A 2008 exploratory study by Khan, Greenwood, Garcia, and Rashid (CAiSE 2008, the International Conference on Advanced Information Systems Engineering) introduced a six-type taxonomy of dependencies from requirements to architectural elements and a small metric suite — Concentration, Dispersion, and Inclusion — to characterize how evolving requirements dependencies propagate change into a software architecture. Analyzing nine change scenarios over ten releases of the Health Watcher Web information system, it found that co-existing conditional+service and goal+infrastructure dependencies dominate architectural change impact. The study itself flagged its findings as unvalidated beyond one system and one architectural view. The open problem is to determine empirically whether the taxonomy, the dominance findings, and the metrics with their severity thresholds generalize to at least two systems from application domains other than that of Health Watcher — with systems of a different architectural style or larger industrial scale included as an optional extension only where such systems are available — and to architectural views other than the module view analyzed in the original study. No later work replicates or refutes the generalization question.

Background

Software requirements evolve continuously, and each change can force corresponding edits in the software architecture — the set of design decisions that decompose a system into components, modules, and interfaces. Requirements–architecture traceability links individual requirements to the architectural elements that realize them, and change impact analysis uses those links to estimate how a proposed requirements change propagates (the so-called ripple effect) through the architecture before the change is implemented.

Khan, Greenwood, Garcia, and Rashid, in a study presented at CAiSE 2008 (the International Conference on Advanced Information Systems Engineering), studied this problem with a dependency taxonomy that classifies the trace from a requirement to the architecture into six types: a goal dependency links a quality-attribute objective (e.g., security, performance, adaptability) to the architectural element realizing it; a service dependency links a functional/behavioral requirement to the operations, classes, or interfaces that perform it; a conditional dependency links a requirement stating that some event, constraint, or decision triggers behavior to the elements that realize the triggering; a temporal dependency links a timing constraint on an event or process to its architectural realization; a task dependency links a requirement needing user input or feedback to the elements that await it; and an infrastructure dependency links requirements about hardware, networks, platforms, and standards to the architecture elements that provide them. The same paper introduced three change metrics measured when a requirements change is incorporated: Concentration (CC), the number of architectural layers a requirement's dependencies span (a high value signals potential ripple across layers; the lowest value is one, indicating change confined within a layer, and the highest value is the total number of layers in the architecture design, and in the aspect-oriented architecture version an aspect is treated as a layer); Dispersion (DD), the percentage of components affected within a layer, computed as the number of classes, operations, and interfaces affected in the architecture by the change over the total number of components in that layer, calculated for each layer concerned and then averaged (DD below 25% was treated as mild, above 33% as severe); and Inclusion (II), the number of components added by the change (which may be 0).

The exploratory study applied this model to Health Watcher, a real Web-based public-health complaint system with ten documented releases in Java and in aspect-oriented variants (aspect-oriented programming modularizes crosscutting concerns such as persistence and distribution as separate units called aspects). Across nine change scenarios, the study found that dependencies rarely occur in isolation: co-existing conditional+service dependencies and co-existing goal+infrastructure dependencies were the architecturally significant combinations driving restructuring and dispersion of change. The authors explicitly cautioned that these observations rest on a single system providing a single point of observation, whose key quality attributes may differ from those of systems in other domains; on a single architectural view — the module view, to which the dependency analysis traced the requirements through their module and composition counterparts in the architectural models; and on only those dependencies actually evolved by the implemented change scenarios — so the impact of other, non-implemented candidate changes remained unknown. The Health Watcher architecture design was also specified according to a second fundamental view, the component-connector view, with deployment-related decisions embedded in these views; dependencies in that view were not analyzed and their change impact remained unknown. The paper closed by asking, in order to validate the dependency model and identify other architecturally-significant dependencies, for further studies of applications from different domains (its own examples contrast systems by key quality attributes, e.g., online banking with security and privacy).

Problem Statement

Determine, through empirical studies on systems other than the Health Watcher Web information system, whether the requirements-to-architecture dependency taxonomy of Khan et al. (2008) — the six goal, service, conditional, temporal, task, and infrastructure dependency types — and its exploratory findings generalize. The question has three jointly required parts, and a study that addresses only some of them does not resolve it: (i) do the observed architecturally significant co-existences, above all conditional+service and goal+infrastructure dependencies, dominate architectural change impact in at least two systems from application domains other than that of Health Watcher (such as security- and privacy-critical Web systems, e.g., the online banking system the source itself names)? For this test a co-existing pair is taken to dominate change impact when, as in the source, it occurs in the majority of the change scenarios whose Dispersion crosses the severe band (DD above 33%) and drives the observed restructuring and cross-layer dispersion; systems of a different architectural style or larger industrial scale are an optional extension, to be included only where such systems are available. (ii) when dependencies are traced through architectural views other than the module view analyzed in the original study — that is, which dependencies may exist for those other views, how is the architecture affected when they change, and is a similar set of dependencies architecturally significant there? (iii) do the change metrics Concentration (CC), Dispersion (DD), and Inclusion (II), computed under the source's own conventions (an aspect treated as a layer for CC; DD as the affected classes, operations, and interfaces over the total number of components in a layer, calculated per layer and then averaged), including the mild-below-25% and severe-above-33% dispersion thresholds, still identify on such systems the same propagation and restructuring they identified in the source — that is, do values crossing those dispersion bands still mark the architecturally significant dependencies and the observed architectural change as they did for Health Watcher?

References

  1. Safoora Shakil Khan, Phil Greenwood, Alessandro Garcia, Awais Rashid. On the Impact of Evolving Requirements-Architecture Dependencies: An Exploratory Study. CAiSE 2008, LNCS 5074, pp. 243–257. DOI: 10.1007/978-3-540-69534-9_19, https://doi.org/10.1007/978-3-540-69534-9_19
  2. Safoora Shakil Khan, Simon Lock. Concern tracing and change impact analysis: An exploratory study. 2009 ICSE Workshop on Aspect-Oriented Requirements Engineering and Architecture Design (EA), pp. 44–48. DOI: 10.1109/EA.2009.5071583, https://doi.org/10.1109/EA.2009.5071583
  3. Eduardo Figueiredo, Ismenia Galvao, Safoora Shakil Khan, Alessandro Garcia, Claudio Sant'Anna, Afonso Pimentel, Ana Luisa Medeiros, Lyrene Fernandes, Thais Batista, Rita Ribeiro, Pim van den Broek, Mehmet Aksit, Steffen Zschaler, Ana Moreira. Detecting architecture instabilities with concern traces: An exploratory study. 2009 Joint Working IEEE/IFIP Conference on Software Architecture & European Conference on Software Architecture (WICSA/ECSA), pp. 261–264. DOI: 10.1109/WICSA.2009.5290815, https://doi.org/10.1109/WICSA.2009.5290815
  4. Ana Luisa Medeiros, Eduardo Figueiredo, Ismenia Galvao, Alessandro Garcia, Thais Batista, Claudio Sant'Anna. Concern-Based Assessment of Architectural Stability: A Comparative Study. 2010 Fourth Brazilian Symposium on Software Components, Architectures and Reuse (SBCARS), pp. 130–139. DOI: 10.1109/SBCARS.2010.23, https://doi.org/10.1109/SBCARS.2010.23
  5. Safoora Shakil Khan. Composing requirements dependencies across architectural views for improving change impact analysis. PhD thesis, Lancaster University, 2013. EThOS: uk.bl.ethos.658055, https://ethos.bl.uk/concern/thesis_or_dissertations/658055
  6. Arda Goknil, Ivan Kurtev, Klaas van den Berg. Generation and validation of traces between requirements and architecture based on formal trace semantics. Journal of Systems and Software 88:112–137, 2014. DOI: 10.1016/j.jss.2013.10.006, https://doi.org/10.1016/j.jss.2013.10.006 (open copy: https://orbilu.uni.lu/handle/10993/12544)
  7. Arda Goknil, Ivan Kurtev, Klaas van den Berg. A Rule-Based Change Impact Analysis Approach in Software Architecture for Requirements Changes. arXiv:1608.02757, 2016. arXiv ID: 1608.02757, https://arxiv.org/abs/1608.02757
  8. He Zhang, Juan Li, Liming Zhu, Ross Jeffery, Yan Liu, Qing Wang, Mingshu Li. Investigating dependencies in software requirements for change propagation analysis. Information and Software Technology 56(1):40–53, 2014. DOI: 10.1016/j.infsof.2013.07.001, https://doi.org/10.1016/j.infsof.2013.07.001
  9. Trosky B. Callo Arias, Pieter van der Spek, Paris Avgeriou. A practice-driven systematic review of dependency analysis solutions. Empirical Software Engineering 16(5):544–586, 2011. DOI: 10.1007/s10664-011-9158-8, https://doi.org/10.1007/s10664-011-9158-8
  10. Khubaib Amjad Alam, Rodina Ahmad, Adnan Akhunzada, Mohd Hairul Nizam Md Nasir, Samee U. Khan. Impact analysis and change propagation in service-oriented enterprises: A systematic review. Information Systems 54:43–73, 2015. DOI: 10.1016/j.is.2015.06.003, https://doi.org/10.1016/j.is.2015.06.003