Gilbert Regan

The Barriers to Traceability and their Potential Solutions: Towards a Reference Framework

Traceability of software artifacts, from requirements to design and through implementation and quality assurance, has long been promoted by the research and expert practitioner communities. However, evidence indicates that, with the exception of those operating in the safety critical domain, few software companies choose to implement traceability processes, often due to associated cost and complexity issues. This paper presents a review of traceability literature including the implementation of traceability in real organizations. Through both analyzing case studies and research published by leading traceability researchers, this paper synthesizes the barriers faced by organizations while implementing traceability, along with proposed solutions to the barriers. Additionally, given the importance of traceability in the regulated domain of safety critical software, the paper compares the barriers for organizations operating inside and outside of this domain.

A Traceability Process Assessment Model for the Medical Device Domain

Traceability of requirements through the software development lifecycle (including supporting processes such as risk management and change management) is a difficult and expensive task. The implementation of effective traceability allows organizations to leverage its many advantages, such as impact analysis, product verification and validation, and facilitation of code maintenance. Traceability is conducive to producing quality software.

A Methodology for Software Process Improvement Roadmaps for Regulated Domains – Example with IEC 62366

Software process improvement initiatives offer many benefits in terms of productivity, cost savings and quality. As part of these initiatives organisations undergo an assessment and then embark on a software process improvement program to improve their existing processes to meet a desired target. These programs can be improved by the use of process improvement roadmaps that are tailored to the organisation and are usually non-transferrable. Within regulated domains, such as the medical device industry, adherence to international standards must be achieved before products can be placed on the market. This work proposes the use of software process improvement roadmaps to assist organisations achieve compliance with medical device standards. These proposed roadmaps will be generic in nature to meet the requirements of the standard, but will be subsequently tailored to meet the specific requirements of an individual organisation. In this paper we introduce the concept of the software process improvement roadmaps for the implementation of standards and detail a methodology for developing these roadmaps.

Assessing traceability-practical experiences and lessons learned

Most existing software systems that lack explicit traceability links between artefacts, or if implemented, are often not leveraged to take advantage of the information it can provide to a development or validation team.

The Development and Validation of a Traceability Assessment Model

Regulation normally requires critical systems to be certified before entering service. This involves submission of a safety case - a reasoned argument and supporting evidence that stringent requirements have been met and that the system is acceptably safe. A good safety case encompasses an effective risk mitigation process which is highly dependent on requirements traceability. However despite its many benefits and regulatory requirements, most existing software systems lack explicit traceability links between artefacts. Reasons for the lack of traceability include cost, complexity and lack of guidance on how to implement traceability.To assist medical device organisations in addressing the lack of guidance on how to implement effective traceability, this paper aims to present the development and validation of a traceability process assessment model and the actions to be taken as a result of the validation. The process assessment model will allow organisations to identify strengths and weaknesses in their existing traceability process and pinpoint areas for improvement.

Investigation of Traceability within a Medical Device Organization

Requirements traceability helps to ensure software quality. It supports quality assurance activities such as impact analysis, regression test selection, compliance verification and validation of requirements. Its implementation has long been promoted by the research and expert practitioner communities. However, evidence indicates that few software organizations choose to implement traceability processes, in the most part due to cost and complexity issues. Organizations operating within the safety critical domains are mandated to implement traceability, and find the implementation and maintenance of an efficient and compliant traceability process a difficult and complex issue. Through interviews with a medical device SME, this paper seeks to determine how traceability is implemented within the organization, the difficulties it faces in implementing traceability, how compliant it is with the medical device standards and guidelines, and what changes could be made to improve the efficiency of their traceability implementation and maintenance.

Research findings from an industrial trial of a traceability assessment and implementation framework

Software systems are becoming increasingly complex. Withinsafety critical domains such as medical device software, thisincreasing complexity is placing growing demands onmanufacturers who must ensure their software not only meetsfunctional requirements but is also safe and reliable. However, theFood and Drugs Administration who regulate medical devicesoftware in the United States report a significant increase inrecalls between years 2003 and 2012 and have cited softwaredifficulties as one of the frequent causes of recalls. Furthermore arecent analysis of traceability documentation submitted to theAdministration has revealed that the traceability data wasincomplete, incorrect, and conflicting in many cases. This isproblematic as traceability plays an important role in thedevelopment of safe and reliable software. In this paper wepresent the validation, through industry trial, of a traceabilityassessment and implementation framework which we havedeveloped to assist medical device organizations implementtraceability in an efficient and regulatory compliant manner. Ourfindings show that implementation of the framework within twoorganizations improved their traceability process and that bothorganizations found the framework to be both useful and usable.

A Critical Evaluation of a Methodology for the Generation of Software Process Improvement Roadmaps

For medical device organisations to market their devices in specific geographic regions they must adhere to the regulations of that region. These regulations often recommend that organisations adhere to specific standards and guidance documents which specify “what” must be achieved without specifying “how” this may be done. Due to changes to the medical device directive, which governs the development of medical devices within the EU, in March 2010, software can now in its own right be considered a medical device. This change has meant that a number of software organisations developing software for the medical device domain must now adhere to the same regulations as other medical device manufacturers. In this work we present a concept for a Software Process Improvement (SPI) roadmap to guide such organisations through the task of implementing medical device standards and guidance documents. In addition we present and evaluate a methodology that can be used to create a SPI roadmap from a set of requirements such as the aforementioned standards and guidance documents.

Traceability-Why Do It?

Traceability of software artifacts, from requirements to design and through implementation and quality assurance, has long been promoted by the research and expert practitioner communities. However, evidence indicates that, with the exception of those operating in the safety critical domain, few software companies choose to implement traceability processes, in the most part due to cost and complexity issues. This paper presents a review of traceability literature including the implementation of traceability in real organizations. Through both analyzing case studies and research published by leading traceability researchers, this paper synthesizes the motivations of the organizations for implementing traceability. Given the importance of traceability in the regulated domain of safety critical software, the paper compares the motivations and benefits for organizations operating inside and outside of this domain. Finally, based on an analysis of the disparate case studies, the paper re-assesses the value of traceability motivators for more widespread adoption by firms outside of the safety critical sector.

The Development and Validation of a Roadmap for Traceability

Organisations who operate in the safety critical domains such as the medical device, avaition, and automotive domains must ensure their software is safe and provide objective evidence to this effect. One way of achieving this is by adhering to domain specific regulations and guidelines which specify a comprehensive implementation of traceability. However there is a gap between regulatory traceability requirements and what is implemented in practice. This lack of compliance means that organisations find it difficult to assess the safety of their software and thus ensure its safety. One reason for non-compliance with regards to traceability is a lack of guidance on what traceability to implement or how to implement it. In this paper we present the development and validation of a roadmap for the implementation of traceability in the medical device domain. The roadmap will provide medical device organisations with a pathway for effective traceability implementation.