Software quality assurance

Software quality assurance (SQA) is a set of activities that ensure that software processes and products conform to specified requirements and standards. It is a preventive approach, focusing on the processes used to create the software, rather than just testing the final product. SQA encompasses process definition, implementation, and auditing, as well as product evaluation and quality control.²

The scope of SQA includes all phases of the software development lifecycle, from initial concept and requirements analysis through design, coding, testing, and maintenance. It also covers supporting processes such as configuration management, documentation, and training. SQA aims to build quality into the software from the start, rather than detecting defects after the fact.

The roots of SQA can be traced back to the early days of computing, but it emerged as a distinct discipline in the 1970s and 1980s. The term "software quality assurance" was popularized by the work of researchers such as Barry Boehm and the development of standards like IEEE 730. The rise of the personal computer and the increasing complexity of software systems in the 1980s led to a greater emphasis on formal quality processes. The Capability Maturity Model (CMM), developed by the Software Engineering Institute (SEI) at Carnegie Mellon University in the late 1980s, provided a framework for assessing and improving software processes, and became a cornerstone of SQA practice.

SQA is composed of several key components: quality planning, process assurance, product assurance, and quality control. Quality planning involves defining quality goals and metrics. Process assurance ensures that the development process follows defined standards and procedures, often through audits and reviews. Product assurance focuses on verifying that the product meets its requirements, typically through testing and inspections. Quality control is the operational aspect, including defect tracking and resolution.

Methodologies commonly used in SQA include the Capability Maturity Model Integration (CMMI), ISO 9001, and Agile methodologies. In Agile development, SQA is integrated into each sprint, with continuous testing and feedback. Test-driven development (TDD) and behavior-driven development (BDD) are practices that support SQA by ensuring that code is tested from the outset.

Several international standards guide SQA practices. ISO/IEC 25010 defines a quality model for software product quality, including characteristics such as functional suitability, performance efficiency, compatibility, usability, reliability, security, maintainability, and portability. ISO 9001 provides general quality management principles that can be applied to software development. IEEE 730 is a standard for software quality assurance processes, outlining the required activities and documentation. The CMMI framework, developed by the SEI, provides a model for process improvement, with five maturity levels from initial to optimizing.³

In practice, SQA is carried out by dedicated quality assurance teams, quality engineers, and testers, but it is also a responsibility of all developers and project managers. Key activities include:

• Developing and maintaining quality plans and standards.
• Conducting process audits and reviews.
• Performing static analysis and code reviews.
• Designing and executing test cases, including unit, integration, system, and acceptance testing.
• Tracking defects and managing quality metrics.
• Ensuring compliance with regulatory requirements, such as in medical devices or aviation software.

In regulated industries, SQA is often mandated by law. For example, the FDA requires software validation for medical devices, and the DO-178C standard governs software in airborne systems.

While the mainstream view of SQA focuses on testing and process, there are several lesser-known dimensions:

• Historical roots: The concept of quality assurance in software was influenced by earlier quality movements in manufacturing, such as Total Quality Management (TQM) and statistical process control. W. Edwards Deming's work on quality management, originally applied to manufacturing, was adapted to software in the 1980s.
• Economic impact: The cost of poor software quality is staggering. A 2020 study by the Consortium for Information and Software Quality (CISQ) estimated that the cost of poor software quality in the US alone was $2.08 trillion, including rework, operational failures, and security vulnerabilities.
• Edge cases in testing: SQA often involves testing edge cases that are rarely encountered in normal use but can cause catastrophic failures. For example, the Ariane 5 rocket explosion in 1996 was due to an integer overflow in the inertial reference system, a defect that could have been caught by rigorous SQA.
• Security as quality: SQA increasingly includes security testing, such as penetration testing and static application security testing (SAST), to identify vulnerabilities before deployment.
• Cultural differences: The perception and implementation of SQA vary globally. For instance, Japanese software companies often emphasize process improvement and quality circles, while Western companies may focus more on testing and certification.

SQA faces several challenges in the modern software landscape. The shift to agile and DevOps has led to a need for continuous testing and quality monitoring, which requires automation and integration into CI/CD pipelines. The rise of artificial intelligence and machine learning introduces new challenges, as these systems are often non-deterministic and require novel testing approaches. Additionally, the increasing complexity of software, with distributed systems and microservices, makes it harder to ensure overall quality.

Future directions include the use of AI to predict defects and automate test generation, the adoption of quality engineering as a broader discipline that encompasses user experience and business value, and the integration of SQA into the entire product lifecycle, including operations and feedback loops.

Capability Maturity Model Integration (CMMI)

A process improvement framework that provides models for developing products and services, with five maturity levels.

ISO/IEC 25010

An international standard that defines a quality model for software product quality and system quality in use.

Static analysis

The analysis of software code without executing it, to detect potential defects and vulnerabilities.

Test-driven development (TDD)

A development practice where tests are written before the code, and the code is developed to pass those tests.

Quality control

The operational activities performed to verify that a product meets its quality requirements, such as testing and inspection.