Software Quality ManagementUnit – V

G Roy Antony ArnoldG oy to y o dAsst. Prof. / CSE

and refersand refersto a development model that was createdft t d f d t ll t d fafter study of data collected fromorganizations that contracted with the

h, whofunded the research.

Th C bilit M t it M d l (CMM)• The Capability Maturity Model (CMM) wasoriginally developed as

.• The CMM is based on the

first described in the bookby

.• It was later published in a report in andas a book by the same authors inas a book by the same authors in .

i bli h dYear Version Published

1987 Software Process maturity framework (Humphrey)

1987 Preliminary maturity questionnaire (Humphrey and Sweet)

1987 Characterizing the software process: a maturity framework (Humphrey)

1989 Managing the software process (Humphrey)

1990 Draft version of CMM (v0.2)

1991 Version for discussion (v0.6)

1991 v1.0: Capability Maturity Model for Software (Paulk et al.) ‘K i f h C bili i d l’ (W b l )‘Key Practices for the Capability Maturity Model’ (Weber et al.)

1993 v1.1: Capability Maturity Model for software, version 1.1 (Paulk et al.)Key practices for the Capability Maturity Mode version 1 1 (Paulk et al )Key practices for the Capability Maturity Mode, version 1.1 (Paulk et al.)

Th h thi f th fi ld f• Though this comes from the field of , it is used as a general model to 

aid in improving organizational businessaid in improving organizational business processes in diverse areas; Such as,

A t it d l b• A maturity model can be that describe how well the 

of an organization can 

. A t it d l id f l• A maturity model may provide, for example :– a place to start– a common language and a shared vision– a common language and a shared vision– a framework for prioritizing actions– a way to define what improvement means for your y p yorganization.

• A maturity model can be used as 

: a 5‐level process maturity continuum ‐ the5th level where processes would be systematically managedby a combination of

.: a KPA identifies a cluster of related

activities thatactivities that, .the goals of a key process area summarize the states

that must exist for that key process area to have beenthat must exist for that key process area to have been.

: There are five types of commonypfeatures:

.

Focus on Process Improvement

Process measured and controlled

Process characterized for the organization 

Process characterized for projects and is often reactive.

f gand is proactive.

Processes Unpredictable, poorly controlled and reactive

Level Designation Description

1 Initial The organization has undefined processes and controlscontrols 

2 Repeatable The organization has standardized methods facilitating repeatable processes.

3 Defined The organization monitors and improves its processesprocesses

4 Managed The organization possesses advanced controls, metrics and feedback.

5 Optimizing The organization uses metrics for optimization purposes.p p

L k f I t ti• Lack of Integration:– CMM has separate models for each function.– Such models often overlap contradict and displaySuch models often overlap, contradict, and displaydifferent levels of maturity.

– This lack of standardization leads to confusions andfli t d i th i l t ti h dconflicts during the implementation phase and

increase training and appraisal costs.• Limitations of KPA:

– The “Key Performance Areas (KPA),” that define CMMlevels focus on “policing” activities such asspecifications documentation audits andspecifications, documentation, audits, andinspections, and do not reveal architecturallysignificant flaws.

A ti it b d A h• Activity‐based Approach: – CMM is an activity‐based approach that considersonly the completion of a specific activity andonly the completion of a specific activity, andnot whether the completed activity achieved thedesired results.

• Paperwork: – CMM places great importance on paperwork and 

ti th t t k th t’ ti dmeetings that take the management’s time and effort away from actual work processes. 

– CMM traps the organization in recording andCMM traps the organization in recording and complying with processes, often at the cost of strategic goals.

A l i l i l d l h i d• Applying multiple models that are not integratedwithin and across an organization could be costlyin training appraisals and improvementin training, appraisals, and improvementactivities.

• TheThe(CMMI) project was formed to sort out theproblem of using multiple CMMs.p g p

• The Software Engineering Institute at CarnegieMellon University developed Capability MaturityModel Integration (CMMI) in 2006 to integrateand standardize the separate models of CMM,and to eradicate other dra backs of CMMand to eradicate other drawbacks of CMM.

CMMI b t ti bli h d i d t• CMMI best practices are published in documentscalled models, each of which addresses a differentarea of interest.

• The current release of CMMI, version 1.3, (released inNovember 2010) provides models for three areas ofinterest: development acquisition and servicesinterest: development, acquisition, and services.– CMMI for Development (CMMI‐DEV) addresses product

and service development processes.CMMI f A i iti (CMMI ACQ) dd l h i– CMMI for Acquisition (CMMI‐ACQ) addresses supply chainmanagement, acquisition, and outsourcing processes ingovernment and industry.CMMI f S i (CMMI SVC) dd id f– CMMI for Services (CMMI‐SVC) addresses guidance fordelivering services within an organization and to externalcustomers.

i l dMaturity Level 2 ‐Managed• CM ‐ Configuration Managementg g• MA ‐Measurement and Analysis• PMC Project Monitoring and Control• PMC ‐ Project Monitoring and Control• PP ‐ Project Planning• PPQA ‐ Process and Product Quality Assurance

• REQM ‐ Requirements Management• SAM Supplier Agreement Management• SAM ‐ Supplier Agreement Management

M t it L l 3 D fi dMaturity Level 3 ‐ Defined• DAR ‐ Decision Analysis and Resolution• IPM ‐ Integrated Project Management• IPM  Integrated Project Management• OPD ‐ Organizational Process Definition• OPF ‐ Organizational Process Focusg• OT ‐ Organizational Training• PI ‐ Product Integration• RD ‐ Requirements Development• RSKM ‐ Risk ManagementTS T h i l S l ti• TS ‐ Technical Solution

• VAL ‐ Validation• VER ‐ Verification• VER  Verification

Maturity Level 4 ‐ Quantitatively Managed• OPP ‐ Organizational Process Performance OPP  Organizational Process Performance• QPM ‐ Quantitative Project ManagementMaturity Level 5 ‐ Optimizing• CAR ‐ Causal Analysis and Resolution• CAR  Causal Analysis and Resolution• OPM ‐ Organizational Performance Management

• A i ti t b tifi d i CMMI i t d• An organization cannot be certified in CMMI; instead, anorganization is appraised.

• Depending on the type of appraisal, the organization can bed d t it l l ti (1 5) bilit l lawarded a maturity level rating (1‐5) or a capability level

achievement profile.• Many organizations find value in measuring their progress by

d ti i l A i l t i ll d t d fconducting an appraisal. Appraisals are typically conducted forone or more of the following reasons:– 1. To determine how well the organization’s processes compare

t CMMI b t ti d t id tif hto CMMI best practices, and to identify areas whereimprovement can be made

– 2. To inform external customers and suppliers of how well theorganization’s processes compare to CMMI best practicesorganization s processes compare to CMMI best practices

– 3. To meet the contractual requirements of one or morecustomers

C b i d i diff• CMMI can be appraised using two different approaches: staged and continuous. 

• The staged approach yields appraisal results as one of five maturity levels. 

• The continuous approach yields one of six capability levels. 

• The differences in these approaches are felt only in the appraisal; the best practices are y pp ; pequivalent and result in equivalent process improvement results.p

A t it l l i ll d fi d l ti l t• A maturity level is a well‐defined evolutionary plateau toward achieving a mature software process. 

• Each maturity level provides a layer in the foundation y p yfor continuous process improvement.

• The maturity levels are measured by the achievement of the specific and generic goals that apply to eachof the specific and generic goals that apply to each predefined set of process areas. 

• There are five maturity levels designated by the y g ynumbers 1 through 5– 1) Initial– 2) Managed– 2) Managed– 3) Defined– 4) Quantitatively Managed– 5) Optimizing

A bilit l l i ll d fi d l ti l t• A capability level is a well‐defined evolutionary plateaudescribing the organization's capability relative to aprocess area.

• capability levels are cumulative, i.e., a higher capabilitylevel includes the attributes of the lower levels.

• In CMMI models with a continuous representation• In CMMI models with a continuous representation,there are six capability levels designated by thenumbers 0 through 5.– 0 ‐ Incomplete– 1 ‐ Performed– 2 ‐Managed2 Managed– 3 ‐ Defined– 4 ‐ Quantitatively Managed

i i i– 5 ‐ Optimizing

lLevel CMM CMMILevel 1 (Initial)

Both describes an immature organization without anydefined processes, run in an ad‐hoc, uncontrolled, and(Initial)  defined processes, run in an ad hoc, uncontrolled, andreactive manner

Level 2 ( bl )

Organizations repeati

Requires management ofi i l i(Repeatable)  some processes to attain

Level 2.organizational requirementsthrough planned, performed,measured, and controlledprocesses.

Level 3 (Defined)

Mandates a set ofdocumented standard

It is an improvement of CMMI Level 2 and describes the(Defined) documented standard

processes to establishconsistency across the

i ti

Level 2 and describes the organizational processes in standards, procedures, tools, dmethodsorganization. and methods.

Level CMM CMMI

Level 4 (Managed)

Requires organizationsto attain control over

Also identifies sub processes that significantly contribute to 

processes by usingquantitative statisticaltechniques.

overall process efficiency.

Level 5 (Optimizing)

Mandates use ofquantitative tools and

Focuses on continuouslyimproving process(Optimizing) quantitative tools and

objectives to manageprocess improvement.

improving processperformance throughincremental and innovativet h l i l i ttechnological improvements.

CMMI supersede CMM in software developmentprocesses but CMM is still relevant and appropriate forprocesses, but CMM is still relevant and appropriate forsequential, activity‐based management paradigm.

CMM CMMIWhile CMM is a certification tool. A i ti i tifi d

CMMI is not certification tool. An i ti i i d dAn organization is certified. organization is appraised and 

awarded a rating from 1 to 5CMM measures the maturity level CMMI is also an activity basedyof an organization by determiningif an organization completes thespecific activities listed in the Key

yapproach but the major differenceis that CMMI takes a more result‐oriented approach when definingspecific activities listed in the Key

Performance Areas (KPA),oblivious to whether thecompletion of such activity leads

oriented approach when definingand measuring Key PerformanceAreas.

completion of such activity leadsto the desired result.

CMM CMMICMM KPA concentrates on thecompletion of specific tasks or

CMMI has an iterative lifecyclethat integrates the latest bestcompletion of specific tasks or

processes and does not motivatethe organization to focus onprocess architecture

that integrates the latest bestpractices from the industry andattacks risks in processarchitecture at an early stageprocess architecture. architecture at an early stage.

Paper work in CMM is concernedat recording processes.

CMMI documentation andmeetings focus on strategic goalsof the organizations.

Simply, CMM has focusedattention on processes

CMMI goes a step further andfocus attention on result‐orientedattention on processes. focus attention on result‐orientedprocesses.