Page 128 - Navy Journal 219

Navy Journal 2019

of how much V & V is enough ? The fundamental concept of RM is the concept
of Risk Exposure (RE) or Risk Impact. RE is an indicator to rationalize the
required V & V activities. RE is defined by the relationship,
RE = Prob(UO) * Loss(UO) , where Prob(UO) is the probability of an
unsatisfactory outcome and Loss(UO) is the loss to the parties affected if the
outcome is unsatisfactory.
The unsatisfactory outcome (UO) can be seen as the error which causes an
operational loss to the client as well as to the development firm. If a project does
little V & V then the probability of an operational error rises. Now, the level of
acceptance of this error depends on the functionality of the software or intended
project. For example, relatively low error in the software controlling nuclear
power plant can result catastrophic loss of human life as well as environment.
Thus for sophisticated software, significant amount of time and money is
allowed for the V&V activities (Boehm, Software Risk Management, 1989).
Considering the trade off between the cost of V&V and RE, it is suggested that
V&V should be a part of an integrated risk reduction strategy. Other sources of
unsatisfactory outcome for a software project besides the risk of operational
damage include overrunning budget and schedule; unsatisfactory functionality or
performance requirement; or developing software which is hard to modify or use
in other situations. It is seen from the observation of BN software development
projects that these other factors of runway project, unsatisfactory functionality,
performance requirement are much more applicable in our case. The main
concern or software RM as a discipline is to identify the sources of risk, to assess
the relative priorities through V&V activities. The successful assessment will
result a balanced and integrated strategy for mitigating the pitfalls or risk factors.
To do so Boehm explained six steps in software RM which are subdivided into
two classes of ‘Risk Assessment’ and ‘Risk Control’ as shown in figure 4. Risk
assessment involves the activities of risk identification, risk analysis, and risk
prioritization. On the other hand, risk control is the accumulation of risk
management planning, risk resolution, and risk monitoring. Having more
significance and importance in BN, risk identification and risk management
planning will be briefly described.

120