Project delivery with a defined goal.

Software verification for a laboratory device at a university hospital

A laboratory device built at a European university medical centre for a study under an FDA IDE has working software, a Python application on a PC and MicroPython firmware on an ESP32, without tests and without IEC 62304 records.

A project with a defined scope, two engineers and a project manager, working remotely with the hospital team. It covers a code review of both parts, refactoring of the PC application for testability, automated tests, and the user and software requirements, the validation and verification plans, the test report and the traceability matrix (a table linking each requirement to its design, tests and risk controls).

Firmware remediation for a cardiac device in the highest risk class

The firmware of a cardiac therapy system, Class III under the EU MDR and at the FDA, with a control console and a probe on two STM32 microcontrollers, has to be brought in line with its design specification before the next regulatory steps.

The work starts with a gap analysis (a review of what is missing against the standard) of the design specification against the code, a MISRA C and SOUP (software of unknown provenance, meaning third party code used in the device) review and an on-site workshop. The remediation then runs in phases agreed in writing: cleanup, critical fixes, high severity issues and unit tests, each phase with its own acceptance by the client's quality team. Every fix goes through the client's change control with an impact analysis. The software safety classification, the system level verification and the release decision stay with the client.

An FDA software file for a finished nRF52 device

An engineering consultancy needs the FDA software documentation for a client's battery powered device on a Nordic nRF52 with Zephyr and BLE (Bluetooth Low Energy), with the firmware already complete.

A documentation project that starts with a gap analysis of the existing evidence and is written from the code and the client's templates. Where requirements or test evidence are missing, the missing verification is agreed with the client as separate work. The documents are: Software Design Specification, SOUP assessment, system test specification, cybersecurity report, threat model (a structured analysis of how the device could be attacked), SBOM (software bill of materials, the list of every software component in the build) and the firmware updates to the hazard analysis, with the IEC 62304, ISO 14971 and FDA section 524B expectations in mind.

A long running imaging archive leaving Win32 and MFC

An imaging archive and reporting product, written in C++ and MFC with DCMTK for DICOM and PostgreSQL, connects to ultrasound, endoscopy, CT, MR and X-ray and has to stay on the market under ISO 13485 and the MDR while it is modernised.

The modernisation is cut into defined projects. The user interface and the document generation layer go first, the DICOM backend and the database stay, and every step is verified against the current behaviour before release. A capture app of the same product family moves from dedicated camera hardware to standard Android devices with CameraX.

A dental imaging engine behind an API

A dental implant planning platform needs an engine that segments CBCT volumes, imports intraoral STL scans, registers the two and returns meshes, the transform and an accuracy figure through an API.

The project starts with a feasibility phase on the client's own anonymised cases, ending in a working pipeline built with ITK and VTK, a measured accuracy report and an architecture and a regulatory plan for a Class IIa product, with the classification under MDR Rule 11 derived from the intended purpose (what the manufacturer states the software is for). The production engine follows as a second project.

A donor programme going international

A cell and tissue bank extends its donor programme to several countries and needs a back office system with a two way API to a web shop, real time stock and booking, and quotas per country.

The scope is split into the back office system, the web shop on a standard platform and the integration between them, each with its own deliverables and estimate.