Can Software Kill You?

Software can kill you. Don’t think so? Talk to the family members of 21 deceased patients treated at the National Cancer Institute in Panama in November 2000. The cancer patients died after being overdosed by a Cobalt-60 radiotherapy machine. The technicians who entered patient and medication data into the software that guided that machine will stand trial starting May 18th in Panama City on charges of second-degree murder.

The Panamanian hospital tragedy may be an extreme case of software failure causing deaths. But consider an example much closer to home. According to published reports, Ferrari’s North America division recalled 353 cars in 1999 because of a software programming error. Some Ferrari 360 Modena and 360 Modena F1 models manufactured in the previous year contained a glitch in the electronic instrument module that prevented a warning light from illuminating if a problem was detected with a car’s brake system.

“That’s a potentially dangerous technical glitch for a high-performance sports car, particularly since those who own them usually aren’t shy about testing a car’s speed limits,” Marti Miernik, director of Neale-May & Partners, told TechNewsWorld.

“While Ferrari says no accidents or injuries occurred because of the problem, the software-related recall of a life-preserving warning system demonstrates the mounting pressure on the automobile industry to ensure that it’s putting quality, error-free software in cars,” Miernik said.

But it’s not just in cars that buggy software is threatening life and limb. Computer programming is now embedded in much of the equipment and appliances that permeate homes, schools and the workplace, making software quality a major issue. Most software releases are far from perfect, and software industry analysts admit there is little difference in the quality control applied to industrial programming and retail products.

Quality Issues Abound

Consumers often criticize software programs for their unreliability and bug-laden performance. Industry-specific analysis bears truth to consumers’ laments about buggy software.

For instance, The Sustainable Computing Consortium reported, there can be as many as 20 to 30 bugs per 1,000 lines of software code in most software applications. Likewise, the Cutter Consortium claimed that of the software firms it polled, 32 percent admitted releasing software with too many defects, 38 percent said their software lacked an adequate quality assurance program, and 27 percent said they do not conduct formal quality reviews.

In his book titled Software Quality: Analysis and Guidelines for Success, author T. Capers Jones reported that no method of removing software defects or errors is 100 percent effective. Formal design and code inspections average about 65 percent in defect-removal efficiency. Most forms of testing are less than 30 percent efficient, Jones wrote.

Many of the studies on software quality show there is little concern for quality assurance over profit. According to the National Institute of Standards and Technology, developers spend about zero percent of their development costs on identifying and correcting defects. Reports like these reveal a callous, user-be-damned attitude by the software industry. But when inept coding runs mission-critical systems in transportation and medical procedures, that attitude can be deadly.

Making Software Perfect?

Adding insult to injury is a conclusion by the Institute of Electrical and Electronics Engineers that peer reviews of software will catch 60 percent of all coding defects. But few, if any, companies subject their programming to peer review.

“You can’t make software perfect. We haven’t invented laws of physics for software yet,” Jeffrey Payne, CEO of software-consulting firm Cigital Labs, told TechNewsWorld. “We will see an increase in critical problems because software is moving so rapidly into everything.”

One key reason why software quality ranks so low is that there is little chance the software industry will be held accountable for damages. With program code embedded in cars, planes, trains and hospital equipment, software developers can hide behind third-party status. They don’t make the products that use the software, so if failure or injury occurs, the software maker hides in the background.

Meanwhile, consumers have no legal recourse over defective software they buy off the shelf because of restrictions on liabilities written into product licensing agreements, said Payne. And custom-built software is protected against liability through various errors-and-omissions clauses.

Quality Assurance Possible

“Quality is often not considered number one for a software product. It is extremely expensive to build good software, and people do cut corners,” said Christopher Nolan, director of professional services at Empirix, in assessing the attitude of the software industry. Empirix provides testing and monitoring products and services for Web and voice applications.

Instead of building in quality checks, most software companies rely on patching to solve coding problems, Nolan said. A good quality-assurance program could rank all software on a scale of risk effectiveness and allocate resources accordingly.

“We don’t see many companies doing this,” Nolan said. What he does see more often, however, is software performing tasks for which it wasn’t originally designed. That adds to the software failure rate.

But Cigital’s Payne said he sees signs that some software companies are showing more concern for testing software better.

“I’m seeing a renewal of software engineers getting serious about making it a science rather than an art,” Payne told TechNewsWorld. “They are starting to rethink the situation and are applying good quality management.”

Empirix’s Nolan said good software design and good testing go hand-in-hand. He added that the industry has to figure out what to test and what’s wrong with requirements supplied by product analysts.

According to Nolan, two factors should guide the quality assurance process. One is having testers who can figure out outlandish cases in which the code might fail. The other is having the ability to handle things beyond the software’s operating scope and flag the error before bad things happen.

Ultimately, however, it is up to market issues that drive the software situation, according to Nolan. Payne couldn’t agree more. In his view, it doesn’t cost any more to build in quality the first time around.

“We find that if quality is integrated up-front, it actually costs less money,” he said.

Formula for Success

Alberto Savoia, CTO of Agitar, believes the software industry has always considered quality assurance to be a separate function that can be outsourced. His company develops software-testing solutions.

“People in the industry are now starting to realize that the developer is responsible for testing. Not doing so is the moral equivalent of a surgeon sewing up a patient and then giving that patient to somebody else to make sure no infection sets in,” Savoia told TechNewsWorld.

His company’s products change the dynamics of testing costs by using special software programs to hunt down bad code in separate modules of a software package. “Ninety percent of all problems could be caught if all software were tested as a single component,” he said. “If you test each module before the entire code is run, you improve the chances of no failure by a factor of 10 or more.”

It is somewhat ironic that Agitar relies on computers to test the quality of other programs’ coding. Five years ago, Savoia said, computers were too slow to do that kind of analysis. The bottom line for the software quality and reliability issue won’t come from government regulation, predicted Mark de Visser, Agitar’s vice president of marketing.

“A lot of software companies are negligent because there are no laws holding them accountable,” de Visser told TechNewsWorld. “The solution will come from a higher degree of competitive pressure.”