Software of unknown pedigree (SOUP) is software that was developed with an unknown process or methodology, or which has unknown or no safety-related properties. In the medical device development standard IEC 62304, SOUP expands to software of unknown provenance, and in some contexts uncertain is used instead of unknown, but any combination of unknown/uncertain and provenance/pedigree refer to the same concept (and all have the same abbreviation). The term SOUP is discussed in the context of safety-critical and high-integrity systems such as medical software – especially in a medical device. SOUP poses a risk when used for safety-related functions. It may prevent other software, hardware, or firmware from performing their safety-related functions. Addressing this risk involves insulating the safety-involved parts of a system from potential undesirable effects. Rather than prohibiting SOUP, organizations often impose additional controls to mitigate risk. Practices may include static program analysis and review of the vendor's development process, design artifacts, and safety guidance.
References
Further reading D. Frankis (2007-11-05). "Safety in the SOUP". Institution of Engineering and Technology Seminar on Pros and Cons of Using Commercial 'Off the Shelf' Components in Aviation Applications, London, UK, 4 Sept. 2007. pp. 9–21. ISBN 978-0-86341-801-3. ISSN 0537-9989.
