[SystemSafety] Qualifying SW as "proven in use" [Measuring Software]

[Thierry.Coq at dnv.com]

Dear all,
There is a method, called SQALE (Software Quality Assessment Based on Lifecycle Expectations), for measuring quality: www.sqale.org, and a derivative on PLC code called PSaQC (PLC Software automated Quality Control, or "psychic"). It is based on the fact that the lack of data for software engineering is troublesome, and the lack of data on quality of software. 
SQALE is supported by a number of tool vendors (static analysis), but is not limited to static analysis of code. It is freely usable (see the license).

Organizations are starting to use it for several reasons:
- it provides an economical way to measure software, in a standard manner, in the project and when accepting the software,
- it is objective and comparable across languages and techniques (especially the SQALE index density)
- it measures the "technical debt" present in the software: the amount of work to improve quality to a defined level,
- it hierarchizes which defects should be corrected first,
- most basic errors of measuring quality in software have been removed by the SQALE quality and analysis models. 

There are limitations:
- there is no link between a SQALE index and a "probability of failure": SQALE measures basically a defect density. As usual, the relationship between defect density and failures is difficult.
- it provides a measure of the "internal quality", as seen from a developer or project manager or customer, not a measure directly of the "external quality", of  an end-user for example,
- measurement points for real-time critical or PLC software are still very insufficient.

Jean-Louis Letouzey has published several papers on SQALE. 
With Jean-Pierre Rosen, we have published data on open source ADA software, as an example of applying SQALE. With Denis Chalon, we have published SQALE data on PLC code. 

Comments or suggestions for improvement are welcome.
I hope this helps.

Thierry Coq
PS. The opinions expressed here represent my own and not necessarily those of my employer.

-----Original Message-----
From: systemsafety-bounces at techfak.uni-bielefeld.de [mailto:systemsafety-bounces at techfak.uni-bielefeld.de] On Behalf Of Derek M Jones
Sent: lundi 17 juin 2013 12:59
To: systemsafety at techfak.uni-bielefeld.de
Subject: Re: [SystemSafety] Qualifying SW as "proven in use"

>>
Software engineering has a culture of not measuring and keeping data.
This is starting to change, but empirical software engineering has only just started:
http://shape-of-code.coding-guidelines.com/2011/03/31/empirical-software-engineering-is-five-years-old/
>>
If anybody knows of any interesting datasets do please let me know.
I am making all data+my analysis code public and so have no interest in data I cannot freely share.
>>

-- 
Derek M. Jones                  tel: +44 (0) 1252 520 667
Knowledge Software Ltd          blog:shape-of-code.coding-guidelines.com
Software analysis               http://www.knosof.co.uk
_______________________________________________
The System Safety Mailing List
systemsafety at TechFak.Uni-Bielefeld.DE


**************************************************************************************
The contents of this e-mail message and any attachments are confidential and are intended solely for the addressee. If you have received this transmission in error, please immediately notify the sender by return e-mail and delete this message and its attachments. Any unauthorized use, copying or dissemination of this transmission is prohibited. Neither the confidentiality nor the integrity of this message can be vouched for following transmission on the Internet.
**************************************************************************************