SlideShare ist ein Scribd-Unternehmen logo
1 von 46
Downloaden Sie, um offline zu lesen
The SQALE method:
                              Meaningful insights into
                              your Technical Debt*
                                Jean-Louis Letouzey
                                August 2012




* The technical debt visible in your source code
Presentation

Jean-Louis Letouzey
Expert consultant at inspearit France




           Product Audit, Technical Debt assessment
           Author of the SQALE method
           Preaching, Teaching SQALE
           SQALE tailoring and coaching in large organizations


© inspearit-2012                                                 2
Table of Contents

  Reminder on Quality and Technical Debt
  Technical Debt: a powerful Paradigm Shift
  The SQALE method: Structure
  Analyzing Technical Debt with SQALE
  Paying back Technical Debt with SQALE
  Summary and Conclusion
  Demonstration




                                              3
Quality

      Quality is:
      compliance to
      requirement
      Before measuring
      Quality, you first need
      to define it
         At project level or
         Organization level




                   If you don’t define it, you won’t get it !
© inspearit-2012                                                4
Technical Debt
Ward Cunningham
at OOPSLA 92:
                       “Every minute spent
“Shipping first time
                       on not-quite-right
code is like going
                       code counts as
into debt. A little
                       interest”
debt speeds
development so
long as it is paid
back promptly with
a rewrite…”




 © inspearit-2012                            5
Technical Debt

      A strong communication tool
      Understandable by managers (fits well in Excel sheets)
      Many blogs, definitions from experts
        Product – Process
        Voluntary – involuntary
        …
      One reference book:




© inspearit-2012                                               6
Technical Debt

In a recent (2012) interview* Ward Cunningham provided some
clarifications:
      “We can say that the CODE is of high quality when
      productivity remains high in the presence of change in TEAM
      and GOALS.”




    Technical debt = Work to be done = Principal
    Impact = Lost of productivity = Interest


    * www.techdebt.org

© inspearit-2012                                                    7
Technical Debt and Agility

      Agile considers the source code as one major deliverable (not
      design model, not documentation)
      The definition of « right code » should be considered for the
      Definition(s) of Done « DoD »
        List of source code quality requirements
        Type and acceptable level of Technical Debt


      Agile promotes transparency
      Technical Debt shall be identified and monitored
      Project shall plan and prioritize activities for repaying and
      limiting this debt


© inspearit-2012                                                      8
Technical Debt and Agile Projects




 Definition of                        « Continuous
« Right Code »                         inspection »
Acceptable type                       Monitoring TD
  and level of
     debt           Part of debt to
                     be repayed
                      within the
                         sprint

 © inspearit-2012                                     9
What Managing Technical Debt Means?

To Manage TD means at least:
1. Define what creates TD
2. Define how to calculate TD
3. Set Goals at organizational or project level
4. Monitor the TD against the goals
5. Compare TD across versions, projects, subcontractors…
6. Analyze TD (age, location and impact)
7. Set Pay down goals
8. Set Pay down plan/priorities
9. …


© inspearit-2012                                           10
Table of Content

  Reminder on Quality and Technical Debt
  Technical Debt: a powerful Paradigm Shift
  The SQALE method: Structure
  Analyzing Technical Debt with SQALE
  Paying back Technical Debt with SQALE
  Summary and Conclusion
  Demonstration




                                              11
Technical Debt: a Paradigm Shift

      Since the 70’s, the Software community is trying to
      measure « Quality » and Quality of source code
      Technical debt is measuring « Non Quality »!



           « Good Code »   ∞                  « Bad Code »     ∞




                                                               Measures
                           Measures




           « Bad Code »     0                 « Right Code »   0



© inspearit-2012                                                          12
What is « right code »

     « Right code » is not « perfect code »

                                           No formal definition of
                   Attribute1


                                             « perfect code »


                                                      « Not right code »
                                                             area
                   Perfect
                    Code


                                                       « Right code »
                                                            area




     As soon as one attribute is in the unacceptable area (i.e.
     potentially decreasing productivity), the code is « not right »

© inspearit-2012                                                           13
Formulas: 5 days training!

    Des formules complexes
   MAINTAINABILITY INDEX
   MI4 = 171 - 3.42ln(aveE) - 0.23aveV(g') - 16.2ln(aveLOC)
        + (50 x sin(sqrt(2.46 x aveCM))



   CLASS COHESION
   LCOM = LCOM = ((1/a x ΣA) - m)/(1 - m)
   Where a is the number of attributes of the class, Σ A is the sum across the set of
   attributes of the number of methods that access each attribute, and m is the
   number of methods of the class.




© inspearit-2012                                                                        14
Aggregations: Averages!




© inspearit-2012          15
Benefits from the Paradigm Shift

TD Specificities                Benefits at measure level
     Aggregation by addition      No masking, no false positive
     Inverse direction            Objective
     « Right » vs « Perfect »     Precise
                                  Easy to understand




Technical debt is a much more powerful system
compared to everything used previously to
measure source code

© inspearit-2012                                                  16
Table of Content

  Reminder on Quality and Technical Debt
  Technical Debt: a powerful Paradigm Shift
  The SQALE method: Structure
  Analyzing the Technical Debt with SQALE
  Paying back Technical Debt with SQALE
  Summary and Conclusion
  Demonstration




                                              17
The SQALE method: Context
SQALE: Software Quality Assessment based on Lifecycle Expectations

•    Based on TD                                    Implementation/Tools
•    Open source
•    Generic
•    Tool independant
•    Widely used



                                        Tailoring

                                       4 concepts

                                9 Fundamental Principles

                        Measurement theory and representativity



    Definition document, articles, tools list are on sqale.org
© inspearit-2012                                                      18
SQALE Structure
                     Analysis tools
     Source
      Code




1 Quality Model                                             2 Analysis Models       3 Indices          4 Indicators

                          1 2       3                          3 6       9

                                5                                    1
                                                                                                       A                               …                                                       E
                                                                                      SQI
    Source code                         Estimation models
                                                                                      STI
       related            Findings                               Costs                SRI
    requirements            Table                                Tables
                                                                                Σ     …                Maintenabilité




                                                                                                           Efficacité
                                                                                                                         Testabilité   Fiabilité   Evolutivité   Efficacité




                                                                                                                                                                   248
                                                                                                                                                                              Maintenabilité




                                                                                                                                                                                  589



                                                                                                                                                                                  248




                                                                                      SQID
                                                                                                          Evolutivité                                1 480        1 480          1 480



                                1                                    4                                       Fiabilité                   548          548          548            548




                                                                                      …                   Testabilité      6 535


                                                                                                                           6 535
                                                                                                                                       6 535


                                                                                                                                       7 083
                                                                                                                                                     6 535


                                                                                                                                                     8 563
                                                                                                                                                                  6 535


                                                                                                                                                                  8 811
                                                                                                                                                                                 6 535


                                                                                                                                                                                 9 400




                                6                                    2
                           1                                     1




                                                              d. / h. / $ ….          d. / h. / $ ….
  « Right Code »                                                                     Technical
    Definition                                                                         Debt

  © inspearit-2012
                                                                                                                                                                                               19
The SQALE Quality Model:
Source Code Requirements
     SQALE asks you to associate each of your expectations
     (requirements) with a quality characteristic

          Iso 25010
           abilities
                                                                   Reuse
                                                  Reusability
                                                                                     Ordered characteristics
                                               Portability
                                                             Maintain                                    Reusability
                                        Maintainability
                                                                                                      Portability
                                                   Deliver
                                Security                                                         Maintainability        Source code
                           Efficiency                                                                                      related
                                                                                              Security
                                         Evolve
                                                                                                                        requirements
                  Changeability
                                                                                         Efficiency
                 Reliability
                                                                                    Changeability
                               Test
           Testability
                                                                               Reliability

                    Code                                                   Testability


                                                                                                                       « Right Code »

                                  Requirements appear only once within the Quality Model,
© inspearit-2012
                                  when they are first needed. >>> orthogonal model
                                                                                                                                        20
SQALE: 2 Estimation Models
       Estimation models transform findings in costs
         One for the Technical Perspective > Technical Debt
         One for the Business Perspective > Business Impact

                                                             Remediation Cost
 Naming                   « Right Code »                     Depends on the type and




                                             Violations
                            Definition                       the amount of technical
  Presentation                                               activities to perform in
                                                             order to remediate the
   Logic                                                     violations
                                                             (remediation life cycle)
           Instruction
                          Requirement        n
        …

        Test Coverage                                       Depends on the negative
                                                            impact on the business
   Structure                                                activities.
Architecture                                                The penalty that will cover
                                                            all damages that will or may
                                                            happened from delivering
 These 2 derived measures are on a ratio scale and can be   with violations
 added without breaching the representation clause
   © inspearit-2012
                                                            Non-Remediation Cost
                                                                                     21
Table of Content

  Reminder on Quality and Technical Debt
  Technical Debt: a powerful Paradigm Shift
  The SQALE method: Structure
  Analyzing Technical Debt with SQALE
  Paying back Technical Debt with SQALE
  Summary and Conclusion
  Demonstration




                                              22
SQALE Structure
                     Analysis tools
     Source
      Code




1 Quality Model                                             2 Analysis Models       3 Indices

                          1 2       3                          3 6       9

                                5                                    1
                                                                                      SQI
    Source code                         Estimation models
       related            Findings                               Costs
    requirements            Table                                Tables
                                                                                Σ
                                1                                    4                …

                                                                                      …
                                6                                    2
                           1                                     1




                                                              d. / h. / $ ….          d. / h. / $ ….
  « Right Code »                                                                     Technical
    Definition                                                                         Debt

  © inspearit-2012
                                                                                                       23
What Managing Technical Debt Means?
                                            SQALE:
To Manage TD means at least:
1. Define what creates TD                   Quality Model
2. Define how you calculate TD              Remediation Function

3. Set Goals at organizational or project
   level
4. Monitor the TD against the goals
5. Compare TD across versions,
   projects, subcontractors…
6. Analyze TD (age, location and
   impact)
7. Set Pay down goals
8. Set Pay down plan/priorities
9. …
© inspearit-2012                                             24
Index: Technical Debt Density

      SQALE defines Density indicators
      You divide your TD by the size of your artifact
      Size may be measured in function points, KSLOC…


SQID (SQALE Quality Index Density = Technical Debt
Density)
      Allows to compare projects, versions,
      subcontractors…
      Allows to set goals without knowing the size in
      advance




© inspearit-2012                                        25
Indicator: The SQALE rating
                   A synthetic indicator dedicated to management
                   dashboards
                   Based on the ratio between the Technical Debt and the
                   Development Cost
Development Cost




                                                                        E




                                                                            Technical Debt
                                                           D
                                                   C
                                            B
                                     A


             © inspearit                                           26
What Managing Technical Debt Means?
                                            SQALE:
To Manage TD means at least:
1. Define what creates TD                   Quality Model
2. Define how you calculate TD              Remediation Function

3. Set Goals at organizational or project
   level
4. Monitor the TD against the goals         Index Densities
5. Compare TD across versions,              Rating
   projects, subcontractors…
6. Analyze TD (age, location and
   impact)
7. Set Pay down goals
8. Set Pay down plan/priorities
9. …
© inspearit-2012                                              27
The SQALE Pyramid: 2 points of view
                                               An external view that
                                             represents the perceived
                                               quality evaluated by
                                                consolidation of the
                                                   hierarchy of
                                                  characteristics
An analytic view provided
by orthogonal
characteristics                                              Maintainability
One understands impact
                                                                               Σ
of each Non-Conformity                             Efficiency
and improvement on                                                  Σ
                                           Changeability
quality characteristic and
life cycle issues.                   Reliability
                                                         Σ
                                               Σ
                             Testability



© inspearit-2012                                                                   28
Analyze your Technical Debt

      The SQALE Pyramid provides a technical perspective : Impact
      on the project’s activities




© inspearit-2012                                                    29
Which code is more « agile »?




© inspearit-2012                30
What Managing Technical Debt Means?
                                            SQALE:
To Manage TD means at least:
1. Define what creates TD                   Quality Model
2. Define how you calculate TD              Remediation Function

3. Set Goals at organizational or project
   level
4. Monitor the TD against the goals         Index Densities
5. Compare TD across versions,              Rating
   projects, subcontractors…
                                            Pyramid
6. Analyze TD (age, location and
   impact)
7. Set Pay down goals
8. Set Pay down plan/priorities
9. …
© inspearit-2012                                              31
Table of Content

  Reminder on Quality and Technical Debt
  Technical Debt: a powerful Paradigm Shift
  The SQALE method: Structure
  Analyzing Technical Debt with SQALE
  Paying back Technical Debt with SQALE
  Summary and Conclusion
  Demonstration




                                              32
The 2 ways to change code

      (In many cases), there are 2 ways to make a change
         The « logical » way = long term view
         The « quick and dirty » way = short term view
The 2 perspectives are commonly considered to prioritize
features. The same logic is applicable to Non-Conformities

                   Features                               Non-Conformities

  Development Cost            Business Value            Technical Debt           Business Impact


                   Priorities/Decision                               Priorities/Decision




  Technical                                Business    Technical                             Business
                     Features List                                        N.C. List
  Perspective                            Perspective   Perspective                         Perspective
© inspearit-2012                                                                                         33
Paying back your Technique Debt

              The SQALE pyramid defines a logical priority for remediation
              actions

                                                        Reuse
                                       Reusability

                                    Portability
                                                  Maintain




                                                                Remediations
                             Maintainability



                                        Deliver
                     Security

                Efficiency

                              Evolve
       Changeability

      Reliability

                    Test
Testability



         Code




   © inspearit-2012                                                            34
Deliver with a residual debt
Technical Debt




                 Technical Debt is permanently monitored
                 and analyzed for identifying and performing
                 immediate remediations




                                                                      Acceptable
                                                                      Level


                                                               Time


© inspearit-2012                                                           35
Deliver with a residual debt
Technical Debt




                                                                                Optimization phase:
                                                                                One need to take into
                                                                                account the Business
                                                                                perspective in order to
                                                                                minimize the impact of the
                 Technical Debt is permanently monitored                        residual debt
                 and analyzed for identifying and performing
                 immediate remediations
                                                                                                Impact




                                                                                                        Acceptable
                                                                                                        Level
                                                               Residual Technical Debt

                                                                                           Time


© inspearit-2012                                                                                              36
Analyze your Technical Debt

      The business perspective upon « Severity », « Importance »




© inspearit-2012                                                   37
The SQALE Debt Map
      An analysis indicator valid at all artefact level
                               Non-remediation Cost
             Business Impact




                                                                          - File
                                                                          - Component
                                                                          - Application




                                                       Remediation Cost

© inspearit-2012
                                                      Technical Debt                  38
Optimize your remediation budget
      Use the impact/cost ratio
                               Non-remediation Cost
             Business Impact




                                                       Remediation Cost

© inspearit-2012
                                                      Technical Debt      39
Table of Content

  Reminder on Quality and Technical Debt
  Technical Debt: a powerful Paradigm Shift
  The SQALE method: Structure
  Analyzing Technical Debt with SQALE
  Paying back Technical Debt with SQALE
  Summary and Conclusion
  Demonstration




                                              40
A simple but powerful paradigm


                    •   Simple calculation
                    •   Simple aggregation
Technical Debt      •   Objectivity
                    •   Wide public
                    •   Few false positives
                    •   Representativeness
                    •   Clear rating rule
SQALE method
                    •   Comparisons
                    •   Remediation priorities
                    •   Analysis perspectives




 © inspearit-2012                                41
Paying back the TD with SQALE
SQALE support 3 different strategies:
      1st strategy: Follow the technical Logic (avoid useless
      rework)
         Use the SQALE pyramid

      2nd strategy: decrease the business impact by
      starting fixing the Non-conformities with the highest
      business impact
         Use the SQALE Business Impact (SBI)
         Use the Debt Map

      3rd strategy: optimize your ROI by starting fixing the
      non-conformities with the highest ROI
         Use the Business Impact/Remediation cost ratio
         Use the Debt Map



© inspearit-2012
                                         Technical Debt         42
SQALE deployment


1   Initialization   2   Tailoring             3    Pilot                4   Deployment


 Planning                Method training           Model Validation      Tools installation &
 Stakeholders’           Tailoring the SQALE       Building a ready to   integration
 Scope…                  basic models              deploy solution        Awareness and
                                                                         Coaching sessions




    A simple technical part
       Setting your own SQALE models
       Tool implementation and validation

    A « Change management » part
      Fighting against old ideas about code measurement
      Addressing a large population                                                             43
The SQALE method: Summary

       Easy to understand and to deploy
       A strong and powerful implementation of the Technical Debt
       concept
       Open source and tool independent
       Used worldwide
       Expert recognition

“In the domain of software quality evaluation, I find
SQALE – Software Quality Assessment based on Life
Cycle Expectations – a great tool for implementing
my mantra. It interprets source code analysis in
terms of what really matters in the specific client
environment. In so doing, it transforms an
overwhelming set of measurement data to
actionable insights which are meaningful at multiple
levels of the firm.”
                    Israel Gat, Cutter Consortium
 © inspearit-2012                                                   44
Table of Content

  Reminder on Quality and Technical Debt
  The SQALE method and the Technical Debt
  The SQALE method and the Business Perspective
  Managing your Technical Debt with SQALE
  A powerful paradigm shift
  How to deploy/use the SQALE method
  Demonstration




                                                  45
just sqale it
                           Thanks

                           Questions?




                          http: /www.sqale.org

                jean-louis.letouzey@inspearit.com
                                           © inspearit


                           46

Weitere ähnliche Inhalte

Ähnlich wie The SQALE method: Meaningful insights into your Technical Debt

From Requirements Management to Release with Git for Android System
From Requirements Management to Release with Git for Android System From Requirements Management to Release with Git for Android System
From Requirements Management to Release with Git for Android System Intland Software GmbH
 
Dollars and Dates are Killing Agile
Dollars and Dates are Killing AgileDollars and Dates are Killing Agile
Dollars and Dates are Killing AgileRally Software
 
Dollars and dates are killing agile final
Dollars and dates are killing agile finalDollars and dates are killing agile final
Dollars and dates are killing agile finaldrewz lin
 
Software quality - no more bugs!
Software quality - no more bugs!Software quality - no more bugs!
Software quality - no more bugs!Arnon Axelrod
 
"Votre produit logiciel : accélérateur ou frein à votre croissance"
"Votre produit logiciel : accélérateur ou frein à votre croissance""Votre produit logiciel : accélérateur ou frein à votre croissance"
"Votre produit logiciel : accélérateur ou frein à votre croissance"oliviervandeWerve
 
Managing Software Debt - Quality Debt Focus for QASIG Seattle
Managing Software Debt - Quality Debt Focus for QASIG SeattleManaging Software Debt - Quality Debt Focus for QASIG Seattle
Managing Software Debt - Quality Debt Focus for QASIG SeattleChris Sterling
 
What scrum masters and product owners should know about software quality and ...
What scrum masters and product owners should know about software quality and ...What scrum masters and product owners should know about software quality and ...
What scrum masters and product owners should know about software quality and ...STX Next
 
apidays Australia 2022 - Guardianship Model - Managing digital hypergrowth at...
apidays Australia 2022 - Guardianship Model - Managing digital hypergrowth at...apidays Australia 2022 - Guardianship Model - Managing digital hypergrowth at...
apidays Australia 2022 - Guardianship Model - Managing digital hypergrowth at...apidays
 
Make a career in software testing: WebPro - Web Testing Professional Program
Make a career in software testing: WebPro - Web Testing Professional ProgramMake a career in software testing: WebPro - Web Testing Professional Program
Make a career in software testing: WebPro - Web Testing Professional ProgramCleanSoft Academy
 
technical debt management strategies
technical debt management strategiestechnical debt management strategies
technical debt management strategiesRaquel Pau
 
Welcome to the Metrics
Welcome to the MetricsWelcome to the Metrics
Welcome to the MetricsVMware Tanzu
 
AI for PM.pptx
AI for PM.pptxAI for PM.pptx
AI for PM.pptxNatan Katz
 
Kerim Cakmak, Moshe Cohen -- Continuous Verification and Validation
Kerim Cakmak, Moshe Cohen -- Continuous Verification and Validation Kerim Cakmak, Moshe Cohen -- Continuous Verification and Validation
Kerim Cakmak, Moshe Cohen -- Continuous Verification and Validation Anatoly Levenchuk
 
Making bimodal it_a_reality_final
Making bimodal it_a_reality_finalMaking bimodal it_a_reality_final
Making bimodal it_a_reality_finalCentric Consulting
 
The Need for Speed
The Need for SpeedThe Need for Speed
The Need for SpeedCapgemini
 
Slides for Houston iPhone Developers' Meetup (April 2012)
Slides for Houston iPhone Developers' Meetup (April 2012)Slides for Houston iPhone Developers' Meetup (April 2012)
Slides for Houston iPhone Developers' Meetup (April 2012)lqi
 
Managing product development flow across an IT organization
Managing product development flow across an IT organizationManaging product development flow across an IT organization
Managing product development flow across an IT organizationInstitut Lean France
 

Ähnlich wie The SQALE method: Meaningful insights into your Technical Debt (20)

Technical Debt.pptx
Technical Debt.pptxTechnical Debt.pptx
Technical Debt.pptx
 
From Requirements Management to Release with Git for Android System
From Requirements Management to Release with Git for Android System From Requirements Management to Release with Git for Android System
From Requirements Management to Release with Git for Android System
 
Dollars and Dates are Killing Agile
Dollars and Dates are Killing AgileDollars and Dates are Killing Agile
Dollars and Dates are Killing Agile
 
Dollars and dates are killing agile final
Dollars and dates are killing agile finalDollars and dates are killing agile final
Dollars and dates are killing agile final
 
Software quality - no more bugs!
Software quality - no more bugs!Software quality - no more bugs!
Software quality - no more bugs!
 
"Votre produit logiciel : accélérateur ou frein à votre croissance"
"Votre produit logiciel : accélérateur ou frein à votre croissance""Votre produit logiciel : accélérateur ou frein à votre croissance"
"Votre produit logiciel : accélérateur ou frein à votre croissance"
 
Managing Software Debt - Quality Debt Focus for QASIG Seattle
Managing Software Debt - Quality Debt Focus for QASIG SeattleManaging Software Debt - Quality Debt Focus for QASIG Seattle
Managing Software Debt - Quality Debt Focus for QASIG Seattle
 
What scrum masters and product owners should know about software quality and ...
What scrum masters and product owners should know about software quality and ...What scrum masters and product owners should know about software quality and ...
What scrum masters and product owners should know about software quality and ...
 
apidays Australia 2022 - Guardianship Model - Managing digital hypergrowth at...
apidays Australia 2022 - Guardianship Model - Managing digital hypergrowth at...apidays Australia 2022 - Guardianship Model - Managing digital hypergrowth at...
apidays Australia 2022 - Guardianship Model - Managing digital hypergrowth at...
 
Make a career in software testing: WebPro - Web Testing Professional Program
Make a career in software testing: WebPro - Web Testing Professional ProgramMake a career in software testing: WebPro - Web Testing Professional Program
Make a career in software testing: WebPro - Web Testing Professional Program
 
technical debt management strategies
technical debt management strategiestechnical debt management strategies
technical debt management strategies
 
Welcome to the Metrics
Welcome to the MetricsWelcome to the Metrics
Welcome to the Metrics
 
AI for PM.pptx
AI for PM.pptxAI for PM.pptx
AI for PM.pptx
 
Kerim Cakmak, Moshe Cohen -- Continuous Verification and Validation
Kerim Cakmak, Moshe Cohen -- Continuous Verification and Validation Kerim Cakmak, Moshe Cohen -- Continuous Verification and Validation
Kerim Cakmak, Moshe Cohen -- Continuous Verification and Validation
 
ODASE Introduction
ODASE IntroductionODASE Introduction
ODASE Introduction
 
Making bimodal it_a_reality_final
Making bimodal it_a_reality_finalMaking bimodal it_a_reality_final
Making bimodal it_a_reality_final
 
The Need for Speed
The Need for SpeedThe Need for Speed
The Need for Speed
 
Amit_Resume
Amit_ResumeAmit_Resume
Amit_Resume
 
Slides for Houston iPhone Developers' Meetup (April 2012)
Slides for Houston iPhone Developers' Meetup (April 2012)Slides for Houston iPhone Developers' Meetup (April 2012)
Slides for Houston iPhone Developers' Meetup (April 2012)
 
Managing product development flow across an IT organization
Managing product development flow across an IT organizationManaging product development flow across an IT organization
Managing product development flow across an IT organization
 

Mehr von drewz lin

Web security-–-everything-we-know-is-wrong-eoin-keary
Web security-–-everything-we-know-is-wrong-eoin-kearyWeb security-–-everything-we-know-is-wrong-eoin-keary
Web security-–-everything-we-know-is-wrong-eoin-kearydrewz lin
 
Via forensics appsecusa-nov-2013
Via forensics appsecusa-nov-2013Via forensics appsecusa-nov-2013
Via forensics appsecusa-nov-2013drewz lin
 
Phu appsec13
Phu appsec13Phu appsec13
Phu appsec13drewz lin
 
Owasp2013 johannesullrich
Owasp2013 johannesullrichOwasp2013 johannesullrich
Owasp2013 johannesullrichdrewz lin
 
Owasp advanced mobile-application-code-review-techniques-v0.2
Owasp advanced mobile-application-code-review-techniques-v0.2Owasp advanced mobile-application-code-review-techniques-v0.2
Owasp advanced mobile-application-code-review-techniques-v0.2drewz lin
 
I mas appsecusa-nov13-v2
I mas appsecusa-nov13-v2I mas appsecusa-nov13-v2
I mas appsecusa-nov13-v2drewz lin
 
Defeating xss-and-xsrf-with-my faces-frameworks-steve-wolf
Defeating xss-and-xsrf-with-my faces-frameworks-steve-wolfDefeating xss-and-xsrf-with-my faces-frameworks-steve-wolf
Defeating xss-and-xsrf-with-my faces-frameworks-steve-wolfdrewz lin
 
Csrf not-all-defenses-are-created-equal
Csrf not-all-defenses-are-created-equalCsrf not-all-defenses-are-created-equal
Csrf not-all-defenses-are-created-equaldrewz lin
 
Chuck willis-owaspbwa-beyond-1.0-app secusa-2013-11-21
Chuck willis-owaspbwa-beyond-1.0-app secusa-2013-11-21Chuck willis-owaspbwa-beyond-1.0-app secusa-2013-11-21
Chuck willis-owaspbwa-beyond-1.0-app secusa-2013-11-21drewz lin
 
Appsec usa roberthansen
Appsec usa roberthansenAppsec usa roberthansen
Appsec usa roberthansendrewz lin
 
Appsec usa2013 js_libinsecurity_stefanodipaola
Appsec usa2013 js_libinsecurity_stefanodipaolaAppsec usa2013 js_libinsecurity_stefanodipaola
Appsec usa2013 js_libinsecurity_stefanodipaoladrewz lin
 
Appsec2013 presentation-dickson final-with_all_final_edits
Appsec2013 presentation-dickson final-with_all_final_editsAppsec2013 presentation-dickson final-with_all_final_edits
Appsec2013 presentation-dickson final-with_all_final_editsdrewz lin
 
Appsec2013 presentation
Appsec2013 presentationAppsec2013 presentation
Appsec2013 presentationdrewz lin
 
Appsec 2013-krehel-ondrej-forensic-investigations-of-web-exploitations
Appsec 2013-krehel-ondrej-forensic-investigations-of-web-exploitationsAppsec 2013-krehel-ondrej-forensic-investigations-of-web-exploitations
Appsec 2013-krehel-ondrej-forensic-investigations-of-web-exploitationsdrewz lin
 
Appsec2013 assurance tagging-robert martin
Appsec2013 assurance tagging-robert martinAppsec2013 assurance tagging-robert martin
Appsec2013 assurance tagging-robert martindrewz lin
 
Amol scadaowasp
Amol scadaowaspAmol scadaowasp
Amol scadaowaspdrewz lin
 
Agile sdlc-v1.1-owasp-app sec-usa
Agile sdlc-v1.1-owasp-app sec-usaAgile sdlc-v1.1-owasp-app sec-usa
Agile sdlc-v1.1-owasp-app sec-usadrewz lin
 
Vulnex app secusa2013
Vulnex app secusa2013Vulnex app secusa2013
Vulnex app secusa2013drewz lin
 
基于虚拟化技术的分布式软件测试框架
基于虚拟化技术的分布式软件测试框架基于虚拟化技术的分布式软件测试框架
基于虚拟化技术的分布式软件测试框架drewz lin
 
新浪微博稳定性经验谈
新浪微博稳定性经验谈新浪微博稳定性经验谈
新浪微博稳定性经验谈drewz lin
 

Mehr von drewz lin (20)

Web security-–-everything-we-know-is-wrong-eoin-keary
Web security-–-everything-we-know-is-wrong-eoin-kearyWeb security-–-everything-we-know-is-wrong-eoin-keary
Web security-–-everything-we-know-is-wrong-eoin-keary
 
Via forensics appsecusa-nov-2013
Via forensics appsecusa-nov-2013Via forensics appsecusa-nov-2013
Via forensics appsecusa-nov-2013
 
Phu appsec13
Phu appsec13Phu appsec13
Phu appsec13
 
Owasp2013 johannesullrich
Owasp2013 johannesullrichOwasp2013 johannesullrich
Owasp2013 johannesullrich
 
Owasp advanced mobile-application-code-review-techniques-v0.2
Owasp advanced mobile-application-code-review-techniques-v0.2Owasp advanced mobile-application-code-review-techniques-v0.2
Owasp advanced mobile-application-code-review-techniques-v0.2
 
I mas appsecusa-nov13-v2
I mas appsecusa-nov13-v2I mas appsecusa-nov13-v2
I mas appsecusa-nov13-v2
 
Defeating xss-and-xsrf-with-my faces-frameworks-steve-wolf
Defeating xss-and-xsrf-with-my faces-frameworks-steve-wolfDefeating xss-and-xsrf-with-my faces-frameworks-steve-wolf
Defeating xss-and-xsrf-with-my faces-frameworks-steve-wolf
 
Csrf not-all-defenses-are-created-equal
Csrf not-all-defenses-are-created-equalCsrf not-all-defenses-are-created-equal
Csrf not-all-defenses-are-created-equal
 
Chuck willis-owaspbwa-beyond-1.0-app secusa-2013-11-21
Chuck willis-owaspbwa-beyond-1.0-app secusa-2013-11-21Chuck willis-owaspbwa-beyond-1.0-app secusa-2013-11-21
Chuck willis-owaspbwa-beyond-1.0-app secusa-2013-11-21
 
Appsec usa roberthansen
Appsec usa roberthansenAppsec usa roberthansen
Appsec usa roberthansen
 
Appsec usa2013 js_libinsecurity_stefanodipaola
Appsec usa2013 js_libinsecurity_stefanodipaolaAppsec usa2013 js_libinsecurity_stefanodipaola
Appsec usa2013 js_libinsecurity_stefanodipaola
 
Appsec2013 presentation-dickson final-with_all_final_edits
Appsec2013 presentation-dickson final-with_all_final_editsAppsec2013 presentation-dickson final-with_all_final_edits
Appsec2013 presentation-dickson final-with_all_final_edits
 
Appsec2013 presentation
Appsec2013 presentationAppsec2013 presentation
Appsec2013 presentation
 
Appsec 2013-krehel-ondrej-forensic-investigations-of-web-exploitations
Appsec 2013-krehel-ondrej-forensic-investigations-of-web-exploitationsAppsec 2013-krehel-ondrej-forensic-investigations-of-web-exploitations
Appsec 2013-krehel-ondrej-forensic-investigations-of-web-exploitations
 
Appsec2013 assurance tagging-robert martin
Appsec2013 assurance tagging-robert martinAppsec2013 assurance tagging-robert martin
Appsec2013 assurance tagging-robert martin
 
Amol scadaowasp
Amol scadaowaspAmol scadaowasp
Amol scadaowasp
 
Agile sdlc-v1.1-owasp-app sec-usa
Agile sdlc-v1.1-owasp-app sec-usaAgile sdlc-v1.1-owasp-app sec-usa
Agile sdlc-v1.1-owasp-app sec-usa
 
Vulnex app secusa2013
Vulnex app secusa2013Vulnex app secusa2013
Vulnex app secusa2013
 
基于虚拟化技术的分布式软件测试框架
基于虚拟化技术的分布式软件测试框架基于虚拟化技术的分布式软件测试框架
基于虚拟化技术的分布式软件测试框架
 
新浪微博稳定性经验谈
新浪微博稳定性经验谈新浪微博稳定性经验谈
新浪微博稳定性经验谈
 

The SQALE method: Meaningful insights into your Technical Debt

  • 1. The SQALE method: Meaningful insights into your Technical Debt* Jean-Louis Letouzey August 2012 * The technical debt visible in your source code
  • 2. Presentation Jean-Louis Letouzey Expert consultant at inspearit France Product Audit, Technical Debt assessment Author of the SQALE method Preaching, Teaching SQALE SQALE tailoring and coaching in large organizations © inspearit-2012 2
  • 3. Table of Contents Reminder on Quality and Technical Debt Technical Debt: a powerful Paradigm Shift The SQALE method: Structure Analyzing Technical Debt with SQALE Paying back Technical Debt with SQALE Summary and Conclusion Demonstration 3
  • 4. Quality Quality is: compliance to requirement Before measuring Quality, you first need to define it At project level or Organization level If you don’t define it, you won’t get it ! © inspearit-2012 4
  • 5. Technical Debt Ward Cunningham at OOPSLA 92: “Every minute spent “Shipping first time on not-quite-right code is like going code counts as into debt. A little interest” debt speeds development so long as it is paid back promptly with a rewrite…” © inspearit-2012 5
  • 6. Technical Debt A strong communication tool Understandable by managers (fits well in Excel sheets) Many blogs, definitions from experts Product – Process Voluntary – involuntary … One reference book: © inspearit-2012 6
  • 7. Technical Debt In a recent (2012) interview* Ward Cunningham provided some clarifications: “We can say that the CODE is of high quality when productivity remains high in the presence of change in TEAM and GOALS.” Technical debt = Work to be done = Principal Impact = Lost of productivity = Interest * www.techdebt.org © inspearit-2012 7
  • 8. Technical Debt and Agility Agile considers the source code as one major deliverable (not design model, not documentation) The definition of « right code » should be considered for the Definition(s) of Done « DoD » List of source code quality requirements Type and acceptable level of Technical Debt Agile promotes transparency Technical Debt shall be identified and monitored Project shall plan and prioritize activities for repaying and limiting this debt © inspearit-2012 8
  • 9. Technical Debt and Agile Projects Definition of « Continuous « Right Code » inspection » Acceptable type Monitoring TD and level of debt Part of debt to be repayed within the sprint © inspearit-2012 9
  • 10. What Managing Technical Debt Means? To Manage TD means at least: 1. Define what creates TD 2. Define how to calculate TD 3. Set Goals at organizational or project level 4. Monitor the TD against the goals 5. Compare TD across versions, projects, subcontractors… 6. Analyze TD (age, location and impact) 7. Set Pay down goals 8. Set Pay down plan/priorities 9. … © inspearit-2012 10
  • 11. Table of Content Reminder on Quality and Technical Debt Technical Debt: a powerful Paradigm Shift The SQALE method: Structure Analyzing Technical Debt with SQALE Paying back Technical Debt with SQALE Summary and Conclusion Demonstration 11
  • 12. Technical Debt: a Paradigm Shift Since the 70’s, the Software community is trying to measure « Quality » and Quality of source code Technical debt is measuring « Non Quality »! « Good Code » ∞ « Bad Code » ∞ Measures Measures « Bad Code » 0 « Right Code » 0 © inspearit-2012 12
  • 13. What is « right code » « Right code » is not « perfect code » No formal definition of Attribute1 « perfect code » « Not right code » area Perfect Code « Right code » area As soon as one attribute is in the unacceptable area (i.e. potentially decreasing productivity), the code is « not right » © inspearit-2012 13
  • 14. Formulas: 5 days training! Des formules complexes MAINTAINABILITY INDEX MI4 = 171 - 3.42ln(aveE) - 0.23aveV(g') - 16.2ln(aveLOC) + (50 x sin(sqrt(2.46 x aveCM)) CLASS COHESION LCOM = LCOM = ((1/a x ΣA) - m)/(1 - m) Where a is the number of attributes of the class, Σ A is the sum across the set of attributes of the number of methods that access each attribute, and m is the number of methods of the class. © inspearit-2012 14
  • 16. Benefits from the Paradigm Shift TD Specificities Benefits at measure level Aggregation by addition No masking, no false positive Inverse direction Objective « Right » vs « Perfect » Precise Easy to understand Technical debt is a much more powerful system compared to everything used previously to measure source code © inspearit-2012 16
  • 17. Table of Content Reminder on Quality and Technical Debt Technical Debt: a powerful Paradigm Shift The SQALE method: Structure Analyzing the Technical Debt with SQALE Paying back Technical Debt with SQALE Summary and Conclusion Demonstration 17
  • 18. The SQALE method: Context SQALE: Software Quality Assessment based on Lifecycle Expectations • Based on TD Implementation/Tools • Open source • Generic • Tool independant • Widely used Tailoring 4 concepts 9 Fundamental Principles Measurement theory and representativity Definition document, articles, tools list are on sqale.org © inspearit-2012 18
  • 19. SQALE Structure Analysis tools Source Code 1 Quality Model 2 Analysis Models 3 Indices 4 Indicators 1 2 3 3 6 9 5 1 A … E SQI Source code Estimation models STI related Findings Costs SRI requirements Table Tables Σ … Maintenabilité Efficacité Testabilité Fiabilité Evolutivité Efficacité 248 Maintenabilité 589 248 SQID Evolutivité 1 480 1 480 1 480 1 4 Fiabilité 548 548 548 548 … Testabilité 6 535 6 535 6 535 7 083 6 535 8 563 6 535 8 811 6 535 9 400 6 2 1 1 d. / h. / $ …. d. / h. / $ …. « Right Code » Technical Definition Debt © inspearit-2012 19
  • 20. The SQALE Quality Model: Source Code Requirements SQALE asks you to associate each of your expectations (requirements) with a quality characteristic Iso 25010 abilities Reuse Reusability Ordered characteristics Portability Maintain Reusability Maintainability Portability Deliver Security Maintainability Source code Efficiency related Security Evolve requirements Changeability Efficiency Reliability Changeability Test Testability Reliability Code Testability « Right Code » Requirements appear only once within the Quality Model, © inspearit-2012 when they are first needed. >>> orthogonal model 20
  • 21. SQALE: 2 Estimation Models Estimation models transform findings in costs One for the Technical Perspective > Technical Debt One for the Business Perspective > Business Impact Remediation Cost Naming « Right Code » Depends on the type and Violations Definition the amount of technical Presentation activities to perform in order to remediate the Logic violations (remediation life cycle) Instruction Requirement n … Test Coverage Depends on the negative impact on the business Structure activities. Architecture The penalty that will cover all damages that will or may happened from delivering These 2 derived measures are on a ratio scale and can be with violations added without breaching the representation clause © inspearit-2012 Non-Remediation Cost 21
  • 22. Table of Content Reminder on Quality and Technical Debt Technical Debt: a powerful Paradigm Shift The SQALE method: Structure Analyzing Technical Debt with SQALE Paying back Technical Debt with SQALE Summary and Conclusion Demonstration 22
  • 23. SQALE Structure Analysis tools Source Code 1 Quality Model 2 Analysis Models 3 Indices 1 2 3 3 6 9 5 1 SQI Source code Estimation models related Findings Costs requirements Table Tables Σ 1 4 … … 6 2 1 1 d. / h. / $ …. d. / h. / $ …. « Right Code » Technical Definition Debt © inspearit-2012 23
  • 24. What Managing Technical Debt Means? SQALE: To Manage TD means at least: 1. Define what creates TD Quality Model 2. Define how you calculate TD Remediation Function 3. Set Goals at organizational or project level 4. Monitor the TD against the goals 5. Compare TD across versions, projects, subcontractors… 6. Analyze TD (age, location and impact) 7. Set Pay down goals 8. Set Pay down plan/priorities 9. … © inspearit-2012 24
  • 25. Index: Technical Debt Density SQALE defines Density indicators You divide your TD by the size of your artifact Size may be measured in function points, KSLOC… SQID (SQALE Quality Index Density = Technical Debt Density) Allows to compare projects, versions, subcontractors… Allows to set goals without knowing the size in advance © inspearit-2012 25
  • 26. Indicator: The SQALE rating A synthetic indicator dedicated to management dashboards Based on the ratio between the Technical Debt and the Development Cost Development Cost E Technical Debt D C B A © inspearit 26
  • 27. What Managing Technical Debt Means? SQALE: To Manage TD means at least: 1. Define what creates TD Quality Model 2. Define how you calculate TD Remediation Function 3. Set Goals at organizational or project level 4. Monitor the TD against the goals Index Densities 5. Compare TD across versions, Rating projects, subcontractors… 6. Analyze TD (age, location and impact) 7. Set Pay down goals 8. Set Pay down plan/priorities 9. … © inspearit-2012 27
  • 28. The SQALE Pyramid: 2 points of view An external view that represents the perceived quality evaluated by consolidation of the hierarchy of characteristics An analytic view provided by orthogonal characteristics Maintainability One understands impact Σ of each Non-Conformity Efficiency and improvement on Σ Changeability quality characteristic and life cycle issues. Reliability Σ Σ Testability © inspearit-2012 28
  • 29. Analyze your Technical Debt The SQALE Pyramid provides a technical perspective : Impact on the project’s activities © inspearit-2012 29
  • 30. Which code is more « agile »? © inspearit-2012 30
  • 31. What Managing Technical Debt Means? SQALE: To Manage TD means at least: 1. Define what creates TD Quality Model 2. Define how you calculate TD Remediation Function 3. Set Goals at organizational or project level 4. Monitor the TD against the goals Index Densities 5. Compare TD across versions, Rating projects, subcontractors… Pyramid 6. Analyze TD (age, location and impact) 7. Set Pay down goals 8. Set Pay down plan/priorities 9. … © inspearit-2012 31
  • 32. Table of Content Reminder on Quality and Technical Debt Technical Debt: a powerful Paradigm Shift The SQALE method: Structure Analyzing Technical Debt with SQALE Paying back Technical Debt with SQALE Summary and Conclusion Demonstration 32
  • 33. The 2 ways to change code (In many cases), there are 2 ways to make a change The « logical » way = long term view The « quick and dirty » way = short term view The 2 perspectives are commonly considered to prioritize features. The same logic is applicable to Non-Conformities Features Non-Conformities Development Cost Business Value Technical Debt Business Impact Priorities/Decision Priorities/Decision Technical Business Technical Business Features List N.C. List Perspective Perspective Perspective Perspective © inspearit-2012 33
  • 34. Paying back your Technique Debt The SQALE pyramid defines a logical priority for remediation actions Reuse Reusability Portability Maintain Remediations Maintainability Deliver Security Efficiency Evolve Changeability Reliability Test Testability Code © inspearit-2012 34
  • 35. Deliver with a residual debt Technical Debt Technical Debt is permanently monitored and analyzed for identifying and performing immediate remediations Acceptable Level Time © inspearit-2012 35
  • 36. Deliver with a residual debt Technical Debt Optimization phase: One need to take into account the Business perspective in order to minimize the impact of the Technical Debt is permanently monitored residual debt and analyzed for identifying and performing immediate remediations Impact Acceptable Level Residual Technical Debt Time © inspearit-2012 36
  • 37. Analyze your Technical Debt The business perspective upon « Severity », « Importance » © inspearit-2012 37
  • 38. The SQALE Debt Map An analysis indicator valid at all artefact level Non-remediation Cost Business Impact - File - Component - Application Remediation Cost © inspearit-2012 Technical Debt 38
  • 39. Optimize your remediation budget Use the impact/cost ratio Non-remediation Cost Business Impact Remediation Cost © inspearit-2012 Technical Debt 39
  • 40. Table of Content Reminder on Quality and Technical Debt Technical Debt: a powerful Paradigm Shift The SQALE method: Structure Analyzing Technical Debt with SQALE Paying back Technical Debt with SQALE Summary and Conclusion Demonstration 40
  • 41. A simple but powerful paradigm • Simple calculation • Simple aggregation Technical Debt • Objectivity • Wide public • Few false positives • Representativeness • Clear rating rule SQALE method • Comparisons • Remediation priorities • Analysis perspectives © inspearit-2012 41
  • 42. Paying back the TD with SQALE SQALE support 3 different strategies: 1st strategy: Follow the technical Logic (avoid useless rework) Use the SQALE pyramid 2nd strategy: decrease the business impact by starting fixing the Non-conformities with the highest business impact Use the SQALE Business Impact (SBI) Use the Debt Map 3rd strategy: optimize your ROI by starting fixing the non-conformities with the highest ROI Use the Business Impact/Remediation cost ratio Use the Debt Map © inspearit-2012 Technical Debt 42
  • 43. SQALE deployment 1 Initialization 2 Tailoring 3 Pilot 4 Deployment Planning Method training Model Validation Tools installation & Stakeholders’ Tailoring the SQALE Building a ready to integration Scope… basic models deploy solution Awareness and Coaching sessions A simple technical part Setting your own SQALE models Tool implementation and validation A « Change management » part Fighting against old ideas about code measurement Addressing a large population 43
  • 44. The SQALE method: Summary Easy to understand and to deploy A strong and powerful implementation of the Technical Debt concept Open source and tool independent Used worldwide Expert recognition “In the domain of software quality evaluation, I find SQALE – Software Quality Assessment based on Life Cycle Expectations – a great tool for implementing my mantra. It interprets source code analysis in terms of what really matters in the specific client environment. In so doing, it transforms an overwhelming set of measurement data to actionable insights which are meaningful at multiple levels of the firm.” Israel Gat, Cutter Consortium © inspearit-2012 44
  • 45. Table of Content Reminder on Quality and Technical Debt The SQALE method and the Technical Debt The SQALE method and the Business Perspective Managing your Technical Debt with SQALE A powerful paradigm shift How to deploy/use the SQALE method Demonstration 45
  • 46. just sqale it Thanks Questions? http: /www.sqale.org jean-louis.letouzey@inspearit.com © inspearit 46