Software of unknown pedigree

Software of unknown pedigree (SOUP) is software that was developed with an unknown process or methodology, or which has unknown or no safety-related properties.^[1] In the medical device development standard IEC 62304, SOUP expands to software of unknown provenance, and in some contexts uncertain is used instead of unknown, but any combination of unknown/uncertain and provenance/pedigree refer to the same concept (and all have the same abbreviation).

The term SOUP is discussed in the context of safety-critical and high-integrity systems such as medical software – especially in a medical device. SOUP poses a risk when used for safety-related functions. It may prevent other software, hardware, or firmware from performing their safety-related functions.^[2]

Addressing this risk involves insulating the safety-involved parts of a system from potential undesirable effects. Rather than prohibiting SOUP, organizations often impose additional controls to mitigate risk. Practices may include static program analysis and review of the vendor's development process, design artifacts, and safety guidance.^[3]

References

^ Felix Redmill (2001). "The COTS Debate in Perspective". In Udo Voges (ed.). Proceedings of the 20th International Conference on Computer Safety, Reliability and Security, SAFECOMP 2001, Budapest, Hungary, September 26–28, 2001. Springer. pp. 122. ISBN 978-3-540-42607-3.
^ Hall, Ken (June 1, 2010). "Developing Medical Device Software to IEC 62304". EMDT - European Medical Device Technology. Retrieved 2012-12-11.
^ Hobbs, Chris (2011-11-01). "Device makers can take COTS, but only with clear SOUP". Medical Design. Archived from the original on 2013-01-23.