FDA issued a final guidance “Infusion Pumps Total Product Life Cycle” dated Dec. 2, 2014 after its draft draft of this document issued April 23, 2010.. This supersedes the original “Guidance on the Content of Premarket Notification [510(k)] Submissions for External Infusion Pumps” issued March, 1993. This guidance mentions the word software 31 times and safety assurance case 15 times. It specifically states that the infusion pump system includes the network (i.e, any device or system physically or wirelessly connected to the infusion pump) and explicitly requests communications and network information in premarket submissions.
It also states that the following should be provided as part of the software design informaiton: A drug library or other dose error reduction mechanism; A real time clock (RTC), On-board memory, Pump log Alarm handler; and Watch dog timer.
The guidance states 3 elements of safety cases: Claims, Arguments, Evidence and provides general guidance but states the format and methodology are flexible but should be well explained. It also states that FDA uses post market data in its review of safety cases to confirm their vaildity.
Section 5b lists 4 hazards to be addressed in the safety case: Delivery Error, Incorrect Therapy, Contamination, Traumatic Injury. It goes on to list categories of hazards and specific causes to be considered.
In the software safety section of the guidance refers to the general FDA software submission guidance, the premarket cybersecurity guidance, and the one for Off-the-shelf software this guidance and then specifically requests static analysis of the software and extensive details required for each unresolved anomaly in terms of root cause analysis, analysis for similar bugs, and details on how to fix the anomlous code.