Search papers, labs, and topics across Lattice.
This study investigates the traceability of non-functional requirements (NFRs) to code within a real-world blockchain-IoT project, addressing a significant gap in existing research that predominantly focuses on functional requirements (FRs). An annotation protocol was developed to create trace links across diverse artifacts, resulting in a curated dataset that highlights the complexities of NFR traceability, particularly in relation to security concerns. The findings reveal that tracing NFRs is substantially more challenging than FRs, primarily due to the dispersed nature of implementation evidence in the codebase.
NFR traceability is not just harder than FR traceability; it reveals a critical gap in how security-related requirements are implemented in code.
Requirement-to-Code traceability has been widely studied, yet existing research and public benchmarks remain largely centered on functional requirements (FRs). In contrast, traceability for non-functional requirements (NFRs) remains more difficult and underexplored, which hinders the verification of critical quality concerns such as security and reliability.This paper studies NFR-to-Code traceability based on a real-world blockchain-IoT project. We design an annotation protocol for constructing trace links across heterogeneous artifacts and build a manually curated subset containing both FR and NFR links. Using this subset, we examine the characteristics of NFR traceability and further evaluate four representative retrieval baselines: TF-IDF, BM25, LSI, and WMD. The results show that FR-to-Code tracing is consistently easier than NFR-to-Code tracing, while security-related NFRs are the most difficult subset. They further indicate that the main challenge of NFR traceability lies not in requirement availability, but in implementation evidence that is distributed and not clearly localized in code.
