Measuring non-functional requirements (NFR) proved to be a non-trivial problem and has been subject to many studies recently. This paper introduces application of Functional Size Measurement (FSM) Patterns to facilitate measurement of NFRs, focusing on security requirements. A Design Science Research methodology was followed to define and demonstrate the usefulness of measurement patterns applied to application security controls (ASC). Examples of how FSM Patterns can be defined for ASC are provided, along with how they are applied during or after the COSMIC measurement of Functional User Requirements (FURs). Results suggest that the magnitude of functional size introduced by a sample set of ASCs through a small case can increase significantly (e.g. over 200%). Defining and applying FSM Patterns turned out to be an effective way of reflecting functional size denoted by security NFRs. The approach also lets such NFRs to be sized before they are actually converted into FURs in the later phases of software development lifecycle, which makes the size of software to be represented more accurate in the early stages of the software development lifecycle. As such, FSM patterns should be an asset in incorporating the functional size stemming from high-level NFRs defined at the start of a project. The scope of this research was limited to security NFRs, and specifically to those security NFRs to be operationalized in the measured software (quasi NFRs). Future work could be extended to other categories of NFRs.

This paper introduces the concepts of functional size measurement (FSM) patterns. These FSM patterns apply to the COSMIC FSM method and may help in solving several issues, such as being able to do an early sizing for estimation, helping inexperienced measurers in learning how to apply the COSMIC method by establishing the relationship between the method rules and the measurement results, avoiding measurement errors, and reducing measurement effort. The approach used to define FSM patterns is Design Science Research. This paper explores the motivation factors, defines the objectives of the solution, and describes the design and development of FSM patterns. FSM patterns can be defined for a portion of a functional process, a single functional process type, a set of functional process types having a main data group - or object of interest - as their common starting point, or a large set of functional processes handling multiple data groups. These types of FSM patterns have been defined as "micro FSM pattern", "basic FSM pattern", "composite FSM pattern", and "multi-composite FSM pattern" respectively. FSM patterns examples are given to demonstrate their applicability in information systems for all four FSM pattern types. Application of FSM pattern with embedded real-time systems is discussed, along with other potential usage benefits for the industry.

Software development organizations applying continuous process improvement, when faced with the limits of qualitative approaches, are looking into quantitative approaches to support decision making, namely for improvement of the software project estimation process. Quantitative approaches include sizing functional requirements with standards such as ISO 19761, known as the COSMIC method. But defects in the requirements may have an impact on the accuracy of the resulting functional size, as well as an impact on the project relative effort sometimes known as the 'productivity rate' and the measurement relative effort. Our research program is investigating the relationship between the attributes of requirements engineering (RE) outputs, the software process relative effort, and the measurement process relative effort. RE outputs studied are requirements and specifications documents and data models. As functional sizing is applied, thorough examination of RE outputs is done, which is likely to lead to identifying quality attributes and related findings. As a case study, this paper reports preliminary results related to the quality of requirements artefacts from a software development organization that is applying the Agile approach to its software development process. The functional size of the software developed through five projects was measured and compared with development effort and measurement effort, taking into account the quality rating of requirements. The results led to recommendations of improvement on the RE process that the organization could deploy in its current and next software projects. This paper also presents a list of functional sizing challenges that the measurer has faced, leading to proposed recommendations for planning any software measurement project.

When reusable software elements are defined in the requirements phase, this raises a number of issues for the measurement of their functional size, when a reusable element implements a business rule or a business sub process, for example. A case study is presented with project functional size measurement data to illustrate the impact of reuse on the resulting size and to determine criteria of reuse effectiveness and efficiency.

This paper reports on a research project investigating the contribution of functional size measurers to finding defects in requirements. In previous experiments, the concurrent inspection of the same requirements document by a measurer in addition to inspectors showed that the functional size measurement activity adds value in finding functional defects that inspectors have not identified. This paper presents an analysis of the influence of defects on the functional size once many of the identified defects have been fixed. For these experiments, the measurers used COSMIC - ISO 19761 to measure functional size and to find defects. Experiments findings show an increase in functional size and a decrease in defects identified.

This paper reports on a research project investigating the contribution of functional size measurers to finding defects in requirements. It describes an experiment where the same requirements document was inspected by a number of inspectors, as well as by a number of measurers. All participants had limited experience in both inspecting and measuring. The number and types of defects found by the two groups are compared and discussed. For this experiment, the measurers used COSMIC - ISO 19761 to measure functional size and to find defects. Results show an increase in defect identification when both inspection and functional size measurement are used to find and report defects.