Section outline
-
LC - senior lecturer Pokhodenko B.O. group: МП_аб-20-25
PC - senior lecturer Pokhodenko B.O. group: МП_аб-20-25
Classes are held remotely in the format of web conferences at the link:
On conference Zoomhttps://us04web.zoom.us/j/2272646103?pwd=Y1BGUU4xb2tsYWtVVW13eHdBUEZuUT09
Identification conference: 227 264 6103
Code: 6eqvfm
-
Lesson 1. Fundamentals of Standardization in the IT Industry and Its Role in Software Quality Assurance
Objective: formation of a comprehensive system of knowledge among students about the role of standardization as an engineering foundation for ensuring the quality, reliability and security of software. The student must master the historical prerequisites for the emergence of the “software crisis” of the 1960s and understand how standardization transformed chaotic code development into a predictable engineering discipline. During the training process, special attention is paid to mastering the basic definitions of “standardization” and “standard”, distinguishing between standardization objects (processes, products, personnel/qualifications, in particular SWEBOK), as well as classifying regulatory documents into de jure and de facto standards. Students must understand the ecosystem of international (ISO, IEC, ISO/IEC JTC 1, IEEE) and national standardization bodies, as well as understand the practical importance of standards harmonization processes (DSTU ISO/IEC) for the competitiveness of domestic developers. An important aspect is the development of the ability to analyze and measure software quality through a set of objective characteristics, such as portability, compatibility (thanks to unified APIs and protocols), reliability and security (through the implementation of SSDLC processes). Finally, the student should be able to justify the need to apply industry regulations at each stage of the software life cycle to create fault-tolerant and scalable digital systems.
-
Lesson 2. Standardization of Software Lifecycle Processes according to the ISO/IEC/IEEE 12207 Standard
Objective: formation of a holistic system of knowledge about the software life cycle (SLC) and practical skills in the regulation of engineering activities in accordance with the international standard ISO/IEC/IEEE 12207 (DSTU ISO/IEC 12207). The student must master the concept of the software life cycle from concept to decommissioning, as well as learn to analyze, compare and choose the optimal development models (waterfall, incremental, evolutionary/iterative and Agile) depending on the level of uncertainty and requirements for system criticality. During the training, special attention is paid to studying the purpose and three-level hierarchical structure of the 12207 standard (Process - Work - Task), as well as the classification of processes into four main categories: consent processes, organizational support, technical management and purely technical processes (requirements analysis, design, coding, integration, verification, validation, deployment and maintenance). An important aspect is the formation of the ability to conduct the procedure of adapting (tailoring) the standard for a specific project and accumulate a quality evidence base in the form of engineering artifacts (SRS, UML diagrams, trace matrices, test reports), which guarantees traceability, security, and successful certification of the created software product.
-
Lesson 3. Standardization of Software Requirements and Quality Models. Requirements Specification according to ISO/IEC/IEEE 29148. Quality Models of Software Systems and Data according to the ISO/IEC 25000 (SQuaRE) Series of Standards
Objective: formation of students' complex of knowledge, skills and practical abilities in the field of requirements engineering, formalization of technical specifications and mathematical assessment of the quality of software products and data in accordance with modern international standards. The student must master the economic and engineering criticality of the requirements phase in the software life cycle, the concept, hierarchy (business, user, system functional and non-functional requirements) and cyclical phases of requirements engineering. In the process of learning, special attention is paid to understanding and practical compliance with the quality criteria of individual requirements (unambiguity, verifiability, completeness, traceability, consistency) in accordance with the ISO/IEC/IEEE 29148 standard, as well as mastering the standardized structure of building a Software Requirements Specification (SRS). Students should learn to analyze, measure and evaluate the quality of systems according to the two-level model of the ISO/IEC 25010 standard (SQuaRE), which covers 8 fundamental characteristics (functional suitability, performance, compatibility, usability, reliability, security, maintainability, portability), and according to the data quality model of the ISO/IEC 25012 standard (internal and system-dependent quality). An important practical result is the formation of the ability to calculate and apply internal, external and process mathematical metrics (in particular, test coverage and defect density) for the design, verification, validation and successful certification of high-quality software.
-
Lesson 4. Maturity Models and Assessment of Software Development Processes: The ISO/IEC 15504 (SPICE) Standard and the CMMI Methodology
Objective: formation of a holistic system of knowledge, analytical abilities and practical skills in the field of assessment, audit and continuous improvement of software development engineering processes based on international maturity models. The student must master the historical background of the emergence of maturity models, their philosophy, the concept of institutionalization and the economic feasibility (ROI) of their implementation, as well as distinguish between the concepts of "process capability" and "organizational maturity". In the learning process, special attention is paid to understanding and comparative analysis of the two-dimensional assessment architecture of the ISO/IEC 15504 / SPICE standard (process measurement according to ISO 12207, 6 levels of capability and the N-P-L-F assessment scale) and the CMMI methodology in its two representations (continuous and staged). Students must learn to analyze in detail the five levels of organizational maturity according to CMMI (from chaotic to optimized), grasp the practice of systematic process improvement through the cyclical application of the Deming model (PDCA), and understand the procedure for forming an evidence base of engineering artifacts (SRS, UML models, trace matrices, test reports, and Git/SonarQube logs) to successfully pass an official international audit.
-
Lesson 5. Introduction to Software Certification and Conformity Assessment: Regulatory Frameworks, Types of Certification, and Engineering Basis
Objective: formation of students' complex of knowledge, legal literacy and practical engineering and auditing skills in the field of conformity assessment and software certification in accordance with international and national regulatory frameworks. The student must master the concept of conformity assessment, the legal status of certification, its importance for software legalization, distribution of responsibility and admission to tenders. In the process of learning, special attention is paid to understanding and comparative analysis of legislative forms of certification (mandatory/regulatory for safety-critical systems and voluntary/market), as well as the systemic classification of certification schemes according to the ISO/IEC 17067 standard (product certification according to ISO 25010, process certification according to ISO 12207/CMMI and certification of quality management systems according to ISO 9001). Students should learn to clearly distinguish the conceptual differences between verification ("are we building the product correctly?") and validation ("are we building the right product?"), master methods of static and dynamic code analysis, and acquire practical skills in forming an evidence base for certification through the creation and audit of a structured package of software lifecycle engineering artifacts (SRS according to ISO 29148, SAD according to ISO 42010, CMP according to ISO 82890, V&V reports according to ISO 29119, and RTM traceability matrix) to ensure transparency, security, and successful receipt of legally significant certificates of conformity.
-
Lesson 6. Certification Testing and Software Testing: Methodology of the ISO/IEC/IEEE 29119 Standard and Formation of the Testing Evidence Base
Objective: formation of students' knowledge, methodological literacy, and practical engineering skills in the field of organizing, designing, and documenting certification testing and software testing processes in accordance with the international normative framework ISO/IEC/IEEE 29119. The student must master the deep conceptual, philosophical, and legal differences between routine commercial testing (Good-Enough Software) and certification testing, comprehend the principles of tester independence (IV&V), and study in detail the five-part structure of the ISO/IEC/IEEE 29119 standard (concept, processes, documentation, methods, and Keyword-Driven Testing) along with the possibility of its adaptation through the profiling procedure (Tailoring). During the training, special attention is paid to the practical mastery of "white box" methods and mathematical criteria for code coverage (Statement, Branch/Decision and strict MC/DC for safety-critical software), as well as formal techniques for designing scenarios based on decision tables and state transition diagrams. An important practical result is the formation of the ability to develop standardized engineering artifacts - from the Test Plan Specification according to ISO 29119-3 with object fixation (SHA-256), stop/resume criteria and binary Pass/Fail criteria, to documenting protocols (Test Log), anomaly reports, status and Final summary reports (Test Summary Report), which, together with configuration control (Baseline), form an integral evidence base for successfully obtaining an official certificate of compliance from the regulator.
-
Lesson 7. Software Certification by Security Criteria: Methodology of the "Common Criteria" Standard (ISO/IEC 15408), Protection Profiles, and EAL Security Assurance Levels
Objective: formation of a holistic system of knowledge, methodological culture and practical engineering skills in the field of information technology security assessment and certification in accordance with the requirements of the international standard ISO/IEC 15408 (“Common Criteria”) and the national regulatory framework of Ukraine. The student must master the philosophical and engineering basis of security assessment (assessment of the active actions of the attacker instead of analyzing random errors), study the historical retrospective of the evolution of regulatory requirements (from TCSEC and ITSEC to the CCRA agreement) and understand the role of an independent third party in conformity assessment. In the learning process, special attention is paid to mastering the two-dimensional engineering framework of requirements - distinguishing and end-to-end tracing of Functional Security Requirements (SFR classes: FAU, FCS, FDP, FIA, etc.) and Security Assurance Requirements (SAR classes: ADV, ALC, ATE, AVA, etc.). Students should learn to design key regulatory artifacts: define the boundaries and perimeter of the Object of Evaluation (TOE), analyze industry Protection Profiles (PP) and develop Security Tasks (ST) with the acquisition of skills in building trace chains "threat - target - SFR - SAR". In addition, students should master the 7-level scale of assurance assessment levels (EAL 1 - EAL 7), understanding the volume of the evidence base and the stringency of the code coverage criteria for each of them. An important practical result is mastering the structure of the national system of TZI, the functions of the regulator (DSSZZI) and the procedure for passing the 5-stage procedural regulations of the state examination to obtain an official Expert Opinion and enter the software into the State Register of Permitted Protection Means.
-
Lesson 8. Industry Certification and Audits of Critical Software. Functional Safety of Embedded Systems (Embedded Software) and Road Vehicles (ISO 26262)
Objective: formation of a holistic system of knowledge, methodological culture and practical engineering skills in the field of design, development, verification and certification audit of critical embedded software (Safety-Critical Embedded Software) in accordance with the requirements of the international standard for functional safety of road transport ISO 26262. The student must master the system decomposition and distinction between the categories Mission-Critical and Safety-Critical, understand the ontology of failures (distinguishing between random hardware failures and systematic code defects) and master the modified V-model with the requirements of end-to-end bidirectional tracing (Traceability). During the training process, special attention is paid to the practical mastering of the HARA (Hazard Analysis and Risk Assessment) methodology for determining the Levels of integrity of automotive safety (ASIL A - ASIL D) based on parametric analysis of the severity of consequences (S), frequency of the situation (E) and controllability (C). Students must learn to apply strict restrictions of safe coding (static memory allocation, prohibition of recursion according to MISRA C / AUTOSAR C++ standards), design fault-tolerant architectures according to Fail-Safe, Fail-Operational and TMR patterns, as well as conduct mathematical verification of the code with achievement of 100% coverage according to strict MC/DC metrics. An important practical result is the formation of the ability to develop a complete Safety Case and undergo a certification audit procedure by notified bodies (in particular TÜV) with fault injection testing on HIL (Hardware-in-the-Loop) hardware stands for official confirmation of compliance and obtaining vehicle admission to serial production.