Through the fog... Software configuration management

Software does exist to make projects run harmoniously, with little excuse for disarray in teams of developers. Quocirca analyst Bob Tarzey outlines some options…

One of the least glamorous sectors of the software industry is software configuration management – yet it's essential. This type of SCM entails tools that are essential for co-ordinating development teams as they transform ideas and requirements into functional software programs. What is SCM, why is it important and how much do you need? The most basic requirement - and common to all tools - is the provision of a library for storing code. The library allows teams of developers to work on different parts of the same program, helping them to share code, avoid duplication, maintain multiple versions and repeatedly build complex applications. Audit trails are automatically kept providing an overview of activity. Storing software in a structured library allows for regular and secure back-up of software assets.

These libraries not only allow co-operation between multiple developers but also between multiple teams of developers, often globally distributed. With the increased outsourcing of software development to cheap labour markets this is becoming increasingly important.

There are three ways of supporting distributed teams. At one extreme is a single centralised library, locally managed and accessed by remote developers over the network. Low speed connections are not that limiting, as developers usually download code to work for hours at a time.

The other extreme is to have multiple replicated repositories close to the development teams, with all the management overheads implied by this.

The third way, between these two extremes, is a centralised repository of metadata, accessed over the network by remote developers but with code cached near those that most often modify it.

The software development process is notorious for not producing what was originally envisaged – or, unhelpfully, end users modify their requirements during the project. In addition to a library, therefore, there is the need for a change control system. Most SCM vendors also include this capability in their tool set. Change requests and bug reports are fed back into the development cycle leading to new versions of the software in the library and the, sometimes, mind-boggling release numbers to which we have become accustomed.

This level of functionality can be purchased for well under €1,000 per seat. Popular products include Borland's StarTeam Standard, Merant's PVCS Version Manager, Microsoft Visual SourceSafe and the Perforce SCM System. Although the level of functionality is similar, these products vary widely in other ways. Microsoft, which mainly sells SourceSafe as part of its Visual Studio packages, does not recommend it being used for a team of more than 30 developers, while Perforce cites customers with thousands of developers in a single team. All are available on multiple platforms except for Microsoft SourceSafe which is, not unsurprisingly, available on just one. Open source products are also available. For example, CVS for version management and Bugzilla for change request control.

These products allow developers to co-operate but work in a fairly unrestricted way. This is ideal for the development of much software. For example, in the high-tech and telecoms industries, the development of software is rapid and diverse. Giving developers freedom of expression leads to greater innovation and imaginative new products. Developers of open source software also need this level of freedom.

The development of mission critical software requires something else. Consider the aerospace and defence industries. A software bug can lead to more than the temporary inconvenience of a PC crashing or the loss of few customer transitions. A plane may crash killing people, a guided missile might miss its target killing the wrong people or a spacecraft might disappear into the emptiness of space. In a banking application, a fraudulent programmer might slip a few unnoticed lines of code that make regular payments to an anonymous bank account. In these examples software development needs to be tightly monitored, controlled and audited.

To this end many SCM vendors provide the ability to enforce process during software development. In a simple process a programmer is assigned a change to make, they check out the code, which they can only access via the SCM system. On completion of changes, testing can be enforced before the code is returned to the library, often only after is has been signed off by a manager. With full process control in place everything is enforced and procedures cannot be bypassed – the development process is watertight and if something goes wrong the finger of blame can be pointed accurately.

Full process control is offered either as an optional extra or part of a fully integrated product set. The price per seat is well in excess of €1,000. It is worth checking out the history of some of these tool sets. The components of IBM/Rational's ClearCase were bought together several years ago and there has been plenty of time to integrate them. Serena has only just purchased TeamTrack adding process and change control to its tool set. It is in the process of integrating it. Merant's Dimensions is a mature integrated product set supporting Unix, Linux and Windows platforms, where as MKS Source Integrity is a newly developed product taking full advantage of the Java platform. Serena and Merant offer mainframe versions of their products. CA has two products - Harvest for Unix, Linux and Windows, and Endeavor for the mainframe, with a bridge between them.

Perhaps the best test of an SCM vendor is to check their appetite for their own dog food. When asked, all but three vendors told Quocirca that they use their own SCM tools to manage the development of their own products. The exceptions were Borland and CA, who admitted that within their companies, which have historically grown by acquisition, there is legacy use of their competitors' products. Both are gradually changing this. The third was Microsoft, who admits that most Microsoft products were built using a proprietary in-house SCM system, not Visual Source Safe.

So, if you want to build software of the same quality as the world's largest software vendor, you are going to find it hard to discover their secrets.

**Quocirca is a leading, user-facing analyst house known for its focus on the 'big picture'. For a full summary of its activities see www.quocirca.com, or reach the company's founding directors by emailing quocirca@silicon.com.

Also in this series: Through the fog... The Functional Infrastructure Through the fog… Management of utility IT Through the fog... How to buy content management software Through the fog... Getting your business processes finely tuned Through the fog... Better connecting users to technologies Through the fog... Better connecting users to technologies Through the fog... Predictive texting Through the fog... Business continuity and disaster recovery Through the Through the fog... Wireless email at work dilemmas Through the fog... Storage as a service Through the fog... Buying an application server Through the fog... Corporate content management Through the fog... Automated speech recognition Through the fog... Public Key Infrastructure Through the fog... Vendor-channel relationships Through the fog... What future photo messaging?

For Quocirca's 'What's the fuss about...?' series for silicon.com, see this page

And for their earlier 'Surviving the Recession' series, see this page.