An introduction to the notion of large-scale complex IT systems

1. Large-scale Complex IT Systems Prof. Ian Sommerville

2. St Andrews Small Scottish town, on the north-east coast of the UK Home of golf Scotland’s oldest university (founded in 1413) Small university focusing on research and teaching excellence

3. About me Background in traditional software engineering Author of widely-used textbook in this area Now primarily interested in human, social and organisational influences on software systems design and dependability

4. Objectives To introduce the notion of an LSCITS and to explain the differences between an LSCITS (large-scale complex IT system) and an LSITS (large-scale IT system) To explain why it is difficult to establish an unambiguous definition of an LSCITS and to describe characteristic features of an LSCITS that may be used to decide whether or not a large system is an LSCITS To explain why the characteristic features of an LSCITS lead to complexity

5. Computing systems Definitions of different types of computing system

6. Systems and programs Program A single executable entity that operates on a computing platform System One or more programs that are intended to work together to deliver functionality to support some organisational purpose Systems of systems A set of systems that work together to serve some organisational purpose, which is usually broader than can be supported by a single system System portfolios A set of systems, some of which may work together as systems of systems Socio-technical systems A set of systems plus organisational processes, policies, standards and procedures that are used in operating these systems

7. Program A set of instructions that can be executed by a computer without other programs e.g. the calculator on an iPhone, a video game, MS Word. Normally, a program has defined functionality and makes use of the services provided by an operating system to interface with the computer hardware and (sometimes) with middleware to access databases and other computers. All seems simple and straightforward but: The program may depend on external libraries and components and have no control over their evolution or non-functional characteristics The program depends on the operating system and, often, other middleware and database systems. Again, the evolution of these systems may be outside the control of the program.

8. System System is an over-used term and means different things to different people My definition is: One or more programs that cooperate purposefully to help achieve some objective or goal. The key distinction between a program and a system is that the system is designed for some broader organisational purpose. So, you can think of a program as a general-purpose tool; a system might be a set of programs that is intended to support some activity, such as software engineering or tax collection. Changes to the activity supported lead to changes in the programs.

9. Systems of systems A system of systems (SoS) is a system where the elements are systems (i.e. sets of programs) rather than individual programs. The purpose of a system of systems is usually broader than that of an individual system There is a system of systems to support air traffic management There are individual systems to support flight information display, radar display, etc. SoS are more complex than systems as the constituent systems are usually independently procured and managed. They may be owned and evolved by different organisations or different parts of the same organisation.

10. System portfolios A collection of systems that is owned or used by an organisation to run its business. For example, an audit at BMW showed that they used 4500 separate programs/systems in their business. Within the collection, there are likely to be both weak and strong dependencies between different members of the collection. These dependencies are not always obvious and change to one system can have unexpected effects on other systems in the portfolio.

11. Socio-technical systems Socio-technical systems include IT systems and the social and organisational environment in which these systems are used Operators – the people who use the system Procedures and Processes – ways of working that use the IT system Policies – rules and regulations that govern work and the way that it is done Standards – definitions of how work should be done across the organisation Culture – the ways in which work is done in a local, professional and national setting

12. What is an LSCITS? Establishing the differences between a large-scale IT system (LSITS) and a large-scale complex IT system (LSCITS)

13. Large-scale IT Systems Large-scale IT systems (LSITS) are programs or systems which are (a) large in size i.e. include thousands of instructions (b) under the control of a single agency and (c) where the design of the system is not influenced by individual operating environments Typically, an LSITS deliberately limits and controls interactions with its environment to avoid uncertainty – e.g. MS Excel is an LSITS because it is (a) large – reputedly 5 million lines of code (b) controlled by Microsoft and (c) based on an set of environmental assumptions that were established by the developers of the system

15. An LSCITS model STS 1 STS 2 S2 S5 S7 S4 S1 S3 S6

16. LSCITS and SoS There is an emerging discipline of extended systems engineering concerned with systems of systems i.e. systems whose constituent parts are other systems In some cases, when people talk about a ‘system of systems’ they mean a system with the same characteristics as an LSCITS. In other cases, an LSCITS is part of a SoS. In other cases, the SoS is something that is more controlled e.g. an aircraft or a car where one authority is responsible for all of the systems that are part of the SoS. Electrical and mechanical systems have more significance. Whatever definition is used, SoS and LSCITS have much in common

17. LSCITS by example Examples of LSCITS A digital music system that provides users with the capabilities to acquire and play digital music and provides artistes with the ability to sell and distribute their music over the internet A national identity management system that maintains a database of information about citizens and provides ‘identity cards’ to authenticate citizens. The set of interacting control systems in an aircraft Examples of large systems that are not LSCITS An iPhone An image management system for medical images

18. System boundaries When you are procuring and designing a system, it is important to define the system boundaries so that you understand what is and is not part of a system. The system boundaries are used to establish the allocation of functionality: To the IT systems that are being developed To other existing or proposed IT systems To the operational processes of system use To the broader organisation Positioning the system boundary can reduce or increase complexity – so an LSITS can be a component of an LSCITS

19. A digital music system Artistes Music companies LSCITS iTunes store iTunes iPod/iPhone LSITS Music player

20. Complexity avoidance One reason why Apple have been successful in their digital music business because they have extended the boundaries of the LSITS to the sale of the digital music, so that they can control the user experience Other companies who have produced technically superior music players have failed because the LSCITS boundary has been extended downwards to include the sale and distribution of music. This added complexity to the system as a whole, which dissuaded users from interacting with the system

21. LSCITS and complexity The characteristics of an LSCITS that lead to complexity

22. Common characteristics of an LSCITS Large-scale Operational independence of the system elements Managerial independence of the system elements Geographic distribution Multi-organisational systems Multiple stakeholder viewpoints Evolutionary development Emergent behaviour Data intensive

23. System size The notion of a ‘large scale’ system is quite a difficult one to define One definition might be in terms of size of source code so a large scale system might be a system with more than 500, 000 lines (say) of source code But should this include code that is ‘reused’? What about systems of systems that are created by integrating several smaller-scale systems, with relatively little new code added? So ‘large-scale’ is a subjective notion that depends on the viewpoint of the person making the judgment

24. Operational independence Operational independence means that different systems, which may be part of an LSCITS, have been designed for separate, independent operation This means that the operation of these LSCITS components may be incompatible or error-prone Differences in user interface may mean that when switching from one system to another users are confused and make operational errors Differences in control assumptions may cause operational problems (e.g. user drives system vs system drives user) Differences in data management may make data exchange difficult or only possible at primitive levels (e.g. cut and paste)

25. Managerial independence The different components of the LSCITS may be owned and managed by different authorities These different authorities have different priorities and, often, business goals This means that the managed systems may evolve independently, without regard for the other systems that are part of the LSCITS. Those changing the system may not even realise that their system is part of a wider LSCITS

26. Geographic distribution The components of an LSCITS are often not co-located but may be located in different parts of an organisation, may be located in different organisations that are not in the same place or may be located in the ‘cloud’ This means that communication is reliant on external networking and introduces additional dependencies on the network provider It also makes it difficult to coordinate the people who are responsible for operating and evolving the different system components Even contacting the people involved in system management may be difficult or impossible

27. Multi-organisational systems Many rules enforced in different ways by different systems. No single manager or owner of the system . Who do you call when failures occur? Information is distributed - users may not be aware of where information is located, who owns information, etc. Processes involve remote actors so process reconfiguration is more difficult Restricted information channels (e.g. help unavailable outside normal business hours; no phone numbers published, etc.) Lack of trust. Owners of components will blame other components for system failure. Learning is inhibited and trust compromised.

28. Stakeholder perspectives Different stakeholders in an LSCITS will often have different perspectives on what the system boundaries (and hence the system functionality) should be Therefore, there is the potential for stakeholder conflict as each stakeholder defines the system to be what is most advantageous for them Because of professional and culture differences, any stakeholder agreement is inevitably provisional and subject to change as role holders change and organisational priorities evolve

29. Emergent behaviour Emergent behaviour is system behaviour that can only be observed when the elements of the system are integrated and the system is put into use. It cannot be predicted by analysis of the individual system elements Examples of emergent system properties are: Performance Reliability Usability A common characteristic of all of these is that they depend on the interactions between system components and the ways in which the system is used in practice

30. Data intensive Typically the data that is managed by an LSCITS is several orders of magnitude larger than the LSCITS itself E.g. consider the volume of digital music in iTunes compared to the sizes of the programs involved in managing and delivering that music to users Consequently, data storage and management is a major overhead in operating an LSCITS. The data management may be subject to external regulation E.g. personal information may not be stored outside the EU Data lifetime will, typically, far exceed the lifetime of the programs in the system and the working lifetimes of the people who established the LSCITS

31. Key points It is practically impossible to establish a simple definition of an LSCITS. You can only establish if a system is an LSCITS by examining its characteristics and comparing these to a list of LSCITS characteristics. The key distinguishing feature of an LSCITS is uncertainty. This affects both the operation and the evolution of LSCITS. The sources of uncertainty primarily derive from the organisational and operational environment of the system. LSCITS are part of broader socio-technical systems and there is a tangled relationship between an LSCITS and these socio-technical systems. The design and operation of an LSCITS must always consider the broader STS of which it is a part.