1. www.eu-etics.org INFSOM-RI-026753 A Quality Certification Model for Grid Research Projects the ETICS feasibility Study Adriano Rippa (adriano.rippa@eng.it) adriano.rippa@eng.it - Engineering Ingegneria Informatica s.p.a. - Engineering Ingegneria Informatica s.p.a. On behalf of ETICS Project

2. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 2 Summary Introduction to QA conceptsIntroduction to QA concepts The starting point of the present studyThe starting point of the present study The proposed Grid Quality Certification Model (GQCM)The proposed Grid Quality Certification Model (GQCM) Comparing GQCM and other QA standardsComparing GQCM and other QA standards Using GQCM in Industries: the Engineering experimentationUsing GQCM in Industries: the Engineering experimentation ConclusionsConclusions

3. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 3 Quality Assurance refers to several concepts Quality of the implementation processQuality of the implementation process –High level steps of the software production cycle suggesting what the organization must do (not how) to have effective development processes that “may lead” to good software. Quality of the requirements managementQuality of the requirements management –Correct collection/management of requirements and relation with the customer and stakeholders, to reduce the percentage of failures due to misinterpreted requirements. Quality of the serviceQuality of the service –Performances and correctness of the service provide Finally quality of the software…Finally quality of the software… QUALITY Quality of Product Quality of Process GQCM CMM ITIL ISO – 900x

4. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 4 Some QA Terminology Measure: a value (number or category) assigned to an attribute of an entity (e.g. software component)Measure: a value (number or category) assigned to an attribute of an entity (e.g. software component) Measurement: The act or process of assigning a number or category to an entity to describe an attribute of that entity.Measurement: The act or process of assigning a number or category to an entity to describe an attribute of that entity. Metric: A function whose inputs are software measures and whose output is a single numerical value that can be interpreted as the degree to which software possesses a given attribute that affects its quality.Metric: A function whose inputs are software measures and whose output is a single numerical value that can be interpreted as the degree to which software possesses a given attribute that affects its quality.

5. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 5 Quality is a matter of measure! State-of-the-art provide hundreds of measuresState-of-the-art provide hundreds of measures –The most common –Cyclomatic complexity –Lines of Code –Function Points –Mean Time Between(to) failure –Bugs density –… –Other approaches (Goal Question Metric - GQM) promote user defined metrics –Anomalies distribution –Effort used to solve anomalies –Cost of not founded anomalies –…

6. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 6 Quality Standards There are many standards to asses the quality of the processes of an organizationThere are many standards to asses the quality of the processes of an organization –CMM –ISO family –ITIL –AQAP But QA means initial investments and managing QA means devote resources to it!But QA means initial investments and managing QA means devote resources to it! Several studies show that lot of companies (e.g. many Small/Medium Enterprises) can’t afford the initial effort and don’t recognise the promised increase of value.Several studies show that lot of companies (e.g. many Small/Medium Enterprises) can’t afford the initial effort and don’t recognise the promised increase of value.

7. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 7 e.g. CMM-I CMM-I levels:CMM-I levels: –1 Initial: Processes are low managed and controlled. There is a first tentative to look at the quality –2 Managed: Processes are specific, controlled, applied, replicable –3 Defined: There is homogeneity in the processes between all the projects. They are defined by the organization –4 Quantitatively Managed: Processes are measured and controlled –5 Optimising: Focus on the continuous improvement process Only ~70 companies in the world are certified at level 5Only ~70 companies in the world are certified at level 5 –50 of them are in India Only 25% of the companies in the world are level 2 or aboveOnly 25% of the companies in the world are level 2 or above

8. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 8 QA in research project is missing! Current quality assurance standards are useful butCurrent quality assurance standards are useful but –They are process oriented, the organisation need to be structured and certified. What for the short-live consortia? –They provide only theoretical guidelines that need to be adapted and realised –It’s hard to systematically verify goodness of results: managing tools needed –They need resources to be devoted to. –People need to be trained and certification needs inspections and time to be achieved (usually about two or three years depending on the organisation complexity).

9. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 9 QA in grids: our solution GQCM is a model for quality assurance that isGQCM is a model for quality assurance that is –fully automatable in measuring and verifying activities to reduce investments and management effort, –not subjective, to certify the object not the process nor the organization, –product oriented, not process oriented, …easily adoptable within grid Research Projects…easily adoptable within grid Research Projects

10. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 10 The timeline FIRST BETA VERSION FINAL BETA VERSION OCTOBER FIRST OFFICIAL VERSION DECEMBER ECHOGRID/EUChinagrid Conference 24-25 April MAYFEBRUARY OGF 20/EGEE UF 7-11 May Belief Conference 25-28 June OGF 21 15-19 Oct QUALIPSO Conference 16-17 Jan 2008 Now EGEE ’07 1-5 Oct EELA 3° Conference 3-5 Dec 2007

11. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 11 Grid Quality Certification Model Some QA Standards areSome QA Standards are –Waterfall-like –Boolean GQCM could be seen as a model that looks at the quality by independent points of view, tested separately to provide user- friendly resultsGQCM could be seen as a model that looks at the quality by independent points of view, tested separately to provide user- friendly results A B C A B C

12. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 12 GQCM: Preliminary remarks GQCM is independent from the ETICS toolsGQCM is independent from the ETICS tools Any GQCM implementation needs just “automation” !Any GQCM implementation needs just “automation” ! GQCM has been developed and described according to several ISO standards (e.g. ISO/IEC 25000, 14598) and will be experimented in a ISO/CMM certified organizationGQCM has been developed and described according to several ISO standards (e.g. ISO/IEC 25000, 14598) and will be experimented in a ISO/CMM certified organization

13. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 13 GQCM: Structure GQCM is structured in Evaluation Modules (EM).GQCM is structured in Evaluation Modules (EM). The set of evaluation techniques are grouped in families. Every family is an EMThe set of evaluation techniques are grouped in families. Every family is an EM 5 EMs:5 EMs: –EM: Static analysis –EM: Coding style –EM: Structural testing –EM: Functional testing –EM: Standards compliance

14. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 14 Evaluation Modules 1/5 EM Static analysisEM Static analysis –Quality characteristics: –Reliability – maturity –Maintainability – analysability –Maintainability – changeability –Maintainability – testability –Technique: –Static analysis of classes. Statistics on measures are used as predictor of quality characteristics. This analysis is expected to be supported by an analysis tool. –Applicability: –Object oriented programming languages. –Input: –source code, each class of the code is analysed

15. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 15 Evaluation Modules 2/5 EM Coding styleEM Coding style –Quality characteristics: –Maintainability – analysability –Technique: –Static analysis of the source code. This analysis is expected to be supported by an analysis tool. –Applicability: –Most programming language –Input: –source code

16. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 16 Evaluation Modules 3/5 EM Structural testingEM Structural testing –Quality characteristics: –Functionality – accuracy –Reliability – maturity –Technique: –Structural testing. The intention of this EM is to test specific classes that are identified by static measures as being statistically more likely to have many errors. –Applicability: –Object oriented programming languages –Input: –source code

17. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 17 Evaluation Modules 4/5 EM Functional testingEM Functional testing –Quality characteristics: –Functionality – accuracy –Functionality – interoperability –Reliability – maturity –Portability – adaptability –Portability - installability –Technique: –Functional testing –The purpose of this EM is both to check platform compliance and to check to functional abilities of the software product. –Applicability: –General –Input: –compiled code –user documentation

18. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 18 Evaluation Modules 5/5 EM Standards complianceEM Standards compliance –Quality characteristics: –Functionality – standards compliance –Technique: –Functional testing –This EM has a good potential for automating the test. –Applicability: –Standard specific –Input: –compiled code

19. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 19 GQCM: EMs and QA points of view Testing results could be virtually grouped in three summarizing points of view to have a more direct vision of what is evaluated :Testing results could be virtually grouped in three summarizing points of view to have a more direct vision of what is evaluated : – Quality – Platforms – Standards Quality Platforms Standards Good quality Medium quality Poor quality WindowsUNIXLinux OASIS: WS-I OGF: OGSA-BES MacOS

20. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 20 GQCM: Final Score Final score should be provided according to the following schema. The items which should be available for the users are:Final score should be provided according to the following schema. The items which should be available for the users are: –A table summarizing the results –A list of passed and non passed tests –All the important information as: –Software product (e.g. name, version, executable code, documentation..) –Platform (name, version, date) –Quality characteristics (name, evaluation result, evaluation module identification) –Standard compliance (for each standard: name, version, date) –Identification of evaluation report (organization, report number, date) –Identification of certification body (organization, contact information) –Certification data (dates, certification number) –Electronic signature of certification record

21. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 21 Summarizing Table structure EMStaticEM CodingEM StructuralEM FunctionalEM Std compl. FunctionalityXX AccuracyXX InteroperabilityX Compliance(X) ReliabilityXXX MaturityXXX MaintainabilityXX AnalyzabilityXX ChangeabilityX TestabilityX PortabilityX AdaptabilityX InstallabilityX

22. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 22 GQCM: Summarizing Table example Consolidated eval. result EM Static EM Coding EM structural EM Functional EM Std compliance EM eval. resultMMGGGY FunctionalityGGG AccuracyGGG InteroperabilityGG ComplianceY(Y) ReliabilityMMGG MaturityMMGG MaintainabilityMMG AnalyzabilityMMG ChangeabilityMM TestabilityMM PortabilityGG AdaptabilityGG InstallabilityGG G = Good M = Medium P = Poor

23. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 23 Do you see any cons? I can’t add any overhead to my projectI can’t add any overhead to my project –This model (and the capability of automate) will reduce the effort in performing continuous build and test activities (e.g. coverage tests) on different releases How much costs adopting it?How much costs adopting it? –Nothing, the model will be discussed publicly and the final version will be released under open license (e.g. Creative Commons) –The ETICS framework is provided as a service running on a dedicated infrastructure, free of charge for Research Project My organisation is certified ISO/CMMi so I…?My organisation is certified ISO/CMMi so I…? –See next slides… Other? Please criticise…Other? Please criticise…

24. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 24 GQCM integration in an ISO 9126 certified organization Facts:Facts: –ISO 9126 define quality attributes –GQCM support the measure and evaluation of quality metrics Hypothesis:Hypothesis: –ISO9126 Portability: adaptability, installability –ISO9126 asks OS adaptability and installability for software of certified organizations –GQCM may test deployment of SW on different platforms (HW+OS) –ISO9126 Maintainability: all. –ISO9126 asks to develop a software that is easy to analyse, easy to modify, Stable –GQCM metrics (such as the CK for OO or coding convetions metrics) helps to verify in concrete these requirements

25. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 25 GQCM integration in an ISO 9126 certified organization ISO9126 Functionality: accuracy.ISO9126 Functionality: accuracy. –ISO9126 asks that a software have to give results according with requirements. –GQCM certification can run functional test (or plug-in external test suits) of declared compliances. ISO9126 Functionality: adequacy.ISO9126 Functionality: adequacy. –ISO9126 asks for correct functions with specific goals. –GQCM may check not dead functions. Our thesis:Our thesis: –Many ISO9126 quality metrics can be measured and evaluated based on GQCM –Any tool implementing it and can be integrated as supporting ISO9126 adoption

26. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 26 GQCM integration in a CMMi certified organization FactsFacts –CMM is process oriented (it gives guidelines). –GQCM is product oriented. Hypotesis: Hypotesis: –CMM2 –asks to “control and value” –GQCM proposes the measures and metrics to be collected, hence controlling and evaluating specific sw related items –CMM3 –asks to “use internal standards and have a reference model” –GQCM proposes code and implementation conventions (how to organise and structure code, how to define tests, etc.)

27. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 27 GQCM integration in a CMM certified organization CMM4CMM4 –asks to “have measured and controlled processes using quantitative and statistical techniques” –GQCM proposes the continuous collection of quality data to perform trends analysis. CMM5CMM5 –asks to have an “improvement process and quality based on measurement” –GQCM provides numerical reference to set the improvement processes. –Our Thesis –GQCM is not in contrast with CMMI and can be integrated in organization as a tool to support CMMI adoption

28. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 28 Engineering: Certifications 1/2 All this work is born from internal needs ofAll this work is born from internal needs of –The research area –The production area Engineering is certified as follows:Engineering is certified as follows: –ISO 9001 –For all the ICT sector in which the organization is involved –Since 1994 ( ISO9001:2000 from December 2002) –CMM 2 –Since February 2005 –For all production divisions –NATO AQAP 2110/160 –Since December 1996 (from 1996 to 2005 there were different rules) The company is managing the process to be certified at level 3The company is managing the process to be certified at level 3

29. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 29 Engineering: Certifications 2/2 To reach the level 3 we are selecting tools for test and quality managementTo reach the level 3 we are selecting tools for test and quality management Engineering is developing Spago4Q (www.spago4q.org)Engineering is developing Spago4Q (www.spago4q.org)www.spago4q.org –integrated with other tools measure processes, performances and bugs. –Examples of calculated metrics: –Test Coverage –Anomalies distribution –Effort used to solve anomalies –Cost of not founded anomalies –Metrics about requirements –Metrics about risk management –…

30. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 30 Engineering: Certifications 2/2 GQCM + ETICS b&t tool will help to measure the left quality aspects as:GQCM + ETICS b&t tool will help to measure the left quality aspects as: –The quality of the code –The compliance with standards –The compliance with OS –…

31. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 31 Engineering: objectives and QA Engineering looks at:Engineering looks at: –Client satisfaction –Company success –Monitoring of the previous points Client satisfaction is seen as a necessary assumption to confirm and enhance Engineering’s successClient satisfaction is seen as a necessary assumption to confirm and enhance Engineering’s success The way to obtain it is the supply of quality productsThe way to obtain it is the supply of quality products Engineering has a Quality Management System (QMS) defined pursuing the following principles:Engineering has a Quality Management System (QMS) defined pursuing the following principles: –Client-oriented attitude –Continuous improvement –Focus on process –Involvement of all human resources

32. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 32 The QMS model based on UNI EN ISO 9001:2000 processes

33. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 33 QA and Engineering Engineering’s Quality Management System:Engineering’s Quality Management System: –involves the entire organizational structure –operates on processes –adopts procedures –uses resources

34. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 34 Engineering: Quality in projects Activities to reach the qualityActivities to reach the quality –identification, formalization, verification and filing of reference documentation (contractual and technical) –drafting a Quality Plan, a document listing project requirements, the operational and management choices aiming at the implementation of requirements –development in conformity with outlined production process –verification of intermediate and final results (concerning in particular the design, testing activities and documentation) –evolution management, during the different job phases and releases, of software and documentation; –check-ups of monthly work progress compared with the actual project planning; –formalization of project’s main events, through recurrent technical and work in progress meetings with the Client.

35. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 35 Engineering: Quality Plan 1/3 At the beginning of the project, the Project Manager should draft a “Quality Plan” that handle:At the beginning of the project, the Project Manager should draft a “Quality Plan” that handle: –Contractual documentation analysis –must be clear that the Project Manager has understood and verified all aspects concerning the contractual relationship with the Client –Project organization –defined in terms of –Resources –Roles –Responsibilities

36. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 36 Engineering: Quality Plan 2/3 –Product/service supply and project requirements –description on: –product/service to be supplied –product/service’s requirements –resolutions in case of eventual vagueness –evidence of possible divergences compared to the contractual documentation –Projecting and Development Process –the adopted process, used methodology, output, support tools –Configuration Management –what it has been decided for check of work-status of product components, for its back-up procedures

37. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 37 Engineering: Quality Plan 3/3 –Suppliers’ Management (sub-contractors) and interactions with Third Parties –only in presence of sub-supplies, even if internal –Materials to be delivered/activities to be carried out –all objects/materials to be delivered to Client or the activities to be carried out for the Client –Verifications and validations modes. –projecting and development verification (functional and technical); –validation of function projecting and development

38. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 38 Engineering: Quality Control 1/2 Quality Assurance and Internal Auditing Division has the responsibility:Quality Assurance and Internal Auditing Division has the responsibility: –to verify the execution of targeted activities to eliminate possible anomalies arisen –to identify, describe and execute corrective actions in order to eliminate anomalies’ causes –to identify, describe and carry out preventive actions in order to eliminate possible anomalies’ causes –to undertake any initiative which could improve the effectiveness and efficiency of the Quality Management System

39. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 39 Engineering: Quality Control 2/2 On an annual basis, this division drafts reports on details gathered by the different corporate divisions, regarding the fulfilment of Quality goals set at the beginning of the year, allowing the identification of possible improvementsOn an annual basis, this division drafts reports on details gathered by the different corporate divisions, regarding the fulfilment of Quality goals set at the beginning of the year, allowing the identification of possible improvements Control activities, on a periodical basis, carried out the Quality Assurance and Internal Audition Division within an IT project are classifies as follows:Control activities, on a periodical basis, carried out the Quality Assurance and Internal Audition Division within an IT project are classifies as follows: –official check-ups –content check-ups –work -in progress check-ups –results’ validation

40. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 40 Conclusions GQCM is a certification modelGQCM is a certification model –Automatable –Not in contrast with classical standards –Ready to be integrated with classical standards –Free –Not limited to the ETICS build and test tool –Not limited to research projects GQCM require less human effort to be used because it is almost fully automatableGQCM require less human effort to be used because it is almost fully automatable ETICS tool is ready to implement GQCMETICS tool is ready to implement GQCM

41. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 41 E-mail addresses We want it to be as simple and effective as possible to use. For this we need your feedback:We want it to be as simple and effective as possible to use. For this we need your feedback: ETICS-QAstudy@cern.ch ETICS-discuss@cern.ch ETICS-support@cern.ch

42. INFSOM-RI-026753 EGEE '07 Conference - Budapest 01-05/10/2007 42 Q&A http://www.eu-etics.org Acknowledgements:Acknowledgements: Many thanks for their contribution to Many thanks for their contribution to Daniela Vagheggini Daniela Vagheggini Gabriele Ruffatti Gabriele Ruffatti Andrea Manieri Andrea Manieri