Heap Memory in .NET

Apropos my previous post, my team was trying to resolve another memory leak problem in one of the .NET applications. It is interesting to note that a .NET program does not have any explict way to specify the heap size. The .NET heap size will keep on growing till it consumes all of the available memory.
A hosted application such as IIS can control the amount of heap allocated to a Application Domain.
The following discussion threads throw more light on this: Link1  Link2

Also found this amazing article by Andrew Hunter (ANTS profiler contributor) explaning the Large Object Heap concept in .NET. Understanding these concepts will make us appreciate how we get an unexpected OutOfMemory error even if our total object size is relatively small.

OutOfMemoryError while using StringBuilder/StringBuffer

I was helping a friend debug a OutOfMemory exception in a Java web application. The program made heavy use of StringBuilder and was appending a large number of strings. An entire record set (containing thousands of records) was essentially converted into an XML string.
Strangely when the OOM error occured, there was still plenty of heap memory available. Furthur deep-dive debugging and some googling around, taught a few important lessons.

1. Whenever the internal buffer capacity of StringBuilder/StringBuffer is exceeded, then the next character array size it creates is twice of the original size. A good blog explaining this is here. Hence it is better to initialize the initial capacity of the StringBuilder to a reasonable value beforehand.
2. StringBuilder needs a continuous block of memory for further allocation. For e.g. you may have 20MB free heap space, but it may be fragmented. Hence even a 5MB StringBuilder allocation may fail and result in a OOM error. Links to forums - Link 1  Link2 Link3
3. Try to use a 64-bit machine, as there are no practical limitations for the heap memory allocation and also it is much easier to find a continous block of memory due to 64-bit addressing.
4. Alter the design of the program to not store the string in memory, but in a file. Alternatively stream it directly to the HTTP response. 

Taxonomy of Services

In one of my previous posts, I had blogged about creating a taxonomy of services using functional categorization.
For e.g. Entity Services, Task/Activity Services, Process Services and Infrastructure services.

But services can also be categorized from different perspectives such as layers or intent of use. For e.g.
Categorization based on Service Layer:

1. Business Services: Represent high level business functions that define an enterprise.
2. Application Services: Application specific and usually will be aggregated in a composite service at the business level.
3. Infrastructure Services: Utility functions that deliver cross cutting functions.

Categorization based on scope:
1. Enterprise Services: Multiple LOBs use the service.
2. Domain Services: Applicable only within a LOB.
3. Application Services: Local to the App Level.

Analysis vs Design

This age-old debate keeps propping up every now and then :)
Found a couple of good articles reflecting on the difference between the two.

http://butunclebob.com/ArticleS.UncleBob.AnalysisVsDesign

http://devhawk.net/2004/03/30/analysis-vs-design-modeling/

Oracle Web Service Manager vs Oracle Enterprise Gateway

Oracle Web Service Manager is an integral part of the Oracle SOA suite and it allows us to implement security declaratively; without any coding from the developer. Security policies can be enforced at run-time using WSM agents or WSM gateways.
There is another product called "Oracle Enterprise Gateway" that has features that overlap with OWSM - hence this results in lot of confusion.

So, lets understand the concepts one by one. A WSM agent is a component that is installed with the endpoint service. So it provides the 'last-mile' security (last security layer). Now OWSM also a gateway component where security policies can be employed in a central location. A gateway can also perform functions that an agent cannot do, such as message routing, transformations, and failover. OWSM also has an extension for OSB, that allows us to use OWSM policies at the OSB (ESB) layer. These capabilities would suffice the requirements of most intranet SOA infrastructures.

Oracle positions the Oracle Enterprise Gateway as the first line of defence ("perimiter security") when SOA services are exposed to the outside world. This is the equivalent of a DMZ firewall. So it looks like Oracle Enteprise Gateway is a more expansive product that can do everything that OWSM does, plus all the bells and whistles.

Ruminating on the Oracle MDM suite

Recently during one of our internal brainstorming sessions, there was a lot of confusion over the various components available on the Oracle platform to build a robust MDM solution. Part of the confusion was because Oracle has picked up best of breed components from various acquisitions and integrated them together to form the MDM suite. Its important to understand that when someone talks about Oracle MDM - it is a suite of components and NOT just one product.

Oracle's acquisition of Hyperion has further added to the confusion, as Hyperion has full capabilites to be used as a MDM solution. Oracle promotes Hyperion Data Relationship Manager as a component in its MDM suite - that can be used for managing the relationships between different attributes of master data from disparate sources.

At the fundamental level, to build a MDM end-to-end solution, you need basic components such as a ETL tool, Data Profiler, Data Cleansing Engine that can be used for standarization, de-duplication, validation, etc. Given below are the core components of the Oracle MDM suite, followed by optional components that help in jump-starting your MDM journey.

• Oracle Data Integrator Enterprise Edition: ODI can be used for ELT style bulk data movement, or near real-time updates, and data services. ODI can consolidate master data from various sources and also publish master data to downstream applications. (Note: Oracle has acquired Golden Gate product that enables real-time intergration of data across disaparate data-sources. GG can also be used in conjuction with ODI for movement of data)
• Oracle Data Quality / Data Profiling: Oracle Data Profiling allows us to profile the master data and investigate the content and the structure of their different data sources. It also gives users the ability to monitor the evolution of data quality over time using Time Series. Oracle Data Quality allows us to standardize, validate, cleanse and enrich master data – for e.g. master list of securities, issuers, official list, etc. Using both these tools will ensure the integrity of data stored in the MDM data store.
• Oracle Business Intelligence Suite: OBIEE can be used for analytics and reporting on master data entities.

Besides these core components, Oracle MDM suite also contains pre-packaged MDM solutions such as “Customer Hub”, “Product Hub”, “Site Hub”, “Supplier Hub”, etc. (Some of these are part of Siebel MDM, I believe.)  

Ruminating on IRM (Information Rights Management)

From a security architecture perspective, it is important to consider the need for using IRM technology. Traditionally we have secured access to documents using RBAC patterns for secure access and download.

But how do you control the information once it is downloaded to the users machine? Can the user copy/paste from the document? Can the user print the document? Can the user forward the document to someone or upload it somewhere? Can he run macros on the document? So how can an enterprise have total control on sensitive information?

These questions cannot be answered by classical access control mechanisms, they need a new security framework concept called "Information Rights Management". Many traditional ECM vendors also offer IRM adapters or add-ons to help customers have total centralized control over their digital assets. For e.g. SharePoint 2010 has IRM protectors that can be plugged-in for end-to-end protection of documents on the user's computers.Oracle UCM can be extended with Oracle IRM, etc.

Across all these IRM product architectures, it is necessary to have some form of client application installed on all users machines. Files that get downloaded from the DMS are special encrypted rights-managed files. The file format contains meta-data that defines the access that can be given to the user. The client application would decrypt the file, understand the access constraints and accordingly give rights to the user. On the windows platform, MS has long released the Windows Rights Management Services - a comprehensive API to address IRM challenges on the windows platform.

How does .NET TPL control the number of threads

I often wondered what heuristics the Task Parallel Library (TPL) in .NET uses to control the number of threads for optimal utilization on multi-core machines.

Found a great discussion thread on StackOverFlow explaining the details.

Techniques for Service Identification in SOA

Its very important to use proper service identification techniques to identify services in an portfolio. In fact, service identification should be the first step in your service lifecycle management process.

Jotting down some of the techniques that we have been using for identifying services:

1. Domain decomposition approach - Look at the high level business entities and create entity services for them.
2. Top down BPM driven approach - Start from the business processes and divide them into sub-processes. Each business process consists of tasks & activities, that would orchestrate between different service components.
3. Business Goal driven approach -  Derive services from business goals. Decompose the business goals into a set of services that would help satisfy the business goal. Provide tracability between business goals and IT services by a Goal/Business Service matix.
4. Existing systems -  Service wrappers are created on existing systems - to surface them for orchestration in a business process or a composite service. This technique may not be appropriate if the existing IT landscape is not aligned with business goals.
5. UI driven approach - Identify/discover services based on the user interface requirements. UI technologies such as Flash, Silverlight, Ext-JS directly call JSON/REST services on back-end application servers.

Ruminating on SEO

SEO (Search Engine Optimization) is an integral part of any Internet Marketing Campaign. SEO strives to increase the visibility of a website in search results. For SEO, we have to consider both on-page factors and off-page factors. Given below are some examples of what can be done on the site pages and what needs to be done outside the site pages.

On-Page factors examples:

• Meta tags
• Headings
• Links
• Keyword frequency (Internal Keyword linking strategy)
• Site Structure (Create and submit site maps)
• UI design that is "Search Engine Friendly" (Image Alt tags, Menus, etc.)
• Make tagging and bookmarking easy.
• Robots.txt
• URL Normalization (if different URLs lead to the same content)

Off-Page factors examples:

• PageRank analysis (Increase no. of inbound links)
• Utilize Social Networks, Forums to form a 'link partnership'. (Social Media Optimization - Social SEO)
• Create and submit articles, blogs, RSS feeds that link to the site.
• Create Sharable content - Mashup ready.

XSL transformations on the brower

Recently, I came across a web framework that was quite unconventional - the framework was performing XML transformations using XSLT on the browser. All web requests were directed to a legacy system that returned XML and this XML was directly sent to the brower. The browser had already loaded the necessary XSL, Javascript and does the XML -> HTML transformation.

There are certain pros and cons of this approach.
Advantages:

• Clear separation of markup/layout from content.
• Heavy XSL processing offloaded to the brower, brower JS code can check for brower compatibilities and spit out right markup code.

Disadvantages:

• All browsers do not support XSL in a standard way. Can be quite a pain to make the look-n-feel compatible with all browsers.
• Search engines/bots see raw XML, may not be able to interpret and understand.
• Disables progressive rendering. User won't see anything at all until entire stylesheet and data is loaded completely.
• XSL is pretty tough to master. Resource skill could become a potential bottleneck.
• Could run into scalability issues for large XML payloads. When processing XML files, XSLT must load the entire document into memory.

IMHO, although XSLT processing in-browser is fast compared to server side, it is still better if no transformation is required at all. There are tons of server side web-frameworks that can do the job better and faster.

Open source API for read/write to Excel files

Long back, I had blogged about native APIs in .NET and Java to read/write Excel files.
Recently came across a new native .NET library that can be used to read/write Excel files and supports the binary BIFF format. This is the format used by Excel 2005 files - i.e. xls files. This API is still evolving and looks quite basic at this point of time. 
The code is available here:  http://code.google.com/p/excellibrary/
There is also a .NET port of the popular Apache POI library available at: http://code.google.com/p/npoi/

The new office (2007, 2010) documents  are based on XML standards (i.e. xlsx files). There are a couple of open source projects for creating and modifying 2007 'xlsx' excel files.
1) http://epplus.codeplex.com/
2) http://excelpackage.codeplex.com/

Operational Reports vs MIS Reports

Once organizations create a data warehouse, a lot of people push all the reporting needs to the DW. But do all reports need to run from a DW?
The answer lies in understanding the difference between operational and informational (MIS) reports. A good article by Bill Inmon on this difference can be found here.

Operational reports are typically detail oriented and shows the latest up-to-date records. Operational reports are used by stakeholders for short term tactical decision making. MIS reports look at summary data over a longer time horizon and are used for strategic decision making.

Examples of operational reporting include bank teller end-of-day window balancing reports, daily account audits and adjustments, daily production records, flight-by-flight traveler logs and transaction logs.

Examples of informational reporting include monthly sales trends, annual revenue, regional sales by product line for the quarter, industry production figures for the year, number of employees by quarter and weekly shipping costs by carrier.

Activity Diagrams vs BPMN Diagrams

For modeling business processes, there are two standards popular today – UML 2.0 Activity Diagrams and BPMN.

There are semantic differences in notation between the two standards. For e.g. the way OR-splits, AND-splits/joins are shown.

A detailed whitepaper showcasing the differences between the two notations can be found here.
A discussion thread at http://www.bpm-research.com/forum/index.php?showtopic=501 makes an interesting read.

Business Function Models Vs Business Capability Models

The difference between these models boils down to the difference between a “business function” and a “business capability”.  Many organizations use them interchangeably. For e.g. A business capability model may illustrate current-state business functions and also future-state business functions that need to be built to deliver on the business vision.
But there are few folks who would like to draw a clear line of differentiation between the two.  Capability can be defined as the ability to perform actions to achieve specific strategic goals/objectives.

The following links provide interesting reading:
Link 1
Link 2

Hence a business capability is much more than a business function – it encompasses other objects such as Actors, Services, Functions, Processes and Infrastructure.  Examples of business capability are – the ability to service customers through online channels, capability to survive liquidity crisis, etc.

Business Architecture Models

While defining the enterprise architecture of an organization, it is essential to understand the various processes, functions and capabilities of the business. Recently came across the FEA Business Reference Model on Wikipedia. The simplicity of the diagram impressed me.

Every organization has different business areas or LOBs. Each business area has a set of business functions that it performs.  A ‘Business Function Model’ describes these functional areas and sub-functions in a graphical representation. An example of a BFM can be found here. 

Each LOB executes its business functions by following certain business processes.  A business process is an orchestration of different business activities and tasks that may be exposed as SOA services.

Various dimensions of Security

When we design our applications to be secure, we have to consider all aspects of security. I have often seen people associate security with just authentication and authorization, but there are other security principles to be considered as stated below.

1. Integrity: We have to ensure that all messages/data have not been tampered with. Integrity of messages ensures that the data has not been maliciously modified by 'man-in-the-middle'.
2. Confidentiality: This security principle ensures that all messages are encrypted and cannot be eavesdropped. 
3. Authentication/Authorization: Ensure that all resource access goes through a proper authentication process.
4. Non-Repudiation: This ensures that any party involved cannot refute the validity of a message exchange.

Modern toolkits and technologies such as digital certifications satisfy all of the above security principles.

Concurrent Business Engineering

Some time back, I had blogged about the advantages of having a unified BPM/SOA strategy at the enterprise level.  Ran through a Forrestor report that touch a similar concept and calls it as "Concurrent Business Engineering".

Concurrent Business Engineering entails greater colloboration between Business and IT for jointly working on defining new business processes and also defining the technology platform for supporting the processes.
Business services are best designed with a strong understanding of the business process context, hence a top down BPM process-centric view would help in understanding what services need to be surfaced to provide maximum agility to the business process.

This is similar to the idea of having a unified BPM/SOA strategy and utilizes the best of top-down and bottom-up methods for executing the business strategy - as blogged earlier. 

Types of Services in SOA

Found a nice article on MSDN describing the various types of services - a taxonomy for services.
Jotting down the concepts explained in the article.


Entity Services - Expose/Surface business entities in the system.e.g. employee, customer, sales order,etc. They contain CRUD operations and additional domain specific operations - e.g. FindOrderByPrice Entity Services abstract the underlying datasources and persistence mechanisms.

Capability Services - Implement a specific business capability - for e.g. Pricing Service, Credit Card Processing Service, etc.   They may use Entity Services for persistence.

Thus Entity Services are "data-centric" and Capability Services are "action-centric".

Process Services - Acts as a facade for a BPM process. Process services would maintain state due to the very nature of a workflow having to maintain state over a long running process.  Process Services are typically implemented using BPM tools such as WWF, Biztalk, WPS, etc.

Infrastructure Services (Utility Services) - Common cross cutting functions such as Logging, Auditing, Security, Authorization, etc.

Ruminating on SOA Governance

 SOA Governance has two dimensions. First – the processes and methodologies used. Second – the tools and products used for governance.

Quite often, people assume that the purchase of a SOA Governance tool would suffice for implementing SOA Governance. But the fact is that the tools would only help in automating certain enforcement policies and service lifecycle workflows. What is first needed is a framework of processes, policies and organization structure to be defined. Any governance process needs to embrace the trilogy of “people, process and technology”.

The following diagram illustrates this point and states the various activities that need to be done for implementing SOA Governance.

The Open Group has also published a SOA Governance Framework that can be accessed here.

SOA Registry, Repository and Service Catalog

While implementing enterprise SOA, it is important to consider deploying a service catalog for services. There is a lot of confusion between the concepts of registry, repository and service catalog.

Traditionally a registry has been a lookup service provided to service consumers. Service providers register their services in the registry and service consumers select an appropriate service for their needs. Standards such as UDDI addressed these needs.The Registry would contain service descriptions, service contracts and service policies that describe a service. Service registries have also been practically used for determining a service end-point address at runtime based on the service unique name.

So what is a repository? As the importance of SOA Governance grew, it became necessary to capture more meta-data about a service. A service repository integrates information about a service from multiple sources and stores it in a centralized database. Service information may include design artifacts, deployment topologies, service code repository, service monitoring stats, etc. Vendors have started positioning their generic asset management products as SOA repositories. For e.g. Rational Asset Manager.

A lot of vendors now sell a combined product that consists of the registry and repository. For e.g. IBM Websphere Registry and Repository.

A service catalog is a concept that can be implemented using SOA registry/repository products.

Entities Vs Value Objects

In Domain Driven Design, we often separate Entities and Value Objects. Junior architects always get confused between these 2 concepts.
The essential difference is that domain entities have an identity and a lifecycle. So each Entity has a unique identity and with a given domain, no two entities can have the same identity. Value objects need not have an identity. So if we have an "equals()" method that compares the parameter values of each value object, then we can have value objects that are identical. Value objects should ideally also be immutable.
The following links offer interesting stuff on this concept.
1) Lostechies
2) StackOverflow
3) Devlicious

TCO of applications during Portfolio Rationalization

In my previous blog post , I had narrated the process of portfolio rationalization. During the fact finding process, we need to calculate the TCO of  an application. It’s a good idea to have a predefined template for entering all the parameters that add to the total cost of the application, i.e. hardware costs, software license costs, maintenance costs, data center costs, etc.

We should also try to collect the TCO statistics over a time period; i.e. over the last 3-5 years. This data when plotted on a graph would help us in identifying patterns and spotting trends. For e.g. if the TCO of an application is showing steep increase with every passing year, then we need to be wary of the “cost of inactivity”. Cost of inactivity means what will happen if no action is taken?

The TCO of applications should also be compared against the business value that the applications are providing. It may be that 70% of the TCO could be consumed by applications having 30% business value.
Another important dimension to capture would be the usage statistics and performance SLAs over the last few years. If the number of uses are increasing and the SLAs are not been met, then it’s time for some proactive action.

SOA and BPM

Yesterday, we were having a discussion with one of our customers on the hot topic of SOA and BPM strategy, i.e. can SOA/BPM initiatives be combined?, what are the challenges, pitfalls, best practices, etc. Jotting down some of the key points of the brainstorming session.

• To start with, its important to realize that both BPM/SOA has a common goal - greater business agility and to align IT with business. SOA and BPM complement each other and the potential benefits are compounded when you have a unified enterprise wide strategy for them.
• BPM drives a process-centric thought process - right from design, implementation, monitoring and continuous optimization. BPM forces a paradigm shift from an application centric view to a process centric view. SOA is an architectural style where as BPM is a management discipline.
• A combined BPM/SOA initiative will do the delicate balancing act between incremental and transformational change. Also a combined initiative should enable stakeholders to decide what important processes need that extra agility and prioritize them to be re-engineered as services because funding is always limited.
• Top-down BPM appraoch drives the discovery of services since they provide important insights into understanding what parts of the IT portfolio can be exposed as SOA services. Thus BMP can provide a structured approach for identifying reusable business services.
• SOA services also enable faster integration in BPM as the need for custom integration touch points reduces and this in turn enables faster deployment of BPM. SOA also enables rapid change of business processes which is not possible if the business process in embedded in a lot of traditiona non-SOA applications. For e.g. when a process needs to change to comply with a new regulation or due to a change in business strategy, then a loosely coupled BPM process orchestrated using SOA services is easier to change. New services can be plugged-in or existing services can be rearranged. 

In today's fast changing business dynamics - "as is" and "to be" are simply temporal states of reality. The future state cannot be predicted, we can only stay prepared by keeping our business processes agile.

SONAR tool

My team has been evaluating the SONAR tool to manage code quality. I was impressed with the features and the user friendliness of the tool. SONAR can be used for both Java and .NET projects. It has a open plug-in architecture that allows any code quality tool to be plugged in.

For example, for static code analysis it combines the power of popular tools such as PMD, checkStyle and FindBugs into an unified user interface that is great to use :)

SONAR also has support for free code coverage tools such as JaCoCo.  Code coverage can be measured by unit tests or integration tests. You can even drill down to source code level - something I love to do :)

SONAR also integrates with new tools such as SQALE that have a formal approach for defining code quality in terms of maintainability, Testability, Reliability, Changeability, Efficiency, Security, Portability, Reusability, etc. Overall it is an invaluable tool to access Technical Debt.

Activation bar in UML Sequence Diagrams

A lot of folks get confused between the "life-line" concept and "activation bar" concept in Sequence Diagrams.

The vertical lines drawn are called the lifeline of the object. When the object is no longer alive, then we can draw an 'X' at the bottom of the line. So why do we need an activation bar? I have seen a lot of architects choosing not to draw the activation bar to keep the diagrams simple.

The activation bar (a.k.a focus of control) represents the time the object is "active", i.e. doing some processing, computing something, waiting for a response from a sub-routine, etc. So it is possible to model multiple interactions in a single diagram - for e.g. a lifeline can have nultiple activation bars.

Good whitepaper on WSRP Portlets

A friend of mine was confused on the concept of remote portlets and the WSRP protocol. I forwarded him this cool whitepaper that explains the concept of remote portlets in a simple and lucid language.

Some snippets from the whitepaper:

Remote portlets enable dynamic integration of business applications and information sources into portals.
This approach only works if all portlets are physically installed at the employee portal; the process of making new portlets available is tedious and expensive.
 
Instead of just providing raw data or single business functions that still require special rendering on the portal side, Web Services for Remote Portlets (WSRP) are presentation-oriented, interactive web services.
They are easy to aggregate and can be invoked through a common interface using generic portlet-independent code that is built into the portal. In addition, re-implementation of the presentation layer on each portal is avoided. The use of generic portlet proxies consuming all WSRP services conforming to the common interface eliminates the need to develop service-specific portlets to run on the portal.

The big difference between WSRP services and data-oriented web services is that they are presentation-oriented, interactive services that all have one common interface. This means that they simple plug into portal servers and do not require any service-specific code on the consuming portal.

Another point to consider is the comparison of remote portlets with mashups? Are they the same? Remote portlets and WSRP standards can be used to create mashups, but portlets also bring in the advantage of personalization and customization. Mashup's also need not just refer to aggregation of content. Wikipedia describes mashup as "A mashup is a website or Web 2.0 application that uses content from more than one source to create a completely new service. This is akin to transclusion." For e.g. tons of new applications built on top of Google Maps.

The case for IT Portfolio Rationalization

Un-rationalized IT portfolio is a critical issue facing many organizations. There are a plethora of reasons why an IT portfolio becomes ‘bloated’ with an ever increasing inventory of applications running of multiple platforms. It could be because of mergers and acquisitions, lack of enterprise architecture standards and IT governance, legacy applications that need to undergo a technology refresh cycle, etc. As a result of this, a majority of the IT budget is spent on “keeping the lights on”, rather than investing on new strategic initiatives. This in turn results in poor business-IT alignment.

Continuous Portfolio Assessment and periodic Rationalization of IT assets is needed to lower the TCO of the IT portfolio and enable business agility. Portfolio assessment and optimization should be an integral part of the organizations EA group.

Any portfolio rationalization exercise would start with an assessment of the current state. Here pre-defined templates to capture the high level IT landscape would be beneficial. More comprehensive templates would be required to capture the details of each application. Information parameters such as application infrastructure, business process supported, TCO, pain areas, etc. would be captured.

The second step would be group applications into clusters. A ‘cluster’ is nothing but a group of applications that are similar in semantics - from a business perspective or a technology architecture perspective. For e.g. applications collaborating or orchestrated to fulfill a business process, a cluster of web applications running of the same technology stack - Websphere App Server on Solaris.

Each application cluster is then evaluated across various dimensions – such as Business value, Business functionality adherence, Current or Future Technology standards adherence, EA standards conformance, SLA conformance, TCO, etc. Based on the rating and the weightage given to each parameter, we would arrive at final scores. Based on the scoring, application clusters would be segmented into 4 categories – retain, enhance, replace, retire/sunset.

The final step is to define roadmaps for the transformation – a set of project streams/initiatives that would be required. A project prioritization framework would help in sequencing the selected initiatives. Pre-defined templates for project prioritization would come in handy here. Here again a metrics driven approach would work; wherein we evaluate the priority of the selected work streams based on parameters such as business impact, risk, technology skills, cost/investment required.

It is also very important to define a governance body to manage the rationalization program and sustain it. The governance body would have participation from both business and IT stakeholders.

The end deliverables of the rationalization exercise would be:
1. Matrix of applications segmented into 4 categories – retain, enhance, replace, retire/sunset
2. Define project streams (rationalization roadmaps) and project sequencing (prioritization) to meet the future state E A vision
3. Define opportunities/initiatives for business process optimization and reduction of TCO

Estimates and Scheduling

Read an interesting article by Joel on software scheduling. Most organizations either use the use-case point estimation method or the function point estimation method.

But the best estimates come from experienced designers and developers - because you have done something similar in the past, you are more confident of the estimates you give.
But how can you bring in these past experiences of people into your estimation process. We would need to collect data on all past and present projects and extract metrics from them.

In the article, Joel talks about "evidence-based scheduling (EBS)" - i.e. base your future estimates on past experiences and developer productivity. It might be difficult to record the productivity of each and every developer, but we can create clusters for a developer group based on yrs of experience.

The most interesting point regarding EBS was that you do not have a single delivery date - you only have probabilities assigned to a range of dates. I always struggled selling this concept to program managers and customers. The point is that its impossible to predict the exact date of shipment at the start of the project. Based on fine granular tasks and past estimation data, we can use algorithms such as "Monte Carlo Simulation" to arrive at a range of dates each with a probability index assigned to it - similar to the image below.

Use of Generics in .NET webservices

Recently, one of my team members was trying out an idea of using a generic container "response" object for all return types from the webservice. The advantage of doing so was that we would just have one generic "Response" object instead of many response objects for different operations - hence it would be easier for clients to extract data and consistently get other meta-data information in the Reponse object such as "Success/Error messsage", "Count", etc.
Given below is sample code showing the generic response data contract.
-------------------------------------------

[DataContract]
public class Response
{
[DataMember]
public T Data { get; set; }
[DataMember]
public List DataCollection { get; set; }
[DataMember]
public string ErrorMessage { get; set; }
}

[DataContract]
public class Customer
{
[DataMember]
public string Name { get; set; }
[DataMember]
public int Age { get; set; }
[DataMember]
public decimal ContactNo { get; set; }
}

[DataContract]
public class Vendor
{
[DataMember]
public string VendorName { get; set; }
[DataMember]
public int Rating { get; set; }
}

-------------------------------------------
As you can see, the actual return object (e.g. vendor, customer) is wrapped in a generic response object. Given below is code snippet of the webservice/WCF service.
-------------------------------------------
public class GenericService : IGenericService
{
public Response DoOtherWork()
{
Response res = new Response();
Vendor c = new Vendor();
c.VendorName = "Rocky"; c.Rating = 3;
res.Data = c;
res.ErrorMessage = "Big Errors";
return res;
}

public Response DoWork(int i)
{
Response res = new Response();
List lstcust = new List();
Customer c = new Customer();
c.Name = "Rocky"; c.Age = 26; c.ContactNo = 7688890909;
int j = 0;
Customer c1 = new Customer();
c1.Name = "dfgdfgRocky"; c1.Age = 26; c1.ContactNo = 7688890909;

lstcust.Add(c); lstcust.Add(c1);
res.DataCollection = lstcust;
res.ErrorMessage = "No Errors";
return res;
}
}
-------------------------------------------
It was interesting to see how the .NET framework handled this in the WSDL. What complex types are created in the WSDL? This was important because the WCF services could potentially be used by Java and Ruby clients.
Here we found a hitch - the WSDL schema had 2 complex types such as "ResponseOfCustomer24335423" and "ResponseOfVendor24r58sdf". This WSDL worked fine when we created stubs in Java by importing the WSDL. But only the random numbers appended at the end of the complex schema was a problem from naming standards and clarity point of view. You would not want your callers to keep wondering why such strange names were given.
But here again, we found an easy workaround. While defining the data-contract, we have the option of specifying the name of the complex type it should appear as in WSDL.
So we just added one key value pair to the Data Contract attribute as follows.
-------------------------------------------
[DataContract(Name = "ResponseOf{0}")]
public class Response
{
[DataMember]
public T Data { get; set; }
[DataMember]
public List DataCollection { get; set; }
[DataMember]
public string ErrorMessage { get; set; }
}
-------------------------------------------
This was cool as could have a placeholder "{0}" for the type passed to the generic container class.
Once we did this, the complex types in the WSDL has user friendly names such as "ResponseOfCustomer" and "ResponseOfVendor".