Medical firmware: the key points
- IEC 62304 defines a software lifecycle for medical device software, with rigour scaled to the safety class (A, B or C).
- Risk management (ISO 14971) drives the design. Hazards are identified, controlled in software or hardware, and verified.
- Documentation is part of the product: requirements, architecture, unit and system tests, traceability and configuration management.
- India regulates medical devices under the Medical Device Rules, 2017 administered by CDSCO; requirements depend on the device class.
What IEC 62304 asks for
| Activity | What it means in practice |
|---|---|
| Software planning | A documented plan, standards and tools |
| Requirements analysis | Testable software requirements traced to system and risk requirements |
| Architectural design | Defined software items, interfaces and segregation |
| Detailed design and implementation | Coding standard, reviews, static analysis |
| Verification and testing | Unit, integration and system tests with recorded results |
| Release and maintenance | Configuration management, problem resolution and change control |
The amount of documentation scales with software safety class, set by the severity of harm the software could contribute to.
Engineering practices we apply
- Requirements and test cases managed with unique IDs and a traceability matrix.
- MISRA C style rules and static analysis in the build.
- Unit tests with coverage reporting, plus hardware-in-the-loop system tests.
- Defensive design: watchdogs, memory protection where available and safe states on fault.
- Signed updates and rollback, as described in secure OTA updates.
- Cybersecurity risk assessment aligned with regulator expectations.
Hardware and standards context
Electrical safety and EMC for medical electrical equipment fall under IEC 60601-1 and its collateral standards, which affect hardware design as much as firmware. We coordinate with accredited labs and your regulatory consultant. The site portfolio shows our experience with a signed OTA bootloader for an STM32-based diagnostic device; see portfolio.
What we do not do
We provide engineering and documentation. Regulatory strategy, clinical evaluation and submissions to CDSCO or other authorities should be handled with your quality and regulatory team or specialist consultants. This page is information, not regulatory advice.
Sources and further reading
- International Electrotechnical Commission — IEC 62304 and IEC 60601 standards.
- International Organization for Standardization — ISO 14971 and ISO 13485 standards.
- CDSCO — Indian medical device regulator information.
Last reviewed: October 2026. Regulations and product availability change; confirm current rules with the issuing authority before you commit to a design.