COTS and OSS – What is it? M. Morisio, M. Torchiano Politecnico di Torino – Italy {morisio, Seminar on CBSE An industrial study in Norway, Germany and Italy Simula Research Lab., Oslo, 4 Feb. 2005

February 4, Back to basics  COTS Commercial Off the Shelf  OSS Open Source Software  In a word, not developed in the project  OTS (Off-The-Shelf) to identify both

February 4, What do we know about OTS?  Use of (C)OTS (products, components) increases  COTS based development radically different from traditional development  Evaluation and selection  Integration, adaptation  Uncontrollable evolution of COTS and its effect on system

February 4, But for ‘real’ users  What is a COTS component?  How common is COTS based development?  Process  What is the process used in industry?  Risks  What are the main risk factors?

February 4, Studies  Maryland, ( )  COTS interviews 1, COTS process  COTS interviews 2, hard and easy  COTS definition1  Norway + Italy, (2002)  COTS interviews 3, six theses  COTS definition 2  Norway + Italy +Germany, (this one)  OTS survey (goal 150 respondents)

February 4, COTS definition (2001)  Should consider  Where developed (inside outside company or business unit)  Rights (copyright, copyleft, ownership)  Cost  Customization –Possible –required  Type of interface (API,.., none)  Type of packaging (source code, DLL, exe)  Size Morisio, Torchiano, Definition and classification of COTS: a proposal, ICCBSS 2002

February 4, COTS definition (2002)  it is not produced here,  within these projects nor exclusively for them;  it may be closed-source as well as open source,  open source software usually treated as if it were closed;  it is not a commodity,  not shipped with the operating system, nor provided with the development environment, nor generally included in any pre-existing platform;  it is integrated into the final delivered system,  it is not a development tool;  it is not controllable  in terms of provided features and their evolution.

February 4, Counter-COTS (2002)  Investigating 7 SMEs in Norway, Italy  Structured interviews  Two quite different contexts  Pretty good chance to generalize  Findings often in contrast with common belief  Theses for further research Torchiano, Morisio, Overlooked facts on COTS based development, IEEE Software 2004

February 4, Open-source (OSS) vs. COTS  Belief:  Open-source software is very different from closed source software  Finding:  Open-source software is often used as closed source

February 4, Architecture and COTS  Common Belief:  Architectural mismatches are the main hurdle in composing systems from existing components  Finding:  Integration problems result from lack of standard compliance; architectural mismatches constitute a secondary issue

February 4, Custom code and COTS  Common Belief:  Custom code is mainly devoted to providing additional functionalities  Finding:  Custom code plays, overall, an integration role

February 4, Selection  Common Belief:  COTS components are selected (or should be) through a formal selection procedure  Finding:  Formal selection procedures are seldom used. Familiarity either with the product or with the generic architecture is the key factor in selection

February 4, Requirements / Architecture  Common Belief:  Requirements drive all renegotiation processes involving COTS products  Finding:  Architecture is more important than requirements for product selection

February 4, Vendor Control and COTS  Common Belief:  Lack of control over the vendor must be accepted passively  Finding:  There is a tendency to increase the level of control over the vendor whenever possible

February 4, Summing up  COTS and OSS can be probably considered under same heading for many respects  Risks and issues possibly common  Need for larger investigation