Get over ISO-phobia - ISO-9000 software standard - Industry Trend or Event

Software Magazine, Oct 15, 1995 by Mike Macfarlane

In the ongoing struggle to produce better software, developers are beginning to use a powerful, but oft-neglected tool--ISO 9000.

The international quality standard has been adopted by 40,000 companies in 90 countries. To be ISO 9000-certified means that an organization has adopted consistent, repeatable quality processes. Many in the development community are now using ISO 9000 to great benefit. There are those, however, that disparage or simply ignore it. Why?

Thus far, ISO 9000 has been important mainly to manufacturers. But as the standard catches fire within the software business, developers around the globe are being forced to take a stand. The battle-lines drawn say much about the nature of software development.

Software development has the image of being an art, not an engineering process. This image is held by practitioners themselves. It is also propagated by outsiders like Orsen Scott Card, a novelist whose views on programming were recently distributed on the Internet:

"Programming is the `Great Game.' It consumes you, body and soul. When you're caught up in it nothing else matters. When you emerge into the daylight, you might well discover that you're a hundred pounds overweight, your underwear is older than the average first grader, and judging from the number of pizza boxes lying around, it must be spring already. But you don't care, because your program runs, and the code is fast and clever and tight."

As a result, there is a clear camp of anarchists in the development community holding the "development-as-art-form" view. Code produced by this group often turns out to be attractive, richly functional, undocumented and virtually unmaintainable. Developers supporting it throw up their hands in defeat. The original developer is now indispensable.

At the other end of the spectrum lie the Software Engineering Institute and Capers Jones, Software Productivity Research Inc. These organizations view software development as engineering. Their followers engage in sleep-inducing theoretical discussions about the "correct" development methodology and how may function points can dance on the head of a pin.

Code turned out by this camp tends to correspond to exactly what the customer asked for: well-documented, maintainable and predictable. Unfortunately, what the customer asks for drifts with the capabilities of technology. While electronics advance exponentially, software advances linearly, and lags the cutting edge by a large gulf.

So, the anarchists say, "Programming is an art, and ISO 9000 would constrain our artistic abilities. Besides, we don't need the discipline. We write quality code already." Meanwhile, the "accountants" say, "Programming is a discipline that requires rigid standards and management techniques. ISO 9000 does not go far enough to ensure discipline and does not guarantee quality code."

Both groups fear ISO for different reasons. ISO-phobia is a result of the misapplications and myths that have surrounded the standard since its inception in 1987.

"ISO is for cans and cookies, not compilers," is an oft-repeated opinion. If anvil auditors certified software companies, this would be true. However, the strain of ISO that makes a difference is ISO 9000-3, which is 9001 applied to the software industry and audited under the TickIT guidelines. This ensures a real software standard, applied intelligently by auditors who really understand the software business.

Quality programs are fragile. ISO ensures that QA momentum doesn't fade, ensuring compliance through regular external audits. Compliance simply means that repeatable, consistent processes and metrics are in place, and that management, through reviews, gets their noses rubbed in quality on a regular basis. It's that simple. But it's the difference between taking about quality and doing something about it. The difference between hacking and engineering. The difference between movement and action.

With the system in place, and managers accountable for repeatable metrics, software firms can equip themselves to deal with the inevitable movement from first sale to wholesale adoption of new technology. It's one thing to establish a technological beachhead. It's quite another to capture the continent.

Mike Macfarlane is VP of quality at Sybase Inc., Emeryville, Calif.