Err:510 Sheet1 MESSAGE IDENTIFIER: ISO/IEC JTC1/SC7/Secretariat/SC7_NEWS-95-51 Err:510
ISO/IEC JTC1/SC7 N1446 1995-09-29
TITLE: ISO/IEC JTC1/SC7 Position and comments on ISO/TC 176/SC 2/N 274 ISO/CD 9000-3 Quality management and quality assurance standards Guidelines for the application of ISO 9001 to the design, development, supply, installation and maintenance of software.
SOURCE: SC7/WG8
STAGE: CD
WORK ITEM:
REFERENCES: SC7/95-136, ISO/TC 176/SC 2/N 274, JTC1/SC7 N1279, SC7 Resolutions 415,416 and 417.
ACTION: Information and appropriate action.
Faxed to ISO/TC176/SC2 Secretariat with cover letter in SC7/95-169. A copy of JTC1/SC7 N1279 (SC7_NEWS-94-66) has
Page 1
Sheet1 also been annexed to the cover letter with the instruction that it be considered as part of SC7 comments to CD 9000-3.
Francois Coallier
ISO/IEC JTC1/SC7 Secretariat
============================================
09/28/95 Marv Kaplan IBM ISO/IEC JTC1/SC7/WG8 Life Cycle Support Processes
3395 North Orchard Pl. Tucson Az. 85712 , USA Marv @ VNET.IBM.COM Tel. [phone] Fax [phone]
_________________________________________________________________ Mr. Francois Coallier Secretariat ISO/IEC JTC1/SC7
ISO/TC 176/SC 2/N 274 - ISO/CD 9000-3 application of ISO 9001 to the design, development, supply, installation, and maintenance of software.
Dear Francois
Page 2
Sheet1 WG8 has significant concerns with this document and must strongly recommend that ISO/CD 9000-3 not be promoted to DIS in its present form.
Please note that the number in parenthesis at the beginning of each ennumerated comment refers to the most applicable of the seven positions enunciated in ISO/IEC JTC1/SC7 N1279 (SC7_NEWS-94-66) "POSITION OF ISO/IEC JTC1/SC7 REGARDING ISO 9000-3" published on 1994-10-12 (Electronically on 1994-09-07).
Please forward WG8 comments to Mr. Charles Corrie Secretariat of ISO/TC176/SC2 for appropriate disposition.
General Issues
ISO/CD 9000-3 does not provide the guidance which is required to apply ISO 9001:1994 to the design, development, supply, installation, and maintenance of software.
The following five fundamental problems associated with ISO/CD 9000-3 must be corrected:
SC7 N1279
(4)
1. ISO/CD 9000-3 does not provide the philosophical founda-
Page 3
Sheet1 tion that would allow the elements of ISO 9001 to be directly applied to software. The relationship of
software development to ISO 9001:1994, 4.4 Design Control and 4.9 Process Control needs to be clarified.
Software development as defined by ISO/CD 9000-3 defines development as "All activities to be carried out to create a software product", in terms of the activities specified in ISO/IEC 12207-1 Development Process that would include ments analysis, System architectural design, Software requirements analysis, Software architectural design, Software detailed design, Software integration, Software qualification testiing, System integration, and System qualification testing.
Software production encompasses all those activities required to physically build the software deliverables, store them, replicate them, protect them, deliver them, install them, and service them. In terms of the activities specified in ISO/IEC 12207-1 this would include the Development Process activities of Software installation, and Software acceptance support tivities of Acceptance and completion activities of Delivery and completion.
Page 4
Sheet1 ISO/CD 9000-3 does not recognize the distinction between development and production as it relates to software. This distinction needs to be clearly defined and enunciated.
ISO/CD 9000-3 should be rewritten to explicitely recognize that ISO 9001:1994 4.4 is the operative element for software development.
ISO/CD 9000-3 should be rewritten to explicitely recognize that ISO 9001:1994 4.9, 4.11, 4.12 and 4.13 are related to software production and not software development.
ISO/CD 9000-3 must be very careful in its recommendations relative to ISO 9001:1994 4.10 activities. ISO/CD 9000-3 should not commingle 4.10 development activities with 4.10 production activities.
It would be beneficial if ISO/CD 9000-3 recommended that 4.10 activities related to software development be explicitely included in design and development planning as called for by ISO 9001:1994 4.4.2.
(2)
2. ISO CD/9003 should be restructured to follow the same numbering sequence as ISO 9001:1994. The lack of a com-
Page 5
Sheet1 mon numbering sequence and a clear 1:1 relationship between ISO 9001 elements and ISO 9000-3 guidance is a continuing source of confusion to the software industry.
(4)
3. The terminology in ISO/CD 9000-3 is inconsistent, not completely defined, and often in conflict with itself. This should be corrected.
(1)
4. ISO/CD 9000-3 expands the scope of ISO 9001 by adding new requirements (see specific comments). ISO/CD 9000-3 is a guidance standard and must not add requirements over and above those in ISO 9001:1994.
(3)
5. The definitions, processes, activities, and tasks identified in ISO/CD 9000-3 are inconsistent with those identified in ISO/IEC 12207-1. ISO/CD 9000-3 should insure that its guidance is not in conflict with the software sector specific standard ISO/IEC 12207-1.
Specific Comments:
(2)
a. Introduction Paragraph 3 - This paragraph is incorrect in its premise and should be rewritten.
The software development environment has evolved significantly since 1991. The Personal Computer has
Page 6
Sheet1 become a ubiquitous tool for the home and office. The internet has become a commonly used mechanism for collaborative computing. Software development is done using visual tools, and object oriented languages. The development methodology of choice is no (5) longer the waterfall method. The Software life-
cycle process standard ISO/IEC 12207-1 has been published and defines softwares primary, supporting, and organisational processes, along with their activities, and tasks.
The need for a simple to use ISO 9000-3 is a major requirement of the software community and should be met by changing the form and structure of ISO/CD 9000-3 so that it uses the same numbering scheme as ISO 9001:1994 and provides appropriate software guidance for each ISO 9001 element.
(3)
b. ISO/CD 9000-3 scope statement should include all the primary life-cycle processes identified by ISO/IEC 12207-1. The scope statement doesn't include acquisition and operation - it should. The scope statement uses the terms maintenance and servicing interchangeably. than servicing. It should use maintenance rather
Page 7
Sheet1 The scope statement states that the guidelines are applicable in situations when "product requirements are stated principally in performance terms", this should be expanded to include the situation where product requirements are stated principally in terms of functional capability or performance.
(3)
c. Normative References - ISO/IEC 12207-1 should be added.
()
d. Note 1 - There was no annex C in the draft copy we received.
(4)
e. Definitions - The omissions in this section significantly reduce the usefulness of ISO 9000-3. Definitions for the following should be added.
- Aspects.
- Build.
- Configuration item.
- Design.
This definition must explain the relationship
Page 8
Sheet1 between "design", "implementation",(see 5.6.1) and "development" (as used in 5.7.1).
- Design Input.
By cross-referencing ISO 9001:1994 4.4.4 to ISO/CD 9000-3, 5.3.1-5.3.3 it appears that the authors of ISO/CD 9000-3 intend to limit "design input" to one "customer requirements" input (as is frequently portrayed in the Waterfall Model).
In ISO/CD 9000-3 5.3.1, the customer requirements specification is referred to as a "significant element of design input".
In ISO/CD 9000-3 5.4.2 (E), there are references to "inputs" and "outputs" for each (development) "phase".
In addition, ISO 9001:1994 4.4.7 refers to "design stage outputs" and "design stage inputs".
These conflicts and contradictions between singular usage and plural usage should be resolved.
- Design Output.
Page 9
Sheet1
Same as comments for Design Input.
- Maintenance.
This definition should clarify the relationship of maintenance as it relates to software development, and as it relates to servicing.
- Production.
Production must be defined as it relates to software development. This is particularly
critical for establishing how ISO 9001:1994 clauses 4.9, 4.10, 4,11, 4.12, and 4.13 should be applied to software.
The lack of a well reasoned philosophical foundation that clarifies the relationship between ISO 9001:1994 4.4 "design" as it is used in "software development" and ISO 9001:1994 4.9-4.13 "production" et al as it is used in "software development" leads to much of the software industries dissatisfaction with ISO 9000-3.
Page 10
Sheet1 - Servicing.
This definition should clarify the relationship of servicing as it relates to software development, and as it relates to maintenance.
- Software Configuration Item.
- Stage.
Clarification is required in relation to phase, step, point.
(4)
f. 3.2 Development - This must be reconciled with the definitions for "design" and "implementation".
(3)
g. 3.3 Implementation - Implementation is not defined in ISO/IEC 12207-1 therefore this reference is incorrect. Change "Implementation" to "Development" and then the reference to ISO/IEC 12207-1 would be correct.
(3)
h. 3.4 Lifecycle model - lifecycle model is used throughout ISO/CD 9000-3 in either a hyphenated or non-hyphenated form. ISO/IEC 12207-1 uses the hyphenated form "life-cycle". It is recommended that
Page 11
Sheet1 ISO/CD 9000-3 use the hyphenated form.
This reference is confusing in that it refers to 12207-1 which has more processes than those described in ISO/CD 9000-3 (eg. Operation and Acquisition). Please clarify.
(2)
i. 3.5 Phase - Recommend consistent use of stage or phase throughout.
Note that "stage" is used in ISO 9001:1994 4.4.6, and 4.4.7.
(3)
j. 3.6 Software - This definition limits software to MIS types of software. It fails to recognize that software is not limited to a "data processing system". Perhaps a better definition would be "Intellectual creation or adaptation comprising the programs, rules, data, tools, and any associated documentation pertaining to the operation of a computer."
(4)
k. 3.8 Software Item - This definition doesn't give any guidance as to what "identifiable" means, what a "step" is nor what the "final step" is. Clarification is also required in relation to "configuration
Page 12
Sheet1 item", and "software configuration item".
(3)
l. Verification - Since verification continues to be used in ISO/CD 9000-3 this definition should be retained from ISO 9000-3:1991.
(3)
m. Validation - Since validaion continues to be used in ISO/CD 9000-3 this definition should be retained from ISO 9000-3:1991.
(1)
n. Note 4 - What is a "post-implementation review" as opposed to a review held "following software development". Recommend that this sentence be rewritten as follows "Management reviews should also consider the output from reviews held at project completion."
(4)
o. 4.2.3.2 C - It is not clear whether this refers to ensuring compatibility among procedures (e.g., development and maintenance) as well as between procedures and documentation. Recommend rewriting as
"Ensuring compatibility among the development, supply, and maintenance processes and between processes and their applicable documentation.
(4)
p. 4.2.3.2 E - Development or testing techniques, tools, or metrics cannot exceed the state of the
Page 13
Sheet1 art. Recommend rewriting as "Where requirements for development or testing techniques, tools, or metrics exceed the state of the art..."
(4)
q. 5.1 - Agreed life-cycle model - Please clarify who the parties to this agreement are.
(4)
r. 5.2.2 Paragraph 1 - This paragraph is confusing, recommend rewriting is as follows, "Whether software is being developed in response to a contract, as a product available for a market sector or in support of the business processes of the supplier, the agreement contract or order should address the following issues:"
(1)
s. 5.2.2 - The subparagraphs a-e include much non software specific information that should be removed. The subparagraphs a-? should address software specific isues such as, licensing, copyright, software ownership, software transferrability, intellectual property confidentiality rights, and protection of software assets, life-cycle requirements, definition of operational environment, acceptance test, product cutover, training, operational support, maintenance, escrowing, etc..
Page 14
Sheet1 (2) t. 5.3.2 Customers Requirements Specifications - It is exceedingly unusual for a customers requirement specification to be a "complete, unambiguous set of functional requirements". The normal state of affairs is to iterate on the requirements until both the acquirer and the supplier are satisfied. This
section should be consistent with ISO 9001:1994 4.3.2 and only require that the "requirements are adequately defined and documented". Specific software guidance should be consistent with ISO/IEC 12207-1 and should be a subset of the pertinent activities and tasks identified in 12207-1.
(3)
u. 5.3.3 Mutual cooperation - The need for cooperation should be defined and documented during the contract phase. Specific software guidance should be con-
sistent with ISO/IEC 12207-1 and should be a subset of the pertinent activities and tasks identified in 12207-1 Supplier and Acquirer processes.
(4)
v. 5.3.3 Mutual Cooperation - The meaning of the word "aspects" at the end of this paragraph is not clear. "Aspects" has been used in 5.3.2 to describe attributes. Does it mean "activities" in 5.3.3.
(5)
w. 5.3.3 b - An effort was made in 5.3.2 to distinquish
Page 15
Sheet1 "iterative" from "incremental" development, why is only "iterative" mentioned here. Recommendation would be to drop the phrase "expecially during iterative processes".
(4)
x. 5.3.3 New item - add "methods for agreeing on schedule and resource modifications caused by changes to requirements".
(7)
y. 5.4.1
Note 13 - This note should be a definitive
statement and specifically identify the applicable standards i.e ISO/CD 10006 and ISO/IEC 12207-1.
(3)
z. 5.4.2 A - The phrasing "and with reference to" is awkward. Recommend changing it to read "..including both a statement of objectives and references to..."
Specific software guidance should be consistent with ISO/IEC 12207-1 and should be a subset of the pertinent activities and tasks identified in 12207-1.
(4)
aa. 5.4.2 G - What is meant by "associated deliveries" ?
(4)
ab. 5.6.1 Design and Implementation General - This paragraph defines "design and implementation activities" with the same definition used in 3.2 for "develop-
Page 16
Sheet1 ment". The second paragraph of 5.7.1 refers to the "design or implementation process', and the third paragraph, to "stages in the software design and development process". These terms must be clarified here, defined in clause 3, and used consistently throughout ISO 9000-3.
(3)
ac. 5.6.1 - This section should provide guidance on how to get from customer requirements to software design. Specific software guidance can be found in ISO/IEC 12207-1. This section should draw heavily on the activities and tasks enumerated in the 12207-1 Development Process.
(3)
ad. 5.6.1 Note 16 - ISO/IEC 12207-1 does not reference Implementation. This note could be changed to read "Identification of development activities and tasks can be found in ISO/IEC 12207-1".
(2)
ae. 5.6.4 Implementation - This clause states, "relates either to clause 4.4 or 4.9 of ISO 9001:1994." How can it be one or the other? What criteria is used to determine which applies ? This should be resolved by limiting 4.9 to production and 4.4 to development.
Page 17
Sheet1 (4) af. 5.6.5 Design Output -
There appears to be a word missing in the first sentence "...required output from each -WHAT?- should be...".
The construction of the second and third sentences appear to differentiate between "design output", and "the outputs of each phase". This appears to conflict with the usage in 5.3.2 and 5.4.2., also note the use of "design and development" development has been previously defined to encompass design. Please clarify.
(2)
ag. 5.7 - ISO 9001:1994 treats 4.4.6 Design review, 4.4.7 Design verification, and 4.4.8 Design validation as equal level activities specifically related to design. They should be treated as equal level activities by ISO/CD 9000-3. ISO 9001:1994
treats test 4.10.3 differently, ISO/CD 9000-3 should also treat it differently. The design activities and test activities should not be commingled.
(4)
ah. 5.7.1 Paragraph 2 - This paragraph by saying "design or implementation" makes a specific distinction between "design" and "implementation". ISO/IEC
Page 18
Sheet1 12207-1 uses the term development to encompass these activities, one term should be selected and used consistently. This paragraph states "when the consequences resolved" consequences do not get resolved. This paragraph states "...proceeding
otherwise is known" the meaning of this clause is not clear. Recommend rewriting this paragraph as follows "It is recommended that the development process should proceed when all known deficiencies are satisfactorily resolved or the risk of proceeding has been evaluated and deemed acceptable."
(2)
ai. 5.7.1 Paragraph 3 - This paragraph refers to ISO 9001:1994 4.10.3, it would seem that the operative clauses should be 4.4.6, 4.4.7, and 4.4.8.
(1)
aj. 5.7.2.2 Design Reviews - The second sentence states that problems trigger unscheduled design reviews. ISO 9001:1994 4.4.6 states that "At appropriate stages of design, formal documented reviews of the design results shall be planned and conducted." As ISO 9001 doesn't have provision for unscheduled design reviews triggered by problems this is a requirement beyond the scope of ISO 9001.
(1)
ak. 5.7.2.2 Paragraph 2 - What does a "design verifica-
Page 19
Sheet1 tion review procedure" refer to? Recommend dropping "verification" as the following paragraphs seem to define a design review procedure.
(3)
al. 5.7.2.2 first list item - The parenthetical statement "(individual or group)" can have many interpretations. Recommend deleting "(individual or
group)". The statement "at what point" requires definition of "point", recommend replacing the statement with "What is to be reviewed, and which development activities are to be reviewed". The development activities enumerated in ISO/IEC 12207-1 can be used as a guide.
(1)
am. 5.7.2.2 next to last list item - This sentence is making a distinction between "problems" and "recommendations". Does this mean problems get fixed, and recommendations get planned and developed? Recom-
mend changing this to read "...to ensure that issues identified at the review are resolved".
(2)
an. 5.7.4 Validation - This states "this clause relates to clause 4.10.4 of ISO 9001", ISO 9001 4.4.8 Design Validation would appear to be the operative clause.
(1)
ao. 5.7.4 Validation - The requirement to record differ-
Page 20
Sheet1 ences in environment is a significant new opportunity for nonconformance. There is no related
requirement in ISO 9001. Recommend deleting last sentence in this paragraph.
(2)
ap. 5.7.5.1 Test Planning - This section commingles the requirements of ISO 9001:1994 4.4.6, 4.4.7, 4.4.8, 4.10, and 4.11. This section should very clearly identify which test activities may be required during "development" and that they should be included in the "design and dev...