About Static Analysis (According to the ISTQB)

What is Static Analysis, according to the ISTQB:
http://istqbexamcertification.com/what-are-static-analysis-tools/

Static Analysis: What to Measure? And How?

In Static Analysis how and what should we measure?
It depends on what we want to analyze and / or control with this verification method.
If you want to know some reasons why it is important to be done, read here (static analysis - why).

How? 

The ideal scenario is to choose the right tool for the job you have to do (as always). This is the how. The tool ideally integrates with your favorite IDE (e.g. Checkstyle plugin for Eclipse, see more info here) so that features are readily available without tool and additional context changes.

What? 

Tools already measure things during static analysis and will allow you to do some kind of fine tuning on the KPI thresholds (e.g. minimum value for the measure, maximum value).

There are lots of papers (and standards) on what to measure to achieve, for instance, maintainability.

Examples of measures:
- LOC
- % comments
- Cyclomatic Complexity
- Max. Depth
- Average Depth
- Etc.

For each programming language there could be different recommendations for the KPIs. Also have a look on what the "community" has to say about it (and to the tool defaults for that language). i.e. Google for it.

Additional Info

Some additional ideas:

• https://en.wikipedia.org/wiki/Software_metric#Common_software_measurements
• http://www.kaner.com/pdfs/metrics2004.pdf
• What is Static Analysis (and examples of tools): http://istqbexamcertification.com/what-are-static-analysis-tools

You also have standards like AFP and AEP (from CISQ) that deal with these topics.

Requirements: Requirements Types (Functional, Non-Functional)

Requirement types are a useful categorization for your requirements catalog. There are several classifications and literature about the subject.
The following requirement types were identified according to European Space Agency (ESA) “Guide to the software requirements definition phase”.

FUNCTIONAL REQUIREMENTS

A function is a “defined objective or characteristic action of a system or component” and a functional
requirement “specifies a function that a system or system component must be able to perform”. Typically we will be describing functionality (features) with functional requirements at first. Then comes "the rest": Non-functional requirements.

NON-FUNCTIONAL REQUIREMENTS

• Performance Requirements specify numerical values for measurable variables used to define a function (e.g. rate, frequency, capacity, speed and accuracy). Performance requirements may be included in the quantitative statement of each function, or included as separate requirements.
• Interface Requirements specify hardware, software or database elements that the system, or system component, must interact or communicate with. Interface requirements should also be classified into “internal” and “external” interface requirements, depending upon whether or not the interface coincides with the system boundary.
• Operational Requirements specify how the system will run (i.e. when it is to be operated) and how it will communicate with human operators (e.g. screen and keyboards etc.). Operational requirements may describe physical aspects of the user interface. Descriptions of the dialogue, screen layouts, command language styles are all types of operational requirements.
• Resource Requirements specify the upper limits on physical resources such as processing power, main memory, disk space etc. They may describe any requirements that the development or operational environment place upon the software. A resource requirement should state the facts about the resources, and not constrain how they are deployed.
• Verification Requirements constrain the design of the product. They may do this by requiring features that facilitate verification of system functions or by saying how the product is to be verified.
• Documentation Requirements state project-specific requirements for documentation, in addition to those contained in Software Configuration Management Plan. The format and style of the Interface Control Documents may be described in the documentation requirements, for example. Documentation should be designed for the target readers (i.e. users and maintenance personnel).
• Security Requirements specify the requirements for securing the system against threats to confidentiality, integrity and availability. They should describe the level and frequency of access allowed to authorised users of the software. If prevention against unauthorised use is required, the type of unauthorised user should be described. The level of physical protection of the computer facilities may be stated (e.g. backups are to be kept in a fire-proof safe off-site).
• Portability Requirements specify how easy it should be to move the software from one environment to another. Possible computer and operating systems, other than those of the target system, should be stated.
• Quality Requirements specify the attributes of the software that make it fit for its purpose. The major quality attributes of reliability, maintainability and safety should always be stated separately. Where appropriate, software quality attributes should be specified in measurable terms (i.e. with the use of metrics).
• Reliability Requirements relate to the “the ability of a system or component to perform its required functions under stated conditions for a specified period of time”. The reliability metric, “Mean Time Between Failure” (MTBF), measures reliability according to this definition.
• Maintainability Requirements relate to the “the ease with which a software system or component can be modified to correct faults, improve performance or other attributes, or adapt to a changed environment”. All aspects of maintainability should be covered in the specification of the maintainability requirements, and should be specified, where appropriate, in quantitative terms.

Source: Requirements Standard (INTERNAL) and ESA.

FUN Dept.: About Early Deliveries (and the relation to Incompetence) | Dilbert

Have you been on a project that delivered in advance? Did you ever finish a task earlier than planned? Good! Don't ever think on following this advice:

FUN Dept.: Predictable persons | Dilbert

INSTALL: Sparx EA

To install and configure EA to use the floating license, starting from https://delivery.critical.pt/TechAreas/net/SitePages/ToolsPage.aspx select Enterprise Architect (https://delivery.critical.pt/TechAreas/net/SitePages/ToolEnterpriseArchitect.aspx). Look at the PDF with the installation instructions (INTERNAL).

You can also download a free trial from the Sparx Systems WWW site.

Configuration Management: Version Control System (VCS) and standardized folder structs

To support the CM activities, your company will make available a tool that can be called generically Version Control System (VCS).

Examples of such systems are Git, CVS and SVN (Wikipedia article here and comparison here).

Your QMS could have a Version Control System GBK (INTERNAL) to speed you up.

This guidebook also could be indicating common standard repository structures (per project type) so that when you move from project to project you'll know right away that you'll find meeting minutes in the same (relative) path, e.g. "quality-management\meeting-minutes", code under the "implementation" folder, requirements documentation under the "requirements" folder, and so on.

Folder structures could be different per project type, i.e. software development projects could have a different template used for initial folder strucutre creation than other of another project type (e.g. Services, R&D, etc.)


PS. BTW, are you a git (in VCS terms)? If so, do not complain to me, complain to Linus, Maybe because "He's such a stupid get" - John Lennon (quote from the "I'm so tired" Beatles song).

Fun Dept.: How's Work? | Dilbert

If you are doing software engineering with a "bad" team and/or leadership or without a proper [software develoment] process here's how you could be feeling:

RESOURCE: TIOBE Index or "the manhood index for programmers" (if they are men)

The Short Story

The latest version of this monthly rank can be found here (COBOL still appears on the second part of the ranking, and VB is pretty much up in the ranking): http://www.tiobe.com/tiobe_index?page=index

The rationale behind the calculations (or the index definition) is described here ("unfortunately" porn sites are excluded - just kidding).

The Long Story

Let me quickly share the TIOBE Index, aka as "the manhood index for programmers" (if they are men) - translated to PT this would translate to "Índice de Macheza do Pugramador" (sic). And this is why: A man should only be considered a man if it is programming on its current position using one of the top 3 languages in this index. If not, you can say to you (man) colleague: "Ah, you're really a chicken" (or something alike, preferably equally insulting).

Talking more seriously, you can look at this index in several ways:
- The current month rank: Shows what languages are more popular (or at least what have been more researched upon)
- The recent years trend (since June 2001)

You can look at this index in several ways: I want to position myself in a "popular" language (which translates to "top ranking language" in this ranking) over the last few years (define the number of years for your particular case); this could be a wise career decision (medium-long term).

But don't forget to look it the other way (the short term): Older languages (like COBOL or Delphi / Object Pascal) are not so popular but because resources are scarce they will be highly paid and could be in high demand: For instance look for job positions of Delphi Programmers in the UK to sort it out (is 320 GBP a day good enough for you?).

BOOK: The Unified Modeling Language Reference (Booch, Jacobson, Runbaugh)

This is the total opposite of the UML Distilled book, mainly because it has ~700 pages.
It is still a very good book by Grady Booch, James Runbaugh and Ivar Jacobson.

http://www.amazon.com/Unified-Modeling-Language-Reference-paperback/dp/032171895X

Book additional details:
ISBN-13: 978-0321718952
ISBN-10: 032171895X

BOOK: Service Design Patterns: Fundamental Design Solutions for SOAP/WSDL and RESTful Web Services (Robert Daigneau)

On patterns related to Web Services (SOAP and REST):

• http://www.amazon.com/Service-Design-Patterns-Fundamental-Solutions/dp/032154420X/ref=pd_sim_sbs_14_5?ie=UTF8&dpID=41A7b4McRzL&dpSrc=sims&preST=_AC_UL320_SR240%2C320_&refRID=1KKZFGSE9M8CEDJ03BNB 

Quoting:
"Web services have been used for many years. In this time, developers and architects have encountered a number of recurring design challenges related to their usage, and have learned that certain service design approaches work better than others to solve certain problems. (...)

This book will help readers answer the following questions:

• How do you create a web service API, what are the common API styles, and when should a particular style be used?
• How can clients and web services communicate, and what are the foundations for creating complex conversations in which multiple parties exchange data over extended periods of time?
• What are the options for implementing web service logic, and when should a particular approach be used?
• How can clients become less coupled to the underlying systems used by a service?
• How can information about a web service be discovered?
• How can generic functions like authentication, validation, caching, and logging be supported on the client or service?
• What changes to a service cause clients to break?
• What are the common ways to version a service? How can web services be designed to support the continuing evolution of business logic without forcing clients to constantly upgrade?"

BOOK: Patterns of Enterprise Application Architecture (Fowler)

For Enterprise Design Patterns this book is a must:

• http://www.amazon.com/Patterns-Enterprise-Application-Architecture-Martin/dp/0321127420/ref=pd_bxgy_14_img_3?ie=UTF8&refRID=03P48V22NYWE65KC0NV4

Citando:
"The practice of enterprise application development has benefited from the emergence of many new enabling technologies. Multi-tiered object-oriented platforms, such as Java and .NET, have become commonplace. These new tools and technologies are capable of building powerful applications, but they are not easily implemented. Common failures in enterprise applications often occur because their developers do not understand the architectural lessons that experienced object developers have learned. (...)

The topics covered include

·  Dividing an enterprise application into layers
·  The major approaches to organizing business logic
·  An in-depth treatment of mapping between objects and relational databases
·  Using Model-View-Controller to organize a Web presentation
·  Handling concurrency for data that spans multiple transactions
·  Designing distributed object interfaces"

BOOK: Enterprise Integration Patterns: Designing, Building, and Deploying Messaging Solutions (Woolf / Hohpe; 2003)

For successful integration of several information systems and/or data the use of enterprise integration patterns will help for sure:

• https://en.wikipedia.org/wiki/Enterprise_Integration_Patterns
• http://www.amazon.com/Enterprise-Integration-Patterns-Designing-Deploying/dp/8131725081/ref=dp_ob_title_bk 

Systems Modeling: About SysML

About SysML, a Systems Engineering Modeling Language, based on UML and using the UML Profile mechanism (that allows it to be extended):

• http://www.omgsysml.org/INCOSE-OMGSysML-Tutorial-Final-090901.pdf
• https://en.wikipedia.org/wiki/Systems_Modeling_Language#List_of_SysML_Tools
• http://www.jot.fm/issues/issue_2007_07/article5.pdf - 155 pages overview
• http://www.informit.com/store/sysml-distilled-a-brief-guide-to-the-systems-modeling-9780321927866 - SysML Distilled BOOK in a format similar to the UML Distilled book. 

PS. Sparx EA tool does support SysML. 

BOOK: Design Patterns: Elements of Reusable Object-Oriented Software (Gamma et al)

This is a must-read book aka as the Bible for Design Patterns written by the Gang of Four (GoF: Gamma et al.).

The main con is that examples are not in C# or Java (C++ and Smalltalk is used) but most of the design patterns introduced there are still widely used today.

Details here.

About QMS Process Areas, Documentation Levels and the Software Development Process (SDP)

The Short Story

• The Top Level Docs of a QMS, e.g. the QM
• How to subdivide Areas into Process Areas? By defining Key Process Areas in a QMS (acc. ISO15504 for instance). Details about Process Areas.  
• Documentation levels: QMS artifacts range from the top-level ones (referred above) to the more detailed ones. How could documentation levels be defined?
• And last but not least: How to define your SDP?

The Long Story...

... Can be read following the above links and reading the SDP process document.

SW Design, SW Construction: Security as a Design Quality Attribute ("5 lines" summary)

Some topics on Security (the "5 lines" summary with a little bit more than 5 lines): As a systems analyst, system architect, software developer and tester (SPA Engineer) you must:

- Read on security related to the technologies you'll be using for producing the final information system being developed (i.e. the solution):

• C++, C, Java, ... - there are full books on the security topic 
• JEE, .Net and other enterprise application frameworks
• RDBMS and other entity persistence means 
• Other common core system components like...
• App. Servers (JBoss and the like)
• Web Servers (Apache, IIS and the like)
• Operating Systems 
• Anything else (that your system reuses: drivers, hardware, ...). 

- Make sure everything above is patched (regularly) and that whatever you program (and configure) is secure in the light of what you (regularly) read.

Remember to:
- Subscribe newsletters on the topic (of follow the proper newfeeds / groups) to help you keeping updated
- Use the proper frameworks for helping you on security as a process, for example:

The OWASP Application Security Verification Standard (ASVS) Project provides a basis for testing web application technical security controls and also provides developers with a list of requirements for secure development.

- Use the proper tools to help you (executing security assessments) before release. Raise all relevant [code] issues found.
- Reuse the invaluable resources (with guidelines and concrete checklists for specific technologies) like the following (take your time exploring them properly and use whatever suits you):

• https://ics-cert.us-cert.gov/Assessments
• http://www.ussecurityawareness.org/highres/infosec-auditing.html
• https://web.nvd.nist.gov/view/ncp/repository

The bottom line: 
Security is a process: You change a line of code (or a system component) and you could have changed the security characteristics of your system as a whole. Remember that a system is as strong as its weakest link (and you don't want to have been working on that weakest part).

(@2016-11-15: minor rephrases, formatting)

Standards: Terminology Standards (Acronyms and Definitions "for all")

Your company has for sure a Glossary of terms that you should read and know from the start to the very end. Do you?

If not, you can always start learning a little bit more about terminology of the [software] industry (as well as UXD terms and other related disciplines) in these standards and/or googable / purchasable documents:

• ECSS, Glossary of Terms, ECSS-P-001 Issue 1 Rev., 11 June 1997. ECSS-P-001
• ISO, Space systems. Glossary of terms, BS EN 13701:2001, CU, 15 July 2001 BS EN 13701:2001
• CMU/SEI, CMMI for Development, CMU/SEI-2006-TR-008, Version 1.2., August 2006, CMU/SEI-2006-TR-008
• ISO, Quality management systems. Fundamentals and vocabulary, BS EN ISO 9000:2005, October 2005, BS EN ISO 9000:2005

• ECSS, Space Engineering – Software, ECSS-E-40B Draft 1, 15 February 2002. ECSS-E-40B
• NATO, NATO Supplementary Software Quality Assurance Requirements to AQAP 2110, AQAP-2210 NATO, Edition 1 – November 2006, AQAP-150
• NATO, NATO Quality Assurance Requirements for Design, Development and Production, AQAP-2110 NATO, Edition 3 –November 2009, AQAP-2110
• SynSpace, Software Engineering Glossary, www.synspace.com, N/A

• ISO, Human-centred design processes for interactive systems, 13407:1999, 1st June 1999. ISO13407:1999 (now outdated)
• Morgan Kaufmann, Usability Engineering, Jakob Nielsen, 23rd September 1993. 978-0125184069
• IS/ISO, Quality Management – Customer Satisfaction – Guidelines for Complaints handling in Organizations, ISO 10002 (2004), January 2006, ISO 10002:2004

(2016-09-30: reordering)

The Fun Dept.: The new password policy | Dilbert

PS. Copyright stated in the target image.

INTERNAL RESOURCE: Toolsets and corporate info repositories

As you might notice the subtitles are somewhat disputable. JIRA was once just an issue tracker, now it's much more than this. So how would you categorize it? It's what it is. ;)

Installable Tools 

- Install GTM locally (to attend GTM meetings): http://support.citrixonline.com/en_US/Meeting/help_files/G2M010002
- Install GTM Outlook Plugin (that adds some actions in the New Appointment window) - to speed up the schedule of meetings: https://builds.citrixonlinecdn.com/builds/calendarintegration/outlook/G2M/setup.exe


- EA: Download and install instructions (shared key):
https://delivery.critical.pt/TechAreas/net/SitePages/ToolEnterpriseArchitect.aspx
https://delivery.critical.pt/TechAreas/net/Shared%20Documents/Get%20shared%20Key%20in%20EA.PDF (Get Shared Key - Floating License).

Training and other "Knowledge Items" and Information Repositories

- Internal Training Materials (Recent):
https://my.critical.pt/humanresources/Pages/TRAINING-MATERIALS.aspx#Tools

- CMS - Technical Portal:
https://delivery.critical.pt/TechAreas/SitePages/Landing%20Page.aspx (Java, .Net, DB, UXD, Safety-Critical, etc.)
https://delivery.critical.pt/TechAreas/SafetyCritical/SitePages/Home.aspx

PS. Old portal in oldportal.critical.pt (https://oldportal.critical.pt/Paginas/Default.aspx)

- QMS Portal:
https://quality.critical.pt/

- QMS offline / RSS notifications HOWTO:
https://quality.critical.pt/SitePages/QMS/QMS%20Tutorial.aspx

- QMS Org. Stds.:
https://quality.critical.pt/orgstandards/Forms/QMS.aspx

Advanced Lifecycle Management (ALM) Tools

There are complete suites for advanced life-cycle management (ALM) of the software development (there is a list here) and some advanced editions of your favorite IDE could offer most of the ALM tools needed for demanding collaborative software development projects (in a single environment).
Also make sure to look here for the Gartner Magic Quadrant for the ALM Tools.

JIRA, JIRA plugins and Maybe More

If you do have the money, you could use a set of tools to support your software development. Some of them are free (as all good things in life). Some other aren't.

Examples include:

• Issue tracker: Issues trend, tasks / actions management, risks, agile and crucible plugins, searches (by ID and custom searches), custom dashboards and exports.
• JIRA Agile (previously called GreenHoper plugin, now comes out-of-the-box): burn-down charts, task boards, planning boards, etc.: https://jira.critical.pt/browse/VISIONCENTER/?selectedTab=com.pyxis.greenhopper.jira:greenhopper-project-panel-tab
• Code Reviews plugin: Crucible: https://crucible.critical.pt/cru/ATG-5#CFR-11408
• Test Management plugin: X-Ray, https://jira.critical.pt/browse/BFAFREND/?selectedTab=com.xpandit.plugins.xray:test-panel (also check BMS, NEO)
• About X-Ray (and SPIRA): https://my.critical.pt/humanresources/Documents/CSW-SPA-2015-PRS-01762-test-management-with-xray.pptx
• Risk Mg. plugin (Example): https://jira.critical.pt/browse/VISIONCENTER/?selectedTab=com.ja.jira.plugin.report.riskmanagement:RiskManagementTab

AOB

• WISE: WISE Tasks (incl. recursivity); WISE Intra Doc (Doc. ID generation), WISE | Resources | Software Licenses, Lessons Learned DB; for PMs the Projects Module is the key feature (showing EVM indicators and more). Bein g phased out to other INTERNAL system: https://pulsar.critical.pt.
• Task tracker for WISE (auxiliary tool, unsupported and being "phased out"): Accessible via the Intranet Tools menu. Stopwatch-like interface, useful for whoever has lots of WPs or Activities and has to record effort on them frequently: http://infoserv.critical.pt/index.php?title=Internal_Tools/Task_Tracker_for_Wise_%2B%2B/Releases

- Continuous Integration, examples:

• Jenkins: http://jenkins.critical.pt/computer/(master)/
• Teamcity could also be in use for some projects.
• About CI: https://en.wikipedia.org/wiki/Comparison_of_continuous_integration_software

- Corporate site, Quality Certifications rationale:

• http://www.criticalsoftware.com/pt/homepage (for the offer, verticals / business areas)
• http://www.criticalsoftware.com/en/how-we-do-it/quality (look for "CERTIFICATIONS & STANDARDS")

- E-mail configs and list management tool (post 2016-05), CSW PT credentials: 

• List Management Tool (Local installation):  \\files.critical.pt\Repository\Licensed-Software\CJWDe
• Web mail: http://outlook.com/owa/criticalsoftware.com (redirected from https://mail.critical.pt)
• Exchange config: http://www.colorado.edu/oit/tutorial/office-365-outlook-windows-manual-exchange-configuration
• Mobile devices config: https://support.office.com/en-us/article/Set-up-Office-apps-and-email-on-a-mobile-device-7dabb6cb-0046-40b6-81fe-767e0b1f014f?ui=en-US&rs=en-US&ad=US
• Office Online, Office 365 (for those who have license for it):  https://login.microsoftonline.com

- VCS clients (INTERNAL):

• CVS Windows client installer, get it here (or get TortoiseCVS): \\files.critical.pt\repository\Base-Software\CVS (see CSW-SYSDEPAR-2006-MMO-2514 for Windows, see CSW-SYSDEPAR-2006-MMO-2513 for Linux)
• SVN Windows client installer (TortoiseSVN): \\files.critical.pt\repository\Base-Software\SVN
• Git: Read this topic "Come on be a Git" for installers.
• Web clients (for quick access of single files on computers without the local VCS clients installed; VPN required): https://svn.critical.pt/svn/ and https://cvs.critical.pt/cgi-bin/cvsweb.cgi/

(2016-05-11: added ALM reference as well as ALM links; 2016-06-07: added list mg. tool; 2016-06-09: Office 365; 2016-09-26: minor rephrases, VCS info; 2017-05-04: rephrases, detail in topics, formatting issues, pulsar, git)