Software development and risk management in the safety critical medical device domain

Abstract: The healthcare sector is one of the fastest growing economic sectors of today. The medical device domain is one part of that sector. An increasing part of functionality in medical devices and systems is implemented in software and many features should not be possible to implement without software. The use of medical software is an inherent risk to the patient and the outcome of a failure can vary from death to almost no effect at all. Risks and risk management is closely connected to medical device domain and it is crucial to all medical device companies to have a good risk management process. It is also stated in law that the companies developing medical devices must have a risk management process. One part of the research in this thesis focuses on the current state of practice in the medical device domain. As a result of this research, the need for high quality software in this domain has been identified and also the needs for new techniques, methods and processes to further improve software quality in the medical device domain. The results have been used to derive a set of requirements on new processes, methods and techniques in the area, to be used by researchers as a guide in the development of more adapted processes, methods and techniques for software development in the medical devices domain. The other part of the research in this thesis focuses on risk and is based on two experiments. A number of decisions regarding risks are taken during software project risk management and it is the people involved that make the decisions. Different people’s opinions about the importance of identified risks are investigated in an experiment and it is concluded that different participants have different opinions about how serious risks are concerning faults remaining after testing are. Probably it is possible to generalise this and conclude that in the software engineering process different people are more or less risk seeking. From the second experiment it could be concluded that multiple roles and thereby different experiences will affect the risk identification process. Involving multiple roles will result in a more complete set of identified risks than if only one role is included.