Sept Software Research and Technology Infusion 2007 Software Assurance Symposium

Sept Software Research and Technology Infusion Goal: Transfer mature Software Engineering and Software Assurance technologies into practice –Provide a reduced risk approach to evaluating: u Technologies derived from NASA-sponsored research u Other new and innovative SE/SA tools and technologies Approach –Present selected SW technologies to the NASA software development/assurance community –Encourage and support collaborations between the technology providers and NASA software developers and assurance personnel.

Sept Motivation Encourage the uptake of new research results and technologies within the NASA missions Facilitate the transfer of technology through collaborations between technology providers and end-users who have a need for the technology Establish and monitor infusion projects and use lessons learned to improve the uptake of new technologies within NASA

Sept Obstacles to Research Infusion “gap” between interpretations of adequate maturity; Risk-aversion of most NASA developers and most NASA projects; Lack of evidence to demonstrate benefits (analyses, ROI, etc.); Practitioners are not always aware of new and relevant technologies available to them; Fragmented practitioner community.

Sept Overcoming Obstacles Information Gathering; Information Dissemination; Brokering Collaborations.

Sept Information Gathering Focus on research/technologies that: 1.Have particular relevance to software assurance. 2.Can be incorporated into existing software development practices with a minimum of disruption. 3.Are mid- to high-TRL (or PF) research, demonstrating success on a real project, and ready for use more or less “as-is”. 4.Are either NASA-funded research results or technologies that address needs identified by NASA software developers. 5.Robust and mature with good user documentation 6.Not currently in widespread use within the agency

Sept Information Dissemination Via the Research Infusion team’s website; Via direct contact with developers and assurance personnel; Via direct “marketing” ( , telephone); Via NASA-wide WebEx(s).

Sept Brokering Collaborations Annual NASA-wide proposal solicitation; A small number (+/- 10) of technologies are presented via NASA-wide announcements; Interested parties are encouraged to submit a proposal, and offered guidance in writing their proposal; Introductions are made between the proposal writers (the NASA developers or QA) and the technology provider, and they are encouraged to work closely in writing the proposal.

Sept Proposal Selection Process Follow a defined and repeatable process –Solicitation announced and promoted –Collaborations brokered and proposals submitted –Each RI team member reviews & evaluates all proposals u Numerical u Qualitative –Evaluations were combined, questions and concerns noted –Communicated concerns and got feedback from proposal teams –Subsequent evaluation meetings held: rankings finalized –Ranking summarized and provided to OSMA and OCE for endorsement Duration ~4 months –Idea is to address the need while it still exists

Sept Impact across NASA

Sept Completed Projects TechnologyTechnology ProviderTechnology DescriptionCustomer Sites and Target Applications Outcome/Benefits Perspective-based InspectionsFraunhofer Maryland, SARPSoftware Manual Inspection Technique GSFC (Spacecraft FSW) USA (ISS power analyzer) Defects found in legacy code and that escaped previous inspections. Adopted. Software Cost Reduction (SCR) Naval Research LaboratoryRequirements Analysis ToolsARC (ISS Payload)Personnel trained. Reqts validated. SpecTRMSafeware Engineering Corp. & MIT Requirements Capture and Analysis JPL (Capture of Mission Design Rationale) Personnel trained. MIT student hired. Orthogonal-Defect Classification JPL, SARPProcess Improvement Methodology JPL (Ground SW)SQA and project personnel trained. CodeSurfer/CodeSonarGrammatech, Inc.Reverse Engineering/defect detection JSC (ISS, Shuttle), IVVF (Spacecraft FSW) Found defects that escaped previous inspections. C Global Surveyor (CGS)ARC – Intelligent Systems Program Software defect detection toolARC (ISS science payload) MSFC (ISS payload) Found defects. Good feedback to provider. Coverity SWAT/PreventCoverity, Inc.Software defect detection toolMSFC (ISS, Shuttle FSW)Found defects that escaped testing. Will be adopted. Klockwork InspectKlockwork, Inc.Static code analysis toolJPL (Mission Planning SW)Found defects. Expressed interest in using again.

Sept New FY07 Research Infusion Projects ProjectTechnologyCustomer Sites Infusion of Perspective-Based Inspection in NASA IV&V Perspective Based InspectionNASA IV&V Facility Supporting Model-Based Systems and Software Engineering with SpecTRM SpecTRMJPL Technology Infusion of CodeSonar into the Space Network Ground Segment at Goddard Space Flight Center’s White Sands Complex CodeSonarGSFC White Sands Technology Infusion of SDA into the MOD Software Development Process Software Developers Assistant (SDA) JSC Technology Infusion of SAVE into STRS Architecture Compliance Verification at GRC Software Architecture and Evaluation Toolset (SAVE) GRC Infusion of Requirements Assistance into CEV IV&V Validation Activities Requirements Assistant (RA)NASA IV&V Facility

Sept FY08 Research Infusion Emphasize the needs based approach to infusion –Will work with the NASA projects to better understand their needs u Needs will serve as the basis for offering up both research and commercial technologies Continue to learn from previous experiences –Understand successes and failures of previously offered technologies u If the infusion wasn’t successful what needs to be improved (either in the process or the technology)? u If the project was successful what did we do right?

Sept FY08 Research Infusion Communicate opportunities –Promote new technologies to be offered u Challenge the center reps to broadly disseminate technology offerings –Conduct F2F discussions –Promote early discussions between the project personnel and the technology developers Communicate results –Promote the results of the infusion projects inside and outside of NASA u Many infusion projects were successful on a single project u Need to promote results using this empirical data –Need to disseminate these successes to other projects to help support the idea that the technology is “proven” –Understand there is still risk associated with the technology

Sept Conclusions and Future Direction We consider the Research Infusion activity to have been a success, and it will continue with increased funding A modest approach has achieved significant results with only small budgetary requirements We anticipate keeping largely the same procedure for soliciting projects, selecting projects, and evaluating progress We will place a greater emphasis on identifying needs and increasing communication