SOUP – Can’t Live Without It!

Software of Unknown Provenance


SOUP.  It is likely that you are familiar with the acronym, SOUP, in relation to medical device and Health IT software.  The medical device software standard IEC 62304, defines SOUP as a “software item that is:

  • already developed and generally available and that has not been developed for the purpose of being incorporated into the medical device (also known as “off-the-shelf software”) or
  • software previously developed for which adequate records of the development processes are not available.

When I started my career in the mid-1980’s, we developed most ALL of the software in our medical devices.  Very little SOUP was used.  However, in 2021, most medical devices and Health IT systems are composed primarily of SOUP!  Wow, what a transition!

We are often asked about SOUP from a compliance standpoint.  One of the major confusions is confusing SOUP used in our products (which are subject to IEC 62304) with SOUP that may be used in our development and other quality system tools (which are not subject to IEC 62304).  IEC 62304 is concerned with the quality of the software running in your medical devices (including SaMD).

A second confusion is artificially gather SOUP documentation separately then where it would naturally apply.  For example, having a separate SOUP software risk analysis from the custom software risk analysis.  Likely, SOUP failure modes are in the same fault trees as your custom software so it would be easiest for the software development team to do the software risk analysis of custom software and SOUP at the same time and document it in the same way.  This applies to all places where SOUP should be considered in the entire SDLC.

Don’t create unnecessary work simply because you think that it is required for compliance.  That is not the intent of IEC 62304 nor of the US design controls regulations.  Sometimes we may see these separate documentation tasks as improving quality – but in fact, they could have the opposite effect! The time invested by the software development teams creating unnecessary documentation could have in fact been invested in greater rigor and detail for safety related software.

Gotta use SOUP?  I get it – but analyze its failure modes and design in risk controls.  We will all benefit from it.  Onward!

About the author

Brian is a biomedical software engineer - whatever that is! Started writing machine code for the Intel 8080 in 1983. Still enjoys designing and developing code. But probably enjoys his garden more now and watching plants grow ... and grandkids grow!

SoftwareCPR Training Courses:

IEC 62304 and other emerging standards for Medical Device and HealthIT Software

Our flagship course for preparing regulatory, quality, engineering, operations, and others for the activities and documentation expected for IEC 62304 conformance and for FDA expectations. The goal is to educate on the intent and purpose so that the participants are able to make informed decisions in the future.  Focus is not simply what the standard says, but what is meant and discuss examples and approaches one might implement to comply.  Special deep discount pricing available to FDA attendees and other regulators.

3-days onsite with group exercises, quizzes, examples, Q&A.

Instructor: Brian Pate

Next public offering:  June 5-7, 2024
Boston, MA

Email to request a special pre-registration discount.  Limited number of pre-registration coupons.

Registration Link:

Register Now



Being Agile & Yet Compliant (Public or Private)

Our SoftwareCPR unique approach to incorporating agile and lean engineering to your medical device software process training course is now open for scheduling!

  • Agile principles that align well with medical
  • Backlog management
  • Agile risk management
  • Incremental and iterative software development lifecycle management
  •  Frequent release management
  • And more!

2-days onsite (4 days virtual) with group exercises, quizzes, examples, Q&A.

Instructors: Mike Russell, Ron Baerg

Next public offering: February 12-15, 2024

Virtual via Zoom

Registration Link:

Register Now



Medical Device Cybersecurity (Public or Private)

This course takes a deep dive into the US FDA expectations for cybersecurity activities in the product development process with central focus on the cybersecurity risk analysis process. Overall approach will be tied to relevant standards and FDA guidance documentation. The course will follow the ISO 14971:2019 framework for overall structure but utilize IEC 62304, IEC 81001-5-1, and AAMI TIR57 for specific details regarding cybersecurity planning, risk characterization, threat modeling, and control strategies.

2-days onsite with group exercises, quizzes, examples, Q&A.

Instructor: Dr Peter Rech, 2nd instructor (optional)

Next public offering:  TBD

Corporate Office

15148 Springview St.
Tampa, FL 33624
Partners located in the US (CA, FL, MA, MN, TX) and Canada.