Software Engineering Institute Research Articles

Based on the CIPP Theory Perspective: The Application of Information Technology Integration in Physical Education Course Evaluation - A Case Study of Software Engineering Institute of Guangzhou

CIPP, as a decision-oriented new model of curriculum evaluation, is suitable for the evaluation needs of information-based physical education courses. The evaluation of teaching in information-based physical education courses based on the CIPP model is divided into four categories: context evaluation, input evaluation, process evaluation, and product evaluation. This study explores the evaluation system of information-based physical education courses to fully leverage the guiding function of course evaluation, aiming to better optimize the construction of information-based physical education courses and improve the quality of teaching in these courses.

Assessment of Project Management Maturity Models Strengths and Weaknesses

The purpose of this article is to analyze the most popular maturity models in order to identify their strengths and weaknesses. Research conducted by international project management communities such as Software Engineering Institute (SEI), Project Management Institute (PMI), International Project Management Association (IPMA), Office of Government Commerce (OGC) and International Organization for Standardization (ISO) showed that organizations with high managerial maturity are more likely to achieve their planned project goals than those that do not identify and standardize their best management practices. This circumstance has encouraged scientists from all over the world to start developing various models that can measure and evaluate managerial maturity in projects. Nowadays, the variety of models created has led to considerable difficulty in understanding the strengths and weaknesses of each model. To solve this problem, the article authors conducted a critical analysis to identify the strengths and weaknesses of the most popular project management maturity models. The results obtained will be of interest to project managers, members of project teams, heads of organizations, project offices and everyone involved in the development of project activities. Based on the analysis, it was found that the most developed maturity models are based on international codes of knowledge of project management. Most maturity models ignore the presence of structural and infrastructural elements, such as a workplace, the necessary equipment and software, the availability of professional standards, instructions, regulations, etc. It was also revealed that there are no processes for assessing the effectiveness and efficiency of using the best practices in the maturity models.

Rural E-Commerce Entrepreneurship Education in Higher Education Institutions: Model Construction via Empirical Analysis

Rural e-commerce entrepreneurship education (EE) in Higher Education Institutions (HEIs) can effectively enhance the development of the rural e-commerce industry and improve the motivation of students to start or be employed in rural e-commerce, but how to conduct effective evaluation is an issue that remains to be clarified. The research objectives of this paper are as follows: to establish a “student-centered” evaluation model for EE in HEIs, to integrate rural e-commerce professional education with EE, and to provide practical guidance for the evaluated HEIs. This paper constructs an evaluation model of rural e-commerce EE in HEIs. The research method combines Analytic Hierarchy Process (AHP) and Fuzzy Comprehensive Evaluation Method. The questionnaire method was used to obtain 384 valid data for the empirical analysis of the education of the Software Engineering Institute of Guangzhou. The study’s results found that the final evaluation result of the school’s rural e-commerce EE grade was good. The indicators at the level of educational support and feedback effectiveness scored relatively high, but those at the level of learning input and educational process scored low. Based on the findings, recommendations were made in terms of developing more open feedback channels, providing a full range of services, and social flexibility of the training program.

Systems Engineering and DevSecOps: Reviewing the Principles

ABSTRACTAs software engineering adopts a more continuous delivery mode for embedded and complex systems, systems engineering must adapt and influence DevSecOps and related practices. In this article, I revisit agile, lean, and DevSecOps principles and comment on their interactions, focusing on those that may increase product and system development, deployment, and evolution risk, and those that increase improvement opportunities through productive engagement across the two disciplines. This material is also available as a Software Engineering Institute Blog Post from 15 March 2021 [https://insights.sei.cmu.edu/blog/comparing-devsec-ops-and-systems-engineering-principles/.]

Risk Evaluation in Software Project Using Bayesian Network Modeling

Project risk events are often influenced by each other and rarely act independently. In this context, effective methods to identify, model and analyze these risks are necessary. The objective of this article is to apply the risk analysis in a software development project, based on the model of the Software Engineering Institute (SEI), using the Bayes model to calculate the event probabilities and also the Noisy-OR calculation structure to assign the initial weights of the network of factors that influence the project. In this way, it is expected to increase the chances of success of the risk analysis process. The results obtained by the techniques adopted prove to be promising in assisting the process of decision making by the managers of software development projects.

A Quantitative Analysis of Defect Prevention in E-commerce Projects

E-commerce is a transaction of buying or selling online. It is a methodology of modern business which addresses the need of business organizations, vendors and customers to reduce cost and improve the quality of goods and services while increasing the speed of delivery [1]. In the emerging global economy, e-commerce and e-business have increasingly become a necessary component of business strategy and a strong catalyst for economic development. E-commerce promises better business for Small and Medium Enterprises (SME) and sustainable economic development for developing countries [2]. With the advent of e-commerce business, many software providers have started developing e-commerce solutions. However, the emphasis has to be given on developing defect free e-commerce portals. The concept of defect removal effectiveness and its measurement are central to software development. As per Software Engineering Institute Website defect removal is one of the top expenses in any software project and it greatly affects schedules [3]. According to Caper Jones, for improvements in productivity, cost, and schedule, it is important to use better defect prevention and removal techniques [4]. This quantitative analysis is done on five e-commerce projects. The lessons learnt from one project are fed into the development process of the subsequent projects that helped in preventing the similar defects. This facilitated in reduction in the count of User Acceptance Test defects, in the projects developed subsequently.

Propuesta de mejora de procesos software basada en PSP para contextos de teletrabajo

En este artículo se presenta una propuesta de especificación de mejora en el proceso software para contextos de teletrabajo basada en el framework Personal Software Process (PSP) del Software Engineering Institute (SEI). La propuesta describe una especificación de un proceso software, para que los desarrolladores que inician su trabajo en la modalidad de teletrabajo, y que no tengan este proceso definido, mejoren la forma de realizar los desarrollos. Tradicionalmente, un profesional de software, al incursionarse en el modo del teletrabajo, está ausente de un entorno laboral usual y se somete a sus propias maneras de llevar a cabo un desarrollo, por lo cual, se puede presentar que el profesional no tenga un proceso específico para desarrollar software o que no conozca alguno en particular. La propuesta en este artículo se enfoca en brindar una mejora para que pueda tener un proceso software base por el cual pueda abordar los retos particulares del teletrabajo.

Designing the Software Systems of the Future

We report here on the Future of Software Design Workshop that was held on Jan 12-14, 2018 in Pittsburgh, PA under the sponsorship of the Carnegie Mellon University Software Engineering Institute. The software industry is awash in modern trends that involve artificial intelligence (AI), autonomy, data everywhere, etc. These trends affect the structure of softwareintensive systems and their designs. The goal of the workshop was to bring together participants from diverse backgrounds to formulate ideas for software design of future systems and related research opportunities and challenges. In this report we summarize the outcomes of the workshop

Toward the Design and Implementation of Traceability Engineering Tool Support

Requirements of a system keep on changing based on the need of stakeholders or the system developers, making requirement engineering an important aspect in software development. This develops a need for appropriate requirement change management. The importance of requirements traceability is defining relationships between the requirements and artefacts extracted by the stakeholder during the software development life-cycle and gives vital information to encourage software understanding. In this paper, we have concentrated on developing a tool for requirement traceability that can be used to extend the requirement elicitation and identification of system-wide qualities using the notion of quality attribute scenarios to capture the non-functional requirements. It allows us to link the functional and non-functional requirements of the system based on the quality attribute scenarios template proposed by the Carnegie Mellon Software Engineering Institute (SEI). Apart from this, the paper focuses on tracing the functional and non-functional requirements of the system using the concept of requirement traceability matrix.

Designing the Software Systems of the Future

We report here on the Future of Software DesignWorkshop that was held on Jan 12-14, 2018 in Pittsburgh, PA under the sponsorship of the Carnegie Mellon University Software Engineering Institute. The software industry is awash in modern trends that involve artificial intelligence (AI), autonomy, data everywhere, etc. These trends affect the structure of software-intensive systems and their designs. The goal of the workshop was to bring together participants from diverse backgrounds to formulate ideas for software design of future systems and related research opportunities and challenges. In this report we summarize the outcomes of the workshop.

Risk factors in software development projects: a systematic literature review

Risks are an inherent part of any software project. The presence of risks in environments of software development projects requires the perception so that the associated factors do not lead projects to failure. The correct identification and monitoring of these factors can be decisive for the success of software development projects and software quality. However, in practice, risk management in software development projects is still often neglected and one of the reasons is due to the lack of knowledge of risk factors that promoted a low perception of them in the environment. This paper aims to identify and to map risk factors in environments of software development projects. We conducted a systematic literature review through a database search, as well as we performed an assessment of quality of the selected studies. All this process was conducted through a research protocol. We identified 41 studies. In these works, we extracted and classified risk factors according to the software development taxonomy developed by Software Engineering Institute (SEI). In total, 148 different risk factors were categorized. The found evidences suggest that risk factors relating to software requirements are the most recurrent and cited. In addition, we highlight that the most mentioned risk factors were the lack of technical skills by the staff. Therefore, the results converged to the need for more studies on these factors as fundamental items for reduction of failure level of a software development project.

A proposal of intellectual capital maturity model (ICMM) evaluation

PurposeThe purpose of this paper is to propose a model to evaluate the degree of intellectual capital (IC) maturity into organizations.Design/methodology/approachThis is a qualitative, applied research designed as an exploratory and descriptive investigation. It employs a case study to apply the intellectual capital maturity model, which is developed from the literature review. The Proknow-C method of systematic literature review is the procedure adopted for the literature review in Scopus, Science Direct and Web of Science databases. In total, 21 IC constructs were derived from such review and assessed by 18 reviewers (judges).FindingsIn the scientific literature, IC is mainly viewed as a resource or set of resources an organization for the creation of competitive advantage and value. Using the information gathered about different views on IC, this study proposes a construction of the theoretical model, based on the models of the capability maturity model–Software Engineering Institute and Asian Productivity Organization–Knowledge Management, the management model and the application protocol.Practical implicationsThis research offers view on the nature of the concept of IC showing (IC) as a business asset through maturity scale. The analysis of the concept of IC is focused at organizational and dimensional levels.Originality/valueThis study contributes to the further development of the concept of IC regarding its measurement in organizations through the maturity scale.

Hermeneutical Elicitation of Requirements: A Technical Perspective to Improve the Conception of the Software Requirements

In order to develop quality software that meets the originals needs of its users, it is necessary to perform the Requirements Engineering, so that the software context to be developed is identified, examined and specified properly. However, there is a problem that is increasingly in debate: the difficulty in understanding and establishing the purpose of the software to be developed, as pointed out by important researches in the area, such as the Chaos Report, which indicates that only 29% of software projects are successful, and the Software Engineering Institute, which points out software requirements as a critical factor for the success of software engineering and that deficiencies in this dimension are the main causes of software project failures. This article presents a proposal to address this problem through the use of the Hermeneutical Elicitation of Requirements, which is the conceptual adequacy of some hermeneutical methods in a technical approach that assists the requirements engineer to conceive better of the software requirements. In this way, the software engineer will be better able to develop the software to better meet the needs of its end users and sponsors.

Deriving organisational business process change factors using the hierarchical elicitation workshop

The hierarchical elicitation workshop (HEW) is a new initiative designed and developed to address common shortcomings in business process change (BPC) initiatives in organisations, particularly those with tight temporal constraints imposed by exogenous bodies. This paper presents a systematic solution to deal with dramatic BPC under tight temporal constraints in large business and government organisations. In an empirical case study, the hierarchical elicitation workshop is developed and trialled. Based on the Software Engineering Institute's Quality Attribute Workshop methodology, a step-by-step process was carried out to elicit and validate the required BPC factors. Engaging internal stakeholder teams to consider implications for BPC with respect to factors such as organisational objectives and strategies, governance, business process architecture and applications, a prioritised list of change actions was systematically elicited and then implemented. The HEW framework and process was successfully applied to elicit BPC factors in this case study, with an immediate and effective implementation of process change. This paper will be of particular interest to researchers of change management and business development.

Analysis and Design of Safety-critical, Cyber-Physical Systems

The list of applications classified as safety critical is growing due to emerging contexts such as the Internet of Things that touch the everyday activities of millions of people through smart devices like home automation systems and connected vehicles. These consumer products require high reliability but must be priced competitively. Traditional system development strategies are costly, in part, because traditional verification activities find only a small percentage of defects early in a project and because when discovered late in the development life cycle their repair requires changes to dependent code as well. Our development approach leverages early system architecture knowledge to jump start an architecture-centric development strategy that iteratively establishes traceability among the requirements, architecture, and verification artifacts. A virtual integration strategy makes the current state of the system under development available for analysis early in the product development life cycle. The approach is implemented using the Architecture Analysis and Design Language (AADL) embodied in the Open Source AADL Tool Environment (OSATE). The Architecture-Led Incremental System Assurance (ALISA) toolkit, the latest contribution of our team at the Software Engineering Institute, builds on AADL to provide the constructs and tools for an engineer to specify the integrated system, and to define verification activities that ensure satisfaction of the specification. The results from using the languages and techniques in pilot projects have shown very large cost and time savings, important to holding down costs for consumer-level Internet of Things systems. In this paper we focus on the architecture-led development process and illustrate the support given by ALISA.

The Future of Software Engineering

This special issue offers a range of perspectives on software engineering's future from professionals working around the world in diverse areas of software. The content ranges from detailed technical articles about the research areas behind today's trends to shorter essays and opinion pieces from folks working to sharpen the focus of their own visions of that future. The Web extra at https://youtu.be/LnSHGDl9O7U is an audio recording of st Shull and Anita Carleton of the Software Engineering Institute and Rafael Prikladnicki of Pontificia Universidade Catolica do Rio Grande do Sul talking about the authors, articles, and discussions that went into the IEEE Software January/February 2016 theme issue on the future of software engineering.

Is it true that what you can't see can't hurt you?

Trying to establish when the acronym ‘DDoS’ (Distributed Denial of Service) was very first used is not as easy as you might think. According to various sources, the first usage of the term ‘denial of service’ was in 1997; a special report to the President's Commission on Critical Infrastructure Protection was released by the Software Engineering Institute at Carnegie Mellon University (which would later become part of CERT).1

Secure by Design: Cybersecurity Extensions to Project Management Maturity Models for Critical Infrastructure Projects

Many systems that comprise our critical infrastructures – including electricity, transportation, healthcare, and financial systems – are designed and deployed as information technology (IT) projects using project management practices. IT projects provide a one-time opportunity to securely cybersecurity to the IT components of critical infrastructures. The project management maturity models used by organizations today to assess the quality and rigour of IT project management practices do not explicitly consider cybersecurity. This article makes three contributions to address this gap. First, it develops the argument that cybersecurity can and should be a concern of IT project managers and assessed in the same way as other project management capabilities. Second, it examines three widely used cybersecurity maturity models – i) the National Institute of Science and Technology (NIST) framework for improving critical infrastructure cybersecurity, ii) the United States Department of Energy’s Cybersecurity Capability Maturity Model (C2M2), and iii) the CERT Resilience Management Model (CERT RMM) from the Carnegie Mellon Software Engineering Institute – to identify six cybersecurity themes that are salient to IT project management. Third, it proposes a set of cybersecurity extensions to PjM3, a widely-deployed project management maturity model. The extensions take the form of a five-level cybersecurity capability perspective that augments the seven standard perspectives of the PjM3 by explicitly assessing project management capabilities that impact the six themes where IT project management and cybersecurity intersect. This article will be relevant to IT project managers, the top management teams of organizations that design and deploy IT systems for critical infrastructures, and managers at organizations that provide and maintain critical infrastructures. The challenge in the digital economy is that no chain is stronger than its weakest link.

Lightweight and Flexible: Emerging Trends in Software Architecture from the SATURN Conferences

Over its 10-year history, the annual Software Engineering Institute (SEI) Architecture Technology User Network (SATURN) conference has become a barometer for the ever-evolving software architecture climate. This article summarizes some software architecture trends that emerged during SATURN 2014 and gives a glimpse of the future based on the current SATURN 2015 technical program.

Verification column

In this issue of the SIGLOG newsletter, the technical column on verification presents an invited contribution on "Algorithmic Logic-Based Verification" by Arie Gurfinkel (Software Engineering Institute / Carnegie Mellon University), Temesghen Kahsai (NASA Ames / Carnegie Mellon University), and Jorge Navas (NASA Ames / SGT Inc.). The increasing number of programming languages and intermediate representations poses an obstacle in the development of a unified verification framework. The article presents a case for the use of Constrained Horn Clauses (CHC) as a universal representation for transition systems to overcome this obstacle. This article should be of special interest to the readers of this newsletter as CHCs have been used in various logic-based application domains, but are relatively new to the domain of verification. I would like to thank the authors for submitting the article.