Requirements Traceability Matrix

• RTM is a structured artifact that maps software requirements to project elements like design, code, and tests, ensuring traceability and regulatory compliance.
• It supports rigorous change impact analysis by clearly linking requirements to downstream artifacts for verification, validation, and systematic gap analysis.
• Automated approaches using IR, deep learning, and formal methods enhance RTM accuracy, streamline maintenance, and reduce manual errors.

A Requirements Traceability Matrix (RTM) is a structured, often tabular, construct that makes explicit the set of trace links between software requirements and other project artifacts—such as architectural components, low-level designs, code modules, test cases, legal and regulatory provisions, or higher-level user needs—across the system’s lifecycle. Originating as a regulatory and standards-mandated artifact in safety-critical domains, the RTM now underpins many verification, validation, and maintenance activities by providing a concrete mapping from intent to implementation to verification and compliance points (Guo et al., 17 May 2024).

1. Fundamental Concepts and Purposes

The RTM captures, for each requirement (frequently represented as rows), the set of downstream or cross-cutting artifacts (columns) with which it is linked. The primary functions of the RTM are:

• Coverage: Ensure every requirement has an explicit realization in code/design and is adequately verified by associated test artifacts (Guo et al., 17 May 2024, Unterkalmsteiner, 2023).
• Change Impact Analysis: Support rigorous impact assessment: modifying a requirement can trigger the identification of all artifacts (code, tests, regulatory mappings) that may require follow-up (Naumcheva et al., 25 Feb 2025).
• Verification and Validation (V&V): Provide an auditable, reproducible mapping for compliance with standards (DO178C, ISO 26262, IEC 62304, GDPR) and facilitate systematic coverage checks and gap analysis (Borichev et al., 14 Dec 2024, Aravantinos et al., 2018).
• Process Transparency: Reduce organizational and developer dependence by externalizing design rationale in an artifact-centric, rather than individual-knowledge-centric, format (Tsiperman, 7 May 2025).

The RTM is thus both an evidence artifact and a pragmatic development tool, supporting the full traceability lifecycle: link elicitation, maintenance, evolution, and regulatory assessment.

2. RTM Structures and Formal Representations

RTMs are structured either as rectangular matrices, graph-based models, or relation tables depending on the granularity required by the domain or toolchain (Naumcheva et al., 25 Feb 2025, Aravantinos et al., 2018):

• Tabular Form: Rows = requirements; columns = artifacts (designs, code modules, tests, legal codes); cell[i,j] = 1 if a trace exists. This is the classical spreadsheet or database instance (Guo et al., 17 May 2024, Unterkalmsteiner, 2023).
• Graph-Based Models: Artifacts are nodes, and traceability relationships are typed, directed edges. The transitive and compositional properties enable rapid impact analysis and link propagation (Naumcheva et al., 25 Feb 2025).
• Relation Sets: Formally, trace links are subsets τ: R ⊆ A × B (e.g., requirements × code, or requirements × legal provisions), with additional typing or rationale metadata for complex domains (Niu et al., 21 Apr 2025, Etezadi et al., 7 Feb 2025).
• Hybrid/Expansion: Domains such as DNN-based projects require additional artifact classes (datasets, architecture configurations, hyperparameters, metric artifacts), with the RTM expanded accordingly (Aravantinos et al., 2018).

The granularity (e.g., requirement-to-method, requirement-to-class, requirement-to-regulation) is configurable based on lifecycle phase and compliance needs.

3. Automated Methods for Trace Link Recovery

Manual RTM construction is prohibitively laborious and error-prone, motivating a spectrum of automated and semi-automated approaches:

3.1 Information Retrieval (IR) and Statistical Approaches

• TF–IDF/Vector Space Models (VSM): Each artifact is represented as an n-dimensional term vector, with similarity (cosine, Euclidean) computed between candidates (Al-Saati et al., 2015, Guo et al., 17 May 2024).
• Latent Semantic Indexing (LSI): Reduces term-document matrices to low-rank conceptual spaces via SVD, mitigating synonymy and sparsity (Al-Msie'deen, 2023).
• Enrichment with Biterms: Methods such as TAROT extract consensual biterms from both requirements texts and code artifacts, creating “pseudo-terms” that enrich standard IR input, and weigh candidate links globally and locally with domain-informed importance functions. Empirically, this approach improves AP by 21.9% and MAP by 9.3% over classic IR methods (Gao et al., 2022).
• Statistical Term Extraction: Ten alternative term-weighting metrics, including normalization and IDF variations, significantly increase recall but may degrade precision (Al-Saati et al., 2015).

3.2 Taxonomy- and Ontology-Driven Early Tracing

• Domain Taxonomy Anchors: Linking requirements to domain-specific controlled vocabularies enables early RTM construction before downstream artifacts exist. Early links propagate via matrix or relation multiplication as design/tests are mapped to the same taxonomic concepts (Unterkalmsteiner, 2023).
• Heuristic and Semantic Scoring: Recommenders blend word2vec-derived similarities, exact matches, and user/history features to propose links, enabling high consistency and recall but requiring manual vetting for accuracy.

3.3 Deep Learning and Transformer Models

• RNN/GRU Architectures: Bidirectional GRUs trained on domain-specific embeddings (e.g., for safety-critical control) surpass VSM/LSI in MAP and F1, achieving up to 0.749 F1 with 100% recall (Guo et al., 2018).
• Transformer-Based (BERT): Contextual representations of artifact pairs result in higher F1 (typically +5–10 percentage points) over traditional IR baselines (Guo et al., 17 May 2024).
• Retrieval-Augmented Generation (RAG) and Prompting: Generative LLMs (Claude, GPT-4o) when supplied with relevant demonstrations and carefully designed prompts yield recall up to 84% and F1 up to 0.36–0.99 on real industry data, substantially ahead of static classifier baselines (Niu et al., 21 Apr 2025, Etezadi et al., 7 Feb 2025, Jin et al., 14 Sep 2025).

3.4 Formal Methods and Hierarchical Decomposition

• Adaptive Clustering Method (ACM): Explicit multi-level artifact hierarchies (business process → service → module → test) are clustered using similarity thresholds, with trace matrices built at each abstraction level. This yields “seamless” traceability across the architecture (Tsiperman, 7 May 2025).
• Object-Oriented Graphs (UOOR): Nodes correspond to fine-grained project elements; edges are typed formal links (implements, refines, validates). Closure and composition properties allow efficient propagation and update of trace relationships (Naumcheva et al., 25 Feb 2025).

4. RTM Maintenance, Evolution, and Tool Support

Maintenance is governed by two main paradigms:

• Full Re-Recovery: Recompute all links from scratch after artifact changes; this is resource-intensive and may lose manual vetting annotations (Guo et al., 17 May 2024).
• Incremental Link Evolution: Incrementally update only those links affected by changes, typically by recomputing similarity scores for modified artifacts and pruning links below the acceptance threshold. Human-in-the-loop correction is essential to maintaining quality, with tools typically highlighting or prioritizing candidate links (Guo et al., 17 May 2024).

Change impact notifications and relationship closure (as in UOOR) enable rapid, targeted review in the event of artifact modification (Naumcheva et al., 25 Feb 2025). CI pipeline integration and continuous delivery (e.g., extraction and re-linking of consensual biterms in TAROT) ensure the RTM remains current as code, requirements, or environments evolve (Gao et al., 2022).

5. Metrics, Evaluation Protocols, and Empirical Results

RTM construction and link recovery algorithms are rigorously evaluated using the following quantitative measures:

Metric	Formula / Description	Primary Refs
Precision (P)	$P = \frac{TP}{TP + FP}$	(Al-Saati et al., 2015, Guo et al., 17 May 2024)
Recall (R)	$R = \frac{TP}{TP + FN}$	(Al-Saati et al., 2015, Guo et al., 17 May 2024)
F1-Score	$F_1 = 2 \cdot \frac{P \cdot R}{P + R}$	(Al-Saati et al., 2015, Gao et al., 2022)
MAP	Mean of average precision per query	(Gao et al., 2022, Guo et al., 17 May 2024)
Statistical	Wilcoxon rank-sum, Cliff's δ, AUC	(Gao et al., 2022, Etezadi et al., 7 Feb 2025)

Empirical observations:

• TAROT: +21.9% AP and +9.3% MAP over pure IR, $p \leq 0.05$ in 42/54 paired system/model cases (Gao et al., 2022).
• BI-GRU: 0.598 precision, 1.000 recall, 0.749 F1—41% increase in precision over VSM (Guo et al., 2018).
• UserTrace: F1 = 0.36 for trace link recovery, UR generation F1 = 0.91, significant improvements in user validation accuracy and time (Jin et al., 14 Sep 2025).
• RAG-LLM in automotive (TVR): validation accuracy 98.87%, correct recovery rate 85.5% (Niu et al., 21 Apr 2025).
• Prompt engineering for legal RTMs: recall 84% (Rice/LLM) vs. 15% (sentence-transformer classifier) on GDPR datasets (Etezadi et al., 7 Feb 2025).
• LSI+FCA (YamenTrace): perfect recall, average precision 50–80% for requirement-to-class tracing in object-oriented systems (Al-Msie'deen, 2023).

Evaluation is performed on standard datasets (NASA CM-1, MODIS, iTrust, others), and industry-specific corpora. Best practices include cross-validation, negative sampling, statistical significance reporting, and effect sizes (Guo et al., 17 May 2024).

6. Advanced Domains: DNNs, Regulatory Traceability, and Multi-Level Architectures

6.1 DNN/ML-Driven Systems

RTMs for deep neural networks adapt classical tracing by introducing artifacts for domain coverage models, dataset partitions, hyperparameter configurations, weight versions, and performance metric artifacts. The traceability chain is extended over all model training iterations and justifies each version by measured performance improvements, not only source code structure. This supports V&V in the absence of classical code artifacts (Aravantinos et al., 2018).

6.2 Regulatory and Legal Compliance

Constructing RTMs between requirements and legal provisions (e.g., GDPR, HIPAA) employs prompt-based generative models for high recall, with explicit rationales supporting human-in-the-loop vetting. RAG and fine-tuned LLM approaches are substantially more robust to semantic complexity and regulatory variation than static similarity classifiers (Etezadi et al., 7 Feb 2025).

6.3 Multi-Layered System Architectures

The Adaptive Clustering Method instantiates explicit, bijective traces at every architectural level (business process, operation, service, module, class method, test case), enforcing seamless decomposition and supporting automated V&V and coverage analysis (Tsiperman, 7 May 2025).

7. Practical Considerations and Tooling Strategies

Key recommendations for the empirical and industrial deployment of RTMs:

• Begin with a core of human-validated links and a project/domain-specific vocabulary (Guo et al., 17 May 2024).
• Choose IR, ML, or generative models congruent with artifact complexity, corpus richness, and tolerable false positive/negative rates (Jin et al., 14 Sep 2025, Niu et al., 21 Apr 2025).
• Employ explainability: each suggested link should include rationale, term highlights, or domain graph paths to facilitate analyst review (Guo et al., 17 May 2024).
• Integrate traceability maintenance into repository and CI pipelines; automate candidate generation and diffing on change events (Gao et al., 2022, Jin et al., 14 Sep 2025).
• Use tool support for bidirectional querying, visualization (as in FCA or graph-based RTMs), and stakeholder notification systems (Naumcheva et al., 25 Feb 2025, Al-Msie'deen, 2023).
• Enforce continuous review and adaptation of trace link models as project artifacts evolve and domain coverage changes (Unterkalmsteiner, 2023).

Taken together, the modern RTM—whether tabular, graph-based, or multi-relational—is a rigorously instrumented, dynamically maintained, and empirically optimized artifact. Its construction and evolution leverage advances in NLP, IR, deep learning, and formal methods to address the grand challenge of traceability: integrating heterogeneous artifacts, supporting regulatory assurance, and enabling responsive, low-overhead software engineering (Guo et al., 17 May 2024, Tsiperman, 7 May 2025, Gao et al., 2022, Aravantinos et al., 2018, Naumcheva et al., 25 Feb 2025, Niu et al., 21 Apr 2025, Etezadi et al., 7 Feb 2025, Unterkalmsteiner, 2023, Al-Msie'deen, 2023, Al-Saati et al., 2015, Jin et al., 14 Sep 2025).