ASPICE和ISO26262質(zhì)量保證過(guò)程

1、Subramaniam Krishnaveni Vairavan (KV)Senior Manager QualityETAS, Japan2021-07-11-01-Gate4SPICE Event Integrated implementation of Automotive SPICE, Functional Safety and Cybersecurity ONSITE/ONLINE event at NEWCARShanghai, ChinaQuality assurance: Relation to standard process, ASPICE and ISO 26262 20

2、21 ETAS GmbH. All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights.2IntroductionQuality assurance: Relation to standard process, ASPICE and ISO 26262KV is process and quality expert

3、 at ETAS (a subsidiary of BOSCH) in Yokohama.He is globally responsible for processes for Real Time Application related product engineering projects within ETAS.With 20years experience in process and quality, he has led various process improvement initiativesHe has strong know-how on ASPICE and is a

4、 qualified competent assessor. He has experience in process definition extending to safety and security processes.He has led initiatives to improve process culture and quality in various organizations.Krishnaveni Vairavan Subramaniam (KV)Senior Manager- Quality ASPICE Competent AssessorETAS K. K.+81

5、(45)222-4933Subramaniam.KrishnaveniVAbout ETASETAS provides innovative solutions, engineering services, consulting, training, and support for the development ofembedded systems for the automotive industry and other sectors of the embedded industry. Security solutions in the area of embedded systems

6、are offered by the ETAS subsidiary ESCRYPT. ETAS is represented with international subsidiaries and sales offices in 12 countries in Europe, North and South America, and AsiaConfidential GATE4SPICE Event | ETAS-RTA Solutions | 2021-07 2021 ETAS GmbH. All rights reserved, also regarding any disposal,

7、 exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights.3ETAS Classic AUTOSAR PortfolioRTA-CAR Solution1AUTOSARConfiguration Tools2AUTOSAR BSWModules3OEM-specific Extensions4OEM-compliant Flash Bootloader5Functional Safety Package6En

8、gineering And Consulting ServicesRTAClassic AUTOSAR SolutionConfidential GATE4SPICE Event | ETAS-RTA Solutions | 2021-07 2021 ETAS GmbH. All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial propert

9、y rights.4ETAS Classic AUTOSAR PortfolioArchitecture design and BSW configurationApplication SW development and code generationSWC .arxmlAUTOSAR import, exportLegacy importOEM-specific componentsVirtual ECU generation (ISOLAR-EVE)System specification (ISOLAR-A)ECU specification (ISOLAR-B)Basic softw

10、are code generation(RTA-RTE, RTA-OS, RTA-BSW)A2L files generation (RTA-A2L)SW Make/ BuildConsulting and engineering services, training, coaching,software development and integration, on-site supportECU Integration and SW TestingValidation and calibrationNetworksCANCAN-FDEthernetFlexRayLINSoftware co

11、mponents implementation(modell-based, hand coded)ASW development and code gene- ration (ASCET)SWC .cBSW .cFBL .c.a2lOS .cMCSD .arxmlECUconfiguration.arxmlRTA-CAR(Classic AUTOSAR Solutions)ETAS Solution for AUTOSAR and Non-AUTOSAR ApplicationsThird party solutionsFlash Boot Loader (RTA-FBL)dbc, fibex

12、, ldf, odx, xlsSystem/ diagnostic/ ECU extractECU 1ECU 2ECU nETAS Virtual ECU validation platformCalibration (INCA)RTE .cRTA-CAR SolutionHsm .cOEM-Specific component (RTA-SUM, RTA-FBL,CycurHsm, Jaspar)Confidential GATE4SPICE Event | ETAS-RTA Solutions | 2021-07 2021 ETAS GmbH. All rights reserved, a

13、lso regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights.5ETAS Classic AUTOSAR PortfolioRTA-CAR Solution Supported OEMsConfidential GATE4SPICE Event | ETAS-RTA Solutions | 2021-07 2021 ETAS GmbH. All rights

14、reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights.6ETAS Classic AUTOSAR PortfolioRTA-CAR Solution Market presenceo Supported Global Suppliers Exampleso Supported Regional Suppliers Examples

15、Confidential GATE4SPICE Event | ETAS-RTA Solutions | 2021-07 2021 ETAS GmbH. All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights.7Quality assurance: Relation to standard process, A

16、SPICE and ISO 26262Short surveyPlease raise hands if your current role fit to one of the listed activities !Responsible for quality management systemPerform quality assessments and audits to check if projects follow processDevelop software by following quality management systemConfidential GATE4SPIC

17、E Event | ETAS-RTA Solutions | 2021-07 2021 ETAS GmbH. All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights.8Common challenges on “good quality”Quality assurance: Relation to standa

18、rd process, ASPICE and ISO 26262Most often development team and quality team sits toofar in the development process chain.High probability on difference in understanding on “quality”What does it mean by “done-done” varies based on individuals/project team = (in other words Definition of Done)Is the

19、work product created out of following process complete and correct? = ( in other words do we have common review criteria to ensure quality ofwork product is good.)Common challenges on “Quality Management System” perceived by development teamProcess is heavy weight and not fitting to my daily workPro

20、cess has a lot of ASPICE, ISO 26262 terminologies and difficult to relate to my daily workThere are too many pages to read if I have to understand how requirements management workThere are too many templates to choose and I have no flexibility to choose my own tools/templatesThe list goes onConfiden

21、tial GATE4SPICE Event | ETAS-RTA Solutions | 2021-07 2021 ETAS GmbH. All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights.9Developers viewAssurance is responsibility of Quality Engi

22、neerI do software developmentQuality assurance how is it perceived?Quality assurance: Relation to standard process, ASPICE and ISO 26262Quality engineers viewI only check if development team is developing software with “built-in quality“My role is to enable quality mindset and review projects status

23、 at regular intervalsConfidential GATE4SPICE Event | ETAS-RTA Solutions | 2021-07 2021 ETAS GmbH. All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights.10Development teams view SUP.1

24、 Quality Assurance is responsibility of Quality departmentQuality assurance how is SUP.1 perceived?Quality assurance: Relation to standard process, ASPICE and ISO 26262Quality department view SUP.1 Quality Assurance is joint responsibility of product/project team and quality teamConfidential GATE4SP

25、ICE Event | ETAS-RTA Solutions | 2021-07 2021 ETAS GmbH. All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights.11with your organizational process Use organizational process todeliver

26、 high quality software to customerQuality assurance: Relation to standard process, ASPICE and ISO 26262and “projects process” comply with organizational process“Quality Assurance” in the context ofISO 9001ASPICEISO 26262 Achieve continual improvement Assurance that “work products” Assurance of funct

27、ional safetyis influenced by development, production, service and management processesA lean and configurable quality management systemConfidential GATE4SPICE Event | ETAS-RTA Solutions | 2021-07 2021 ETAS GmbH. All rights reserved, also regarding any disposal, exploitation, reproduction, editing, d

28、istribution, as well as in the event of applications for industrial property rights.12Quality assurance: Relation to standard process, ASPICE and ISO 26262Objective of todays session & key takeawaysTo share my experience on howQuality assurance can be achieved by having a “common language” between t

29、he project and quality teamA lean quality management system can be defined with a 3-step approachPurposeDefinition of DoneReview criteriaTo extend this approach to safety related projects (and why not also with security related projects in the future)Last but not the least, how can Definition of Don

30、e and Review criteria be adapted to ASPICE/ISO 26262If time permits, we shall do a joint workshop on deriving Definition of Done and Review criteria for few process areasConfidential GATE4SPICE Event | ETAS-RTA Solutions | 2021-07 2021 ETAS GmbH. All rights reserved, also regarding any disposal, exp

31、loitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights.13Quality assurance: Relation to standard process, ASPICE and ISO 26262Why? Provides a “Purpose” on why “I as a developer should follow this process”What? Provides expectations on “

32、Definition of Done (DoD)” - “How do I ensure that I have implemented this process”?How? Provides supporting infrastructure (methods, tools, templates, guidelines) for good development practiceHow can we achieve “Quality Assurance” with a lean standard process?What? Provides review criteria for each

33、work product - “How shall I ensure that the work product I am developing meets the requirements of DoD”Confidential GATE4SPICE Event | ETAS-RTA Solutions | 2021-07 2021 ETAS GmbH. All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the e

34、vent of applications for industrial property rights.14Quality assurance: Relation to standard process, ASPICE and ISO 26262Why?- Provides a “Purpose” on why “I as a developer should follow this process”What?Provides expectations on “Definition of Done (DoD)” “How do Iensure that I have implemented t

35、his process”?Provides review criteria for each work product to satisfy “Definition of Done (DoD)”How?- Supporting infrastructure (methods, tools, templates) for good development practiceBenefits of this 3-step-approachPurpose Common understanding on why process is requiredDefinition of Done Builds a

36、gile mindset of what is DONE-DONE“Requirement” for each process helps betterunderstanding on processReview criteria sets good basis for review of work productsMethods gives a free hand for developers to choose their tools/templates for good development practicesConfidential GATE4SPICE Event | ETAS-R

37、TA Solutions | 2021-07 2021 ETAS GmbH. All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights.15Definition of DoneMindset - high compliance to processHow do I ensure that I have imple

38、mented this process?Shallprovide a set of expectations to the project team on what shall they do to ensure the process is followeddocument the expectations in human language (no ASPICE, ISO 26262 terminologies used)Common language between project team and quality teamQuality assurance: Relation to s

39、tandard process, ASPICE and ISO 26262Review criteriaMindset - high quality work productHow shall I ensure that the work product I am developing meets the requirements of DoDShallprovide a set of checkpoints for author and/or reviewer to verify the correctness and completeness of the work productprov

40、ide a common set of criteria to audit work productsNote Of course an experienced author/reviewer can go beyond what is listed in the review criteriaConfidential GATE4SPICE Event | ETAS-RTA Solutions | 2021-07 2021 ETAS GmbH. All rights reserved, also regarding any disposal, exploitation, reproductio

41、n, editing, distribution, as well as in the event of applications for industrial property rights.16What tasks are required to perform this process?Is a review performed to check if the process was followed?Is the outcome of process managed in a configuration management system?Is the process planned

42、in the project schedule?Is the process traceable to other relevant processes?Definition of Done Content structureQuality assurance: Relation to standard process, ASPICE and ISO 26262Confidential GATE4SPICE Event | ETAS-RTA Solutions | 2021-07 2021 ETAS GmbH. All rights reserved, also regarding any d

43、isposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights.17Is the output work product of a process available?(e.g. Requirements document)Are the contents of output work product complete and correct?Is the output work product r

44、eviewed, reworked and baselined?Are traceability established to other relevant work products?Review criteria Content structureQuality assurance: Relation to standard process, ASPICE and ISO 26262Confidential GATE4SPICE Event | ETAS-RTA Solutions | 2021-07 2021 ETAS GmbH. All rights reserved, also re

45、garding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights.18Software requirements are required to agree on common understanding with stakeholders on what needs to be built and why.Definition of DoneRequirements are

46、 specified and structured in an unambiguous wayAll requirements have verification methods assigned to itRequirements are analyzed and results documentedTraceability is established between source and detailed requirementsAll requirements are reviewed and results documented and baselinedRequirements r

47、elated tasks are planned and trackedReview coverage and traceability coverage is 100%Quality assurance: Relation to standard process, ASPICE and ISO 26262“Requirements Management” Purpose, Definition of Done and Review criteriaPurposeReview criteriaRequirements documentDocument exist under version c

48、ontrolAll requirements have a unique tagRequirements are categorized and prioritized based on releaseRequirements are in valid statusRequirements are reviewed and evidence availableRequirements are baselined with version managementTraceability reportReport exists under version control.All source req

49、uirements are traced to detailed requirementsThe link between source and detailed requirements are“complete” and “correct”Report reviewed and baselinedConfidential GATE4SPICE Event | ETAS-RTA Solutions | 2021-07 2021 ETAS GmbH. All rights reserved, also regarding any disposal, exploitation, reproduc

50、tion, editing, distribution, as well as in the event of applications for industrial property rights.Confidential GATE4SPICE Event | ETAS-RTA Solutions | 2021-0719Quality assurance: Relation to standard process, ASPICE and ISO 26262Document exist under version controlIs the requirements document main

51、tained within a version control system and location as defined in configurationmanagement list.All requirements have a unique tagDoes each requirement have a unique id which is easy to understandRequirements are categorized and prioritized based on releaseAre requirements categorized based on their

52、type?Are requirements prioritized based on release?Requirements are in valid statusIs the status of each requirement updated and maintained (e.g. accepted, reviewed, rejected)Requirements are reviewed and evidence availableIs the requirement reviewed? Evidence recorded? Reviewfindings reworked?Requi

53、rement are baselined with version managementAre requirements baselined after rework?Is there a version numbering scheme available?Is the document set to released?Review criteria - Input to Review checklistMore information can be provided to each review criteria, so that the team can also use it as a

54、 “checklist” 2021 ETAS GmbH. All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights.20Relation between Definition of Done and ASPICE practices (BPs and GPs)Quality assurance: Relation

55、 to standard process, ASPICE and ISO 26262Definition of DonePA2.1PA2.2PA3.1PA3.2SWE.X BP.xA plan is available to perform the processXEvidence that the plan is performed and maintainedXAll tasks planned and performed are managed in a version control systemXReviews are performed to ensure the process

56、followed aligns with org processXTraceability establishedXBaselined and communicated to the teamXImprovements are identified based on retrospectives / lessons learnedXXRegularly reflect on the execution of the project to identify areas for improvementXXConfidential GATE4SPICE Event | ETAS-RTA Soluti

57、ons | 2021-07 2021 ETAS GmbH. All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the event of applications for industrial property rights.21How are Definition of Done (DoD) and Review criteria implemented by projects?Quality assurance:

58、Relation to standard process, ASPICE and ISO 26262Developer viewWhat needs to be done?Use DoD as a self review checkpoint to ensure all tasks are doneUse review criteria as a self review checklist to ensure the work products are complete and correctQuality Engineer viewIs it really Done-Done?Use DoD

59、 to do process compliance spot-checks(SUP.1 BP3 Assure quality of process activities)Use review criteria to do work product spot-checks to verify if work product is really “Done- Done”(SUP.1 BP2 Assure quality of work products)Reviewer viewWhat shall be checked?Use DoD as a review checkpoint to veri

60、fy the DoD (before closing tasks for a sprint!)Use review criteria as review checklist to perform reviewsConfidential GATE4SPICE Event | ETAS-RTA Solutions | 2021-07 2021 ETAS GmbH. All rights reserved, also regarding any disposal, exploitation, reproduction, editing, distribution, as well as in the