SW development process in regulated health tech

areaCourse: TUT/SGN-57406

Stefan Baggström28th Jan 2014

04/18/2023 © Movendos 2013 2

Motivation

• Previous lectures were mostly about standards, regulation and related backgrounds

• This is about practice, i.e. development of medical products

• Focus on SW development process

04/18/2023 © Movendos 2013 3

Topics

Movendos introSW development todayRequirements from regulationMovendos SW development process

04/18/2023 © Movendos 2013 4

Movendos intro

This section sets the context of this presentation. It describes the company, it’s products and team.

Tools for effective health coaching

Nutrition

Physicalactivity

Physiotherapy

Psychotherapy

Social exclusion

Mind balance

Preventive healthcareHealthy

habits

Coaching

Knowledge vs Behavior

Individual’s behavior

40 %

Genes, environment,

healthcare

Coach

Customer

Coach’s support to your every day life Highly personalized training tasks

Use with your favorite device

04/18/2023 © Movendos 2013 9

System view

Customer

SES

S3

RDS / MySQL

EC2

Professional

Amazon Web Services

Elastic Beanstalk

Application Container

04/18/2023 © Movendos 2013 10

Back end: Elasticbeanstalk application with default container

04/18/2023 © Movendos 2013 11

Front end: Responsive single page web application

Web user interface

 

Backbone.js / marionette.js

- MVC- REST API communication DOM

Index.html- Application shell

HTML templates

Cascading style sheets (CSS)

Arto Leppisaari

CEO

Stefan Baggström

CTO

Hannu NieminenResearch

Our partners

Hannu Mikkola

SW architect

Carlos PerezSW developer

Our team

About me

• 20 years in SW & telco business

• Various roles in Nokia SW platforms and products

• 2 years in startup life– First incubating at TUT– Now startup co-founder & CTO

04/18/2023 © Movendos 2013 14

Our journeyExplore

Business models and product

conceptsMost promising 2

Understand

…2nd prototype

Problem / solution fit

Commercial product

Product / market fit + Sales

Jan-2012

May-2012

Jan-2013

Jan-2014

…

1st prototype

…

04/18/2023 © Movendos 2013 15

Key take aways

• Movendos developes tools for effective health coaching

• Web application can be a medical device based on it’s intended use

04/18/2023 © Movendos 2013 16

SW development

This section offers a glimbse into some of the today’s SW development practises. These practises are used for developing

different kind of products for various business fields.

04/18/2023 © Movendos 2013 17

SW development <-> regulation

• Things to keep in mind:– It’s not just your own code that

matters– Development processes evolve

over time– Iterative product development

with customer collaboration is here to stay

– Directives and standards were done some time ago based on old mainstream best practices

04/18/2023 © Movendos 2013 18

SW development buzz words

• Agile, scrum, kanban, …• Continuous integration,

deployment, …• Open source SW, libraries,

frameworks, …• Clouds, IaaS, PaaS, SaaS, …

04/18/2023 © Movendos 2013 19

SW development buzz words

• Web, mobile, cross platform, …• Licenses, patents, contracts,…• Continuous updates, beta, …• Customer expectations for great

UX (got used to iPhones/iPads)…• New technologies are emerging

with increasing rate…

04/18/2023 © Movendos 2013 20

Basic elements of SW process

http://cloverleafsolutions.com/methods/software-development-lifecycle.html

04/18/2023 21

Some of the SW development methodologies

© Movendos 2013

http://cloverleafsolutions.com/methods/software-development-lifecycle.html

04/18/2023 22

Agile a’la Scrum

© Movendos 201

Source: http://analytical-mind.com/tag/scrum/

04/18/2023 © Movendos 2013 23

Agile a’la Kanban

http://blog.crisp.se/2009/11/16/henrikkniberg/1258359420000

04/18/2023 © Movendos 2013 24

Continuous integration a’la Jenkins

http://www.ranorex.com/blog/wp-content/uploads/2012/08/Integrate-In-Jenkins.png

04/18/2023 25

DevOps, Continuous delivery

© Movendos 2013

http://www.collab.net/solutions/devops

04/18/2023 © Movendos 2013 26

Updates, updates, updates…

• Safety related regulation: A change in a product is considered as added risk for safety– Best to develop single version, deploy it and never update?

• Security and privacy related practices:– Always update the product to mitigate risks and to fix

uncovered vulnerabilities

• Interworking between systems:– Best practise is to update when others update

• Consider medical devices connected to hospital networks and Internet:– Updates or not to update?

• Testing always preceeds deployment of an update

04/18/2023 © Movendos 2013 27

http://www.cloudstrategies.com/2010/05/cloud-spectrum-iaas-paas-saas/

04/18/2023 © Movendos 2013 28

http://www.businessinsider.com/html5-vs-native-apps-for-mobile-2013-6?op=1

04/18/2023 © Movendos 2013 29

http://www.businessinsider.com/html5-vs-native-apps-for-mobile-2013-6?op=1

04/18/2023 © Movendos 2013 30

http://www.businessinsider.com/html5-vs-native-apps-for-mobile-2013-6?op=1

04/18/2023 © Movendos 2013 31

http://www.businessinsider.com/html5-vs-native-apps-for-mobile-2013-6?op=1

04/18/2023 © Movendos 2013 32

User experience

Some aspects of good UX:• Easy to use• Easy to navigate• Find information fast• Load fast• No crashes

But end users are expecting more!

04/18/2023 © Movendos 2013 33

Complexity multiplies(from code chunk into system)

1 3

3 9

04/18/2023 © Movendos 2013 34

Some piece of codepublic void handleMessagesFromDatabase() { if (!applicationContextReady){ return; }

List<NewMessage> messages = newMessageRepository.findUnsentNonPriorityMessages();

// Stop if there are no more messages if (messages.isEmpty()){ return; }

for(NewMessage message : messages){ if(emailIsValid(message.getToUser().getEmail())){ queueStandardEmail(message); } else{ onSendFailure(message, EmailSendStatus.INVALID_EMAIL_ADDRESS); } } }

04/18/2023 © Movendos 2013 35

From small code chunk to full blown system

• Multiple size by 10k, 100k or 1M to build a sub system

• Go further and integrate all subsystems into the system

• Note, the code comes into the project also from used:– Libraries– OS, runtime, …– Compiler, IDE, version control,

…

04/18/2023 © Movendos 2013 36

Working as a small dev team

Source: http://www.romanpichler.com/blog/tag/teamwork/page/2/

04/18/2023 © Movendos 2013 37

Brook’s law: “Putting more people on a late job makes it later.”

http://www.pmhut.com/estimating-software-effort

04/18/2023 © Movendos 2013 38

Working concurrently

Source: http://websites-development.com/blog/git-methodology

04/18/2023 © Movendos 2013 39

Deliverables (kind of a minimum set)

• Requirements in product and sprint backlogs

• Design documents• Test cases: unit, integration, system tests• Test reports• Bug reports• Versioned, reviewed, integrated and

running code

04/18/2023 © Movendos 2013 40

From piece of code into product

Functional

*3 into system

*3 with team

*9 into product

04/18/2023 © Movendos 2013 41

Key take aways

• SW development processes evolve over time

• Use of SOUP (software of unknown pedigree / provenance) increases

• Use of web apps increases over native apps (many runtimes)

• Users demand good usability• SW development is complex in

many dimensions

04/18/2023 © Movendos 2013 42

Requirements from regulation

This section describes the regulatory constraints set for SW

product development. One concrete example case explained.

04/18/2023 © Movendos 2013 43

Medical device

Must conform with regulation

Must not endanger the safety or health of the patient or other persons

Manufacturer to ensure• Safety • Suitability for intented use• Performance and reliability

04/18/2023 © Movendos 2013 44

Medical Device/SW Regulation

• Depends on the market, country, type of medical device

• Example case:– SW product with medical intended use – Targeting European market– Council Directive 93/42/EEC– There are applicable harmonized

standards, which help to comply with the directive

– In addition, the directive has requirements for validation and releasing

04/18/2023 © Movendos 2013 45

Standard set (example)

IEC 62304 Medical device software - Software life cycle processes

EN 62366 Medical devices. Application of usability engineering to medical devices

ISO 14971 Medical Devices-Application of risk management to medical devices

ISO 13485 Medical Devices. Quality management systems. Requirements for regulatory purposes

04/18/2023 © Movendos 2013 46

Standards set requirements for

• SW development process• Quality management system• Risk management process• Usability process• Clinical investigation• Validation• Registration• Placing on the market• Problem resolution • Etc.

04/18/2023 © Movendos 2013 47

Regulation continued

• There are directives and laws for– Privacy– Security– Language support– …

• These may set complementary, but also contradicting requirements for vendors

Is medical field unlike others?

• Regulation applies also to airplane, railway, and many other industries

• SW project risks typically deal with schedule & costs– Add safety & essential performance risks

for medical devices

• Time to money: typically it’s development & verification time – Add time required for validation &

approval for medical devices

• Clinical validation requires it’s own time & effort

04/18/2023 © Movendos 2013 49

Movendos SW development process

This section explains how Movendos developes SW. It’s our way of applying

state of the art practices, and our way of working with the constraints set by the

regulation.

04/18/2023 © Movendos 2013 50

Customer development

• Collaboration with customers• Iterate and verify• Problem centric as opposed

to product or technology centric

• Performed in parallel with product development

04/18/2023 © Movendos 2013 51

Source: http://practicetrumpstheory.com/blog/

04/18/2023 © Movendos 2013 52

Movendos SW development

Let’s focus on these aspects• SW development process• Risk management• Documentation

Sprint

Item 1Item 2Item 3

Product backlog

SW release

Just sprints…?

http://scalingsoftwareagilityblog.com/the-big-picture-is-now-the-scaled-agile-framework/

Definitely too much for a startup…

We have release planning included

Rel 1Rel 2Rel 3

Release plan

Agile development life-cycle - the whole from begin to end

http://www.agilemodeling.com/essays/agileDesign.htm

Development in sprints

Movendos - full life-cycle

Project preparation Feature complete Release Validation In use

Maintenance preparation

Feature completeRelease

Validation

Development

Development

Retirement

Patch update/bug fixes

04/18/2023 © Movendos 2013 58

Risk management

• Risk analysis– Methods: Failure Mode Effect

Analysis (FMEA), Fault Tree Analysis (FTA), or some other feasible way

– Initial analysis + incremental

• Reports & reviews

04/18/2023 © Movendos 2013 59

Risk management in more detail

• Initial risk analysis• Risk analysis for each sprint

backlog item• Update risk magement report

for each major milestone• Corrective and preventive

actions based on findings• Reporting of hazards to

customers and officials

04/18/2023 © Movendos 2013 60

Documentation

• Process documentation– SW process– Quality Management System

document(s)

• Project documentation– Intended use– Plans– Reports

• Traceability– Requirements-implementation-

tests-releases-…

04/18/2023 © Movendos 2013 61

Documents in more detail

• Quality Management System• SW development process• Product’s intended use• Project plan• Requirement specification = product

backlog• Product architecture• Usability and UX/UI design documents• Test plans and reports• Validation documents• Problem reports (and bug reports)

04/18/2023 © Movendos 2013 62

Project documentation

• Example: 1st milestone– Project plan– Intended use– Risk management plan + risk

analysis– Initial usability analysis– Verification plan– Initial architecture– SW components plan– Initial product backlog

04/18/2023 © Movendos 2013 63

Traceability

Full traceability is required: ”Why was this SW change made and how it was verified?”

You need to have links between:Requirements, design documents, test plans, tests, code, test reports, change notes

Everything should be in version control: code, docs, tests, tools, environment configurations, etc.

04/18/2023 © Movendos 2013 64

Verification & Validation

• Verification shall be performed … to ensure that the design and development outputs have met the design and development input requirements.

• Design and development validation shall be performed to ensure that the resulting product is capable of meeting the requirements for the specified application or intended use.

04/18/2023 © Movendos 2013 65

All inclusive

04/18/2023 © Movendos 2013 66

Developing medical SW - Top agile with?

• Traceability• Risk management• Test planning, specs & reports• Documentation• Verification, Validation

Treat all requirements alike!

Stefan Baggströmstefan.baggstrom@movendos.com

Tel +358 50 581 6919

Thank you!