MOSS
MOSS
Module 5
Software Quality, Software Quality Dilemma, Achieving Software Quality Elements of Software
Quality Assurance, SQA Tasks , Software measurement and metrics. Software Process
Improvement(SPI), SPI Process CMMI process improvement framework, ISO 9001:2000 for
Software. Cloud based Software - Virtualisation and containers, Everything as a service(IaaS, PaaS),
Software as a service. Microservices Architecture - Microservices, Microservices architecture,
Microservice deployment.
SOFTWARE QUALITY
Today, software quality remains an issue.
Customers blame developers, arguing that sloppy practices lead to low quality software.
Developers blame customers (and other stakeholders), arguing that irrational delivery dates
and a continuing stream of changes force them to deliver software before it has been fully
validated.
American Heritage Dictionary defines quality as “a characteristic or attribute of
something.”
For software, two kinds of quality may be encountered:
Quality of design encompasses requirements, specifications, and the design of the system.
Quality of conformance is an issue focused primarily on implementation.
User satisfaction = compliant product + good quality + delivery within budget and
schedule
Software quality can be defined as:
o An effective software process applied in a manner that creates a useful product
that provides measurable value for those who produce it and those who use it.
Useful Product
• A useful product delivers the content, functions, and features that the end-user desires.
• It delivers these assets in a reliable, error free way.
•A useful product always satisfies those requirements that have been explicitly stated
by stakeholders.
•It satisfies a set of implicit requirements (e.g., ease of use) that are expected of all high
quality software.
Adding Value
• By adding value for both the producer and user of a software product, high quality software
provides
benefits for the software organization and the end-user community.
• The software organization gains added value because high quality software requires less maintenance
effort, fewer bug fixes, and reduced customer support.
• The user community gains added value because the application provides a useful capability in a way
that expedites some business process. 1
• The end result is:
(1) greater software product revenue
(2) better profitability when an application supports a businessprocess
(3) improved availability of information that is crucial for the business.
Quality Factors
1. Correctness - The extent to which a program satisfies its specification and fulfills the customer’s
mission objectives.
2. Reliability - The extent to which a program can be expected to perform its
intended function with required precision.
3. Efficiency - The amount of computing resources and code required by a program to
perform its function.
4. Integrity - Extent to which access to software or data by unauthorized persons
can be controlled.
5. Usability - Effort required to learn, operate, prepare input for, and interpret output of a
program.
6. Maintainability - Effort required to locate and fix an error in a program.
7. Flexibility - Effort required to modify an operational program.
8. Testability - Effort required to test a program to ensure that it performs its intended
function.
2
THE SOFTWARE QUALITY DILEMMA
•If you produce a software system that has terrible quality, you lose because no one will want to
buy it.
•If on the other hand you spend infinite time, extremely large effort, and huge sums of money to
build the absolutely perfect piece of software, then it's going to take so long to complete and it
will be so expensive to produce that you'll be out of business anyway.
• Either you missed the market window, or you simply exhausted all your resources.
•So people in industry try to get to that magical middle ground where the product is good enough
not to be rejected right away, such as during evaluation, but also not the object of so much
perfectionism and so much work that it would take too long or cost too much to complete.
“Good Enough” Software
•Good enough software delivers high quality functions and features that end users desire, but at
the same time it delivers other more obscure or specialized functions and features that contain known
bugs.
• Arguments against “good enough.”
o It is true that “good enough” may work in some application domains and for a few
major software companies.
o If you deliver a “good enough” (buggy) product, you risk permanent damage to your
company’s reputation.
Cost of Quality
Prevention costs include
quality planning
formal technical reviews
test equipment
Training
Internal failure costs include
Rework
Repair
failure mode analysis
External failure costs
complaint resolution
product return and replacement
help line support
warranty work
The relative costs to find and repair an error or defect increase dramatically as we go from prevention
to detection to internal failure to external failure costs.
4
SOFTWARE QUALITY ASSURANCE
Software quality assurance (SQA) encompasses:
(1) an SQA process
(2)specific quality assurance and quality control tasks (including technical reviews and a
multi- tiered testing strategy)
(3) effective software engineering practice (methods and tools)
(4) control of all software work products and the changes made to them
(5) a procedure to ensure compliance with software development standards
(6) measurement and reporting mechanisms.
11. Standards - The job of SQA is to ensure that standards that have been adopted are followed and
that all work products conform to them.
12. Reviews and audits –
• Technical reviews are a quality control activity.
• Their intent is to uncover errors.
• Audits are a type of review performed by SQA personnel with the intent of ensuring
that quality guidelines are being followed for software engineering work.
13. Testing - The job of SQA is to ensure that testing is properly planned and efficiently conducted
so that it has the highest likelihood of achieving its primary goal.
14. Error/defect collection and analysis - SQA collects and analyzes error and defect data to
better
understand how errors are introduced and what software engineering activities are best suited
to eliminating them.
5. Change management - SQA ensures that adequate change management practices have been
instituted.
6. Education - The SQA organization takes the lead in software process improvement and is a key
proponent and sponsor of educational programs.
7. Vendor management - The job of the SQA organization is to ensure that high-quality software
results by suggesting specific quality practices that the vendor should follow (when possible),
and incorporating quality mandates as part of any contract with an external vendor.
8. Security management - SQA ensures that appropriate process and technology are used to
achieve software security.
9. Safety - SQA may be responsible for assessing the impact of software failure and for initiating
those steps required to reduce risk.
10. Risk management - Although the analysis and mitigation of risk is the concern of software
engineers, the SQA organization ensures that risk management activities are properly conducted 5
and that risk- related contingency plans have been established.
SQA NEED
• Quality Assurance testing is employed to reduce possible defects in every stage of the
software development life cycle.
• The focus of SQA is to monitor continuously throughout the Software Development Life Cycle
to ensure the quality of the delivered products.
• In process assurance, SQA provides management with objective feedback regarding compliance
to approved plans, procedures, standards, and analyses.
SQA TASKS
SQA Goals
6
SOFTWARE MEASUREMENT AND METRICS
SPI Framework
a set of characteristics that must be present if an effective software process is to be achieved
a method for assessing whether those characteristics are present
a mechanism for summarizing the results of any assessment
a strategy for assisting a software organization in implementing those process characteristics
that have been found to be weak or missing.
7
An SPI framework assesses the “maturity” of an organization’s software process and provides a
qualitative indication of a maturity level.
Constituencies
Quality certifiers
Quality(
Process)
-->
Quality(
Product)
Formalists -
This group
wants to
understand
process
workflow.
Tool advocates
- This group
insists on a tool-
assisted
approach to SPI
Practitioners -
This
constituency
uses a pragmatic
approach
Reformers - The goal of this group is organizational change that might lead to a better software process
Ideologists - This group focuses on the suitability of a particular process model for a specific
application domain or organizational structure.
Maturity Models
• A maturity model is applied within the context of an SPI framework.
• The intent of the maturity model is to provide an overall indication of the “process maturity”.
• An indication of the quality of the software process, the degree to which practitioner’s
understand and apply the process,
Assessment examines a wide range of actions and tasks that will lead to a high quality process.
Consistency - Are important activities, actions and tasks applied consistently across all software
projects and by all software teams?
Sophistication - Are management and technical actions performed with a level of sophistication
that implies a thorough understanding of best practice?
Acceptance - Is the software process and software engineering practice widely accepted by
management
and technical staff?
Commitment - Has management committed the resources required to achieve consistency,
sophistication and acceptance?
Gap analysis—The difference between local application and best practice represents a “gap” that offers
opportunities for improvement.
benefits include the cost savings associated with higher product quality (fewer defects), less rework,
reduced effort associated with changes, and the income.
costs include both direct SPI costs (e.g., training, measurement) and indirect costs associated with
greater
emphasis on quality control and change management activities and more rigorous application of
software engineering methods (e.g., the creation of a design model).
• “a roadmap for implementing workforce practices that continuously improve the capability of
an organization’s workforce
• Set of five organizational maturity levels
10
Process areas for the People CMM
• The cloud is made up of very large number of remote servers that are offered for rent by
companies that own these servers.
• Cloud-based servers are ‘virtual servers’, which means that they are implemented in
software rather than hardware.
• You can rent as many servers as you need, run your software on these servers and make them
available to your customers.
• Your customers can access these servers from their own computers or other networked devices
such as a tablet or a TV.
• Cloud servers can be started up and shut down as demand changes.
• You may rent a server and install your own software, or you may pay for access to software
products that are available on the cloud.
Scalability, elasticity, and resilience
Scalability reflects the ability of your software to cope with increasing numbers of users. As the load
on
your software increases, your software automatically adapts so that the system performance and
response time is maintained.
Elasticity is related to scalability but also allows for scaling-down as well as scaling-up. That is, you
can monitor the demand on your application and add or remove servers dynamically as the number of
users
change.
Resilience means that you can design your software architecture to tolerate server failures. You can
make several copies of your software concurrently available. If one of these fails, the others continue to
provide a service.
12
VIRTUALISATION AND CONTAINERS
• A virtual server runs on an underlying physical computer and is made up of an operating system
plus a set of software packages that provide the server functionality required.
• A virtual server is a stand-alone system that can run on any hardware in the cloud.
• This ‘run anywhere’ characteristic is possible because the virtual server has no
external dependencies.
• Virtual machines (VMs), running on physical server hardware, can be used to implement virtual
servers.
• A hypervisor provides hardware emulation that simulates the operation of the underlying
hardware.
• If you use a virtual machine to implement virtual servers, you have exactly the same
hardware platform as a physical server
Container-based virtualization
• If you are running a cloud-based system with many instances of applications or services, these
all use the same operating system, you can use a simpler virtualization technology called
‘containers’.
• Using containers accelerates the process of deploying virtual servers on the cloud.
• Containers are usually megabytes in size whereas VMs are gigabytes.
• Containers can be started and shut down in a few seconds rather than the few minutes required
for a VM.
• Containers are an operating system virtualization technology that allows independent servers
to share a single operating system.
• They are particularly useful for providing isolated application services where each user sees
their own version of an application.
13
Docker
• Containers were developed by Google around 2007 but containers became a mainstream
technology around 2015.
• An open-source project called Docker provided a standard means of container management that
is fast and easy to use.
• Docker is a container management system that allows users to define the software to be
included in a container as a Docker image.
• It also includes a run-time system that can create and manage containers using these
Docker images.
Benefits of containers
• They solve the problem of software dependencies.
•Instead of shipping your product as stand-alone software, you can ship a container that includes all
of the support software that your product needs.
• They provide a mechanism for software portability across different clouds.
•Docker containers can run on any system or cloud provider where the Docker daemon is available.
• They provide an efficient mechanism for implementing software services and so support the
development of service-oriented architectures.
• They simplify the adoption of DevOps.
•This is an approach to software support where the same team are responsible for both developing
and supporting operational software.
EVERYTHING AS A SERVICE
• The idea of a service that is rented rather than owned is fundamental to cloud computing.
Infrastructure as a service (IaaS)
•Cloud providers offer different kinds of infrastructure service such as a compute service, a
network service and a storage service that you can use to implement virtual servers.
Platform as a service (PaaS)
•This is an intermediate level where you use libraries and frameworks provided by the cloud provider
to implement your software.
• These provide access to a range of functions, including SQL and NoSQL databases.
Software as a service (SaaS)
• Your software product runs on the cloud and is accessed by users through a web browser or mobile
app.
14
SOFTWARE AS A SERVICE
•Increasingly, software products are being delivered as a service, rather than installed on
the buyer’s computers.
• If you deliver your software product as a service, you run the software on your servers, which
you may rent from a cloud provider.
•Customers don’t have to install software and they access the remote system through a
web browser or dedicated mobile app.
• The payment model for software as a service is usually a subscription model.
• Users pay a monthly fee to use the software rather than buy it outright.
15
Advantages and disadvantages of SaaS for customers
1. Local/remote processing
•A software product may be designed so that some features are executed locally in the user’s browser
or mobile app and some on a remote server.
• Local execution reduces network traffic and so increases user response speed.
• This is useful when users have a slow network connection.
16
• Local processing increases the electrical power needed to run the system.
2. Authentication
•If you set up your own authentication system, users have to remember another set of
authentication credentials.
• Many systems allow authentication using the user’s Google, Facebook or LinkedIn credentials.
•For business products, you may need to set up a federated authentication system, which
delegates authentication to the business where the user works.
3. Information leakage
•If you have multiple users from multiple organizations, a security risk is that information leaks
from one organization to another.
•There are a number of different ways that this can happen, so you need to be very careful in
designing your security system to avoid this.
4. Multi-tenant and multi-instance systems
•In a multi-tenant system, all customers are served by a single instance of the system and a
multitenant database.
• In a multi-instance system, a separate copy of the system and database is made available for each
user.
MULTI-TENANT SYSTEM
•A multi-tenant database is partitioned so that customer companies have their own space and can
store and access their own data.
•There is a single database schema, defined by the SaaS provider, that is shared by all of the
system’s users.
•Items in the database are tagged with a tenant identifier, representing a company that has stored data
in the system.
•The database access software uses this tenant identifier to provide ‘logical isolation’, which means
that users seem to be working with their own database.
MULTI-INSTANCE SYSTEMS
•Multi-instance systems are SaaS systems where each customer has its own system that is adapted to
its needs, including its own database and security controls.
•Multi-instance, cloud-based systems are conceptually simpler than multi-tenant systems and
avoid security concerns such as data leakage from one organization to another.
• There are two types of multi-instance system:
•VM-based multi-instance systems are multi-instance systems where the software instance
and database for each customer runs in its own virtual machine.
• All users from the same customer may access the shared system database.
• Container-based multi-instance systems
•These are multi-instance systems where each user has an isolated version of the software and
database running in a set of containers.
•This approach is suited to products in which users mostly work independently, with relatively
little data sharing.
•Therefore, it is best used for software that serves individuals rather than business customers or
for business products that are not data-intensive.
MICROSERVICES
• Microservices are small-scale, stateless, services that have a single responsibility.
• They are combined to create applications.
• They are completely independent with their own database and UI management code.
• Software products that use microservices have a microservices architecture. 17
•If you need to create cloud-based software products that are adaptable, scaleable and resilient then
design them around a microservices architecture.
A microservice example
System authentication
•User registration, where users provide information about their identity, security information,
mobile (cell) phone number and email address.
• Authentication using UID/password.
• Two-factor authentication using code sent to mobile phone.
• User information management e.g. change password or mobile phone number.
• Reset forgotten password.
•Each of these features could be implemented as a separate service that uses a central shared database
to hold authentication information.
• However, these features are too large to be microservices.
•To identify the microservices that might be used in the authentication system, you need to break
down the coarse-grain features into more detailed functions.
Characteristics of microservices
18
MICROSERVICES ARCHITECTURE
•A microservices architecture is an architectural style – a tried and tested way of implementing a
logical software architecture.
• This architectural style addresses two problems with monolithic applications
•The whole system has to be rebuilt, re-tested and re-deployed when any change is made. This can be
a slow process as changes to one part of the system can adversely affect other components.
•As the demand on the system increases, the whole system has to be scaled, even if the demand is
localized to a small number of system components that implement the most popular system
functions. A microservices architecture for a photo-printing system
Example:
MICROSERVICE DEPLOYMENT
•After a system has been developed and delivered, it has to be deployed on servers, monitored
for problems and updated as new versions become available.
• When a system is composed of tens or even hundreds of microservices, deployment of the
system is
19
more complex than for monolithic systems.
•The service development teams decide which programming language, database, libraries and
other support software should be used to implement their service. Consequently, there is no
‘standard’
deployment configuration for all services.
•It is now normal practice for microservice development teams to be responsible for deployment
and service management as well as software development and to use continuous deployment.
•Continuous deployment means that as soon as a change to a service has been made and validated,
the modified service is redeployed.
Deployment automation
•Continuous deployment depends on automation so that as soon as a change is committed, a series
of automated activities is triggered to test the software.
•If the software ‘passes’ these tests, it then enters another automation pipeline that packages
and deploys the software.
•The deployment of a new service version starts with the programmer committing the code changes to
a code management system such as Git.
•This triggers a set of automated tests that run using the modified service. If all service tests
run successfully, a new version of the system that incorporates the changed service is created.
• Another set of automated system tests are then executed. If these run successfully, the service
is ready
for deployment.
20