Verum white paper Analytical Software Design Case Nucletron uses ASD to reduce development and testing times for Cone Beam CT Scan software Author(s): R. Wiericx and L. Bouwmeester Version: 2.0, 12/05/2009 Copyright 2009 Verum Consultants BV Page 1 of 10
Executive Summary In this Analytical Software Design (ASD) case, Nucletron BV used ASD to verify the existing design of the Computed tomography (CT) Acquisition and Reconstruction Process Layer for use case Acquire and Reconstruct CT Volume. As a leader in radiation oncology, Nucletron continually searches for ways to reduce development time and improve quality of their software products. The company already used UML but Verum s Analytical Software Design (ASD) [1] was seen by Nucletron as a possible way to further realize these goals. Therefore, Nucletron started a case study to evaluate ASD and to verify the benefits of ASD. ASD led to an increase in productivity from 3 to 17 LOC per man-hour and a reduction in the number of defects from 6 to zero. The case study results can be summarized as follows: Nucletron completed and formally verified parts of the existing design of the CT Acquisition and Reconstruction Process Layer Nucletron established that with ASD it is easy to create asynchronous designs that behave correctly under all circumstances and are deadlock free Applying ASD led to an increase in productivity from 3 to 17 LOC per manhour and a reduction in the number of defects from 6 to zero for all components generated with ASD:Suite. For the relatively small part of the system designed with ASD, costs were reduced by 75%. In conclusion, the case study has proved that using ASD to formally verify software components indeed results in a reduction of development effort and improves software quality, and thereby decreases cost. These additional benefits were achieved even though Nucletron was using UML, proving that organizations already using sophisticated software development methods can benefit from ASD. As a result of this case study, Nucletron is very enthusiastic about the benefits of ASD. For new software products with complex behaviour, Nucletron plans to use ASD. Nucletron concluded: If we had used ASD for the project, we would have saved one man year of effort out of three. Berthold Hutten, Software architect at Nucletron After a steep learning curve, the creation of ASD interfaces and designs became quite easy and fast. Cis van Heerde, Application Designer at Nucletron Copyright 2009 Verum Consultants BV Page 2 of 10
1 Introduction Nucletron is the knowledge-driven leader in radiation oncology and is committed to developing solutions focused on improving patient care. Nucletron is specialized in the development, manufacture, sales, service and support of the world's most innovative cancer treatment products, and partners actively with its customers to provide the most effective and efficient patient care options. As a leader in radiation oncology, Nucletron continually searches for ways to reduce development time and improve quality of their software products. Verum s Analytical Software Design (ASD) [1] was seen by Nucletron as a possible way to further realize these goals. To learn more about the possibilities of ASD:Suite tooling and its underlying technology, Nucletron carried out a case study in which ASD was applied to a small but representative software component. The main objectives of the case study were: To verify the benefits of ASD. The most important benefits of interest to Nucletron were: o o Reducing time, cost and scope overruns by ensuring specifications are complete and thereby reducing the need for rework Further increase of software quality To find out whether ASD modeling helps in verifying the correctness of their software To find out whether ASD modeling is useful and practical for their software This paper presents an overview of how ASD was applied to the case study and draws conclusions based upon the objectives stated above. Copyright 2009 Verum Consultants BV Page 3 of 10
2 Current situation One of Nucletron s innovative cancer treatment products is the Oncentra ConeBeam application. ConeBeam technology is a breakthrough method of acquiring and reconstructing CT images from 3D isotropic data. Used in conjunction with an image detector on a radiotherapy simulator, it creates a unique radiation-therapy imaging tool that can perform conventional, virtual and CT-assisted simulation. This case study was applied to the existing design of the Oncentra ConeBeam application. In particular, the use case Acquire and Reconstruct CT Volume was chosen as a subject for this case study. To realize this use case, Nucletron originally designed the existing software as shown in the following figure. View Domain CT Acquisition Process and Reconstruction Layer <<interface>> IAcquireReconstructHandler <<ASD>> AcquireReconstructHandler <<ASD>> ReconstructionHandler <<ASD>> StorageHandler 1 1 1 1 1 <<interface>> IPositionServer <<interface>> IAcquisitionServer <<interface>> IReconstructionServer PositionServer AcquisitionServer ReconstructionServer Figure 1 - CT Acquisition Process and Reconstruction Layer Figure 1 shows the software decomposition of the CT Acquisition Process and Reconstruction Layer, which contains the following components: Acquire Reconstruct Handler: This is the main controller of the use case Acquire and Reconstruct CT Volume and its responsibility is to prepare the Position Server and the Acquisition Server. Copyright 2009 Verum Consultants BV Page 4 of 10
Reconstruction Handler: Its responsibility is to reconstruct the acquired projections into proper CT images. Storage Handler: Its responsibility is to store the reconstructed slices as CT images. In the existing implementation, the CT Acquisition and Reconstruction Process Layer executes in a single-threaded environment. This design choice imposes the restriction that a proper abort of an ongoing action is impossible. The alternative of a completely asynchronous design was considered as too difficult by Nucletron and was therefore not used. In the final design, the Abort and Finish functionality of the components were the only elements implemented asynchronously....to achieve a minimum level of reliability, considerable effort was spent on testing 2.1 Nucletron s conventional approach Nucletron used a waterfall like approach to develop the use case Acquire and Reconstruct CT Volume. The design was decomposed into 3 components as depicted in Figure 1. During the design phase of these 3 components, Nucletron applied a structured approach using UML tooling to specify the functional requirements in terms of stimuli and responses. For the creation of the designs, Nucletron used an enumerated approach; the behaviour of the designs was described in a tabular form. Validation of the original design was performed by manual execution of an extremely large test set on a real system, which revealed incorrect and illegal behaviour. After thorough analysis of the incorrect behaviour, the design was modified and tested again. This process was repeated until all tests passed. The result was a largely reliable system. Although Nucletron followed a structured approach, the completeness of their design was not guaranteed. Their approach also did not address the correctness of their designs. Furthermore, to achieve a minimum level of reliability, considerable effort was spent on testing. Although the system was largely reliable, field errors occasionally occurred. Copyright 2009 Verum Consultants BV Page 5 of 10
3 Method For the case study, the ASD:Suite was used to model and formally verify the existing behaviour of the original Storage Handler and Reconstruction Handler components. The first step was to describe the existing interfaces of these components as ASD interface models. These interface models were derived from the software analysis & design document [2] and the existing implementation. The second step was to make the ASD design models of the Storage Handler and the Reconstruction Handler component. 3.1 Storage Handler component The ASD design of the Storage Handler component required minor modifications because the original design mixed control and data, whereas ASD implements a strict separation of data and control. The ASD design of the Storage Handler component was formally verified with the ASD:Suite tooling. 3.2 Reconstruction Handler component The ASD design of the Reconstruction Handler component was changed from the original design due to differences in the threading models implemented by the original design and ASD. The existing design is based on a single thread using synchronous call-backs, whereas ASD implements a threading model where call-backs are decoupled and processed using an additional thread. Copyright 2009 Verum Consultants BV Page 6 of 10
4 Results...Nucletron concluded that ASD provides an easy way to create asynchronous designs that behave correctly under all circumstances and are guaranteed free of dead-locks, livelocks and race conditions. Since Nucletron already used an enumerated approach for their designs, the creation of ASD interface and design models was a straightforward task. The application of ASD ensured the requirements were complete, but did not reveal any new requirements. The Storage Handler component was based on a synchronous design which is generally considered to be simple to implement. However, the ASD:ModelChecker revealed that such a simple design contained more than 300 different execution scenarios. Further, the ASD:ModelChecker revealed: 1. A serious race condition on the interface, which was resolved 2. A live-lock in the design caused by the original implementation that determines when storage has finished. This is often an indication that the design is not complete. Although the design of the Reconstruction Handler component was not formally verified, Nucletron concluded that ASD provides an easy way to create asynchronous designs that behave correctly under all circumstances and are guaranteed free of dead-locks, live-locks and race conditions. ASD implements a clear separation between data and control. Nucletron realized that this makes decisions on control flow visible and explicit, and therefore results in an architecture or component description with a high level of precision. Copyright 2009 Verum Consultants BV Page 7 of 10
5 Conclusions 5.1 Applying ASD leads to higher software quality and reduces development effort and costs Nucletron found that using ASD leads to higher quality software with lower costs in a significantly shorter time. The table below shows the time and cost to develop the components the conventional way, without ASD and using ASD. The table clearly shows: An increase in productivity from 3 to 17 LOC per man-hour A cost reduction of 75% Finally, the number of defects has reduced from 6 to 0 for all components generated with ASD, which reduces the cost of non-quality and prevents possible field recalls. Although applied to a relatively small part of the system, the improvements in quality as well as the reduction in time and cost were already significant. Effort (Man-hours) Duration (Months) Defects Development Cost Cost of Defects Total Cost LOC per man-hour Without ASD 621 5 6 45.187,88 11.184,00 56.371,88 3 ASD 112 1 0 8.145,45 6.021,30 14.166,75 17 Both delivered 1.864 lines of C#. Duration assumes one user. Saving: 75% 5.2 ASD modeling is useful and practical The maturity of Nucletron s development approach made adopting ASD straightforward, which helped shortening the learning curve of ASD. Nucletron concluded that after a steep learning curve, the creation of ASD interfaces and designs became quite easy and fast. 5.3 Applying ASD guarantees the correctness of designs For applications with complex behaviour, Nucletron experienced the real added value in the usage of ASD. The ASD:ModelChecker revealed a serious race condition and live-lock in the current Storage Handler component. Copyright 2009 Verum Consultants BV Page 8 of 10
The case study has also shown that ASD provides an easy way to create complex asynchronous designs that behave correctly and are guaranteed to be free of dead-locks, live-locks, and race conditions. Copyright 2009 Verum Consultants BV Page 9 of 10
6 About the authors Ronald Wiericx is ASD consultant working at ICT Embedded BV, a full subsidiary of ICT Automatisering NV, a leading IT company, employing 1,000 people across various countries. Leon Bouwmeester is managing consultant at Verum Consultants BV. Acknowledgements We are grateful to Nucletron for allowing us to present this case and for their cooperation when we applied ASD to verify the Acquisition and Reconstruction Process layer for ConeBeam CT scan. References [1] An introduction to ASD, http://www.verum.com/resources/papers.html [2] SMX-114/3052-02, CT Acquisition & Reconstruction Process Layer Software Analysis & Design. Copyright 2009 Verum Consultants BV All rights are reserved. No part of this publication may be reproduced in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior written permission of the copyright owner. Copyright 2009 Verum Consultants BV Page 10 of 10