​
Summary

This Standard Operating Procedure (SOP) establishes a systematic framework for identifying, investigating, and resolving software problems throughout the medical device software lifecycle. It ensures that software issues are properly documented, analyzed for safety impact, and resolved through appropriate change control processes while maintaining compliance with IEC 62304 software lifecycle requirements.

​
Why is SOP Software Problem Resolution important?

Software problems in medical devices can directly impact patient safety and device effectiveness. The FDA and other regulatory authorities require manufacturers to have robust processes for identifying and resolving software issues, as software defects are a leading cause of medical device recalls and safety incidents. This SOP is essential because software problems can emerge at any stage - during development, testing, or post-market use. Without a systematic approach to problem resolution, critical safety issues might be overlooked, improperly analyzed, or inadequately addressed. The regulation requires that you demonstrate due diligence in identifying problems, conducting thorough root cause analysis, and implementing appropriate corrective actions. For IEC 62304 compliance, software problem resolution is mandatory for all safety classification levels, with increasing rigor required for Class B and Class C software that could contribute to hazardous situations.

​
Regulatory Context

Under 21 CFR Part 820 (Quality System Regulation):
  • Section 820.100 requires establishment of procedures for implementing corrective and preventive actions
  • 820.198 mandates complaint handling procedures for software-related issues
  • Software changes must follow design control requirements under 820.30
  • Problem resolution must be documented as quality records under 820.180
IEC 62304 (Software Lifecycle Processes):
  • Section 9 requires software problem resolution processes for all safety classes
  • Problem analysis must consider safety implications and update risk analysis
  • Software changes require verification and validation appropriate to safety classification
Special attention required for:
  • Safety-related problems require immediate risk assessment
  • Software problem resolution must integrate with CAPA system
  • Change control processes must maintain design control compliance
  • Post-market software problems may trigger FDA reporting requirements

​
Guide

​
Establishing Problem Identification and Reporting Processes

Problem identification must be proactive and comprehensive. Software problems can originate from multiple sources: customer complaints, internal testing, post-market surveillance, vulnerability assessments, or routine software monitoring. Establish clear channels for reporting problems from all these sources. Use a centralized ticketing system to track all software problems from identification through resolution. This system should integrate with your complaint handling process, CAPA system, and change control procedures. Each problem report must capture essential information including problem description, affected software versions, safety implications, and steps to reproduce the issue. Document problem classification based on type (corrective, preventive, adaptive), scope (number of devices affected, change complexity), and criticality (safety, performance, security impact). This classification drives the appropriate level of investigation and resolution approach.

​
Conducting Thorough Problem Investigation

Root cause analysis is mandatory for all software problems, with depth proportional to safety classification and potential impact. For Class A software with no safety impact, basic analysis may suffice. For Class B and C software, conduct comprehensive analysis including:
  • Technical root cause - What specific code, configuration, or design element caused the problem
  • Process root cause - What development, verification, or validation process failed to prevent the problem
  • Systemic analysis - Whether similar problems exist elsewhere in your software or processes
Safety assessment is critical for all problems. Use your risk management process to evaluate whether the problem introduces new hazards, changes existing risk levels, or affects risk control measures. Update your risk management file accordingly and consider whether additional risk controls are needed. Trend analysis helps identify systematic issues. Look for patterns in problem types, affected components, or root causes that might indicate broader quality system problems requiring preventive action.

​
Implementing Appropriate Resolution Strategies

Change control integration is essential for problem resolution. All software changes to resolve problems must follow your design control and change management procedures. The extent of verification and validation required depends on the safety classification and scope of changes. For safety-related problems, implement immediate risk controls while developing permanent solutions. This might include software patches, user notifications, or temporary operational constraints. Document these interim measures and verify their effectiveness. Verification of problem resolution must demonstrate that the implemented solution actually resolves the problem without introducing new issues. For Class B and C software, conduct appropriate regression testing to ensure existing functionality remains intact.

​
Managing Problem Resolution Documentation

Traceability between problems, root causes, implemented changes, and verification results is mandatory for regulatory compliance. Your ticketing system should maintain this traceability automatically, but ensure manual documentation captures the complete resolution story. Problem closure requires verification that the solution is effective and complete. This includes technical verification of the fix, confirmation that safety assessments are updated, and documentation that all required change control activities are complete.

​
Integrating with Broader Quality Processes

CAPA integration ensures that software problems contributing to broader quality issues trigger appropriate corrective and preventive actions. Not all software problems require formal CAPAs, but safety-related issues and systemic problems should. Post-market surveillance must incorporate software problem data to maintain ongoing benefit-risk assessments. Problem trends and resolution effectiveness provide valuable data for clinical evaluation updates and regulatory submissions. Annual review of software problems helps identify improvement opportunities for both your products and processes. Look for recurring problem types, resolution effectiveness, and process improvements that could prevent future issues.

​
Example

​
Scenario

Your medical device software receives a customer complaint about incorrect calculation results in specific clinical scenarios. The software is classified as IEC 62304 Class C (safety-critical). Here’s how you would handle this problem: Problem Report Creation: Customer reports that device displays incorrect values when processing certain patient data ranges. Problem is logged in your ticketing system with high criticality due to potential safety impact. Investigation: Software team reproduces the issue and identifies a calculation error in the algorithm when processing edge-case values. Root cause analysis reveals the development team didn’t test extreme value ranges during verification. Safety Assessment: Risk management team evaluates that incorrect calculations could lead to inappropriate clinical decisions, potentially resulting in patient harm. This triggers immediate safety controls and formal change request. Resolution Planning: Develop software patch to fix calculation algorithm, expand test coverage for edge cases, and implement additional verification requirements for calculation-critical code. Implementation: Deploy software update following full design control process including verification testing, validation with clinical scenarios, and user notification of the update.

​
Example Problem Ticket Documentation

Problem ID: SW-2024-015
Date Reported: March 10, 2024
Source: Customer complaint via support channel
Affected Software: Version 2.3.1, Calculation Module
Safety Classification: Class C - Safety Critical Problem Description: Device displays incorrect calculation results when patient weight >120kg and BMI calculation is performed. Root Cause: Algorithm overflow error in BMI calculation function when processing high weight values. Insufficient input validation and edge case testing during development. Safety Impact: HIGH - Incorrect BMI calculations could lead to inappropriate dosing recommendations. Resolution:
  • Immediate: User notification about weight limit and manual calculation requirement
  • Permanent: Software patch v2.3.2 with corrected algorithm and expanded input validation
  • Preventive: Enhanced verification testing requirements for all calculation functions
Verification: Patch tested with full range of weight values (0-200kg), regression testing completed, clinical validation with test scenarios passed. Closure Date: March 25, 2024
Closed By: Software Team Lead

​
Q&A