NFR-to-Code Traceability in a Blockchain-IoT System: An Empirical Study.
Abstract
. Requirement-to-Code traceability has been widely studied, yet existing research and public benchmarks remain largely centered on functional requirements (FRs). In contrast, traceability for non-functional requirements (NFRs) remains more difficult and underexplored, which hinders the verification of critical quality concerns such as security and reliability. This paper studies NFR-to-Code traceability based on a realworld blockchain-IoT project. We design an annotation protocol for constructing trace links across heterogeneous artifacts and build a manually curated subset containing both FR and NFR links. Using this subset, we examine the characteristics of NFR traceability and further evaluate four representative retrieval baselines: TF-IDF, BM25, LSI, and WMD. The results show that FR-to-Code tracing is consistently easier than NFR-toCode tracing, while security-related NFRs are the most difficult subset. They further indicate that the main challenge of NFR traceability lies not in requirement availability, but in implementation evidence that is distributed and not clearly localized in code. Keywords: Requirements traceability · Non-functional requirements · Empirical study · Software quality · Information retrieval 1 Introduction Requirement-to-Code traceability refers to establishing explicit links between requirements and their implementing code elements [6]. Such trace links support important software engineering tasks, including requirement validation, change impact analysis, regression testing, and compliance checking [20]. More importantly, they play a critical role in software quality assurance by enabling the verification of whether key requirements, especially those related to security and reliability, are properly implemented in code. However, most existing studies and datasets mainly focus on functional requirements (FRs) [1], which are typically associated with explicit system behaviors and can be more directly mapped ⋆ Corresponding author. 2 Y. Wang et al. to identifiable implementation logic in code. In real-world systems, however, non-functional requirements (NFRs) are equally critical, especially for quality attributes such as secur