IEC 62304 is an international standard that defines software development life cycle (SDLC) requirements for medical device software. It is applicable to medical device software functioning as a component of a medical device and to software that is itself a medical device. Although being compliant with IEC 62304 may not be required for your medical device, there are compelling reasons to employ it anyway.
One reason is that the standard provides a risk-driven approach to software engineering. Each software system is assigned a software safety class (A, B, or C) based on “the risk of harm to the patient, operator, or other people resulting from a hazardous situation to which the software system can contribute in a worst-case-scenario.”1 Then, when developing the software system, specific processes, activities, and tasks are required based on its software safety class. The higher the risk of the software system, the more effort and rigor that must be applied to ensure safety. The standard also allows the software system to be broken into software items, which with appropriate segregation can be assigned a software safety class that is lower than the software system as a whole. The benefit is that your team can spend more time on the higher risk parts of the software system and less time on the lower risk items.
IEC 62304 also addresses the basic philosophy that to development safe medical device software, good software engineering practices must be employed. These good practices include traversing through common SDLC phases like planning, requirements analysis, design, integration, and system testing. Another good practice is the incorporation of verification of phase outputs, like software requirements specifications, design documents, source code, test cases, and test results.
Another reason to use IEC 62304 is due to its flexibility. It provides a framework for software development, risk management, software configuration management, problem resolution, and maintenance, without being prescriptive. Although the requirements for each process, activity, and task are specified, the standard does not provide instructions for how to accomplish them, what software development life cycle to follow, or what tools to use. This can be advantageous to your software development team.
An advantage to this non-prescriptive approach is that you do not have to completely throw away your current procedures, work instructions, and forms; you don’t have to start over. You can perform a gap analysis comparing your current practices with IEC 62304, and make modifications as needed to fill the gaps.
Another advantage is that your software development teams can follow the SDLC model of their choosing, based on what works best for the team and the project, whether that is waterfall, the V-model, incremental, iterative, evolutionary, or some yet to be named model. If the correct processes, activities, and tasks are incorporated, the specific SDLC model doesn’t matter.
Besides being risk-driven, employing good software engineering practices, and being flexible, the activities of IEC 62304 align with the documentation required for FDA premarket submissions. For example, establishing a project’s Software Development Plan as required by IEC 62304 fulfills the software development environment description needed in premarket submissions. Similarly, other documentation needed for premarket submissions like software requirements, architectural design, and test documentation are produced when following IEC 62304.
Choosing to follow IEC 62304 is a clear choice when there must be evidence that the software development process followed is as good as, or better than, what is specified in IEC 62304, but, as you can see, there are many additional benefits to using it as well.
The RND Group has worked with the leading companies in the medical device industry since 1997. The RND Group fully understands the rigor required in designing, developing, documenting, and testing products that are regulated by the FDA. The RND Group has applied that rigor to the software engineering support it has provided for countless product development efforts, and The RND Group can point with pride to products that have been successfully introduced into the medical device marketplace.
Please visit our contact page or call 317-558-6701.
- IEC 62304:2006/AMD1:2015. “Medical device software – Software life cycle processes.”
- “Guidance for the Content of Premarket Submissions for Software Contained in Medical Devices.” FDA. May 11, 2005.