Abstract-We present a method for the synthesis of software system designs that satisfy strict quality requirements, are Paretooptimal with respect to a set of quality optimisation criteria, and are robust to variations in the system parameters. To this end, we model the design space of the system under development as a parametric continuous-time Markov chain (pCTMC) with discrete and continuous parameters that correspond to alternative system architectures and to the ranges of possible values for configuration parameters, respectively. Given this pCTMC and required tolerance levels for the configuration parameters, our method produces a sensitivity-aware Pareto-optimal set of designs, which allows the modeller to inspect the ranges of quality attributes induced by these tolerances, thus enabling the effective selection of robust designs. Through application to two systems from different domains, we demonstrate the ability of our method to synthesise robust designs with a wide spectrum of useful tradeoffs between quality attributes and sensitivity.Keywords-software performance and reliability engineering; probabilistic model synthesis; multi-objective optimisation I. INTRODUCTION Evaluating the performance, reliability and other quality attributes of alternative designs is essential for the cost-effective engineering of software [1], [2]. Delaying this evaluation until integration or system testing can greatly increase engineering costs, as defects identified late in the development lifecycle require much more effort to fix [3]. A common method to avoid this delay uses model-based simulation [4] or formal verification [5] to predict the quality attributes of alternative designs. Models that meet the quality requirements of the system under development are then used as a basis for its implementation. Models based on queueing networks [6], probabilistic models [2], [5] and timed automata [7] have been used for this purpose, together with tools for their simulation (e.g. Palladio [8]) and verification (e.g. PRISM [9]). Furthermore, recently proposed approaches automate the search for suitable designs. Probabilistic model repair [10], [11] automatically modifies the transition probabilities of Markov models that violate a quality requirement, generating new models that meet the requirement. Precise parameter synthesis [12] identifies transition rates that enable continuous Markov models to satisfy a quality requirement or to optimise a quality attribute of the modelled system. Finally, probabilistic model synthesis [13] starts from a design template that captures alternative system designs, and uses multiobjective optimisation to generate the Pareto-optimal set of Markov models associated with the quality requirements of the system.