Lecture material set for the TUT course SGN-57406 'Standards, Interoperability and Regulation in Health Informatics'. This presentation discusses the requirements coming from regulation for the SW development process, and presents one tailored SW life cycle process suitable for medical device SW development.

1. SW development process
in regulated health tech area
Course: TUT/SGN-57406
Stefan Baggström
28th Jan 2014

2. Motivation
• Previous lectures were mostly
about standards, regulation and
related backgrounds
• This is about practice, i.e.
development of medical products
• Focus on SW development
process
1/28/2014
© Movendos 2013
2

3. Topics
Movendos intro
SW development today
Requirements from regulation
Movendos SW development process
1/28/2014
© Movendos 2013
3

4. Movendos intro
This section sets the context of this
presentation. It describes the
company, it’s products and team.
1/28/2014
© Movendos 2013
4

5. Tools for effective health coaching

6. Social exclusion
Physiotherapy
Physical
activity
Nutrition
Mind balance
Coaching
Psychotherapy
Preventive healthcare
Healthy habits

7. Knowledge vs Behavior
Individual’s
behavior
40 %
Genes, environm
ent, healthcare

8.  Coach’s support to your every day life
 Highly personalized training tasks
 Use with your favorite device
Customer
Coach

9. System view
Amazon Web Services
Elastic
Beanstalk
Application
Container
S3
Customer
EC2
Professional
RDS / MySQL
SES
1/28/2014
© Movendos 2013
9

10. Back end: Elasticbeanstalk
application with default container
1/28/2014
© Movendos 2013
10

11. Front end: Responsive single page
web application
Web user interface
Index.html
- Application shell
Backbone.js / marionette.js
- MVC
- REST API communication
DOM
Cascading style sheets (CSS)
HTML templates
1/28/2014
© Movendos 2013
11

12. Our team
Arto Leppisaari
Stefan Baggström
Hannu Nieminen
CEO
CTO
Research
Hannu Mikkola
SW architect
Our partners
Carlos Perez
SW developer

13. About me
• 20 years in SW & telco business
• Various roles in Nokia SW
platforms and products
• 2 years in startup life
– First incubating at TUT
– Now startup co-founder & CTO

14. Our journey
Jan-2012
Explore
May-2012
Business models and
product concepts
Most promising 2
1st prototype
Jan-2013
Problem / solution fit
…
Understand
2nd prototype
…
Jan-2014
Product / market fit + Sales
Commercial product
1/28/2014
© Movendos 2013
…
14

15. Key take aways
• Movendos developes tools for
effective health coaching
• Web application can be a
medical device based on it’s
intended use
1/28/2014
© Movendos 2013
15

16. SW development
This section offers a glimbse into some of
the today’s SW development practises.
These practises are used for developing
different kind of products for various
business fields.
1/28/2014
© Movendos 2013
16

17. SW development <-> regulation
• Things to keep in mind:
– It’s not just your own code that
matters
– Development processes evolve over
time
– Iterative product development with
customer collaboration is here to
stay
– Directives and standards were done
some time ago based on old
mainstream best practices
1/28/2014
© Movendos 2013
17

18. SW development buzz words
• Agile, scrum, kanban, …
• Continuous
integration, deployment, …
• Open source
SW, libraries, frameworks, …
• Clouds, IaaS, PaaS, SaaS, …
1/28/2014
© Movendos 2013
18

19. SW development buzz words
Web, mobile, cross platform, …
Licenses, patents, contracts,…
Continuous updates, beta, …
Customer expectations for great
UX (got used to iPhones/iPads)…
• New technologies are emerging
with increasing rate…
•
•
•
•
1/28/2014
© Movendos 2013
19

20. Basic elements of SW process
http://cloverleafsolutions.com/methods/software-development-lifecycle.html
1/28/2014
© Movendos 2013
20

21. Some of the SW development
methodologies
http://cloverleafsolutions.com/methods/software-development-lifecycle.html
1/28/2014
© Movendos 2013
21

22. Agile a’la Scrum
Source: http://analytical-mind.com/tag/scrum/
1/28/2014
© Movendos 201
22

23. Agile a’la Kanban
http://blog.crisp.se/2009/11/16/henrikkniberg/1258359420000
1/28/2014
© Movendos 2013
23

24. Continuous integration a’la Jenkins
http://www.ranorex.com/blog/wp-content/uploads/2012/08/Integrate-In-Jenkins.png
1/28/2014
© Movendos 2013
24

25. DevOps, Continuous delivery
http://www.collab.net/solutions/devops
1/28/2014
© Movendos 2013
25

26. Updates, updates, updates…
• Safety related regulation: A change in a product is
considered as added risk for safety
– Best to develop single version, deploy it and never update?
• Security and privacy related practices:
– Always update the product to mitigate risks and to fix uncovered
vulnerabilities
• Interworking between systems:
– Best practise is to update when others update
• Consider medical devices connected to hospital
networks and Internet:
– Updates or not to update?
• Testing always preceeds deployment of an update
1/28/2014
© Movendos 2013
26

27. http://www.cloudstrategies.com/2010/05/cloud-spectrum-iaas-paas-saas/
1/28/2014
© Movendos 2013
27

28. http://www.businessinsider.com/html5-vs-native-apps-for-mobile-2013-6?op=1
1/28/2014
© Movendos 2013
28

29. http://www.businessinsider.com/html5-vs-native-apps-for-mobile-2013-6?op=1
1/28/2014
© Movendos 2013
29

30. http://www.businessinsider.com/html5-vs-native-apps-for-mobile-2013-6?op=1
1/28/2014
© Movendos 2013
30

31. http://www.businessinsider.com/html5-vs-native-apps-for-mobile-2013-6?op=1
1/28/2014
© Movendos 2013
31

32. User experience
Some aspects of good UX:
• Easy to use
• Easy to navigate
• Find information fast
• Load fast
• No crashes
But end users are expecting more!
1/28/2014
© Movendos 2013
32

33. Complexity multiplies
(from code chunk into system)
1
3
1/28/2014
3
9
© Movendos 2013
33

34. Some piece of code
public void handleMessagesFromDatabase() {
if (!applicationContextReady){
return;
}
List<NewMessage> messages = newMessageRepository.findUnsentNonPriorityMessages();
// Stop if there are no more messages
if (messages.isEmpty()){
return;
}
for(NewMessage message : messages){
if(emailIsValid(message.getToUser().getEmail())){
queueStandardEmail(message);
}
else{
onSendFailure(message, EmailSendStatus.INVALID_EMAIL_ADDRESS);
}
}
}
1/28/2014
© Movendos 2013
34

35. From small code chunk to full
blown system
• Multiple size by 10k, 100k or 1M
to build a sub system
• Go further and integrate all
subsystems into the system
• Note, the code comes into the
project also from used:
– Libraries
– OS, runtime, …
– Compiler, IDE, version control, …
1/28/2014
© Movendos 2013
35

36. Working as a small dev team
Source: http://www.romanpichler.com/blog/tag/teamwork/page/2/
1/28/2014
© Movendos 2013
36

37. Brook’s law: “Putting more people
on a late job makes it later.”
http://www.pmhut.com/estimating-software-effort
1/28/2014
© Movendos 2013
37

38. Working concurrently
Source: http://websites-development.com/blog/git-methodology
1/28/2014
© Movendos 2013
38

39. Deliverables
(kind of a minimum set)
•
•
•
•
•
•
Requirements in product and sprint backlogs
Design documents
Test cases: unit, integration, system tests
Test reports
Bug reports
Versioned, reviewed, integrated and
running code
1/28/2014
© Movendos 2013
39

40. From piece of code into product
Functional
*3 into
system
*3 with
team
*9 into
product
1/28/2014
© Movendos 2013
40

41. Key take aways
• SW development processes evolve
over time
• Use of SOUP (software of unknown
pedigree / provenance) increases
• Use of web apps increases over
native apps (many runtimes)
• Users demand good usability
• SW development is complex in
many dimensions
1/28/2014
© Movendos 2013
41

42. Requirements from regulation
This section describes the
regulatory constraints set for SW
product development. One concrete
example case explained.
1/28/2014
© Movendos 2013
42

43. Medical device
Must conform with regulation
Must not endanger the safety or
health of the patient or other persons
Manufacturer to ensure
• Safety
• Suitability for intented use
• Performance and reliability
1/28/2014
© Movendos 2013
43

44. Medical Device/SW Regulation
• Depends on the
market, country, type of medical
device
• Example case:
SW product with medical intended use
Targeting European market
Council Directive 93/42/EEC
There are applicable harmonized
standards, which help to comply with
the directive
– In addition, the directive has
requirements for validation and
releasing
–
–
–
–
1/28/2014
© Movendos 2013
44

45. Standard set (example)
IEC 62304 Medical device software Software life cycle processes
EN 62366 Medical devices. Application of
usability engineering to medical devices
ISO 14971 Medical Devices-Application of
risk management to medical devices
ISO 13485 Medical Devices. Quality
management systems. Requirements for
regulatory purposes
1/28/2014
© Movendos 2013
45

46. Standards set requirements for
•
•
•
•
•
•
•
•
•
•
SW development process
Quality management system
Risk management process
Usability process
Clinical investigation
Validation
Registration
Placing on the market
Problem resolution
Etc.
1/28/2014
© Movendos 2013
46

47. Regulation continued
• There are directives and laws for
–
–
–
–
Privacy
Security
Language support
…
• These may set
complementary, but also
contradicting requirements for
vendors
1/28/2014
© Movendos 2013
47

48. Is medical field unlike others?
• Regulation applies also to
airplane, railway, and many other
industries
• SW project risks typically deal with
schedule & costs
– Add safety & essential performance
risks for medical devices
• Time to money: typically it’s
development & verification time
– Add time required for validation &
approval for medical devices
• Clinical validation requires it’s own
time & effort

49. Movendos SW development
process
This section explains how Movendos
developes SW. It’s our way of applying
state of the art practices, and our way of
working with the constraints set by the
regulation.
1/28/2014
© Movendos 2013
49

50. Customer development
• Collaboration with customers
• Iterate and verify
• Problem centric as opposed to
product or technology centric
• Performed in parallel with
product development
1/28/2014
© Movendos 2013
50

51. Source: http://practicetrumpstheory.com/blog/
1/28/2014
© Movendos 2013
51

52. Movendos SW development
Let’s focus on these aspects
• SW development process
• Risk management
• Documentation
1/28/2014
© Movendos 2013
52

53. Just sprints…?
Sprint
Product backlog
Item 1
Item 2
Item 3
SW
release

54. Definitely too much for a
startup…
http://scalingsoftwareagilityblog.com/the-big-picture-is-now-the-scaled-agile-framework/

55. We have release planning included
Release plan
Rel 1
Rel 2
Rel 3

56. Agile development life-cycle the whole from begin to end
http://www.agilemodeling.com/essays/agileDesign.htm

57. Movendos - full life-cycle
Patch update/
bug fixes
Project preparation
Development
Feature complete
Release
Validation
In use
Maintenance
preparation
Validation
Release
Development in sprints
Retirement
Feature complete
Development

58. Risk management
• Risk analysis
– Methods: Failure Mode Effect
Analysis (FMEA), Fault Tree Analysis
(FTA), or some other feasible way
– Initial analysis + incremental
• Reports & reviews
1/28/2014
© Movendos 2013
58

59. Risk management in more detail
• Initial risk analysis
• Risk analysis for each sprint
backlog item
• Update risk magement report for
each major milestone
• Corrective and preventive
actions based on findings
• Reporting of hazards to
customers and officials
1/28/2014
© Movendos 2013
59

60. Documentation
• Process documentation
– SW process
– Quality Management System
document(s)
• Project documentation
– Intended use
– Plans
– Reports
• Traceability
– Requirements-implementation-testsreleases-…
1/28/2014
© Movendos 2013
60

61. Documents in more detail
•
•
•
•
•
•
•
•
•
•
Quality Management System
SW development process
Product’s intended use
Project plan
Requirement specification = product
backlog
Product architecture
Usability and UX/UI design documents
Test plans and reports
Validation documents
Problem reports (and bug reports)
1/28/2014
© Movendos 2013
61

62. Project documentation
• Example: 1st milestone
– Project plan
– Intended use
– Risk management plan + risk
analysis
– Initial usability analysis
– Verification plan
– Initial architecture
– SW components plan
– Initial product backlog
1/28/2014
© Movendos 2013
62

63. Traceability
Full traceability is required:
”Why was this SW change made and how
it was verified?”
You need to have links between:
Requirements, design documents, test
plans, tests, code, test reports, change
notes
Everything should be in version control:
code, docs, tests, tools, environment
configurations, etc.
1/28/2014
© Movendos 2013
63

64. Verification & Validation
• Verification shall be performed … to
ensure that the design and
development outputs have met the
design and development input
requirements.
• Design and development validation
shall be performed to ensure that
the resulting product is capable of
meeting the requirements for the
specified application or intended
use.
1/28/2014
© Movendos 2013
64

65. All inclusive
1/28/2014
© Movendos 2013
65

66. Developing medical SW
- Top agile with?
•
•
•
•
•
Traceability
Risk management
Test planning, specs & reports
Documentation
Verification, Validation
Treat all requirements alike!
1/28/2014
© Movendos 2013
66

67. Thank you!
Stefan Baggström
stefan.baggstrom@movendos.com
Tel +358 50 581 6919