Application of IEC/EN 62304 at an advanced stage of software development

Y

yurucamp

Hi ! I'm fairly new to the site and the world of standards in general, and I find myself with a lot of questions everyday.

Currently, the company I work for almost finished developing an embedded software, run by a platform also developed by the company. But it was only recently that it was established as a medical software.
In order to put our product on the market, we need to comply to the MDD directive and decided to apply the hamonized standards in order to. The thing is, the standard EN/IEC 62304 has a huge part about the development process of the software, and our software is almost complete. At the end of the day, if we establish every process and documents needed, can we say we comply to this standard?
The implementation of some certain software items haven't been tested (no test procedure) and for those that did go through tests, we haven't documented it.
So I was wondering if stating we're complying to 62304 was a "lie" since it wasn't taken into account since the beginning, or if regulatory authorities could invalid our CE marking because of it.

Sorry if some of my statements seem naive, as I said, I'm new to the field.
I might post more on this thread if any more questions pop up.

Thanks for helping ! Please feel free to ask for any complementary information if it helps answering my question. :)
 

yodon

Leader
Super Moderator
Certainly don't try to lie your way through things!

First, set up the necessary procedures (establish a documented software development life cycle) which describes the things you do do implement the standard.

Second, determine the software safety class (this has to be documented with rationale) then do a gap assessment against where you currently are -v- where you need to be.

Third, take the necessary actions to resolve the gaps. Yes, you will have to retrospectively document things. Yes you will have to gather test material that provides objective evidence that the software requirements have been met.

If time is short, you should consider engaging with a consultant that can facilitate a lot of this. The standard doesn't really introduce any new software engineering concepts but there are some subtleties that someone with experience can help you through.
 

glork98

Involved In Discussions
You'll need to create the processes and apply them to the code. That includes having documented processes and executing them on the existing product. It's not just the testing but the quality practices that are expected to be applied during product development. This would include doing hazard analysis and writing the requirements and design documents and reviewing them.

You're not "done" until all that is done. If you think it's a huge addition to the work then you're getting tuned in to what's ahead. Saying that you have processes but they came too late to use won't be acceptable.

The level of work is indicated by the risk the device poses to patients and users. Establish that first.
 

3dBUnderThe Limit

Starting to get Involved
IEC 62304 1.1 has a new section regarding Legacy software that has not been developed according to 62304, that could be a route to solve your problems. You will in the end need the processes required by 62304 for further development, but at least you will know what you need to do in the first stage to establish a baseline for continued work according to 62304.
 
Last edited:

yodon

Leader
Super Moderator
I don't think I would recommend taking the legacy approach with software currently under development. For one, the optics are quite bad and doesn't demonstrate the manufacturer understood the requirements in the first place. For another, there's still a substantial chunk of work to do to backfill, even then. Might as well do it right.
 
Top Bottom