Saturday, March 2, 2013

Are You Licensed Yet? Will Engineering Software Become Illegal Unless You Have a License?

This week the Northeast Ohio Chapter (NEOACM) of the Association for Computing Machinery is going to hold a round-table discussion on government mandated licensing of Software Engineers.
I have been chronicling the developments of what the various states are doing or have planed for licensing of software professionals over the last year, so I have been invited to be one of the panelists. If you are going to be in the Youngstown Ohio area this coming Thursday [2013/Mar/7th] stop by the Youngstown Business Incubator at 6:00 PM.
Are You Licensed Yet? Will Engineering Software Become Illegal Unless You Have a License?
Sponsored by NEOACM on:
March 7th
6:00 - 8:00 PM
Youngstown Business Incubator
241 West Federal Street
Youngstown Ohio, 44503
In chronological order these are my past entries on mandatory licensing of Software Engineers:
  1. Do you have your license to write firmware?
  2. Government Responses on Software License Questions
  3. More Government Responses on Software License Questions
  4. Yet More Government Responses on Software License Questions and Study Guide
  5. A Principles and Practices Exam Specification to Support Software Engineering Licensure in the United States of America
Add to those documents from NEOACM that you should review when considering mandatory licensing of Software Engineers:
There are a few items that are important to understand, before you can take the Software Engineering Exam: NCEES Principles and Practice of Engineering Examination Software Engineering Exam Specifications
First you must have a four year degree (The state of Maryland has an exception that I need to look in to), and the degree must be accredited by the Accreditation Board for Engineering and Technology (ABET). ABET lists only twenty-two Software Engineering programs. Software Engineer Insider summarizes a few of them. The closest to the NEOACM chapter are Penn State Behrend and Gannon University, both in Eire PA.
Next you must take, the completely unrelated to Software Engineering, the eight hour long exam that covers Chemical, Civil, Electrical, Environmental, Industrial, Mechanical, Other Engineering Disciplines, before you can even take the Software Engineering exam. Perhaps this is why Software Engineer Insider states "Other software engineers may want to take the licensing exam as a badge of accomplishment.". I'm sorry but I find that distressing. Egos have no place in the areas of safety that this Software Engineer license claims to be about. Read some of the background links above and you find Ego makes more than one appearance. Pathetic.
You must also have experience in Software Engineering, four to twelve years as it varies by state, before you can take the Software Engineering (SE hereafter, not to be confused with Structural Engineering that is a more common NCESS exam right now) exam. Seems like a classic bootstrap problem, can't get the license until you have experience, and you are not allowed to practice without a license? This is where Mentoring enters the picture, however there are no state licensed Software Engineers yet to be Mentors.
It is important to understand the difference of the various computer/software degrees that are relevant to licensing. David Janzen, Associate Professor California Polytechnic State University Computer Science Department, explains the difference between Computer Engineering, Computer Science, Software Engineering, which I summarize below, see his page for the whole text:
  1. "Computer Science covers the core concepts and technologies involved with how to make a computer do something. Learning to program a computer by writing software is essential, and computer programming is used in most computer science courses..."
  2. "Computer Engineering teaches you how to design systems that include both computer hardware and software. You will take classes on how computer hardware works and how to build a computer..."
  3. "Software Engineering focuses on how to design and build software in teams. You will take many of the same courses as you would in computer science, but you will take additional courses that teach you about topics like requirements engineering, software architecture, software testing, and software deployment. You will learn about working with people (communication, management, working with non-technical customers), processes for developing software, and how to measure and analyze the software product and the software process..."
So Software Engineering knowledge that is being tested for is more about project management than anything else. As I've said for years "Most causes of system faults are created before the first line of code is written, or first schematic is drawn. The errors are caused by not understanding the requirements of the system", so in this one regard these new exam requirements may be a Good Thing. However good requirements doesn't directly address real world problems like the number one cause of most crashes and security breaches being buffer overflows.
Some Safety Myths:
Just make it reliable Just use redundancy
Just do a lot of testing Just make the software "safe"
Just do it all in software Its always the operator's fault


What is on the exam and who brought us to this point (besides our collectively buggy software)? The organizations that I know have been have been involved in the preparation of the exam are IEEE-USA, assisted by the IEEE Computer Society, the National Society of Professional Engineers, and the Texas Board of Professional Engineers. Do you know of others?
Exam contents:
Requirements 17.5%
Design 13.75%
Construction 11.25%
Testing 12.5%
Maintenance 7.5%
Configuration Management 7.5%
Engineering Processes 7.5%
Quality Assurance 7.5%
Safety, Security, and Privacy 15%
I have said all along this is more about selling training material than safety. Sadly I felt I should purchase the Principle and Practice Exam Sample Questions and Solutions Book to be participate in the round-table discussion. Not being a IEEE member the 50 page document cost me $49.99. Three of the pages are the ones from Exam contents that I just listed above, eleven pages are blank or not relevant to the exam like the copyright notice. I showed the document to a couple of other people and they felt the question/answer contents was okay, but that the limited volume of information supplied was a complete rip-off for $50. One person even asked "Why can't they just put this on a web site?". If this is about safety then why isn't it free? Also only Internet Explore worked to buy the document, Opera and Chrome did not. IEEE is pushing for better software and their own software based web site doesn't work...
The most valuable section of the document is the list of fifteen reference books from which the exam question pool is based. The exam is 80 questions, however I have not found how many questions are in the actual question pool anyplace. Reproducing the list here would be certain to have the copyright police show up. So I'm only going to mention three that I know are safe from the copyright police. First is professor Phillip A. Laplante's Requirements Engineering for Software and Systems (Applied Software Engineering Series) that supports my conjecture this is about selling training material not safety. Second Steve McConnell's Code Complete: A Practical Handbook of Software Construction, Second Edition that is on any software design reading list, as it should be. If you have read this book before, then read the new rewritten second edition. Finlay Linda Westfall's The Certified Software Quality Engineer Handbook , as I was already familiar with it, so felt safe to list it.
For full disclosure if you buy those books by the above links I do get a small pittance from Amazon's Affiliate Program, so I too am making a profit related to safety.
I'll give a few representative questions. Note these are not the actuall qustions rather my paraphrasing and simplification of them. Some of them are constructed like story problems that made you groan when you where in math class:
  1. Given a small key space (a few bits) calculate the Diffie-Hellman secret key value. I taken this as representation of the silly concept that such a exam as this is useful. I am not a cryptographer and I have no idea how to calculate a DH key by hand. I base my designs on people that are experts in the relevant fields and rely on their expertise and software to calculate such keys. A better question might be why DH is used verse the One Time Pad (one of the other questions). Knowing how keys are exchanged is what is important, not how they are calculated.
  2. Given a flow graph, typical of Dot from Graphviz, calculate the flow path.
  3. Given a similar flow graph as above, calculate McCabe's Cyclomatic Complexity value. Myself I use C and C++ Code Counter to do such things.
  4. Given a set of statistics calculate the probability of software failure on demand; they use the incorrect acronym 'POFOD'. Are they are saying it is impossible to have perfect software?
  5. What software keeps an aircraft stable in flight? Their answer is overly simplistic.
  6. What is the difference between Real Time and Non-Real Time modeling languages?
  7. Incoming tasks must be serviced in a given time to meet requirements. How many processes does it take to guarantee requirements are meet? Myself I'd use Erlang, but that is not one of the answers.
  8. What is the best way to keep a project on schedule?
In closing there are two items I came across while doing research on this licensing issue today. First according to the U.S. Bureau of Labor and Statistics Computer Software Engineer stopped being a viable profession in 2009, or at least it is the last year they list Software Engineering in the Occupational Employment Statistics database. After 2009 things move to Software Development. Makes me wonder what to expect from code.org?:
Occupational Employment and Wages, May 2009
15-1031 Computer Software Engineers, Applications
Develop, create, and modify general computer applications software or specialized utility programs. Analyze user needs and develop software solutions. Design software or customize software for client use with the aim of optimizing operational efficiency. May analyze and design databases within an application area, working individually or coordinating database development as part of a team. Exclude "Computer Hardware Engineers" (17-2061).
Occupational Employment and Wages, May 2009
15-1032 Computer Software Engineers, Systems Software
Research, design, develop, and test operating systems-level software, compilers, and network distribution software for medical, industrial, military, communications, aerospace, business, scientific, and general computing applications. Set operational specifications and formulate and analyze software requirements. Apply principles and techniques of computer science, engineering, and mathematical analysis.
Occupational Employment and Wages, May 2011
15-1132 Software Developers, Applications
Develop, create, and modify general computer applications software or specialized utility programs. Analyze user needs and develop software solutions. Design software or customize software for client use with the aim of optimizing operational efficiency. May analyze and design databases within an application area, working individually or coordinating database development as part of a team. May supervise computer programmers.
Secondly, returning to ABET, they describe the difference between a two year technology degree and a four year BS degree. From all the job ads I see in the Embedded Space the work that companies want done fall into the area of ABET's two year degrees, yet most all of the jobs demand that you have a four year degree to make it past the HR gatekeepers. Anyone care to explain that? Fortunately most new opportunities are found via networking bypassing these impediments to your career.