Agile Planning: My Top Five Tips on Decomposing User Stories Into Tasks

DecomposeDecomposing a User Story involves taking the result your user is looking for (stated as a User Story) and breaking it down into a number of tasks that the team can work on individually.  Here are five tips I have found to be very useful:

1) Decompose User Stories into tasks as a team

Group planning is a cornerstone of Agile development.  Though it may feel inefficient at times, the benefits are well worth it.  See my previous post: Agile Planning: Plan/Estimate As A Group, Really? for more information/details.

2) Attempt to size your tasks to take one team member between 1/2 day to 3-4 days to complete

Motto here equals: Allow a “Race to Done” situation

Creating tasks that are smaller than a handful of hours end up taking to much time administratively to create/track/update/etc.  Tasks that are larger than 3/4 days (some would say that is too big, but teams I have been on have found it to be workable) really should be broken into a couple of tasks if possible.  They just take too much time to be able to race to done effectively. 

3) Create tasks that result in a deliverable unit of work when completed

When decomposing a user story, be sure to break the story down into tasks that can be completed in a small amount of time (Point 2) but don’t focus on the time so much as ensuring you are creating tasks that result in a deliverable unit of work.

Don’t break down a ‘Maintain User’ feature into (like you might have in the past):

  • Build the UI
  • Build the biz logic
  • Build the data tier

Instead create vertical slices of functionality when possible:

  • Implement Add User
  • Implement Edit User
  • Implement Delete User
  • Implement Add/Edit/Delete User Automated UI tests
    When a team member takes on the ‘Implement Add User’ task, it’s a contained unit of work, straight forward to know when completed, and also not dependent on other tasks being completed to be able to be tested (like Build UI/Data tier/Biz logic all are dependent on each other to deliver functionality to the user).

4) Don’t get caught deep diving into the details of each task

ddThis is more difficult in practice than in theory.  Knowing that task estimation is just around the corner for the team, it’s natural for a experience developer to what to define all details possible, down to ‘how many stored procedures are we going to be creating’.  This, in theory at least, helps ensure the estimation process will be more precise.  I don’t buy into this theory, at least not from a time invested by the team to get this extra level of preciseness. Certainly attempt to ask the functional questions when decomposing a User Story, so hidden functional ‘gotcha’s are uncovered, but also realize the team is just defining/sizing effort at this point, not writing up a ‘development specification’.

5) Ensure testing/automation tasks are included

On the teams I have worked with over the past years, we have always had a group of professional Quality Assurance Analysts.  Our Scrum teams are no different so these types of tasks don’t usually get forgotten, but for the many teams that don’t have QA pros integrated into their Agile teams, I can imagine this to be something missed.  A motto of ‘get the functionality to the user as quick as possible’ would seem to lead to that.  Just because the team is Agile, doesn’t mean there isn’t any testing that should go on!  Automating tasks where appropriate is also very important, given the high amount of regression testing that is needed when sprinting via 2-4 week timeframes.

Next up in this series, group estimate via Planning Poker.

Agile Planning: ‘Ideal Day’ – User Story Estimation

USI don’t like Story Point estimating.  There I said it.  I know many have had success with Story Point estimating, and the Scrum guru Mike Cohn advocates it in his books/etc.  I have just found it to be too abstract, and difficult for developers (and myself) to grasp when starting out using Agile techniques.

In my experience, when developers/engineers/etc. are asked to estimate in hours (which is very much the norm in software), they rulersaren’t really thinking in hours.  Truth be told, I don’t think many actually think in hour blocks when estimating, but instead think in terms of ‘days of work’ or partial days of work.  Here’s an example of what a developer is thinking when giving an estimate:  “Hmm.. I think this task should take me about a day, maybe day and half to complete, so lets make it 8*1.5 = 12 hours”  Tell me you don’t do that?  There wasn’t any self talk on thinking part one of the task would take 2 hours, part two, 6 hours, etc. but rather they would ‘chunk’ their time into days.

So in comes Story point estimating.  We don’t want to be estimating User Stories from a calendar time perspective, but instead relatively against each other.  This allows for quick estimates that give size, but not ‘commitment’ to time which is what most developers feel an estimate is. Hour estimates come during User Story decomposition, part of Sprint planning.  Unfortunately, how do you define one Story Point?  What is your logical point of reference?

This is where the ‘Ideal Day’ metric works better for me.  This metric was shared with me by Pete Carroll and is really an abstraction of the number of hours you would normally expect a developer to be productive during a typical day, subtracting time for meetings, bathroom breaks, etc. This will vary from organization to organization, but has a large benefit over Story Point Estimation IMHO.  Mainly it is the default metric the developers are already thinking in as I eluded to above.  There isn’t any translation in their head, no trying to define an ambiguous metric.  Instead it’s more gut feel that is natural to all developers with some experience while still allowing for the relative estimating of User Stories to take place. All Ideal Day estimates should be in round numbers, (ie 1,2,3. not 1.5, 2.34, etc).

Trick here is to realize the Ideal Day metric is still an abstraction of time estimates.  We don’t plan off the Ideal Day on a timeline, but instead use team velocity matched with Ideal Days to equate to time-lining User Stories from a high level.  The Velocity metric will help even out the group estimation variance just like with Story points, but it feels so much more natural to the team.

Next up in this series, decomposing user story tips.

Agile Planning: Plan/Estimate As A Group, Really?

Office lifeSo you decided to go ‘Agile’ with your team?  Maybe you have read a book or two on Scrum, XP, or something similar.  Many of the base ideals of Agile development make intuitive sense, but this idea of “Group Planning/Estimating”…  Really?  Surely that isn’t going to work with ‘my’ team.

I know this is where I was several months ago.  The team I work with has been using a number of Agile concepts for years to get projects done, and doing it quite successfully I might add.  I was reading up on Scrum, and intrigued by its simplicity yet didn’t really get the idea of how important group collaboration is to its success right away.  I had originally balked at the idea of having Daily Standups (after having them for months now, I realize how wrong I was on this), so the idea of having the whole team get into a room for several hours to “plan” (which includes some estimating) every two weeks (our chosen sprint length) just sounded so inefficient.  I mean… isn’t planning/estimating the PM’s job?  Including all those people and taking them away from “development time” to plan?

Well, I am here to say that a transition to group planning can be difficult, but once you work through the growing pains, it’s well worth the effort.  Don’t short-change yourself by going 1/2 way either.  If you are planning for a 2 weeks sprint, and it’s only taking 1/2 hour to complete, you probably aren’t planning as a group, but more just planning individually and meeting for a short time to pick tasks individually for the sprint.  Most people I have spoken with or read online say it should take around 2 hours per week in the sprint to complete the planning processes.  (4 hours for a two week sprint)  This is dependent on the size of the team, complexity of the project, etc… but it’s a good rule of thumb, and one that I have found to be about right given the number of sprints I have been involved with.

There certainly is work that needs to be done prior to the planning meeting, especially by the ScrumMaster and Product Owner, to groom the project backlog as well as ensure the User Stories are in a state ready to be handed to the team.  But the process of taking a feature and decomposing it into development tasks (unless most of the features you are building are trivial in nature), should be done by the team as who knows better than the ones who will be doing the work?  Picking the tasks as a team, golden.  Estimating the work as a team, what better way to ensure all team members have at least a semi-good understanding of the work being committed to? Having a say in this process also breeds ownership by the team and it’s members.  They have some ‘skin in the game’ from the planning stages, and that helps set them up for success to meet the goals of the sprint which is great for all involved.

I highly recommend reading Agile Estimating and Planning by Mike Cohn as his book will help you work through the transition to group planning very well.

My next post will cover the ‘Ideal Day’ metric, and how I have found it helps the team size User Stories (features).

My Top 5 Mobile Connections 2011 Take-A-Ways

As I wait in the airport for my flight to board, I figured I would put together a quick Mobile Connections 2011 ’Top 5 take-a-ways’ post from my perspective. Lots more detail in my previous posts for each session, this is just my ‘mind dump’ without looking back at my individual session notes.

My original “big goals” coming into the conference were to get a feel from the experts on where cross platform mobile development is headed, if there are any tools to build for the four major platforms with one code base and if so… what tools are leading the charge now, and expected to lead in that space going forward.

#1 Take Away: Cross platform development via one code base (including HTML5) is tough at best, crazy to try at worst.   A number of the experts flat out said, if you want a average at best application, go ahead and try to use a cross platform tool.  Average meaning it won’t specifically feel like other apps on each platform… compromises have to be taken because of the lack of support for some features on each platform, as well as the different UI styles.  If you want a decent application, the UI needs to be built with native code.  Plain and simple.  Furthermore, this isn’t changing anytime soon so just get used to it.

#2 Take away: The “cloud” term has different definitions to different people (no surprise there), but the idea of the ‘private cloud’ vs ‘public cloud’ really hit home for me.  Our ability to leverage the cloud technologies without actually having to put our data/etc on some ‘public’ server is attractive… especially for a transition in the short term, as the technologies around public cloud based security/etc mature.  The ability to do hybrid Cloud offerings, having your web servers hosted by a public cloud provider but the data being hosted on company owned cloud technologies sounds great for SaaS providers that have sensitive data they need to protect the best they can, while still trying to allow for max scalability.  Cloud and Mobile really go hand and hand now, if you expect to support a significant number of mobile users anyway.

#3 Take Away: NoSQL solutions are super fast, and scale 1000’s of times better than Disk Based SQL solutions.  If you are going to be supporting numbers of mobile clients in the tens of thousands or more, you need to be utilizing this type of technology.  Redis seems to be mentioned in every conversation regarding this platform type.  (NoSQL at is most basic is a fully in memory key-value data store). Excellent tips were shared in my notes writeup of the Architecting Back End Systems for Mobile session.

#4 Take Away: SaaS companies (and others using web technologies) need to look at the product offerings that BiTKOO has. Their Keystone app is an amazing abstraction of Authentication/Authorization and from a coding perspective, is really Plug and Play.  Also, their SecureWithin application gateway brings about many possibilities regarding accessing corporately stored data on the web securely. More info can be found in my notes writeup regarding the session BiTKOO CEO gave.

#5 Take Away: The speakers at these conventions are top notch from a know how perspective.  The value they provide to the attendee’s in question answering after the sessions alone, is worth the cost/time invested to attend.

I do feel it’s important to throw in this ‘bonus’ takeaway… I will call it 1a as it’s a continuation of the first takeaway:

#1a Take Away: I did attend a workshop yesterday related to the RhoMobile toolset for cross platform development. Though I wasn’t crazy about how the session was conducted, the products they have do look very promising. Using web developer skills (Ruby), the tool supports all the major Mobile OS’s (WP7 and WinCE support too, in about a month) and generates Native code for each platform. It has a number of excellent features of which the one I liked most was it’s support for specific style sheets per OS. So you build your UI using web programming skills and the product styles the UI to look like the ‘normal’ app presentation for the OS. It comes with stock style sheets for each OS and it really does work well. Has support for camera, BlueTooth, etc, as well as a mapping control that makes the use of the OS’s preferred mapping API very nicely. The toolset also has a local data storage tier that takes advantage of SQLLite. If the platform you deploy to doesn’t have SQLLite embedded into it, the tool will deploy a binary representation of it so you can plan on a single local data source across all platforms. This tool has great promise from what I can tell.

My Notes: 3 Screens and the Cloud: How NUI Technologies Play Nice Together

Speaker: Tim Huckaby  Chairman of InterKnowlogy.com 

Uses Awesomium control to embed web content into WPF application for kiosks/etc.

Natural User Interface (NUI) =  touching the screen (or manipulating the screen without touching it)

Tenants

  • The content should define the experience
  •  The “Grandma Huckaby Test”: the ability to effectively use the kiosk without training
  • No one should have to touch the machine to update content (remote deployment while running)
  • Updating content should happen centrally and should have automated delivery
  • Cant go to deep screens wise (maybe 2/3 levels deep at most)

If something is moving (even simple animation) a humans attention is caught.  You are going to look at it.)

Touch Capable Hardware Implementations:

  • Capacitive – Think electric impulse (iPhone and others)
  • Infrared – Expensive ones.  Think laser pointer(s) (best fidelity of touch… costs 10’s of thousands of $$)
  • Resistive – Think push down and drag  (old,  No ‘cool’ devices use this anymore) 

Tip: 98% of time 2 people is all a device like this needs to support, though people think it will need to support more.  The use cases just don’t support the need to support more.

Given a typical user experience < 5 min on a kiosk type device, you need to keep the navigation shallow and intuitive.

.NET 4 has decent support for touch.  Before .NET 4 was very minimal support.

.NET 4 turned touch into a first class citizen for developers.

WPF does support true distributed computing.  (with .NET 4 version)

Convinced we gotta do mobile apps native.  The user experience in particular requires it.

Azure is easy for .NET Dev’s”

Important aspects of storage:

  • Space consumption & Transactional cost
  • Some storage is designed for unlimited storage but you pay per transaction
  • Other storage mechanisms are designed for limited storage but unlimited transactions

Biggest problem with Azure now is: No way to really know how much this thing is going to cost. 

Kinect can authenticate (differentiate between faces… and when voice is there, voices too)

Hooking Kinect into the windows OS sure looks to be a step to having a ‘Minority Report’ type User Interface for computers. 

This session was an excellent way to end the conference for me.  Tim is an excellent speaker and showed some really interesting technologies.  Peaked my interest regarding looking into some possible UI design changes we might be able to make.

My Notes: Building Location Aware Android Apps

Speaker: Wei-Meng Lee

Wei’s talk was very good, but unfortunately for me, it covered many points that I had already been introduced to in the two other Location based sessions I had attended within the past two days. 

Here are the main takeaways I got from the session that were not already covered in the other sessions:

TIP: (most common problems) Requires INTERNET permission in the android Manifest.XML file to get mapping control to work correctly.

Troubleshooting tip: if you don’t have internet access working in the emulator, or the Map API Key is not entered in your code, you won’t be able to see the map.. (95 % of the issues people have are these two)

Confirmed Native support for GeoCoding and reverse GeoCoding by Google Maps too.

Don’t use both location Manager = “GPS” and “Network” at same time… write the code to turn one off back and forth… otherwise your coords will change often.

My Notes: The New Age of Cloud Computing Eliminating the Need to Write Security Code

Speaker: Doron Grinstein (BiTKOO)   (Involved with development of FastPass at Disney)

Cloud computing is not a server with a longer extension cord (co-location of our hardware).

Cloud computing definition (in his mind): Ability of 3rd party to store, process, search, compute, without being able to look at my data even with a court order.  Algorithms  should support this mechanism instead of just ‘trust’

Think: “Google for private data” Don’t have to know the background technologies.. Just ask for data and you get it back. This is what cloud computing is to him.

Real world example: why is there e-commerce?  What enables e-commerce regarding the entry of credit card info?  When you purchase online, you trust the protocol (SSL), don’t have to trust the intermediaries.

XACML helps enable such a situation for application access control.

Keystone is their application access control engine. it “provides fine-grained authorization using the XACML standard”.

Point: Security ‘goop’ of an app on average should take about 30% of the software development effort.  That’s a lot and it gets done over an over again as new software application get developed.  Why role this type of code into every new app, instead use the Keystone product to do it for you.  Just have to setup a metadata db for your elements and security roles/etc, then hook up a authentication adapter based on your existing authentication process, and the tool will take care of the access control.

My comment right from notes while watching demo: Wow this tool is amazing.  In essence allows for a person to setup a data dictionary via the cloud on application security. 

By externalizing authentication and authorization, you are no longer reinventing the world.  Just using this as a tool for authentication/authorization.

Tool enables federation without writing code.

Also showed tool: SecureWithin.  “As secure as your weakest link”

“Traversing the firewall is a job for a 12 year old.  Going to bypass the concrete wall, instead I will go through the window.”  (Windows = endpoints… weakest link most of the time)

Endpoints need to be protected (properly from within)… if your trusting the infrastructure to protect them… your in trouble.. It’s not a matter of if, but when.

All functions available in the GUI are available via WCF Calls too.

Wow.  This companies offerings are ground breaking.  Challenge the norm thinking.  Amazing.

Allow for 6 diff ways to get

1) Installable

2) Hardware appliance

3) VM Appliance (VMWare or Hyper-V)

4) Cloud (EC2, Azure)

5) Hybrid (1-3) + 4

6) Source

Most of the membership enforcement/etc is done via the ISAPI Filter type setup. 

Products used by Disney, Time Warner, Department of Defense, many other large companies/organizations.

Overall, this one hour session challenged many concepts I thought I understood prior to this session.  Authorization/Authentication via a product like Keystone is amazing, and can become a task for the more junior developer (to setup the metadata in the db in essence) as opposed to some of the most experience/important developers on your team, allowing them to focus on other important tasks.

BiTKOO looks to me to be a company to watch, and one I am wanting to talk to others I work with to start the buy-in process so we can possibly look into using such tools in the near future.

My Notes: Securing Innovation | Cloud Connections Keynote

Speaker: Nils Puhlmann, Chief Security officer, Zynga Inc.  Co-founder Cloud Security Alliance

Zynga (maker of FarmVille, CityVille, Mofia Wars, etc) adds as many as 1000 servers a week to keep up with growth.

“We have to accept what we all know to be elemental – that taking a defensive position can, at best, only limit losses.  And we need gains. ” Peter Drucker.

Point of quote is to say we need to shape security as an enabler rather than just thinking about it as a way to be on the defensive.

Top mobile activities in US:

  • – Sent text msgs 68%
  • – Took photo 52.4%
  • – Accessed news and info 39.5%
  • – Used browser 36.4%

Point:Spectrum of usage is going wider

47 apps downloaded per user for iPhone/ITouch.  22 for Android per user.

Internet has changed from Internet of content/search, to a Internet of people interaction.

 

Social networking has surpassed email use now. People used to have Internet access to get to their email account(s), now it’s to get to Facebook or other social networking sites.

Most Security challenges of Social networks are not technical.

Non-technical info:

  •  Obvious productivity impact
  •  Information disclosure
  •  The graying of personal and professional lives
  •  Corporate disclosure
  •  Social engineering made easy
  •  Sharing of passwords/predictable user names

Technical:

  •  Social networking malware
  •  most AV Challenged the web-base malware
  •  Bots
  •  Bandwidth concerns

“AV is dead anyway”… Web Based malware eliminates the effectiveness of the desktop Anti-Virus products.

Top risks of Social Network’s

  •  Unproven identity of profiles and info
  •  Malware targeting social network sites and users
  •  Inadvertent disclosure of private or sensitive info
  •  Social engineering made easy
  •  Complete loss of privacy
  •  Identity theft
  •  Frameworks for app dev and delivery can lead to malware distribution

Maltego.com… shows you info correlation/connection.  Check this out on your name

Touchgraph.com – Google tool that shows social relationships.

 

Key cloud security problems of today (from CSA Top threats research):

  • Trust: lack of provider transparency, impacts governance, risk management, compliance
  • Data: Leakage, Loss of storage in unfriendly geography
  • Insecure Cloud software
  • Malicious use of Cloud services
  • Account/Service Hijacking
  • Malicious insiders
  • Cloud-specific attacks

Only way to drive risk down to a appropriate level is by managing vulnerabilities. 

Now more than ever, it’s important to have experts look at your data/apps/etc regularly.

it’s also important to have separation of duties.  Don’t want one person or the use of that person’s credentials to have too much access to allow for a lack of check pointing before changes to systems/etc get implemented. 

Security as a Service Initiative:

  • Info assurance challenged by disruptive trends (cloud, mobile, social networking, etc)
  • Cloud proves opportunity to rethink security (economics, arch, service delivery models, etc)

 

My Notes: The Cloud as a Platform

Speaker: Jinesh Varia   Amazon Web Services (AWS) Technology Evangelist

Lines are blurring between SaaS, PaaS, IaaS

Lots of new innovative business models.  Pay as you go, One time upfront + pay as you go, Requested bid price and pay as you go, Standard and Reserved.   These work best respectively in the following environments: Spiky workloads, steady state workloads, time insensitive workloads, for regulatory and compliant workloads.

Take-Away #1: Flexibility is the key for cloud options

– Can use any Programming Model, language, or OS/DB
– Can use any service individually or in any combo
– Can use as much (or as little) and only pay for what was consumed.
– Can use any existing System Management tools and extend the data center to the cloud

The cloud as a platform: Platform that provides Foundation to build innovation solutions on top, abstraction to hide underlying layers (hardware and software), is self service.

1 job, 1 machine, 500 hours = $1500 rack and stack on premises
1 job, 500 machines,  hour = $290

Netflix is almost 100% on AWS

Take Away #2: Elasticity is the fundamental property of the cloud

“Turn off, and not pay for it, when you don’t need it.”  That’s the beauty of the elasticity of the cloud.

“Build a Web application that sleeps at night or shrinks itself when there are no users accessing it”… Follow the sun and leverage the true power of on-demand elasticity and globally dispersed regions.  (follows the sun means high usage during the day, much less at night)

The day is not too far away where this is viable for most: Scalability, Security, high availability, Fault-tolerance, Testability and elasticity will be configurable properties of the app arch and will be an automated and intrinsic part of the platform on which they are built.

Cloud is a platform for computation, Research and Development.  Time to provision a server is a few minutes with cloud.

Don’t have to hug your servers anymore.. You can get complete control of the environment.

Cloud is a platform for:

  • Computation
  • R&D
  • New Gen apps
  • Internal Corp IT
  • Storage
  • Integration
  • Platforms
  • To realize your own ideas

Take Away #3: Redefining cloud security

In the cloud, security is a shared responsibility.

App needs to encrypt data in transit and at rest, protect your AWS Credentials, rotate your keys, security your application.

The cloud is more than its services.. Its an enabler

Future = “Internet as the Operating system of Services”

My Notes:Android Dev for .NET/C# Developers with Mono for Android

Session Speaker: Wally McClure (on intro slide said: aka: “.NET Judas”)

Where we are at now:

  • Laptops are not quite convenient
  • Power management is important
  • Wifi is not everywhere
  • Multiple smart phone platforms
  • iPhone has tremendous mind share/market share
  • Android has seen tremendous growth
  • RIM is dominant in the corporate market still
  • WP7 has shipped
  • .NET Framework is popular

Mobile Dev issues:

  • Battery
  • Screen size
  • CPU
  • Memory
  • Dev tools
  • Using existing knowledge

Mono =  open source implementation of .NET

Mono for Android is a .NET/C# layer over native APIs which can use Visual Studio – IDE

Big issue currently: No design surface.  Use Droid Draw for graphical design surface

My take is Mono for Android is great for existing .NET devs to code up Android apps.  If you want your app to be really nice though, you are probably going to need to implement the UI natively, and could use Mono for Android as a tool to generate a component to call into for your main biz logic that might already be built in .NET.