7-1
Ethics in Information Technology, Sixth Edition
Ethics in Information Technology, Sixth Edition
Chapter 7
Ethical Decisions in Software Development
Self-Assessment Questions
1. b. The need for such systems is a fairly recent occurrence.
2. defect
3. b. Many software developers are incompetent or lazy.
Discussion Questions
1. Identify the three criteria you consider to be most important in determining whether
or not a system is a quality system. Briefly discuss your rationale for selecting these
criteria.
Students’ responses will vary. The system should be easy to learn and use, perform quickly
downtime.
2. What are the primary factors that contribute to poor-quality software? Which of
these factors can be traced back to poor ethical decisions on the part of management
or project team leaders or members?
One cause of poor software quality is that many developers do not know how to design
7-2
Ethics in Information Technology, Sixth Edition
quality into software from the very start; others simply do not take the time to do so.
Another factor that can contribute to poor-quality software is the extreme pressure that
3. Define quality management and quality assurance, and briefly discuss the difference
between the two.
Quality management focuses on defining, measuring, and refining the quality of the
development process and the products developed during its various stages. These
4. Explain why the cost to identify and remove a defect in the early stages of software
development might be 100 times less than the cost of removing a defect in software
that has been distributed to customers. What are the implications for a software
development organization?
If the defect is not identified in the early stages, some rework of the deliverables produced
5. Explain the difference between strict liability, negligence, contributory negligence,
and breach of warranty, and explain how they differ.
Strict liability is when the defendant is held responsible for injuring another person,
7-3
Ethics in Information Technology, Sixth Edition
6. Identify and briefly discuss two ways in which the use of an effective software
development methodology can protect software manufacturers from legal liability for
defective software.
The following are two ways in which the use of an effective software development
methodology can protect software manufacturers from legal liability for defective software:
• Reduce software errors: Software errors can creep in at all stages of development.
Poor communication between the customer and the software designer can result in
7. Your company is considering using N-version programming—with three software
development firms and three hardware devices—for the navigation system of a
guided missile. Briefly describe what this means, and outline several advantages and
disadvantages of this approach.
N-version programming is an approach to minimizing the impact of software errors by
independently implementing the same set of user requirements N times (where N could be
2, 3, 4 or more). N versions of software are run in parallel; and, if a difference is found, a
7-4
Ethics in Information Technology, Sixth Edition
8. Why is the system-human interface one of the most important but difficult areas of
safety-critical systems? Do a search on online and find three good sources of
information relating to how to design an effective system-human interface.
Human behavior is not nearly as predictable as the performance of hardware and software
components in a complex system. The system designer must consider what human
9. Identify two commonly used system development methodologies. What are the
primary pros and cons of each approach?
The waterfall system development model is a sequential, multistage system development
process in which development of the next stage of the system cannot begin until the results
7-5
Ethics in Information Technology, Sixth Edition
Waterfall
Agile
Pros
Cons
Pros
Cons
Formal review at end of
each stage allows
maximum management
Users’ needs may go
unstated or be
miscommunicated.
For appropriate
projects, this approach
puts an application into
It is an intense process
that takes considerable
time and effort on the
Structured processes
produce many
Users can’t easily
review intermediate
Forces teamwork and
lots of interaction
Requires stakeholders
and users to spend
10. Identify and briefly describe six different forms of software testing.
• Dynamic testing involves testing the code for a completed unit of software by actually
entering test data and comparing the results to the expected results. There are two forms
of dynamic testing:
• Black-box testing involves viewing the software unit as a device that has expected
7-6
Ethics in Information Technology, Sixth Edition
11. What is the difference between system reliability and system safety? Give an example
of a system that operates reliably but not safely.
Reliability and safety are two different system characteristics. Reliability has to do with the
capability of the system to continue to perform; safety has to do with the ability of the
12. Explain how an organization might use CMMI-DEV to improve its software
development practices.
CMMI-Development (CMMI-DEV), which is frequently used to assess and improve
software development practices, is a set of guidelines for 22 process areas related
13. Identify and briefly discuss the implications to a project team of classifying a piece of
software as safety critical.
When developing safety-critical systems, a key assumption must be that safety will not
7-7
Ethics in Information Technology, Sixth Edition
automatically result from following an organization’s standard development methodology.
Safety-critical software must go through a much more rigorous and time-consuming
14. What is risk? How can it be quantified? What problems might you encounter in
trying to quantify risk?
Risk is the potential of gaining or losing something of value. Risk is quantified using three
elements: a risk event, the probability of the event happening, and the impact (positive or
15. What is risk management? Identify four strategies for addressing a particular risk.
Risk management is the process of identifying, monitoring, and limiting risks to a level that
an organization is willing to accept. The level of risk that remains after managing risk is
7-8
Ethics in Information Technology, Sixth Edition
16. What is the ISO 9001 family of standards? How does an organization achieve ISO
9001 certification? What are the benefits of such certification?
The ISO 9001 family of standards serves as a guide to quality products, services, and
management. ISO 9001 provides a set of standardized requirements for a quality
management system.
17. What is FMEA, and how is it used?
Failure mode and effects analysis (FMEA) is a technique used to develop ISO 9001–
compliant quality systems by both evaluating reliability and determining the effects of
7-9
Ethics in Information Technology, Sixth Edition
What Would You Do?
1.
a. Although this is a fictional story, it is realistic and makes the point that when a major
corporate breakdown occurs, there is often plenty of blame to go around. Seldom is a
major misdeed attributable to a single individual.
• Ray Johnson—Johnson was the Robotics Division Chief at Silicon Techtronics
and pushed the development of the robot so aggressively that he allowed tests
• Randy Samuels—Samuels wrote the program code that caused the Robbie
CX30 robot to oscillate wildly and kill the robot operator, Bart Matthews.
Samuels lacked knowledge in the field of robotics and was headstrong and
self-oriented. He wasn’t a team player and didn’t receive criticism very well.
• Sam Reynolds—Reynolds was a programmer with no management experience,
and he was not capable of managing other professionals. His unwillingness to
b. Students’ answers will vary; however, the first thing that should be mentioned is the
7-10
Ethics in Information Technology, Sixth Edition
need to implement a quality management process as well as a re-examination of the
2. Students’ answers may vary. Some of them may say that more weight should be given to
the firm that claims that all its software development practices are ISO 9001 compliant.
Firms that are ISO 9001 certified provide proof of their commitment to quality
3. Students’ responses will vary. Most students will recognize that the ethical decision in this
situation would be to immediately provide a complete explanation of the software bug to
4. Students’ responses will vary. It would be unethical and unacceptable to release the
software with two of its key features compromised due to bugs. Students could suggest the
5. Students’ answers will vary. If a safety-critical system is defined as one whose failure may
cause injury or death, then a chemical reactor would be considered safety critical.
Consequently, the software must go through a much more rigorous and time-consuming
7-11
Ethics in Information Technology, Sixth Edition
6. Students’ responses will vary. Some students will argue that since the software being
discussed is not safety-critical, the release of the current software and a later release of a
corrected product would be in the best interests of the company.
Cases
Case 1: F-35 Plagued with Software Issues
1. Students’ answers will vary depending on their research. In July 2017, The Pentagon made
a $3.7 billion advance payment to Lockheed Martin for a new batch of 141 F-35 aircraft.
Also in that month, Lockheed Martin issued a press release noting that the F-35 Joint Strike
3. Student’s answers will vary but will likely focus on the need to ensure an established
software development methodology is being used for the development of all pieces of
Case 2: How Safe Are Self-Driving Cars?
1. Students’ answers will vary. If a self-driving car is involved in an accident, the
manufacturer could be found liable if the car (including the software running on it) is found
7-12
Ethics in Information Technology, Sixth Edition
2. Students’ answers will vary. The pros of a standard artificial intelligence algorithm used by
all manufacturers could include an increase in the safety performance of all self-driving
3. Students’ answers will vary; however, they will likely focus on the nature of safety-critical
systems and the need for such systems and software to be put through more rigorous