Dorothy Graham Blog

How long does it take to write a book?

2012-01-25T07:53:00.000-08:00

A number of people have asked me this, since our new book is now out.

This book took us 2 and a half years. This doesn’t include the effort put in by the case study authors and other contributors, so this book represents a lot of work! What exactly had we been doing all that time? I wondered that too, so here is where the time went.

In August 2009, I have my first note of our plan to solicit contributions for a new book on automation experience. We sent emails, put a call for contributions on my web site, and talked to people at conferences, and began gathering potential contributions.

I started keeping track of the hours we spent from December 2009. We had a big initial “push” (the first peak on the graph) and produced a “protobook” – 4 chapters with an introduction. We were sure this would be snapped up by a publisher!

We submitted to the publisher of our previous book in mid-February, but initially they weren’t very keen! This was a blow, as we were convinced this would be a great book! I tried several other publishers over the next few months, and got rejected; I continued to try and convince Pearson/Addison Wesley that they should publish our book.

They eventually relented in July and we signed a contract. We worked steadily on the book over the rest of that year, a total of around 400 hours between us. The complete draft manuscript, ready for independent review was due on the 15^th April, and the final manuscript on the 15^th October. “No problem”, we thought.

However, we found that we did need to work at a more intense level - we spent another 300 hours to the end of April (the double peak with some time out in February), and another 300 hours to the end of 2011. The final peak was editing the final page proofs and doing the index, more work that we had anticipated at that stage. The total for us comes to just under 1000 hours. We don't know how much time the contributors spent, but it their time was equivalent to ours, the collaboration represents around 2000 hours of time - that's more than one working year.

We enjoyed working on this book and reading all the stories as they came in. There are many useful lessons, some heartfelt pain, and many gratifying successes among the stories.

You can follow the book on Twitter on @AutExpBook. The book tweets tips and good points every few days!

Thanks to all the book contributors, and to co-author Mark Fewster.

Part 3. Certification schemes do not assess tester skill?

2011-02-05T04:48:00.001-08:00

(Continuing from Parts 1 and 2, certification is evil? and some history about ISTQB)

Now I would like to say something about the criticism that the current schemes do not assess tester skill. I am thinking mainly of the Foundation level, as this seems to be where the criticism is mainly directed, and I am more familiar with that than the Advanced Levels.

In the main, I agree. There is a modicum of skill needed in testing techniques to be able to answer multiple-choice questions about them, but that is not the same as being able to test well in practice. And I also agree that the current ISTQB Foundation level is based more on learning facts than on practicing the craft. Why is that? Because the current scheme was designed to meet a different need, a basic ignorance about testing in general; it was not designed to assess testing skill.

I feel it is unfair for people to criticize a scheme because it doesn’t conform to what they think assessment of testers should be today, when the scheme was never meant to be that kind of assessment. It’s a bit like criticizing a bicycle for not powering you up a hill by itself – it’s not intended to do that.

When we were developing the original Foundation Syllabus with ISEB, I remember many discussions about what was possible and practical, including ways of assessing tester skills beyond basic concepts and vocabulary:

- interviews?

- looking at projects submitted from their workplace?

- observing them at work?

- substantial pieces of testing work to be done in a supervised exam-like setting or as a project to be given in within a time frame?

All of these have significant challenges. For example, how to ensure fairness if different people interview in different ways, ensuring that the work being assessed was actually done by the person submitting it, time commitment, scope and fair comparison of observation at work, designing a testing task that would be applicable to people from different industries.

We decided that the place to start was with something very basic that could be built on later, something that would try to cover common ground that all testers should know and build on - hence it was called "Foundation".

Criticism is good – we all learn by having our ideas challenged. But current qualification schemes are not “evil”, even if there are aspects of their current implementation that are not as they should be. So let’s take the context of the certification schemes into account, and remember that what may be ideal for today was not possible 12 or 13 years ago.

Part 2. A bit of history about ISTQB certification

2011-02-05T04:44:00.000-08:00

(Continuing from Part 1 where I was surprised at reactions to certification as "evil")

In the early 1990s, software testing was not a respected profession; in fact many thought of testing at best as a “necessary evil” (if they thought of testing at all!). There were few people who specialized in testing, and it was seen as a “second-class” activity. There was a general perception that testing was easy, that anyone could do it, and that you were rather strange if you liked it.

It was then that I decided to specialize in testing, seeing great scope for improvement in testing activities in industry, not only in imparting fundamental knowledge about testing (basic principles and techniques), but also in improving the view testers had of themselves, and the perceptions of testers in their companies. I developed training courses in testing, and began Grove Consultants, named after my house in Macclesfield. One of my most popular talks at the time was called “Test is a four-letter word”, reflecting the prevailing culture about testing. The UK’s Specialist Interest Group in Software Testing (SIGIST) was started by Geoff Quentin in 1989, and was the only gathering of testers in the UK.

It was into this context that the initiative to create a qualification for testers was born. Although I was not the initiator, I was involved from the first meeting (called by Paul Gerrard at a STARWest conference in 1997) and the earliest working groups that developed the first Foundation Syllabus, donating many hours of time to help progress this effort. This work was carried out with support from ISEB (Information Systems Examination Board) of the British Computer Society (meeting rooms, travel expenses and admin help). The testing qualification was modeled on ISEB’s qualifications in Project Management and Information Systems Infrastructure, which were perceived as useful and valuable in their respective sectors. One of the aims was to give people a common vocabulary to talk about testing, since at the time people seemed to be using many different terms for the same thing.

The first course based on the ISEB Foundation Syllabus was given in October 1998 and the first Foundation Certificates in Software Testing were awarded at that time. But an important aspect of the scheme was that it was not necessary to take a training course in order to get the qualification; you could just take the exam. (Some other schemes were based on attendance at courses which seemed too training-provider profit-oriented to us.)

The success of the Foundation qualification took everyone by surprise – there seemed to be a hunger for something that gave testers more respect, both for themselves and from their employers. It also gave testers a common vocabulary and more confidence in their work. The Foundation qualification was meeting its main objective of “removing the bottom layer of ignorance” about software testing.

Work then began on extending the ISEB qualification to a more advanced level (which became the ISEB Practitioner qualification) and also to extending it to other countries, as news of the qualification spread in the international community. I was a facilitator at the meeting that formed ISTQB in 2001 in Sollentuna, Sweden.

I became a member of the working party that produced the first ISTQB Foundation Syllabus in 2005, and I am amazed at how ISTQB has grown; it has certainly changed over the past six years. While working on the update to the Foundation book, I was rather surprised and disappointed at the apparent lack of review the before release of the 2010 Syllabus.

In Part 3 I return to the criticism that current certification schemes do not address tester skill.

Part 1. Certification is evil?

2011-02-05T04:40:00.000-08:00

Certification is evil?

This is a 3-part blog (because it ended up rather longer than I anticipated when I started).

1: My reaction to “certification is evil”

2: A bit of history about ISTQB certification

3: The criticism that current schemes do not assess tester skill

I enjoyed reading the Software Testing Club's publication "A Tester is for Life, not just for Christmas" (http://blog.softwaretestingclub.com/2010/11/a-tester-is-for-life-not-just-for-christmas/) which consists of interviews with a number of people, all of whom answered the same questions.

But I was quite shocked at the strength of feeling shown by quite a few against certification. The question asked was "What are your views on Testing Certification Schemes?" Although there are a few older testing qualifications from the US, it seems that most people assumed the ISTQB qualifications were being asked about.

A couple of people called the ISTQB scheme a "scam", one person said it was "downright dangerous", and someone said it was "the devil in disguise" and talked about the "evil axis" of certification institutes, training providers and HR departments. Some mentioned "profit" and "money-making". Several criticized any exam based on memorizing, saying that current exams are too easy, even "trivial"; one said the exam "has no value".

The basis of this criticism (if there is a rational basis) seems to be that current schemes do not assess tester skills, i.e. how well you can actually do testing. (I will return to this point at the end of this blog.)

(On the other hand, many said that the current schemes were a good starting point for people new to testing, that it gave knowledge of basic terminology, helped them get their first job, and can demonstrate that you are serious enough about testing to take an exam.)

I was not surprised to find people who didn't like the ISTQB certification schemes - I have been to conferences over the past few years where this has become clear. But some of the "opposition" to certification is, I believe, based on a false premise about what it was intended to be, and this I feel is somewhat unfair.

Just to state my own position: I am not involved in any certification scheme at the moment. I no longer provide accredited ISTQB training courses in software testing. However, I was involved in writing the initial Foundation Syllabus, and I am currently in the process of updating our book that supports the ISTQB Foundation Syllabus.

It seems to me that people have lost sight of (or perhaps were never aware of) the origins and purpose of the current certification scheme, at least the ISTQB Foundation (which is the one I am most familiar with).

I have been involved in software testing all my working life, for over 40 years. The situation before the current ISTQB certification began was very different to what testing is like today!

See my next entry for a bit of history about ISTQB.

Automation benefit measured by EMTE - good or bad?

2010-10-07T05:03:00.000-07:00

Being able to run tests that we would not have had time to run manually is one of the benefits of automated testing; we should be able to measure this benefit in some way.

What is EMTE?

EMTE stands for "Equivalent Manual Test Effort" and is a way of measuring the benefit of running automated tests.

If an automated test (A) would have taken 4 hours to run manually, then its EMTE is 4 hours; another test (B) that would have taken 7.5 hours to run manually has an EMTE of 7.5 hrs.

In a test cycle, if Test A is run five times, and Test B is run twice, then the EMTE for that cycle is 5*4 hrs + 2*7.5 hrs = 20 + 15 = 35 hours EMTE.

What is EMTE used for?

EMTE can be used as a way to measure a benefit of test automation (automated running of functional tests).

When tests are automated, they can be run in much less time than they could be run manually. Our tests A and B may be able to run in 5 and 10 minutes respectively, for example. So we can achieve "4 hours' worth" of manual testing in 5 minutes of automated testing. Whenever we run Test A, we can "clock up" 4 hours of EMTE.

Is EMTE a good thing?

Yes, because it is a way to show the benefit of automation.

Costs (of automation as well as other things) tend to become visible by themselves - managers see that people are spending time on the automation. But what is the benefit of this automation? If you don't make benefits visible to managers, there is a risk that they will not see the benefits, and may eventually conclude that there are no benefits. EMTE is one way to make an automation benefit visible.

So how could it be a bad thing?

I have had discussions with a couple of people recently (thanks Julian and Wade) about abusing EMTE, and yes, it can be abused (as any metric can). Here is how it could be mis-used:

"Test A takes 5 minutes, so let's run it 12 times every hour for 2 hours. This gives 24*4 hours of EMTE = 96 hours. This will make us look really great!"

The problem is that after the first run, the other 23 runs are being done just for the sake of looking good, not for a valuable benefit in terms of running that test. This is an abuse of EMTE, and is a bad thing.

What to do about it?

Use EMTE (and other measures of the benefit of test automation) sensibly.

Perhaps only "count" EMTE once a day, however many times a test is run? (e.g. in continuous integration testing)

In what other ways can the benefit of automation be shown? (e.g. more coverage, freeing testers to find more bugs, number of times tests are run, more variety of data used?)

Have you encountered the abuse of this (or other automation) measures? How have you solved the problem? (Please comment, thanks!)

Dot Graham

Automated tests should find bugs? No!

2010-05-27T05:13:00.000-07:00

I have recently been having what seems like the same discussion with a number of different people.

"Automated tests should find bugs" or "find more bugs" is a very common misconception. Basically this says that finding bugs is a valid objective for automation. I don't agree - I think this is generally a very poor objective for test automation. The reasons are to do with the nature of testing and of automation.

Testing is an indirect activity, not a direct one. We don't just "do testing", we "test something". (Testing is like a transitive verb which requires an object to be grammatically correct.) This is why the quality of the software we test has a large impact on testing: if a project is delayed because testing finds lots of bugs, we shouldn't blame the testing! (I hope that most people realize this by now, but do have my doubts at times!) Testing is not responsible for the bugs inserted into software any more than the sun is responsible for creating dust in the air. Testing is a way of assessing the software, whatever the quality of that software is.

Test automation is doubly indirect. We don't "do automation", we "automate tests that test something".

Automation is a mechanism for executing tests, whatever the quality of those tests are (that assess the software, whatever the quality of that software is).

Bugs are found by tests, not by automation.

It is just as unfair to hold automation responsible for the quality of the test, as it is to hold the testing responsible for the quality of the software.

This is why "finding bugs" is not a good objective for test automation. But there are a couple more points to make.

Most people automate regression tests. Regression tests by their nature are tests that have been run before and are run many times. The most likely time a test will find a bug is the first time it is run, so regression tests are less likely to find bugs than say exploratory tests. In addition the same test run for a second time (and more) is even less likely to find a bug. Hence the main purpose of regression tests (whether automated or not) is to give confidence that what worked before is still working (to the extent that the tests cover the application).

Of course, this is complicated by the fact that because automated tests can be run more often, they do sometimes find bugs that wouldn't have been found otherwise. But even this is not because those tests are automated, it is because they were run. If the tests that are automated had been run manually, then those manual tests would have found the bugs. So even this bug-finding is a characteristic of the tests, not of the automation.

So should your goal for automation be to find bugs? No! At least not if you are planning to automate your existing regression tests.

I have been wondering if there may be two exceptions: Model-Based Testing (where tests are generated from a model), and mature Keyword-driven automation, i.e. using a Domain Specific Test Language. In both cases, the first time a test is run is in its automated form.

But hang on, this means that again it is the tests that are finding the bugs, not the fact that those tests are automated!

"Finding bugs" is a great objective for testing - but it is not a good objective for automation.

Finding 40% of your own mistakes

2010-01-14T02:00:00.000-08:00

I used to be fond of quoting a statistic that says you can only find around 40% of your own mistakes.

Michael Stahl emailed me to ask where this number came from. Interesting question - first thought - I don't remember! I'm sure I must have read it somewhere at some time, but where, by whom and was it based in a study?

I checked with Mark Fewster, one of my former colleagues, and he thinks it might have come from a study done by the Open University in the UK.

I checked with Tom Gilb, as he uses an estimate of around a third (33%) for the effectiveness of an initial inspection - which is probably more effective than an individual anyway! Tom has demonstrated an effectiveness of 33% repeatedly by experimentation with early Inspections; he said it also agrees with Capers Jones' data.

I think we used the figure of 40% only because people found it more believable than 33%.

The frightening consequence is that if you don't have anyone else review your work, you are guaranteed to leave in two thirds of your own mistakes!

DDP Discussions and challenges

2010-01-02T03:09:00.000-08:00

Several people have asked about benchmarks for DDP. I have actually blogged about this, but my comments are "buried" in the comments to the post about "Starting with DDP". Please have a look at the comments for that post, which include:

- benchmarking DDP with other organisations (raised by Bernhard Burger)

- Paul Herzlich's challenges about the seriousness of defects, getting data, DDP being hard to use and code-based metrics (all of which I have replied to in my following comment)

- using DDP to improve development (raised by Ann-Charlotte)

- Michael Bolton's challenges:

5 examples to show when it doesn't work (which I reply to in my first comment following his) (including some Dilbert Elbonian testers ;-)

7 "problems" - some of which I agree with, some I don't understand, and some I think illustrate the benefit of DDP rather than being problems with it (replied to in my second comment after his)

Thanks to Michael B's comments, I also formulated 3 Rules for when to use DDP:

DDP is appropriate to use when:
1) you keep track of defects found during testing
2) you keep track of defects found afterwards
3) there are a reasonable number of defects – for both 1) and 2)

These are not the whole story (as illustrated by Michael's examples) but I think are a pre-requisite to sensible use of DDP.

Can Agile be Context-Driven?

2009-12-18T01:57:00.000-08:00

"They say they are doing Agile, but they're not doing all of the practices, so they aren't really Agile."

This seems to be a popular view, implying that Agile needs to be done "properly". A search on "agile best practice" brings up many entries. Is there such a thing as Agile Best Practice?

The Context-driven principles (www.context-driven-testing.com) include:

1. The value of any practice depends on its context.

2. There are good practices in context, but there are no best practices. (emphasis mine)

So if you adapt agile practices to suit your context, as was described by Gitte Ottosen at EuroSTAR, isn't that context-driven agile? And isn't that the best way to practice it?

ROI from automation

2009-06-19T08:34:00.000-07:00

How do you measure Return on Investment from automation?

According to http://www.investopedia.com/terms/r/returnoninvestment.asp, return on investment is (Gain - Cost) / Cost.

So if we have a set of automated tests that save 5 hours of manual testing, then if those tests took one hour to build and run, our ROI would be (5 - 1) / 1 = 4 (if my arithmetic is correct). So that would be a four-fold ROI for those automated tests.

Of course in the initial stages of automation, before our automation regime is mature, it might take us 10 hours to build and run those same tests. This would give an ROI of (5 - 10) / 10, i.e. a negative return on investment of -0.5.

Negative ROI is not generally a good idea, as it means you are losing money. But you may have negative ROI in the early stages of automation, but a very good positive ROI long-term. It might also make more sense to look at ROI over a larger sample, say all of the automation build and run in a month, and monitor that month by month.

How do you measure ROI for automation?

Make testing fun?

2009-03-16T02:47:00.000-07:00

On the LinkedIn group "Software Testing Club", the question was asked: "How can we make testing more fun?" They are running 1300 scripts over 4 months.

There were some interesting answers about holding weekly competitions, creating visibility with management, and having a movie in work time. There were also a couple of mentions about automation also. Here is my response to the thread:

--------------------

Draw a graph of the "boringness" of the testing - on a scale of 1 to 10 - of different things the testers are doing. The more boring the activity, the more ripe it is for automation. But don't think of automation as all-or-nothing. Pick out the most boring things for people to do and automate them. You can get real benefit by automating only 2% of the scripts, for example.

You don't need to purchase expensive tools to automate either. Use what you already have or look into open source tools (see the FreeTest Conference link from my web site).

However, do be warned that a free tool is not free! In order to be successful in automation, you must plan and prepare how you will do it.

In fact there is so much to say about how to go about automation that I have written a book about it with Mark Fewster (see link on my web site). Although the case studies are now getting a little "long in the tooth", the main body of the book covers the principles of automation - whatever tool you use - that will help you creat a long-lasting "regime".

Manual testing is not fun if you are just following a script; but manual testing is tremendous fun if you are doing exploratory testing, for example. Get the computers (tools) to do what they are good at, and free the people to do what they are good at.

Don't blame the bread-making machine - thoughts on test automation

2009-02-23T21:17:00.000-08:00

If you have a bread-making machine, it may or may not make good bread.

If it doesn't, the reason might be the ingredients you put into the machine. If you put in too much salt (or no salt at all), the bread won't be edible. Is that the fault of the bread-making machine?

Some people blame the test automation for things which are actually the responsibility of the testing. For example, if you mistakenly think that finding lots of bugs is the main aim of your regression test automation, you are setting yourself up for disappointment, if not failure of your automation effort. Finding bugs is what testing (and testers) do - it is not the job of automation - the job of automation is to run tests.

The tests are the ingredients that determine whether the testing is effective or not. The effectiveness of the tests is the same whether those tests are run manually or using an automation tool.

The tool is no more responsible for the quality of the testing than the bread-making machine is responsible for the taste of the bread.

DDP

2008-12-29T10:21:00.000-08:00

Getting started with DDP

You probably already have the information you need to calculate your own DDP - the number of defects found in testing, and the number that were found later (e.g. a later stage of testing or reported to Support).

For example, if system testing (ST) found 50 bugs, and user acceptance testing (UAT) found 25, the DDP of ST was 67% (50 / 75).

Take a project that finished 3 to 6 months ago and calculate what the DDP was for that. Now you have a starting point to see how your testing is changing over time.

Not all bugs are created equal! When you start measuring DDP, you might want to use only the highest one or two severity ratings. Or you could have one DDP for high severity, and one for all bugs.

If you have any questions about DDP please ask!

2008-12-28T00:00:00.000-08:00

DDP is my favourite metric. It is very easy to measure, easy to understand, and gives you an idea of the quality of the testing, in terms of defects found. Many people have found it very useful. If you are one of those people, please respond to this blog and tell me about your experiences!

What is DDP?

DDP is Defect Detection Percentage. It is a measure of the effectiveness of testing (or reviewing) at finding defects. The calculation is very simple: The number of defects (bugs) found in testing* divided by the number of defects found in total so far**.

*DDP can be calculated for different iterations, different testing stages (e.g. integration and system test) or testing by a defined set of testers.

**You can choose any point in time to calculate DDP - for example, one month after an iteration is released (or when the next iteration is released).

There are lots of variations on DDP - if you have any questions, please ask!

Dot