Configuration management

Last updated

Top level Configuration Management Activity model ConfiurationActivityModel.png
Top level Configuration Management Activity model

Configuration management (CM) is a systems engineering process for establishing and maintaining consistency of a product's performance, functional, and physical attributes with its requirements, design, and operational information throughout its life. [1] [2] The CM process is widely used by military engineering organizations to manage changes throughout the system lifecycle of complex systems, such as weapon systems, military vehicles, and information systems. Outside the military, the CM process is also used with IT service management as defined by ITIL, and with other domain models in the civil engineering and other industrial engineering segments such as roads, bridges, canals, dams, and buildings. [3] [4] [5]

Contents

Introduction

CM applied over the life cycle of a system provides visibility and control of its performance, functional, and physical attributes. CM verifies that a system performs as intended, and is identified and documented in sufficient detail to support its projected life cycle. The CM process facilitates orderly management of system information and system changes for such beneficial purposes as to revise capability; improve performance, reliability, or maintainability; extend life; reduce cost; reduce risk and liability; or correct defects. The relatively minimal cost of implementing CM is returned manyfold in cost avoidance. The lack of CM, or its ineffectual implementation, can be very expensive and sometimes can have such catastrophic consequences such as failure of equipment or loss of life.

CM emphasizes the functional relation between parts, subsystems, and systems for effectively controlling system change. It helps to verify that proposed changes are systematically considered to minimize adverse effects. Changes to the system are proposed, evaluated, and implemented using a standardized, systematic approach that ensures consistency, and proposed changes are evaluated in terms of their anticipated impact on the entire system. CM verifies that changes are carried out as prescribed and that documentation of items and systems reflects their true configuration. A complete CM program includes provisions for the storing, tracking, and updating of all system information on a component, subsystem, and system basis. [6]

A structured CM program ensures that documentation (e.g., requirements, design, test, and acceptance documentation) for items is accurate and consistent with the actual physical design of the item. In many cases, without CM, the documentation exists but is not consistent with the item itself. For this reason, engineers, contractors, and management are frequently forced to develop documentation reflecting the actual status of the item before they can proceed with a change. This reverse engineering process is wasteful in terms of human and other resources and can be minimized or eliminated using CM.

History

Configuration Management originated in the United States Department of Defense in the 1950s as a technical management discipline for hardware material items—and it is now a standard practice in virtually every industry. The CM process became its own technical discipline sometime in the late 1960s when the DoD developed a series of military standards called the "480 series" (i.e., MIL-STD-480, MIL-STD-481 and MIL-STD-483) that were subsequently issued in the 1970s. In 1991, the "480 series" was consolidated into a single standard known as the MIL–STD–973 that was then replaced by MIL–HDBK–61 pursuant to a general DoD goal that reduced the number of military standards in favor of industry technical standards supported by standards developing organizations (SDO). [7] This marked the beginning of what has now evolved into the most widely distributed and accepted standard on CM, ANSI–EIA–649–1998. [8] Now widely adopted by numerous organizations and agencies, the CM discipline's concepts include systems engineering (SE), Integrated Logistics Support (ILS), Capability Maturity Model Integration (CMMI), ISO 9000, Prince2 project management method, COBIT, ITIL, product lifecycle management, and Application Lifecycle Management. Many of these functions and models have redefined CM from its traditional holistic approach to technical management. Some treat CM as being similar to a librarian activity, and break out change control or change management as a separate or stand alone discipline.

Overview

CM is the practice of handling changes systematically so that a system maintains its integrity over time. CM implements the policies, procedures, techniques, and tools that manage, evaluate proposed changes, track the status of changes, and maintain an inventory of system and support documents as the system changes. CM programs and plans provide technical and administrative direction to the development and implementation of the procedures, functions, services, tools, processes, and resources required to successfully develop and support a complex system. During system development, CM allows program management to track requirements throughout the life-cycle through acceptance and operations and maintenance. As changes inevitably occur in the requirements and design, they must be approved and documented, creating an accurate record of the system status. Ideally the CM process is applied throughout the system lifecycle. Most professionals mix up or get confused with Asset management (AM, see also ISO/IEC 19770), where it inventories the assets on hand. The key difference between CM and AM is that the former does not manage the financial accounting aspect but on service that the system supports or in other words, that the later (AM) is trying to realize value from an IT asset. [9] [10] [11]

The CM process for both hardware- and software-configuration items comprises five distinct disciplines as established in the MIL–HDBK–61A [12] and in ANSI/EIA-649. Members of an organization interested in applying a standard change-management process will employ these disciplines as policies and procedures for establishing baselines, manage and control change, and monitor and assess the effectiveness and correctness of progress. The IEEE 12207 process IEEE 12207.2 also has these activities and adds "Release management and delivery". The five disciplines are:

  1. CM Planning and Management: a formal document and plan to guide the CM program that includes items such as:
    • Personnel
    • Responsibilities and resources
    • Training requirements
    • Administrative meeting guidelines, including a definition of procedures and tools
    • Baselining processes
    • Configuration control and configuration-status accounting
    • Naming conventions
    • Audits and reviews
    • Subcontractor/vendor CM requirements
  2. Configuration Identification (CI): consists of setting and maintaining baselines, which define the system or subsystem architecture, components, and any developments at any point in time. It is the basis by which changes to any part of a system are identified, documented, and later tracked through design, development, testing, and final delivery. CI incrementally establishes and maintains the definitive current basis for Configuration Status Accounting (CSA) of a system and its configuration items (CIs) throughout their lifecycle (development, production, deployment, and operational support) until disposal.
  3. Configuration Control: includes the evaluation of all change-requests and change-proposals, and their subsequent approval or disapproval. It covers the process of controlling modifications to the system's design, hardware, firmware, software, and documentation.
  4. Configuration Status Accounting: includes the process of recording and reporting configuration item descriptions (e.g., hardware, software, firmware, etc.) and all departures from the baseline during design and production. In the event of suspected problems, the verification of baseline configuration and approved modifications can be quickly determined.
  5. Configuration Verification and Audit: an independent review of hardware and software for the purpose of assessing compliance with established performance requirements, commercial and appropriate military standards, and functional, allocated, and product baselines. Configuration audits verify that the system and subsystem configuration documentation complies with the functional and physical performance characteristics before acceptance into an architectural baseline.

Software

The software configuration management (SCM) process is looked upon by practitioners as the best solution to handling changes in software projects. It identifies the functional and physical attributes of software at various points in time, and performs systematic control of changes to the identified attributes for the purpose of maintaining software integrity and traceability throughout the software development life cycle.

The SCM process further defines the need to trace changes, and the ability to verify that the final delivered software has all of the planned enhancements that are supposed to be included in the release. It identifies four procedures that must be defined for each software project to ensure that a sound SCM process is implemented. They are:

  1. Configuration identification
  2. Configuration control
  3. Configuration status accounting
  4. Configuration audits

These terms and definitions change from standard to standard, but are essentially the same.

Configuration management database

ITIL specifies the use of a Configuration management system (CMS) or Configuration management database (CMDB) as a means of achieving industry best practices for Configuration Management. CMDBs are used to track Configuration Items (CIs) and the dependencies between them, where CIs represent the things in an enterprise that are worth tracking and managing, such as but not limited to computers, software, software licenses, racks, network devices, storage, and even the components within such items.

The benefits of a CMS/CMDB includes being able to perform functions like root cause analysis, impact analysis, change management, and current state assessment for future state strategy development. Example systems, commonly identifies themselves as IT Service Management (ITSM) systems, include FreshService, ServiceNow and Samanage.

Information assurance

For information assurance, CM can be defined as the management of security features and assurances through control of changes made to hardware, software, firmware, documentation, test, test fixtures, and test documentation throughout the life cycle of an information system. [13] [ better source needed ] CM for information assurance, sometimes referred to as Secure Configuration Management, relies upon performance, functional, and physical attributes of IT platforms and products and their environments to determine the appropriate security features and assurances that are used to measure a system configuration state. For example, configuration requirements may be different for a network firewall that functions as part of an organization's Internet boundary versus one that functions as an internal local network firewall.

Maintenance systems

Configuration management is used to maintain an understanding of the status of complex assets with a view to maintaining the highest level of serviceability for the lowest cost. Specifically, it aims to ensure that operations are not disrupted due to the asset (or parts of the asset) overrunning limits of planned lifespan or below quality levels.

In the military, this type of activity is often classed as "mission readiness", and seeks to define which assets are available and for which type of mission; a classic example is whether aircraft on board an aircraft carrier are equipped with bombs for ground support or missiles for defense.

Operating system configuration management

Configuration management can be used to maintain OS configuration files. [14] Many of these systems utilize Infrastructure as Code to define and maintain configuration. [15]

The Promise theory of configuration maintenance was developed by Mark Burgess, [16] [17] [18] with a practical implementation on present day computer systems in the software CFEngine able to perform real time repair as well as preventive maintenance.

Preventive maintenance

Understanding the "as is" state of an asset and its major components is an essential element in preventive maintenance as used in maintenance, repair, and overhaul and enterprise asset management systems.

Complex assets such as aircraft, ships, industrial machinery etc. depend on many different components being serviceable. This serviceability is often defined in terms of the amount of usage the component has had since it was new, since fitted, since repaired, the amount of use it has had over its life and several other limiting factors. Understanding how near the end of their life each of these components is has been a major undertaking involving labor-intensive record keeping until recent developments in software.

Predictive maintenance

Many types of component use electronic sensors to capture data which provides live condition monitoring. This data is analyzed on board or at a remote location by computer to evaluate its current serviceability and increasingly its likely future state using algorithms which predict potential future failures based on previous examples of failure through field experience and modeling. This is the basis for "predictive maintenance".

Availability of accurate and timely data is essential in order for CM to provide operational value and a lack of this can often be a limiting factor. Capturing and disseminating the operating data to the various support organizations is becoming an industry in itself.

The consumers of this data have grown more numerous and complex with the growth of programs offered by original equipment manufacturers (OEMs). These are designed to offer operators guaranteed availability and make the picture more complex with the operator managing the asset but the OEM taking on the liability to ensure its serviceability.

Standards

A number of standards support or include configuration management, [19] including:

Guidelines

Construction

More recently[ when? ] configuration management has been applied to large construction projects which can often be very complex and have a huge number of details and changes that need to be documented. Construction agencies such as the Federal Highway Administration have used configuration management for their infrastructure projects. [32] There are construction-based configuration management tools that aim to document change orders and RFIs in order to ensure a project stays on schedule and on budget. These programs can also store information to aid in the maintenance and modification of the infrastructure when it is completed. One such application, CCSNet, was tested in a case study funded by the Federal Transportation Administration (FTA) in which the efficacy of configuration management was measured through comparing the approximately 80% complete construction of the Los Angeles County Metropolitan Transit Agency (LACMTA) first and second segments of the Red Line, a $5.3 billion rail construction project. This study yielded results indicating a benefit to using configuration management on projects of this nature. [33]

See also

Related Research Articles

In software engineering, software configuration management is the task of tracking and controlling changes in the software, part of the larger cross-disciplinary field of configuration management. SCM practices include revision control and the establishment of baselines. If something goes wrong, SCM can determine the "what, when, why and who" of the change. If a configuration is working well, SCM can determine how to replicate it across many hosts.

ISO/IEC/IEEE 12207Systems and software engineering – Software life cycle processes is an international standard for software lifecycle processes. First introduced in 1995, it aims to be a primary standard that defines all the processes required for developing and maintaining software systems, including the outcomes and/or activities of each process.

Software maintenance in software engineering is the modification of a software product after delivery to correct faults, to improve performance or other attributes.

In the context of software engineering, software quality refers to two related but distinct notions:

In configuration management, a baseline is an agreed description of the attributes of a product, at a point in time, which serves as a basis for defining change. A change is a movement from this baseline state to a next state. The identification of significant changes from the baseline state is the central purpose of baseline identification.

Software quality assurance (SQA) is a means and practice of monitoring all software engineering processes, methods, and work products to ensure compliance against defined standards. It may include ensuring conformance to standards or models, such as ISO/IEC 9126, SPICE or CMMI.

The term configuration item (CI) refers to the fundamental structural unit of a configuration management system. Examples of CIs include individual hardware or software components. The configuration-management system oversees the life of the CIs through a combination of processes and tools by implementing and enabling the fundamental elements of identification, change management, status accounting, and audits. This system aims to avoid the introduction of errors related to lack of testing as well as of incompatibilities with other CIs.

MIL-STD-498, Military Standard Software Development and Documentation, was a United States military standard whose purpose was to "establish uniform requirements for software development and documentation." It was released Nov. 8, 1994, and replaced DOD-STD-2167A, DOD-STD-2168, DOD-STD-7935A, and DOD-STD-1703. It was meant as an interim standard, to be in effect for about two years until a commercial standard was developed.

In systems engineering and requirements engineering, a non-functional requirement (NFR) is a requirement that specifies criteria that can be used to judge the operation of a system, rather than specific behaviours. They are contrasted with functional requirements that define specific behavior or functions. The plan for implementing functional requirements is detailed in the system design. The plan for implementing non-functional requirements is detailed in the system architecture, because they are usually architecturally significant requirements.

In software engineering, software system safety optimizes system safety in the design, development, use, and maintenance of software systems and their integration with safety-critical hardware systems in an operational environment.

The ISO/IEC 15288 is a technical standard in systems engineering which covers processes and lifecycle stages, developed by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Planning for the ISO/IEC 15288:2002(E) standard started in 1994 when the need for a common systems engineering process framework was recognized. The previously accepted standard MIL STD 499A (1974) was cancelled after a memo from the United States Secretary of Defense (SECDEF) prohibited the use of most U.S. Military Standards without a waiver. The first edition was issued on 1 November 2002. Stuart Arnold was the editor and Harold Lawson was the architect of the standard. In 2004 this standard was adopted by the Institute of Electrical and Electronics Engineers as IEEE 15288. ISO/IEC 15288 has been updated 1 February 2008 as well as on 15 May 2015.

DOD-STD-2167A, titled "Defense Systems Software Development", was a United States defense standard, published on February 29, 1988, which updated the less well known DOD-STD-2167 published 4 June 1985. This document established "uniform requirements for the software development that are applicable throughout the system life cycle." This revision was written to allow the contractor more flexibility and was a significant reorganization and reduction of the previous revision; e.g.., where the previous revision prescribed pages of design and coding standards, this revision only gave one page of general requirements for the contractor's coding standards; while DOD-STD-2167 listed 11 quality factors to be addressed for each software component in the SRS, DOD-STD-2167A only tasked the contractor to address relevant quality factors in the SRS. Like DOD-STD-2167, it was designed to be used with DOD-STD-2168, "Defense System Software Quality Program".

Quality engineering is the discipline of engineering concerned with the principles and practice of product and service quality assurance and control. In software development, it is the management, development, operation and maintenance of IT systems and enterprise architectures with a high quality standard.

In computer engineering, a physical configuration audit (PCA) is the formal examination of the "as-built" configuration of a configuration item (CI) against its technical documentation to establish or verify the CI's product baseline. The PCA is used to examine the actual configuration of the CI that is representative of the product configuration, in order to verify that the related design documentation matches the design of the deliverable CI. It is also used to validate many of the supporting processes that the contractor uses in the production of the CI. This is also used to verify that any elements of the CI that were redesigned after the completion of the functional configuration audit also meet the requirements of the CI's performance specification. Additional PCAs may be accomplished later during CI production if circumstances such as the following apply:

Software requirements for a system are the description of what the system should do, the service or services that it provides and the constraints on its operation. The IEEE Standard Glossary of Software Engineering Terminology defines a requirement as:

  1. A condition or capability needed by a user to solve a problem or achieve an objective.
  2. A condition or capability that must be met or possessed by a system or system component to satisfy a contract, standard, specification, or other formally imposed document.
  3. A documented representation of a condition or capability as in 1 or 2.

Functional safety is the part of the overall safety of a system or piece of equipment that depends on automatic protection operating correctly in response to its inputs or failure in a predictable manner (fail-safe). The automatic protection system should be designed to properly handle likely human errors, systematic errors, hardware failures and operational/environmental stress.

ISO 26262, titled "Road vehicles – Functional safety", is an international standard for functional safety of electrical and/or electronic systems that are installed in serial production road vehicles, defined by the International Organization for Standardization (ISO) in 2011, and revised in 2018.

ISO 10007 "Quality management — Guidelines for configuration management" is the ISO standard that gives guidance on the use of configuration management within an organization. "It is applicable to the support of products from concept to disposal." The standard was originally published in 1995, and was updated in 2003 and 2017. Its guidance is specifically recommended for meeting "the product identification and traceability requirements" introduced in ISO 9001:2015 and AS9100 Rev D.

ANSI/EIA-649, "National Consensus Standard for Configuration Management", is an industry standard for configuration management.

References

  1. "MIL-HDBK-61A, ""Military Handbook: Configuration Management Guidance". Department of Defense. 7 February 2001. Archived from the original on 20 March 2012. Retrieved 24 March 2012.
  2. "ANSI/EIA-649B, ""National Consensus Standard for Configuration Management". TechAmerica. 1 April 2011. Archived from the original on 1 August 2012. Retrieved 24 March 2012.
  3. "History and Heritage of Civil Engineering". ASCE . Archived from the original on 16 February 2007. Retrieved 8 August 2007.
  4. "Institution of Civil Engineers What is Civil Engineering" (PDF). ICE . Archived from the original (PDF) on 23 September 2006. Retrieved 22 September 2007.
  5. "Configuration Management and the Federal Transportation Administration (FTA) National Lessons Learned Program". Federal Transportation Administration. Archived from the original on 7 September 2012. Retrieved 22 September 2007.
  6. "Systems Engineering Fundamentals" (PDF). Defense Acquisition University Press. January 2001. Archived from the original (PDF) on 11 February 2006. Retrieved 25 March 2012.
  7. "Memorandum, Specifications and Standards – A New Way of Doing Business". Secretary of Defense. 29 June 1994. Archived from the original on 21 October 2013. Retrieved 23 March 2012.
  8. "Configuration Management Compliance Validation: Critical Review and Technology Assessment(CR/TA)Report" (PDF). Defense Technical Information Center. Archived (PDF) from the original on 9 October 2022. Retrieved 14 May 2001.
  9. Atlassian. "Guide to configuration management databases (CMDBs)". Atlassian. Retrieved 20 July 2021.
  10. Galusha, C. (June 2001). "Getting started with IT asset management". IT Professional. 3 (3): 37–40. doi:10.1109/6294.939973.
  11. "The ISO 19770-1 standard: A guide to implementing IT asset management". The SHI Hub. 30 January 2018. Retrieved 20 July 2021.
  12. "Military Handbook: Configuration Management Guidance" (PDF). Department of Defense: United States of America. p. iii–iv. Retrieved 21 July 2016. 4. CM LIFE CYCLE MANAGEMENT AND PLANNING [...] 5. CONFIGURATION IDENTIFICATION [...] 6. CONFIGURATION CONTROL [...] 7. CONFIGURATION STATUS ACCOUNTING [...] 8. CONFIGURATION VERIFICATION AND AUDIT [...] 9. DATA MANAGEMENT [...]
  13. National Information Systems Security Glossary
  14. C. Lueninghoener. "Getting Started with Configuration Management. ;login: issue: April 2011, Volume 36, Number 2" (PDF). Archived (PDF) from the original on 9 October 2022. Retrieved 23 November 2012.
  15. Loschwitz, Martin (14 November 2014). "Choosing between the leading open source configuration managers". Admin Network & Security. Lawrence, Kansas: Linux New Media USA LLC.
  16. M. Burgess, Cfengine: a site configuration engine, USENIX Computing systems, Vol8, No. 3 1995
  17. M. Burgess, On the theory of system administration, Science of Computer Programming 49, 2003. p1-46 pdf Archived 24 July 2011 at the Wayback Machine
  18. M. Burgess, Configurable immunity for evolving human-computer systems, Science of Computer Programming 51 2004, p197-213 pdf Archived 3 March 2012 at the Wayback Machine
  19. "NISTIR 7339 Analysis of Standards for Lifecycle Management of Systems for US Army" (PDF). National Institute of Standards and Technology. August 2006. Archived from the original (PDF) on 21 December 2016. Retrieved 25 November 2015.
  20. "ASSIST-QuickSearch - Basic Profile". 27 September 2011. Archived from the original on 27 September 2011.
  21. 1 2 [ dead link ]
  22. "Standards for CM | Institute of Configuration Management". 2 May 2012. Archived from the original on 2 May 2012.
  23. "Configuration Management Standards: an extensive list of CM and related industry standards". CMPIC - The Configuration Management Process Improvement Center.
  24. "ECSS-M-ST-40C Rev.1 – Configuration and information management (6 March 2009) | European Cooperation for Space Standardization". ecss.nl.
  25. "IEEE 828-2012 - IEEE Standard for Configuration Management in Systems and Software Engineering". standards.ieee.org.
  26. "ISO 10007:2017(en) Quality management — Guidelines for configuration management". iso.org. Retrieved 29 November 2023.
  27. "ASSIST-QuickSearch Document Details". Quicksearch.dla.mil. Retrieved 28 August 2022.
  28. "ASSIST-QuickSearch Document Details". Quicksearch.dla.mil. Retrieved 28 August 2022.
  29. "Defense Acquisition Guidebook [DAG]". 13 February 2013. Archived from the original on 13 February 2013.
  30. "Archived copy" (PDF). www.dau.mil. Archived from the original (PDF) on 31 January 2017. Retrieved 11 January 2022.{{cite web}}: CS1 maint: archived copy as title (link)
  31. "Configuration Management Plan". AcqNotes.
  32. "Configuration Management for Transportation Management Systems Handbook". Federal Highway Administration. Retrieved 28 March 2012.
  33. "Configuration Management Case Study". PACO Technologies, Inc. Archived from the original on 26 August 2016. Retrieved 28 March 2012.