On Software Certification: We Need Product-Focused Approaches

Abstract

Abstract. In this paper we begin by examining the "certification" of a consumer product, a baby walker, that is product-focused, i.e., the certification process requires the performance of precisely defined tests on the product with measurable outcomes. We then review current practices in software certification and contrast the software regime's process-oriented approach to certification with the product-oriented approach typically used in other engineering disciplines. We make the case that productfocused certification is required to produce reliable software intensive systems. These techniques will have to be domain and even product specific to succeed.

Reducing the footprint of certifiable health software during early stage development

“…Maibaum and Wassyng provide arguments for independent certification of critical software, specifically arguing for productfocused certification, as opposed to certifying the development process [12] [1]. One argument against product-focused certification is cost.…”

On Pairwise Comparisons Based Internal and External Measures for Software Evaluation

“…In most modern systems, software is one of the most complex and error prone components. As a result, there is an apparent need for a viable software evaluation (and that includes certification and validation) process which can adjusted to the dynamic demands of the rapidly evolving software industry [19], [27].…”

“…Consider for example the elements of product based certification process [25], [27]. The process involves defining the evaluation requirements, identifying the evaluation, building the evaluation schedule and executing the evaluation schedule.…”

Certification of Open Source Software – A Scoping Review

“…Examples of such domains are healthcare, defense, and the increasingly important domain of transportation (e.g., self-driving vehicles). Due to the criticality of the systems and the high risk associated with software malfunctions in such domains, high standards in terms of the software's security, reliability, and safety have to be maintained [26]. Additionally, domains such as government and public administration, although not necessarily operating critical systems, have in many countries requirements in place that ask for some guarantee of the software's reliability and proper licensing before OSS can be used.…”