D.3.3 ALGORITHMS FOR INCREMENTAL ... - SecureChange

2 F. Massacci and L.M.S. Tran
enterprise modeling, software engineering, observable and control-
Key words
lable rules
1 Introduction
“...There are known unknowns: that is to say, there are things
that we now know we don’t know...”
— Donald Rumsfeld, United States Secretary of Defense
The term software evolution has been introduced by Lehman in his work on laws
of software evolution [17, 18], and was widely adopted since 90s. Recent studies
in software evolutions attempt to understand causes, processes, and effects of the
phenomenon [2, 14, 16]; or focus on the methods, tools that manage the effects of
evolution [19, 29, 36].
In the domain of software systems [12, 15, 27, 33, 42], evolution refers to a
process of continually updating software systems in accordance to changes in their
working environments such as business requirements, regulations and standards.
While some evolutions are unpredictable, many others can be predicted albeit with
some uncertainty (e.g. a new standard does not appear overnight, but is the result
of a long process).
It is now widely accepted that in order to fully understand an enterprise system
we can no longer consider simply its IT structure. We face a socio-technical system
[31] “that involve complex interactions between software components, devices and
social components (people or groups of people), not as users of the software but
as players engaged in common tasks” [11].
This is particularly true for large systems of systems such as the Air Traffic
Management “system” (ATM for short). Modelling the key objectives on an Air
Traffic Control Organization requires to include both human and system actors
and, before digging into detailed software features, requires the ability to reason
about high-level strategic assignments of goals to those human and system actors.
In the ATM setting changes are often organizational changes that involves
complex subsystems as a whole. For example, the SESAR Open Sky initiative
foresee the introduction of an Arrival Manager (a system) in order to replace
some of the activities by the Sequence Manager (a human). Still this system relies
on decisions by other humans. Evolution is therefore not represented in terms
of software features but rather in assigning high-level mission critical goals such
as “maintain aircraft separation” to different actors.
The potential evolutions of such large and complex system is not completely
unpredictable, as it often involves significant multi-party (or even multi-state) negotiations.
Stakeholders with experience and high-level positions have a good visibility
of the likely alternatives, the possible but unlikely solutions, and the politically
impossible paths. For example, the Federal Aviation Authority (FAA) document
of the System Wide Information Management (SWIM) for Air Traffic Management
(ATM) lists a number of potential technical alternatives that depends from
high-level decisions (e.g., the existence of an organizational agreement for nationwide
identity management of SWIM users).