Im working on the implementation of an IEC 62304 compliant development process in our company and I have a question considering SOUP (Software of unknown Provenance).
Our goal is the develop a web application in the future.
For this application we will use different open-source libraries on the backend as well as on the frontend.
For the most of these libraries our SOUP documentation procedure is known.
- Identify the library, version number, licence etc.
- List the requirements we have for the library.
- Test these requirements in form of Unit/Integration tests.
For these libraries it is also possible to separate their code from our code with clear interfaces and document this separation.
Now on to the problem. What should we do with Frameworks like Spring/JEE on the backend or Angular/React on the frontend. The code of these libraries isn't separable from our code. We even use these frameworks to structure our code. We can generate requirements to these frameworks, but I’m not sure how to test that these requirements are fulfilled. The two options im considering are:
- There are several Integration and System tests which test that the overall software system, which is build using the frameworks, runs as it should. Are these tests enough even if they are not explicitly testing the framework functionality?
- Write lots and lots of framework tests which test if dependencies are injected or that Rest endpoints are available or that html template injection works and so on.
Personally I tend to option 1. What I don’t like about option 2 is that unit testing a framework is a completely redundant effort. These frameworks already have a huge amount of tests by themselves which already cover all of the functionality they have. Also, In some cases, I need to use parts of the framework itself to test the framework. (eg. Spring MockMVC to test Controllers).
So my questions are:
- Are Software Frameworks (Spring/JEE/Angular/React) considered SOUP?
- If yes, how to document and test these Frameworks to become IEC 62304 compliant?