Walid AbdelMoez, Katerina Goseva-Popstojanova, Hany Ammar

1. Maintainability Based Risk Assessment in Adaptive Maintenance Context Walid AbdelMoez, Katerina Goseva-Popstojanova, Hany Ammar LANE Department of Computer Science and Electrical EngineeringWest Virginia University This work is funded in part by grants from the NSF ITR Program and from the NASA Office of Safety and Mission Assurance (OSMA) SARP program managed through the NASA IV&V Facility, Fairmont, West Virginia.

2. Outline • Introduction • Maintainability-Based Risk • Maintainability-Based Risk Assessment in Adaptive Maintenance Context • Case Study • Related Work • Conclusion and Future Work

3. Introduction • A successful maintenance project necessitates a well-planned maintenance effort to manage the maintenance process and to alleviate the risks associated with performing necessary maintenance tasks. • Software maintainers usually are not engaged in the initial software development cycle. Before maintainers can modify a program, they must understand how it operates. They often deal with complicated and hard to comprehend systems.

4. Introduction • According to [Pigoski 1996], 60%-80% of the system budget is spent on maintenance. • Enhancements (perfective/ adaptive maintenance) account for 78%-83% of the maintainer effort.

5. Introduction • Many types of risk are associated with the maintenance of software systems. These types of risk: • Project risk concern is that the maintenance project cannot be completed within the budget or timeframe. • Usability risk focus is that the maintenance conducted on the system will trigger problems and failures. • Maintainability risk addresses the question how complex it will be to maintain the system in the future because of the way we handled this maintenance task.

6. Outline • Introduction • Maintainability-Based risk • Maintainability-Based Risk Assessment in Adaptive Maintenance Context • Case Study • Related Work • Conclusion and Future Work

7. Maintainability-based Risk • Maintainability-based Risk is defined as: Probability of performing maintenance task * Cost of performing this task • Risk caused by low system maintainability can be assessed by the following: • Software components require frequent maintenance tasks • High cost of maintenance effort - the required maintenance is growing out of control (changes propagate to many components). • Loss of the system by aging - the system becomes out-dated and it is not worthy to maintain

8. Goals and Objectives • Improve the maintainability of the system architecture. • Identify the risky components of the system in terms of maintainability . • Use maintainability risk to manage system maintenance process.

9. Outline • Introduction • Maintainability-Based Risk • Maintainability-Based Risk Assessment in Adaptive Maintenance Context • Case Study • Related Work • Conclusion and Future Work

10. Maintainability-based Risk Estimation Methodology for Adaptive Maintenance

11. Estimating Initial Change Probabilities • We make use of adaptive maintenance reports of changes to estimate the initial change probabilities ICP=[icpi]. • First, we evaluate the rate of occurrence of changes in each component Ci of the system. • Then, we estimate the initial probability of change for each component by normalizing the rate of occurrence for each component by the total number of change reports.

12. . . V13 Required Services cpij = Estimating Change Propagation V1 C2 C1 = 1 V11 V12 V13 Change in Provided Service Change = 0 • Change Propagation Probabilities matrix CP=[cpij] • cpijis the probability that a change inCidue to corrective/ perfective maintenance requires a change inCjwhile maintaining the overall function of a system S • cpij = P([Cj]  [Cj'] | [Ci]  [Ci'] ^ [S] = [S'] ) • cpijis estimated by

13. V1 C2 C1 V11 V12 M1 M2 M3 … M7 V13 Receiving Component methods Change in Provided Service Change scij = Estimating Size of Change • Size of changeSC=[scij ] scijis definedas the ratio between the number of affected methods of the receiving component caused by the changes in the interface elements of the providing components and the total number of methods in the receiving component • scijis estimated by

14. Outline • Introduction • Maintainability-Based Risk • Maintainability-Based Risk Assessment in Adaptive Maintenance Context • Case Study • Related Work • Conclusion and Future Work

15. UML Model of CM1Use Case Diagram

16. UML Model of CM1Structure Diagram

17. UML Model of CM1Sequence Diagram

18. Initial Change Probabilities for CM1

19. Change Propagation Probabilities for CM1

20. Size of Change for CM1

21. Maintainability-based Risk of CM1

22. Outline • Introduction • Maintainability-Based Risk • Maintainability-Based Risk Assessment in Adaptive Maintenance Context • Case Study • Related Work • Conclusion and Future Work

23. Background • Our proposed maintainability-based risk assessment methodology relates to probabilistic risk assessment (PRA). • PRA is an exercise for evaluating the probability of failure or success of a mission. • Generally, decisions concerning choice of upgrades, scheduling of maintenance, etc are based on the outcome of the probabilistic risk assessment exercise. • In [Bin+ 2003], Bin et al. presented a framework for systematic integration of the software contribution to the risk in system failure analysis.

24. Background • One of the famous studies [P.Oman 1994] introduced the Maintainability Index (MI) measure • Polynomial of widely used code level metrics such as Halstead measures and McCabe’s cyclomatic complexity • A similar study [Muthanna 2000] used design level metrics to statistically estimate the maintainability of software systems • Linear model based on a minimal set of design level software metrics to predict Software Maintainability Index

25. Outline • Introduction • Maintainability-Based Risk • Maintainability-Based Risk Assessment in Adaptive Maintenance Context • Case Study • Related Work • Conclusion and Future Work

26. Conclusion • We introduce and discuss the concept of architectural level maintainability-based risk assessment in the context of adaptive maintenance. • We present an estimation procedure based on change propagation probabilities using architectural information of the system and change reports of the system components. • We also discuss a case study to illustrate our risk assessment methodology. • This research work is a part of a wider effort that considers other architectural level risks such as reliability-based risk and performance-based risk

27. Future Work • We are considering to explore more case studies to test the maintainability-based risk of the components taking into consideration different types of maintenance. • We also plan to automate the computation of the maintainability-based risk by expanding the Software Architectures Change Propagation Tool (SACPT) and to augment it in our Architectural-level Risk Assessment Tool.