White paper:

Medical Device Software using IEC 62304

This white paper provides an overview of the medical device

software standard IEC 62304 concerning the development of
software life cycle processes.

This document was prepared in May 2024, any content including links and quoted regulation may be out of date. Please refer to the
appropriate source for the most recent information. We endeavour to keep an up-to-date record of information at www.pharmout.net.
©2024 PharmOut. This document has been prepared solely for the use of PharmOut and its clients. Copying is prohibited.

MKT_WPR227_01_r04
PharmOut White Paper: Medical Device Software using IEC 62304

Table of Contents
What is IEC 62304 and “medical device software”? .................................................................... 3
Software Development Lifecycle (SDLC) .................................................................................... 3
1. Software Safety Classification ........................................................................................ 4
2. Software Development Planning .................................................................................... 4
2.1 Methodologies ................................................................................................................. 4
3. Software Requirements Analysis .................................................................................... 5
4. Software Architectural Design ........................................................................................ 6
5. Software Implementation ............................................................................................... 6
6. Software Testing and Integration.................................................................................... 7
7. Software Release & Maintenance ................................................................................... 7
IEC 62304’s Relationship with other Standards.......................................................................... 7
References .................................................................................................................................. 8
Sources ....................................................................................................................................... 8

PharmOut Pty Ltd, ABN: 85 117 673 766, Unit 10, 24 Lakeside Drive, Burwood East, Victoria 3151.
Ph: +61 3 9887 6412, Fax: +61 3 8610 0169, Email: [email protected] Web: www.pharmout.net

©2024 PharmOut. This document has been prepared solely for the use of PharmOut and its clients. Copying is prohibited.
Page 2 of 8 MKT_WPR227_01_r04
PharmOut White Paper: Medical Device Software using IEC 62304

What is IEC 62304 and “medical device software”?

Established in 2006, IEC 62304 remains a foundational standard, with an amendment released
only in 2015. Recognized by regulatory authorities such as the United States, Canada, and
Australia, it is acknowledged as the primary standard for software lifecycle processes for
medical devices (Europe is still in the process of harmonizing IEC 62304 under MDR/IVDR).
Whilst the standard is less prescriptive compared to other standards; it instead provides a
framework through which manufacturers can develop their own software lifecycle processes.
Within scope is “medical device software” defined as either:
▪ Software as a Medical Device (SaMD): software that is a medical device in its own
right.
▪ Embedded software (Software in a Medical Device, SiMD): software that is
incorporated or an integral part of the final medical device.

Software Development Lifecycle (SDLC)

The software development lifecycle (SDLC) is intended to be applied throughout the entire life
cycle of the medical device. The life cycle includes design, production, and post-production
when product is placed on the market.
Key aspects of the process include:
1. Software development planning.
2. Software requirements analysis.
3. Software architectural design.
4. Software implementation.
5. Software testing and integration.
6. Software release and maintenance.
A brief description of each is provided in the sections below1.

1
It is recommended companies purchase the complete standard to ensure full compliance is met.
PharmOut Pty Ltd, ABN: 85 117 673 766, Unit 10, 24 Lakeside Drive, Burwood East, Victoria 3151.
Ph: +61 3 9887 6412, Fax: +61 3 8610 0169, Email: [email protected] Web: www.pharmout.net

©2024 PharmOut. This document has been prepared solely for the use of PharmOut and its clients. Copying is prohibited.
Page 3 of 8 MKT_WPR227_01_r04
PharmOut White Paper: Medical Device Software using IEC 62304

1. Software Safety Classification

IEC 62304 mandates the manufacturer assign the software a ‘software safety classification‘
which assists in determining the level of documentation that will be required.
There are three classifications which are described in Table 1 below. The IEC 62304 standard
provides a flowchart to assist with assignment. The definition of “hazardous situation” is given
in PharmOut Whitepaper “Medical Device Risk Management using ISO 14971”.
Table 1: Software safety classification

Software safety Description

classification

A The software cannot contribute to a hazardous situation.

B The software can contribute to a hazardous situation with

unacceptable risk which can result in non-serious injury
occurring.

C The software can contribute to a hazardous situation with

unacceptable risk which can result in death or serious injury
occurring.

2. Software Development Planning

The software development plan outlines what work and actions will be conducted. The plan can
include:
▪ software development standards, methods and tools
▪ traceability between requirements
▪ software configuration and change management
▪ software problem resolution.

2.1 Methodologies
Whilst IEC 62304 does not mandate a model to follow, traditional development would take a
‘waterfall approach’ where each planned stage would occur sequentially and proceed through
once (refer to Figure 1). However, many software companies have adopted the ‘agile approach’.
This can involve two week ‘sprints’ where work on stages occurs simultaneously and iteratively
(refer to Figure 2).

PharmOut Pty Ltd, ABN: 85 117 673 766, Unit 10, 24 Lakeside Drive, Burwood East, Victoria 3151.
Ph: +61 3 9887 6412, Fax: +61 3 8610 0169, Email: [email protected] Web: www.pharmout.net

©2024 PharmOut. This document has been prepared solely for the use of PharmOut and its clients. Copying is prohibited.
Page 4 of 8 MKT_WPR227_01_r04
PharmOut White Paper: Medical Device Software using IEC 62304

Figure 1: Waterfall methodology.

Figure 2: Agile methodology.

3. Software Requirements Analysis

Requirements are one of the key backbones to the development of software. Incomplete or
ambiguous requirements can lead to development issues or the software not meeting the
intended functionality. Requirements that should be considered can include:
▪ software inputs and outputs
▪ security requirements
▪ user interface requirements (e.g. graphical user interface, GUI)
▪ maintenance requirements.
An example of a software requirement is provided in Table 2.
Table 2: Example of a software requirement

Example: software for analysing a patient scan

Software requirement: The software must be capable of producing a PDF.

PharmOut Pty Ltd, ABN: 85 117 673 766, Unit 10, 24 Lakeside Drive, Burwood East, Victoria 3151.
Ph: +61 3 9887 6412, Fax: +61 3 8610 0169, Email: [email protected] Web: www.pharmout.net

©2024 PharmOut. This document has been prepared solely for the use of PharmOut and its clients. Copying is prohibited.
Page 5 of 8 MKT_WPR227_01_r04
PharmOut White Paper: Medical Device Software using IEC 62304

4. Software Architectural Design

Just like architecture for a building, software architecture describes the structure of the
software, identifying components, describing their interaction and dependency. A simplified
example is provided in Table 3 below that utilizes a layered architecture.
Table 3: Layered architecture of a software2

Example: Layered architecture

Presentation Layer Component Component

(e.g. user interface) e.g. GUI

Application Layer
(e.g. manages application Component Component
functionality)

Data Layer
(e.g. data storage &
Component Component
retrieval)

Generating the architecture should take into consideration:

▪ risk
▪ integration of the components
▪ use of “software of unknown provenance” (SOUP, otherwise known as ‘off-the-
shelf software’ that hasn’t been specifically developed for medical devices)
▪ ease of maintenance.
Verification of the software architecture must be conducted.

5. Software Implementation
This stage is where the design becomes reality – software design is translated into a working
and functional software system by writing the code, configuring settings, and integrating the
various components to create the software.
Verification of the software implementation must be conducted.

2
Richards, M., Software Architecture Patterns, https://www.oreilly.com/content/software-architecture-
patterns/, O’Reilly, August 15, 2015, accessed 8th May 2024.
PharmOut Pty Ltd, ABN: 85 117 673 766, Unit 10, 24 Lakeside Drive, Burwood East, Victoria 3151.
Ph: +61 3 9887 6412, Fax: +61 3 8610 0169, Email: [email protected] Web: www.pharmout.net

©2024 PharmOut. This document has been prepared solely for the use of PharmOut and its clients. Copying is prohibited.
Page 6 of 8 MKT_WPR227_01_r04
PharmOut White Paper: Medical Device Software using IEC 62304

6. Software Testing and Integration

Testing, which was a part of the earlier stages (conducted through verification), focused only on
specific components of the software. This testing phase evaluates the software as a whole and
includes for example the documentation of:
▪ test cases (e.g. input data 123 into the software)
▪ expected results (e.g. input data 123, should give answer 456)
▪ anomalies – deviations from the expected results.
Note that IEC 62304 does not cover validation of the software (refer to IEC 60601-1 or IEC
82304-1).

7. Software Release & Maintenance

Once the software is ready, it can be released for use (Note: IEC 62304 does not cover the final
release of the software). The version of the software is tracked and updated each time there is a
new release or update.
Maintenance process activities are just as important as the software development process
activities. Maintenance activities assist in ensuring the software continues to function as
intended and involves:
▪ creation of a maintenance plan
▪ how feedback will be received, evaluated and resolved
▪ how to evaluate and implement bug fixes, patches, upgrades or obsolescence.

IEC 62304’s Relationship with other Standards

IEC 62304 should not be used in isolation, but instead alongside other important standards in
the medical device industry such as:
▪ ISO 13485 – Medical Device Quality Management Systems.
▪ ISO 14971 - Application of Risk Management to Medical Devices.
▪ IEC 60601 – Medical Electrical Equipment.
▪ IEC 62366 – Application of Usability Engineering to Medical Devices.

PharmOut Pty Ltd, ABN: 85 117 673 766, Unit 10, 24 Lakeside Drive, Burwood East, Victoria 3151.
Ph: +61 3 9887 6412, Fax: +61 3 8610 0169, Email: [email protected] Web: www.pharmout.net

©2024 PharmOut. This document has been prepared solely for the use of PharmOut and its clients. Copying is prohibited.
Page 7 of 8 MKT_WPR227_01_r04
PharmOut White Paper: Medical Device Software using IEC 62304

References
IEC 62304:2006/Amd1:2015: Medical device software – Software life cycle processes
ISO 14971:2019: Medical devices – Application of risk management to medical devices
ISO 13485:2016: Medical Device – Quality management systems
IEC 60601 series: Medical electrical equipment
IEC 62366-1:2015: Medical devices – Part 1: Application of usability engineering to medical
devices
IEC 82304-1:2016: Health Software – Part 1: General requirements for product safety

Sources
Links used within this document are prone to change. Please refer to the appropriate source for
the most recent information. We endeavour to keep an up-to-date record of information at
www.pharmout.net

PharmOut is an international GMP consultancy serving the Pharmaceutical, Medical Device and
Veterinary industries. PharmOut specialises in PIC/S, WHO, United States FDA, European EMA,
and Australian TGA GMP consulting, engineering, project management, training, validation,
continuous improvement and regulatory services.
Our team includes international GMP experts who have previously held leadership roles within
regulatory bodies.
For more information please visit www.pharmout.net or contact us at [email protected].

PharmOut Pty Ltd, ABN: 85 117 673 766, Unit 10, 24 Lakeside Drive, Burwood East, Victoria 3151.
Ph: +61 3 9887 6412, Fax: +61 3 8610 0169, Email: [email protected] Web: www.pharmout.net

©2024 PharmOut. This document has been prepared solely for the use of PharmOut and its clients. Copying is prohibited.
Page 8 of 8 MKT_WPR227_01_r04