IEC 62304:2006 “Medical device software – Software life cycle processes”  is a standard which specifies life cycle requirements for the development of medical software and software within medical devices. Its guidelines require developers to apply language subsets. In this IEC 62304 compliance case study, IEC 62304 and MISRA C were used in combination.

NOW Technologies—a close knit, dedicated team of professionals—helps people with disabilities live an independent life. Based in Budapest, Hungary, and founded in 2014, NOW Technologies works closely with injured and disabled people along with medical and rehabilitation professionals. Understanding user requirements and getting their feedback is pivotal to ensuring that their products are not only safe but also sufficiently intuitive that they require the least amount of training possible. The scope of their work means that NOW Technologies are obliged to comply with many standards, including IEC 62304.

Traditionally, people with disabilities have to deal with a variety of controllers to interact with their computers, mobile phones, and other devices. NOW Technologies created Gyroset Glory to be a universal controller and a discrete, comfortable headset. Used in combination with Gyroset Link, Gyroset Glory also empowers disabled people to drive their power wheelchairs.

Not everyone has the physical ability to operate a wheelchair using a joystick and so alternative input devices, such as a headset, are required. The Gyroset Glory ensures intuitive wheelchair operation through the use of proportional controls so that a user can move the chair in any direction proportionally to the signal from the input device.

IEC 62304 compliance case study: Setting the standards

Mark Istvan, Managing Director of NOW Technologies

The  multi-purpose nature of the Glory Gyroset required compliance to a host of different standards depending on its role:

• Medical equipment—In some use cases, the product might be viewed as medical equipment, which implies a need for conformance to IEC 60601, a widely accepted benchmark for medical electrical equipment. Compliance with IEC 60601-1 has become a requirement for the commercialization of electrical medical equipment in many countries.
• Wheelchair controller—In its more specific deployment as a wheelchair controller, ISO 7176 becomes relevant. ISO 7176-14:2008 specifies requirements and associated test methods for the power and control systems of electrically powered wheelchairs and scooters. It sets safety and performance requirements that apply during normal use and some conditions of abuse and failure. It also specifies methods of measurement of the forces necessary to operate controls and sets limits on the forces needed for some operations.
• Autonomous wheelchair—Although the early Gyroset headsets were not required to comply with functional safety standards, future versions of the controllers will give wheelchairs an autonomous capability and so will clearly need to be certified to safety-critical standards. NOW Technologies took the initiative therefore to develop their software in accordance with IEC 62304:2006 “Medical device software – Software life cycle processes”.

“The connected nature of the Gyroset controller family meant that neither security nor safety were ever far from our thoughts” confirmed Mark Istvan, Managing Director of NOW Technologies.

IEC 62304 and MISRA C

As part of that safety-critical process, NOW opted to comply with the MISRA C:2012 standard. IEC 62304 recommends the use of a language subset, and IEC 62304 and MISRA C is a popular combination.

The influence of the MISRA organization continues to grow across the safety critical sectors. In April 2016, MISRA released a summary of the extent to which MISRA C:2012 could be mapped to ISO/IEC TS 17961:2013, a technical specification outlining coding rules for secure C.  That showed that most of the 46 C Secure rules were covered by the MISRA C:2012 guidelines, and that correlation was improved further with the introduction of MISRA C:2012 Amendment 1 and its 14 additional guidelines.

The more recent release of MISRA C:2012 (Edition 3, Revision 1) sees a welcome continuation of the informative and educational approach adopted by the original version of MISRA C:2012. MISRA C:2012 (Edition 3, Revision 1) is the first revision of MISRA C:2012, and  consolidates the original MISRA C:2012 document with the security guidelines established in Amendment 1, and the corrections outlined in Technical Corrigendum 1.

IEC 62304 compliance case study: Getting the code right for MISRA C

For C programmers working on safety- or security-critical applications, restrictions and guidelines to ensure safe coding practices can be painful. Features of the C language are designed to make your work easier and more efficient and to provide work-arounds for obstacles. But, these are often just the features that the “language subset” guidelines disallow.

However, since  life-critical applications require code to be developed to the most stringent best practice, compliance with these guidelines are a common theme in functional safety standards across the sectors. For example, the guidelines in the MISRA C standard brings a wide range of benefits to a code base by

• Promoting portability and avoiding unexpected results
• Ensuring there is no reliance placed on compiler- or platform-specific constructs
• Identifying unreachable or infeasible code which often indicates a defect that will, at the very least, impact software maintainability
• Prohibiting certain language constructs known to be a source of common errors or security vulnerabilities
• Measurably reducing program complexity
• Improving program testability as well as easing standard compliance and certifiability

To retain these benefits while making restrictions less onerous for developers, MISRA has long made consistent efforts to make rules more precise so that the standard will not prevent reasonable uses or behaviours that have no undesirable consequences. For instance, in the past, macros were prohibited because of the many difficulties they can introduce. However, developers were prevented from using them in circumstances where they provide a neat, convenient and technically sound solution. The current updated MISRA rules allow macros, but limit their use to ensure they are only used properly.

IEC 62304 compliance case study: Specifying a tool chain

To address the various design challenges, NOW Technologies settled on STM32 M3 and M4 devices for the Gyroset range and included the Atollic compiler as part of their Linux-hosted tool chain along with LDRArules to perform their static analysis work.

LDRArules enforces compliance with industry- or user-defined coding standards and provides clear visibility of software flaws that might typically pass through the build and test process and become latent problems. Using LDRArules, NOW Technologies was able to quickly identify any potential faults and security vulnerabilities that the MISRA C:2012 guidelines enforce as well as helping with IEC 62304 compliance.

“Although we clearly wanted the best technical solution for our products, cost is always a factor in the commercial world” noted Mark. “Not only is it a consideration for the initial purchase price, but ease of use was also important for us. We simply couldn’t afford to spend time struggling with a complex interface. Happily, LDRArules was easy to install and to learn”

IEC 62304 compliance case study: Tool classification and validation

By using independently classified and certified test tools for use with functional safety standards like IEC 62304, NOW Technologies was able to make the Glory Gyroset qualification process far less onerous than compliance would otherwise have been.

Software test tools generally fall into the T2 classification as specified by functional safety standards, which includes any tool “that supports the test or verification of the design or executable code, where errors in the tool can fail to reveal defects but cannot directly create errors in the executable software.”

“That LDRArules had already achieved SGS-TÜV SAAR certification was certainly an influential factor in our decision to go with LDRA,” Mark confirmed. “We were confident that their tools would bring additional rigor and scrutiny to the table, and we wanted that assurance and safety from risk.”

IEC 62304 compliance case study: A vision of the future

Despite the impressive credentials of the Gyroset range of products, NOW Technologies are driven by bigger goals. “Glory Gyroset represents the first step along an ambitious product roadmap,” explained Mark.

“Our goal is to help people with disabilities to live an independent life, by providing them with affordable solutions to communicate, create, and work independently, and to enable them to live their lives with mobility,” he affirmed. “There is nothing more frustrating for any individual than for disability to limit their potential. Our products seek to reduce such limitations to an absolute minimum.”

Longer term, Mark also sees a future outside this domain.

“In this particular market, there is big incentive to get things right first time. Because of the risk to personal health, it is simply not feasible to place a prototype for beta test,” he noted. “As a consequence, any feedback we get arrives very late in the development lifecycle.”

“Getting things right first time is a very portable capability” Mark mused. “When combined with the more obvious attribute of a familiarity with the demands of functional safety standards, I believe it puts NOW Technologies in a great place to expand into medical robotics, industrial applications and beyond” he concluded.

Forward together

Wherever the future takes NOW Technologies, it seems certain that LDRA will be involved. “We will definitely continue to use LDRArules in our future projects and will consider other LDRA products as our activities diversify,” confirmed Mark. “LDRArules has been invaluable to us in providing evidence of our adherence to the IEC 62304 standard in general, and to MISRA C rules in particular.”

“Most remarkably, I would estimate that we have saved at least €200k by using LDRArules, which represents a very speedy return on investment for us,” Mark concluded.