Case study · Embedded software

From a list of defects to remediated, verified firmware.

A Central European medical technology company contracted Silurus Software to take over the firmware repositories of its safety-critical surgical device, fix the defects found in the gap analysis in four phases, and add three new device features, under IEC 62304 and FDA expectations.

Client: Central European medical technology company
Duration: Several months
Team: 2 senior embedded engineers, 1 FDA regulatory consultant, 1 project manager
Technology: Embedded C · STM32 · Renode · CI · IEC 62304 · FDA cybersecurity

We do not name the client or the product. Non-disclosure agreements, the client's business interests and the confidentiality of its technology do not allow it.

Context

Firmware that needed a new owner.

The console firmware and the bootloaders had been written and maintained by a single developer. The gap analysis had shown where the code and the released documents disagreed.

The defects ranged from a control loop timing error and a protocol mismatch to buffer overflows, a heap leak and a missing bootloader integrity check.

The company needed the defects fixed and documented before its regulatory submission, and an external team to take the repositories over.

Remediation

For every defect the manufacturer can show what changed, why, and how it was verified.

Challenge

Fix what the review found, and prove it.

The defects were safety relevant, and every change had to stay inside the IEC 62304 lifecycle and the regulatory assumptions of the submission.

Defects hard to reproduce

Some faults depended on the hardware and the operating cycle, so they needed tools of their own to reproduce.

No safety net

The build was not reproducible and there was no CI pipeline.

Documents to keep in step

Every fix and every feature needed updated requirements, design, test reports and traceability.

Solution

Phased remediation, verified at every step.

A one day workshop, then four phases, each verified, documented and accepted.

A team of two senior embedded engineers, an FDA regulatory consultant and a project manager took over the repositories after a one day workshop, made the build reproducible in CI and fixed the defects in four phases.

Each phase was verified with unit tests, static analysis, integration tests in a Renode simulation and tests on our own bench hardware, then documented and accepted by the client. For defects that were hard to reproduce we built internal tools, for example a PC application that tunes and records the operating cycle on the device.

Our FDA regulatory consultant advised the client on the regulatory impact of the new features, and every feature contract states its regulatory assumptions and risk controls.

Scope

What we delivered.

Repository takeover and CI

Reproducible build, protected branches, cppcheck and flawfinder, and a CI pipeline for the device firmware.

Phased remediation

Dead code removed, then critical and high severity defects fixed, including bootloader integrity, CRC handling, buffer overflows, unsafe string formatting and read out protection.

Verification

Unit tests with mutation testing, Renode integration tests, and tests on bench hardware with fault injection.

New features

A tuning tool for the device, a field firmware update with ECDSA signed images over the service port, and SD card service logging.

Logging verification

Verified for power loss, full and removed cards, event bursts, processor load, write latency and E-Stop response.

Regulatory documentation

Software requirements, architecture and design updates, record format specification, test reports and traceability for every change, plus FDA regulatory consultation on the new features and input to the client's risk analysis and threat model.

Results

Fixed, verified and documented.

4Remediation phases, each verified, documented and accepted

3New device features on the remediated code

CIStatic analysis and unit tests on every change

The firmware repositories build reproducibly in CI, with static analysis and unit tests on every change.

New features follow the same path as the fixes: requirements, risk controls, tests on the device and traceability.

Embedded CIEC 62304STM32RenodeCIRemediationFirmware updateFDA cybersecurity

More work

Related case studies.

Client names are withheld unless the client has agreed to be named. All case studies.

Case study

IEC 62304 gap analysis of safety-critical surgical device firmware

Two people reviewed a safety-critical surgical device's firmware, documents and process against IEC 62304, FDA and MDR in three weeks. The remediation was then contracted to Silurus Software.

Case study

Lab device refactoring and IEC 62304 documentation

Desktop application and firmware of a Dutch university medical centre's lab device refactored to be testable, with IEC 62304 documentation, in three months.

Embedded and firmware development Retrospective IEC 62304 documentation Medical device cybersecurity Regulatory consulting, EU MDR and FDA Sample deliverables

Talk to us

Firmware with known defects and a submission date?

We take over the repositories, fix the defects in verified phases and keep the documents in step.

Send your requirements Book a 30 minute technical call