Lesson 7 of 16 · Automotive SPICE, the vital 20 %
Level 3: the standard process and the defined process
At level 2 a project manages itself. At level 3 the organisation owns the process: one standard process, tailored per project by stated rules, and improved from what projects report back.
A reviewer checks a design against the architecture checklist and logs three findings, all later closed. Which GP?
Does "every hardware-in-the-loop (HIL) regression run finishes within 24 h of a merge to main" work as a GP 2.1.1 objective for SWE.6?
Traceability is kept in a spreadsheet and checked by hand before each release. Acceptable, or a weakness?
Two kinds of process
| Term | Meaning | Rated in |
|---|---|---|
| Standard process | The organisation's reference description: activities, inputs and outputs, roles, guidance, templates, and tailoring guidelines. | PA 3.1 Process definition |
| Defined process | What one project actually uses: the standard process, selected and tailored by the guidelines. | PA 3.2 Process deployment |
"The process defined is organization wide and no longer project specific"[Guidelines §5.1.1, p. 255]. Remember the level rule: level 3 also needs PA 1.1, 2.1 and 2.2 all at F.
PA 3.1: the standard process
| GP | What must exist |
|---|---|
| 3.1.1 | The standard process: activities with inputs and outputs, their sequence and interactions, roles with their involvement (e.g. a RASIC matrix: who is Responsible, Approves, Supports, is Informed or Consulted), guidance and templates, tailoring guidelines with "predefined unambiguous criteria", and maintenance from feedback. |
| 3.1.2 | Required competencies for each role, and how people acquire them. |
| 3.1.3 | Required resources and infrastructure: tools, licences, labs. |
| 3.1.4 | Methods to monitor whether the standard process works, such as lessons learned, compliance checks, audits or change requests. |
Source: PAM §5.4.1, pp. 106–108.
Rules from the Guidelines that decide most PA 3.1 ratings[Guidelines §5.1.2.1, pp. 256–258]:
- Missing activity descriptions, or missing inputs and outputs: GP 3.1.1 no higher than P (PA3.1.RL.2, RL.3).
- No template, but detailed content requirements exist: not downrated (RL.6).
- The tailoring guidelines don't say who tailors and who approves: downrated (RL.14).
- The same deviation keeps being approved by waiver without updating the standard process: downrated (RL.15). A recurring exception is a sign the standard process is wrong.
PA 3.2: deploying it
| GP | What must be shown |
|---|---|
| 3.2.1 | The project's defined process was selected or tailored from the standard process, conformance was verified, and it is used as the managed process. |
| 3.2.2 | People are assigned to the roles by competency, gaps are found and closed. |
| 3.2.3 | The resources and infrastructure are actually available and used. |
| 3.2.4 | Data on the defined process is collected and analysed, and fed back to improve the standard process or the defined process. |
Source: PAM §5.4.2, pp. 108–109. The tailoring decisions and their rationale must be documented, and conformance checked by an authorised role[Guidelines §5.2.2.1, p. 262].
What level 3 does not look at: configuration management and storage of the process descriptions themselves, the process-description tools, or staffing for process improvement. Those belong to PIM.3 or other models, so "weaknesses regarding these aspects must not lead to any downrating on capability level 3"[Guidelines, p. 254]. What GP 3.1.1 does check is version control of the standard process as a definition: a unique version identifier, documented changes between versions, and clear dates from which a new version applies (PA3.1.RL.10–13)[pp. 257–258].
Seat-Heat's company, going for level 3
A. PA 3.1 or PA 3.2?
The Development Handbook with RASIC and templates.
Seat-Heat's signed tailoring sheet.
Retrospective actions about the process reaching the monthly process board.
B. Would an assessor downrate?
"Projects under 10 people may combine SWE.5 and SWE.6 test reports."
"Reviews may be skipped where the project lead deems appropriate."
Three waivers this year for the same template, and the handbook is unchanged.
The handbook's Confluence pages have no formal baseline. Does that affect PA 3.1?
C. From memory
Explain the difference between the standard process and the defined process, and say which PA rates each.
The standard process is the organisation-wide reference, including tailoring guidelines (PA 3.1, process definition). The defined process is a project's tailored instance of it, actually used and monitored (PA 3.2, process deployment).
Your win: you can say what separates "a well-run team" (level 2) from "an organisation with a process" (level 3), and spot tailoring rules that won't survive assessment. Next: how an assessor actually gets from evidence to a rating.
To keep it: import this lesson's Anki deck (how).
Read next
VDA Guidelines chapter 5, pp. 254–274, especially the tailoring and versioning rules in §5.1.2.1.
Thinking about whether a small organisation with one team can reach level 3? It is a good question to put to your teacher or to an assessor at a Gate4SPICE event.