{"id":3266,"date":"2026-01-30T00:00:00","date_gmt":"2026-01-29T23:00:00","guid":{"rendered":"https:\/\/kunden.weissblaumedia.de\/microconsult\/2019\/10\/28\/ps_sichere-software-3\/"},"modified":"2026-02-04T14:29:32","modified_gmt":"2026-02-04T13:29:32","slug":"ps_secure-software-3","status":"publish","type":"post","link":"https:\/\/www.microconsult.de\/en\/ps_sichere-software-3\/","title":{"rendered":"Taming the Dragon \u2013 Secure Software from the Start (Part 3)"},"content":{"rendered":"

This is what the experts say<\/h3>\n

As part of the research for the article \u201eTaming the Dragon \u2013 Secure Software from the Start\u201c, MicroConsult interviewed embedded experts and received advice and statements on quality and security, which we have summarized in the following points.<\/strong><\/p>\n

<\/p>\n

The most frequent and serious safety deficiencies in quality assurance<\/h4>\n
    \n
  1. Management fails to recognize the importance of safety and delegates the issue to "student interns" or external consultants. (Responsibility for safety should remain within the company.)<\/li>\n
  2. Technicians are unaware that the safety standards reflect the state of the art and that if the work does not meet these standards, it is technically or engineeringally deficient.<\/li>\n
  3. The most common errors and deficiencies related to safety and quality assurance include poor training, inadequate expertise, lack of overview, and lack of sensitivity among project stakeholders (CEO, V, M, QA\u2026).<\/li>\n
  4. The interfaces between sales, marketing, development and quality assurance are not functioning optimally.<\/li>\n
  5. The necessity and recognition of quality assurance \u2013 including in the form of time and encouragement \u2013 are not recognized.<\/li>\n
  6. Often there is a lack of time for innovation in the form of evaluating experiences that lead to changes and improvements.<\/li>\n
  7. Lack of training among developers \u2013 technically usually good, but there are weaknesses in software development.<\/li>\n
  8. The state of the art is not sufficiently determined.<\/li>\n
  9. Employee training is not goal-oriented.<\/li>\n
  10. The selection and use of tools and methods are insufficiently prepared.<\/li>\n
  11. Risk management is inadequately implemented, and requirements and quality characteristics are incompletely defined.<\/li>\n
  12. Technical safety is monitored throughout the product lifecycle.<\/li>\n
  13. A simple decrease in the phase results is insufficient.<\/li>\n
  14. Does my project comply with the functional safety (FuSi) requirements of ISO 26262? This question is often not adequately addressed.<\/li>\n
  15. In almost all projects, the lack of coordination between test stages is a problem. This can lead to "blank spots" in test coverage, which are unacceptable in a safety project.<\/li>\n<\/ol>\n

    The most common and serious misconceptions about safety in quality assurance<\/h4>\n

    Mistake 1<\/strong>Testing is particularly important to achieve safety.<\/p>\n

    The correct is<\/strong>Quality and safety are not tested, they are designed or manufactured. Or to put it another way: Weighing a pig won't fatten it, and testing won't make electronics and their software safe.<\/p>\n

    Mistake 2: <\/strong>If the task description is too vague, for example if the safety criticality is not specified, the fault lies (exclusively) with the client.<\/p>\n

    The correct is<\/strong>The supplier bears sole responsibility for their product.<\/p>\n

    Mistake 3: <\/strong>The preliminary design (architectural design) does not play a particularly important role in safety.<\/p>\n

    The correct is<\/strong>The preliminary design sets the course for a compatible balance between functionality and safety \u2013 e.g., sufficient self-monitoring.<\/p>\n

    Mistake 4<\/strong>There are no legal (judicial) disputes concerning the safety of electronics and their software.<\/p>\n

    The correct is<\/strong>They do exist, and they can be very lengthy and expensive.<\/p>\n

    Mistake 5<\/strong>: Software = Code<\/p>\n

    The correct answer is:<\/strong> Software consists of code, but also of data and the associated documentation, which includes about 30 different pieces of information.<\/p>\n

    Mistake 6<\/strong>I create a quality and safety process by defining roles.<\/p>\n

    The correct answer is:<\/strong> Quality and safety can only be achieved by establishing a lived process.<\/p>\n

    Mistake 7<\/strong>"Zero Defects" achieves a high level of safety.<\/p>\n

    The correct answer is:<\/strong> \u201eWhile "zero defects" are desirable, they are physically unattainable. Werner von Siemens stated in 1880: "Safety in automated processes is not only a matter of human responsibility, but also of economic sense." The operational reliability of a technical system is understood as the reduction of risk to an (economically) acceptable level. This means that tolerable residual errors remain in our technical systems. Therefore, appropriate error detection and response measures must be implemented.<\/p>\n

    Further errors<\/strong><\/p>\n