,
it op
is strategy
only
possible
to
andamount
the membership
function ofare
the relational operator
� boolean
further
discuss
them.
giventhat
by the
of dirty clothes (the higher the number
U freq
| operator
treqthat
| fprop
Adaptive
goals
represent
adaptation
strategies
must
be
Adaptive
goals
represent
adaptation
strategies
must
be
Notice
that
G
∈
{G
,
G
,
G
,
G
}.
The
non•t
<t
≤t
>t
≥t
.
from
KAOS
to
FUGA
goal.
The
general
objective
is
to
turn
on
the
washing
machine,
must
be
performed
on
the
goal
model
to
achieve
this
objective.
connectives
(and
f))
and
the
connectives
derived
from them
and
the
membership
function
of
the
relational
operator
�
way
er
goals
are
fulfilled
or
not.
There
is
no
way
is
similar
to
the
fourth
function
shown
in
Figure
2(a),
where
fprop
::=
fprop
�
fprop
|
∼fprop
|
expr
comp
expr
ossibleperformed
to
ofthe
dirtyFor
clothes
is, the worse the violation is). Goal G1.3 is
The
of req
the
fuzzy
language
inspired
by use
that
operator
Gstrategies
∈ {G
, Gmust
G
Gnot
The
nonwhen
a goal
isNotice
notsemantics
fulfilled
satisfactorily.
For
examperformed
when
a, goal
isis
fulfilled
satisfactorily.
exam•t
<t
≤t
>t ,grammar
≥t }.
terminal
symbol
axiom
of
the
and
we
and
the
associated
strategy
defines
setthe
of(or
basic
actions
that
Adaptive
goals
represent
adaptation
that
be
isa similar
toasg,
the
fourth
function
shown
inclothes
Figure
2(a),the
where
expr
::=
| is
varthe
| expr
op
expr
be
much”
a goal
is satisfied/violated.
This
mayconst
be considering
and
implies
⇒).
˜
For
operator
not
∼
we
adopt the
domain
is
the
amount
of
dirty
and
origin
(O)
Expressing
goals
through
LTL
is
equivalent
to
then
redefined
follows:
no ple,
way
symbol
req
the
axiom
of
we
use
theory
ofgoal
fuzzy
sets,
proposed
by and
Zadeh
[9].
It todomain
AG1.2
defines
theterminal
adaptation
strategies
performed
ple,
defines
thethrough
adaptation
strategies
performed
when
performed
ona the
goal
model
thisthe
objective.
comp
::=
� is|originally
≺
|when
�AG1.2
|�
|must
≈the
| be
�≈grammar
decide
wether
the
goal
crisp
(treq)
performed
is not
satisfactorily.
For
examthe
is
amount
dirty
theoperator
origin (O)
ers.
goals,
but
it may when
notitThis
beatoenough
others.
oals
expressions.
way,
itfor
isfulfilled
only
possible
tois specified
isachieve
represented
by
the of
point
(5,clothes
0). 1.and
ssome
mayas
becrisp
definition
shown
in
equation
For
f
we
can
decide
op
::=
+
|
−
|
∗
|
/
G(dirty
clothes
�
5)
it
to
decide
wether
the
goal
is
specified
through
a
crisp
(treq)
goal
G1.2
is
not
fully
satisfied.
Each
strategy
has
an
objective
Adaptive
goals represent
adaptation
be
G1.2
is not
fully assigns
satisfied.
Each
strategy
has
anstrategies
objectivethat
adopts
membership
function
(µ)
that
a degree
ofrepresented
oraasince
fuzzy
formula
(fgoal
req).
AG1.2
defines
the
strategies
performed
when
is
by must
the point
(5,[9]
0).are available for fuzzy boolean
ssess
whether
goals
areG1.1.3
fulfilled
oradaptation
not.
is
no
way
nly
is goodple,
for
goal
we
areThere
only
Different
semantics
orLTL
others.
between
the
definitions
provided
in
equations
2
and
3.
The
or
a
fuzzy
formula
(f
req).
and
the
membership
function
of
the
relational
operator
�
performed
when
a
goal
is
not
fulfilled
satisfactorily.
For
exam(e.g.,
enforce
a
goal
satisfaction,
prevent
a
goal
violation,
(e.g.,
enforce
a
goal
satisfaction,
prevent
a
goal
violation,
Since
crisp
formulae
are
LTL
expressions,
there
is
no
need
goal
G1.2
is
not
fully
satisfied.
Each
strategy
has
an
objective
semantics
[9] are
for fuzzy
boolean
truth
each
proposition.
PossibleDifferent
say
“how
much”
a goal (codomain,
isis satisfied/violated.
may
beto <t
n are
z only
knowing
wether
a program
selected
orformulae
notyoperator
in∈
zThis[0,
Notice
that
G1])
, G≤t , G
G≥t }.isThe
nonconnectives
(e.g.,
�))
and available
the
connectives
derived
from this
•t ∈ {G
>t ,there
is similar
to
the
fourth
function
shown
in
Figure
2(a), where
Since
crisp
are
LTL
expressions,
noas
need
ple,
AG1.2
defines
the
adaptation
strategies
performed
when
actual
choice
depends
on
the
application
we
are
dealing
with,
and
so
on)
and
is
decomposed
into
a
set
of
operations
that
and
so
on)
and
is
decomposed
into
a
set
of
operations
that
to
further
discuss
them.
Term
f
req
is
expressed
a
fuzzy
(e.g.,
enforce
a
goal
satisfaction,
prevent
a
goal
violation,
connectives
(e.g.,
�))
and
the
connectives
derived
from
this
ufficient
for
some
goals,
but
it
may
not
be
enough
for
others.
terminal
symbol
req
is
the
axiom
of
the
grammar
and
we
use
oal
values
are:
absolutely
true
absolutely
false
(0),Each
of LTL
to formalize
goal
basicishas
set
(e.g.,
or of
�,dirty
and clothes
impliesand
⇒).
˜ theFor
operator
r contrast,
not in z the adoption
theordomain
thean
amount
origin
(O) ∼ we adopt
goal
G1.2
fully
strategy
objective
to
further
discuss
them.
Term
f(1),
req
is
as
asatisfied.
guaranteeand
the achievement
of
the
achievement
the
on)
and
isgoal
decomposed
into
atheguarantee
set
of
operations
that
temporal
formula
operators
G,
Fexpressed
,isGnot
Ufuzzy
), a crisp
ortonot
example,
good
for
G1.1.3
since
we
are
only
basic
setsince
(e.g.,
or
�,
and(5,implies
⇒).
˜ For
operator
we
the
former
definition
assigns
a∼ more
itthe
to objective.
decide
wether
goal
is
specified
through
a Gcrisp
(treq)
<t
•t ,of
−x ,objective.
dalize
be the LTL
bestsoisoption
since
we
may
want
to(see
the
definition
shown
in
1. For
operator
� itadopt
isoptimistic
possible degree
goal
is represented
by the
point
0).equation
an
intermediate
degree
of
truth
(a
value
in
(0,
1)).
The
(e.g.,
enforce
a
goal
satisfaction,
prevent
a
goal
violation,
temporal
formula
(see
operators
G,
F
,
G
,
G
,
U
),
a
crisp
<t
•t
−x
goals
allow
one
foresee
depending
terestedFuzzy
in knowing
wether
a program
isofstrategies
selected
or
not
in za goals
or adifferent
fuzzy
formula
(f req).
Fuzzy
allow
one
foresee
different
strategies
depending
guarantee
the
achievement
the
objective.
temporal
formula
(treq)
or
fuzzy
untimed
formula
(f
prop).
the
definition
shown
in
equation
1.
For
operator
�
it
is
possible
of
satisfaction
to
the
values
of
the
domain
than
the other.
Different
semantics
[9]
are
available
fordefinitions
fuzzy
boolean
s awant
yases
in to
which the washing
machine
terminates
a
to
choose
among
two
possible
2
3.
The
choice
and
so
on)
and
is
decomposed
into
a
set
of
operations
that
temporal
formula
or
athe
fuzzy
untimed
formula
(f
prop).
semantics
of
relational
operators
(,
≺,the
,
,
≈,var
6≈
crispgoals
formulae
are
LTL
expressions,
there
isvalue
no
need
me
In contrast,
the
adoption
offuzzy
LTL
to(treq)
formalize
goal
level
of theSince
different
onstrategies
Fuzzy
goals
allow
one
foresee
different
depending
on
satisfaction
level
of
different
goals
and
on(e.g.,
theone
to) choose
among
two
possible
2from
3. application
The choicewe are
Note
that
the
term
const
represents
a constant
and
�� units.
�� and
�)) of
and
the
connectives
this
athe satisfaction
nminates
, onthan
t1.4.1
later
expected
(@(wm.sens
=since
“green
, them.
between
them
dependdefinitions
on derived
the kind
of
guarantee
the achievement
of theconnectives
objective.
Note
that
the
term
const
represents
a
constant
value
and
var
to
further
discuss
Term
f
req
is
expressed
as
a
fuzzy
would
not
be
the
best
option
we
may
want
to
shown
in
2(a);
corresponding
crisp
operators
on theissatisfaction
levelFigure
theG1.3
different
goals
and on context.
the for
current
execution
context.
For example
if goal
is violated
between
oneorof�,depending
them
depend⇒).
theoperator
kind of∼application
basic
and implies
˜onFor
we adopt we are
current
execution
For
example
G1.3setdealing
is(e.g.,
violated
��
indicates
aof
variable.
Asthe
commonly
done
LTL,
weif goal
adopt
“green
Fuzzy
goals
allow
foresee
different
strategies
ese
− z =the
�)., cases
This corresponds
totemporal
considering
theseAs
with, since the former
definition
less
formula
(seecommonly
operators
G, done
F<t , Gfor
),one
a crisp
ais variable.
LTL,
adopt
•t , G
−x , Uwe
lerate
in are
which
the
washing
machine
terminates
a Relational
µ(∼
π)is
1 is−conservative
µ(∼conservative
π)
(1)
the
definition
shown
in equation
1. Fordefinition
operator
�
it =
isless
possible
current
execution
context.
For
example
ifsince
goal
G1.3
is violated
dealing
with,
since
the
former
since the
amount
of indicates
dirty
clothes
higher
than numbers
5, one
maythe
amount
of
dirty
clothes
is
higher
than
5,
one
may
presented
in
Figure
2(b).
operators
can
be
the
set
of
natural
as
temporal
domain.
Furthermore,
on
the
satisfaction
level
of
the
different
goals
and
on
the
ring
these
��
temporal
formula
(treq)
or atemporal
fuzzy untimed
formula
(f prop). to choose
ak” violations.
thanamong
the other
one. definitions 2 3. The choice
the
set
of
natural
numbers
as
domain.
Furthermore,
rogram
a
bit
later
than
expected
(@(wm.sens
=
“green
,
two
possible
since
the
amount
of
dirty
clothes
is
higher
than
5,
one
may
than
the
other
one.
apply
two
adaptation
strategies:
relax
the
conflicting
goal
G1.2
apply
two
adaptation
strategies:
relax
the
conflicting
goal
G1.2
since
we
suppose
that
crisp
and
fuzzy
untimed
formulae
are
µ(π
f
π
)
≡
min(µ(π
),
µ(π
))
(2)
2
1
2
current
execution
context.
For
if goal G1.3 is violated 1
described
assuppose
impulse
functions
one
or
more
step
that
the
term
const
represents
a constant
value
andfunctions.
var
ons
entation
G1.3
asNote
crisp
expressions
time z � :ofz � G1.2
− z =and
�). adaptation
This
corresponds
to considering
these
since
we
that
crisp
andor
fuzzy
untimed
formulae
areexample
between one of them depend on the kind of application we are
two
strategies:
relax
the
conflicting
goal
G1.2
(for smallapply
violations,
some
6
or
7
clothes),
or
allocate
a
free
(for
small
violations,
some
6
or
7
clothes),
or
allocate
a
free
defined
over
finite
domains,
the
universal
(∀)
and
existential
since
the
amount
of
dirty
clothes
is
higher
than
5,
one
may
indicates
a
variable.
As
commonly
done
for
LTL,
we
adopt
pressions
µ(π
fis=
π2less
≡conservative
µ(ππ)
(3)
For
example,
x
= 7domains,
0of is absolutely
true
in 0, thatdealing
is with, since the former definition
of be
1 ) ∗ µ(π2 )
ases
as ideal.
“weak”
not
In violations.
fact
weviolations,
aim
to track
the
level
µ(∼1 π)
1) −
µ(∼
(1)
defined
over
finite
universal
(∀)only
and existential
(for
small
some
orcan
orthe
free
(1)
washing
thatG1.2
can(∃)work
in parallel
withclothes),
the
current
the
set
of 6natural
numbers
asallocate
temporal
domain.
Furthermore,
applya augmenting
two
adaptation
strategies:
G1.2µ(∼ π) = 1 − µ(∼ π)
washing
machine
that
can work
inexpressive
parallelrelax
withthe
theconflicting
current
quantifiers
be
added
without
the
eeclevel
ofG1.2machine
than
the
other
one. goal
representation
of (∃)
and
G1.3
asrespeccrisp
expressions
fThe
goals
and the
G1.3,
which
depends
quantifiers
can
be
added
without
augmenting
the
expressive
point
in
which
the
constraint
is
verified;
it
is
absolutely
µ(π
(2)
1 � π2 ) ≡ min(µ(π1 ), µ(π2 ))
washing
machine
that
can
work
in
parallel
with
the
current
since
we
suppose
that
crisp
and
fuzzy
untimed
formulae
are
(forimportant
small violations,
6 or
7 clothes),
or allocate
one (fornot
morebeimportant
that
is,tomore
thanthe8one
clothes
µ(π1 �aπfree
(2)
(forofmore
violations,some
that is,
more
than 8 clothes
power
of
the
language.
2 ) ≡ min(µ(π1 ), µ(π2 ))
s respecgain
would
ideal.
Inviolations,
wethe
aim
track
level
the
power
of
language.
total
unit ofone
energy
consumed
(energy)
and
the
µ(π1 � π2 ) ≡ µ(π1 ) ∗ µ(π2 )
(3)
infact
all
the
other
points.
Similarly
x(∀)<isand0inspired
is can
absolutely
defined
over
finite
domains,
the
universal
existential
(forfalse
more
important
violations,
that
is,
more
thanwashing
8language
clothesmachine
that
work
in parallel with the µ(π
current
left).
The
semantics
of
the
fuzzy
by the
left).
�π)π=
) ∗ µ(π
(3) f is chosen,
µ(∼
−µ(π
µ(∼1for
π)
(1)∼ and
1semantics
2 )1≡
2)
)tyand
the
atisfaction
of
goals
G1.2
and
G1.3,
which
depends
respecOnce
a
operators
The
semantics
of
the
fuzzy
language
is
inspired
by
the
The
clothes leftleft).
to betrue
washed
(dirty
clothes).
Thebeisadded
quantifiers
can
without
the[0,
expressive
oneaugmenting
(for
more
important
violations,
that
is,maintain
more
8 clothes
intheory
](∃)−
∞,
0[ (energy)
and
absolutely
false
inimportant
∞[.
Fuzzy
Inthe
thistotal
context,
it of
istheory
also
important
to
establish
and
maintain
of
fuzzy
sets,
originally
proposed
by
Zadeh
[9].
It
µ(πthan
(2)
In
this
context,
it
is
also
to
establish
and
1 � π2 ) ≡ min(µ(π1 ), µ(π2 ))
hes).
The
vely
on
unit
energy
consumed
and
the
ofalso
fuzzy
sets,
originally
proposed
by Zadeh [9]. It
ingis that we areIn not
operator g is obtained by applying the classical De Morgan
power
of
the
language.
only
interested
inimportant
knowing
left).
this
context,
is
to
and
maintain
∗ µ(π2 )
(3) been chosen,
the relationships
among
thebeitelements
of(dirty
the goal
model
and
relational
use
aestablish
smooth
function
to
athe
a semantics
membership
function
(µ)
that
abydegree
mount
dirty clothes
left toadopts
washed
clothes).
The (µ)
1 � π2 ) ≡ µ(π
the
relationships
among
the assign
ofdegree
goal
model
andaµ(π
Once
semantics
for1 )operators
∼�and
has
knowing
The
the
fuzzy
language
is assigns
inspired
aoperators
membership
that
assigns
aelements
ofthe of
Once
a semantics
for operators
∼
has�been
chosen,
to of
goals
are satisfied,
butadopts
we would
also
like tooffunction
In this
context,
it degree
is also
important
to establish
and
maintain
law,
and
implication
(⇒)
˜ and
is computed
as
a residuum of a Tthe
relationships
among
the
elements
of
the
goal
model
and
roblem
hereof isthethat
we
are
not
only
interested
in
knowing
running
system.
This
allows
one
to
keep
the
truth
to
each
proposition.
Possible
values
are:
absolutely
true
those
of
the
running
system.
This
allows
one
to
keep
the
operators
�
is
obtained
by
applying
classical
De Morgan
othelikethose
to
theory
of
fuzzy
sets,
originally
proposed
by
Zadeh
[9].
It
of
satisfaction
between
0
and
1
to
those
propositions
that
truth
to
each
proposition.
Possible
values
are:
absolutely
true
operators
�
is
obtained
by
applying
classical
De
Morgan
rule, rule,
the
actual
deviations
and
be
ready
to
adjust
the
the
relationships
among
the
elements
of
the
goal
model
and
those
of
the
running
system.
This
allows
one
to
keep
the
norm.
An
intuitive
semantics
for
temporal
hether
the
goals
are
satisfied,
but
we
would
also
like
to
adopts
membership
(µ)
that
a of
degree
of
consistent
with
the acorresponding
requireadjustadapted
the systemdo
(1),
absolutely
false
(0),
or intermediate
an
intermediate
degree
of
truth
(a
Once
a requiresemantics
for
∼ andas�ahas
chosen,
and
implication
(⇒)
˜computed
is computed
asbeen
a residuum
of aoperators
T-norm. is given
adapted
system
consistent
with
the
(1),
absolutely
false
(0),
orfunction
an
degree
truth
(a This
and
implication
⇒)
˜ operators
is
residuum
of a T-norm.
not
fully
theadjust
condition,
but
arerunning
close
tocorresponding
it.
For
those
of assigns
the
system.
allows
one to (keep
the
ict,
heaware
system.
Since
G1.2
and G1.3
aretorespect
ineach
conflict,
adapted
system
consistent
with
the
requireof and
the
actual
deviations
and
be
ready
to corresponding
the
truth
proposition.
Possible
values are: absolutely true operators �
is intuitive
obtained
by
applying
classical
De
Morgan
rule,
in
Table
II,
where
crisp
and
fuzzy
temporal
are
ne conflict,
ments
viceversa.
An
semantics
for
temporal
operators
is
given
Tavalue
in
(0,
1)).
ments
and
viceversa.
An
intuitive semantics
value
in (0,
adapted
system
consistentclose
with the
corresponding
require- for temporal operators is given in Ta- inoperators
eep
ecessaryoftothe
relax
the
critical
one
and
example,
≈1)).
0 iskeep
absolutely
true
for
the
points
toimplication
ments
andless
viceversa.
ehavior
system.
Since
G1.2
and
G1.3
are
conflict,
(1),xabsolutely
false
or an
intermediate
degree
of
truth
(⇒)
˜ iscrisp
computed
a language
residuum
of (NL
aoperators
T-norm.
and keep
The
semantics
ofin(0),
fuzzy
relational
operators
(�,
≺,(a
�, and
�,
blewhere
II, where
and as
fuzzy
temporal
(respectively
described
in
natural
expr).
The
semantics
of
fuzzy
relational
operators
(�,
≺,
�,
�,
ments
and
viceversa.
ble
II,
crisp
and
fuzzy
temporal
operators
(respectively
for
scould
is another
example
that
motivates
thecritical
for
An intuitive semantics for temporal operators is given in Tabe necessary
relax
theF UZZY
less
one and of
keeptruth III.
value
in
(0,
III.
C RISP
AND
Gneed
OALS
0 to([−1,
1]),
has
a1)).
degree
between
0 and
1 Gin
the
CisRISP
AND
F UZZY
OALS
need for
≈,
)RISP
is
shown
in G
Figure
2(a)
compared
with
that
Crisp
opFuzzy
and Fuzzy
op)expressed
are expressed
in natural
language
(NL proposiIII.
Cis
AND
FinUZZY
OALS
≈,
�≈) �≈
shown
Figure
2(a)
and and
isoperators
compared
with
Crisp
op and
op)
are
in natural
language
(NL and
Besides
considering
the
fuzzy
connectives
The
semantics
of
fuzzy
relational
(�, C
≺,
�, that
�, Fble
beother. Thislevel
II, where
crisp
and fuzzy
temporal
operators
(respectively
satisfaction
of
requirements,
and
then
be
e
is
another
example
that
motivates
the
need
for
III.
RISP
AND
UZZY
GtoOALS
points
near
0
(e.g.,
[−4,
−1)
∪
(1,
4]),
and
is
absolutely
false
d then be
This section
presents
the
language
we
propose
to
specify
of
the
corresponding
crisp
operators,
reported
in
Figure
2(b).
This
section
presents
the
language
we
propose
specify
expr).
of
the
corresponding
crisp
operators,
reported
in
Figure
2(b).
expr).
≈,
�≈is) the
is shown
in we
Figure
is compared with that Crisp op and
Fuzzywe
op) are
are expressed
in natural language
(NL an intrinsic vagueness
This
section
language
propose
specify
tions,
also interested
in adding
nowing
satisfaction
level
of requirements,
then
be2(a) toand
GA
a goal
tothe
satisfy
another
one.presents
This
why
FUGAand
hy
FUGA
This
section
presents
the
language
we propose
goals.
Crisp
goals
areInstill
defined
inone.
LTL,
while
goals
In
contrast
to
the
crisp
case,
fuzzy
relational
operators
are fuzzy
elsewhere.
Note
that
these
definitions,
membership
goals.
Crisp
goals
are
stillcrisp
defined
in2(b).
LTL,
while
goals to specify
contrast
to
the
crisp
case,
fuzzy
relational
are
of
corresponding
crisp
operators,
reported
inoperators
Figure
expr).
ble
to
relax
arepresent
goal
to
satisfy
another
This
isgive
why
FUGA
goals.
Crisp
goals
arethe
still
defined
infuzzy
LTL,
while
fuzzy
goals
can
zzy
goals
to
those
requirements
that
can
to
temporal
operators.
Due
to
lack
of space, in this paper
s thatuse
cana fuzzy temporal
goals.
Crisp
goals
are
still
defined
LTL,
whilein fuzzy goals
language.
The
two
options
are
unified
inor
notIndescribed
as
an
impulse
or
a fuzzy
step
but
we
ainare
contrast
toan
the
crisp
fuzzy
relational
operators
are
use
fuzzy
temporal
language.
The
two
options
unified
not
as
impulse
step
function,
but
we
use
ause
functions
are
arequirements
special
case
ofaare
the
ones
and
can
only
fuzzy
goals
to ∈
represent
those
thatacase,
can
uselevel
a fuzzy
temporal
language.
The
two
options
unified
infunction,
Crisp
op
NL expr
Fuzzy
op expr
NL expr
Crisp
op
NL
expr
Fuzzy
op
NL
are
ptroduces
to a are
certain
(x
[0,described
1]).
These
goals
are
use
a
fuzzy
temporal
language.
The
two
options
are
unified
in
we
only
discuss
the
semantics
of
the
temporal operators
goals
not
described
as
an
impulse
or
a
step
function,
but
we
use
a
a singleupalanguage
whose
grammar
isfunction
presented
in
Figure
smooth
to
assign
ameans
degree
of
satisfaction
between
0 in Figure
aThis
single
language
whose
grammar
is presented
smooth
function
toThese
assign
a??,
degree
of satisfaction
between
0 be
eals,
satisfied
to
a assume
certain
level
(x
∈
[0,
goals
are
Crisp
op
NL??,
expr
Fuzzy op
NL expr
single
language
whose
grammar
is1.
presented
in
Figure
??,language
values
01]).and
that
fuzzy
goals
can
escribed
in Section
III.
Obviously
“crisp”
goals,
G in
Always
G Almost Almost
G
Always
G
always always
a single
whose
grammar
is presented
Figure
??,
sp”
goals,
smooth
function
to assign
aGdegree
of not
satisfaction
between
0
that
are
required
in
the
laundry
system
example4 . The
where
G•t
∈
{G
,
G
,
G
,
G
}.
and
1
to
those
propositions
that
do
respect
the
condition,
where
∈
{G
,
G
,
G
,
G
}.
and
1
to
those
propositions
that
do
not
respect
the
condition,
ndered
as described
in
Section
III.
Obviously
“crisp”
goals,
<t
≤t
>t
≥t
•t
<t ≤t >t ≥t
GG<t GAlways
Almost
always
where
G•t ∈ {G
, G≤t1abe
, Gto
, G≥t }.propositions
t instantsG
G<t
Lasts hopefully
instants
G<t
Lasts hopefully
<tLasts tLasts
>t
to
considered
generalization
ofthat
crisp
rough
LTL
expressions,
can<tand
still
adopted
to
where
Grespect
those
do notones.
condition,
•t ∈ {Gthe
<t , G
≤t , G>t , G≥t }. G<t
dopted
to
Lasts
t
instants
G
Lasts
hopefully
<t in an operational
ormalized through LTL but
expressions,
can
be adopted to
but
close
to it.
areare
close
to still
it.
from
t instants
from
now
from now
t instants
fromway
now
semantics
isnow
defined
through
function
or requirements
but
are satisfied
close to it.
req ::= treq
freq
now Always
t instants
from now
se
that
cantreq
bethat
simply
or
tisfied
req | ::=
| freq
G>t Gfrom
from exactly
always from
from exactlyG>t
G>tAlmost
Almost
always from
>tAlways
presentorthose requirements
can be simply satisfiedreqor ::= treq | freq
)#
)
!"# $%"
req ::= treq | freq
from req,
exactly
G>t evaluates
Almost always
from possible fuzzy formula
f Always
Eval(f
every
freq ::= Gfreq
| F<tGfreq
freq | |GF
freqfreq
| G−x
| freq freq
Gfreq
F<tGfreq
freq | |GF
| G−x freqG>t| freq
•t <t
•t freq
t instants
exactly
t instants
freq ::=
| Gfreq
freq ::=
| freq
t instantsi) that
•t freq | G−x
freq | ::=
| freq
<t freq | G•t freq | G−xt freq
instants
exactly t instants exactly t instants
ot.
U freq | treq
| fprop
U freq | treqU |freq
fprop| treq | fprop
- at- -instant
G−x
Always
except at
- i by adopting
G−x
Always
except at
U
freq
|
treq
|
fprop
other
auxiliary
functions.
G
Always
except
at
may
−x
said,
we
must
also
define
how
the
system
may
stem
mayfpropsaid,
As already
we must
also
define
how
the
system
may
most
some
cases x cases
::=fprop
fprop
�::=
fprop
|
∼fprop
|
expr
comp
expr
mostx some
::= fprop
� ::=
fpropfprop
| ∼fprop
| expr
comp |expr
most some x cases
fprop � fprop | ∼fprop | expr fprop
comp expr
fprop
�
fprop
|
∼fprop
expr
comp
expr
o ooo
ple
oo
o o For
me
during
requirements
elicitation.
According
to
the
traditional
semantics
of fuzzy temporal
o ooexample
o
example
o example
o
o
o
o
dapt
at runtime
during
requirements
elicitation.
For
o
o
o
F
Eventually
F
Eventually
F
Eventually
const
expr ::= expr
const ::=
| var const
| expr |opvarexpr
expr
op
expr
const
expr ::= const
| var
| exprconst
expr
exprop
opexpr
expr
| var
var
const
| expr
const
|op
expr
op
expr
expr
::= const
const
var
expr op expr
|| var
F F<t FWithin
t Within
F<t F<t
Within
around
t Within
t [10],
Within
around
taround
t evaluating
FF
t
1rns
is violated
hine
turns
goal
G1.4.1
is::=
violated
because
machine
<t Within
<t
x::=
0|�≺ ::=
::=�
|| �≈
compbecause
� | the
≺::=
|washing
��|| �|≈≺x||the
≈
�≈| � turns
x| �≈
0 turns
≺| 0≈|| �
| �≈
comp ::=
::=
��comp
| � �| �|x≺
�≈ operators
comp
| 0≈
�|washing
|≈
f
req
at
instant
i would be
≈machine
≺| �≈| � | ≈ F|<t
�≈
<t
from from from>t
F>t FEventually
-Eventually
-− ||| ∗∗−
>t Eventually
|op
suddenly
a| −
washing
turn the washing
op during
::= +op
∗+| must
/| cycle,
∗ | |/ ∗
::=| we
− turn
| ∗ we
|the
/must
ingwashing
eff
op ::= + | |−
−−| ::=
|−∗ +| / | −
during
a washing
cycle,
washing
exactly
t
instants
exactlyexactly
t instants
equivalent
to
finding
the
most
satisfactory
truth
value of
t
instants
(a)
(a) (a)
U U
UntilUntil
U
achine
onmust
again.also
Werestore
must also
restore in
thea system
in
a state
ate
gain.
We
the system
state in a state
UAlmostUUntil
Almost Almost
Until Until
U
Until
(a)
f
req
in
the
interval
[i,
i
+
t).
This
interpretation
is not
here
the
drum
is already
filled,
the
must
togrammar
be The
added
The non-terminal
req isofthetheaxiom
of the grammarTable II
be isadded
The
non-terminal
symbol
req
the
axiom
of
the grammar
ded
The
non-terminal
req
ispowder
thetoaxiom
ofis the
um
already
filled,
thesymbol
powder
must
be
added
non-terminal
symbol reqsymbol
is the axiom
grammar
Table
IITable
II also want to take into account
T EMPORAL
OPERATORS
.
satisfactory
for
us
since
we
nd
the
program
must
be
set
again.
This
is
a
goal
that
states
and
we
use
it
to
decide
wether
the
goal
is
specified
through
a
hat
states
and
we
use
it
to
decide
wether
the
goal
is
specified
through
a
tes must
and webeuse
to decideThis
wether
goalthat
is specified
a use it to decide
ram
setit again.
is athegoal
states through
and
we
wether the
goal is specified through a
T EMPORAL
OPERATORS .
o
T EMPORAL
.
othus we call it adaptive
o
o
ow
the system
should
adaptoritself,
and formula
crisp (treq)
or a fuzzy
formula (freq). the situations in
which OPERATORS
f req has
a high value of truth for
adaptive
crisp
a we
fuzzy
(freq).
ive
crisp adapt
(treq)
or(treq)
a fuzzy
formula
o (freq).
o crisp (treq) oro a fuzzy
m
should
itself,
and thus
call
it adaptive
formula o(freq).
o
o
o
o
o=
>o
<o
|o
Besides considering
the fuzzyxconnectives
and
propositions,
a
time
instant
slightly
greater
than
i + t. For example,
= x == 0
|x !=|0 (b) x>> 0>
Besides
considering
fuzzy
connectives
and propositions,
x< < 0<
we are
also
interested
in the
adding
anfuzzy
intrinsic
vagueness
to propositions,
Besides
considering
the
connectives
and
for goal G1.4.1, where we want to tolerate the fact that
temporal
Due to lack
space, inanthis
paper wevagueness
only
we are
also
interested
in ofadding
intrinsic
to
weoperators.
arewashing
also
interested
in adding
an
vagueness
2a intrinsic
machine
takes
bitare
more
time toto complete
discuss
theasemantics
ofDue
some
temporal
operators
that
re- we only
temporal
operators.
to
lack
of
space,
in
this
paper
temporal
operators.
Due toThe
lacksemantics
of space,
in 2this paper we only
Figure 2. (a) Fuzzy membership functions for relational operators and (b) quired in
system
example.
is defined
a laundry
washing
program.
This
corresponds
Figure 2. (a) Fuzzy membership functions for relational operators and (b)
discussthe
the
semantics
of
some temporal
operators
that are
re- evaluating the
2 to
Crisp membership functions for relational operators.
discuss
the semantics
of some temporal
operators
that
are reFigure
2.
Fuzzy
functions
for
relational
operators
(b)
Crisp(a)
membership
functions for
relational
operators.
This
also membership
uncerlines
that
crisp membership
functions
are and quired
2 The complete
insatisfaction
thesemantics
laundryof system
example.
The
semantics
is
defined
of
goal
G1.4.1
by
taking
into
account
also some
the
language
is
available
at
http://home.dei.
quired
in
the
laundry
system
example.
The
semantics
is
defined
Crisp membership
functions
for
relational
operators.
a special case of fuzzy memebrship functions and, for this polimi.it/pasquale/publications/FuzzyLanguage.pdf
(b)
(b) for relational operators and (b)
Figure 2. (a) Fuzzy membership functions
(b)
Crisp membership functions for relational
operators.
time instants
than
(i + wm.program.duration)
for
This also uncerlines that crisp membership functions are
2
semantics ofgreater
the language
is available
at http://home.dei.
This also uncerlines that crisp membership functions are The complete
2 The complete
semantics of the language is available
at http://home.dei.
0
0
a special case of fuzzy memebrship functions and, for this polimi.it/pasquale/publications/FuzzyLanguage.pdf
which
proposition
(wm.sens
=
green
)
is
true.
special caseallows
of fuzzy
functions
and, for
this polimi.it/pasquale/publications/FuzzyLanguage.pdf
Thisa language
us memebrship
to modify the
definition
of goal
G1.3 and consider the amount of dirty clothes explicitly
as severity of the violation. Needless to say, the highest
4 The complete semantics of the language is available at http://home.dei.
polimi.it/pasquale/publications/FuzzyLanguage.pdf
Crisp op
1
G
G<t
0
Figure 3.
t
time
Membership function µF<t .
To this aim, we need to fuzzify the temporal interval
[i, i + t) by introducing a membership function µF<t that is
evaluated on the offset between the current instant (x) and
i. In particular, µF<t (x) is equal to 1 when x ∈ [0, t) and
decreases to zero when x ≥ t, as shown in Figure 3.
If the membership function µF<t is positive in the interval
[i, w), the operational semantics for F<t (f req) at instant i
is given by evaluating f req for each instant x (x ∈ [i, w))
and by weighting it with respect to the value returned by
the membership function µF<t at instant x. F<t becomes
the maximum among these evaluations. The semantics of
operator F<t is also expressed by the following recursive
function:
f Eval(F<t (f req), i) = val1(f req, t, i, 0)
f loat val1(f req, t, i, timer){
if (µF<t (timer) > 0)
return max(µF<t (timer) ∗ f Eval(f req, i),
val1(f req, t, i + 1, timer + 1))
else return 0; }
According to this semantics, goal G1.4.1 is redefined as
follows:
@(wm.state = ready) ⇒
Ft<p.duration (wm.sens = “green” ∧
@(wm.state = washCompleted))
Informally, it states that if the washing machine becomes
ready, the washing program must complete (wm.sens =
0
green0 ) within some z time instant, from that moment (z =
wm.program.duration).
According to the literature [10] the fuzzy temporal operator G is evaluated in t as follows:
eval(Gf req, i) = eval(f req, i) f eval(Gf req, i + 1)
where function eval(f req, t) assigns a truth value to f req
in i. In this definition, G is computed by aggregating, through
operator f, the truth values of f req for each instant i. This
implies that if the truth value of f req becomes completely
false (equals 0) for a certain time instant, due to a transient
violation, G becomes 0 consequently, exactly like in the crisp
case. Hence this interpretation for operator G does not allow
us to tolerate transient violations. For example when the
number of dirty clothes for certain time instants exceeds
five, goal G1.3 would be violated.
G>t
F
F<t
F>t
U
NL expr
Fuzzy op
Always
Lasts t instants
from now
Always from exactly
t instants
Eventually
Within t
Eventually from
exactly t instants
Until
G
G<t
G>t
G−x
F<t
U
NL expr
Almost always
Lasts hopefully
t instants from now
Almost always from
exactly t instants
Always except at
most some x cases
Within around t
Almost Until
Table II
T EMPORAL OPERATORS .
For this reason, we adopt a different semantics: when the
truth value of f req is under a certain threshold (thmin ), it
is not taken into account in the evaluation of G. Instead,
it is substituted by a satisfaction value, computed by a
membership function (µG ), that depends on the number of
past violations (i.e., the truth value of f req is less than
thmin ). The membership function µG returns a truth value
that is inversely proportional to the number of violations
already occurred (# errors), as shown in Figure 4.
The semantics of operator Gf req is described by the
following function:
f Eval(Gf req, i) = val2(f req, i, 0)
f loat val2(f req, i, error){
if (f Eval(f req, i) < thmin ){
error + +;
if (µG (error) == 0) return 0;
µ (error)
else return µG G(error−1) ∗ val2(f req, i + 1, error); }
else return f Eval(f req, i) ∗ val2(f req, i + 1, error)}
1
0
Figure 4.
#errors
Membership function µG .
Function f Eval, which is used to describe the semantics
of Gf req, adopts an auxiliary function val2 that takes the
sub-formula (f req) on which G is applied, the instant i
at which the formula is computed, and a violation counter
(error) initialized to 0. Every time a violation occurs, error
is incremented. If the updated value of error makes µG
return a value equal to zero, it means that Gf req has a truth
value equal to 0 (return 0). Otherwise the current truth
G (error)
value of Gf req is multiplied by factor µGµ(error−1)
. Note
that if no violation occurred, the truth value of f req (given
by f Eval(f req, i)) directly affects the final evaluation of
Gf req.
This way, we can redefine goal G1.3 as follows
Tolerance level
low
medium
high
G dirty clothes 5
to say that the number of dirty clothes must almost always
be less than or equal to five.
Operator G−x f req requires that f req has a satisfactory
truth value with the exception of “at most some” x cases.
This is useful when we want to admit a certain number of
violations. For example, goal G1.2, due to peaks in energy
consumption, could accept up to a maximum of some ten
violations. This way, goal G1.2 can be redefined as follows:
m
d
M
D
(a)
[d, D']
[d', D]
D'=d'
G−10 energy ≤ EM AX
to mean that the amount of consumed energy must always
be less than or equal to EM AX , but we accept up to ten
exceptions.
Operator G−x is semantically similar to G, with the only
difference that G−x adopts a slightly modified membership
function (µG−x ). This function returns 1, when it is evaluated
for a number of violations in the interval [0, x], and returns
a value between 0 and 1 if the number of violations (k) is
greater than x.
Operator G>t has a semantics similar to that of G, since
evaluating G>t in i is equivalent to evaluating G in i + t:
f Eval(G>t f req, i) = f Eval(Gf req, i + t)
Note that f Eval(f prop, i) evaluates a fuzzy proposition
(f prop) by adopting the membership functions of the relational operators shown in Figure 2(a), while f Eval(treq, i)
checks expression treq according to the usual LTL semantics.
A. Tuning the membership functions
Every time the formalization of a goal introduces a
new membership function, we must define its shape by
considering the preferences of the different stakeholders.
Our approach considers that membership functions be
limited and continuous, and in most of the cases they have
a trapezoidal shape (but can also degenerate into triangles).
For each of these trapezoidal functions, we must define the
domain ([d, D]) over which it can assume values between 0
and 1. We must also specify two key points in the domain:
the minimum (m) and maximum (M ) values for which the
corresponding crisp formula would be true (i.e., the upper
parallel side of the trapezoid). These points obey to the
following inequality: d ≤ m ≤ M ≤ D, with the general
case when d < m ≤ M < D. The user can tune the
severity of these membership functions by expressing the
gradient of the segments that go from point (x, 0), with
x ∈ [d, m), to point (m, 1), and from point (M, 1) to (y, 0),
m
d
M
M+(m'-M)*(M-m)
(M-m)+(M'-m')
m'
M'
D
(b)
Figure 5. (a) Customization of a trapezoidal membership function and (b)
Splitting of the membership function into smaller trapezoidal functions.
with y ∈ (M, D]5 . This is equivalent to choosing a value for
x and y. Non expert users can just specify a severity level
among {low, medium, high} when they specify goals. This
2
corresponds to fixing x = m−d
3 +d and y = (D−M )∗ 3 +M
m−d
D−M
for low, x = 2 + d and y = 2 + M for medium, and
x = (m − d) ∗ 23 + d and y = D−M
+ M for high. These
3
possibilities are shown in Figure 5(a).
The membership function that does not present a trapezoidal shape corresponds to a formula for which the crisp
version is true in more than one interval of the domain.
However these cases can be reduced to the trapezoidal case
by decomposing the problem into smaller trapezoidal problems obtained by segmenting the domain in subsets, each
containing exactly one interval in which the membership
function is one. This case is shown in Figure 5(b).
IV. A DAPTIVE G OALS
FLAGS proposes adaptive goals as means to conveniently
describe adaptation countermeasures in a parametric way,
that is with respect to the satisfaction level of the other
goals or the environmental conditions. Each countermeasure
comes with a set of constraints (trigger and conditions) that
identify the execution points where it must be performed, an
objective to be achieved, and a sequence of actions applied
on the goal model to fulfill the aforementioned objective.
A condition specifies properties of the system (e.g., satisfaction levels of both conventional and adaptive goals,
goals’ priorities, countermeasures already performed) or of
5 The user can express the gradient of only one of these segments when
d = m or M = D.
the environment (e.g. domain assumptions) that must be
true to allow a specific countermeasure to be activated. A
trigger expresses a constraint on the satisfaction of a leaf
goal and activates the execution of a countermeasure if the
corresponding conditions are satisfied too. As for objective,
we can:
6
• Enforce the satisfaction of a leaf goal without modifying its definition, and its membership functions;
• Enforce a weaker version of a goal by relaxing its membership function or changing its definition completely;
• Prevent situations in which the satisfaction level of
goals would be too low.
Note that a countermeasure that enforces the original goal
gives more guarantees than a countermeasure that enforces
a weaker version of the goal, which gives more guarantees
than a countermeasure that just prevents a goal from being
violated. The objective of a countermeasure allows us to
assess the success of an adaptation at runtime and evaluate
whether other countermeasures must be performed. Actions
can change the goal model by:
• Adding/Removing goals;
• Modifying the definition of a leaf goal (i.e., changing
the membership function adopted for its evaluation);
• Adding/Removing operations;
• Modifying the pre- and postconditions of operations;
• Adding/Removing entities, events, or agents.
These actions can be tuned according to the satisfaction
level of goals or the execution context, by applying more or
less severe adaptations accordingly. If we deal with critical
goals, or if a goal largely deviates from the desired objective,
a countermeasure that enforces a goal satisfaction without
modifying its membership function can be performed. While
for those situations in which a goal cannot be completely
satisfied (i.e., its satisfaction is always under a certain
threshold), we must substitute the existing goal with a new
one or relax its membership function.
Countermeasures may conflict the same ways as conventional goals do. We can have possible conflicts:
• Among countermeasures that can be applied on the
same goal at the same time due to overlapping conditions;
• Among countermeasures associated with conflicting
goals (the conflict is made explicit in the goal model).
For the first type of conflicts, our policy is to trigger
the stronger countermeasure, while the others can only be
performed if the previous one fails. If there is more than
one equivalent countermeasure, all of them can be triggered
at the same time in case they do not produce an incoherent
goal model. As explained in Section II, conflicting goals
in general are associated with different priorities (the most
6 This assumption does not reduce the expressive power of our approach
since adaptations applied on higher level goals can always be reduced to
violations of leaf ones [5].
critical ones have the highest priorities). This allows us to
solve the second type of conflicts since the countermeasures
of the adaptive goals with higher priorities are triggered.
Despite these potentials, the mechanism adopted to handle
conflicts is still too simplistic in certain situations. For
example a vicious cycle may exist when a countermeasure
A has a negative side effect on another goal, and that goal’s
countermeasure B has a negative side effect on the first goal
as well. These cases can be handled by tuning the conditions of the countermeasures involved, which would become
pretty complex. For example, to solve the aforementioned
situation, we should state that countermeasure A cannot be
executed if it has been already performed in the past, and B
was performed as an effect of A.
The laundry system uses the adaptive goals shown in
Figure 6. Adaptive goal AG1.2 is associated with goal G1.2,
since it is triggered when the total amount of consumed
energy is too high. AG1.2 is decomposed into a single countermeasure (C1). C1 is activated if the violation level of goal
G1.2 is lower than 0.8 as stated in its associated condition
(Sat(G1.2) < 0.8). Obviously when the satisfaction level is
higher than 0.8, no countermeasures are taken. This countermeasure can enforce the satisfaction of the original goal
by substituting operation Select P rogram with operation
Select Ecoprogram, which would choose cheap washing
programs. These programs must have a duration inversely
proportional to the actual amount of consumed energy, that
is, 2 − ∼ (Sat(G1.2)) hours. This example highlights how
adaptation can be tuned depending on the satisfaction level
of stated requirements. In our case, the duration of a selected
washing program will be inversely proportional to the satisfaction level of goal G1.2: the more energy is consumed,
the shorter the selected washing program is. If a suitable
eco-program does not exist, a washing cycle cannot be performed. Countermeasure C1 applies the following actions on
the goal model: removeOperation(Select P rogram), and
addOperation(Select Ecoprogram). This last operation is
equal to operation Select P rogram but the required postcondition becomes:
ReqPostG1.1.3 : wm.program.name = p.namef
wm.program.duration = p.durationf
wm.program.duration ≤ 2 − ∼ Sat(G1.2)
We associate adaptive goal AG1.3 with goal G1.3. AG1.3
is operationalized through 2 countermeasures (C2 and C3).
C2 is activated when the satisfaction of goal G1.3 is lower
than 0.8 (its condition is Sat(G1.3) < 0.8). It relaxes the
membership function of goal G1.2, making it less strict, as
defined in Figure 7. This way, we reduce the number of times
countermeasure C1 is triggered, avoiding to be blocked
waiting for a suitable washing program to be selected again.
Countermeasure C3 is activated when the satisfaction
level of goal G1.3 is lower than 0.6, and if C2 was already
G1.2
Maintain
[Low Energy
Consumption]
G1.3
G1.4.1
Maintain
[No dirty clothes]
Achieve
[Perform washing]
AG1.2
AG1.3
AG 1.4
C2
C3
Relax memb fun
(G1.2)
Add goal
(G1.5)
C1
Remove operation
Add operation
(Select Program) (Select Ecoprogram)
Figure 6.
5
Figure 7.
Add goal
(G1.6)
Add operation
(Turn On WM)
Adaptive goals for the laundry system
original
1
C4
relaxed
Energy units
A relaxed version of the membership function of goal G1.2.
triggered without achieving its objective, as stated in its
condition (Sat(G1.3) < 0.6f ∼ C2). This countermeasure
adds a new goal G1.5 to use another washing machine if
there are other clothes to wash. Goal G1.5 is defined as
follows:
G((d.amount > 0f ∼ (wm.state = f ree)f
∃wm0 ∼ (wm.id = wm0 .id) f wm0 .state = f ree) ⇒
F(wm0 .state = selected))
Since goals G1.2 and G1.3 are in conflict, adaptive goals
AG1.2 and AG1.3 may have conflicts of type 2. In this case,
only the countermeasures associated with the most critical
goal are triggered (i.e., C2 and C3). Furthermore C2 and C3
can also be in conflict, but countermeasure C2 is triggered
first since it is explicitly specified in the condition of C3.
Adaptive goal AG1.4.1 is associated with goal G1.4.1
and is operationalized through countermeasure C4. C4 is
activated when the washing machine turns off suddenly
during a washing cycle. This is defined in AC5’s condition:
(wm.state = off ). The objective of this countermeasure is
to restore the satisfaction of goal G1.4.1 by turning on the
washing machine and restoring it in a state in which the
drum is filled, but the powder must be added newly and the
program must be selected. To this aim this countermeasure
adds goal G1.6, which is defined as follows:
F(wm.state = selectedf ∼ (wm.powder)f
∼ (wm.drumEmpty) f wm.program = “”)
This goal can be operationalized through operation Turn
On WM:
Operation:
Input:
Output:
DomPre:
DomPost:
TrigPre:
ReqPre:
ReqPost:
Turn On WM
wm : W ashingM achine
wm : W ashingM achine
wm.state = of f
wm.state = selected
turn on
@(wm.state = of f )
turn on ∧ ¬(wm.powder)∧
¬(wm.drumEmpty) ∧ (wm.program = “”)
The application of a countermeasure may also modify
existing adaptive goals by eliminating some countermeasures
that are no longer useful. In general, if a countermeasure removes a goal, an operation, or an object (agent/entity/event), all the countermeasures that modify these
elements are invalidated. For example, if countermeasure
C1 is applied, all countermeasures that modify or remove
operation SelectP rogram are invalidated. Furthermore, if
a countermeasure modifies/relaxes a goal’s definition, some
countermeasures are triggered less frequently, since the
possibility of a goal to be satisfied under a certain threshold
is reduced. For example, since countermeasure C2 relaxes
the membership function of goal G1.2, countermeasure
C1 will be triggered less frequently. Note that adding or
removing countermeasures also requires that the conflicts
among existing countermeasures be updated.
V. G OALS AT RUNTIME
Besides being used to “generate” the actual application,
the goal model is also used to oversee its runtime adaptation.
A live goal model allows us to efficiently handle changes
due to new requirements or modifications to the context.
It also allows us to reason on countermeasures and understand whether and how they are feasible on the different
application instances. Devised countermeasures behave differently in the different situations, and thus they may not
achieve expected results. Similarly, designed membership
functions may not correspond to the actual needs of the
stakeholders. For example, countermeasure C3, which tries
to use a free washing machine, may become useless if
all washing machines are always busy, or conversely, the
membership function to represent the constraint of goal G1.2
does not trigger an adaptation when needed, e.g., because its
membership function is too optimistic. All these situations
must be properly supervised at runtime. We foresee that each
instance of the application is associated with a live goal
model that receives field data and decides how to change
the application, if needed. Field data are used to access the
satisfaction of conventional goals, evaluate the triggers and
conditions associated with adaptive goals, and select the
actual countermeasures that must be executed to keep the
application on track. Adaptation actions are properly translated into statements at application level, whose execution
is triggered by the goal model. Changes can either refer to
the single instance, and thus they only affect the particular
instance and its goal model, or to the entire application, that
is, they modify the definition of the goal model permanently,
and future instances will start from the new version.
VI. R ELATED W ORK
The concept of fuzzy requirements [11] is not new. Fuzziness is mainly adopted to express uncertain requirements [4],
[12] and to perform trade-off analysis among conflicting
functional requirements [13]. Liu et al. [12] introduce a
methodology to elicit non-functional requirements through
fuzzy membership functions that allows one to represent
the uncertainty of human perception. Instead, Whittle et
al. [4] propose RELAX, a notation to express uncertain
requirements, whose assessment is affected by the imprecision of measurement, and integrate it with a goal modeling
methodology [14]. The adoption of fuzziness for tradeoff analysis [13] aims to identify aggregation functions
to combine correlated requirements into higher-level ones.
Fuzziness can also guide the selection of COTS components during requirements elicitation. For example, Alves et
al. [15] use the degree of satisfaction of one or more goals
to select components and analyze possible mismatches.
In this paper, we exploit fuzziness to express and assess
the satisfaction degree of requirements with the idea of
preventing some violations and tolerating small/transient
deviations. We think that reasoning with satisfaction levels
allows us to effectively select and tune adaptation. Letier et
al. [16] have also investigated partial satisfaction of goals.
They annotate goal refinement models with some objective
functions, that are measured and evaluated with respect to a
target value. The satisfaction degree of a goal is expressed
in a probabilistic way based on the frequency with which its
objective function is satisfied. Conversely, in our work we
measure the satisfaction level in terms of the proximity of a
goal to being completely satisfied, and not in terms of the
probability it is satisfied.
Our approach also proposes the definition of adaptation
capabilities while eliciting requirements, as it has been
proposed in other works [17], [18]. Lapouchnian et al. [17]
exploit alternative paths in the goal model to derive a set of
possible system’s behaviors. This way, when a requirement
is violated, these alternatives are ready to be selected to
perform adaptation. Goldsby et al. [18] use goal models to
represent the non-adaptive behavior of the system (business
logic), the adaptation strategies (to handle environmental
changes) and the mechanisms needed by the underlying
infrastructure to perform adaptation. These proposals only
handle adaptation by enumerating all alternative paths at design time. In contrast, we support the continuous evolution of
the goal model by tracing adaptive goals onto the underlying
implementation.
Adapting the specification of the system-to-be according
to changes in the context was originally proposed by Salifu
et al. [19]. It was also extensively exploited in different
works [20], [21] that handled context variability through
the explicit modeling of alternatives. Penserini et al. [20]
model the availability of execution plans to achieve a goal
(called ability), and the set of pre-conditions and contextconditions that can trigger those plans (called opportunity).
Ali et al. [21] detect the parameters that come from the
environment (context) and associate them with specific variation points in the goal model. This way different execution
plans are selected at runtime based on the actual context.
Conversely, in our approach adaptation does not only refer
to variation points but it allows us to apply modifications
in the goal model. Furthermore the factors that can trigger
such modifications depend on: (1) the context, (2) the actual
satisfaction level of goals, and (3) the countermeasures
already performed on the goal model.
All these works address adaptation at requirements level,
but they mainly target context-aware applications and
context-based adaptation. They do not consider adaptations
required by the inability to satisfy some goals. A different approach is instead adopted by Wang et al. [3] who
provide reconciliation mechanisms when requirements are
violated. They generate system reconfigurations, guided by
OR-refinements of goals, after the violation of a goal is diagnosed. They choose the configuration that contributes most
positively to the non-functional requirements of the system
and also has the lowest impact on its current configuration.
Again, our work is different since it foresees a wider set of
adaptations that can change the goal model in different ways
and these changes can be traced onto the underlying system.
Furthermore we allow one to tune adaptation by considering
the satisfaction level of fuzzy goals.
VII. C ONCLUSIONS
The paper presents FLAGS, an innovative goal model,
based on KAOS, for specifying the requirements and adaptation capabilities of self-adaptive systems. Its key innovations
are the transformation of goals into live entities, the distinction between crisp and fuzzy goals, with which one can
associate different satisfaction levels, and the definition of
adaptation strategies as if they were goals. All these elements
help embed self-adaptability in software systems from the
very beginning (requirements elicitation), and reason on
possible consequences.
This is the first complete formalization of the goal model,
and our future work will concentrate on further shaping
and refining it. We will better investigate the conflict resolution mechanism among countermeasures and the training
of membership functions through significant examples. In
parallel, we will also investigate simpler notations to provide
practitioners with a sound and usable modeling means.
Finally, we plan to adopt our goal model to specify some
real(istic) self-adaptive systems to gain more experience,
identify further requirements for it, and empirically assess
its usefulness.
VIII. ACKNOWLEDGEMENTS
The authors wish to thank John Mylopoulos for his fruitful
comments and the anonymous reviewers for the suggestions
that helped us improve the paper.
R EFERENCES
[10] K. Lamine and F. Kabanza, “Using Fuzzy Temporal Logic
for Monitoring Behaviour-based Mobile Robots,” in Proc. of
IASTED Int. Conf. on Robotics and Applications, 2000, pp.
116–121.
[11] X. F. Liu, “Fuzzy Requirements,” IEEE Potentials, pp. 24–26,
1998.
[12] X. F. Liu, M. Azmoodeh, and N. Georgalas, “Specification
of Non-functional Requirements for Contract Specification in
the NGOSS Framework for Quality Management and Product
Evaluation,” in Proc. of the 5th Int. Workshop on Software
Quality, 2007, pp. 36–41.
[13] X. Liu and J. Yen, “An Analytic Framework for Specifying
and Analyzing Imprecise Requirements,” in Proc. of the 18th
Int. Conf. on Software Engineering, 1996, pp. 60–69.
[14] B. H. C. Cheng, P. Sawyer, N. Bencomo, and J. Whittle,
“A Goal-Based Modeling Approach to Develop Requirements
of an Adaptive System with Environmental Uncertainty,” in
Proc. of the 12th Int. Conf. on Model Driven Engineering
Languages and Systems, 2009, pp. 468–483.
[15] C. Alves, X. Franch, J. P. Carvallo, and A. Finkelstein, “Using
Goals and Quality Models to Support the Matching Analysis
During COTS Selection,” in Proc. of the 4th Int. Conf. on
COTS-Based Software Systems, 2005, pp. 146–156.
[1] P. Oreizy, N. Medvidovic, and R. N. Taylor, “Architecturebased Runtime Software Evolution,” in Proc. of the 20th Int.
Conf. on Software Engineering, 1998, pp. 177–186.
[16] E. Letier and A. van Lamsweerde, “Reasoning About Partial
Goal Satisfaction for Requirements and Design Engineering,”
Software Engineering Notes, vol. 29, no. 6, pp. 53–62, 2004.
[2] S.-W. Cheng, A.-C. Huang, D. Garlan, B. R. Schmerl, and
P. Steenkiste, “Rainbow: Architecture-Based Self-Adaptation
with Reusable Infrastructure,” in Proc. of the 1st Int. Conf.
on Autonomic Computing, 2004, pp. 276–277.
[17] A. Lapouchnian, Y. Yu, S. Liaskos, and J. Mylopoulos, “Requirements-driven Design of Autonomic Application
Software,” in Proc. of the Conf. of the Centre for Advanced
Studies on Collaborative Research, 2006, pp. 80–94.
[3] Y. Wang, S. A. Mcilraith, Y. Yu, and J. Mylopoulos, “Monitoring and Diagnosing Software Requirements,” Automated
Software Engineering, vol. 16, no. 1, pp. 3–35, 2009.
[18] H. J. Goldsby, P. Sawyer, N. Bencomo, B. H. C. Cheng, and
D. Hughes, “Goal-Based Modeling of Dynamically Adaptive
System Requirements,” in Proc. of the 15th Int. Workshop on
Engineering of Computer-Based Systems, 2008, pp. 36–45.
[4] J. Whittle, P. Sawyer, N. Bencomo, and B. H. C. Cheng,
“RELAX: Incorporating Uncertainty into the Specification of
Self-Adaptive Systems,” in Proc. of the 17th Int. Requirements Engineering Conf., 2009, pp. 79–88.
[5] A. van Lamsweerde, Requirements Engineering: From System
Goals to UML Models to Software Specifications.
John
Wiley, 2009.
[6] J. Kramer and J. Magee, “Self-Managed Systems: an Architectural Challenge,” in Proc. of Future of Software Engineering, 2007, pp. 259–268.
[7] L. Baresi, S. Guinea, and L. Pasquale, “Integrated and Composable Supervision of BPEL Processes,” in Proc. of the 6th
Int. Conf. of Service Oriented Computing, 2008, pp. 614–619.
[8] A. Pnueli, “The Temporal Logic of Programs,” in Proc. of the
18th Annual Symposium on Foundations of Computer Science,
1977, pp. 46–57.
[9] L. A. Zadeh, “Fuzzy sets,” Information and Control, vol. 8,
no. 3, pp. 338–353, 1965.
[19] M. Salifu, Y. Yu, and B. Nuseibeh, “Specifying Monitoring
and Switching Problems in Context,” in Proc. of the 15th International Requirements Engineering Conf., 2007, pp. 211–
220.
[20] L. Penserini, A. Perini, A. Susi, and J. Mylopoulos, “High
Variability Design for Software Agents: Extending Tropos,”
ACM Transactions on Autonomous Adaptive Systems, vol. 2,
no. 4, pp. 75–102, 2007.
[21] R. Ali, F. Dalpiaz, and P. Giorgini, “A Goal Modeling
Framework for Self-Contextualizable Software,” in Proc. of
the 14th Int. Conf. on Exploring Modeling Methods in Systems
Analysis and Design, vol. 29, 2009, pp. 326–338.