Using the Doughnut Model to Support Sustainable Quality Requirements in iStar Jennifer Horkoff1 and Tong Li2 1 Chalmers | University of Gothenburg, Sweden, 2 Technical University of Beijing, China jennifer.horkoff@gu.se, litong@bjut.edu.cn Abstract. Sustainability has become a critical topic, not only from an environmental perspective, but in the creation of software systems which are themselves sustainable. The sustainability literature has made use of the doughnut model from economics to understand the delicate balance needed for sustainable development. This model emphasizes the notion of having just the right amount of a resource (e.g., food, water) and not too much, else negative consequences (water depletion, starvation) may be felt by others in the ecosystem. Although iStar has covered well the notion of trade-offs between qualities (e.g. security vs. usability, perfor- mance vs. maintainability), the implicit aim of the work is always to maximize qualities. In this work we aim for “just enough” quality by applying the doughnut economic model to quality requirements in iS- tar. Overall, we propose a visually appealing model which emphasizes a sustainable balance between qualities. Keywords: sustainability, quality requirements, quality analysis 1 Introduction Sustainability has become a critical topic, not only from the perspective of envi- ronmental or natural sustainability, but in creating software systems which are themselves sustainable [1]. Sustainability literature has made use of the dough- nut model from economics to understand the delicate balance between desired aspects for inclusive and sustainable economic development [2]. This model em- phasizes the notion of having just the right amount of a resource (e.g., food, water) and not too much, else negative consequences (water depletion, starva- tion) may be felt by others in the ecosystem. Keeping in mind the importance of sustainable software system development, we believe that this mindset can apply well to the area of non-functional requirements (NFRs) and software qualities. Many methods exist to model and reason over the achievement of NFRs and qualities (e.g., the NFR Framework [3], iStar [4], and similar frameworks). Although this work has covered well the notion of trade-offs between qualities (e.g. security vs. usability, performance vs. maintainability), the implicit aims of the work is always to maximize the achievable qualities. Although previous work deals with satificing or satisfaction of qualities, as far as we are aware, Copyright © 2020 for this paper by its authors. Use permitted under 1 Creative Commons License Attribution 4.0 International (CC BY 4.0). existing work on requirements qualities does not consider the possibility of over- saturation of satisfaction, having too much, or more than is needed of a partic- ular quality, which may have adverse effects on other qualities (e.g., too much usability is costly, too much performance hinders modifiabilty). To create sys- tems which are sustainable, we should focus on “just enough” quality in various dimensions, in line with agile thinking and the realities of business. In this work we apply the doughnut economic model to qualities in iStar. We evaluate our idea through application to historical goal model examples, focusing on qualities, considering changes to existing reasoning techniques. By aiming to achieve just enough of various qualities, we argue that systems are easier to construct and maintain, and are therefore more likely to be successful and sustainable. Although other models for sustainable software development have been proposed (e.g., [1, 5]) they do not specifically focus sustainability- minded ways to visualize general quality requirements. In this paper, we briefly introduce the doughnut model in Sec. 2, then present our ideas via an example in Sec. 3. We discuss issues such as semantics and reasoning, including the notion of over-saturation in Sec. 4. We conclude and describe future plans in Sec. 5. 2 The Doughnut Economic Model The doughnut model combines together both planetary boundaries (climate change, land use) with social boundaries (income, education) into one holis- tic view of sustainable development [2] (see Fig. 1). In this model, the inner boundary refers to social foundations, while the outer boundary forms the envi- climate change r ac oc ye id ea la LOGICAL CEILING n e tion ECO ific n o le at oz ep st space fo io d n d ju r hu n a fe a ma L FOUNDA es OC IA TIO nit LL th S N y FA ORT water food SH health energy tion chemical pollution L AL air pollu TF networks OR SH education income housing & work gender peace RE ng Y equality & justice M GE social political di us & NO loa or en bi equality voice NE RA O od loss ph og T IV EC ive os nitr EA E TIV rs ND D ISTRIBU ity ph co land ter hwa nve fres rawals rsio h d n wit Fig. 1: The Doughnut Economic Model, reproduced from [2] 2 ronmental dimensions. The idea is to find a safe space for humanity that balances all of these environmental and social factors. In our work, we are inspired by this model, but adapt a simpler version to better suit quality requirements, keeping the general principle of balance. 3 The Doughnut Model applied to Qualities in iStar In order to further motivate the need for the new visualization and to demon- strate how it would look and work in practice, we present two examples. We start with a simple example from [6] focusing on security trade-offs, recreated in Fig. 2a. We focus the top part of the original model, with the quality goals (softgoals) and the functional elements (tasks and goals) which directly impact qualities. To illustrate what a trade-off may look like we add a hurt link from security to usability. We also add an extra security function to demonstrate potential over saturation. We redraw this extended model using a visualization inspired by the doughnut model, in Fig. 2b. Here we show the four qualities from the original model as labels along the desirable inner part of the “doughnut”. We shade the doughnut segments representing the qualities different shades of green, orange, and brown to reflect their level of satisfaction, for example, se- curity has three incoming help links, so is potentially over saturated (brown), while usability is hurt (orange). We discuss reasoning further in Sec. 4. Specific colors and visual elements may have to be adjusted based on future usability studies. In the second example, we recreate two of the three actors in Fig. 3a, again focusing on qualities. Here we can see the doughnut model beginning to scale to more qualities, in this case seven and five. Due to the increasing number of qualities in the doughnut, we can no longer use straight internal contribution links as in the first example, here we use curved green and red arrows for help and hurt contributions within the doughnut and straight links from functional elements to quality. Again, we indicate positive/negative via color, and severity by link thickness (to be evaluated and improved in future studies). Here we start to explore doughnuts in iStar actors with typical dependencies. We see the Employee Security + - + Integrity Usability Confidentiality + + Authenticate Restrict Maintain Maintain network address network address to access Administrative Privileges + + integrity Restrict the host integrity administrative privledges Access to host Access to Authenticate remotely host to access the remotely host (a) Excerpt of an i* model recreated (b) 2a captured using Doughnut model from [6] with additional links and elements Fig. 2: Doughnut Visualization applied to part of i* model from [6] 3 KHP Help Kids Increase Funds High Quality Avoid Counselling Help As Many Scandal Kids as Possible Immediacy Anonymity Help As [Services] [Services] Many Kids as Provide Online Possible Counseling Services High Quality Use Cyber Counselling Use Text Café/Portal/ Messaging Chat Room Get Effective Counsellors Kids and Cyber Café/ Happiness Help Youth Portal/Chat Provide [Counsellors] Room Service counseling via text message Avoid Comfortable Immediacy Text High Quality Anonymity Burnout ness with [Service] Messaging Counselling [Service] service Service Help be Provide Listen for Provide Online Cues Counseling Help As Many acquired counseling via Services Kids as Cyber Café/Portal/ Possible Chat Room Use Text Kids use Chat Use Text Use Chat Messaging Room Messaging Room (a) i* model recreated from [7] D Couns- KHP elors D + ++ ++ + + + - + + + - - -- - - -- + - + Use Use Use Text Use Text Chat Chat Messaging Messaging Room Room Provide Provide Online Online Counseling Counseling (b) Two Actors from 3a captured Using the Doughnut syntax Fig. 3: Doughnut Visualization applied to part of i* model from [7] 4 common visual clutter, but there is also a clear distinction between quality and function in the model. 4 Semantics and Reasoning Existing descriptions of NFR or iStar/i* semantics, supporting goal reasoning, can be adjusted to account for our proposal. Traditionally, satisfaction is thought of on a scale from fully denied to fully satisfied, as is shown in Fig. 4a, with some variation in the names, colors, and format of the labels. In this work, we intro- duce the notion of Over-Saturation, to show that going beyond satisfaction (or satisficing) is both possible and undesirable (see left side of Fig. 4b). We defined over-saturation in this case as: satisfying a quality to a degree that is more than is necessary to achieve a desirable state. This definition is vague by construction, as satisfaction and over-saturation depend on the quality and context. For ex- ample, for security, satisfaction may mean that the majority of users are happy with the level of security provided by a system. Here even ‘majority’ will depend on the size of the user base, if there are only five major customers, one cus- tomer being dissatisfied with security is significant. However, if there are 1000 customers, it may be acceptable that 90% of customers are satisfied with the system security. One can satisfy the additional 10% by adding more security features, but this may negatively affect cost, usability, or performance in such a way that the overall trade-off is negative. In such a case, adding more security interventions may lead to over-saturation. Existing goal model reasoning approaches such as reasoning described in the NFR Framework [3] or iStar/i* [7] can be adjusted to account for the new con- cept of over-saturation. This would mean the introduction of new labels or new color codes. Previously, the goal model community has struggled with how to determine whether something is fully or partially satisfied or denied (how much is enough?), with different interpretations of goal models leading to different pro- cedures and semantics [8]. The question of when a quality moves from satisfied to over-satisfied is similar, and can be dealt with in similar ways. For exam- Thoughts ple, in the Thoughts on NFR Framework onSatisfaction Satisfaction Oversatisfaction Oversatisfaction and the interactive approach- Leads in [7], - Leads to when to not not satisfyinga goal satisfying other qualities receives more than one source of positive evidence, one canother judgequalities whether the (a) Typical view of Quality Satisfaction (e.g., [3, 7]) New way with better colors? Denial vs. oversaturation? (b) New Proposal for Quality Satisfaction Fig. 4: Satisfaction of Qualities: Old vs. New 5 goal is partially satisfied, satisfied, partially saturated, or over-saturated. For other procedures, e.g., [9] where ‘promotion’ of incoming contribution values is not accounted for (e.g., any number of incoming partially satisfied values results in partially satisfied), extending to support over-saturation is more challenging. Generally, one needs either a way to ‘count’ or quantify incoming positive evi- dence, along with thresholds, to determine when a quality is too satisfied; or this decision must be passed to users, relying on domain knowledge and expertise. 5 Conclusions We have proposed an alternative way to visualize, think about, and reason over quality requirements, including the notion of quality over-saturation. Through examples, we have begun to show practical feasibility, and we have discussed how the new concepts could influence existing goal reasoning techniques. Future work will consider views over the model, e.g., incrementally showing the Doughnut model elements, contribution links, contributing elements, etc. Tooling should be adapted, ideally automatically transform existing i* or iStar models into the new notation. We are working on an evaluate plan involving surveys, prototypes and user studies with both iStar experts and novices. We welcome others to participate in the use and development of these ideas. Acknowledgements Supported by Vetenskapsrådet project “Non-Functional Requirements for Ma- chine Learning: Facilitating Continuous Quality Awareness (iNFoRM)”. References 1. S. S. Mahmoud and I. Ahmad, “A green model for sustainable software engineering,” International Journal of Software Engineering and Its Applications, vol. 7, no. 4, pp. 55–74, 2013. 2. K. Raworth, “A safe and just space for humanity: can we live within the doughnut,” Oxfam Policy and Practice: Climate Change and Resilience, vol. 8, no. 1, pp. 1–26, 2012. 3. L. Chung, B. A. Nixon, E. Yu, and J. Mylopoulos, Non-functional requirements in software engineering. Springer Science & Business Media, 2012, vol. 5. 4. F. Dalpiaz, X. Franch, and J. Horkoff, “istar 2.0 language guide,” arXiv preprint arXiv:1605.07767, 2016. 5. A. Raturi, B. Penzenstadler, B. Tomlinson, and D. Richardson, “Developing a sus- tainability non-functional requirements framework,” in Proceedings of the 3rd In- ternational Workshop on Green and Sustainable Software, 2014, pp. 1–8. 6. G. Elahi and E. Yu, “Modeling and analysis of security trade-offs–a goal oriented approach,” Data & Knowledge Engineering, vol. 68, no. 7, pp. 579–598, 2009. 7. J. Horkoff and E. Yu, “Interactive goal model analysis for early requirements engi- neering,” Requirements Engineering, vol. 21, no. 1, pp. 29–61, 2016. 8. ——, “Comparison and evaluation of goal-oriented satisfaction analysis techniques,” Requirements Engineering, vol. 18, no. 3, pp. 199–222, 2013. 9. P. Giorgini, J. Mylopoulos, E. Nicchiarelli, and R. Sebastiani, “Reasoning with goal models,” in International Conference on Conceptual Modeling. Springer, 2002, pp. 167–181. 6