CPMS Software Lifecycle Management 2 — Questions and Answers
Question 1: What does 'SOUP' stand for in the context of IEC 62304 medical device software?
- Software of Unknown Provenance (Correct answer)
- Software of Unified Purpose
- Structured Output Unit Protocol
- System of Unverified Processes
Correct answer: Software of Unknown Provenance
SOUP (Software of Unknown Provenance) refers to software items not developed under a known software development lifecycle, including commercial off-the-shelf and open-source software.
Question 2: When should a software change control process be initiated in medical device software?
- Only when the device is subject to a regulatory recall
- Whenever a modification to released software is proposed, regardless of perceived impact (Correct answer)
- Only during the initial software development and design phase
- Only when a new commercial software version is publicly launched
Correct answer: Whenever a modification to released software is proposed, regardless of perceived impact
Change control must be initiated for any proposed modification to released software so that changes are formally evaluated, documented, and approved before implementation.
Question 3: What is the purpose of a software traceability matrix in the medical software lifecycle?
- To map software requirements to design elements, test cases, and code modules (Correct answer)
- To track software development project timelines and resource allocation
- To document the software's network architecture and communication protocols
- To record all software defects and their resolution status
Correct answer: To map software requirements to design elements, test cases, and code modules
A traceability matrix links requirements to design elements, source code, and test cases, ensuring complete coverage and enabling impact analysis when changes occur.
Question 4: What distinguishes software verification from software validation in the medical software lifecycle?
- Verification occurs after validation in the development sequence
- Verification checks outputs against specifications; validation checks against user needs (Correct answer)
- Verification is performed by users in clinical settings; validation is performed by developers
- Verification applies only to hardware interfaces; validation applies only to software functions
Correct answer: Verification checks outputs against specifications; validation checks against user needs
Verification confirms software meets specified requirements ('Are we building it right?') while validation confirms the product meets user needs in the intended environment ('Are we building the right product?').
Question 5: In IEC 62304, which software safety class applies when a software failure could contribute to a hazardous situation but other risk controls exist to prevent serious harm?
- Class A
- Class B (Correct answer)
- Class C
- Class D
Correct answer: Class B
Class B applies when software failure can contribute to a hazardous situation, but additional non-software risk controls mitigate serious injury, requiring more rigor than Class A but less than Class C.
Question 6: What is the purpose of a software problem report (SPR) in medical device software maintenance?
- To document new feature requests submitted by clinical users
- To formally record, track, and manage software defects and anomalies (Correct answer)
- To report quarterly software performance metrics to management
- To document software training completion records for regulatory compliance
Correct answer: To formally record, track, and manage software defects and anomalies
Software problem reports formally document defects and anomalies discovered during testing or post-release, enabling systematic tracking, investigation, and resolution.
Question 7: What is a 'software item' as defined in IEC 62304?
- Any physical hardware component that executes software instructions
- Any identifiable part of a computer program including source code, object code, and data (Correct answer)
- Only the compiled executable files shipped as part of a medical device
- The complete finished software product approved for market release
Correct answer: Any identifiable part of a computer program including source code, object code, and data
IEC 62304 broadly defines a software item as any identifiable part of a computer program, from a complete software system down to a single module, including source code, object code, and data.
CPMS Software Lifecycle Management 2
What does 'SOUP' stand for in the context of IEC 62304 medical device software?