Software of unknown pedigree (SOUP) is

software Software consists of computer programs that instruct the Execution (computing), execution of a computer. Software also includes design documents and specifications. The history of software is closely tied to the development of digital comput ...

that was developed with a unknown

process A process is a series or set of activities that interact to produce a result; it may occur once-only or be recurrent or periodic. Things called a process include: Business and management * Business process, activities that produce a specific s ...

methodology In its most common sense, methodology is the study of research methods. However, the term can also refer to the methods themselves or to the philosophical discussion of associated background assumptions. A method is a structured procedure for bri ...

, or which has unknown or no safety-related properties. In the medical device development standard IEC 62304, SOUP expands to software of unknown provenance, and in some contexts ''uncertain '' is used instead of ''unknown'', but any combination of unknown/uncertain and provenance/pedigree refer to the same concept; all with the same abbreviation. The term ''SOUP'' is often used in the context of safety-critical and high integrity systems such as medical software especially in a

medical device A medical device is any device intended to be used for medical purposes. Significant potential for hazards are inherent when using a device for medical purposes and thus medical devices must be proved safe and effective with reasonable assura ...

. A risk that SOUP poses is that it cannot be relied upon to perform safety-related functions, and it may prevent other software, hardware or firmware from performing their safety-related functions. Addressing the risk involves insulating the safety-involved parts of a system from potentially undesirable effects caused by the SOUP. Rather than prohibiting SOUP, additional controls are often imposed to mitigate risk. Practices may include static program analysis and review of the vendor's development process, design artifacts, and safety guidance.

References

Further reading