ClearSpecs Education 1 Development with Seatbelts: Controlling Reqts Risk David Gelperin ClearSpecs...

ClearSpecsClearSpecs

EducationEducation 11

Development with Seatbelts: Development with Seatbelts: Controlling Reqts RiskControlling Reqts Risk

David GelperinDavid Gelperin

ClearSpecs EnterprisesClearSpecs [email protected]@clearspecs.com



Controlling Reqts RiskControlling Reqts Risk

1. Reqts 1. Reqts RiskRisk

2. Risk Mgmt2. Risk Mgmt

3. Safety Tactics3. Safety Tactics



Reqts can be DangerousReqts can be Dangerous

Fred Brooks is still right: Fred Brooks is still right: The hardest The hardest single part of building a … system is single part of building a … system is deciding precisely what to builddeciding precisely what to build

Arthur SchlesingerArthur Schlesinger is right: is right: … … the the possibilities of the future are more possibilities of the future are more various than the human intellect is various than the human intellect is designed to conceivedesigned to conceive

Hard +

Important +

Pervasive

Dangerous



Reqts are DangerousReqts are Dangerous

KilledKilled InjuredInjured

CarsCars43K43K

people - USpeople - US2.5M2.5M

people - USpeople - US

ReqtsReqts~15%~15%projectsprojects

~30%~30%projectsprojects

2006

2000



Reqts RiskReqts Risk

RiskRisk: potential cause of : potential cause of significant harm or losssignificant harm or loss

DefectsDefects Risk Risk

SynonymsSynonyms: danger, hazard, peril: danger, hazard, peril

StakeholdersStakeholders Risk Risk

ResourcesResources Risk Risk

ImplementationImplementation Risk Risk

ReqtsProcessProcess Risk Risk ChangeChange Risk Risk



Who’s in Peril “from”?Who’s in Peril “from”?

Project EstimatorProject Estimator

Product ArchitectProduct Architect Functional DesignerFunctional Designer Product TesterProduct Tester Product DeveloperProduct Developer Documentation AuthorDocumentation Author

Product UserProduct User BystanderBystander Product CustomerProduct Customer

Danger, Will Robinson



6 Types of Reqts Risk6 Types of Reqts Risk

DefectsDefects Risk Risk: potential for : potential for significant harm significant harm or lossor loss rooted in rooted in defectivedefective reqts info reqts info

ImplementationImplementation Risk Risk: potential for : potential for significant problems in implementingsignificant problems in implementing a set of one or more a set of one or more goodgood reqts reqts

ProcessProcess Risk Risk: potential for seriously : potential for seriously defective reqts info rooted in defective reqts info rooted in inadequate inadequate reqts dev or mgmt processesreqts dev or mgmt processes

StakeholdersStakeholders Risk Risk: potential for seriously : potential for seriously defective reqts info rooted in defective reqts info rooted in inadequate inadequate understanding, involvement or understanding, involvement or inappropriate behaviorinappropriate behavior

ChangeChange Risk Risk: potential for : potential for significant harm significant harm or lossor loss rooted in rooted in rapidly changingrapidly changing reqts reqts infoinfo

ResourcesResources Risk Risk: potential for seriously : potential for seriously defective reqts info rooted in defective reqts info rooted in inadequate inadequate time or toolstime or tools

“to” risk

“from” risk



Are Good Reqts Possible?Are Good Reqts Possible?

Some Some (e.g., in the agile (e.g., in the agile community)community) believe that believe that large-scale reqts cannot be large-scale reqts cannot be done effectively – done effectively – and they and they may be rightmay be right. History . History provides strong evidence provides strong evidence for this view. for this view.

A different interpretation of A different interpretation of history is that history is that just doing just doing the basics is not enoughthe basics is not enough. . Proactive mgmt of reqts Proactive mgmt of reqts risk must be includedrisk must be included..




1. Reqts Risk1. Reqts Risk


3. Safety Tactics3. Safety Tactics



Risk Mgmt is Risk Mgmt is Project Mgmt for AdultsProject Mgmt for Adults

An almost defining characteristic of An almost defining characteristic of adulthood is a adulthood is a willingness to confront willingness to confront the unpleasantness of lifethe unpleasantness of life, from the , from the niggling to the cataclysmic. … You niggling to the cataclysmic. … You have to face up to unpleasant have to face up to unpleasant realities. That’s what it means to be realities. That’s what it means to be a grown-up.a grown-up.

DeMarco & ListerDeMarco & Lister



SEI Continuous Risk MgmtSEI Continuous Risk Mgmt

Process includes:Process includes:

• identify risk factorsidentify risk factors i.e., risks, indicators, i.e., risks, indicators,

and root causesand root causes

• classify, assess and prioritizeclassify, assess and prioritize factors factors

• developdevelop and execute and execute aa risk management risk management

strategystrategy

• monitormonitor factors and strategy factors and strategy

• adjustadjust strategy, strategy, journaling journaling causes and causes and

adjustmentsadjustments

• communicatecommunicate activities and results activities and results



Project Risk FactorsProject Risk FactorsPeoplePeople SponsorsSponsors ManagementManagement SupportSupport SkillsSkills Head countHead count Under-performanceUnder-performance PoliticsPolitics ConflictConflict

SystemSystem RequirementsRequirements DesignDesign Interaction with environmentInteraction with environment InnovationInnovation ScaleScale

ProjectProject ScheduleSchedule BudgetBudget

ChangeChange TurnoverTurnover Scope creepScope creep




1. Reqts Risk1. Reqts Risk


3. Safety Tactics3. Safety Tactics (48) (48)



Categories of Safety TacticsCategories of Safety Tactics

1.1. AvoidAvoid reqts-based failures reqts-based failures

2.2. MitigateMitigate impact of reqts-based impact of reqts-based

problemsproblems

3.3. MiniMinimizemize reqts-based problems reqts-based problems

4.4. MonitorMonitor reqts status reqts status

5.5. StaffStaff for reqts development for reqts development

6.6. PlanPlan for reqts risk mgmt for reqts risk mgmt

7.7. PreparePrepare for reqts risk mgmt for reqts risk mgmt

8.8. CompensateCompensate for reqts-based for reqts-based

problemsproblems

Thinking Outside the (Reqts) Box



1. Avoid Reqts-based 1. Avoid Reqts-based FailuresFailures

Reconfirm reality and Reconfirm reality and satisfiability of stated needssatisfiability of stated needs

Triage and prioritize reqtsTriage and prioritize reqts

Manage customer expectationsManage customer expectations

Reconfirm project feasibilityReconfirm project feasibility

Identify and resolve conflicts Identify and resolve conflicts earlyearly

Commit incrementallyCommit incrementally



2. Mitigate Impact 2. Mitigate Impact of Reqts-based Problems of Reqts-based Problems

Require frequent demos of Require frequent demos of understandingunderstanding

Decouple vision from buildDecouple vision from build

Prototype unfamiliar functions Prototype unfamiliar functions and interfacesand interfaces

Build in multilane cyclesBuild in multilane cycles

Mitigation saves money (by definition)



3a. Minimize Comm Problems3a. Minimize Comm Problems – – part 1part 1

Maintain a climate of Maintain a climate of personal safety and personal safety and respectrespect

Use Use rich definitionsrich definitions

Use algebraic formulasUse algebraic formulas rather than “magic rather than “magic numbers”numbers”



Personal Safety and RespectPersonal Safety and Respect

Acknowledge personality typesAcknowledge personality types

No fear of disrespect or reprisalNo fear of disrespect or reprisal

Enables:Enables:– truth telling truth telling – voicing concernsvoicing concerns– “ “don’t knows”don’t knows”



Derived Conditions Derived Conditions (modified nouns)(modified nouns)

Derived conditionsDerived conditions name collections name collections of one or more logical expressions of one or more logical expressions (joined by (joined by ANDANDs and s and OrOrs) s)

potential customerpotential customer = =

bought-many-services or bought-many-services or

bought-services-A-and-B orbought-services-A-and-B or

bought-a-lot-of-service-Cbought-a-lot-of-service-C

bought-many-servicesbought-many-services = =

total-invoiced-service-types > 5total-invoiced-service-types > 5

bought-services-A-and-Bbought-services-A-and-B = =

invoiced-for-service-A invoiced-for-service-A

and invoiced-for-service-Band invoiced-for-service-B

bought-a-lot-of-service-Cbought-a-lot-of-service-C = =

invoiced-amount-for-service-C > invoiced-amount-for-service-C > $500,000.00$500,000.00



Project GlossaryProject GlossaryRich DefinitionsRich Definitions

Nouns Nouns [unmodified][unmodified] (customer, service)(customer, service)

Entity profilesEntity profilesModified NounsModified Nouns (order for service, satisfied customer(order for service, satisfied customer potential customer)potential customer)

Related entitiesRelated entitiesQuality profilesQuality profilesDerived valuesDerived valuesDerived conditionsDerived conditions

Verbs, Post-modifiedVerbs, Post-modified ((identify customers)identify customers)

Action contractsAction contractsDerived tasksDerived tasks

Verbs, PremodifiedVerbs, Premodified ((accurately identify, reliably processaccurately identify, reliably process))

Quality profilesQuality profilesEventsEvents ((accurately identify potential customersaccurately identify potential customers

for our new web-based order for our new web-based order management systemmanagement system))

Event profilesEvent profiles

Common DefinitionsCommon DefinitionsPlain definitionsPlain definitionsAcronymsAcronyms



Algebraic FormulasAlgebraic Formulas

Example:Example:

TCAS shall provide collision TCAS shall provide collision avoidance protection for any two avoidance protection for any two commercial aircraft (commercial aircraft (excludingexcluding the the Concorde) closing horizontally at a Concorde) closing horizontally at a rate up to rate up to

max-horiz-closing max-horiz-closing ( = ( = 2 max-air-speed2 max-air-speed; ; currentlycurrently max-air-speed = max-air-speed = 600 knots) 600 knots)

and vertically at a rate up to and vertically at a rate up to max-vert-closing max-vert-closing

( = ( = max-control-descent + max-control-descent + max-climbmax-climb; ; currentlycurrently max-control-descent max-control-descent = 5000 fpm = 5000 fpm and max-climb = 4000 fpm)and max-climb = 4000 fpm)



3a. Minimize Comm Problems3a. Minimize Comm Problems – – part 2part 2

Create user personasCreate user personas

Clarify with examples and Clarify with examples and measuresmeasures

Structure informationStructure information with spec patterns -- avoid with spec patterns -- avoid text blockstext blocks

Picture reqts infoPicture reqts info

Capture contextCapture context



Structure Info with ModelsStructure Info with Models

ContextContext

• Inter-actorsInter-actors

• Boundary data flowBoundary data flow

• InterfacesInterfaces

UsageUsage

• User StoriesUser Stories

• Use CasesUse Cases

• Usage ScenariosUsage Scenarios

• Acceptance TestsAcceptance Tests

BehaviorBehavior• Decision Tables

• Trigger-Response Tables

• State Transition Tables



Picture Reqts InfoPicture Reqts Info DiagramsDiagrams

– entityentity– entity-relationshipentity-relationship– concept mapsconcept maps– reqts graphreqts graph– usage contextusage context– usageusage– scenarioscenario– collaborationcollaboration– sequencesequence– activityactivity– statestate

MockupsMockups– screensscreens– data displaysdata displays– reportsreports

SimulationsSimulations– process flow (scenario)process flow (scenario)– screen flowscreen flow



Now What?Now What?

Goal: Goal: Reduce reqts-related riskReduce reqts-related risk by changing stakeholder by changing stakeholder understanding and thereby understanding and thereby behaviorbehavior

Question -- Are your reqts Question -- Are your reqts info and process satisfactory? info and process satisfactory? How do you know?How do you know?

Learn (and remember) Learn (and remember) how to accurately how to accurately

forecastforecast danger (i.e. danger (i.e. what to fear)what to fear)

Use relevant tactics to Use relevant tactics to develop your RRM strategydevelop your RRM strategy

Monitor reality and adjustMonitor reality and adjust



BUT, it won’t be easyBUT, it won’t be easy

Risk management is the Risk management is the least practiced of all project least practiced of all project managementmanagement disciplinesdisciplines across across all industry sectors, and nowhere all industry sectors, and nowhere less applied than the IT industry.less applied than the IT industry.

Robert Charette Robert Charette

quoting a PMI studyquoting a PMI study



Checkout Checkout

technical paperstechnical papers at at www.clearspecs.comwww.clearspecs.com

Email Email

questions questions andand commentscomments to to [email protected]@clearspecs.com

ClearSpecs Education 1 Development with Seatbelts: Controlling Reqts Risk David Gelperin ClearSpecs...

Documents

Transcript of ClearSpecs Education 1 Development with Seatbelts: Controlling Reqts Risk David Gelperin ClearSpecs...