The Software Assurance of COTS Software Products

Abstract

The basic principles, both the problem space and the many solutions, have long been well discussed in the literature. Taking a slightly different angle on this work, this paper focuses on the practical steps the Software Assurance (SA) community plays in addressing these principles. Within NASA, the term “software assurance” incorporates software quality, safety, reliability, verification and validation and NASA’s Independent Verification and Validation. This paper focuses on the broad software assurance approaches needed to assure Commercial Off the Shelf (COTS) software, including reliability and safety analyses when and where needed. COTS software is sometimes used in place of, or in conjunction with, developed code. It can be a standalone piece of software like a Configuration Management System, perform certain embedded tasks such as management of an internal bus, be part of an add-on to an instrument such as a camera or recording device to allow remote operations, or a combination of COTS and developed code. The most complex COTS/developed systems combination is that of a developed SW System that uses a compiler, code libraries and runs on an commercial operating system. This becomes further complicated when COTS are connected to other software and other COTS, including complex electronic devices. What level of assurance is needed varies with the application and use. The question becomes, not only how can these SW COTS be assured, especially when used in safety critical applications, but how much is enough.