Identifying technical risks in third-party software for embedded products

Market and technology changes are forcing consumer electronics manufacturers to integrate third-party software in their embedded products. However, this integration is more challenging than for the mainstream COTS market, given fewer standards, less opportunity for prototyping and fewer independent sources of information. Therefore, while satisfactory processes have been proposed for evaluating COTS software, they can only be exploited for embedded software if an approach is available to identify potential technical risks. Such an approach has been developed, embodied in a checklist, which aims to guide an assessor as they build their understanding of the interactions between components, given the documentation typically supplied. The checklist contents are informed by a series of studies of the root causes of failures during the integration of both in-house and third-party software components. The paper focuses on how the checklist is structured so that incompatible design decisions in different components can be identified. The checklist has been validated on two development projects in the early phases of evaluating third-party components.