1. Software Process Improvement: SEI Capability Maturity Model
COP 4331 and EEL4884
Processes for OO Software Development
© Dr. David A. Workman
School of EECS
University of Central Florida
April 20, 2010

2. Introduction
Reference: The Capability Maturity Model: Guidelines for Improving the Software Process, by Carnegie Mellon University, SEI, Addison-Wesley, 1994, ISBN=
Reference: The Capability Maturity Model for Software, by Paulk et al, Text[pp48-59]
History
Originally the vision of Watts Humphrey and produced by a team of SEI researchers including: Mark Paulk Bill Curtis Mary Beth Chrissis Ed Averill Judy Bamberger Tim Kasse Mike Konrad Jeff Perdue Charlie Weber Cindi Wise Jim Withey
Version 1.0 was released in August 1991
April 20, 2010

3. Motivation “Software Crisis”
“No Silver Bullet” (technology is only part of the solution)
Demand for more and more complex software systems have outstripped our ability to cope with changes required to meet these demands.
Organizations began to realize the fundamental problem is the inability to manage the software process!
Examples
A review of 17 major DOD contracts found that the average 28-month schedule was missed by 20 months!
Deployment of the B1 bomber was delayed by software problems and the $58 billion A12 aircraft program was canceled partly for the same reason.
GAO concluded a study of more than 20 large software projects with this statement, “The understanding of software as a product and of software development as a process is not keeping pace with the growing complexity and software dependence of existing and emerging mission-critical systems.”
April 20, 2010

4. Evolution
Humphrey’s Book, “Managing the Software Process” Addison-Wesley, “Characterizing the Software Process: A Maturity Framework,” IEEE Software, March 1988.
Method: Software Process Assessment An appraisal by a team of trained software professionals to determine the state of an organization’s current software process, to determine the most important process-related issues, and to obtain organizational support for improvement.
Method: Software Capability Evaluation An appraisal by a team of trained software professionals to identify contractors qualified to perform the software work or to monitor the state of the software process used on an existing software effort.
Maturity Questionaire
SEI Development and Release
SEI Influenced the ISO 9000 Standard series, specifically 9001.
April 20, 2010

5. Fundamental Concepts
The CMM focuses on the capability of software organizations to produce high-quality products consistently and predictably. Software process capability is the inherent ability of a software process to produce planned results.
DEFINITION (Process) A sequence of steps performed for a given purpose. The process integrates people, tools, and procedures.
DEFINTION (Software Process) A set of activities, methods, practices, and transformations that people employ to develop and maintain software and the associated products (documents, etc.)
DEFINTION (Software Process Capability)decribes the range of expected results that can be achieved by following a software process.
April 20, 2010

6. Fundamental Concepts
The CMM focuses on the capability of software organizations to produce high-quality products consistently and predictably. Software process capability is the inherent ability of a software process to produce planned results.
DEFINITION (Software Process Performance) the actual results achieved by following a software process.
DEFINTION (Software Process Maturity) the extent to which a specific process is explicitly defined, managed, measured, controlled, and effective. As a software organization matures, it needs an infrastructure and culture to support its methods, practices, and procedures so that they endure after those who originally defined them have gone.
DEFINTION (Institutionalization) is the building of infrastructure and culture to support methods, practices, and procedures so that they are the ongoing way of doing business.
April 20, 2010

7. Software Process Maturity Framework
Five Maturity Levels:
Initial: The software process is characterized by ad hoc, and occasionally even chaotic. Few processes are defined, and success depends on individual effort and heroics.
Repeatable: Basic project management processes are established to track cost, schedule, and functionality. The necessary process discipline is in place to repeat earlier successes on projects with similar applications.
Defined: The software process for both management and engineering activities is documented, standardized, and integrated into a standard software process for the organization. All projects use an approved, tailored version of the organization’s standard software process for developing and maintaining software.
April 20, 2010

8. Software Process Maturity Framework
Five Maturity Levels (continued):
Managed: Detailed measures of the software process and product quality are collected. Both the software process and products are quantitatively understood and controlled.
Optimizing: Continuous process improvement is enabled by quantitative feedback from the process and from piloting innovative ideas and technologies.
April 20, 2010

9. The CMM Level Structure
Maturity
Levels
Indicate
Contains
Process
Capability
Key
Process
Areas
Achieves
Organized by
Goals
Common
Features
Address
Contain
Key
Practices
Implementation/
Institutionalization
Describe
Activities or
Infrastructure
April 20, 2010

10. Key Process Areas Definition
Except for level 1, each maturity level is decomposed into several key process areas that indicate where an organization should focus to improve its software process. KPAs identify the issues that must be addressed to achieve a desired maturity level. If an organization is at level K+1 then it has addressed all of the KPAs at levels  K.
Each KPA identifies a cluster of activities that, when performed collectively, achieve a set of goals considered important for enhancing process capability.
The KPAs may be considered to be the requirements for achieving a particular maturity level.
Papers presented in class and your term project should be provide practical answers or insights to the following questions:
What personnel skills are required for a given KPA at a given level?
How many (what subset) of the organization's personnel are required to support a given KPA at a given level?
What tool support is necessary for a given KPA at a given level?
What are the training requirements (tools and methods) for a given KPA at a given level?
What project metrics/data should be collected for a given KPA at a given level?
What product metrics/data should be collected for a given KPA at a given level?
See Notes!
April 20, 2010

11. KPAs – Level 2
Focus: project concerns related to establishing basic project management controls.
Requirements Management (establish customer & user repoire, involve customer & users in the process)
Software Project Planning: (establish project management and engineering procedures)
Software Project Tracking and Oversight (make visible to the organization)
Software Subcontract Management (qualified subcontractors)(avoid disconnect in management and engineering maturity and capability)
Software Quality Assurance (make SQA visible to management)
Software Configuration Management (control access and change to engineering work products and project deliverables)
April 20, 2010

12. KPAs – Level 3
Focus: project and organizational issues leading toward the infrastructure that institutionalizes effective software engineering across all projects.
Organization Process focus: coordinate and integrate process across all projects.
Organization Process definition: develop a reusable set of process assets (documents, training materials) defining the organization’s standard software process (includes a tool set)
Training program: train personnel in the various process procedures and roles
Integrated Software Management:
Software Product engineering:
Inter-group coordination:
Peer Reviews:
April 20, 2010

13. KPAs – Level 4
Focus: establishing a quantitative understanding of both the software process and the software products being built (process and product metrics and measures).
Quantitative Process Management: develop the quantitative measures necessary to control process performance of software projects.
Software Quality Management: develop quantitative measures necessary to control the quality of software products.
Software Quality Metrics
Metrics Validation Process (IEEE Standard 1061)
April 20, 2010

14. KPAs – Level 5
Focus: addressing issues concerning organization and projects relating to continuous and measurable software process improvement.
Defect Prevention: detect causes of defects and prevent them from recurring.
Technology Change Management: identify beneficial new technologies (tools, methods, and processes) and transfer them into the organization in an orderly manner.
Process Change Management: continually improve software processes in the organization with the intent of improving software quality, increasing productivity, and decreasing the cycle time for product development.
April 20, 2010

15. Common Features Definition
Attributes that indicate whether the implementation and institutionalization of a KPA is effective, repeatable, and lasting. There are 5:
Commitment to perform:
actions the organization must take to ensure that the process is established and will endure; establish organizational policies and leadership.
Ability to perform:
defines the preconditions that must exist in the project or organization to implement the software process competently; resources, organizational entities, and training.
Activities to perform:
activities, roles, and procedures necessary to implement KPAs; create plans and procedures, tracking progress, taking corrective action when not done.
Measurement and analysis:
determine process status.
Verifying implementation:
steps to ensure compliance with process.
April 20, 2010

16. Level 2: Requirements Engineering Practices
Goals:
Requirements Management establishes common understanding (agreement) between customer and vendor of the customer's requirements addressed by the project.
It involves allocating system requirements to software modules or components.
The "agreement" covers technical and non-technical requirements (e.g. delivery dates) and forms the basis for estimating, planning, performing and tracking project activities.
To achieve control, the team reviews initial and revised system requirements allocated to software to resolve issues before they are incorporated in development. Whenever requirements change, the affected plans, work products, and activities are adjusted to remain consistent with the updated requirements.
System requirements allocated to software are controlled to establish a baseline for software engineering and management use.
Software Plans, products, and activities are kept consistent with the system requirements allocated to software.
April 20, 2010

17. CMM Key Practices by Level
Dr. David Workman
School of EE and CS
January 17, 2006

18. Level 2: Requirements Engineering Practices
Requirments Engineering Practices:
The team reviews allocated requirements before they are incorporated into development.
The team uses allocated requirements as the basis for software plans, work products, and activities.
Changes to allocated requirements are reviewed and incorporated into the software project.
April 20, 2010

19. Level 2: Software Planning Practices
Goals:
Software estimates (size, resources, schedule, risks, commitments) are documented for use in planning and tracking development.
Project activities and commitments are planned and documented.
Affected stakeholders agree to their commitments related to the project.
April 20, 2010

20. Level 2: Software Planning Practices
Software Project Planning Practices:
The development team participates on the project proposal.
The software project planning is initiated in the early stages of, and in parallel with, the overall project planning.
The software team participates with the other stakeholder planning groups throughout the project's life.
Project commitments made to individuals and groups external to the organization are reviewed with senior management according to a documented procedure.
Software development stages of manageable size are identified or defined.
The software development plan is developed according to a documented procedure.
The software development plan is documented.
April 20, 2010

21. Level 2: Software Planning Practices
Software Project Planning Practices:
The software work products that are needed to establish and maintain control of the project are identified.
Estimates for the size of software work products (or changes to their sizes) are derived according to a documented procedure.
Estimates for the project's critical computing resources are derived according to a documented procedure.
The project's schedule is derived according to a documented procedure.
The software risks associated with cost, resources, schedule, and technical aspects of the project are identified, assessed, and documented.
Plans for the project's software engineering facilities and support tools are prepared.
Software planning data are recorded.
April 20, 2010

22. Level 2: Project Tracking & Control Practices
Goals:
Actual results and performance are tracked against the software development plan; accomplishments and results (size, effort, schedule, cost) are compared with documented estimates.
Corrective actions are taken and managed to closure when actual results and performance deviate significantly from the software plans.
Changes to software commitments are agreed to by the affected stakeholders.
April 20, 2010

23. Level 2: Project Tracking & Control Practices
A documented software plan is used for tracking the software activities and communicating status.
The project's development plan is revised according to a documented procedure.
Software project commitments and their changes made by external stakeholders are reviewed by senior management according to a documented procedure.
Approved changes to commitments that affect the software project are communicated to the members of the development group and other software-related groups (e.g. tools, training, contracts, 3rd party vendors)
The size of software work products (or the size of changes to) are tracked, and corrective actions are taken as necessary.
The project's software effort and costs are tracked, and corrective actions are taken as necessary.
The project's critical resources (e.g. funds spent) are tracked, and corrective actions are taken as necessary.
April 20, 2010

24. Level 2: Project Tracking & Control Practices
The project's software schedule is tracked, and corrective actions are taken as necessary.
Software engineering technical activities are tracked, and corrective actions are taken as necessary.
The software risks associated with cost, resources, schedule, and technical aspects of the project are tracked.
Actual measurement data and replanning data for the software project are recorded.
The software development team conducts periodic internal reviews to track technical progress, plans, performance, and issues against the software development plan.
Formal reviews to address the accomplishments and results of the software project are conducted at selected project milestones according to a documented procedure.
April 20, 2010

25. Level 2: Subcontract Management Practices
Goals:
The prime contractor selects qualified software subcontractors.
The prime contractor and the software subcontractor agree to their commitments to each other.
The prime contractor and the software subcontractor maintain on-going communciation with each other.
The prime contractor tracks the software subcontractor's actual results and performance against its commitments.
The purpose of SSM is to select qualified software subcontractors and manage them effectively.
SSM involves selecting a software subcontractor, establishing commitments with the subcontractor, and tracking and reviewing subcontractor’s performance and results.
A documented agreement covering the technical and nontechnical requirements is established and is used as the basis for managing the subcontract. The work to be done by the subcontractor and the plans for the work are documented. The standards that are to be followed by the subcontractor are compatible with the prime’s standards.
The software planning, tracking, and control activities for the subcontracted work are preformed by the subcontractor. The prime ensures that these planning, tracking and control activities are performed appropriately and that the software products delivered by the subcontractor satisfy their acceptance criteria.
April 20, 2010

26. Level 2: Subcontract Management Practices
The subcontracted work is defined and planned according to a documented procedure.
The software subcontractor is selected based on an evaluation of the subcontract bidder's ability to perform the work, according to a documented procedure.
The contractual agreement between the prime and subcontractor is used as the basis for managing the subcontract.
A documented subcontractor's software development plan is reviewed and approved by the prime.
A documented subcontractor's software development plan is used for tracking the software activities and communicating status.
Changes to the software subcontractor's statement of work, terms and conditions, and other commitments are resolved according to a documented procedure.
The prime's management conducts periodic status/coordination reviews with the subcontractor's management.
April 20, 2010

27. Level 2: Subcontract Management Practices
Periodic technical reviews and interchanges are held with the subcontractor.
Formal reviews to address the subcontractor's accomplishments and results are conducted at selected milestones, according to a documented procedure.
The prime's software quality assurance group monitors the subcontractor's software quality assurance activities, according to a documented procedure.
The prime's software configuration management group monitors the subcontractor's configuration management activities, according to a documented procedure.
The prime conducts acceptance testing as part of the delivery of the subcontractor's software products, according to a documented procedure.
The subcontractor's performance is evaluated on a periodic basic, and the evaluation is reviewed by the subcontractor.
April 20, 2010

28. Level 2: Software Quality Assurance Practices
Goals:
Software quality assurrance activities are planned.
Adherence of software products and activities to the applicable standards, procedures, and requirements is verified objectively.
Affected groups and individuals are informed of software quality assurance activities and results.
Noncompliance issues that cannot be resolved within the software project are addressed by senior management.
The purpose of SQA is to provide management with appropriate visibility into the process being used by the project and the products being built.
SQA involves reviewing project products and activities to verify they comply with applicable documented procedures and standards.
SQA provides the software project and other designate managers the results of reviews and audits.
SQA works with the project team during its early stages to establish plans, standards, and procedures that will add value to the project and satisfy the constraints of the project and the organization’s policies.
April 20, 2010

29. Level 2: Software Quality Assurance Practices
A SQA plan is prepared for the software project, according to a documented procedure.
The SQA group’s activities are performed in accordance with the SQA plan
The SQA group participates in the preparation and review of the project’s software development plan, standards, and procedures.
The SQA group reviews software engineering activities to verify compliance.
The SQA group audits designated software work products to verify compliance.
The SQA group periodically reports the results of its activities to the software team.
Deviations identified in the software activities and software work products are documented and handled according to a documented procedure.
The SQA group conducts periodic reviews of its activities and findings with the customer’s SQA personnel, as appropriate.
April 20, 2010

30. Level 2: Software Configuration Management Practices
Goals:
Software configuration management activities are planned.
Selected software work products are identified, controlled, and available.
Changes to identified software work products are controlled.
Affected stakeholders are informed of the status and content of the software baselines.
The purpose of SCM is to establish and maintain the integrity of the products of the software project throughout the project’s life cycle.
SCM involves identifying the configuration of the software (i.e., selected software work products and their descriptions) at given points in time, systematically controlling changes to the configuration, and maintaining the integrity and traceability of the configuration throughout the software life cycle.
A software baseline library is established containing the software baselines as they are developed. Changes to baselines and release of the software products built from the baseline library are systematically controlled via change control and configuration auditing functions of the SCM.
Products placed under CM include customer deliverables and items that are required to create them (e.g. a compiler).
April 20, 2010

31. Level 2: Software Configuration Management Practices
An SCM plan is prepared for each software project according to documented procedure.
A documented and approved SCM plan is used as the basis for performing SCM activities.
A configuration management library system is established as a repository for the software baselines.
The software work products to be placed under configuration management are identified.
Change requests and problem reports for all configuration items/units are initiated, recorded, reviewed, approved, and tracked according to documented procedure.
Changes to baselines are controlled according to documented procedure.
Products from the software baseline library are created and their release is controlled according to documented procedure.
The status of configuration items/units is recorded according to documented procedure.
Standard reports documenting the SCM activities and the contents of the software baseline are developed and made available to affected stakeholders.
Software baseline audits are conducted according to documented procedure.
April 20, 2010

32. Level 3: Key Practices (Organization Process Focus)
Purpose: Organization Process Focus
To establish the organizational responsibility for software practice activities that improve the organization's overall software process capability.
This involves developing and maintaining an understanding of the organization's and project's software processes and coordinating activities to assess, develop, maintain, and improve these processes.
This is accomplished by establishing a software process group responsible for the organization's software process activities. It is responsible for developing and maintaining process standards for the organization, and it coordinates the process activities with each project.
Goals: Organization Process Focus
Software process development and improvement activities are coordinated across the organization.
The strengths and weaknesses of the software processes used are identified relative to a process standard.
Organization-level process development and improvement activities are planned.
April 20, 2010

33. Level 3: Key Practices (Organization Process Focus)
Organization Process Focus Practices:
The software process is assessed periodically, and action plans are developed to address the assessment findings.
The organization develops and maintains a plan for its software process development and improvement activities.
The organization's and project's activities for developing and improving their software processes are coordinated at the organizational level.
The use of the organization's software process database is coordinated at the organizational level.
New processes, methods, and tools in limited use in the organization are monitored, evaluated, and, where appropriate, transferred to other parts of the organization.
Training for the organization's and project's software processes is coordinated across the organization.
The groups involved in implementing the software processes are informed of the organization's and project's activities for software development and improvement.
April 20, 2010

34. Level 3: Key Practices (Organization Process Definition)
Purpose: Organization Process Definition
To develop and maintain a usable set of software process assets that improve process performance across the projects and provide a basis for cumulative long-term benefits to the organization.
Involves developing and maintaining the organizations standard software process, along with related process assets, such as description of software lifecycles, process tailoring guidelines and criteria, the organization's process database, and a library of process-related documentation.
Goals: Organization Process Definition
A standard software process is developed and maintained.
Information related to the use of the organization's standard process is collected, reviewed, and made available in a persistent form.
April 20, 2010

35. Level 3: Key Practices (Organization Process Definition)
Organization Process Definition Practices:
The organization's standard software process is developed and maintained according to a documented procedure.
The organization's standard software process is documented according to established organization standards.
Descriptions of approved software lifecycles available for use by projects are documented and maintained.
Guidelines and criteria for projects' tailoring of the organization's standard process are developed and maintained.
The organization's software process database is developed and maintained.
A library of software process-related documentation is established and maintained.
April 20, 2010

36. Level 3: Key Practices (Training Program)
Purpose: Training Program
To develop the skills and knowledge of individuals so they can perform their roles effectively and efficiently.
Involves identifying training needs.
Involves procuring the training agent and delivery system.
Goals: Training Program
Training activities are planned.
Training for developing skills and knowledge needed to perform software management and technical roles are provided.
Individuals in the software engineering group and software-related groups receive the training necessary to perform their roles.
April 20, 2010

37. Level 3: Key Practices (Training Program)
Training Program Practices:
Each software project develops and maintains a training plan that specifies its training needs.
The organization's training plan is developed and revised according to a documented procedure.
The training for the organization is performed in accordance with the organization's training plan.
Training courses prepared at the organization level are developed and maintained according to organization standards.
A waiver procedure for required training is established and used to determine whether individuals already posses the knowledge and skills required to perform in their designated roles.
Records of training are maintained.
April 20, 2010

38. Level 3: Key Practices (Integrated Software Management)
Purpose: Integrated Software Management
To integrate the software engineering and management activities into a coherent, defined software process that is tailored from the organization’s standard software process and related process assets, which are described in the Organization Process Definition.
Involves developing the project’s process defined software process and managing the project using that defined software process; the defined project software process is tailored from the organization’s standard process to address specific project characteristics.
Goals: Integrated Software Management
The project’s defined software process is a tailored version of the organization’s standard process.
The software development plan is based on the project’s defined process.
The management of the project’s size, effort, cost, schedule, staffing, and other resources are tied to the project’s defined process.
April 20, 2010

39. Level 3: Key Practices (Integrated Software Management)
Integrated Software Management Practices:
The project’s defined software process (pdsp) is developed by tailoring the organization’s standard software proces (ossp) according to a documented procedure(adp).
Each pdsp is revised adp.
The software project’s software development plan, which describes the use of the pdsp, is developed and revised adp.
The software project is managed in accordance with the pdsp.
The ossp database is used for software planning and estimating.
The size of the software work products (or the size of their changes) is managed adp.
The project’s software effort and costs are managed adp.
The project’s critical computer resources are managed adp.
The critical dependencies and critical pats of the project’s schedule are managed adp.
The project’s software risks are identified, assessed, documented, and managed adp.
Reviews of the software project are periodically performed to determine the actions needed to bring the software project’s performance and results in line with the current and projected needs of the business, customer, end users, as appropriate.
April 20, 2010

40. Level 3: Key Practices (Software Product Engineering)
Purpose: Software Product Engineering
To perform consistently a well-defined engineering process that integrates all the software engineering activities to produce correct, consistent software products effectively and efficiently.
Involves performing the engineering tasks to build and maintain the software using the project’s defined software process and appropriate methods and tools.
Goals: Software Product Engineering
The software engineering tasks are defined, integrated, and consistently performed to produce the software.
Software work products are kept consistent with one another.
April 20, 2010

41. Level 3: Key Practices (Software Product Engineering)
Software Product Engineering Practices:
Appropriate software engineering methods and tools are integrated into the pdsp.
The software requirements are developed, maintained, documented, and verified by systematically analyzing the allocated requirements according to the pdsp.
The software design is developed, maintained, documented, and verified according to the pdsp, to accommodate the software requirements and to form the framework for coding.
The software code is developed, maintained, documented, and verified according to the pdsp, to implement the software requirements and software design.
Software is testing is performed according to the pdsp.
Integration testing of the software is planned and performed according to the pdsp.
April 20, 2010

42. Level 3: Key Practices (Software Product Engineering)
Software Product Engineering Practices:
System and acceptance testing of the software are planned and performed to demonstrate that the software satisfies its requirements.
The documentation that will be used to operate and maintain the software is developed and maintained according to the psdp.
Data on defects identified in peer reviews and testing are collected and analyzed according to the pdsp.
Consistency is maintained across software work products, including the software plans, process descriptions, allocated requirements, software requirements, software design, code, test plans, and test procedures.
April 20, 2010

43. Level 3: Key Practices (Intergroup Coordination)
Purpose: Intergroup Coordination
To establish a means for the software engineering group to participate actively with the other engineering groups so the project is better able to satisfy the customer's needs effectively and efficiently.
Involves the software engineering group's participation with the other engineering groups to address system-level requirements, objectives, and issues.
Goals: Intergroup Coordination
The customer's requirements are agreed to by all affected groups.
The commitments between engineering groups are agreed to by the affected groups.
The engineering groups identify, track, and resolve intergroup issues.
April 20, 2010

44. Level 3: Key Practices (Intergroup Coordination)
Intergroup Coordination Practices:
The software engineering group and the other engineering groups participate with the customer and end users, as appropriate, to establish the system requirements.
Representatives of the project's software engineering group work with representatives of the other engineering groups to monitor and coordinate technical activities and resolve technical issues.
A documented plan is used to communicate intergroup commitments and to coordinate and track the work performed.
Critical dependencies between engineering groups are identified, negotiated, and tracked according to a documented procedure.
Work products produced as input to other engineering groups are reviewed by representatives of the receiving groups to ensure that the work products meet their needs.
Intergroup issues not resolvable by the individual representatives of the project engineering groups are handled according to a documented procedure.
Representatives of the project engineering groups conduct periodic technical reviews and interchanges.
April 20, 2010

45. Level 3: Key Practices (Peer Reviews)
Purpose: Peer Reviews
To remove errors from the software work products early and efficiently.
Involve a methodical examination of software work products by the producer's peers to identify errors and areas where changes are needed.
Goals: Peer Reviews
Peer review activities are planned.
Errors or required changes in software work products are identified and removed.
April 20, 2010

46. Level 3: Key Practices (Peer Reviews)
Peer Reviews Practices:
Peer reviews are planned and plans are documented.
Peer reviews are performed according to a documented procedure.
Data on the conduct and results of the peer reviews are recorded.
April 20, 2010