SW-CMM, By CHC-3

Capability Maturity Model

SW development as a baseball team.

What happens when a ball is hit to a Little League team? Everyone runs around at random. They might do the right thing, or they might not. The next time the ball is hit in the same place, they will do something different.

What happens when a ball is hit to a professional team? Everyone moves in a coordinated fashion, based on practicing that play many times. Sometimes they fail to make the right play, but they almost always try to do the right thing.

What happens when you lose the star player on a Little League team? Usually the team can no longer function. What happens when you lose the start player on a professional team? Often, other players can step up to take his/her place.

Professional teams also discuss their play and look for ways to improve. They might say to each other -- "The next time there is an infield hit with 2 outs, lets do this instead."

You can say that a professional baseball team is more "mature" than a Little League team.

The Capability Maturity Model (CMM) describes 5 levels of software process maturity, with detail about what constitutes each level.

CMM is used to judge the quality (maturity) of a software development organization -- to see how well it works.

CMM is also used as a roadmap for improving a SW development organization.

How does this work?

There are officially certified CMM "assessors" who come to your company and conduct an audit of your SW processes. (This takes a few weeks.) They tell you what level you are at and what you need to do to advance.

An organization can also send their own people to CMM training. Those people can then help the organization improve. This is worthwhile for large companies.

Summary of the levels

Level 1, Initial -- Anything at all. Ad-hoc and chaotic. Will have some successes, but will also have failures and badly missed deadlines. (98% of SW development organizations at this way.)

Level 2, Repeatable -- SW processes are defined, documented, practiced, and people are trained in them. Groups across an organization may use different processes. (This is harder to do than it sounds. Organizations often take 12-18 months of hard work to get here.)

Level 3, Defined -- SW processes are consistent and known across the whole organization.

Level 4, Managed -- SW processes and results are measured quantitatively, and processes are evaluated with this data.

Level 5, Optimizing -- Organizations engage in continuous process improvement. They experiment with new methods and technologies. They change their processes when they find something that works better.

Problems / drawbacks with CMM

1) Organizations look at CMM as a method or formula for improvement. But it is actually a set of goals, without specifying how to achieve the goals. To use CMM, you have to think, be flexible, be creative, and integrate the goals of CMM with the realities of your business.

If you say, "we do CMM just like it is specified in the book", then you aren't doing CMM.

2) Organizations are using CMM as a stamp of approval, without really committing to process improvement. They want to find the easiest way to get certified as Level 2 (or whatever) without really changing their underlying methods.

I talked to the woman who was the first CMM assessor in the world. She was getting tired and disillusioned with the whole thing. When she went in to work with a company they would say "tell us what we need to do to get Level 2" rather than "let's work together to improve our processes".

3) CMM focuses on management activities. It does not say much about how to write better code. This is unfortunate, since good code is the goal of software development.

4) CMM does not help at all for projects that are in a crisis right now. And this is often when companies look for help with their SW process.

An analogy: For long-term cardiac health, eating lots of fruits and veggies, quitting smoking, getting exercise, and reducing your stress, are all good ideas. But suppose you are having a heart attack now. Will any of these actions help? No, it is too late for preventive measures. You need some other kind of intervention.