IEC 62304: a practical guide for medical device software

What IEC 62304 is

IEC 62304 is the international standard for the software life cycle of medical device software. It does not prescribe a single methodology. Instead it defines the processes, activities, and tasks a team is expected to perform and document across development and maintenance, so that the resulting software is safe and its development is demonstrable.

Software safety classification

The amount of rigour the standard expects scales with risk, expressed as a safety class:

• Class A: no injury or damage to health is possible.
• Class B: non-serious injury is possible.
• Class C: death or serious injury is possible.

Classification is done for the software system and can be refined for software items. Higher classes require more detailed design, verification, and documentation.

Key deliverables to plan for

Across the life cycle, teams typically produce a software development plan, a software requirements specification, an architectural design, detailed design for higher-risk items, verification and integration test records, a software release record, and, throughout, risk management, configuration management, and problem resolution records. The full list is in the IEC 62304 checklist.

Why traceability sits at the centre

IEC 62304 expects a traceable path: software requirements trace to architecture, to the implementation that satisfies them, and to the verification that confirms them, with risk control measures traced too. In spreadsheets and separate documents, that web of links is maintained by hand and drifts. A tool that treats trace links as live data keeps the path honest, which is the difference between coverage you can show an auditor and coverage you have to rebuild first. See how this works for medical device teams.

This guide is educational. It describes what the standard expects. It does not certify any product or organisation as compliant.