System and method to determine defect risks in software solutions

• US 8,495,583 B2
• Filed: 09/11/2009
• Issued: 07/23/2013
• Est. Priority Date: 09/11/2009
• Status: Expired due to Fees

• Current Assignee: HCL Technologies Limited
• Original Assignee: International Business Machines Corporation
• Inventors: Bassin, Kathryn A., Hess, Howard M., Huang, Sheng, Kagan, Steven, Li, Shao C., Li, Zhong J., Liu, He H., Skrabanek, Susan E., Tan, Hua F., Zhu, Jun
• Primary Examiner(s): Tsai, Henry W. H.
• Assistant Examiner(s): BARTELS, CHRISTOPHER A.
• Application Number:
  US12/558,147
• Publication Number:
  US 20110067005A1
• Time in Patent Office: 1,411 Days
• Field of Search: None
• US Class Current: 717/127
• CPC Class Codes: G06F 11/008 Reliability or availability analysis
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 8/10 Requirements analysis; Specification techniques
• CPC Class Codes: G06Q 10/0635 Risk analysis of enterprise or organisation activities

Abstract

A method is implemented in a computer infrastructure having computer executable code tangibly embodied on a computer readable storage medium having programming instructions. The programming instructions are operable to receive one or more risk factors, receive one or more contexts, identify one or more context relationships and associate the one or more contexts with the one or more risk factors. Additionally, the programming instructions are operable to map the one or more risk factors for an associated context to a software defect related risk consequence to determine a risk model and execute a risk-based testing based on the risk model to determine a defect related risk evaluation for a software development project.

Claims

1. A method implemented in a computer infrastructure having computer executable code tangibly embodied on a computer readable storage medium having programming instructions operable to:

receive one or more risk factors;

receive one or more contexts and identify one or more context relationships;

associate the one or more contexts with the one or more risk factors;

map the one or more risk factors for an associated context to a software defect related risk consequence to determine a risk model, wherein the mapping is implemented using a processor of the computer infrastructure and comprises;

determining a relative weight for relevant risk factors;

determining a weighted sum of the relevant risk factors of a context for failure damage risk factors;

determining a weighted sum of the relevant risk factors of the context for failure possibility risk factors; and

calculating a product of the weighted sum of the relevant risk factors for failure damage risk factors and the weighted sum of the relevant risk factors for failure possibility risk factors to determine an overall risk for the context; and

execute a risk-based testing based on the risk model to determine a defect related risk evaluation for a software development project.

2. The method of claim 1, wherein the one or more risk factors is an orthogonal list of risk factors.

3. The method of claim 1, wherein the one or more risk factors comprise at least one of technical risk factors, business risk factors and project management risk factors.

4. The method of claim 1, wherein the one or more risk factors comprises user-added risk factors.

5. The method of claim 1, wherein the one or more risk factors are defined with one or more of a risk factor name, a risk factor category, a requirement type, a description, one or more scale definitions and a risk factor value.

6. The method of claim 5, further comprising determining the risk factor value by at least one of measuring directly, calculating from risk sub factor values and using a questionnaire.

7. The method of claim 1, further comprising refactoring the one or more risk factors to achieve an orthogonal list of risk factors by at least one of merging risk factors, deleting a risk factor, splitting risk factors and adding the risk factor.

8. The method of claim 1, wherein the identifying the one or more contexts comprise at least one of a top-down approach and a bottom-up approach.

9. The method of claim 1, wherein the identifying the one or more context relationships comprises identifying one or more aggregate context relationships and one or more implementation context relationships.

10. The method of claim 1, wherein the associating the one or more contexts with the one or more risk factors comprises, for each of the one or more risk factors identifying contexts from the one or more contexts for which the one or more risk factors are applicable.

11. The method of claim 1, wherein the mapping further comprises determining a dimension where the one or more risk factors generates a risk impact.

12. The method of claim 11, wherein the dimension comprises at least one of:

a failure possibility dimension, which indicates a likelihood that a defect will occur within a specific context; and

a failure damage dimension, which indicates a consequence of an occurrence of the defect in production.

13. The method of claim 1, wherein the mapping further comprises receiving mapping rules as if-then rules.

14. The method of claim 1, wherein the executing the risk-based testing is performed for each stage in a software development lifecycle.

15. The method of claim 1, wherein the executing the risk-based testing comprises:

breaking down software into risk evaluation units;

evaluating and annotating a software solution with selected risk factors for the risk evaluation units;

performing the risk-based testing on the software from one or more dimensions,

collecting test results and a test process from the risk-based testing; and

updating the defect related risk evaluation.

16. The method of claim 15, further comprising updating the risk model including at least one of altering a relative weight of a risk factor, adding a new risk factor, adding or removing a context and altering one or more mapping definitions.

17. The method of claim 1, wherein a service provider at least one of creates, maintains, deploys and supports the computer infrastructure.

18. The method of claim 1, wherein the programming instructions are provided by a service provider on a subscription, advertising, and/or fee basis.

19. A system implemented in hardware, comprising:

a risk factor receiving (RFR) tool operable to receive one or more risk factors;

a context receiving (CR) tool operable to receive;

one or more contexts;

one or more context relationships; and

associations of the one or more contexts with the one or more risk factors;

a mapping tool operable to map the one or more risk factors for an associated context to a software defect related risk consequence to determine a risk model, wherein the mapping comprises;

determining a relative weight for relevant risk factors;

determining a weighted sum of the relevant risk factors of a context for failure damage risk factors;

determining a weighted sum of the relevant risk factors of the context for failure possibility risk factors; and

calculating a product of the weighted sum of the relevant risk factors for failure damage risk factors and the weighted sum of the relevant risk factors for failure possibility risk factors to determine an overall risk for the context;

a software break-down (SB) tool operable to break-down software into risk evaluation units;

a risk annotation tool operable to evaluate and annotate a software solution with selected risk factors for the risk evaluation units; and

a risk-based testing tool operable to execute a risk-based testing on the software based on the risk model to determine a defect related risk evaluation for a software development project and collect test results and a test process from the risk-based testing.

20. The system of claim 19, further comprising at least one of:

a risk evaluation update (REU) tool operable to update the defect related risk evaluation; and

a risk model update (RMU) tool operable to update the risk model by at least one of altering a relative weight of a risk factor, adding a new risk factor, adding or removing a context and altering one or more mapping definitions.

21. The system of claim 19, wherein the one or more risk factors:

comprise an orthogonal list of risk factors, including at least one of technical risk factors, business risk factors, project management risk factors and user-added risk factors; and

are defined with one or more of a risk factor name, a risk factor category, a requirement type, a description, one or more scale definitions and a risk factor value.

22. The system of claim 19, wherein the mapping further comprises determining a dimension where the one or more risk factors generates a risk impact, wherein the dimension comprises at least one of:

a failure possibility dimension, which indicates a likelihood that a defect will occur within a specific context; and

a failure damage dimension, which indicates a consequence of an occurrence of the defect in production.

23. A computer program product comprising a computer usable storage device having readable program code embodied in the storage device, the computer program product includes at least one component operable to:

receive one or more risk factors, wherein the one or more risk factors;

comprise an orthogonal list of risk factors, including at least one of technical risk factors, business risk factors, project management risk factors and user-added risk factors; and

are defined with one or more of a risk factor name, a risk factor category, a requirement type, a description, one or more scale definitions and a risk factor value;

receive one or more contexts and identify one or more context relationships;

associate the one or more contexts with the one or more risk factors;

map the one or more risk factors for an associated context to a software defect related risk consequence to determine a risk model, wherein the mapping comprises;

determining a relative weight for relevant risk factors;

determining a weighted sum of the relevant risk factors of a context for failure damage risk factors;

determining a weighted sum of the relevant risk factors of the context for failure possibility risk factors; and

calculating a product of the weighted sum of the relevant risk factors for failure damage risk factors and the weighted sum of the relevant risk factors for failure possibility risk factors to determine an overall risk for the context; and

execute a risk-based testing based on the risk model to determine a defect related risk evaluation for a software development project.

24. A computer system for classifying automated code inspection services defect output for defect analysis, the system comprising:

a CPU, a computer readable memory and a computer readable storage media;

first program instructions to receive one or more risk factors;

second program instructions to receive one or more contexts and identify one or more context relationships;

third program instructions to associate the one or more contexts with the one or more risk factors;

fourth program instructions to map the one or more risk factors for an associated context to a software defect related risk consequence to determine a risk model, wherein the mapping comprises;

determining a dimension where the one or more risk factors generates a risk impact, wherein the dimension comprises at least one of;

a failure possibility dimension, which indicates a likelihood that a defect will occur within a specific context; and

a failure damage dimension, which indicates a consequence of an occurrence of the defect in production; and

determining a relative weight for relevant risk factors;

determining a weighted sum of the relevant risk factors of a context for failure damage risk factors;

determining a weighted sum of the relevant risk factors of the context for failure possibility risk factors; and

calculating a product of the weighted sum of the relevant risk factors for failure damage risk factors and the weighted sum of the relevant risk factors for failure possibility risk factors to determine an overall risk for the context; and

fifth program instructions to execute a risk-based testing based on the risk model to determine a defect related risk evaluation for a software development project,

wherein the first, second, third, fourth and fifth program instructions are stored on the computer readable storage media for execution by the CPU via the computer readable memory.