Yossi Lichtenstein

Test program generation for functional verification of PowerPC processors in IBM

A new methodology and test program generator have been used for the functional verification of six IBM PowerPC processors. The generator contains a formal model of the PowerPC architecture and a heuristic data-base of testing expertise. It has been used on daily basis for two years by about a hundred designers and testing engineers in four IBM sites. The new methodology reduced significantly the functional verification period and time to market of the PowerPC processors. Despite the complexity of the PowerPC architecture, the three processors verified so far had fully functional first silicon.

Business familiarity as risk mitigation in software development outsourcing contracts

This study examines the role of business familiarity in determining how software development outsourcing projects are managed and priced to address risks. Increased business familiarity suggests both more prior knowledge, and hence reduced adverse selection risk, and increased implied trust about future behavior, and hence implied reduced moral hazard risk. Preferring high business familiarity partners may also alleviate concerns about incomplete contracts. By reducing these risks, higher business familiarity is hypothesized to be associated with higher priced projects, reduced penalties, and an increased tendency to contract on a time and materials rather than a fixed price basis. These hypotheses were examined with objective contractual legal data from contracts made by a leading international bank. Integrating trust theory into agency theory and into incomplete contract theory and examining unique contract data, the contribution of the study is to show that the premium on business familiarity and the trust it implies is not in directly affecting price, but, rather, in changing how the relationship is managed toward a tendency to sign time and materials contracts. Implications about integrating trust into agency theory and incomplete contract theory, as well as implications regarding trust premiums and software development outsourcing, are discussed.

Real options in information technology risk management: an empirical validation of risk-option relationships

Recently, an option-based risk management (OBRiM) framework has been proposed to control risk and maximize value in information technology investment decisions. While the framework is prescriptive in nature, its core logic rests on a set of normative risk-option mappings for choosing which particular real options to embed in an investment in order to control specific risks. This study tests empirically whether these mappings are observed in practice. The research site is a large Irish financial services organization with well established IT risk management practices not tied to any real options framework. Our analysis of the risk management plans developed for a broad portfolio of 50 IT investments finds ample empirical support for OBRiMs risk-option mappings. This shows that IT managers follow the logic of option-based risk management, although purely based on intuition. Unfortunately, reliance on this logic based on intuition alone could lead to suboptimal or counterproductive risk management practices. We therefore argue that managerial intuition ought to be supplemented with the use of formal real option models, which allow for better quantitative insights into which risk mitigations to pursue and combine in order to effectively address the risks most worth controlling.

Coverage-Directed Test Generation Using Symbolic Techniques

In this paper, we present a verification methodology that integrates formal verification techniques with verification by simulation, thereby providing means for generating simulation test suites that ensure coverage. We derive the test suites by means of BDD-based symbolic techniques for describing and traversing the implementation state space. In our approach, we provide a high-level of control over the generated test suites; a powerful abstraction mechanism directs the generation procedure to specific areas, that are the focus for verification, thereby withstanding the state explosion problem. The abstraction is achieved by partitioning the implementation state variables into categories of interest. We also depart from the traditional graph-algorithmic model for conformance testing; instead, using temporal logic assertions, we can generate a test suite where the set of state sequences (paths) satisfies some temporal properties as well as guaranteeing transition coverage. Our methodology has been successfully applied to the generation of test suites for IBM PowerPC and AS/400 systems.

Industrial experience with test generation languages for processor verification

We report on our experience with a new test generation language for processor verification. The verification of two superscalar multiprocessors is described and we show the ease of expressing complex verification tasks. The cost and benefit are demonstrated: training takes up to six months; the simulation time required for a desired level of coverage has decreased by a factor of twenty; the number of escape bugs has ken reduced.

Puzzles in software development contracting

Current outsourcing practices are relatively unsophisticated in comparison with the techniques prescribed by economic theory. Customers end up bearing all long-term risk, and vendors have no direct incentive to achieve long-term system effectiveness.

Fully abstract denotational semantics for flat Concurrent Prolog

A denotational, hence, compositional semantics for a subset of Concurrent Prolog is developed and related to an operational semantics. The denotational semantics makes divergence and the resultant substitutions of finite computations together with the termination mode-success, failure, or deadlock-observable. Relative to this notion of observation it is proved that the denotational semantics is fully abstract in the sense that it records the minimal amount of extra information beyond the observables to make it compositional. Full abstraction is an important property because it quantifies the information that one needs in order to reason about individual program-parts independently. This is believed to be the first such result in the area of concurrent logic programming.<<ETX>>

Concurrent algorithmic debugging

Algorithmic Debugging is a theory of debugging that uses queries on the compositional semantics of a program in order to localize bugs. It uses the following principle: if a computation of a programs component gives an incorrect result, while all the subcomputations it invokes compute correct results, then the code of this component is erroneous. Algorithmic Debugging is applied, in this work, to reactive systems, in particular to programs written in Flat Concurrent Prolog (FCP). Debugging reactive systems is known to be more difficult than the debugging of functional systems. A functional system is fully described by the relation between its initial input and final output; this context-freedom is used in debugging. A reactive system continuously responds to external inputs, thus its debugging cannot make use of context-free input/output relations. Given a compositional semantic model for a concurrent programming language, we demonstrate how one can directly apply the ideas of Algorithmic Debugging to obtain a theory of program debugging for the considered language. The conflict between the context-freedom of input/ output relations and the reactive nature of concurrent systems is resolved by using semantic objects which record the reactive nature of the systems components. In functional algorithmic debugging the queries relate to input/output relations; in concurrent algorithmic debugging the queries refer to semantic objects called processes which capture the reactive nature of FCP computations. A diagnosis algorithm for incorrect FCP programs is proposed. The algorithm gets an erroneous computation and using queries isolates an erroneous clause or an incomplete procedure. An FCP implementation of the diagnosis algorithm demonstrates the usefulness as well as the difficulties of Algorithmic Debugging of FCP programs.

Ex post adaptations and hybrid contracts in software development services

We follow the recent literature on ex post adaptations in procurement and argue that highly volatile specifications result in multiple variations of fixed price (FP) and time and materials (T&M) contracts. Specifically, placing a cap on specification change in FP contracts prevents specification volatility, similar to the way that placing a cap on the price in T&M contracts prevents price escalation. We argue that these hybrid mechanisms are particularly important in software development contracting, a new critical business capability involving frequent and costly ex post adaptations to specification change. The level of completeness in these contractual archetypes is hypothesized to be determined by contracting costs and benefits, where costs are related to project uncertainty and benefits are related to the likelihood of vendor opportunism. We test this hypothesis with a unique data set of 270 software development contracts entered into by a leading international bank. The analysis confirms the existence of multiple hybrid contracts that mitigate both price escalation and specification volatility. It also shows that contracting costs and benefits explain more variance in contract choice when these hybrids are included, uncovering the detailed mechanisms used to curb opportunism when the vendor is less familiar to the client.

Looking for the Locus of Innovation in New Service Development

Although services are the main growth engine in modern economies, there is evidence that new service development practices are ineffective. In this exploratory study, we look at the organizational roles that participate in the different stages of service innovation. We expect to find multiple roles in the creation, development and deployment of innovation in services. We suggest that this fuzziness of the locus of innovation may explain some of the difficulties in service innovation. We interviewed six senior executives in European service organizations about their recent major innovations. The data on twenty five innovations, support our main expectation that service innovation involves many organizational roles and typically aggregates more functions as the innovation process progresses. We find also that customers and customer facing functions are not central to innovation, that R&D and business development do not create but mostly develop innovations, and that top executives participate in the creation of new services and processes