AIR JAM: The U.S .

Federal Aviation
billion
Administration spent $2.6 ic-
air-traff
trying to upgrade its to cancel the
control system, only dlocked skies
project in 1994. Gri ay.
are still with us tod

We waste billions of dollars

each year on entirely
preventable mistakes
By Robert N. Charette

Have you heard the one about the disappearing warehouse? One day,
it vanished—not from physical view, but from the watchful eyes of
a well-known retailer’s automated distribution system. A software
glitch had somehow erased the warehouse’s existence, so that goods
destined for the warehouse were rerouted elsewhere, while goods at
the warehouse languished. Because the company was in financial
ODD ANDERSEN/AFP/GETTY IMAGES

trouble and had been shuttering other warehouses to save money,

the employees at the “missing” warehouse kept quiet. For three years,
nothing arrived or left. Employees were still getting their paychecks,
however, because a different computer system handled the payroll.
When the software glitch finally came to light, the merchandise in
the warehouse was sold off, and upper management told employees
to say nothing about the episode.

42 IEEE Spectrum | September 2005 | NA www.spectrum.ieee.org

 MARKET CRAS
automated suppH: After its new
system failed ly -chain management
last October, leav
merchandise stuc k in company ing
warehouses, Brit is
Sainsbury's had to h food retailer
additional clerks hire 3000
to stock its shelve
s.

This story has been floating around the information well as investments that can’t be made—are now well
technology industry for 20-some years. It’s probably into the billions of dollars a year.
apocryphal, but for those of us in the business, it’s The problem only gets worse as IT grows ubiquitous.
entirely plausible. Why? Because episodes like this hap- This year, organizations and governments will spend an
pen all the time. Last October, for instance, the giant estimated $1 trillion on IT hardware, software, and serv-
British food retailer J Sainsbury PLC had to write off its ices worldwide. Of the IT projects that are initiated, from
US $526 million investment in an automated supply-chain 5 to 15 percent will be abandoned before or shortly after
management system. It seems that merchandise was stuck delivery as hopelessly inadequate. Many others will arrive
in the company’s depots and warehouses and was not get- late and over budget or require massive reworking. Few
ting through to many of its stores. Sainsbury was forced IT projects, in other words, truly succeed.
to hire about 3000 additional clerks to stock its shelves The biggest tragedy is that software failure is for the
manually [see photo, “Market Crash”]. most part predictable and avoidable. Unfortunately, most
This is only one of the latest in a long, dismal history organizations don’t see preventing failure as an urgent
GRAHAM BARCLAY/BLOOMBERG NEWS/LANDOV

of IT projects gone awry [see table, “Software Hall of matter, even though that view risks harming the organi-
Shame” for other notable fiascoes]. Most IT experts agree zation and maybe even destroying it. Understanding why
that such failures occur far more often than they should. this attitude persists is not just an academic exercise; it
What’s more, the failures are universally unprejudiced: has tremendous implications for business and society.
they happen in every country; to large companies and
small; in commercial, nonprofit, and governmental SOFTWARE IS EVERYWHERE. It’s what lets us
organizations; and without regard to status or reputa- get cash from an ATM, make a phone call, and drive our
tion. The business and societal costs of these failures— cars. A typical cellphone now contains 2 million lines
in terms of wasted taxpayer and shareholder dollars as of software code; by 2010 it will likely have 10 times as

www.spectrum.ieee.org September 2005 | IEEE Spectrum | NA 43

 YEAR COMPANY OUTCOME (COSTS IN US $)
2005 Hudson Bay Co. [Canada] Problems with inventory system contribute to $33.3 million* loss.

2004-05 UK Inland Revenue Software errors contribute to $3.45 billion* tax-credit overpayment.

2004 Avis Europe PLC [UK] Enterprise resource planning (ERP) system canceled after $54.5 million† is spent.

2004 Ford Motor Co. Purchasing system abandoned after deployment costing approximately $400 million.

2004 J Sainsbury PLC [UK] Supply-chain management system abandoned after deployment costing $527 million.†

2004 Hewlett-Packard Co. Problems with ERP system contribute to $160 million loss.

2003–04 AT&T Wireless Customer relations management (CRM) upgrade problems lead to revenue loss of $100 million.

2002 McDonald’s Corp. The Innovate information-purchasing system canceled after $170 million is spent.

2002 Sydney Water Corp. [Australia] Billing system canceled after $33.2 million† is spent.

2002 CIGNA Corp. Problems with CRM system contribute to $445 million loss.

2001 Nike Inc. Problems with supply-chain management system contribute to $100 million loss.

2001 Kmart Corp. Supply-chain management system canceled after $130 million is spent.

2000 Washington, D.C. City payroll system abandoned after deployment costing $25 million.

1999 United Way Administrative processing system canceled after $12 million is spent.

1999 State of Mississippi Tax system canceled after $11.2 million is spent; state receives $185 million damages.

1999 Hershey Foods Corp. Problems with ERP system contribute to $151 million loss.

1998 Snap-on Inc. Problems with order-entry system contribute to revenue loss of $50 million.

1997 U.S. Internal Revenue Service Tax modernization effort canceled after $4 billion is spent.

1997 State of Washington Department of Motor Vehicle (DMV) system canceled after $40 million is spent.

1997 Oxford Health Plans Inc. Billing and claims system problems contribute to quarterly loss; stock plummets,
leading to $3.4 billion loss in corporate value.
1996 Arianespace [France] Software specification and design errors cause $350 million Ariane 5 rocket to explode.
1996 FoxMeyer Drug Co. $40 million ERP system abandoned after deployment, forcing company into bankruptcy.
1995 Toronto Stock Exchange [Canada] Electronic trading system canceled after $25.5 million** is spent.
1994 U.S. Federal Aviation Administration Advanced Automation System canceled after $2.6 billion is spent.
1994 State of California DMV system canceled after $44 million is spent.
1994 Chemical Bank Software error causes a total of $15 million to be deducted from 100 000 customer accounts.
1993 London Stock Exchange [UK] Taurus stock settlement system canceled after $600 million** is spent.
1993 Allstate Insurance Co. Office automation system abandoned after deployment, costing $130 million.
1993 London Ambulance Service [UK] Dispatch system canceled in 1990 at $11.25 million**; second attempt abandoned after
deployment, costing $15 million.**
1993 Greyhound Lines Inc. Bus reservation system crashes repeatedly upon introduction, contributing to
revenue loss of $61 million.
1992 Budget Rent-A-Car, Hilton Hotels, Marriott Travel reservation system canceled after $165 million is spent.
International, and AMR [American Airlines]

Sources: Business Week, CEO Magazine, Computerworld, InfoWeek, Fortune, The New York Times, Time, and The Wall Street Journal
* Converted to U.S. dollars using current exchange rates as of press time.
† Converted to U.S. dollars using exchange rates for the year cited, according to the International Trade Administration, U.S. Department of Commerce.
** Converted to U.S. dollars using exchange rates for the year cited, according to the Statistical Abstract of the United States, 1996 .

44 IEEE Spectrum | September 2005 | NA www.spectrum.ieee.org

many. General Motors Corp. estimates that
by then its cars will each have 100 million
lines of code.
The average company spends about 4 to
Case Study # 1
5 percent of revenue on information tech-
nology, with those that are highly IT COMPANY:
dependent—such as financial and telecom-
Oxford Health Plans
munications companies—spending more
than 10 percent on it. In other words, IT is
now one of the largest corporate expenses FAILURE: LOSS:
outside employee costs. Much of that money
goes into hardware and software upgrades,
New billing system October 1997 announcement of
software license fees, and so forth, but a big cannot keep up with quarterly loss triggers stock
chunk is for new software projects meant to expanding business, price to drop from $68 to
create a better future for the organization and resulting in uncollected $26 in one day, wiping out
its customers. $3.4 billion in corporate
payments of $400 million
Governments, too, are big consumers of
software. In 2003, the United Kingdom had
from patients and value. Company later pays
more than 100 major government IT proj- $650 million owed to investors $225 million to
ects under way that totaled $20.3 billion. caregivers. settle lawsuits.
In 2004, the U.S. government cataloged
1200 civilian IT projects costing more than
$60 billion, plus another $16 billion for military software. the total abandonment of a project before or shortly after it is
Any one of these projects can cost over $1 billion. To take two delivered, and if you accept a conservative failure rate of 5 percent,
current examples, the computer modernization effort at the U.S. then billions of dollars are wasted each year on bad software.
Department of Veterans Affairs is projected to run $3.5 billion, For example, in 2004, the U.S. government spent $60 billion
while automating the health records of the UK’s National Health on software (not counting the embedded software in weapons sys-
Service is likely to cost more than $14.3 billion for development tems); a 5 percent failure rate means $3 billion was probably wasted.
and another $50.8 billion for deployment. However, after several decades as an IT consultant, I am convinced
Such megasoftware projects, once rare, are now much more com- that the failure rate is 15 to 20 percent for projects that have
mon, as smaller IT operations are joined into “systems of systems.” budgets of $10 million or more. Looking at the total investment in
Air traffic control is a prime example, because it relies on connec- new software projects—both government and corporate—over the
tions among dozens of networks that provide communications, last five years, I estimate that project failures have likely cost the
weather, navigation, and other data. But the trick of integration has U.S. economy at least $25 billion and maybe as much as $75 billion.
stymied many an IT developer, to the point where academic Of course, that $75 billion doesn’t reflect projects that exceed
researchers increasingly believe that computer science itself may their budgets—which most projects do. Nor does it reflect proj-
need to be rethought in light of these massively complex systems. ects delivered late—which the majority are. It also fails to account
for the opportunity costs of having to start over once a project
WHEN A SOFTWARE PROJECT FAILS, it jeopardizes is abandoned or the costs of bug-ridden systems that have to be
an organization’s prospects. If the failure is large enough, it can repeatedly reworked.
steal the company’s entire future. In one stellar meltdown, a poorly Then, too, there’s the cost of litigation from irate customers
implemented resource planning system led FoxMeyer Drug Co., suing suppliers for poorly implemented systems. When you add
a $5 billion wholesale drug distribution company in Carrollton, up all these extra costs, the yearly tab for failed and troubled soft-
Texas, to plummet into bankruptcy in 1996. ware conservatively runs somewhere from $60 billion to $70 billion
IT failure in government can imperil national security, as the in the United States alone. For that money, you could launch the
FBI’s Virtual Case File debacle has shown. The $170 million VCF space shuttle 100 times, build and deploy the entire 24-satellite
system, a searchable database intended to allow agents to “con- Global Positioning System, and develop the Boeing 777 from
nect the dots” and follow up on disparate pieces of intelligence, scratch—and still have a few billion left over.
instead ended five months ago without any system’s being
deployed [see “Who Killed the Virtual Case File?” in this issue]. WHY DO SOFTWARE PROJECTS FAIL SO OFTEN?
IT failures can also stunt economic growth and quality of life. Among the most common factors:
Back in 1981, the U.S. Federal Aviation Administration began look- • Unrealistic or unarticulated project goals
ing into upgrading its antiquated air-traffic-control system, but • Inaccurate estimates of needed resources
the effort to build a replacement soon became riddled with prob- • Badly defined system requirements
lems [see photo, “Air Jam”]. By 1994, when the agency finally gave • Poor reporting of the project’s status
up on the project, the predicted cost had tripled, more than • Unmanaged risks
$2.6 billion had been spent, and the expected delivery date had • Poor communication among customers, developers, and users
slipped by several years. Every airplane passenger who is delayed • Use of immature technology
because of gridlocked skyways still feels this cancellation; the • Inability to handle the project’s complexity
cumulative economic impact of all those delays on just the U.S. • Sloppy development practices
airlines (never mind the passengers) approaches $50 billion. • Poor project management
Worldwide, it’s hard to say how many software projects fail or • Stakeholder politics
how much money is wasted as a result. If you define failure as • Commercial pressures

www.spectrum.ieee.org September 2005 | IEEE Spectrum | NA 45

 Of course, IT projects rarely fail for just one or two reasons. The SOFTWARE PROJECT FAILURES have a lot in common
FBI’s VCF project suffered from many of the problems listed above. with airplane crashes. Just as pilots never intend to crash, soft-
Most failures, in fact, can be traced to a combination of technical, ware developers don’t aim to fail. When a commercial plane
project management, and business decisions. Each dimension inter- crashes, investigators look at many factors, such as the weather,
acts with the others in complicated ways that exacerbate project maintenance records, the pilot’s disposition and training, and
risks and problems and increase the likelihood of failure. cultural factors within the airline. Similarly, we need to look at
Consider a simple software chore: a purchasing system that auto- the business environment, technical management, project man-
mates the ordering, billing, and shipping of parts, so that a sales- agement, and organizational culture to get to the roots of soft-
person can input a customer’s order, have it automatically checked ware failures.
against pricing and contract requirements, and arrange to have the Chief among the business factors are competition and the need
parts and invoice sent to the customer from the warehouse. to cut costs. Increasingly, senior managers expect IT departments
The requirements for the system specify four basic steps. to do more with less and do it faster than before; they view software
First, there’s the sales process, which creates a bill of sale. That projects not as investments but as pure costs that must be controlled.
bill is then sent through a legal process, which reviews the con- Political exigencies can also wreak havoc on an IT project’s
tractual terms and conditions of the potential sale and approves schedule, cost, and quality. When Denver International Airport
them. Third in line is the provision process, which sends out the attempted to roll out its automated baggage-handling system, state
parts contracted for, followed by the finance process, which sends and local political leaders held the project to one unrealistic sched-
out an invoice. ule after another. The failure to deliver the system on time delayed
Let’s say that as the first process, for sales, is being written, the 1995 opening of the airport (then the largest in the United
the programmers treat every order as if it were placed in the com- States), which compounded the financial impact manyfold.
pany’s main location, even though the company has branches in Even after the system was completed, it never worked reliably:
several states and countries. That mistake, in turn, affects how it chewed up baggage, and the carts used to shuttle luggage around
tax is calculated, what kind of contract is issued, and so on. frequently derailed. Eventually, United Airlines, the airport’s main
The sooner the omission is detected and corrected, the bet- tenant, sued the system contractor, and the episode became a tes-
ter. It’s kind of like knitting a sweater. If you spot a missed stitch tament to the dangers of political expediency.
right after you make it, you can simply unravel a bit of yarn and A lack of upper-management support can also damn an IT
move on. But if you don’t catch the mistake until the end, you undertaking. This runs the gamut from failing to allocate enough
may need to unravel the whole sweater just to redo that one stitch. money and manpower to not clearly establishing the IT project’s
If the software coders don’t catch their omission until final relationship to the organization’s business. In 2000, retailer Kmart
system testing—or worse, until after the system has been rolled Corp., in Troy, Mich., launched a $1.4 billion IT modernization
out—the costs incurred to correct the error will likely be many effort aimed at linking its sales, marketing, supply, and logis-
times greater than if they’d caught the mistake while they were tics systems, to better compete with rival Wal-Mart Corp., in
still working on the initial sales process. Bentonville, Ark. Wal-Mart proved too formidable, though, and
And unlike a missed stitch in a sweater, this problem is much 18 months later, cash-strapped Kmart cut back on moderniza-
harder to pinpoint; the programmers will see only that errors tion, writing off the $130 million it had already invested in IT.
are appearing, and these might have several causes. Even after the Four months later, it declared bankruptcy; the company contin-
original error is corrected, they’ll need to change other calcula- ues to struggle today.
tions and documentation and then retest every step. Frequently, IT project managers eager to get funded resort to
In fact, studies have shown that software specialists spend a form of liar’s poker, overpromising what their project will do,
about 40 to 50 percent of their time on avoidable rework rather how much it will cost, and when it will be completed. Many, if
than on what they call value-added work, which is basically work not most, software projects start off with budgets that are too
that’s done right the first time. Once a piece of software makes small. When that happens, the developers have to make up for
it into the field, the cost of fixing an error can be 100 times as the shortfall somehow, typically by trying to increase produc-
high as it would have been during the development stage. tivity, reducing the scope of the effort, or taking risky shortcuts
If errors abound, then rework can start to swamp a project, like in the review and testing phases. These all increase the likelihood
a dinghy in a storm. What’s worse, attempts to fix an error often of error and, ultimately, failure.
introduce new ones. It’s like you’re bailing out that dinghy, but A state-of-the-art travel reservation system spearheaded by
you’re also creating leaks. If too many errors are produced, the a consortium of Budget Rent-A-Car, Hilton Hotels, Marriott, and
cost and time needed to complete the system become so great that AMR, the parent of American Airlines, is a case in point. In 1992,
going on doesn’t make sense. three and a half years and $165 million into the project, the group
In the simplest terms, an IT project usually fails when the abandoned it, citing two main reasons: an overly optimistic devel-
rework exceeds the value-added work that’s been budgeted for. opment schedule and an underestimation of the technical diffi-
This is what happened to Sydney Water Corp., the largest water culties involved. This was the same group that had earlier built
provider in Australia, when it attempted to introduce an automated the hugely successful Sabre reservation system, proving that past
customer information and billing system in 2002 [see box, “Case performance is no guarantee of future results.
Study #2”]. According to an investigation by the Australian Auditor
General, among the factors that doomed the project were inade- AFTER CRASH INVESTIGATORS CONSIDER the
quate planning and specifications, which in turn led to numer- weather as a factor in a plane crash, they look at the airplane itself.
ous change requests and significant added costs and delays. Was there something in the plane’s design that caused the crash?
Sydney Water aborted the project midway, after spending Was it carrying too much weight?
AU $61 million (US $33.2 million). In IT project failures, similar questions invariably come up
All of which leads us to the obvious question: why do so many regarding the project’s technical components: the hardware and
errors occur? software used to develop the system and the development prac-

46 IEEE Spectrum | September 2005 | NA www.spectrum.ieee.org

 tices themselves. Organizations are often seduced by the siren ously, companies with the worst IT practices won’t subject them-
song of the technological imperative—the uncontrollable urge selves to a CMM evaluation. (The CMM is being superseded by the
to use the latest technology in hopes of gaining a competitive CMM-Integration, which aims for a broader assessment of an orga-
edge. With technology changing fast and promising fantastic new nization’s ability to create software-intensive systems.)
capabilities, it is easy to succumb. But using immature or untested Immature IT practices doomed the U.S. Internal Revenue
technology is a sure route to failure. Service’s $4 billion modernization effort in 1997, and they have
In 1997, after spending $40 million, the state of Washington continued to plague the IRS’s current $8 billion modernization. It
shut down an IT project that would have processed driver’s may just be intrinsically impossible to translate the tax code
licenses and vehicle registrations. Motor vehicle officials admit- into software code—tax law is complex and based on often-vague
ted that they got caught up in chasing technology instead of con- legislation, and it changes all the time. From an IT developer’s
centrating on implementing a system that met their requirements. standpoint, it’s a requirements nightmare. But the IRS hasn’t been
The IT debacle that brought down FoxMeyer Drug a year earlier helped by open hostility between in-house and outside pro-
also stemmed from adopting a state-of-the-art resource-planning grammers, a laughable underestimation of the work involved, and
system and then pushing it beyond what it could feasibly do. many other bad practices.
A project’s sheer size is a fountainhead of failure. Studies indi-
cate that large-scale projects fail three to five times more often than THE PILOT'S ACTIONS JUST BEFORE a plane crashes
small ones. The larger the project, the more complexity there is are always of great interest to investigators. That’s because the pilot
in both its static elements (the discrete pieces of software, hard- is the ultimate decision-maker, responsible for the safe operation of
ware, and so on) and its dynamic ele-
ments (the couplings and interactions
among hardware, software, and users;
connections to other systems; and so
Case Study #2
on). Greater complexity increases the
possibility of errors, because no one COMPANY:
really understands all the interacting
Sydney Water Corp.
parts of the whole or has the ability to
test them.
Sobering but true: it’s impossible to
FAILURE:
thoroughly test an IT system of any real Project to automate
size. Roger S. Pressman pointed out in customer information
his book Software Engineering, one of the and billing for
classic texts in the field, that “exhaustive
Australia's largest
testing presents certain logistical prob-
lems.…Even a small 100-line program water provider is
with some nested paths and a single loop canceled in 2002, due
executing less than twenty times may to inadequate plan-
require 10 to the power of 14 possible ning, numerous change
paths to be executed.” To test all of those
requests, and cost and
COST:
100 trillion paths, he noted, assuming
each could be evaluated in a millisecond, schedule overruns. $33.2 million
would take 3170 years.
All IT systems are intrinsically frag-
ile. In a large brick building, you’d have to remove hundreds of the craft. Similarly, project managers play a crucial role in software
strategically placed bricks to make a wall collapse. But in a projects and can be a major source of errors that lead to failure.
100 000-line software program, it takes only one or two bad lines Back in 1986, the London Stock Exchange decided to auto-
to produce major problems. In 1991, a portion of AT&T’s telephone mate its system for settling stock transactions. Seven years later,
network went out, leaving 12 million subscribers without service, after spending $600 million, it scrapped the Taurus system’s devel-
all because of a single mistyped character in one line of code. opment, not only because the design was excessively complex and
Sloppy development practices are a rich source of failure, and cumbersome but also because the management of the project
they can cause errors at any stage of an IT project. To help organi- was, to use the word of one of its own senior managers, “delu-
zations assess their software-development practices, the U.S. sional.” As investigations revealed, no one seemed to want to
Software Engineering Institute, in Pittsburgh, created the Capability know the true status of the project, even as more and more prob-
Maturity Model, or CMM. It rates a company’s practices against five lems appeared, deadlines were missed, and costs soared [see
levels of increasing maturity. Level 1 means the organization is using box, “Case Study #3”].
ad hoc and possibly chaotic development practices. Level 3 means The most important function of the IT project manager is to
the company has characterized its practices and now understands allocate resources to various activities. Beyond that, the project
them. Level 5 means the organization quantitatively understands manager is responsible for project planning and estimation, con-
GREG WOOD/AFP/GETTY IMAGES

the variations in the processes and practices it applies. trol, organization, contract management, quality management, risk
As of January, nearly 2000 government and commercial organ- management, communications, and human resource management.
izations had voluntarily reported CMM levels. Over half acknowl- Bad decisions by project managers are probably the single great-
edged being at either level 1 or 2, 30 percent were at level 3, and only est cause of software failures today. Poor technical management, by
17 percent had reached level 4 or 5. The percentages are even more contrast, can lead to technical errors, but those can generally be
dismal when you realize that this is a self-selected group; obvi- isolated and fixed. However, a bad project management decision—

www.spectrum.ieee.org September 2005 | IEEE Spectrum | NA 47

such as hiring too few programmers or picking the wrong type way. The same attitudes existed among those responsible for the
of contract—can wreak havoc. For example, the developers of travel reservation system, the London Stock Exchange’s Taurus
the doomed travel reservation system claim that they were hob- system, and the FAA’s air-traffic-control project—all indicative of
bled in part by the use of a fixed-price contract. Such a contract organizational cultures driven by fear and arrogance.
assumes that the work will be routine; the reservation system A recent report by the National Audit Office in the UK found
turned out to be anything but. numerous cases of government IT projects’ being recommended
Project management decisions are often tricky precisely because not to go forward yet continuing anyway. The UK even has a gov-
they involve tradeoffs based on fuzzy or incomplete knowledge. ernment department charged with preventing IT failures, but as
Estimating how much an IT project will cost and how long it will the report noted, more than half of the agencies the department
take is as much art as science. The larger or more novel the proj- oversees routinely ignore its advice. I call this type of behavior
ect, the less accurate the estimates. It’s a running joke in the indus- irrational project escalation—the inability to stop a project even
try that IT project estimates are at best within 25 percent of their after it’s obvious that the likelihood of success is rapidly approach-
true value 75 percent of the time. ing zero. Sadly, such behavior is in no way unique.
There are other ways that poor project management can hasten
a software project’s demise. A study by the Project Management IN THE FINAL ANALYSIS, big software failures tend to
Institute, in Newton Square, Pa., showed that risk management is resemble the worst conceivable airplane crash, where the pilot was
the least practiced of all project management disciplines across all inexperienced but exceedingly rash, flew into an ice storm in an
industry sectors, and nowhere is it more infrequently applied than untested aircraft, and worked for an airline that gave lip service to
safety while cutting back on training and
maintenance. If you read the investiga-
tor’s report afterward, you’d be shaking
FAILURE: your head and asking, “Wasn’t such a
crash inevitable?”
Effort to design new So, too, the reasons that software proj-
stock settlement ects fail are well known and have been
system is scrapped amply documented in countless articles,
in 1993, after seven reports, and books [see sidebar, To Probe
years, because of Further]. And yet, failures, near-failures,
and plain old bad software continue to
overly complex and plague us, while practices known to avert
cumbersome design mistakes are shunned. It would appear
and poor project that getting quality software on time and
management. within budget is not an urgent priority at
Case Study #3 most organizations.
It didn’t seem to be at Oxford Health
COST: Plans Inc., in Trumbull, Conn., in 1997.
COMPANY: The company’s automated billing sys-
London Stock Exchange $600 million tem was vital to its bottom line, and yet
senior managers there were more inter-
ested in expanding Oxford’s business
in the IT industry. Without effective risk management, software than in ensuring that its billing system could meet its current
developers have little insight into what may go wrong, why it may needs [see box, “Case Study #1”]. Even as problems arose, such as
go wrong, and what can be done to eliminate or mitigate the risks. invoices’ being sent out months late, managers paid little atten-
Nor is there a way to determine what risks are acceptable, in turn tion. When the billing system effectively collapsed, the com-
making project decisions regarding tradeoffs almost impossible. pany lost tens of millions of dollars, and its stock dropped from
Poor project management takes many other forms, including $68 to $26 per share in one day, wiping out $3.4 billion in corpo-
bad communication, which creates an inhospitable atmosphere rate value. Shareholders brought lawsuits, and several government
that increases turnover; not investing in staff training; and not agencies investigated the company, which was eventually fined
reviewing the project’s progress at regular intervals. Any of these $3 million for regulatory violations.
can help derail a software project. Even organizations that get burned by bad software experi-
ences seem unable or unwilling to learn from their mistakes. In
THE LAST AREA THAT INVESTIGATORS look into a 2000 report, the U.S. Defense Science Board, an advisory body
after a plane crash is the organizational environment. Does the to the Department of Defense, noted that various studies com-
airline have a strong safety culture, or does it emphasize meet- missioned by the DOD had made 134 recommendations for
ing the flight schedule above all? In IT projects, an organization improving its software development, but only 21 of those rec-
that values openness, honesty, communication, and collaboration ommendations had been acted on. The other 113 were still valid,
is more apt to find and resolve mistakes early enough that rework the board noted, but were being ignored, even as the DOD com-
JIM WATSON/AFP/GETTY IMAGES

doesn’t become overwhelming. plained about the poor state of defense software development!
If there’s a theme that runs through the tortured history of bad Some organizations do care about software quality, as the expe-
software, it’s a failure to confront reality. On numerous occasions, rience of the software development firm Praxis High Integrity
the U.S. Department of Justice’s inspector general, an outside panel Systems, in Bath, England, proves. Praxis demands that its customers
of experts, and others told the head of the FBI that the VCF system be committed to the project, not only financially, but as active par-
was impossible as defined, and yet the project continued any- ticipants in the IT system’s creation. The company also spends a

48 IEEE Spectrum | September 2005 | NA www.spectrum.ieee.org

tremendous amount of time understanding and defining the cus-
tomer’s requirements, and it challenges customers to explain what TO PROBE FURTHER:
they want and why. Before a single line of code is written, both
the customer and Praxis agree on what is desired, what is feasi-
SOFTWARE SPECIAL REPORT
ble, and what risks are involved, given the available resources.
After that, Praxis applies a rigorous development approach that WHO KILLED THE VIRTUAL CASE FILE?
limits the number of errors. One of the great advantages of this For background on the FBI, read Ronald Kessler’s The Bureau:
model is that it filters out the many would-be clients unwilling The Secret History of the FBI (St. Martin’s Press, 2002).
to accept the responsibility of articulating their IT requirements Track FBI CIO Zalmai Azmi’s attempts to drag the bureau into the
and spending the time and money to implement them properly. 21st century at http://www.fbi.gov/hq/ocio/ocio_home.htm.
[See “The Exterminators,” in this issue.] Read the record testimony of Arnold Punaro, executive vice presi-
dent and general manager of Science International Applications
SOME LEVEL OF SOFTWARE FAILURE will always Corp.—prepared for the 3 February 2005 U.S. Senate hearing on the
be with us. Indeed, we need true failures—as opposed to avoid- Virtual Case File (VCF)—at http://www.saic.com/
able blunders—to keep making technical and economic progress. cover-archive/law/trilogy.html.
But too many of the failures that occur today are avoidable. And The Government Accountability Office (GAO) and the Department
as our society comes to rely on IT systems that are ever larger, of Justice’s Office of the Inspector General (OIG) warned Congress of
more integrated, and more expensive, the cost of failure may serious problems with the VCF. Start exploring GAO documents at
become disastrously high.
http://www.gao.gov. For the September 2003 report "FBI Needs an
Even now, it’s possible to take bets on where the next great soft-
Enterprise Architecture to Guide Its Modernization Activities," search
ware debacle will occur. One of my leading candidates is the IT
on report number GAO-03-959.
systems that will result from the U.S. government’s American
For OIG reports related to the FBI’s IT systems, start digging at
Health Information Community, a public-private collaboration that
http://www.usdoj.gov/oig/reports/FBI. One must-read: "The Federal
seeks to define data standards for electronic medical records. The
Bureau of Investigation’s Management of the Trilogy Information
idea is that once standards are defined, IT systems will be built
to let medical professionals across the country enter patient records Technology Modernization Project" at http://www.usdoj.gov/oig/
digitally, giving doctors, hospitals, insurers, and other health-care reports/FBI/a0507/index.htm.
specialists instant access to a patient’s complete medical history. The graybeards evaluate the VCF in a National Research Council
Health-care experts believe such a system of systems will improve report at http://www7.nationalacademies.org/cstb/pub_fbi.html.
patient care, cut costs by an estimated $78 billion per year, and
reduce medical errors, saving tens of thousands of lives. THE EXTERMINATORS
But this approach is a mere pipe dream if software practices For an introduction to formal software-design methods, see Jeannette
and failure rates remain as they are today. Even by the most opti- M. Wing’s "A Specifier’s Introduction to Formal Methods," in
mistic estimates, to create an electronic medical record system Computer, September 1990, Vol. 23, no. 9. "An Invitation to Formal
will require 10 years of effort, $320 billion in development costs, Methods," by Jonathan P. Bowen et al. in Computer, April 1996, Vol.
and $20 billion per year in operating expenses—assuming that 29, no. 4, discusses how to make formal methods more widely used.
there are no failures, overruns, schedule slips, security issues, For many examples of formal methods used in industry, see
or shoddy software. This is hardly a realistic scenario, especially "Formal Methods: State of the Art and Future Directions" at
because most IT experts consider the medical community to be http://www-2.cs.cmu.edu/~emc/papers/Invited%20Journal%
the least computer-savvy of all professional enterprises. 20Articles/state_art_future.pdf.
Patients and taxpayers will ultimately pay the price for the Praxis High Integrity Systems offers a number of technical articles
development, or the failure, of boondoggles like this. Given today’s and presentations at http://www.praxis-his.com/publications.
IT practices, failure is a distinct possibility, and it would be a loss
of unprecedented magnitude. But then, countries throughout the WHY SOFTWARE FAILS
world are contemplating or already at work on many initiatives of Many good books have been written about the causes of software
similar size and impact—in aviation, national security, and the failure, including Frederick P. Brooks Jr.’s The Mythical Man-
military, among other arenas. Month: Essays on Software Engineering, 20th Anniversary
Like electricity, water, transportation, and other critical parts Edition (Addison-Wesley, 1995); Kweku Ewusi-Mensah’s Software
of our infrastructure, IT is fast becoming intrinsic to our daily exis- Development Failures (MIT Press, 2003); Stephen Flowers’s
tence. In a few decades, a large-scale IT failure will become more Software Failure: Management Failure (John Wiley & Sons,
than just an expensive inconvenience: it will put our way of life 1996); Robert L. Glass’s Software Runaways (Prentice Hall PTR,
at risk. In the absence of the kind of industrywide changes that 1998); Capers Jones’s Patterns of Software Systems Failure
will mitigate software failures, how much of our future are we will- and Success (International Thomson Computer Press, 1996);
ing to gamble on these enormously costly and complex systems? Peter Neumann’s Computer Related Risks (Addison Wesley,
We already know how to do software well. It may finally be 1995); Ivars Peterson’s Fatal Defect (Vintage Books, 1996);
time to act on what we know.  Susan A. Sherer’s Software Failure Risk (Plenum, 1992); and
Edward Yourdon’s Death March (Prentice Hall, 1997).
ABOUT THE AUTHOR The online "Forum on Risks to the Public in Computers and
ROBERT N. CHARETTE is president of ITABHI Corp., a risk- Related Systems" is at http://catless.ncl.ac.uk/risks.
management consultancy in Spotsylvania, Va. An IEEE member, he is Frederick P. Brooks Jr.'s classic paper "No Silver Bullet: Essence
the author of several books on risk management and chair of the and Accidents of Software Engineering" appeared in Computer, April
ISO/IEEE committee revising the 16085 standard on software and sys- 1987, pp. 10–19.
tems engineering risk management.

www.spectrum.ieee.org September 2005 | IEEE Spectrum | NA 49