4 ms·
You can use any SOUP you want, the rule is that it is up to you, medical device seller, to write the requirements (performance or other) you want from it, and v
by seren 8y ago
You can use any SOUP you want, the rule is that it is up to you, medical device seller, to write the requirements (performance or other) you want from it, and verify them. Additionally, you need to assess any risk added by the inclusion of the SOUP and mitigate them. (The effort depends on whether you include it into a Class A/B/C sw unit). You are ultimately responsible for any bug in the SOUP. And this is rather orthogonal to license of the sw.
Since this is a daunting task to verify something like QT, now you can at least pay for the certified version, and point some of your risk mitigations directly to the QT specifications/FMEA/Test results.
The usual strategies to avoid having to validate a huge external SW is to either have HW redundancies, or to segregate it completely from your main SW so that any failure of your SOUP is harmless.
- pknopf 8y agoWe use Yocto. By default, the distribution is super minimal. As I enable features in the Kernel, or add dependencies, they are driven based off of some functionality of our GUI/device which is tested/validated before each release. So, if I enable squashfs in the kernel, and I can boot my box (which uses it), I can say that I have tested the requirements needed from the Kernel. If I add in openssl for TLS connection to mobile devices and have validation in place to ensure connectivity, I can say that I have tested the required functionality of openssl. I'd think this would be enough, but I never can seem to satisfy regulatory people. They are (in general) not very technical.
- seren 8y agoI would say it depends a bit of the usage of the system, and what is the worse case scenario of a failure (patient data corrupted, life sustaining devices switched off), in which case you might need to add another mitigation (CRC check, manual procedure) independent of your Yocto box.
- pknopf 8y agoI would understood under those circumstances where patients are at risk. I'm not trying to get consultation services from HN, but for the sake of discussion, these devices are recorders used for post-op educational purposes. External/separate monitors are used for the actual operation. I bring this up because the risk is very low, yet I have had multiple customers who wish to distribute our product ask about this. This is turning into more of a rant than anything. I'll end with this comment.
- ska 8y agoYou aren’t expected to do anything in analysis and mitigation for SOUP that you shouldn’t already be doing for all of your own software. The point is you can’t just punt on that stuff when you use others software. It doesnt have to be that onerous, but you do need to put some thought into it.