CSC 317 — Software Engineering

• Explain the nature of software, the causes and modes of software failure, and why software engineering is practised as a discipline. not yet covered
• Compare software process models and select and justify a model for a given project context. not yet covered
• Elicit, specify, validate and trace functional and non-functional requirements, and manage requirements change. not yet covered
• Apply design principles, architectural styles, UML models and design patterns to produce and evaluate a software design. not yet covered
• Apply coding standards, secure coding, version control, build automation and testing techniques to construct and verify software. not yet covered
• Evaluate software quality using the ISO/IEC 25010 model, reviews and audits, and quantitative metrics, and improve code through refactoring. not yet covered
• Plan and manage a software project, including estimation, scheduling, risk management, configuration and release management, and DevOps practice. not yet covered
• Explain maintenance and evolution strategies, and apply professional ethics, privacy and responsible-engineering principles to current and emerging technologies. not yet covered

Software Engineering

• Software Engineering Foundations and Process Models not yet covered
• Requirements Engineering and Software Design not yet covered
• Software Construction, Testing and Quality not yet covered
• Project Management, Configuration Management and DevOps not yet covered
• Maintenance, Evolution, Ethics and Emerging Trends not yet covered

The nature of software and why it is hard to engineer

• Define software and software engineering, and distinguish software engineering from programming and from computer science. 13 questions
• Classify software by type (generic and customised products; system, application, embedded, web and mobile, AI-enabled and safety-critical software) and give an example of each. 18 questions
• Describe the essential attributes of good software: maintainability, dependability and security, efficiency, and acceptability. 12 questions
• Explain the significance of software in modern society and the economy, including the share of lifetime cost taken by change and maintenance. 9 questions
• Explain the essential difficulties of software (complexity, conformity, changeability and invisibility) described in Brooks's "No Silver Bullet". 12 questions

Software failure, unreliability and the discipline

• Distinguish an error (human mistake), a fault (defect in the code or design) and a failure (observed deviation from required behaviour), and trace how one leads to the next. 14 questions
• Explain the main causes of software unreliability: ambiguous or changing requirements, design flaws, inadequate testing, schedule pressure and poor estimation, integration and configuration errors, and unanticipated operating conditions. 9 questions
• Describe common failure modes (crash or omission, incorrect value, timing failure, data corruption, security breach) and relate each to its consequences in a safety-critical system. 12 questions
• Explain why software engineering emerged as a discipline, with reference to the "software crisis" and the 1968 NATO Software Engineering Conference. 15 questions
• Analyse the avionics and insulin pump case studies to identify the requirements, design and testing measures (hazard analysis, redundancy, fail-safe states, independent verification) that make embedded safety-critical software dependable. 20 questions

The SDLC and plan-driven models

• Define the software development life cycle (SDLC) and describe the purpose, inputs and outputs of each generic phase: feasibility, requirements, design, implementation, testing, deployment and maintenance. 23 questions
• Describe the Waterfall model and identify the project conditions under which it is appropriate. 20 questions
• Describe the V-Model and map each development phase to its corresponding test level. 5 questions
• Describe Boehm's Spiral model and explain the role of risk analysis in each cycle. 15 questions
• Distinguish iterative from incremental development and explain how each reduces the cost and risk of change. 12 questions

Agile development and choosing a process model

• Explain the four values and the principles of the Agile Manifesto. 16 questions
• Describe the Scrum framework: its roles (Product Owner, Scrum Master, Developers), events (Sprint, Sprint Planning, Daily Scrum, Sprint Review, Sprint Retrospective) and artefacts (Product Backlog, Sprint Backlog, Increment). 12 questions
• Compare the Waterfall, V-Model, Iterative, Spiral and Agile models on requirements stability, risk handling, customer involvement, documentation, and suitability for safety-critical or regulated systems. 18 questions
• Select and justify a process model for a given project scenario, considering size, criticality, requirements volatility, regulatory constraints and team distribution. 9 questions
• Analyse the NASA Apollo, Healthcare.gov and Boeing avionics case studies to explain how the choice and execution of the process model contributed to success or failure. 9 questions

Requirements types and elicitation

• Distinguish user requirements from system requirements, and functional from non functional requirements; classify non-functional requirements as product, organisational or external. 15 questions
• Write non-functional requirements in a verifiable, measurable form (for example response time, throughput, availability, mean time to failure). 12 questions
• Describe elicitation methods (interviews, questionnaires, observation and ethnography, workshops and JAD sessions, prototyping, document analysis) and select suitable methods for a given stakeholder situation. 18 questions
• Identify the stakeholders of a system and explain common elicitation problems: tacit knowledge, conflicting requirements, domain jargon and a changing business environment. 12 questions

Specification, validation, traceability and change

• Describe the purpose, structure and content of a Software Requirements Specification (SRS), with reference to ISO/IEC/IEEE 29148. 15 questions
• Write a use case (actors, preconditions, main success scenario, alternative and exception flows) and a user story with acceptance criteria, applying the INVEST criteria and the Given–When–Then format. 17 questions
• Specify best-case (main success) and worst-case (exception, failure and misuse) scenarios for a requirement, and explain why worst-case scenarios expose missing requirements. 13 questions
• Describe requirements validation checks (validity, consistency, completeness, realism, verifiability) and techniques (reviews, prototyping, test-case generation). 13 questions
• Construct and interpret a requirements traceability matrix, and describe a requirements change management process (change request, impact analysis, approval, baseline update). 11 questions
• Analyse the hospital management system and government tax system case studies to identify the requirements engineering failures involved and how they could have been prevented. 17 questions

Design principles and architectural styles

• Explain abstraction, modularity, information hiding and separation of concerns as design principles. 14 questions
• Define cohesion and coupling, rank their types (from coincidental to functional cohesion; from content to data coupling), and evaluate a given design in terms of them. 17 questions
• Describe the layered, client–server, microservices and event-driven architectural styles, including their components, connectors and typical uses. 20 questions
• Compare architectural styles against quality attributes (performance, scalability, availability, maintainability, security) and select a style for a given scenario. 13 questions
• Analyse the microservices case study to explain the trade-off between independent 9 questions
• deployability and the costs of distribution (network latency, data consistency, operational complexity). 17 questions

UML structural and behavioural modelling

• Distinguish UML structural diagrams from behavioural diagrams and state the purpose of each main diagram type. 13 questions
• Draw and interpret a class diagram showing associations, multiplicity, aggregation, composition, generalisation and dependency. 13 questions
• Draw and interpret use case, sequence, activity and state machine diagrams for a given scenario. 17 questions
• Describe component and deployment diagrams and relate them to an architectural style. 11 questions

Design patterns: purpose, categories and creational patterns

• Explain what a design pattern is, the elements of a pattern description (name, problem, solution, consequences), and the benefits and risks of using patterns. 5 questions
• Classify design patterns into the creational, structural and behavioural categories and state the intent of each category. 11 questions
• Describe the intent, structure and consequences of the Singleton pattern, including thread-safety concerns and why overuse makes it an anti-pattern. 7 questions
• Describe the Factory Method pattern, distinguish it from a simple factory and from Abstract Factory, and identify where it reduces coupling. 17 questions
• Describe the intent, structure and an example use of at least one structural pattern (Adapter, Facade or Decorator). 15 questions

Behavioural patterns, MVC and anti-patterns

• Describe the Observer pattern (subject, observers, notification, push and pull models) and identify it in code or in a class diagram. 11 questions
• Describe the Strategy pattern and explain how it replaces conditional logic with composition. 8 questions
• Explain Model–View–Controller (MVC), the responsibilities of each component, and why MVC is classed as an architectural or compound pattern rather than a single design pattern. 8 questions
• Select an appropriate pattern for a given design problem and justify the choice. 12 questions
• Define anti-patterns and recognise common ones (God Object, Spaghetti Code, Golden Hammer, Lava Flow, copy-and-paste programming) together with their remedies. 14 questions
• Analyse the use of the Observer pattern in distributed systems (publish–subscribe, message brokers) and explain the issues of message ordering, delivery guarantees and coupling. 12 questions

Coding standards, secure coding and code review

• Explain the purpose of coding standards and style guides (readability, consistency, defect prevention) and apply naming, formatting and commenting conventions. 20 questions
• Describe secure coding principles (input validation, output encoding, least privilege, defence in depth, failing securely, safe handling of secrets) and relate them to common vulnerability classes such as injection and broken access control (OWASP Top 10). 14 questions
• Describe code review practices (formal inspection, walkthrough, pull-request review), including the roles involved and the use of checklists. 17 questions
• Explain what static analysis tools detect (style violations, code smells, potential defects, security vulnerabilities), name examples (linters, SonarQube), and state their limitations, including false positives and false negatives. 14 questions

Version control, build automation and CI/CD pipelines

• Explain the purpose of version control and use core Git concepts: repository, commit, branch, merge, rebase, pull request and tag. 15 questions
• Compare branching strategies (Git Flow, GitHub Flow, trunk-based development) and select one for a given team context. 13 questions
• Describe build automation tools (for example Make, Maven or Gradle, npm) and the stages of a CI/CD pipeline: build, test, analyse, package and deploy. 15 questions
• Analyse the Linux kernel development workflow (patch review on mailing lists, maintainer hierarchy, merge window, the origin of Git) as an example of large-scale distributed construction. 16 questions

Test levels and test-case design

• Define software testing, distinguish verification (“are we building the product right?”) from validation (“are we building the right product?”), and explain why testing can show the presence but not the absence of defects. 16 questions
• Describe unit, integration (top-down, bottom-up and big-bang, with stubs and drivers), system and acceptance testing (alpha, beta, user acceptance), and regression testing. 24 questions
• Derive black-box test cases using equivalence partitioning, boundary value analysis and decision tables. 14 questions
• Derive white-box test cases for statement and branch coverage, calculate cyclomatic complexity from a control-flow graph, and interpret coverage results. 12 questions

Test automation, defect tracking and V&V strategy

• Describe test automation, test frameworks (the xUnit family such as JUnit or pytest; UI automation tools such as Selenium) and the test automation pyramid. 14 questions
• Explain test-driven development (red–green–refactor) and its relationship to automated regression testing. 17 questions
• Describe the defect life cycle and the contents of a defect report, and distinguish defect severity from priority. 7 questions
• Describe verification and validation strategies, static (reviews, inspections, static analysis, formal verification) and dynamic (testing), and plan a V&V approach for a safety-critical system. 28 questions
• Analyse the Toyota unintended acceleration case to explain the roles of code quality, static analysis findings, the limits of testing and independent V&V in embedded safety-critical software. 9 questions

Software quality and the ISO/IEC 25010 model

• Define software quality from the user, product and process perspectives, and distinguish quality assurance from quality control. 9 questions
• Describe the ISO/IEC 25010 product quality model (its characteristics and sub characteristics) and the quality-in-use model, stating which edition of the standard is being used. 16 questions
• Apply the quality model to specify measurable quality requirements for a given system and to evaluate a product against them. 11 questions
• Describe software reviews and audits (management review, technical review, inspection, audit) and their purposes within quality assurance. 18 questions

Quality metrics and code refactoring

• Distinguish product, process and project metrics, and explain the Goal–Question–Metric (GQM) approach to choosing metrics. 11 questions
• Calculate and interpret maintainability metrics: lines of code, cyclomatic complexity, coupling and cohesion metrics (for example CBO and LCOM) and the maintainability index. 12 questions
• Calculate and interpret reliability metrics: MTTF, MTTR, MTBF, availability [MTTF ÷ (MTTF + MTTR)], defect density, POFOD and ROCOF. 19 questions
• Describe security metrics such as vulnerability counts by CVSS severity, mean time to remediate, and the proportion of code covered by security testing. 11 questions
• Define refactoring, identify common code smells (long method, large class, duplicated code, feature envy) and select behaviour-preserving refactorings (extract method, rename, move method). 10 questions
• Analyse healthcare cybersecurity breach cases to link quality lapses (unpatched systems, weak authentication, inadequate audit logging) to their consequences, and propose quality controls. 17 questions

Planning, estimation and scheduling

• Describe project planning activities and the contents of a project plan, and contrast plan-driven planning with agile release and sprint planning (velocity, story points). 13 questions
• Construct a work breakdown structure (WBS) for a given project. 15 questions
• Describe estimation techniques: expert judgement, estimation by analogy, planning poker, function point analysis and algorithmic cost models. 14 questions
• Calculate effort and duration using the COCOMO II Post-Architecture model from size (KSLOC), scale factors and effort multipliers, and explain how each affects the estimate. 15 questions
• Construct a schedule using a Gantt chart and an activity network, identify the critical path, and allocate resources to activities. 19 questions

Risk management, teams and project outcomes

• Describe the risk management process: identification, analysis (probability and impact), planning (avoidance, mitigation, transfer, acceptance) and monitoring. 21 questions
• Calculate risk exposure (probability × impact) and prioritise risks in a risk register. 9 questions
• Explain team organisation, communication overhead [n(n − 1)/2 channels], Brooks’s law, and the factors that affect team motivation and communication. 13 questions
• Interpret the Standish Group CHAOS Report outcome categories (successful, challenged, failed) and its reported success factors. 10 questions
• Evaluate the published methodological criticisms of the CHAOS Report and their implications for how its figures should be used. 9 questions

Configuration management and release management

• Define software configuration management and describe its activities: configuration identification, change control, status accounting and configuration audit. 10 questions
• Explain version control in depth: baselines, merge conflict resolution, tagging, semantic versioning (MAJOR.MINOR.PATCH), and monorepo versus multi-repo organisation. 18 questions
• Describe release management (release planning, packaging, release notes, rollback) and deployment strategies (blue–green, canary, rolling, feature flags). 11 questions
• Distinguish continuous integration, continuous delivery and continuous deployment. 8 questions

DevOps, Infrastructure as code and monitoring

• Explain DevOps culture and principles (shared ownership; the “three ways” of flow, feedback and continual learning) and how DevOps differs from separate development and operations. 14 questions
• Describe Infrastructure as code (declarative and imperative approaches; tools such as Terraform and Ansible) and the role of containerisation (Docker) and orchestration (Kubernetes). 21 questions
• Describe monitoring and observability (logs, metrics, traces, alerting) and interpret the four DORA metrics: deployment frequency, lead time for changes, change failure rate and time to restore service. 17 questions
• Analyse the Amazon deployment pipeline case study to explain how automation, small batch sizes and service ownership enable frequent, low-risk deployment. 13 questions

Software maintenance and legacy systems

• Classify maintenance as corrective, adaptive, perfective or preventive, and explain why maintenance dominates lifetime cost. 11 questions
• Describe the characteristics and risks of legacy systems and the strategies for dealing with them: scrap, continue maintaining, re-engineer, wrap or encapsulate, migrate, or replace. 16 questions
• Describe the activities of software re engineering: reverse engineering, source code translation, program structure improvement and data re-engineering. 11 questions
• Analyse the air-traffic control legacy modernisation case to evaluate modernisation strategies and their risks. 11 questions

Technical debt, refactoring strategy and evolution

• Define technical debt, classify it as deliberate or inadvertent and prudent or reckless, and explain how it accrues “interest” 11 questions
• Plan refactoring strategies at system scale (continuous versus planned refactoring, the strangler fig pattern, branch by abstraction) and explain how automated tests make refactoring safe. 10 questions
• Explain Lehman’s laws of software evolution (for example continuing change and increasing complexity) and their implications for maintenance planning. 8 questions
• Describe evolutionary process models (prototyping, incremental, spiral) and the staged model of a software system’s lifetime (initial development, evolution, servicing, phase-out). 11 questions

Ethics and professional practice

• Describe the eight principles of the ACM/IEEE-CS Software Engineering Code of Ethics and Professional Practice: Public, Client and Employer, Product, Judgment, Management, Profession, Colleagues and Self. 14 questions
• Apply the code to analyse ethical dilemmas in software development, such as pressure to release known defects, whistle-blowing, conflicts of interest and intellectual property. 14 questions
• Explain privacy principles (data minimisation, consent, purpose limitation, privacy by design) and their engineering implications. 16 questions
• Describe the obligations that Ghana’s Data Protection Act, 2012 (Act 843) places on systems that process personal data. 9 questions
• Analyse the Cambridge Analytica case to identify the ethical and engineering failures in data access, consent and platform design. 5 questions

Responsible engineering and emerging trends

• Explain algorithmic bias in AI-integrated software, its sources (biased training data, proxy variables, feedback loops) and mitigations (fairness testing, representative data, human oversight). 11 questions
• Describe sustainability in software engineering: energy-efficient design, green software practices and long-term social responsibility. 12 questions
• Evaluate AI-assisted development (code-generation assistants, AI-based testing) in terms of productivity, code quality, security, licensing and the need for human review. 12 questions
• Describe blockchain-based software engineering (smart contracts, immutability, consensus) and identify its distinctive testing and maintenance challenges. 12 questions