Case study · Verification and validation

QA and DevOps behind a regulated software portfolio.

A team of 10 Silurus Software specialists has run QA and DevOps for a European manufacturer's medical software portfolio over several years, first under the EU MDD and then the EU MDR, and under FDA requirements.

Client: European medical technology manufacturer
Duration: Multi-year, ongoing
Team: 10 QA and DevOps specialists
Scope: CI/CD · test automation · traceability

We do not name the client or the product. Non-disclosure agreements, the client's business interests and the confidentiality of its technology do not allow it.

Context

A portfolio that keeps changing.

The manufacturer develops a large portfolio of medical software products in parallel. Each release has to pass verification under EU MDR and FDA requirements.

Each audit looks at the evidence behind a release: what was tested, against which requirement, with which result.

Development teams grow faster than the QA and DevOps capacity around them. When verification falls behind, releases wait or the evidence gets thinner.

Verification

A test result counts only if an auditor can trace it back to a requirement.

Challenge

More test capacity without weaker evidence.

The client needed more QA and DevOps capacity across several teams, without diluting the domain knowledge or the regulatory discipline the portfolio depends on.

Release pace

Several products release in parallel, and verification must keep up with each of them.

Audit evidence

EU MDR and FDA audits read the traceability from requirement to test result to deployment.

Cybersecurity

Signed binaries and a controlled build chain are part of the compliance case.

Solution

A test and release infrastructure that runs every night.

Every build is signed, and the full regression runs overnight with a report the next morning.

Ten specialists work inside several of the client's functional teams. They built and run the pipeline, the test environments and the evidence around them.

Virtualised environments make test runs reproducible and isolated. Regression suites run overnight, and the traceability documentation links each result to its requirement and its deployment.

Scope

What the team runs.

Signed builds

CI/CD pipelines with automated DLL and EXE signing for cybersecurity compliance.

Reproducible environments

Virtualised test environments for isolated, repeatable test runs.

Overnight regression

Automated regression suites that run overnight and report the next morning.

Coverage

Code coverage measured continuously, with a defined process for raising code quality.

Test layers

Unit, integration, system, smoke, automated UI, performance and security testing.

Traceability

Documentation from requirements to test results and deployment verification.

Results

Daily quality feedback through several audit cycles.

Multi-yearContinuous partnership

10Specialists across several functional teams

7Test layers, from unit to security testing

NightlyFull regression run, reported next morning

The team has supported the portfolio through several notified body audits and FDA inspections. Overnight testing gives daily quality feedback and has shortened regression cycles while increasing coverage.

EU MDRFDAIEC 62304CI/CDCode signingTest automationCode coverageTraceability

More work

Related case studies.

Client names are withheld unless the client has agreed to be named. All case studies.

Case study

Engineering capacity for a mission critical imaging platform

Eight engineers inside a European manufacturer's imaging platform teams, IEC 62304, quarterly releases each through full V&V, over several years.

Case study

IEC 62304 feature development in a large .NET codebase

Senior developers inside a European manufacturer's lifecycle, QMS and review workflow, over several years.

Verification and validation Dedicated engineering teams Medical and dental imaging software Quality and standards

Talk to us

Verification falling behind development?

We add QA and DevOps capacity inside your QMS, with the traceability your next audit will ask for.

Send your requirements Book a 30 minute technical call