SPICE to ASPICE – standards evolution and implementation

Market competition in the software industry is leading to a steady increase in innovation and product quality. For companies in the sector to remain relevant the market, it is important to apply solutions that help them keep up with market pressure. Without the steady improvement of software development processes, it is nearly impossible to achieve adequate quality and efficiency. Implementing special standards such as ISO 15504 or Automotive SPICE helps to deliver proper results. In this article we are taking a look at these standards, their evolution and the benefits that come from implementing them in a company.

What is SPICE (ISO15504)?

ISO 15504 also known as SPICE (Software Process Improvement and Capability Determination) is an international norm made in collaboration between International Organisation for Standardisation (ISO) and International Electrotechnical Commission (IEC). Originally, SPICE was funded by the European Union and was its response to CMMI. The SPICE standard is prepared for software companies and its main goal is to assess and improve the capability of the development process.

The SPICE standard is designed to help identify the stages of software development that need improvement in order to make a holistic impact on improving the quality of products developed in the industry. The model can also be used to measure the effectiveness of the process. There are various models of evaluating software companies, but one of the most commonly used in the world is the ISO 15504 standard. According to ISO 15504, evaluation of the software production process should focus on project planning, project management, software development and organisational processes.

There are several stages in the SPICE certification process:

• Initial evaluation
• Process development
• Applying processes in your company’s software projects
• Final evaluation
• Certification

In the evaluation process, SPICE uses its own PAM (Process Assessment Model) that helps define the capability of processes within an organisation. It takes a two-dimensional approach and defines:

• Process Dimension – focuses on all fundamental indicators to evaluate the capability of a process, like base practises and work products.
• Capability Dimension – focuses more on general indicators of process capability such as generic practises, general resources, and generic work products.

ISO 15504 provides a framework based on 6 levels of capability on a scale from 0 to 5, that are measured by 9 process attributes:

Each process attribute is evaluated in a four-point rating scale:

• Not achieved (little or no evidence of the attribute in the process)
• Partially achieved (some evidence of the attribute in the process, and some aspects still unpredictable)
• Largely achieved (significant evidence of the attribute in the process, but some variation may exist)
• Fully achieved (the attribute is fully and consistently found in the process).

With grading assigned to each attribute and each process, we can create an assessment profile that can take various forms like tables or graphs.

The SPICE standard doesn’t contain strict regulations for assessment. Instead, it defines the basic scope of requirements, that must be complied with to conduct an assessment in line with the ISO/IEC 15504 guidelines.

The ISO/IEC 15504 model can be used in companies of different sizes and different areas of operation. The standard does not pay attention to the internal structure or business philosophy of the software company. Nor is it built for a specific software technology or development process. The model is intended to provide the basic requirements for quality software engineering.

From ISO 15504 to ISO 33000

In time ISO 15504 needed to evolve, therefore its numbering scheme was changed to ISO/IEC 33000. With that modification, the norm had a complete technical and conceptual overhaul on process assessment and now also offers in-depth review of the topic both for software developing organisations and for those who outsource such services. ISO 33000 revises ISO 15504 and provides a framework for assessment to cover the processes used in the development, maintenance and application of systems across IT area, and also those deployed in the design, improvement and delivery of services. In contrast to ISO 15504 one of the main objectives of ISO 33000 is to provide a global framework for process evaluation and a final framework for improvement processes and management systems. Results of assessment stay similar, which means it can help with improvement of process performance and identification of risks associated with the use of processes. In general, the actualisation to ISO 33000, was made to create a more complete and up-to-date standard.

ASPICE as the evolution of SPICE

Besides the change involved in ISO 15504 numbering modification, SPICE itself also evolved. The influence of various industries has played an important role in this process. The ISO/IEC 15504 norm is focused on software in general. Therefore, after the release of SPICE several process assessment models and extensions were developed for more specified industries, for example:

• Automotive SPICE
• Medi SPICE – Medicine
• Hardware Engineering SPICE
• Mechanical SPICE
• Test SPICE
• Agile SPICE
• S4S – SPICE for SPACE – Space Technology
• SPICE in Action – Experiences in Tailoring and Extension

ASPICE or Automotive SPICE is one of the norms that evolved from ISO 15504. As its main focus it provides best practices and processes in terms of automotive software development. Therefore, we can define ASPICE a lot like SPICE itself, as an assessment model that provides a framework for defining, implementing and evaluating software development processes. With the difference that it is applied only to the automotive industry and its own crucial demands.

ASPICE certification can give a guarantee that improvements are made at every stage of the production process. ASPICE also works in context of ISO-26262 and ISO SAE 21434. Despite differences, the standards are complementary to each other and can provide a better software development process.

The structure of the Automotive SPICE model is very similar to ISO 15504. In the evaluation process, it also uses the two-dimensional framework of Process Dimension and Capability Dimension. Both are rated by the same scale of 6 levels of capability, 9 attributes of process assessment and achievement scale presented by 4 letters (N, P, L, F).

This evaluation model relates to the V-model, which includes a testing phase alongside every stage of development. ASPICE uses VDA scope, which can be defined as a minimal set of processes. This model, on its left side of the V, includes initial phases, such as:

• SYS.1 – Requirements Elicitation – phase is out of VDA scope, which means we can use it, but it is not required by OEM
• SYS.2 – System Requirements Analysis
• SYS.3 – System Architectural Design
• SWE.1 – Software Requirements Analysis
• SWE.2 – Software Architectural Design
• SWE.3 – Software Detailed Design and Unit Construction

And on its right side of the V, it includes secondary phases, like:

• SYS.4 – System Integration and Integration Test
• SYS.5 – System Qualification Test
• SWE.4 – Software Unit Verification
• SWE.5 – Software Integration and Integration Test
• SWE.6 – Software Qualification Test

This assessment rating provides more control over the software development process and helps to ensure product quality, timely release and, by identifying problems quickly, reduces the cost impact on product development.

Benefits from implementing SPICE and ASPICE

Since the standards are very much alike, they also share some benefits that come from using those assessment models. It is easy to find advantages from using these standards, among them, we can highlight the following:

• Identification of tasks and competences that are important for the process.
• Structuring and standardisation of processes.
• Gives the possibility to measure quality of the development of software.
• Motivating process engineers to make the best use of resources in a way to meet organisation goals.
• Helps to establish a culture of continuous improvement in the company.
• Helps increase recognition in the market and trust in the company’s products.
• Detect and correct possible failures at each stage of a project.
• Increase customer satisfaction.

Implementation of those standards helps with addressing any type of dysfunction in a software project while following common guidelines in all of them.

Using SPICE or ASPICE has the potential to reduce costs, missteps, and work time. Limitation of defaults and defects in the software developing process is especially important in the case of the automotive industry since it may prevent the manufacturer from putting a vehicle with flaws on the market.

Those standards can also improve contact with clients. They help to avoid miscommunications and provide greater transparency between producers and their business partners. From a client’s perspective, they can also be useful for measuring the maturity of a process in a supplier’s company and for determining the capabilities of a potential technology partner.

Another important advantage is related to the maturity of a process and its correlation with product maturity. Usually, the more a mature process is, the higher product maturity is. Which translates to finding out and fixing possible product faults at an early stage of the development process. All that also supports cost reduction, while encouraging innovation despite limited resources.

The importance of using SPICE and ASPICE in organisation

With all the value from the benefits shown here, the main reason to implement SPICE or ASPICE in a company still should be the need of being a competitive producer in a software market. In many cases, especially in the automotive industry, without those certificates it is hard to find partners or clients. Implementation of those standards helps to show who is a reliable cooperation partner.

Use of ASPICE seems to be crucial in the automotive industry. Since it requires both suppliers and customers to be very strict about the products they put on the road, the mutual use of a standards’ certification such as ASPICE simplifies work by ensuring the same approach. An approach that puts quality and safety first, for all parties involved in the process.

In Spyrosoft we see even more value in using those standards. As practitioners with a lot of experience in implementing both SPICE and Automotive SPICE, we also like to expand our portfolio to other standards related to safety and cybersecurity. Here, experience in ASPICE is a great advantage, because a lot of security and safety standards like FuSa are built on a base similar to the one in ISO 15504. Therefore, for us the extra value in using ASPICE is also treating it as a basic framework, that we already have and that helps with the implementation of other standards. In many cases, it means that we already have the base, and now we only need to adjust and add missing pieces to be compliant with other standards, for example with FuSa.

In conclusion, not having SPICE or ASPICE in a company can result in lack of confidence from other firms and business partners. While implementing those can have multiple benefits in terms of both product development processes and the business aspects of the company.

If you want to know more about automotive standards and safety norms, check out our ASPICE and FuSa offer.