Medical device standards' requirements for traceability during the software development lifecycle and implementation of a traceability assessment model

Developing safety critical software is a complex process. Due to the fact that medical device software failure can lead to catastrophic consequences, numerous standards have been developed which govern software development in the medical device domain. Risk management has an important role in medical device software development as it is important to ensure that safe software is developed. Demonstrating traceability of requirements right throughout the medical device software development and maintenance lifecycles is an important part of demonstrating that ‘safe’ software has been produced through adopting defined processes. Consequently, medical device standards and guidelines emphasise the need for traceability. This paper outlines the extent and diversity of traceability requirements within medical device standards and guidelines, and identifies the requirements for traceability through each phase of the software development lifecycle. The paper also summarises the findings obtained when a lightweight assessment method (MedTrace), that we created, based upon the traceability practices within these standards, was implemented in two SME organisations. Finally we highlight how the findings indicate a lack of guidance as to what is required when implementing and maintaining a traceability process.