Our goal in this paper is to introduce and motivate a methodology, called Tropos, for building agent oriented software systems. Tropos is based on two key ideas. First, the notion of agent and all related mentalistic notions (for instance goals and plans) are used in all phases of software development, from early analysis down to the actual implementation. Second, Tropos covers also the very early phases of requirements analysis, thus allowing for a deeper understanding of the environment where the software must operate, and of the kind of interactions that should occur between software and human agents. The methodology is illustrated with the help of a case study. The Tropos language for conceptual modeling is formalized in a metamodel described with a set of UML class diagrams.

Security issues for software systems ultimately concern relationships among social actors-stakeholders, system users, potential attackers- and the software acting on their behalf. This paper proposes a methodological framework for dealing with security and privacy requirements based on i*, an agent-oriented requirements modeling language. The framework supports a set of analysis techniques. In particular, attacker analysis helps identify potential system abusers and their malicious intents. Dependency vulnerability analysis helps detect vulnerabilities in terms of organizational relationships among stakeholders. Countermeasure analysis supports the dynamic decisionmaking process of defensive system players in addressing vulnerabilities and threats. Finally, access control analysis bridges the gap between security requirement models and security implementation models. The framework is illustrated with an example involving security and privacy concerns in the design of agentbased health information systems. In addition, we discuss model evaluation techniques, including qualitative goal model analysis and property verification techniques based on model checking. 1.

www.utdallas.edu/~chung/, www.inf.puc-rio.br/~julio Abstract. Essentially a software system’s utility is determined by both its functionality and its non-functional characteristics, such as usability, flexibility, performance, interoperability and security. Nonetheless, there has been a lop-sided emphasis in the functionality of the software, even though the functionality is not useful or usable without the necessary non-functional characteristics. In this chapter, we review the state of the art on the treatment of non-functional requirements (hereafter, NFRs), while providing some prospects for future directions.

Abstract. Goal models have been used in Computer Science in order to represent software requirements, business objectives and design qualities. In previous work we have presented a formal framework for reasoning with goal models, in a qualitative or quantitative way, and we have introduced an algorithm for forward propagating values through goal models. In this paper we focus on the qualitative framework and we propose a technique and an implemented tool for addressing two much more challenging problems: (1) find an initial assignment of labels to leaf goals which satisfies a desired final status of root goals by upward value propagation, while respecting some given constraints; and (2) find an minimum cost assignment of labels to leaf goals which satisfies root goals. The paper also presents preliminary experimental results on the performance of the tool using the goal graph generated by a case study involving the Public Transportation Service of Trentino (Italy). 1

Early requirements analysis is concerned with modeling and understanding the organizational context within which a software system will operate. Such organizational models can describe either the status quo or a desired new status. It is convenient to build such models by deploying organizational patterns which describe oftenused organizational structures. The paper proposes a catalogue of patterns which adopt concepts from organization theory and strategic alliances literature. The patterns are modeled using the i * framework which offers the notions of actor, goal and actor dependency and specified in Telos. Each proposed pattern is evaluated with respect to a set of quality attributes, such as predictability, adaptability and openness. We illustrate the use of our proposed patterns with a business-tobusiness example modeling alternative organizational settings. This research has been conducted within the context of a comprehensive software development methodology called Tropos. 1.

Exploring alternative options is at the heart of the requirements and design processes. Different alternatives contribute to different degrees of achievement of non-functional goals about system safety, security, performance, usability, and so forth. Such goals in general cannot be satisfied in an absolute, clear-cut sense. Various qualitative and quantitative frameworks have been proposed to support the assessment of alternatives for design decision making. In general they lead to limited conclusions due to the lack of accuracy and measurability of goal formulations and the lack of impact propagation rules along goal contribution links. The paper presents techniques for specifying partial degrees of goal satisfaction and for quantifying the impact of alternative system designs on the degree of goal satisfaction. The approach consists in enriching goal refinement models with a probabilistic layer for reasoning about partial satisfaction. Within such models, non-functional goals are specified in a precise, probabilistic way; their specification is interpreted in terms of application-specific measures; impact of alternative goal refinements is evaluated in terms of refinement equations over random variables involved in the system's functional goals. A systematic method is presented for guiding the elaboration of such models. The latter can then be used to assess the impact of alternative decisions on the degree of goal satisfaction or to derive quantitative, fine-grained requirements on the software to achieve the higher-level goals.

We introduce a variability-intensive approach to goal decomposition that is tailored to support requirements identification for highly customizable software. The approach is based on the semantic characterization of ORdecompositions of goals. We first show that each high-level goal can be associated with a set of concerns, in response to which, alternative refinements of the goal can be introduced. A text corpus relevant to the domain of discourse can be used to derive such variability concerns that are specific to the problem. In parallel, contextual facts that can vary while a goal is being fulfilled are modeled. Then, a highvariability goal model is constructed aiming at responding to the predefined variability concerns completely, while contextual factors are used to test whether it addresses all realistic background circumstances. We apply our approach in a study from the geriatric health care domain. 1.

Autonomic computing systems reduce software maintenance costs and management complexity by taking on the responsibility for their configuration, optimization, healing, and protection. These tasks are accomplished by switching at runtime to a different system behaviour – the one that is more efficient, more secure, more stable, etc. – while still fulfilling the main purpose of the system. Thus, identifying and analyzing alternative ways of how the main objectives of the system can be achieved and designing a system that supports all of these alternative behaviours is a promising way to develop autonomic systems. This paper proposes the use of requirements goal models as a foundation for such software development process and sketches a possible architecture for autonomic systems that can be built using the this approach.

Autonomic computing systems reduce software maintenance costs and management complexity by taking on the responsibility for their configuration, optimization, healing, and protection. These tasks are accomplished by switching at runtime to a different system behaviour – the one that is more efficient, more secure, more stable, etc. – while still fulfilling the main purpose of the system. Thus, identifying the objectives of the system, analyzing alternative ways of how these objectives can be met, and designing a system that supports all or some of these alternative behaviours is a promising way to develop autonomic systems. This paper proposes the use of requirements goal models as a foundation for such software development process and demonstrates this on an example. 1

Software systems of the future will have to perform well within ever-changing organizational environments. Unfortunately, existing software development methodologies (object-oriented, structured or otherwise) have traditionally been inspired by programming concepts, rather than organizational ones, leading to a semantic gap between system and its operational environment. To reduce this gap, we propose a software development methodology named Tropos which is founded on the i * organizational modeling framework. i * offers the notions of actor, goal and (actor) dependency. Tropos uses these concepts as a basis to model early and late requirements, architectural and detailed design for a software system. The paper outlines Tropos phases through an e-business example. The methodology complements well proposals for agent-oriented programming platforms. 1