A lightweight approach to technical risk estimation via probabilistic impact analysis

ABSTRACT

An evolutionary development approach is increasingly commonplace in industry but presents increased difficulties in risk management, for both technical and organizational reasons. In this context, technical risk is the product of the probability of a technical event and the cost of that event. This paper presents a technique for more objectively assessing and communicating technical risk in an evolutionary development setting that (1) operates atop weakly-estimated knowledge of the changes to be made, (2) analyzes the past change history and current structure of a system to estimate the probability of change propagation, and (3) can be discussed vertically within an organization both with development staff and high-level management. A tool realizing this technique has been developed for the Eclipse IDE.

REFERENCES

• 1: L. A. Belady and M. M. Lehman. A model of large program development. IBM Systems J., 15(3):225--252, 1976.
• 2: Bruce I. Blum, Three paradigms for developing information systems, Proceedings of the 7th international conference on Software engineering, p.534-543, March 26-29, 1984, Orlando, Florida, United States
• 3: C. Chittister and Y. Y. Haimes. Assessment and management of software technical risk. IEEE Trans. Systems, Man and Cybernetics, 24(2):187--202, 1994.
• 4: E. W. Dijkstra. A note on two problems in connection with graphs. Numerische Mathematik, 1:169--271, 1959.
• 5: Herman Fischer, Computer system simulation of an on-line interactive command and control system, Proceedings of the 5th conference on Winter simulation, p.333-340, December 08-10, 1971, New York, NY [doi>10.1145/800294.811456]
• 6: Michael Fischer , Martin Pinzger , Harald Gall, Populating a Release History Database from Version Control and Bug Tracking Systems, Proceedings of the International Conference on Software Maintenance, p.23, September 22-26, 2003
• 7: Michael W. Godfrey , Lijie Zou, Using Origin Analysis to Detect Merging and Splitting of Source Code Entities, IEEE Transactions on Software Engineering, v.31 n.2, p.166-181, February 2005 [doi>10.1109/TSE.2005.28]
• 8: Susan Horwitz , Thomas Reps , David Binkley, Interprocedural slicing using dependence graphs, ACM Transactions on Programming Languages and Systems (TOPLAS), v.12 n.1, p.26-60, Jan. 1990 [doi>10.1145/77606.77608]
• 9: Jyrki Kontio , Gerhard Getto , Dieter Landes, Experiences in improving risk management processes using the concepts of the Riskit method, Proceedings of the 6th ACM SIGSOFT international symposium on Foundations of software engineering, p.163-174, November 01-05, 1998, Lake Buena Vista, Florida, United States
• 10: Joseph P. Loyall , Susan A. Mathisen, Using Dependence Analysis to Support the Software Maintenance Process, Proceedings of the Conference on Software Maintenance, p.282-291, September 01, 1993
• 11: Two case studies of open source software development: Apache and Mozilla, ACM Transactions on Software Engineering and Methodology (TOSEM), v.11 n.3, p.309-346, July 2002 [doi>10.1145/567793.567795]
• 12: A. Mockus and D. M. Weiss. Predicting risk of software changes. Bell Labs Technical J., 5(2):169--180, 2000.
• 13: Leon Moonen, Lightweight Impact Analysis using Island Grammars, Proceedings of the 10th International Workshop on Program Comprehension, p.219, June 27-29, 2002
• 14: M. Moriconi , T. C. Winkler, Approximate Reasoning About the Semantic Effects of Program Changes, IEEE Transactions on Software Engineering, v.16 n.9, p.980-992, September 1990 [doi>10.1109/32.58785 ]
• 15: Gail C. Murphy , David Notkin, Lightweight lexical source model extraction, ACM Transactions on Software Engineering and Methodology (TOSEM), v.5 n.3, p.262-292, July 1996 [doi>10.1145/234426.234441]
• 16: Gail C. Murphy , David Notkin , Kevin Sullivan, Software reflexion models: bridging the gap between source and high-level models, Proceedings of the 3rd ACM SIGSOFT symposium on Foundations of software engineering, p.18-28, October 12-15, 1995, Washington, D.C., United States
• 17: Nachiappan Nagappan , Thomas Ball , Andreas Zeller, Mining metrics to predict component failures, Proceeding of the 28th international conference on Software engineering, May 20-28, 2006, Shanghai, China [doi>10.1145/1134285.1134349]
• 18: Donald E. Neumann, An Enhanced Neural Network Technique for Software Risk Analysis, IEEE Transactions on Software Engineering, v.28 n.9, p.904-912, September 2002 [doi>10.1109/TSE.2002.1033229 ]
• 19: K. S. Rajeswari , R. N. Anantharaman, Development of an instrument to measure stress among software professionals: factor analytic study, Proceedings of the 2003 SIGMIS conference on Computer personnel research: Freedom in Philadelphia--leveraging differences and diversity in the IT workforce, April 10-12, 2003, Philadelphia, Pennsylvania [doi>10.1145/761849.761855]
• 20: Janne Ropponen , Kalle Lyytinen, Components of Software Development Risk: How to Address Them? A Project Manager Survey, IEEE Transactions on Software Engineering, v.26 n.2, p.98-112, February 2000 [doi>10.1109/32.841112 ]
• 21: O. Saliu and G. Ruhe. Software release planning for evolving systems. Innovations in Systems and Softw. Eng., 1(2), 2005. To appear.
• 22: Jacek Śliwerski , Thomas Zimmermann , Andreas Zeller, When do changes induce fixes?, Proceedings of the 2005 international workshop on Mining software repositories, p.1-5, May 17-17, 2005, St. Louis, Missouri
• 23: Amrit Tiwana , Mark Keil, The one-minute risk assessment tool, Communications of the ACM, v.47 n.11, p.73-77, November 2004 [doi>10.1145/1029496.1029497]
• 24: Nikolaos Tsantalis , Alexander Chatzigeorgiou , George Stephanides, Predicting the Probability of Change in Object-Oriented Systems, IEEE Transactions on Software Engineering, v.31 n.7, p.601-614, July 2005 [doi>10.1109/TSE.2005.83]
• 25: R. J. Turver and M. Munro. An early impact analysis technique for software maintenance. J. Softw. Maintenance: Res. and Pract., 6:35--52, 1994.
• 26: R. J. Walker, R. Holmes, I. Hedgeland, P. Kapur, and A. Smith. A lightweight approach to technical risk estimation via probabilistic impact analysis. Tech. rep. 2006-817-10, Computer Science, Univ. of Calgary, 2006.
• 27: Annie T. T. Ying , Gail C. Murphy , Raymond Ng , Mark C. Chu-Carroll, Predicting Source Code Changes by Mining Change History, IEEE Transactions on Software Engineering, v.30 n.9, p.574-586, September 2004 [doi>10.1109/TSE.2004.52]
• 28: L. A. Zadeh. Fuzzy sets. Information and Control, 8(3):338--353, 1965.
• 29: Thomas Zimmermann , Peter Weissgerber , Stephan Diehl , Andreas Zeller, Mining Version Histories to Guide Software Changes, IEEE Transactions on Software Engineering, v.31 n.6, p.429-445, June 2005 [doi>10.1109/TSE.2005.72]

INDEX TERMS

Primary Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING
      D.2.7 Distribution, Maintenance, and Enhancement

Additional Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING
      D.2.9 Management

General Terms:
Design, Management, Measurement

Keywords:
decision support, probabilistic impact analysis, revision history, technical risk estimation