The complexity and heterogeneity of COTS-based software products are increasing rapidly. In contrast to in-house software, COTS components and systems are close entities and, as such, hide many parts of their implementation. Even if this is safe with regard to the principles of encapsulation, high-cohesion and low-coupling, one expects to determine how these external entities may behave in user’s deployment environments which are often different from vendor’s development environments. “Assessment and prediction of behaviors and QoS attributes of COTS software components and systems” means here that if COTS components and systems are not built/prepared for the assessment and the prediction of their properties, they may not be qualified as high-confidence software entities. The proposed workshop mainly stresses the design of COTS software, in other words how to create trustworthy software in order to better instrument, support and organize a COTS software market.

COTS can significantly complicate the independent verification and validation (IV&V) process. The necessarily pessimistic culture of IV&V has a perspective on COTS that greatly differs from a developer’s generally optimistic, success-oriented perspective. For example, there is no basis for assuming that the COTS assessments made by developers will ultimately be consistent or even compatible with those made by an IV&V group. This frequently results in higher project risk and uncertainty. This workshop seeks to illuminate these and other COTS and IV&V related challenges

The workshops topics are:

Embedded systems cover a range of computer systems from ultra small computer-based devices to large, possibly distributed, systems monitoring and controlling complex processes. COTS-based development in embedded systems, with electronic and mechanical components has a long tradition. However component-based development (CBD) with software components, in particular COTS components, is utilized to a lesser degree. A major reason is the inability of component technologies to cope with specific requirements of embedded systems. In general, component-based technologies do not address timing issues, QoS, dependability, resource constraints, and other extra-functional properties of crucial importance for embedded systems. This raises the question whether Component-based and COTS-based approach is beneficial for development of embedded systems, and which are the specifics to be addressed to make such an approach feasible.

The aim of this panel is to discuss the needs and problems with respect to a component based approach in the context of embedded systems and come to some conclusion about the feasibility of COTS and CBD approaches for embedded systems. The following questions will be in the focus of the discussion:

As governments and enterprises adopt COTS-based information systems, COTS components must be selected that satisfy the security requirements of applied systems. However, the selection of security components is a trade-off between the confidence level in the components and the cost of replacing components. The higher confidence required of the security components leads to a higher cost in the selection process. Particularly, as governments take into account the confidence-level of COTS-based information systems, they must replace security functional components by their own developing components in high security environment. A decision method is needed to solve the trade-off between security and costs. This paper focuses on decision making to solve the problem of replacing the security functional components in COTS-based systems. This paper suggests an appropriate adaptation level and a cost-effective priority to replace security functional components in security environment. To make a cost effective decision on adapting security functional components, we develop a hierarchical model of information security technologies. Based on this, we determine the priority among security functional components using AHP (Analytic Hierarchy Process).

Acknowledgements: This work was sponsored in part by the Korean Ministry of Information and Communication in the context of University IT Research Center Project.

The objective of this tutorial is to provide prospective and existing managers, architects, and developers of CBA’s with a “composable” collection of spiral-based processes and techniques found to be useful for successfully developing a wide range of CBA’s and acquire some experience in using them in within a participatory exercise. The elements of the tutorial will be:

Motivation. Why traditional waterfall, V-Model, or risk-insensitive development do not work for CBA development. The tutorial will begin with examining how these models fail to or only partially address the critical issues within CBA development by discussing problems within several representative projects, and then introduce briefly how spiral-based development anticipates and avoids potential problems.

Approach. The tutorial will summarize the key aspects of the recursive, re-entrant Spiral-based Framework of primary activities and decisions within CBA development to guide the CBA developers through each development Spiral cycle. The composable process elements for this framework will be elaborated including COTS assessment and system definition, COTS tailoring, glue code development, custom code development and integration. It will show how these are dynamically composed within a Spiral development cycle according risk and context sensitive patterns in response to rapidly changing project circumstances.

Techniques. Four categories of techniques will be addressed. First, the role of risk management in CBA development will be summarized and illustrated, including the use of risk analysis to determine how much is enough of activities such as COTS evaluation [Port]. Second, guidelines for executing the process elements, such as the COTS Assessment Background (CAB), COTS Assessment Plan (CAP), and COTS Assessment Report (CAR) for performing COTS assessment, are defined in a minimum-essential, tailoring-up fashion rather than in an exhaustive, tailoring-down fashion [Yang]. Third, cost and schedule estimation models, such as the COCOMO II and COCOTS, are used to scope projects and perform tradeoff analyses [Yang]. Fourth, examples of techniques for effective COTS tailoring, applications scoping and architecting, and glue code development and integration.

Examples. Two non-trivial, real-project representative case studies will be included to illustrate the application of above techniques. One is from the multimedia archive domain, and the other is from the e-commerce domain.

Participatory Exercise. The tutorial will also provide a project case study with points at which attendees will apply the techniques such as prioritizing objectives, filtering COTS candidates, identifying risk-driven assessment priorities, performing cost tradeoff analyses. Attendees will also gain experience determining and discussing strategies for smoothly navigating through the process framework, and early identification and avoidance of unnecessary go-backs which typically causes unnecessary rework, waste of resources, and schedule delays.