Bertrand Meyer

See http://bertrandmeyer.com/about

Just another day at the office

by

In the past few weeks I wrote a program to compute the aliases of variables and expressions in an object-oriented program (based on a new theory [1]).

For one of the data structures, I needed a specific notion of equality, so I did the standard thing in Eiffel: redefine the is_equal function inherited from the top class ANY, to implement the desired variant.

The first time I ran the result, I got a postcondition violation. The violated postcondition clauses was not even any that I wrote: it was an original postcondition of is_equal (other: like Current)  in ANY, which my redefinition inherited as per the rules of Design by Contract; it reads

symmetric: Result implies other ~ Current

meaning: equality is symmetric, so if Result is true, i.e. the Current object is equal to other, then other must also be equal to Current. (~ is object equality, which applies the local version is is_equal).  What was I doing wrong? The structure is a list, so the code iterates on both the current list and the other list:

from
    start ; other.start ; Result := True
until (not Result) or after loop
        if other.after then Result := False else
              Result := (item ~ other.item)
              forth ; other.forth
        end
end

Simple enough: at each position check whether the item in the current list is equal to the item in the other list, and if so move forth in both the current list and the other one; stop whenever we find two unequal elements, or we exhaust either list as told by after list. (Since is_equal is a function and not produce any side effect, the actual code saves the cursors before the iteration and restores them afterwards. Thanks to Ian Warrington for asking about this point in a comment to this post. The new across loop variant described in  two later postings uses external cursors and manages them automatically, so this business of maintaining the cursor manually goes away.)

The problem is that with this algorithm it is possible to return True if the first list was exhausted but not the second, so that the first list is a subset of the other rather than identical. The correction is immediate: add

Result and other_list.after

after the loop; alternatively, enclose the loop in a conditional so that it is only executed if count = other.count (this solution is  better since it saves much computation in cases of lists of different sizes, which cannot be equal).

The lesson (other than that I need to be more careful) is that the error was caught immediately, thanks to a postcondition violation — and one that I did not even have to write. Just another day at the office; and let us shed a tear for the poor folks who still program without this kind of capability in their language and development environment.

Reference

[1] Bertrand Meyer: The Theory and Calculus of Aliasing, draft paper, available here.

Touch of Class book page available

by

The book page for Touch of Class (my introductory programming textbook), announced in the book, is finally available, courtesy Vladimir Tochilin:

touch.ethz.ch

It includes some book extracts (prefaces, table of contents, an entire sample chapter, for which I chose the Recursion chapter), a list of known errata and a wiki page to report new errata, a discussion forum, links to the full set of slides (PowerPoint, PDF) for the associated course, video recordings of that course at ETH, and a special “instructor’s corner” for those having adopted the textbook for their courses.

Dwelling on the point

by

Once again, and we are not learning!

La Repubblica of last Thursday [1] and other Italian newspapers have reported on a “computer” error that temporarily brought thousands of accounts at the national postal service bank into the red. It is a software error, due to a misplacement of the decimal points in some transactions.

As usual the technical details are hazy; La Repubblica writes that:

“Because of a software change that did not succeed, the computer system did not always read the decimal point during transactions”.

As a result, it could for example happen that a 15.00-euro withdrawal was understood as 1500 euros.
I have no idea what “reading the decimal point ” means. (There is no mention of OCR, and the affected transactions seem purely electronic.) Only some of the 12 million checking or “Postamat” accounts were affected; the article cites a number of customers who could not withdraw money from ATMs because the system wrongly treated their accounts as over-drawn. It says that this was the only damage and that the postal service will send a letter of apology. The account leaves many questions unanswered, for example whether the error could actually have favored some customers, by allowing them to withdraw money they did not have, and if so what will happen.

The most important unanswered question is the usual one: what was the software error? As usual, we will probably never know. The news items will soon be forgotten, the postal service will somehow fix its code, life will go on. Nothing will be learned; the next time around similar causes will produce similar effects.

I criticized this lackadaisical attitude in an earlier column [2] and have to hammer its conclusion again: any organization using public money should be required, when it encounters a significant software malfunction, to let experts investigate the incident in depth and report the results publicly. As long as we keep forgetting our errors we will keep repeating them. Where would airline safety be in the absence of thorough post-accident reports? That a software error did not kill anyone is not a reason to ignore it. Whether it is the Italian post messing up, a US agency’s space vehicle crashing on the moon or any other software fault causing systems to fail, it is not enough to fix the symptoms: we must have a professional report and draw the lessons for the future.

Reference

[1] Luisa Grion: Poste in tilt per una virgola — conti gonfiati, stop ai prelievi. In La Repubblica, 26 November 2009, page 18 of the print version. (At the time of writing it does not appear at repubblica.it,  but see  the TV segment also titled “Poste in tilt per una virgola” on Primocanale Web TV here, and other press articles e.g. in Il Tempo here.)

[2] On this blog: The one sure way to advance software engineering (post of 21 August 2009).

The Case of the Handsome Couple: answer

by

Alina was, as noted, on Pařížská (Paris avenue). Heeding the unknown voice, she started walking clockwise; she did not hesitate as to what this means since, conveniently, she was standing right next to a clock:

Public clock on Pařížská

Luca was standing on the other side of the block. He too saw a clock:

Hebrew clock

Pařížská was built in the late nineteenth century, as Prague’s answer to the Paris Champs-Élysées; it cut through Josefov, the old Prague ghetto. Most of the old Josefov was destroyed at the time; among the buildings that survived were six synagogues, the famous cemetery, and the “Jewish Town Hall”. This last building had been reconstructed in the 18th century with a fancy clock using Hebrew letters and, as an homage to the right-to-left reading of Hebrew script, running in the opposite of the direction of ordinary clocks. The clock figures in Guillaume Apollinaire’s Alcools:

    Tu ressembles au Lazare affolé par le jour
    Les aiguilles de l’horloge du quartier juif vont à rebours
    Et tu recules aussi dans ta vie lentement
    En montant au Hradchin et le soir en écoutant
    Dans les tavernes chanter des chansons tchèques
        (You look like Lazarus scared by daylight
        The hands of the Jewish quarter clock go backwards
        And you too step back slowly through your life
        As you walk up to the Hradčany and in the evening
        Listen to Czech songs sung in taverns)

Luca started walking clockwise, according to the clock next to him; you know the rest.

Normal clocks all go the same way; the backwards clock is no more than a wink and a whim. Had Luca raised his eyes more:

Three clocks on the Jewish Town Hall

he would have gone by one of the other, ordinary clocks, going in the same direction as Alina; and we would not have a story.

The Case of the Handsome Couple

by

Yesterday’s New York Times carries an article by John Tierney about the 95th anniversary of the king of mathematical puzzles, Martin Gardner. The article is so well done that I will not even try a summary, referring you instead directly to it [1]. Just one detail worthy of note:  when he undertook to write a monthly puzzle column for Scientific American at the age of 37, Gardner “had never taken a math course beyond high school. He had struggled with calculus and considered himself poor at solving basic mathematical puzzles, let alone creating them.”

Logical and mathematical puzzles are a great way to keep the mind alert; one of the attractions of going to meetings of IFIP Working Group 2.3 on Programming Methodology[2]  is that members constantly tease each other with puzzles of diverse nature and difficulty; Rustan Leino, the group’s current secretary, keeps a fascinating collection on one of his Web pages [3].

It would be imprudent to promise anything like a “ monthly puzzle” here, but let me at least announce an “occasional series”, which is not too harsh a commitment, and propose the first installment today. This little teaser is definitely original: The Case of the Handsome Couple.

At a dinner, one couple stands out as particularly hansome; both the wife and the husband (Alina and Luca). Conversation turns to the inevitable question: “How did you two meet?”.

“ Interesting indeed”, says the wife. “It was love at first sight: I was walking and came face to face with Luca;  on the spot, I knew he was the one.”

“Tell us more! Where and how?”

“It was in Prague. I was walking along the Pařížská avenue, this kind of Champs-Élysées of Prague, window-shopping at the luxury shops. Then my Blackberry rang; I picked it up. I heard an unknown voice, telling me to start walking clockwise around the block. For some reason I felt compelled to obey it; soon after I came face to face with him. You know the rest.”

The host turns to Luca: “How was it for you?”

“Will you believe me: exactly the same! I was actually, as we later reconstructed, on the other side of that same city block. Suddenly my iPhone rang and I heard that strange voice ordering me to keep walking clockwise around the block. And suddenly I find myself face to face with her! You see the result.”

It’s a normal city block, and they were both faithfully obeying the injunction to walk clockwise, yet met face to face. How was that possible?

References

[1] John Tierney: For Decades, Puzzling People With Mathematics, in New York Times, 19 October 2009, available here.

[2] IFIP WG 2.3, Programming Methodology: see the group’s Web page.

[3] Rustan Leino’s puzzle collection at research.microsoft.com/en-us/um/people/leino/puzzles.html. (Disclaimer: Rustan says he obtained two puzzles — originally from other sources —through me.)

Knuth & company

by

Remember Stacey’s in Palo Alto and San Francisco? Only a decade ago these and other technical bookstores were the mecca of the tech industry, where developers would swarm at any time of day to catch up on the latest releases. One well-known Valley entrepreneur even told me she did her hiring there, spotting customers who looked like developers and picked the right books.

Times have changed. After all the other branches, Stacey’s venerable San Francisco’s store finally closed earlier this year [1], the victim of the bubble’s burst, of Amazon, and of the crisis. Many others in the US and elsewhere met the same fate.

But wait… In Gaul, a little village is resisting the onslaught. A couple of streets away from the Shakespeare and company bookstore immortalized by Hemingway, Scott Fitzgerald and so many others, the Paris technical bookstore Le Monde en Tique [3] is a true legend of its own. Le Monde en Tique has, for the past twenty years, carried the best selection of computer and other technology books within a good thousand kilometers. I was there on Oct. 10, after the European Computer Science Summit (more on ECSS soon) for a book signing of Touch of Class:

Holding books

The store’s name, “the World in Tics”, is a wink to the many “tics” served by its books, from informatics (computer science and information technology) to “telematics” (computer  communication). Housed in a beautiful stone edifice in the heart of medieval Paris, on a little winding street close to the river, Le Monde en Tique is more than a bookstore: it is a haven for the local developer community, a place to stop by on a Saturday afternoon for a passionate discussion on agility, Ajax or Agitar. There is even a small garden:

The garden

There is a secret to Le Monde en Tique’s continued success: the quality of its offerings. The unique skill of  Jean Demétreau and his team is their availability to locate hot new books, including those from the US and elsewhere, before anyone else does; the large Paris bookstores like FNAC, and the Web sites such as fnac.fr and amazon.fr are often several weeks behind. Not just the French sites, as a matter of fact: in the case of Touch of Class, Le Monde en Tique had the book about a month ahead of amazon.com USA. This is why people come from very far away to get both the latest offerings and the classics.

So here’s my plug: whether you have just heard about a great new book, or haven’t heard anything and want to find out what is the latest great new book, this is the place to go. It might already be late when you finally take yourself away from browsing the shelves; but as you go out of the store and walk a few steps, the sight will not be too bad:

Notre Dame on an October evening

References

[1] Matthai Kuruvila, Stacey’s Bookstore closing down in S.F., in SFGate (San Francisco Chronicle), 5 January 2009, available here.

[2] Shakespeare and company bookstore in Paris: see here.

[3] Le Monde en Tique bookstore, 6 rue Maître Albert, Paris: see www.lmet.fr.

The CPU Clock principle of software releases

by

On how to build software, there is still much we do not know for sure; but we have also learned a few principles that can be considered firm.  By definition these are not new ideas; today’s principle, for example, is related to what agile developers know as “timeboxing”. But even if they have been published and discussed they are not universally applied or understood.

An  example is the CPU Clock principle: release at fixed frequency.

When planning for a new release of a system you can play with three parameters: functionality; quality; release time. The CPU Clock principle states that once a release time has been set you should never budge. If something has to go, it will be functionality.

At Eiffel Software we have been applying this principle systematically since shortly after we released EiffelStudio into open source in 2006. There are two releases a year, the  “Northern Spring release” on May 15 and the “Southern Spring release” on November 15 [2]. The content of each release is finalized six weeks before (April 1st, October 1st) and no delay is tolerated [3].

This scheme is a radical departure from the previous mode of operation. Of course every release had a planned delivery date, but it also had planned functionality; often, the functionality was not all ready at the appointed time, so the delivery date would shift, often by many months. No doubt the release plan was thought realistic at the time the team devised it, but it is a natural human tendency to promise too much and hope for the best. Delays came not so much from major obstacles, as features would get dropped if found too hard to include, but from functionality which the team believed to be “almost there” as the release date approached; a week passed, then a month, then maybe a half-year or more.

The better technique, as we have learned (no doubt many others have too) is to make release time the non-negotiable target. As with the clock cycle of a CPU in a modern computer, the sequence of release deadlines is the heartbeat to which everything else in the process must synchronize. The scale is different from that of a computer by a few orders of magnitude (months rather than pico- or nanoseconds), but the principle is the same.

The scheme requires a strict rule that whatever is not ready in time will not make it into the release. Indeed it has occurred a few times that some scheduled functionality had to be dropped, or at least moved to the next release. But now — with two and a half years of experience — comes the remarkable lesson: this case, dropping a planned feature because it is not ready at the appointed time, happens only exceptionally. It is not hard to analyze the reasons:

  • Developers work better. It is not pleasant, for a developer who has devoted considerable effort to a new mechanism, to see that it does not make it to the product. Knowing that the deadline is coming, and that it is for real, is a powerful incentive to finish the work.
  • Everyone, managers and developers, learns to be realistic. Managers will not set impossible goals; developers will not commit to impossible implementations.

Traditionally, some software projects have always had to treat delivery time as the number one goal. If you had to adapt an automatic teller machine network to the introduction of the euro, there was not much other choice than to be ready on January 1, 2002, and preferably a little before that. But many projects have a more lackadaisical attitude. They would fare better by adhering to the CPU Clock principle.

In describing it I have left a question open. Functionality should yield to  release punctuality, but we saw that there is a third parameter:  quality. What about it? Should we be ready to sacrifice it as well? I will not address the question furtherfor the moment, if only because this may be a good topic for reader comments before I come back to it in a future post.

The CPU clock principle addresses release times: the times when new versions of the product are made available to its users. It does not necessarily apply to internal milestones of the development team. Timeboxing, a related idea made popular by agile methods, is about such internal, intermediate steps; the typical iteration period of timeboxing is a f ew weeks. While fixed deadlines and a fixed frequency may be useful for such short internal iterations, the case for timeboxing is less compelling, especially for a large project where the various components may evolve along different timelines.

Because the CPU Clock principle governs the global scheduling of a product development, the scale is different. I cited above the 6-month periodicity of EiffelStudio development; although each project will define its own period, it makes no sense to go below one month for any significant software effort.

How universal is the principle? Only two exceptions come to mind: very small projects, and the initial phase of a project, when the development is taking shape and it is too early to define the ideal release scheme. Outside of these two cases, I see the CPU Clock principle, on the basis of our experience and of discussions with many developers and project leaders, as the only sustainable model for healthy software projects.

Notes

[1] EiffelStudio open-source development page, see here.

[2] Formerly known as the “Spring release” and “Fall release” until someone complained of hemisphere bias.

[3] Actually some last-minute technical problems have occasionally caused short delays in the actual delivery, without affecting the overall cycle. We have taken measures to ensure that these do not occur again.

Do you know Java?

by

I am jealous of Emmanuel (Manu) Stapf who blogged about this before I had the time to; but I can at least refer you to his entry [1].

The idea actually comes from Martin Nordio, who as part of his thesis work formalized the exception semantics of both Eiffel and Java. In the process he came across some (shall we say) interesting properties of Java, and got into the habit of asking people first if they know Java well, and then if they can predict the results of some simple programs.

So, do you think you know Java? If so, please take the test, and wait for the answer next week in Manu’s blog.

Reference

[1] Emmanuel Stapf: “And people are still using Java?” blog entry.

 

SEAFOOD 2010

by

The next SEAFOOD (Software Engineering Advances For Offshore and Outsourced Development) conference will take place in Saint Petersburg, Russia, on 17 and 18 June 2010. The conference co-chairs are Andrey Terekhov from Saint Petersburg State University and Lanit-Tercom, and Martin Nordio from ETH are conference co-chairs. Mathai Joseph from Tata Consulting Services and I will be co-chairing the PC. The Call for Papers will be issued soon; information about this year’s conference at seafood.ethz.ch.