Introducing a Quality Model for MVC Applications

A presentation by @stuherbert  for @GanbaroDigital A Quality Model For
MVC Applications Introducing

@GanbaroDigital Today’s Talk

@GanbaroDigital 1. Quality Metrics

@GanbaroDigital 2. Quality Models

@GanbaroDigital 3. Measuring Quality

@GanbaroDigital You’ll leave this talk with a clear understanding of
using a quality model and how to start building one for your MVC apps.

@GanbaroDigital How do you currently measure quality?

@GanbaroDigital You probably rely on quality metrics.

@GanbaroDigital • Code coverage • Pass / Fail Unit Tests
• Pass / Fail Acceptance Tests • Open bug reports • Cyclomatic Complexity • CRAP • High / low coupling • Number of responsibilities • … and so on Quality Metrics

@GanbaroDigital Utilities for metrics: phpqatools.org

@GanbaroDigital What do quality metrics describe?

@GanbaroDigital A quality metric is an absolute count of one
property of the source code.

@GanbaroDigital What is a ‘good’ value for a quality metric?

@GanbaroDigital The same quality metric cannot consistently be interpreted by
different teams.

@GanbaroDigital The same quality metric cannot consistently be interpreted by
different people on the same team.

@GanbaroDigital How do these different metrics relate to each other?

@GanbaroDigital Quality metrics are completely unrelated to each other.

@GanbaroDigital Quality metrics cannot be compared against each other.

@GanbaroDigital Which quality metrics do you use in your code
reviews?

@GanbaroDigital Why don’t you use all your quality metrics in
your code review checklists?

@GanbaroDigital We measure quality to prevent things going wrong and
to detect the things that have already gone wrong.

@GanbaroDigital The most cost-effective place to resolve a problem is
as close to the cause as possible.

@GanbaroDigital The earlier that you can detect problems the cheaper
it is to resolve them.

@GanbaroDigital What if we could measure quality the same way
across all code, all teams?

@GanbaroDigital What would that look like?

@GanbaroDigital

@GanbaroDigital QM-1.1 QM-1.2 QM-1.3 QM-1.4 QM-1.5 QM-2.5 QM-2.12 QM-2.6 QM-2.1
QM-3.1 QM-2.11 QM-2.16 QM-2.4 QM-1.7 QM-2.15 QM-2.7 QM-2.13 QM-2.10 QM-2.9 QM-1.6 QM-2.8 QM-2.2 QM-2.14 QM-2.3

@GanbaroDigital 0% 25% 50% 75% 100% QM-1.1 QM-1.2 QM-1.3 QM-1.4
QM-1.5 QM-2.5 QM-2.12 QM-2.6 QM-2.1 QM-3.1 QM-2.11 QM-2.16 QM-2.4 QM-1.7 QM-2.15 QM-2.7 QM-2.13 QM-2.10 QM-2.9 QM-1.6 QM-2.8 QM-2.2 QM-2.14 QM-2.3

@GanbaroDigital Quality metrics are useful but you can’t plot a
single graph with them.

@GanbaroDigital SQuaRE Introducing

@GanbaroDigital SQuaRE = Software product Quality Requirements and Evaluation =
ISO 25000 standards series

@GanbaroDigital Why ISO 25000?

@GanbaroDigital Most informal approaches to quality focus only on what
is wrong.

@GanbaroDigital Most formal quality assessment frameworks measure the team not
the product.

@GanbaroDigital Quality Model Division 2501n Quality Management Division 2500n Quality
Requirements Division 2503n Quality Measurement Division 2502n Quality  Evaluation Division 2504n

@GanbaroDigital ISO 25010:2011 Systems and software engineering - Systems and
software Quality Requirements and Evaluation (SQuaRE) - Systems and software quality models

@GanbaroDigital Two Quality Models • Quality In Use Model •
Product Quality Model

@GanbaroDigital Quality In Use Model measures what it is like
to live with the code that has shipped.

@GanbaroDigital Product Quality Model measures the quality of the code
that you want to ship.

@GanbaroDigital Other models (e.g. data quality) are covered elsewhere in
ISO 25000

@GanbaroDigital What does the Product Quality Model look like?

@GanbaroDigital • Functional suitability • Performance efﬁciency • Compatibility •
Usability • Reliability • Security • Maintainability • Portability Eight Main Categories

@GanbaroDigital Functional Suitability • Functional completeness • Functional correctness •
Functional appropriateness

@GanbaroDigital Performance Efﬁciency • Time behaviour • Resource utilisation •
Capacity

@GanbaroDigital Compatibility • Co-existence • Interoperability

@GanbaroDigital Usability • Appropriateness recognisability • Learnability • Operability •
User error protection • User interface aesthetics • Accessibility

@GanbaroDigital Reliability • Maturity • Availability • Fault tolerance •
Recoverability

@GanbaroDigital Security • Conﬁdentiality • Integrity • Non-repudiation • Accountability
• Authenticity

@GanbaroDigital Maintainability • Modularity • Reusability • Analysability • Modiﬁability
• Testability

@GanbaroDigital Portability • Adaptability • Installability • Replaceability

@GanbaroDigital We can apply the Product Quality Model to MVC
apps.

@GanbaroDigital How? We deﬁne quality measurements.

@GanbaroDigital What is a quality measurement?

@GanbaroDigital It is a mathematical function: X = A /
B or X = 1 - ( A / B )

@GanbaroDigital X = A / B where A is the
number of times that a quality criteria is satisﬁed B is the total number of opportunities to satisfy that quality criteria

@GanbaroDigital For example: A is the number of times that
output is correctly escaped. B is the total number of times that output needs escaping.

@GanbaroDigital If we correctly escape output 25 times out of
30 X = 25 / 30 = 0.83

@GanbaroDigital If we correctly escape output 87 times out of
1237 X = 87 / 1237 = 0.07

@GanbaroDigital These measurements are comparable. We can compare 0.83 to
0.07.

@GanbaroDigital X = 1 - ( A / B )
where A is the number of times that a quality criteria is not satisﬁed B is the total number of opportunities to satisfy that quality criteria

@GanbaroDigital For example: A is the number of application routes
where a GET modiﬁes the database B is the total number of routes in the application that accept GETs

@GanbaroDigital If we modify the database during a GET request
in 5 routes out of 400 X = 1 - ( 5 / 400 ) = 0.98

@GanbaroDigital If we modify the database during a GET request
in 39 routes out of 258 X = 1 - ( 39 / 258 ) = 0.84

@GanbaroDigital These measurements are comparable. We can compare 0.98 to
0.84.

@GanbaroDigital Quality measurements: X = A / B or X
= 1 - ( A / B )

@GanbaroDigital Use X = A / B when you want
people to do A as much as possible

@GanbaroDigital Use X = 1 - ( A / B
) when you want people to do A as little as possible

@GanbaroDigital When we measure quality, a quality criteria is either:
satisﬁed (a pass) or not (a fail).

@GanbaroDigital Every quality measurement has a value between 0 and
1. 0 is the worst score possible. 1 is the best score possible.

@GanbaroDigital One quality measurement function measures one quality criteria.

@GanbaroDigital ISO is working on some draft quality measurements. They’re
not ready. They’re not speciﬁc enough.

@GanbaroDigital We have to deﬁne our own.

@GanbaroDigital Step 1: Deﬁne your quality criteria.

@GanbaroDigital Start by covering the basics. Cover what is important
to you.

@GanbaroDigital 3 Levels Of Importance • Essential - must not
ship • Major - should not merge • Minor - housekeeping

@GanbaroDigital Examples: Security • Validate route parameters • Validate query
string parameters • Validate form data • Check CSRF token • Escape output correctly

ship • Major - should not merge • Minor - housekeeping

@GanbaroDigital Examples: HTTP • Do not modify database on GETs
• Return HTTP 422 when request validation fails • Return HTTP 500 when an unexpected exception occurs

ship • Major - should not ship • Minor - housekeeping

@GanbaroDigital Examples: Code Health • Follow SOLID • Follow DRY
• Remove all unused code

@GanbaroDigital Step 2: Deﬁne one or more quality measurement function
for each of your quality criteria.

@GanbaroDigital Route Parameter Verification • X = A / B,
where • A = number of route parameters that are verified, and • B = total number of route parameters defined

@GanbaroDigital CSRF Token Publishing • X = A / B,
where • A = number of HTML forms that publish a CSRF token • B = total number of HTML forms

@GanbaroDigital CSRF Token Veriﬁcation • X = A / B,
where • A = number of routes that validate the CSRF token of a HTML form • B = total number of routes that accept a HTML form as input

@GanbaroDigital Verification Failure Notification • X = A / B,
where • A = number of routes that return HTTP 422 when request verification fails • B = total number of routes that accept any form of input

@GanbaroDigital Class Substitution • X = A / B, where
• A = number of methods that accept an interface as the input type • B = total number of methods that accept objects as input

@GanbaroDigital … you get the idea.

@GanbaroDigital Start small. Don’t go overboard.

@GanbaroDigital No-one writes perfect code. No-one can afford to pay
for perfect code.

@GanbaroDigital Design quality measurements for the things that are cheaper
to get right ﬁrst time.

@GanbaroDigital Design quality measurements for the things that need to
become habits.

@GanbaroDigital How do we use the quality model in code
reviews?

@GanbaroDigital Your quality criteria are your code review checklist.

@GanbaroDigital Train your developers to use the quality criteria when
designing and writing software.

@GanbaroDigital How do we use the quality model in QA
teams?

@GanbaroDigital The quality model forms the basis of your test
strategy.

@GanbaroDigital Update your quality criteria and quality measurement functions when
QA discovers new kinds of defects.

@GanbaroDigital How do we use the quality model with management?

@GanbaroDigital 0% 25% 50% 75% 100% QM-1.1 QM-1.2 QM-1.3 QM-1.4
QM-1.5 QM-2.5 QM-2.12 QM-2.6 QM-2.1 QM-3.1 QM-2.11 QM-2.16 QM-2.4 QM-1.7 QM-2.15 QM-2.7 QM-2.13 QM-2.10 QM-2.9 QM-1.6 QM-2.8 QM-2.2 QM-2.14 QM-2.3

@GanbaroDigital 0% 25% 50% 75% 100% Interoperability Accountability Authenticity Analysability
Modiﬁability Conﬁdentiality Modularity Non-repudiation Testability Integrity Fault Tolerance Resource Utilisation

@GanbaroDigital The quality measurements show where quality is good as
well as where it needs improving.

@GanbaroDigital Ignoring problems is just as unhealthy as only reporting
problems.

@GanbaroDigital Celebrate your successes. Fix your faults.

@GanbaroDigital In post-mortems, link the root cause to the relevant
quality measurements or to any missing ones.

@GanbaroDigital Identify gaps in your quality criteria and plug them.

@GanbaroDigital How do we deal when the team changes?

@GanbaroDigital Quality has already been deﬁned. That’s what your written
quality criteria are. You just need to train new people in your quality criteria.

@GanbaroDigital Talk about your quality criteria when interviewing. Make it
part of your engineering culture.

Stuart Herbert ~ @stuherbert Founder @GanbaroDigital

Introducing a Quality Model for MVC Applications

Introducing a Quality Model for MVC Applications

More Decks by Stuart Herbert

Other Decks in Programming

Featured

Transcript