Assessing COTS integration risk using cost estimation inputs

ABSTRACT

Most risk analysis tools and techniques require the user to enter a good deal of information before they can provide useful diagnoses. In this paper, we describe an approach to enable the user to obtain a COTS glue code integration risk analysis with no inputs other than the set of glue code cost drivers the user submits to get a glue code integration effort estimate with the COnstructive COTS integration cost estimation (COCOTS) tool. The risk assessment approach is built on a knowledge base with 24 risk identification rules and a 3-level risk probability weighting scheme obtained from an expert Delphi analysis. Each risk rule is defined as one critical combination of two COCOTS cost drivers that may cause certain undesired outcome if they are both rated at their worst case ratings. The 3-level nonlinear risk weighting scheme represents the relative probability of risk occurring with respect to the individual cost driver ratings from the input. Further, to determine the relative risk impact, we use the productivity range of each cost driver in the risky combination to reflect the cost consequence of risk occurring. We also develop a prototype called COCOTS Risk Analyzer to automate our risk assessment method. The evaluation of our approach shows that it has done an effective job of estimating the relative risk levels of both small USC e-services and large industry COTS-based applications.

REFERENCES

• 1: Barry W. Boehm , Clark , Horowitz , Brown , Reifer , Chulani , Ray Madachy , Bert Steece, Software Cost Estimation with Cocomo II with Cdrom, Prentice Hall PTR, Upper Saddle River, NJ, 2000
• 2: C. Abts, "Extending the COCOMO II Software Cost Model to Estimate Effort and Schedule for Software Systems Using Commercial-Off-The-Shelf (COTS) Software Components: the COCOTS Model," Ph.D. Dissertation, Oct. 2001.
• 3: Raymond J. Madachy, Heuristic Risk Assessment Using Cost Factors, IEEE Software, v.14 n.3, p.51-59, May 1997 [doi>10.1109/52.589234]
• 4: Kari Känsälä, Integrating Risk Assessment with Cost Estimation, IEEE Software, v.14 n.3, p.61-67, May 1997 [doi>10.1109/52.589236]
• 5: A. Rashid, and G. Kotonya (2001) Risk Management in Component-Based Development: A Separation of Concerns Perspective. ECOOP Workshop on Advanced Separation of Concerns (ECOOP Workshop Reader). Springer-Verlag Lecture Notes in Computer Science.
• 6: D. Carney, E. Morris, and P. Place,: Identifying Commercial Off-the-Shelf (COTS) Product Risks: The COTS Usage Risk Evaluation. September 2003. TECHNICAL REPORT. CMU/SEI-2003-TR-023.
• 7: A. Minkiewicz, The Real Costs of Developing COTS Software. http://www.pricesystems.com/downloads/pdf/COTSwhitepaper3-31-04.pdf.
• 8: D. Port, and Z.H. Chen,: "Assessing COTS Assessment: How Much Is Enough?", Proceedings, ICCBSS 2004, Feb. 2004, pp. 183-198.
• 9: Barry W. Boehm , Daniel Port , Ye Yang , Jesal Bhuta, Not All CBS Are Created Equally: COTS-Intensive Project Types, Proceedings of the Second International Conference on COTS-Based Software Systems, p.36-50, February 10-13, 2003
• 10: D. Port, and Y. Yang, "Empirical Analysis of COTS Activity Effort Sequences," Proceedings, ICCBSS'04, Los Angeles, California, USA, Feb. 20

INDEX TERMS

Primary Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING
      D.2.9 Management
          Subjects: Cost estimation

Additional Classification:
  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.3 Software Management
          Subjects: Software development; Software process

General Terms:
Management, Measurement

Keywords:
COCOTS, cost driver, risk assessment