Getting Software Traceability Right in Automotive

Before software defines the software-defined vehicle, developers define the software. Because the requirements are vast, the applications are complex and, in many cases, the software is fundamental to the safe operation of the vehicle, it is imperative that each piece of code is traceable — tied to product requirements on one end and functional tests on the other.

Traceability is the best way to help ensure software quality and consistency, and to validate that any changes are not affecting other software unexpectedly. As the software expands, developers need automated tools to keep track of all of the pieces and link them appropriately. Software traceability is also at the foundation of the United Nations Economic Commission for Europe’s Regulation 156, which must be followed for vehicle homologation.

The concept of traceability is rooted in the best-practices guidelines for automotive software development known as ASPICE (Automotive Software Process Improvement and Capability dEtermination). ASPICE leverages the V-model, an approach that maps out how each step in the development process is connected to the next — from system requirements to system design, software requirements, software implementation, software integration and qualification testing, system integration, and qualification testing. As software is developed, it should be crystal clear how the software is linked to each of those stages.

How to implement software traceability

It may be necessary to enforce compliance with the software development process. If a developer were to start writing code before requirements had been reviewed and approved, for instance, the end result might not meet the eventual requirements, and it would be more likely to fail test cases written to those requirements. Trying to align the software with the requirements later in the process is usually more time-consuming and expensive.

Companies can set up systems that improve the traceability of the software, creating links from a requirements management system to a task management system, a code repository, and a test management system. But this takes a lot of manual work.

Wind River Studio Developer allows teams to automate the connections between those systems and put them all behind a single pane of glass. For any given project, they can visualize the traceability, as well as the conformance to established processes and regulations. These benefits can extend to external partners and suppliers. As each supplier develops software, its code can be traceable in Studio, providing full visibility into what software is deployed in vehicles.

Testing advantages of traceability

Developers can also leverage traceability to automatically gather data from tests related to the software, requirements and tasks. This capability is critical when those tests are widely distributed, either as software-in-the-loop in the cloud, or on hardware-in-the-loop test benches.

More importantly, traceability enables developers using Studio to not only intelligently select tests that match up with specific requirements but also choose tests for related requirements. This way, developers can get a fuller picture of whether their new code changes have had an effect on adjacent software — and they can get those results within the same day.

In the future, generative AI could use the traceability amplified by Studio to select relevant tests, generate additional test cases and focus testing on areas that humans might not realize need more scrutiny. The ultimate goal is to optimize testing strategies and identify bugs, even before the software has been checked in.

Traceability and security

Traceability also plays an important role in vehicle cybersecurity. For example, if a vehicle experiences a security event, Studio can use traceability to automatically link the event with a specific piece of code, or even to the original developer who introduced that code. When digital feedback is in place, developers can hear about the event within an hour, as opposed to days, and begin to take action to remediate it.

A key management system enables each piece of code to be cryptographically signed before it is deployed to vehicles, using state-of-the-art cryptography standards to impart a high level of trust to the traceability as well, since every signed module is linked to requirements.

Software granularity is necessary for the software-defined vehicle to evolve over time. Automakers must have the ability to manage, secure, test and update tens of thousands of individual pieces of software, many of which come from individual suppliers. Traceability is vital to that ability, making tools like Wind River Studio essential to the software-defined vehicle.