Software of Unknown Provenance (SOUP)
What is SOUP?
Software of unknown provenance (SOUP) describes software that has been included in medical devices or in medical software (including software as a medical device) that was not developed according to a known software development process or methodology, or which has unknown or no safety-related properties.
The standard IEC 62304:2006 (Medical device software – software life cycle processes) specifically defines SOUP as:
Software that is already developed and generally available and that has not been developed for the purpose of being incorporated into the MEDICAL DEVICE (also known as “off the-shelf software”) or software previously developed for which adequate records of the development PROCESSES are not available.
IEC 62304:2006 does not prohibit the use of SOUP but additional controls are required and the risk of the SOUP needs to be assessed and taken into account.
What are the benefits of Software of Unknown Provenance?
The major benefit of Software of Unknown Provenance is in the faster product development times. Essentially, with SOUP, you don’t have to re-invent the wheel. This is particularly true when using complex software components which themselves require significant time and specific technical expertise which may not be available within the development team, e.g. operating systems.
What is SOUP and what is not SOUP?
Not all third party software is SOUP. Software developed and maintained with respect to IEC 62304 requirements or with respect to medical device regulations are not SOUP.
Therefore, any software that was NOT developed following IEC 62304 compliant processes is SOUP.
Some examples of SOUP are:
Code developed in your company before design control was in place
There are also some clear examples of software that is not SOUP:
Development Tools and Compilers
Software Development Frameworks
How should SOUP be handled in a Medical Device?
The biggest concern with including SOUP in your medical device is how it will impact the overall safety of your device. However, there are established practices, defined in standards and guidance documents that help manufacturers to reduce the risk of using SOUP.
Once you have decided to include SOUP in your medical device, then the first step is to identify which market you are targeting. Thereafter, you need to handle the specific requirements of the applicable standards and regulations. While being compliant with IEC 62304 is a good start, often specific markets have requirements that are slightly different to IEC 62304.
For more information
If you would like more information about SOUP or about how to best handle the inclusion of SOUP in your medical device then read our blog article on Reducing the Uncertainty of SOUP, or contact us at email@example.com. We will be happy to help you.