ASPICE

Automotive SPICE assesses and improves software and system development processes. Learn the process reference model (SYS.1–5, SWE.1–6, SUP, MAN), capability levels 0–5, process attributes and N/P/L/F ratings, work products, bidirectional traceability, and how OEMs use assessments.

Carmakers buy software from dozens of suppliers. ASPICE gives them a common yardstick for how well a supplier develops it: are requirements managed, is architecture documented, is everything tested and traceable?

Most OEMs require suppliers to reach ASPICE Capability Level 2 (managed) or 3 (established) on key processes.

An analogy

ASPICE is like a restaurant hygiene inspection: it doesn't taste the food (product), it checks whether the kitchen's processes reliably produce safe food.

The V-model processes

System side: SYS.1 requirements elicitation, SYS.2 system requirements, SYS.3 architecture, SYS.4 integration test, SYS.5 qualification test. Software side: SWE.1 SW requirements, SWE.2 architecture, SWE.3 detailed design & unit construction, SWE.4 unit verification, SWE.5 integration test, SWE.6 qualification test. Plus SUP (quality assurance, configuration, problem and change management) and MAN.3 project management.

Capability levels

Level 0 incomplete; 1 performed (base practices done); 2 managed (planned, monitored, work products controlled); 3 established (standard organisational process tailored); 4 predictable (quantitatively managed); 5 innovating. Each level has process attributes rated N/P/L/F.

Traceability and consistency

Every requirement must trace to architecture, design, code and tests — and back (bidirectional). Consistency between levels, test coverage of requirements and review evidence are core assessment findings.

Assessments and improvement

Certified assessors interview teams and inspect evidence against base practices and generic practices. Findings drive improvement plans. ASPICE 4.0 adds machine-learning (MLE) and hardware (HWE) processes; it complements ISO 26262 (safety) and ISO 21434 (cybersecurity).

Formulas

• Rating scale: N: 0–15 %, P: > 15–50 %, L: > 50–85 %, F: > 85–100 %
• Level n achieved when: PAs of level n rated ≥ L and all lower-level PAs rated F

Worked example: Rating a process attribute

Given: PA 2.1 (performance management): 70 % of practices evidenced

Find: Rating.

• > 50–85 % → Largely achieved (L)

Answer: L

Worked example: Level achievement

Given: SWE.1: PA1.1 = F, PA2.1 = L, PA2.2 = F, PA3.1 = P

Find: Capability level.

• Level 1: PA1.1 F ✓
• Level 2: PA2.1 L, PA2.2 F (≥ L) and PA1.1 F ✓
• Level 3: PA3.1 P < L ✗

Answer: Capability Level 2

Common mistakes

• Wrong: Creating documents only for the assessment. — Right: Evidence must reflect real daily practice.
• Wrong: One-way traceability. — Right: Trace requirements → tests and tests → requirements (bidirectional).

Applications

• Supplier selection: OEMs require ASPICE Level 2/3 in contracts.
• Process improvement: Assessment findings drive better requirements, testing and CM.
• Safety & security alignment: ASPICE evidence supports ISO 26262 and 21434 work products.

Key takeaways

• SYS/SWE V-model processes + SUP + MAN.
• Levels 0–5; N/P/L/F ratings.
• Bidirectional traceability is essential.
• Most OEMs require Level 2–3.

Going further

• ASPICE for Cybersecurity: Adds SEC processes aligned with ISO 21434.
• Agile in ASPICE: Scrum can meet ASPICE if planning, traceability and baselines are evidenced.
• Tool qualification: Requirements and test tools must support traceability and consistency.