Software Change Management: a Quantified Perspective

Software change impact analysis (CIA) methods enable developers to understand potential impacts of a code change so that the change can be executed confidently without affecting reliability of the software. However, existing CIA approaches do not support CIA for all source code granularities. Additionally, they lack support for inter-granular change impact queries and hidden dependencies. This paper introduces Augur, an automated static code analysis-based CIA approach that addresses these shortcomings. Augur infers and maintains semantic and environment dependencies along with data and control dependencies between source code entities across granularities. Additionally, Augur uses Change Impact Query Language, a novel query language for impact analysis proposed in this paper, to support inter-granular CIA queries with batch querying feature. Augur has been realized as a Visual Studio extension called Augur-Tool. We have conducted quantitative evaluation on two open-source and two industrial projects to assess the accuracy of the tool. Results from the evaluation indicate that Augur provides CIA with high accuracy (average precision 55% and average recall 85%).

Software change impact analysis (CIA) is a key technique to identify the potential ripple effects of the changes to software. Coarse-grained CIA techniques such as file, class and method level techniques often gain less precise change impacts, which are difficult for practical use. Fine-grained CIA techniques, such as slicing, can be used to gain more precise change impacts, but need more time and space cost. In this paper, by combining the features of the coarse-grained technique and the fine-grained technique, a variable-method (VM) correlation-based CIA technique called VM-CIA is proposed to improve the precision of static CIA. First, the VM-CIA technique uses the abstract syntax tree (AST) of program to construct a novel intermediate representation called variable and method triple (VMT), which is used to analyze the correlation between the variables and methods. Second, the VM-CIA technique proposes the single-change impact analysis algorithm and multi-change impact analysis algorithm to compute the impact set based on the VMT representation. In addition, the VM-CIA technique can get a sorted impact set which is more accurate than the existing CIA techniques. The empirical results show that the VM-CIA technique can greatly improve the precision (19%) over traditional the CIA techniques, while at the cost of a little recall (5%). Moreover, the empirical studies also show that the VM-CIA technique predicts a ranked list of potential impact results according to the distance measure, which can greatly facilitate the practical use.

In this paper, we propose a formal model and a platform for software change management. The model is based on graphs rewriting, and deals with both multi-language source codes and heterogeneous database schemas. These are represented by software components linked by meaningful relationships. The change impact analysis is done, using a knowledge-based system, that includes impact propagation rules preserving the software consistency. This is implemented by an integrated platform including a multilanguage parsing tool, and a soft-ware change management module.

Safety standards prescribe change impact analysis (CIA) during evolution of safety-critical software systems. Although CIA is a fundamental activity, there is a lack of empirical studies about how it is performed in practice. We present a case study on CIA in the context of an evolving automation system, based on 14 interviews in Sweden and India. Our analysis suggests that engineers on average spend 50–100 h on CIA per year, but the effort varies considerably with the phases of projects. Also, the respondents presented different connotations to CIA and perceived the importance of CIA differently. We report the most pressing CIA challenges, and several ideas on how to support future CIA. However, we show that measuring the effect of such improvement solutions is non-trivial, as CIA is intertwined with other development activities. While this paper only reports preliminary results, our work contributes empirical insights into practical CIA.

"Change Impact Analysis" is the process of determining the consequences of a modification to software. In theory, change impact analysis should be done during software maintenance, to make sure changes do not introduce new bugs. Many approaches and techniques are proposed to help programmers do change impact analysis automatically. However, it is still an open question whether and how programmers do change impact analysis. In this paper, we conducted two studies, one in-depth study and one breadth study. For the in-depth study, we recorded videos of nine professional programmers repairing two bugs for two hours. For the breadth study, we surveyed 35 professional programmers using an online system. We found that the programmers in our studies did static change impact analysis before they made changes by using IDE navigational functionalities, and they did dynamic change impact analysis after they made changes by running the programs. We also found that they did not use any change impact analysis tools.

The way practitioners perform maintenance tasks in practice is little known by researchers. In turn, practitioners are not always up to date with the proposals provided by the research community. This work investigates the gap between software maintenance techniques proposed by the research community and the software maintenance practice. We carried out a survey with 112 practitioners from 92 companies and 12 countries. We concentrate on analyzing if and how practitioners understand and apply the following subjects: bad smells, refactoring, software metrics, and change impact analysis. This study shows that there is a large gap between research approaches and industry practice in those subjects, especially in change impact analysis and software metrics.

Change impact analysis techniques estimate the potential effects of changes made to software. Directed Incremental Symbolic Execution (DiSE) is an intraprocedural technique for characterizing the impact of software changes on program behaviors. DiSE first estimates the impact of the changes on the source code using program slicing techniques, and then uses the impact sets to guide symbolic execution to generate path conditions that characterize impacted program behaviors. DiSE, however, cannot reason about the flow of impact between methods and will fail to generate path conditions for certain impacted program behaviors. In this work, we present iDiSE, an extension to DiSE that performs an interprocedural analysis. iDiSE combines static and dynamic calling context information to efficiently generate impacted program behaviors across calling contexts. Information about impacted program behaviors is useful for testing, verification, and debugging of evolving programs. We present a case-study of our implementation of the iDiSE algorithm to demonstrate its efficiency at computing impacted program behaviors. Traditional notions of coverage are insufficient for characterizing the testing efforts used to validate evolving program behaviors because they do not take into account the impact of changes to the code. In this work we present novel definitions of impacted coverage metrics that are useful for evaluating the testing effort required to test evolving programs. We then describe how the notions of impacted coverage can be used to configure techniques such as DiSE and iDiSE in order to support regression testing related tasks. We also discuss how DiSE and iDiSE can be configured for debugging; finding the root cause of errors introduced by changes made to the code. In our empirical evaluation we demonstrate that the configurations of DiSE and iDiSE can be used to support various software maintenance tasks.

Small changes can have major and nonlocal effects in object oriented languages, due to the extensive use of subtyping and dynamic dispatch. This makes it difficult to understand value flow through a program and complicates life for maintenance programmers. Change impact analysis provides feedback on the semantic impact of a set of program changes.The change impact analysis method presented in this thesis presumes the existence of a suite of regression tests associated with a Java program and access to the original and edited versions of the code. The primary goal of our research is to provide programmers with tool support that can help them understand why a test is suddenly failing after a long editing session by isolating the changes responsible for the failure. The tool analyzes two versions of an application and decomposes their difference into a set of atomic changes. Change impact is then reported in terms of affected tests whose execution behavior may have been modified by the applied changes. For each affected test, it also determines a set of affecting changes that were responsible for the test's modified behavior.The first contribution of this thesis is the demonstration of the utility of the basic change impact analysis framework of [51], by implementing a proof-of-concept prototype, Chianti, and applying it to Daikon, for an experimental validation.The second contribution is the definition and implementation of the dependences between atomic changes. Extensive experiments show that our dependences can help build the intermediate programs automatically in most cases.Another contribution is the heuristics for ranking the atomic changes for fault localization. This thesis proposes a heuristic that ranks method changes that might have affected a failed test, indicating the likelihood that they may have contributed to a test failure. Our results indicate that when a failure is caused by a single method change, our heuristic ranked the failure-inducing change as number 1 or number 2 of all the method changes in 67% of the delegate tests (i.e., representatives of all failing tests).

FCA–CIA: An approach of using FCA to support cross-level change impact analysis for object oriented Java programs

As business services become increasingly dependent on information technology (IT), it also becomes increasingly important to maximize the decision support for managing IT. Configuration Management Data Bases (CMDBs) store fundamental information about IT systems, such as the system's hardware, software and services. This information can help provide decision support for root cause analysis and change impact analysis. We have worked with our industrial research partner, CA, and with CA customers to identify challenges to the use of CMDBs to semi-automatically solve these problems. In this paper we propose a framework called DRACA (Decision Support for Root Cause Analysis and Change Impact Analysis). This framework mines key facts from the CMDB and in a sequence of three steps combines these facts with incident reports, change reports and expert knowledge, along with temporal information, to construct a probabilistic causality graph. Root causes are predicted and ranked by probabilistically tracing causality edges backwards from incidents to likely causes. Conversely, change impacts can be predicted and ranked by tracing from a proposed change forward along causality edges to locate likely undesirable impacts.

As the complexity of a software system grows, it becomes increasingly difficult for developers to be aware of all the dependencies that exist between artifacts (e.g., files or methods) of the system. Change impact analysis helps to overcome this problem, as it recommends to a developer relevant source-code artifacts related to her current changes. Association rule mining has shown promise in determining change impact by uncovering relevant patterns in the system's change history. State-of-the-art change impact mining algorithms typically make use of a change history of tens of thousands of transactions. For efficiency, targeted association rule mining focuses on only those transactions potentially relevant to answering a particular query. However, even targeted algorithms must consider the complete set of relevant transactions in the history. This paper presents ATARI, a new adaptive approach to association rule mining that considers a dynamic selection of the relevant transactions. It can be viewed as a further constrained version of targeted association rule mining, in which as few as a single transaction might be considered when determining change impact. Our investigation of adaptive change impact mining empirically studies seven algorithm variants. We show that adaptive algorithms are viable, can be just as applicable as the start-of-the-art complete-history algorithms, and even outperform them for certain queries. However, more important than the direct comparison, our investigation lays necessary groundwork for the future study of adaptive techniques and their application to challenges such as the on-the-fly style of impact analysis that is needed at the GitHub-scale.

Software Requirements Changes is a typical phenomenon in any software development project. Restricting incoming changes might cause user dissatisfaction and allowing too many changes might cause delay in project delivery. Moreover, the acceptance or rejection of the change requests become challenging for software project managers when these changes are occurred in Software Development Phase. Where in Software Development Phase software artifacts are not in consistent state such as: some of the class artifacts are Fully Developed, some are Half Developed, some are Major Developed, some are Minor Developed and some are Not Developed yet. However, software effort estimation and change impact analysis are the two most common techniques which might help software project managers in accepting or rejecting change requests during Software Development Phase. The aim of this research is to develop a new software change effort estimation model which helps software project manager in estimating the effort for software Requirement Changes during Software Development Phase. Thus, this research has analyzed the existing effort estimation models and change impact analysis techniques for Softwrae Development Phase from the literature and proposed a new software change effort estimation model by combining change impact analysis technique with effort estimation model. Later, the new proposed model has been evaluated by selecting four small size software projects as case selections in applying experimental approch. The experiment results show that the overall Mean Magnitude Relative Error value produced by the new proposed model is under 25%. Hence it is concluded that the new proposed model is applicable in estimating the amount of effort for requirement changes during SDP.

Large systems often have a long life-span and their system and software architecture design comprise many intricately related elements. The verification and maintenance of these architecture designs require an understanding of how and why the system are constructed. Design rationale is the reasoning behind a design and it provides an explanation of the design. However, the reasoning is often undocumented or unstructured in practice. This causes difficulties in the understanding of the original design, and makes it hard to detect inconsistencies, omissions and conflicts without any explanations to the intricacies of the design. Research into design rationale in the past has focused on argumentation-based design deliberations. Argumentation-based design rationale models provide an explicit representation of design rationale. However, these methods are ineffective in communicating design reasoning in practice because they do not support tracing to design elements and requirements in an effective manner. In this thesis, we firstly report a survey of practising architects to understand their perception of the value of design rationale and how they use and document this knowledge. From the survey, we have discovered that practitioners recognize the importance of documenting design rationale and frequently use them to reason about their design choices. However, they have indicated certain barriers to the use and documentation of design rationale. The results have indicated that there is no systematic approach to using and capturing design rationale in current architecture design practice. Using these findings, we address the issues of representing and applying architecture design rationale. We have constructed a rationale-based architecture model to represent design rationale, design objects and their relationships, which we call Architecture Rationale and Element Linkage (AREL). AREL captures both qualitative and quantitative rationale for architecture design. Quantitative rationale uses costs, benefits and risks to justify architecture decisions. Qualitative rationale documents the issues, arguments, alternatives and tradeoffs of a design decision. With the quantitative and qualitative rationale, the AREL model provides reasoning support to explain why architecture elements exist and what assumptions and constraints they depend on. Using a causal relationship in the AREL model, architecture decisions and architecture elements are linked together to explain the reasoning of the architecture design. Architecture Rationalisation Method (ARM) is a methodology that makes use of AREL to facilitate architecture design. ARM uses cost, benefit and risk as fundamental elements to rank and compare alternative solutions in the decision making process. Using the AREL model, we have proposed traceability and probabilistic techniques based on Bayesian Belief Networks (BBN) to support architecture understanding and maintenance. These techniques can help to carry out change impact analysis and rootcause analysis. The traceability techniques comprise of forward, backward and evolution tracings. Architects can trace the architecture design to discover the change impacts by analysing the qualitative reasons and the relationships in the architecture design. We have integrated BBN to AREL to provide an additional method where probability is used to evaluate and reason about the change impacts in the architecture design. This integration provides quantifiable support to AREL to perform predictive, diagnostic and combined reasoning. In order to align closely with industry practices, we have chosen to represent the rationale-based architecture model in UML. In a case study, the AREL model is applied retrospectively to a real-life bank payment systems to demonstrate its features and applications. Practising architects who are experts in the electronic payment system domain have been invited to evaluate the case study. They have found that AREL is useful in helping them understand the system architecture when they compared AREL with traditional design specifications. They have commented that AREL can be useful to support the verification and maintenance of the architecture because architects do not need to reconstruct or second-guess the design reasoning. We have implemented an AREL tool-set that is comprised of commercially available and custom-developed programs. It enables the capture of architecture design and its design rationale using a commercially available UML tool. It checks the well-formedness of an AREL model. It integrates a commercially available BBN tool to reason about the architecture design and to estimate its change impacts.

This paper shows that existing software metric tools interpret and implement the definitions of object-oriented software metrics differently. This delivers tool-dependent metrics results and has even implications on the results of analyses based on these metrics results. In short, the metrics-based assessment of a software system and measures taken to improve its design differ considerably from tool to tool. To support our case, we conducted an experiment with a number of commercial and free metrics tools. We calculated metrics values using the same set of standard metrics for three software systems of different sizes. Measurements show that, for the same software system and metrics, the metrics values are tool depended. We also defined a (simple) software quality model for maintainability based on the metrics selected. It defines a ranking of the classes that are most critical wrt. maintainability. Measurements show that even the ranking of classes in a software system is metrics tool dependent.

Change impact analysis is generally regarded as a very difficult program comprehension problem. One of the reasons for this is that there is no universal definition for dependency between software artifacts, only algorithms that approximate the dependencies. In the past two decades, different kinds of algorithms have been developed by researchers. But which algorithm is the most suitable in a specific situation, which one finds the relevant dependencies in the best way? What kinds of dependencies are important for the programmers? What kinds of algorithms do they work with? Finding the most relevant dependencies is difficult, and it is essentially a creative mental task. A possible way to answer the above questions is to involve programmers in a survey, and listen to their subjective opinions based on expertise and experience in program comprehension. In this paper, we present the results of our survey on this theme. We wanted to know what the difference was between the results of some well-known algorithms and programmers´ opinions and, in addition, among programmers´ opinions as well. Hence we conducted a case study.