458
`
`PART VII THE GUARDIAN
`
`so we cannot do
`him he will be proceeding
`into the jungle on false pretenses
`it we will have had to
`that If we edit his work and assure that he knows about
`confirmation dialog box This is also not acceptable
`use an error message or
`The only choice we have is to run along behind our brave user making sure
`that he doesnt come to harm We keep track of his path into the jungle we
`remember each of his actions we assure
`be cleanly
`each
`can
`that
`action
`information is lost Essentially we main
`reversed we assure that no collateral
`formed the axiom Audit
`trail of his actions This is why
`clear audit
`tain
`dont edit
`
`Audit dont edit
`
`If you cant bound input data with gizmos just go ahead and accept whatever
`the user gives you Then keep track of what you did and didnt get and if any
`things get straightened out you will have full records that
`body demands that
`will enable you to do so You could for example make an internal note that
`the
`data wasnt quite right yet and make that
`information available to the user The
`user can then judge whether
`the absence of the data will cause the planets
`to
`track of who
`the software should keep
`in their orbits This means that
`halt
`what where how and when the user is doing things
`so the situation can be
`at some later date This is much
`modified rectified or just plain understood
`more human than merely forcing
`the data into some arbitrary format whose
`to.a file schema rather
`correctness is judged mostly on its compliance
`than to
`human need
`
`filled-in
`
`Now calm down In the real world we accept partially and incorrectly
`documents all of the time We make
`mental or otherwise note to fix it later
`and we usually do If we forget we fix it when we eventually discover the omis
`fix it we somehow muddle through Who said that
`sion Even if we never
`is for humans Well pro
`for computer software than it
`are different
`grammers thats who They say they are rejecting
`or inaccurate
`incomplete
`data for our own good but actually they are doing it for their own goodso
`they dont have to write the more difficult code that deals with the unexpected
`Humans dont die if they try to diyide by zero but stupid computer programs
`
`values
`
`0463
`
`
`
`IBG 1022 4 of 4
`CBM of U.S. Patent No. 7,693,768
`
`

`

`CHAPTER 29 MANAGING
`
`EXCEPTIONS
`
`459
`
`do We have
`make our programs smarter
`makes the most money
`
`choice We can either demand that humans also die or we can
`know which method
`choose
`the one that
`
`realize that
`
`it is counter
`
`invoice
`
`is creating
`
`What about thegasplost data
`to everyones wishes if information is lost The
`Yes
`and then discards
`amount
`data-entry clerk who fails to key in the invoice
`the
`real problem But is it really the righteous duty of the pro
`gram to stop the user and point out this failure No it isnt You have to con
`desktop productivity one the user will
`sider the situation If the application
`be interacting with the program and the results of his error will likely become
`car and wont
`the program like
`In any case the user will be driving
`apparent
`the stupid Chevy dis
`take kindly to having the steering wheel
`lock up because
`covered it was low on windshield-washer
`
`is
`
`fluid
`
`is
`
`into
`
`full-time data-entry clerk keying forms
`On the other hand lets say the user
`corporate data-entry program Our clerk does this one job for
`living
`thousandsof hours using the pro
`and he will have spent hundredsmaybe
`for what is happening on the screen and will
`gram He will have
`sixth sense
`glance whether he has entered bad data particularly if the program
`know with
`is using subtle modeless visual and audible cues to keep him informed of the
`status of the data
`
`It wont demand that
`the program will be helping out
`Remember
`gizmos Things like part numbers
`enter bounded information into unbounded
`but will be entered
`
`the user
`
`through
`
`that must be valid arent going
`to be typed in anyway
`picklist of some sort Things like addresses and phone numbers will
`gizmos so that he can enter information more natu
`be entered into extraction
`rally And the program will constantly give the user positive audible feedback
`partner helping him stay aware of the status
`so the program begins to act as
`of his work
`
`So how serious is the loss of data
`
`In
`
`data-entry situation missing field can be serious but the field will usu
`than just omitted The program can easily
`rather
`ally be entered incorrectly
`valid entry without stop
`the problem and change it to
`help the clerk detect
`to omit necessary fields the
`ping the proceedings If the clerk is determined
`the program The percentage of clerks who fail
`problem is the clerk and not
`is likely quite low It
`because of either lack of ability or sociopathic tendencies
`
`0464
`
`

`

`460
`
`PART VII THE GUARDIAN
`
`isnt the job of the data-entry program to treat all data-entry clerks as though
`simple job just because one out of hundred cant
`they cant be trusted to do
`
`example of audit dont edit in its
`Windows 95 actually offers
`installation procedure The program is not only smart enough
`to
`it also keeps copious internal notes on its progress
`situations but
`
`reasonable
`
`to adapt
`
`unexpected
`
`the problem
`record of its progress up until
`If it ever crashes it leaves behind
`expert telephones her every move to the team so that
`the way
`bomb-disposal
`to do next time When the user
`if the bomb goes off they will know what not
`them to
`runs the install program again the program reads those notes and uses
`so it doesnt
`done successfully
`it what
`succeed The notes tell
`it has already
`have to do those items over The last entry in the notes also tells it the thing
`that didnt work The install program will either omit
`time around or take
`different
`tack at solving it
`
`the offending task this
`
`Most of our information processing systems are really very tolerant of missing
`missing name code number or price can almost always be
`information
`the data can always be
`reconstructed from other data in the record If not
`involved
`the various parties
`
`in the transaction
`
`reconstructed
`
`by asking
`the time and its cost
`
`Businesses do this all
`
`is high but not as high as the cost
`information pro
`of Novells technical
`help lines for example Actually our
`systems can work just fine with missing data The programmers who
`cessing
`write these systems just dont like all of the extra work involved in dealing with
`missing data so they invoke data integrity as an unbreakable deified law and
`to keep databases from
`interact with rigid fascistware
`thousands of clerks must
`their business from failing
`
`crashingnot
`
`to prevent
`
`This book isnt about worker productivity or job psychology but it is counter
`those few
`productive to treat all of your workers
`like idiots to protect against
`rapid expensive and
`who are It lowers everyones productivity
`encourages
`the uninten
`and decreases morale which increases
`error-causing turnover
`tional error rate of the clerks who want to do well
`
`self-fulfilling
`
`prophecy
`
`It is
`
`to assume that your information workers
`
`are untrustworthy
`
`ginal Oppression
`
`just said is true but mar
`The moguls of the industrial age know that what
`clearly worked well enough for them to grow and prosper
`can be made However
`role of the data
`the stereotypical
`counter-argument
`entry clerk mindlessly keypunching from stacks of paper
`forms while sitting in
`room among hundreds of identical clerks doing identical
`boiler
`Out very rapidly The task of data entry is becoming less
`mass-production
`
`so
`
`jobs is dying
`
`job
`
`0465
`
`

`

`CHAPTER 29 MANAGING
`
`EXCEPTIONS
`
`461
`
`capable profes
`productivity desktop job performed by intelligent
`by the customers In other words the population
`sionals and even directly
`less tolerant of being treated
`interacting with data-entry software is increasingly
`clerk The imperatives of the
`like an unambitious uneducated
`age are giving way to the imperatives of the information age and
`industrial
`insults them not when they can just
`users wont
`stupid software that
`ven
`they find
`button and net surf for another
`few milliseconds until
`
`and more
`
`tolerate
`
`push
`
`unintelligent
`
`dor of similar goods or services
`
`that offers
`
`software interface that
`
`treats them
`
`with respect
`
`into
`
`tool
`
`Fudging
`In the real world missing information and extra information that doesnt
`for success Information
`standard field is an important
`systems rarely handle this real-world data They only model
`sort of skeleton of the actual
`able data portion of transactions
`dozens of meetings travel and entertainment
`which may involve
`spouses and kids golf games and favorite
`sports figures Maybe
`could only be completed if the termination date was extended
`fudge on the termi
`limit Most companies would rather
`beyond the official
`nation date than see million-dollar deal go up in smoke In the real world
`limits are fudged all of the time
`
`fit
`
`processing
`
`the rigid repeat
`
`transaction
`
`names of
`
`transaction
`
`two weeks
`
`While entry systems are working to keep bad data out of the system they
`almost never allow the user to fudge There is no way to make marginal com
`vitally nec
`field For example maybe
`ments or to add an annotation next to
`essary item of data is missing an interest rate say If the system wont allow the
`the company
`valid interest rate it stops
`to be entered without
`transaction
`had
`from doing business What if the interest rate field on the loan application
`that said prime plus
`penciled note next to it initialed by the bank president
`three the day the cash is delivered The system working hard to maintain per
`fection fails the reality test
`
`If the automated data-processing system is too rigid it doesnt allow fudging
`In other words it wont model
`the real world
`system that
`rejects reality
`any invalid fields You must ask
`good thing even if it doesnt have
`not
`yourself the question what
`is more important Your database or your busi
`ness The propeller-heads who manage the database and create the data-entry
`feed it serve the CPU as master and neither the needs of the user
`that There is
`can overcome
`
`programs that
`needs of your
`
`nor
`
`is
`
`business
`
`significant
`
`the
`
`0466
`
`

`

`462
`
`PART VII THE GUARDIAN
`
`conflict of interest
`
`that oniy software design knowledgeable
`
`in but detached
`
`from the development process
`
`can resolve
`
`this is
`
`setting and information is actually lost
`If the program is used in
`professional
`big bad thing because it only happens very occa
`bad thing but not
`losing data it will be obnox
`the interface protects
`sionally If however
`against
`big bad thing Its kind of
`ious to every entry clerk all of the time and this is
`if you trust your data-entry clerks they will perform better with the
`Zen-like
`increased responsibility
`
`Besides the amount of lost data will be insignificant and probably recoverable
`have seen that had rigid validation
`More importantly all of the software that
`as Swiss cheese The bottom line
`
`to guarantee data integrity was as full of holes
`is that all of that data integrity stuff doesnt work against
`
`determined
`
`invader
`
`anyway
`
`so you might as well
`
`try
`
`different approach
`
`Imagine how nice it would be if when
`user finished editing he could request
`listed the details of suspected errors he had made along with
`dialog box that
`as to why and possibly some hints on fixing them There is
`some suggestions
`usually plenty of information that an auditing program can gather when it sus
`pects problems and most of our computers have space for it Its good invest
`ment
`
`Ive already
`
`said what
`
`Failing gracefully
`think about error messages but Im under no illusions
`of error messages
`it will have on an industry that
`that programs are going to issue error messages so now
`Facing reality
`accept
`Id like to talk about how to fail with grace
`
`about
`
`the impact
`
`is chock-full
`
`that
`
`reflect
`
`They either work or they
`computers are absolute in their behavior
`Digital
`dont Good programmers are sensitive to this nature and tend to create pro
`it When programs detect
`errorsreally nasty internal
`grams
`errorsthey tend to crash absolutely Lets say
`program is merrily computing
`along say downloading your email from server when it runs out of memory
`buried deep in the internals of the program Most of the
`at some procedure
`message that says in effect You are com
`know and use issues
`down the entire program You restart
`the
`pletely hosed and then shuts
`the program lost your email and when you
`computer only to find that
`it had
`it has also erased your mail because
`the server
`find that
`interrogate
`already handed it to your program
`
`software
`
`0467
`
`

`

`CHAPTER 29 MANAGING
`
`EXCEPTIONS
`
`463
`
`This is not good
`
`When
`
`fatal problem it knows it will die Before it goes
`program discovers
`It can just go ahead and crash or
`it can follow one of two strategies
`however
`it can take the time and effort to prepare for its death without hurting the user
`disgruntled psychotic ex-employee taking
`In other words it can go out
`blaze of automatic machine pistol fire or it
`dozen coworkers with him in
`
`like
`
`that
`
`its will
`
`and all of its insurance
`
`is complete
`can tidy up its affairs assuring
`bank accounts and safe deposit boxes are identified and recorded
`goes to meet its silicon god
`
`policies
`
`its heirs before it peacefully
`
`for
`
`infor
`
`Most programs are filled with data and settings When they crash that
`The user is left holding the bag In our email
`mation is normally just discarded
`from the serverwhich then erased its
`email
`example the program accepted
`the email was properly recorded locally The email
`copybut didnt assure that
`program surely didnt crash because of its own incompetencenawwwwit
`was brought down by the foolishness of some irresponsible
`screen saver pro
`the email program was the victim No
`but
`gram running in the background
`you are the victim If the email program had made sure that
`those messages
`were promptly written to the local disk even before it informed the server
`the messages were successfully downloaded the problem would never have
`then crashed things
`arisen even if the stupid screen saver
`
`that
`
`is still there particularly
`
`the unwillingness of software to dismantle itself benignly
`constantly see
`before it crashes Even if it doesnt crash the attitude
`dialog will come up and the user will enter several complex
`in dialog boxes
`inputs and settings On the tenth or eleventh field the dialog rejects the users
`input and shuts down the dialog The user then calls the dialog back up and
`discarded Remember Mr
`lo the first ten valid entries were inconsiderately
`in high school who ripped up
`incredibly mean geography teacher
`Jones that
`your entire report on South America and threw it away because you handed it
`instead of ink Why couldnt he have just asked you to transcribe it
`in in pencil
`instead of forcing you to do it over Dont you hate South America to this day
`Mr Jones could easily have been
`programmer
`
`0468
`
`

`

`Undo
`
`remarkable
`
`facility that
`
`lets us reverse
`
`the feature is of obvious
`
`from
`
`goal-directed
`
`ndo is that
`previous action Simple and elegant
`value Yet when we examine undo
`considerable variation
`point of view there appears
`pose and method Undo remains important but
`simple as you might think
`
`in pur
`
`its not as
`
`Assisting the exploration
`Undo is the facility traditionally thought of as the rescuer of
`in shining armor the cavalry gal
`the knight
`swooping in at the last
`
`users in distress
`the ridge the superhero
`
`loping over
`second
`
`facility undo has no merit It contributes
`As
`computational
`nothing to the world of computer software Mistake-free as
`they are computers have no need for undo Human beings
`on the other hand make mistakes all of the time and undo
`use This singular
`facility that exists
`
`for their exclusive
`
`is
`
`465
`
`0469
`
`

`

`466
`
`PART VII THE GUARDIAN
`
`observation should immediately
`undo should
`be modeled the least
`mentation modeland the most
`
`the facilities
`tell us that of all
`program
`like its construction methodsits imple
`like the users mental model
`
`in
`
`they make mistakes as part of their every
`Not only do humans make mistakes
`day behavior From the standpoint of
`misdirected
`
`laugh an uh you
`cough
`hiccup
`sneeze
`glance
`blink
`pause
`know are all errors But from the standpoint of the human user they are per
`fectly normal Human mistakes are so quotidian that
`if you think of them as
`errors or even as abnormal behavior
`you will screw up the design of your
`
`computer
`
`false start
`
`software
`
`The users mental model of mistakes
`
`the user doesnt imagine himself as making mistakes is another way
`Saying that
`of saying that his mental model doesnt include an error on his part Following
`the users mental model means absolving the user of blame The implementa
`tion model of course is based on the error-free CPU Following the imple
`mentation model means acknowledging that all culpability has to be the users
`The typical programmer normally blames the user before he blames the soft
`ware Wooop Wooop Wooop Model conflict Most software assumes
`that
`and any problems are purely the fault of the user
`is blameless
`
`it
`
`The solution is for the user interface designer to completely abandon any shred
`mistake Users dont make mistakes in
`the user could make
`of thought
`their own minds so the program shouldnt contradict
`face
`
`them in its user inter
`
`that
`
`Users dont make mistakes
`
`vs
`
`peripheral
`
`If we design software from the point of view that users never make mistakes we
`immediately begin to see things differently We cease
`the user as
`to imagine
`and we begin to imag
`module of code or
`that drives the computer
`ine him as an explorer probing the unknown We understand
`that exploration
`forays into blind alleys and box canyons down dead ends
`
`involves
`
`inevitable
`
`0470
`
`

`

`CHAPTER 30 UNDo
`
`467
`
`for humans to experiment to vary their actions
`and into dry holes It is natural
`the veil of the unknown to see where their boundaries
`to probe gently against
`tool unless he experiments with
`lie How can he know what he can do with
`varies widely from person
`it Of course the degree of willingness
`to experiment
`to person but most people experiment
`
`little bit
`
`at least
`
`From the implementation model
`
`continuous
`
`innocent
`probing is just
`enlightened mental model point of view his actions
`rebuffing those perceived mistakes or
`The program has the choice of either
`assisting him in his explorations
`
`are natural
`
`the programmers point of view such gentle
`series of mistakes From our more-
`and normal
`
`Undo is for exploration not mistakes
`Undo is the primary tool for supporting exploration in software user interfaces
`if he decides to
`one or more previous actions
`the user to reverse
`It allows
`change his mind
`
`The secret
`
`to designing
`
`assumption
`
`that
`
`it supports
`
`undo system is to create
`successful
`normal part of the everyday working set of the
`that undo is
`tacit acknowledgment of fail
`
`from the
`
`it
`
`it is less
`
`tool
`
`for revers
`
`programs tools avoiding any hint
`ure by the user The key to this is to design it so that
`ing errors and more one for supporting exploration Primarily errors are single
`long series of
`by contrast
`and unintentional actions Exploration
`probes and steps some of which may be keepers and others of which need to
`undo systems treat
`be abandoned Most existing
`things as single incorrect
`
`incorrect
`
`is
`
`actions but
`
`this model
`
`is less helpful
`
`Undo is distastefully human
`in practical software development
`Undo is one of the more difficult
`find much discussion of it
`It isnt very tough algorithmicallyyou wont
`in
`textbooksbut it necessitates
`adding
`computer science
`code into virtually every other part
`lot of convoluted
`the program and putting
`big reason why undo is often omitted
`of it This difficulty of construction is
`
`non-trivial
`
`facility to
`
`exercises
`
`or implemented poorly
`
`implementation of undo
`an equally significant barrier to the adequate
`Probably
`psychological one Undo is not very computer-like Computers never make
`the programmers main career
`this is one of
`and
`the deterministic
`
`is
`
`mistakes
`
`Programmers
`
`as
`
`group really appreciate
`
`attractions
`
`behavior
`
`of
`
`0471
`
`

`

`468
`
`PART VII THE GUARDIAN
`
`to create
`
`computers
`
`large part of what makes programming so appealing to them is
`self-consistent world of logical rational
`the ability
`self-contained
`behaviora world of squared-off corners and clean-room streets Undo on the
`and miscon
`rough edges and discards inconsistencies
`other hand is all about
`strued artifacts Undo is
`thing and because it
`human thing not
`computer
`an unpleasant and vaguely distasteful
`deals with human fallibility it represents
`
`part of the programmers
`
`job
`
`Undo reassures
`
`significant contribution that undo makes to the user is purely psychological
`it reassures him It is much easier to enter
`cave if you are confident
`that you
`can get back out of it at any time The undo function is that comforting
`to explore further by
`ladder
`to the surface supporting the users willingness
`assuring him that he can back out of any dead-end caverns
`
`rope
`
`users often dont think about undo until
`dont
`
`think about
`
`they need it in much the
`their insurance
`
`policies until
`
`Curiously
`same way that homeowners
`some disaster strikes Users will frequently charge half-prepared into the cave
`looking for the rope ladderfor undoafter they have encoun
`
`and only start
`
`tered trouble
`
`Users mental model of undo
`
`The users mental model of undo is predictably variable for the simple reason
`users need undo it doesnt directly support
`goal they bring to
`necessary conditiontrustworthinesson
`the task Rather it supports
`real goal It doesnt contribute positively to attaining
`the users goal
`from spoiling
`the effort
`
`that although
`
`way to
`but keeps some negative occurrence
`
`the
`
`The user will visualize the undo facility in many different ways depending on
`the situation and his expectations If the user is very computer-naive he might
`get-me-out-of-here buttonan escape valve or
`see it as an unconditional
`himself from hopelessly tangled misadven
`for extricating
`computer user might visualize undo as
`ity for deleted data computer-sympathetic
`user with
`might see it as 1(cid:224)tii aiii or LIFO stack of procedures
`time
`undone one at
`
`ejector-seat
`
`lever
`
`ture
`
`more experienced
`
`storage facil
`logical mind
`can be
`
`that
`
`In order to create an effective
`
`undo facility we must satisfy
`
`as many of these
`
`mental models as we expect our users will bring to bear
`
`0472
`
`

`

`CHAPTER 30 UNDO
`
`469
`
`describe
`
`The undo language gap
`As is so common in the software industry there is no adequate
`the types of undo that existthey are uniformly called undo and left
`at that This language gap contributes to the lack of innovation in new and bet
`show the spe
`taxonomy for undo and
`ter variants of undo
`have created
`them as each one is discussed
`cific names for undo variants and define
`
`terminology
`
`to
`
`action
`
`of
`
`is
`
`user added or
`
`the affected
`
`text or
`
`procedure
`
`data component
`
`nent
`
`rnciemectIO orn
`
`Lets first talk about what undo operates on the users actions
`typical user
`the user did
`procedure componentwhat
`has
`in typical application
`information was affected When the
`and an optional data componentwhat
`the action
`the procedure
`requests an undo function
`component
`user
`reversed and if the action had an optional data componentthe
`respectively Cutting
`deleted datathat data will be deleted or added back
`data compo
`that have
`pasting drawing typing and deleting are all actions
`so undoing them involves
`removing or replacing
`and
`functions with both
`
`image parts
`
`call
`
`transformations
`
`such
`
`as
`
`paragraph
`
`rotation
`
`are dataless
`Many undoable functions
`reformatting operation in word processor or
`in drawing program
`Both of these operations act on data but neither of them adds or deletes data
`e4ur(cid:231)
`have lust
`functions like these that
`component
`procedure
`ur1ulr1
`don
`undo functions
`discriminate
`actions or nreduraIs Most existing
`procedurals and incrementals but simply reverse
`between
`
`call
`
`the most
`
`recent
`
`action
`
`The two most-familiar types of undo in common use today are single undo and
`multiple undo
`is the most basic variant non-repeatably reversing
`the effects of the most recent user action whether procedural or incre
`
`out
`
`mental
`
`because it is so simple to operate The user inter
`This facility is very effective
`to describe and remember The user gets precisely
`face is simple and clear easy
`one free lunch This is by far the most frequently implemented undo and it is
`for many programs For some users the
`certainly adequate if not optimal
`absence of this simple undo is sufficient grounds to abandon
`product
`entirely
`
`right away some
`notices most of his command mistakes
`The user generally
`the
`thing about what he did doesnt feel or look right so he pauses to evaluate
`situation If the representation is clear he sees his mistake and selects the undo
`
`0473
`
`

`

`470
`
`PART VII THE GUARDIAN
`
`function to set things back to the previously correct state then proceeds from
`there
`
`Multiple undo is iepeatableit can revert more than one previous operation
`in reverse temporal order
`
`by menu item or buttcon with an unchanging
`Normally undo is invoked
`label The user knows that
`triggering the idiom will undo the last operation
`this blind undo
`of what that operation is
`
`but there is no indication
`
`call
`
`On the other hand if the idiom includes
`particulat operation that will be undone
`
`textual or visual description
`it explanatory undo
`
`call
`
`of the
`
`If for example the users last operation was to type in the word design an
`explanatory undo function on the menu would say undo typing design
`feature than blind undo
`much more pleasant
`Explanatory undo is generally
`to put on menu item but more difficult to put on
`It is fairly easy
`although putting the explanation in ToolTip is
`good compromise
`
`buttcon
`
`The trouble with single undo
`incremental undo is when the user acci
`The biggest
`limitation of single-level
`dentally short-circuits the ability of the undo facility to rescue him This prob
`lem crops up when the user doesnt notice his mistake
`For
`example assume he deletes
`six paragraphs of text then deletes one word then
`the six paragraphs were erroneously deleted and should
`undo now merely brings back
`the one
`performing
`replaced Unfortunately
`word and the six paragraphs are lost forever The undo function has failed him
`the six
`than practically Anybody can clearly see that
`than the single word yet
`are more important
`the program freely
`in favor of the one word The programs
`discarded those paragraphs
`quarter and throw away
`fifty-dollar bill simply because the
`caused it to keep
`quarter was offered last
`
`decides
`
`that
`
`by behaving literally rather
`
`paragraphs
`
`immediately
`
`be
`
`blindness
`
`In some programs any click of the mouse however
`the single undo function to forget
`the last meaningful
`might be causes
`thing
`the user did This can be really frustrating if you expect undo help from the
`program Although multiple undo solves
`introduces some
`these problems it
`significant problems of its own
`
`of function it
`
`innocent
`
`0474
`
`

`

`CHAPTER 30 UNDo
`
`471
`
`Multiple undo
`
`of single-level undo has been to create mul
`The response to the weaknesses
`tiple-level implementation of the same incremental undo The program saves
`undo repeatedly each action can be
`the user takes By selecting
`each action
`
`scenario the
`In the above
`invocation
`in reverse order of its original
`undone
`user can restore the deleted word with the first invocation of undo and can
`second invocation Having to redun
`restore the precious six paragraphs with
`small price to pay for being able to recover
`dantly re-delete the single word is
`tends to not
`those six valuable paragraphs The excise of the word re-deletion
`be noticed the way we dont notice the cost of ambulance trips we dont quib
`ble over the little stuff when lives are at stake But this doesnt change the fact
`faulty model and in other circumstances
`the undo mechanism is built on
`strict LIFO order can make the cure as painful
`the
`
`as
`
`that
`
`undoing functions in
`
`disease
`
`Imagine
`
`document
`
`again our user deleting
`and performing
`
`six paragraphs of text then calling up another
`In order
`to
`function
`
`global
`
`find-and-replace
`the user must first unnecessarily undo the
`
`retrieve the missing six paragraphs
`
`operation This time the intervening
`rather complex global
`find-and-replace
`operation was not the insignificant single-word deletion of the earlier example
`and having to undo it is
`The intervening operation was complex and difficult
`excise effort It would sure be nice to be able to choose
`clearly an unpleasant
`which operation in the queue to undo and to be able to leave interveningbut
`validoperations untouched
`
`Any program with undo must remember the users last operation and if applic
`any changed data If the program implements multiple undo it
`able cache
`stack of operations the depth of which may be settable by the
`must maintain
`Each time undo is invoked
`it performs an
`as an advanced
`preference
`user
`incremental undo reversing the most recent operation replacing or removing
`data as necessary and discarding the restored operation from the stack
`
`The model problems of multiple undo
`as much as to its
`The problems with multiple undo are not due to its behavior
`in an unrelentingly func
`manifest model Most undo facilities
`are constructed
`tion-centric manner They remember what
`by individual
`and separate
`
`the user does function-by-function
`In the time-honored way
`
`function
`
`the users actions
`
`0475
`
`

`

`472
`
`PART VII THE GUARDIAN
`
`undo button reverses
`
`on
`
`function-by-function basis is
`
`Reversing
`
`for solving
`
`follow implementation models undo systems
`of creating manifest models that
`of the
`tend to model code and data structures
`instead of user goals Each press
`precisely one function-sized bite of behavior
`very appropriate mental model
`most simple problems caused by the user making an erroneous entry Users
`sense it right away and fix it right away usually within
`two- or three-function
`limit The new Paint program in Windows 95 for example has
`fixed three-
`undo limit However when the problem grows more convoluted the
`incremental multiple undo model doesnt scale up very well
`
`action
`
`to get
`
`interlaced
`
`and nullify others not
`
`some text
`text but not undo the editing
`
`then
`
`global
`
`replace
`
`changing
`
`the
`
`You bet your LIIFO
`When the user goes down
`logical dead end rather
`than merely mis-keying
`data he can often proceed several complex steps into the unknown before real
`bearing on known territory At
`izing that he is lost and that he needs
`functions that
`he may have performed several
`this point however
`are not all bad He may well want to keep some actions
`reverse order What
`if the user entered
`necessarily in strict
`edited it then decided to undo the entry of that
`and prob
`of it Sort of like dividing by zero such an operation is undefined
`lematic to implement and explain Neil Rubenking offered me this pernicious
`tragedy to cata
`the user did
`example suppose
`changing cat to dog To undo the first without
`strophe then another
`can the program reliably fix all of the dogastrophes
`
`second
`
`single straight-line
`
`In this more complex situation the simplistic representation of the undo as
`LIFO stack of incrementals doesnt satisfy
`the way it does
`The user may be interested
`in studying his actions
`in simpler situations
`discontiguous subset of them for reversion while keep
`menu and choosing
`ing some others This demands an explanatory undo with more robust pre
`than might otherwise be necessary for normal blind multiple undo
`sentation
`from that presentation must be more
`the means for selecting
`Additionally
`the operation in the queue to clearly show the user
`sophisticated Representing
`what he is actually undoing is
`problem of some difficulty
`
`as
`
`Redo
`
`If you dont believe
`that programmers are designing our software the redo
`shadow of doubt By adhering rigor
`function should convince you beyond
`ously to the implementation model
`for undo whereby functions are literally
`
`0476
`
`

`

`CHAPTER 30 UNDo
`
`473
`
`the particular operation to
`the inability to select
`undone in reverse
`sequence
`first undoing all of the valid intervening operations has caused
`undo without
`the redo function to come into being Redo essentially undoes the undo
`
`if the programmer
`to implement
`Redo mostly exists
`already gone to the effort to implement undo Many programs that
`implement
`as an undoable action In effect
`the last undone action
`single undo treat
`invocation of the undo function
`makes
`
`because
`
`it
`
`is easy
`
`has
`
`this
`
`second
`
`redo function
`
`presses
`
`desired
`
`The real purpose of redo ends up being to avoid
`half-dozen or so operations
`tiple undo If the user wants to back out of
`things return to the
`the undo buttcon
`few times waiting to see
`in this situation to press undo one time too many
`state It is very easy
`He immediately sees that he has undone something desirable Redo solves
`problem by allowing him to undo the undo putting back the last good action
`Redo is really nothing more than
`explanatory undo
`
`diabolical
`
`situation in mul
`
`he
`
`this
`
`substitute
`
`for better visualization
`
`tools in an
`
`Special undo function