SOUP stands for software of unknown (or uncertain) pedigree (or provenance), and is a term often used in the context of safety-critical and safety-involved systems such as medical software. SOUP is software that has not been developed with a known software development process or methodology, or which has unknown or no safety-related properties.[1]
Often, engineering projects are faced with economic or other pressure to embody SOUP into their high integrity systems.
The problem with SOUP is that it cannot be relied upon to perform safety-related functions, and it may prevent other software, hardware or firmware from performing their safety-related functions. The SOUP problem is therefore one of insulating the safety-involved parts of a system from the SOUP and its undesirable effects.[2]
SOUP is now a defined term ("Software Of Unknown Provenance") in some medical device regulations through the standard IEC 62304:2006 "medical device software –software life cycle processes". It is not prohibited to use SOUP but additional controls are needed and the risk needs to be taken into account. Specific practices to take when using SOUP as part of a medical device may include review of the vendor's software development process, use of static program analysis by the vendor, design artifacts, and safety guidance.[3]