Monday, March 24, 2008

What tool should we use for our Process Asset Library?

Do you have any recommendations for software to properly manage a Process Area Library? We currently have Sharepoint but there has to be something out there that is much better for hosting a PAL. Any suggestions?

Sure, MS Sharepoint works pretty good . . . . woops, sorry! I just read your email.

This is a hot topic that every organization struggles with. It's a decision that needs to be made early so that you can capture the early deliverables for your process development project.

There are many tools to choose from. Actually, Sharepoint CAN be a decent tool for this, if it's configured properly, is available to all, and has the full-text seach add-on installed. And best of all, it's free!

Some clients I work with use their code management tools (tracker, SubVersion, CVS, et al) for this, although I find this problematic and difficult to use. Others use any number of document management tools like Documentum or LiveLink.

One of my favorites is CollabNet, a tool that essentially combines your PAL with your project repository - it's web based and (I think) is very affordable.

Finally, many companies just use simple directories with a web front end. This makes it possible to create a slick interface that is intuitive and easy to use.

The key rule of thumb for me is that all of your process assets be accessible, easy to locate and copy, that the system have the ability to record usage statistics, revisions, document attributes, and provide appropriate reports.

Wednesday, March 19, 2008

Live from the SEPG Conference in sunny Tampa, FL

The following is live 'blogged from Jeff's "Ask the CMMI Appraiser" session at SEPG 2008.

Under what circumstances would you remove an ATM?

The appraisal team needs to be cohesive and productive team and will be working long hours in cramped conditions. Sounds like a plumber!

There are two conditions under which I would remove an appraisal team member.

The first is when the ATM is being so disruptive that the team cannot work effectively. This included bullying (to get people to agree with them), excessive arguing, being lazy (not pulling their load), being consistently late, or just being plain disgusting in some way.

The second is if it is discovered that their is conflict of interest - if an ATM is the manager of projects or groups being interviewed, or if they are related to any of the interviewees, or if some other condition exists that may cloud their judgment - such as if they were the author of many of the processes being evaluated. Don't laugh, it happens!

Are Agile and the CMMI Compatible?

Yes, of course they are. CMMI is methodology agnostic and although it may read like a "waterfall" method, it isn't. I've seen many organizations implement agile processes that work well for CMMI. As a matter of fact, by far the largest number of failures in the implementation of process is with "waterfall" projects.

When you’re starting out with process definitions in a very small organization is it standard to stop development until definitions are defined?

This is what I call the "changing the engine while the car is racing" questions. If only this could be done, our job would be easy! No, I would not recommend this. A better approach would be to incrementally develop and deploy process in many small pieces, allowing people to focus 95% of their time on engineering tasks, and 5% on the develop and deployment of process. If rolled out in several releases over time it can be relatively painless.

What the heck is a technical data package?

The term Technical Data Package, or "TDP," for those of you "in the know" is your set of work products associated with design, coding, and testing of your application. This set should be well understood, well defnined, and having a reasonably standard look and feel.

What is a technical data package in an Agile environment?

Not much different than in a traditional environment, although medium and complexity can differ. For instance, a whiteboard drawing that is photographed and stored in a project repository can be an acceptable alternative to a Visio diagram.

Is it possible for a LA to conduct an Appraisal without the LA actually being onsite?

There is nothing in the MDD that says that an LA MUST be on site at all times - although an appraisal conducted this way would be very difficult to perform, and possibly could result in an innacurate result. Understanding the context of the organization is the most important thing for an LA and I can't imagine how this could be done remotely.

Are there any conditions where a LA would choose not to continue on with the Appraisal?

Yes. One example is if the organization being appraised has been coached on their answers in an effort to fool the LA into thinking they are doing something they are not. People always think they can fool us, but it's so obvious when they do it I feel bad for them.

Another scenario is when they're just not ready for an appraisal. There’s a lot of high pressure during appraisals and if its discovered that it is going to lead to an unsuccessful appraisal, I might tell them to wait a few months and try again.

Live blogging from Tampa FL at the SEPG Conference 2008

Friday, March 14, 2008

Where do we start for DAR?

We don’t have any process defined for DAR. We want our firm to achieve Level 3 maturity but we have to start from scratch. How to go about it? Can we have a policy and a guideline for DAR process and integrate in our product creation process? What tools can we use to facilitate DAR?

DAR, or Decision Analysis and Resolution, is a ML3 Process Area that is used to help us make complex decisions in during times of stress and chaos. It is a structured process that uses guidelines and criteria to drive decisions that might otherwise be driven by emotion, money, or vendor favors (like golf, tickets, or cash).

DAR starts with guidelines that determine WHEN it should be used (such as "DAR is always used for product selection"). Then there are criteria and methods defined to help you make the decision.

Like of CMMI PA's, it's perfectly fine to integrate it into your "product creation" processes. In fact, the PA Technical Solution, or TS, takes advantage of DAR in the very first practice.

You can start with some simple guidelines and some spreadsheets that help you manage scoring or setting of criteria. From there you can grow a "DAR Library" that can be reusable from project to project.

Thursday, March 13, 2008

German Company Blows CMMI Quiz

A certain German company that specializes in SPICE has been trying hard to break into CMMI in the North American market. They've showed up in my backyard a few times. Their monthly "CMMI Quiz" that they spam across our nation just came to my mailbox this morning. I answer this quiz (correctly mind you . . . ) every month within two minutes of receiving it, but do I ever win the $50 gift certificate? Well this month they really revealed their knowledge of CMMI with this winner-of-a-quiz:

A CMMI Maturity Level 5 organization must have…

a: All Process Areas at Capability Level 5
b: At least the Process Management Process Areas at Capability Level 5
c: All Process Areas minimally at Capability Level 3 and at least one selected sub-process at Capability Level 5
d: The Maturity Level 5 Process Areas at Capability Level 5

Do any of you blog'sters see what's wrong here? Remember, they asked about "Maturity Level 5." Here was my response in the quiz email:

My answer is: NONE OF THE SELECTIONS ARE CORRECT! Wow. I’m amazed at this!

The correct answer is “All Maturity Level Two and Three Process Areas performing at Maturity Level Three AND selected sub-processes from those 18 PA’s performing at ML5.

In order to be performing ML5 you must have implemented baselines and models (OPP), quantitatively managed the sub-processes (QPM), used statistical data to select and pilot innovations (OID), and implement those innovations (CAR) on selected sub processes. But there is no requirement for all PA’s to be performing at CL5, or ML5 for that matter.

Your use of “Capability Level” throughout this betrays your lack of understanding of model representations.

Here's the breakdown:

a: All Process Areas at Capability Level 5

Not correct. We don’t “mix” Capability and Maturity Levels like this. One uses the Continuous Representation, the other the Staged Representation. There is an “Staged equivalency”, but this is not how it is applied. If using the staged approach, GG4 and GG5 DO NOT APPLY

b: At least the Process Management Process Areas at Capability Level 5

Not correct. They may be part of this, but we would not include just those, and I doubt we would statistically manage OID and CAR.

c: All Process Areas minimally at Capability Level 3 and at least one selected sub-process at Capability Level 5

Not correct. This may be close, but but no cigar. Only one sub process would not pass muster with the SEI AND we would not mix “Capability Level” and “Maturity Level” like this

d: The Maturity Level 5 Process Areas at Capability Level 5

Not correct. Again, we would not mix these, and there is no requirement to perform GG4 and GG5 if using the Staged Representation.

Keep studying guys - I hope you're clients aren't reading this!

How do we apply the CMMI if all we do is Code and Test?

There are some projects in our company which are comprised of only coding and unit level testing activities. All the other activities ( requirements gathering, analysis, design, monitoring (task priority, taks allocation, system testing ) are all handled by our customer. How are these type of projects handled by the CMMI?

Projects of this nature, if they truly have no other tasks other than coding and unit testing, can still use and follow the relevant CMMI process areas.

For purposes of an appraisal, assuming you have other projects that DO utilize a full life cycle, you could make those projects your "focus" projects and the coding/testing projects as "non-focus" projects.

That said, it's hard for me to imagine how a project can only have "coding and testing." Don't they work from a plan? Don't they capture metrics realted to what they're doing? Don't they practice CM? QA? Are tasks not monitored and controlled?

And how about requirements? Are you saying that your project teams don't discover, or "derive" requirements that the customer didn't think of? I'm not sure that's even possible!

If you think about it, even in the scenario you've described, most of the relevent process areas are represented.

Yea, it's depressing, I know. But suck it up.

Wednesday, March 12, 2008

How does the CMMI compare to TS and other manufacturing performance models?

We are a manufacturer and the use of CMMI has been mandated by our customers, whilst this fits well with 85% of the organisation which is software manufacture it is hard to fit it to the hardware manufacture side; especially when one compares them with manufacturing specific models like APQP/TS 16949.

When one does a gap analysis on TS, RD, VAL, VER, and PI versus the 24 disciplines in APQP there is a large gap around the area of “design for excellence” (DFMA, D and P FMEA, MSA, PPAP etc.).

How easy is it to hybridize the model and still satisfy external appraiser’s requirements? When will we see a constellation for manufacturing? Am I the only person wrestling with this issue?
Is the answer really 42?

The CMMI is best suited for software, although it can be applied elsewhere. Here in the US, defense contractors who are required to achieve CMMI ML2 or 3 tend to segment off their software organizations for their appraisals and declare their manufacturing operation “out of scope.” This is allowed in the CMMI model, and is known as an “organizational unit,” but some companies choose to submit the entire company to an appraisal. If you believe you need or want to included your entire company in an appraisal you should not have any trouble making it work for you (and to benefit from it).

You’re right, TS is better suited for manufacturing – although in practice it isn’t that much different than CMMI. At its core it’s nothing more than a product management behavioral model – it does not instruct a company “how” to do anything – it’s merely a set of guidelines of “what” should be done.

If you analyze the text of the PA’s you’ll see it is broken into “Goals” and “Practices” (both the Generic and the Specific variety). The Goals are required and could apply to almost any type of industry, and are not really software specific. The practices (at least the Specific variety) are NOT required, but expected, and they DO read like a software process. From purely an appraisal perspective, you could replace the Specific Practices with some that are more appropriate for your manufacturing environment, and meet the Goals using those as “alternative practices.” This is perfectly acceptable in the CMMI and as an appraiser I would not have any trouble “passing” an organization that took this approach.

As to the gap analysis you’ve described, you are not comparing “apples to apples.” In listing the CMMI “engineering” PA’s and comparing them to DFMA, FMEA, etc you are leaving out the PA’s such as OPP/QPM, OID/CAR which would play a role and be integrated with VAL and VER to form the equivalent. Unlike other process models, the CMMI is a highly cross-functional interdependent model and needs to be viewed as a system – not stand alone PA’s.

I would recommend that you do a high-level mapping of how the CMMI would align with the more manufacturing specific model. I think you’ll find that they are equivalent with a little bit creative integration – and that is the way the model is intended to be used. I admit it’s not as clean as we may like it to be – but it does work.

You will want to meet with and explore your Lead Appraiser’s intellectual flexibility on this – not everyone has a “systems of systems” capability and it will require this to successfully understand how you’re applying the CMMI model. Contrary to myth, not all LA’s are brilliant and wise!

I wouldn’t expect the a manufacturing – or other industry specific – constellation anytime soon. It’s not a constellation that’s on the “horizon.” The next release will be “SERVICES.” And no, you’re not the only one wondering about this.

If the answer is not “42” it’s “B.” Either one will yield the same result J

Can the CMMI be used for Manufacturing?

Can you advise on how readily applicable the CMMI is to a conventional manufacturing environment, I understand from the book and other SEI publications that the model is infinitely tailorable but when you get down to the SP level it is very software centric.

Well, that would have something to do with it being written by the "Software" Engineering Institute!

The CMMI is a process model for product development, and the Goals are the required components. The PRactices are expected, and DO often read like a software product model, but they can be replaced with alternatives of your choosing - as long as those alternatives add up to achieving the Goals in each Process Area.

So yes, the CMMI could be used, and often is, in a manufacturing environment. It's a great set of guidelines for product and project management.

Is the Configuration Management Plan the same as "Plan for Data Management" in Project Planning

Does a Configuration Management Plan satisfy the pratice "SP 2.3 Plan for Data Management"?

You will likely get many different ideas on this . . . I would start with the notion that it COULD if all of the appropriate information is in the CM plan.

Some will say no, a CM Plan is distinct from this practice. That's true if you interpret the CM plan in its most narrow form, but I would argue that even the term "configuration management" is something in our industry that means many things to many people, so it's not beyond the realm of possibility to include "project data" as part of the plan.

As practical appliers of process, we are able to interpret artifacts in any way we please, as long as they satisfy the minimum requirements - why not let the artifacts work harder and satisfy the MAXIMUM requirements - and include things like "project data," roles& responsible for the artifact (geez, maybe a little GP2.7, GP2.2, GP2.3 . . . ) and who approves them, when they're audited, and by whom (oh, a little more CM "evidence" here) and so on?

I borrow a concept from the building industry where they architect rooms and buildings that "work harder." A gym that is also a meeting place that is also a performance space. Why have more artifacts than you need? Make the one's you have work harder.Just remember that the intention of the practice is to plan for the management of all data produced by the project - including things like test data, customer files, and other work products not always traditionally placed under "configuration management.

"Think agile, and reduce the burden on your practitioners. Engineers will love you for it.

Should we use Six Sigma as well as CMMI?

We're just starting out with CMMI and my manager says we should employe Six Sigma to manage our metrics. Does that make sense?

Six Sigma is a set of methods for gathering, analyzing, and acting on information derived from statistal analysis of performance data. The CMMI is a process model. The two CAN co-exist with one another.

Whether or not a company has adopted CMMI has no bearing on their ability to apply 6Sigma techniques, of course, but the viability of the results are skewed by the lack of “standard process performance.” The degree of skew is a risk management problem – how much flawed data is a manager willing to work with? Starting with the assumption that data is ALWAYS flawed, it comes down to how much risk are they willing to manage? Even when you apply Stastical Process Control to software the data is always flawed. But even flawed data can be helpful DEPENDING on how it’s used. This type of conversation seems to open their eyes a bit to the use of statistical data.

So yes, techniques like 6Sigma CAN be applied at any time – but the value and accuracy of the data they produce increased as process stability increases. This may have nothing at all to do with CL by the way. The absence of a policy, for instance, may not affect data accuracy (especially in small organizations). Sometimes, depending on the client, I advise them to put 6S on hold until they’ve reached some level of stability. One could argue that it’s a “waste” until CMMI ML5, but I don’t think so – there is value to the data at all levels (assuming we know what we’re looking at and why).

What's the difference between a performed, managed, and defined process?

I'm confused about the three different types of processes in the CMMI - Performed, Managed, and Defined? Aren't they all just defined?

Well, to be more precise there are FIVE process types in the model - the three you mentioned plus "Quantitative" and "Optimizing." Those two represent ML4 and ML5 - but I digress.

The three process “types” you’ve asked about each have different attributes.

A “performed” process may be improvised, has no policy, training, QA, et al, but includes the basic practices needed to execute the process on a project.

A “Managed” process has all of the attributes of the “performed” process but is executed in accordance with a policy, is planned, has resources assigned, people are trained, etc (all of the GPs for GG2).

A "Defined" process is a process composed using the organizations set of standard processes following a set of guidelines and is improved over time. (GG3). The process that results from any of these may or may not include everything needed to complete a project from start to finish (for example, it could address only Requirements Management and not Project Planning). It does, however, typically include much of what is needed in practice and ALWAYS “lives” within a project.

Just to add to the confusion, a “Tailored” process IS a Defined process. A Defined Process IS a “Tailored” process. If a Managed” process is tailored, is derived from a set of standard processes, and the “user” contributes to the PAL and measurement repository, it is a “defined process.”

Finaly, an “institutionalized” process can be either a “managed” process (GG2) OR a “defined process.” (GG3). The Generic goals indicate the "degree" of institutionalization.

Whew! And we're just getting started!

How we do know if a company is really CMMI Maturity Level Three?

We're speaking to some suppliers and they're saying that they are CMMI Maturity Level Three, but they are not in the SEI's list of published appraisal results. Are they trying to pull the wool over our eyes?

When a SCAMPI A Appraisal is submitted to the SEI there is a document, the Appraisal Disclosure Statement (ADS), that the appraisal sponsor initials to indicate whether he/she wants the results posted on the SEI’s website (PARS). It is not a requirement that they be posted – although in my experience most want it posted with the exception of those who need to maintain confidentiality (e.g.; defense contractors, intelligence agencies, et al). If a company claims to be CMMI MLx, and they are not in the database, you may ask to see a copy of their ADS as proof that they are indeed MLx and that their appraisal results are current.

The ADS is the “official” appraisal document and should be retained and managed by the appraisal sponsor.

How do interfaces get defined if we're not using an object oriented language?

I have a question about interfaces: If an organization doesn't design or build using Object-Oriented Programming, how can internal interfaces be interpreted? As documentation of functions or procedures invoked?

Even "procedural" programs have interfaces - both intra- and inter-program interfaces.

If you're asking about internal interfaces, or intra-program interfaces, you might consider that interface descriptions and standards are a big part of this - just as much as it might be in an OOP world. These are practices that are contained with Technical Solutions, or TS, in the CMMI Model.

"C" functions have interfaces too, of course, except they're often defined by data structures that are passed, or pointers to pointers of data structures - but they're still interfaces that need to me defined and managed. Of course, OOP makes this simpler and easier to maintain, but that's another discussion!

Tuesday, March 11, 2008

Anyone going to SEPG 2008?

Well, it's that time of year again - time to head down to Tampa for the biggest geek-fest of all time, the SEI's SEPG 2008!

We're heading down this Sunday night, and it will be a welcomed change for the 10 degrees and ice that we have in Detroit (and in Rochester, NY where I am right now). If you haven't made plans yet it's not too late.

This year will be a great show - a number of our friends are speaking, including our pal Hillel from Baltimore with his ever-present passion and energy for integrating Agile and CMMI, Pat O'Toole will be giving his usual, and I'll be presenting both a "Poster Session" on Monday and Tuesday in the main hall, and then talking about our blog, "Ask the CMMI Appraiser" on Wednesday at 4:20 in the main ballroom. That session will be "Live Blogged" with Jill Mannaioni at the keyboard.

This just in! We'll be having a panel discussion with Mike Konrad (off CMMI and SEI fame), Hillel, David Anderson, and myself on Wednesday evening to present our joint paper, "CMMI and Agile: Why not choose both?" This is sure to attract a crowd and be entertaining. Did you know Mike K. earned a PhD at 16?

Of course they'll be lots of parties, dinners, and receptions to attend, and a room full of vendors. I'm looking forward to seeing our friend Frank Koch from Process Strategies, and my all time favorite SEI guy, Steve Masters.

The SEI Member lunch and award session will be a blast, as will the SEI Partner lunch with a special guest, Watts Humphrey, as the speaker.

I just found out I'll be doing a video interview with the SEI's marketing department on Tuesday - should be loads of fun!

See you all in Tampa!!!!!