Assessing traceability — practical experiences and lessons learned

Most existing software systems that lack explicit traceability links between artefacts, or if implemented, are often not leveraged to take advantage of the information it can provide to a development or validation team. Within the medical device domain, as in other safety critical domains, regulation normally requires such systems that are certified before entering service. This involves submission of a safety case (a reasoned argument that the system is acceptably safe) to the regulator. A safety case should include evidence that the organisation has established effective software development processes. At the heart of such processes, they must incorporate traceability. However, numerous barriers such as a lack of awareness of traceability and a lack of guidance as to how to implement traceability hamper its effective implementation. In this paper, we address the lack of guidance on traceability implementation by presenting our experience of developing and trialling a traceability assessment model in two medical device organisations. We show that the assessment model was successful in identifying strengths and weaknesses in both organisations' implementation of traceability. Through experience of trialling the model, we propose an idea to improve it by automation, using the Open Services for Lifecycle Collaboration initiative