A Toolbox of Software Architecture Review Techniques - Pt 3

Part 3: Evaluation Criteria - "Is it good enough FOR WHAT"

(This is the third post in the series on architecture review techniques. Check out Part 1 and Part 2 if you haven’t done so already)

Evaluation criteria - you should definitely have some

Seriously. That’s not just a throwaway line to kick off a blog post. You’ve probably also been in situations where someone has asked you, «Can you check out this architecture and tell me if its ok?». Sure, you can usually come up with some feedback based on experience, but mostly you want to reply with, «Can I tell you if it’s ok FOR WHAT? What's important for you? Is it security, performance, maintainability....?». You need to work on your evaluation criteria if you want to deliver a useful architecture review.

There are plenty of techniques for capturing evaluation criteria. Such as:

• experience
• scenarios
• checklists
• design principles
• architecture smells
• anti-patterns
• metrics

We'll go through the most common ones and you can google around for the rest which are useful to have in your toolbox.

This post is a bit long but working with evaluation criteria can be the most important part of a review, so I think it's worth it. As an additional benefit, working with quality attributes, which are the basis for evaluation criteria, is a tool that will give you testable design criteria that you can use to drive an architecture design process and not just review an architecture.

But first a word on experience. You can come a long way by relying solely on experience to perform the review - especially if you actually have both the technical and domain experience that you think you do. But you will get more out of an architecture review if you take a the time to systematically work through your evaluation criteria first.

tl;dr summary:

• determine which qualities (or quality attributes) are most important for the system to deliver - eg: performance, maintainability, usability, etc
• use checklists, generic requirements and technical requirements for criteria that are relevant across solutions and projects
• elicit verifiable scenarios that operationalise the generic requirements and to exemplify qualities that are specific to your solution
• relying on experience can work if you have deep domain knowledge in addition to software architecture expertise.

System Qualities

«...The architecture is the primary carrier of system qualities, such as performance, modifiability, and security, none of which can be achieved without a unifying architectural vision. Architecture is an artifact for early analysis to make sure that the design approach will yield an acceptable system. Architecture holds the key to postdeployment system understanding, maintenance, and mining efforts…»
SEI definition

Evaluation criteria start with the system qualities. Typically these have been called non-functional requirements but more and more people are using the term “quality attributes” and “quality requirements” instead. Ideally, whoever wants the system reviewed would have a list of system qualities that they want the solution to achieve - but very few people have them at a level that can be used for a review. Often there is a document somewhere in the organisation called "Non functional requirements (NFR)" that lists a mix generic design goals, developer guidelines and specific test criteria and constraints that are applicable across all projects. For example, the following are taken from some real non-functional requirements documents:

• “The solution must be flexible enough to evolve as the business requires”
• “Response times for customer-facing webapps must be < 2secs for 95% of all requests”
• “Always use the prescribed logging package and not System.out…”

Evaluation criteria should be verifiable and these generic non-functional requirements documents usually require some form of operationalising to get evaluation criteria that are useable. For instance, what does “flexible enough” mean in the context of the system you are evaluating? Other qualities such as “peak number of concurrent users” will also be specific to that system.

In addition there can be solution-specific quality attributes that are important for your system, and these need to be verified with their own quality requirements that are probably not mentioned in the generic list of NFRs. Consider a boring document archive system that you need to have for compliance reasons. It is most likely a long-lived, non-innovative solution where sustainability is a very important quality attribute - that is, how can the system be maintained over a 10+ year period. Sustainability is a quality attribute that is not usually mentioned in a common set of requirements but it could be quite important to some specific solutions.

Extracting the total set of requirements for the qualities that you want your system to have, involves both the identification of those requirements that are solution-specific and the operationalisation of those generic common requirements within the context of the system under review.

An important step in an architecture review is to elicit these criteria and one of the most useful results from an architecture review can simply be to get architects and product owners more proactive in eliciting, refining, maintaining, and testing these qualities in the design evolution of the solution.

Identifying and prioritising system qualities

Start by determining which qualities are relevant for your system. There are many sets of -illities you can use, but it can be useful to ones that are provided in the ISO 25010 software quality model standard and then customise them as needed for your particular project.

As an example of customisation, perhaps the Usability aspects aren’t relevant for your back-end project; or you need to extend the refinements for Security to include Authentication, Defense-in-depth, etc; or you need an additional quality which isn’t depicted in the model - for instance issues around DevOps or legal Compliance. Wikipedia has quite a comprehensive list of system qualities that you can use to customise the above list.

You might identify the important qualities and refinements simply from the business drivers and scope of the review or perhaps you will need to evolve the tree as part of scenario workshops, which I’ll describe later in this blog.

Most of these qualities are well understood, except perhaps those under “functional suitability”. You may assume that all these are covered under testing. However, I once worked on a project to automate the processing of social security applications. It was only in a scenario workshop with case-handlers that we learned the importance and consequence of ensuring that the system was completely correct with respect to the relevant legislation. For instance, if the case was sent to an appeals court then the govt agency needed to show exactly how the automatic processing occurred. This required two changes: a) extensions to the domain model to record far more information about rule execution so that processing could be recreated at a later date; and b) a change from user stories and acceptance criteria for functionality directly connected to legal compliance to a more detailed technique - RuleSpeak - that removed ambiguity and interpretation by developers.

The SEI uses a Quality Utility Tree, which can be cumbersome to use in practice, but you can represent them in multiple different ways. For instance my colleague Mario uses an impact map, and here’s some other examples from Arnon Rotem-Gal-Oz blog series on system qualities:

• Blog series.
• Nice summary on stackexchange.
• And an example tree.

There are two purpose for this structured set of quality attributes:

1. To get you thinking about the evaluation criteria you need use in an evaluation. Even if you are going to evaluate based on experience, it’s useful to work through all qualities that are important for the solution owner in order to minimise the chance that you overlook something important.
2. Have a representation of system quality that you can discuss with product owners, domain experts, etc who will help identify, prioritise, and refine testable evaluation criteria. It's not often these stakeholders consider issues beyond functional user stories and a visual representation can help drive workshops to elicit evaluation criteria. It also helps get them to take more ownership of these quality issues - especially when they have to vote on priority and there are tradeoffs that need to be made.

Evaluation criteria based on system qualities

Once you have the important quality attributes for the solution then you can exemplify them with testable evaluation criteria. These usually takes the form of:

• scenarios or
• checklists

Before getting to those it’s worth mentioning that the most popular type of evaluation criteria is experience - i.e., no explicit evaluation criteria. If you have enough experience with both software architecture and the particular problem domain, then in effect, you have scenarios and checklists as tacit knowledge.

Scenarios

Scenarios are the most often recommended approach for capturing evaluation criteria. For each quality attribute you work with relevant stakeholders in the project to capture specific, quantified scenarios that you can use as acceptance test cases for the architecture. For instance, you can see example scenarios in a quality utility tree in following image.

These scenarios need to be verifiable. One technique is to use SMART scenarios - specific, measurable, actionable, realistic, and timebound. Another format is to specify Context, Stimulus, and Response from the system. These scenarios are like acceptance test cases for the architecture and the Context, Stimulus, Response format is very similar to the Given, When, Then format used in BDD/Specification By Example that you may be already familiar with.

• Given (Context) normal conditions
• When (Stimulus) a write operation on an entity occurs
• Then the (Response) from the system should be less than 500 milliseconds.

It can be difficult to get stakeholders to specify evaluation criteria in this detailed format - especially if they have little experience with quality attributes. If that is the case then it's best to get them to start with simple, specific examples rather than trying for detailed, quantified, specifications of the requirements they want. In this sense you can think of scenarios as user stories. An example requirement that is the used to start a more detailed discussion with the domain experts rather than a perfect specification. You can use an iterative process to make them more detailed in subsequent workshops. As an example, flexibility/maintainability is always a tough quality to give testable criteria for. Crystal-ball gazing can be error-prone and throw up examples that may never occur, but stakeholders will likely have many examples of things that have been difficult to change in the past and will have domain knowledge of things that will likely change in the future - knowledge that IT people will usually not have themselves. Its important to make these criteria explicit and it may take a series of workshops with stakeholders to get the important, testable quality attribute scenarios out in the open.

A useful tool for generating, refining, and prioritising these scenarios is the Quality Attribute Workshop. The workshop gathers relevant stakeholders and works through the following steps:

• identify the important qualities attributes and refinements (the architecture drivers)
• brainstorming of scenarios with broad selection of stakeholders. At this stage those scenarios can be quite high level and as simple as a bit of prose on some post-it notes.
• scenarios are then grouped together as appropriate and prioritised using voting from those present
• the highest priority scenarios are then refined using the “Context, Stimulus, Response” format and quantified.
• finally, those scenarios are classified for (Benefit, Difficulty to Realise) using a High, Middle, and Low rating.

The result is a tree or table such the one in the previous diagram. There is also a more lightweight workshop format you can use - the mini quality attribute workshop. (presentation slides and video)

These techniques for generating scenarios are especially helpful when running an architecture review in an domain in which you are not an expert - for example if you are called in as an external reviewer. Additionally, they can be useful when one of the objectives is to improve understanding of the system drivers to a larger group.

It may not always be useful, or necessary, to spend time generating scenarios. Creating scenarios with stakeholders is time consuming and it can be challenging to get them refined and quantified. An IEEE Software article from 2008 includes a debate between Tom Gilb and Alistair Cockburn on the relative merits of quantifying these scenarios and the return on investment for the amount of work you put in. Unfortunately, the debate is behind the IEEE paywall, but you can read Alistair’s thoughts from his website and Tom’s writings on the benefits of requirements quantification are well detailed. Additionally, you may not have time to run these workshops within the time constraints of the review, or perhaps the scope of the review doesn’t require detailed scenarios. But being able to elicit and detail evaluation criteria using scenarios is a useful technique to have.

Checklists

Checklists are probably the most used technique in practice for capturing evaluation criteria. Whilst scenarios are good for capturing project and domain specific evaluation criteria, checklists are good for capturing the technical architecture issue that exist across multiple projects. For example, I have a checklist that deals solely with integration architecture that I use on most projects.

There’s not much to say about using checklists. Simply create and maintain checklists for the quality issues that exist across all projects and use them in your reviews. The answers to this question on stackexchange provide a great collection of checklists. For instance, this one from Code Complete:

Additionally, TOGAF recommends the whole architecture review process be designed around checklists.

The TOGAF architecture compliance review process is not as detailed as the ones I’ll get to in later posts, but the TOGAF guide provides a useful set of checklists for areas such as:

• Hardware and Operating System Checklist
• Software Services and Middleware Checklist
• Applications Checklists
• Information Management Checklists
• Security Checklist
• System Management Checklist
• System Engineering/Overall Architecture Checklists
• System Engineering/Methods & Tools Checklist

Other sources for checklists include:

• These from microsoft (one, two, and three).
• Checklist for conceptual architecture.
• and this one for architecture design documents. 

I’m sure there are plenty more out there, but these should be a good starting point for developing your own.

Summary

In this post of the blog series we’ve looked at evaluation criteria which are one of the most important parts of the Review Inputs (remember Review Inputs from the SARA report that we looked at in the last post?)

Let’s wrap it up with a rewording of the original tl;dr summary:

• determine which qualities (or quality attributes) are most important for the system to deliver - eg: performance, maintainability, and usability. These are the architecture drivers.
• use checklists, generic requirements and technical requirements/constraints for criteria that are relevant across solutions and projects.
• elicit verifiable scenarios that operationalise the generic requirements and to exemplify qualities that are specific to your solution.
• use workshops with stakeholders (where appropriate) to both make use of their extensive domain knowledge and to get them to take ownership of system quality in addition to functional user stories.
• relying on experience can work if you have deep domain knowledge in addition to software architecture expertise.

The next post in the series will move on to next major area in architecture reviews - Methods and Techniques.

Thanks to @marioaparicio for comments on a draft of this article.

Read more

SEMAT and the origins of Software Engineering

I hope commentators on the SEMAT initiative - on both sides - have read enough history so that the rest of us aren't doomed to listen to a repeat performance of the last 40 years.

Its been interesting for me to follow the initial steps of the Software Engineering Method and Theory (SEMAT) initiative. Reading the SEMAT blog and articles revived memories from when I spent a bunch of years doing research on software engineering foundations. So I'm very curious to see how it progresses. Unfortunately, the initial buzz reminds me a lot of the fledgling steps of the original "software engineering" movement and I hope we don't waste an opportunity to deal with an important issue by continuing to bitch about the meaning of the word engineering.

Its hard to argue with the SEMAT Call to Action - especially the identification of immature practices. We do lack a theoretical foundation that provides both an explanation for the practices that have proven to be useful and a justification for proposing approaches for further improvement. (unless of course you believe we have already reached the pinnacle for software development effectiveness)

Many of the responses to the initial Vision and first workshop (google blog search semat,  twitter search #semat) are made by knowledgeable and insightful commentators. However, a great deal of what I read is simply a restatement of arguements that have been made in our discipline - that were often made more eloquently and constructively - for more than 40 years. Perhaps catching up with a bit of history can focus people on providing an improvement rather than rehashing old opinions.

---

P. Naur and B. Randell, (Eds.). Software Engineering: Report of a conference sponsored by the NATO Science Committee, Garmisch, Germany, 7-11 Oct. 1968, Brussels, Scientific Affairs Division, NATO (1969) 231pp.	B. Randell and J.N. Buxton, (Eds.). Software Engineering Techniques: Report of a conference sponsored by the NATO Science Committee, Rome, Italy, 27-31 Oct. 1969, Brussels, Scientific Affairs Division, NATO (1970) 164pp.
The transcripts of the original two software engineering conferences are available online. They contain many working papers,  but most importantly, also transcribed debates between the participants which capture very interesting views on both sides. As a bonus, there is also the first analogies I can find between software design and the design theories of Christopher Alexander

---

The NATO conferences on software engineering were held in 1968 and 1969 and were intended to provoke ideas for improving software development. Indeed the term "software engineering" was meant to provoke and not to dictate a frame of mind needed to produce dependable software.

The phrase ‘software engineering’ was deliberately chosen as being provocative, in implying the need for software manufacture to be based on the types of theoretical foundations and practical disciplines, that are traditional in the established branches of engineering (1968, Preface)

There were many debates about the nature of engineering and whether or not it can be applied in software development which elicited useful insights into the nature of software development. Indeed, some of those comments allude to understandings which are considered relatively recent, such as agile development.

“[Naur] In my terms design consists of:
Flowchart until you think you understand the problem.
Write code until you realise that you don’t.
Go back and re-do the flowchart.
Write some more code and iterate to what you feel is the correct solution.” (1968 Report)

Additionally, there were points made, such as the usefulness of mathematical formalisms for software development, which are still not satisfactorily addressed today.

The important take away is that the result of the first software engineering conference was debate. The term engineering was put forward to provoke discussion on a commonly agreed set of problems - a Call to Action.

The problem was when they reconvened in 1969 for the next conference. The thing you notice in the transcripts is that the topic of debate has changed. There is no longer a sense of how should we frame our thinking to resolve these issues. The notion that software development could be "engineered" had taken hold. The only question now was, how. This was also explicitly pointed out by the editors of the transcripts:

Unlike the first conference, at which it was fully accepted that the term software engineering expressed a need rather than a reality, in Rome there was already a slight tendency to talk as if the subject already existed. And it became clear during the conference that the organizers had a hidden agenda, namely that of persuading NATO to fund the setting up of an International Software Engineering Institute. However things did not go according to their plan. The discussion sessions which were meant to provide evidence of strong and extensive support for this proposal were instead marked by considerable scepticism, and led one of the participants, Tom Simpson of IBM, to write a splendid short satire on "Masterpiece Engineering" (Editor's report)

(btw: anyone who thinks they have a witty and insightful take on why software development isn't like engineering should read "Masterpiece Engineering")

This communication gap in the 2nd software engineering conference happened very quickly and was not overcome. This resulted in a whole group of people who could have made useful contributions being removed from the debate.

The sense of urgency in the face of common problems was not so apparent as at Garmisch [1968]. Instead, a lack of communication between different sections of the participants became, in the editors’ opinions at least, a dominant feature.” (Editor's report)

Its pretty clear in the external commentary of the first SEMAT workshop that this is happening again. Whether or not they have chosen to remove themselves from the effort, there is now a significant group of people who could be helping to achieve the goals of the Call to Action who are simply not taking part.

There is always risk that the subject of debate gets 'highjacked' by a particular side - such as those who believe that software development can be engineered. Using the word "highjacked" is very emotive and implies a deliberate misdirection of a movement, but in reality it is that people are at risk of pushing an approach that simply conforms to their preconceived world-view. Many of the comments on SEMAT and software engineering in general appear obvious to their authors and their like-minded colleagues. But they make little sense to the people on the other side. They are based on incommensurable viewpoints. That is, you simply can't find common basis for comparing them.

We each have a worldview through which we understand our domain (in this case software development). Those worldviews can be incommensurable like the pro- and anti- software engineering camps. But there is no right or wrong answer answer here. The only thing that matters is whether or they provide useful suggestions for improving our discipline.

I don't know if engineering is the most useful paradigm through which software development can be improved. However, you only have to have a basic understanding of philosophy of science to understand that its not possible to tell until after theories have been developed, evaluated, and falsified.

The SEMAT Call to Action captures issues that exist in software development. The software-engineering group needs to devise theories which can be proven useful in resolving those issues. The its-not-engineering proponents should be doing the same. It will help everyone if the debate between them continues instead of becoming a divide that stifles possibilities.

I'll finish off with my favourite quote by Dijkstra and Randell in the '69 transcripts:

“Dijkstra: I would like to comment on the distinction that has been made between practical and theoretical people. I must stress that I feel this distinction to be obsolete, worn out, and fruitless. It is no good, if you want to do anything reasonable, to think you can work with such simple notions. Its inadequacy, amongst other things, is shown by the fact that I absolutely refuse to regard myself as either impractical or not theoretical.
...
What is actually happening, I am afraid, is that we all tell each other and ourselves that software engineering techniques should be improved considerably, because there is a crisis. But there are a few boundary conditions which apparently have to be satisfied. I will list them for you:
We may not change our thinking habits.
We may not change our programming tools.
We may not change our hardware.
We may not change our tasks.
We may not change the organisational set-up in which the work has to be done.
Now under these five immutable boundary conditions, we have to try to improve matters. This is utterly ridiculous. Thank you. (Applause).

Randell: ... ‘There’s none so blind as them that won’t see.’ ... If you have people who are completely stuck in their own ways, whether these are ways of running large projects without regard for possible new techniques, or whether these are ways of concentrating all research into areas of ever smaller relevance or importance, almost no technique that I know of is going to get these two types of people to communicate. ... You have to have good will. You have to have means for people to find out that what the others talk is occasionally sense. This conference may occasionally have done a little bit of that. I wish it had done a lot more. It has indicated what a terrible gulf we so stupidly have made for ourselves.

Read more