I need to produce some documentation to be compliant with IEC 62304 and, while reading all of the processes needed to be documented, I'm having a couple doubts about how to structure the whole lot of documentation.

My concern is about how to divide all of the documentation in separate documents and what should be included.

The whole software system can be considered composed of 3 main subsystems:

  • Firmware on embedded device (#1)
  • A companion Android Application (#2)
  • An application backend used to ingest, process and save data from the devices (#3)

I'm especially in charge of the latest, which is a fairly streamlined streaming-oriented application which processes and saves data on a DB (a SOUP, in the case of IEC 62304 compliance).

Now, the data saved in the DB is visualized in a Grafana dashboard: in which document should this component be considered? What should be the limit of the scope regarding the #3 application and its interaction with the other components? Since Grafana would be a SOUP, I was thinking about writing about it in the appropriate document where all configurations and SOUP management is. Should I mention/reference inside the SRS of #3 application the requirements for the needed visualizations? Which is the appropriate document where I should put this information?

I'm using as a template reference for all of the documentation needed this blog, since I'm new to software development with ISO/Standard Regulations, but any additional resources as to how structure the whole docs in this context is highly appreciated.

Thank you

1 Answer 1


The fact that a component is identified as SOUP simply means that you don't have control over the process used to develop that component, so you have to assume it was developed with the worst possible process (no tests, no design, no issue tracking, nothing). Apart from that, a SOUP component is just another component in your (sub-)system.

This means:

  • Your SRS should contain the requirements that resulted in the selection for a particular SOUP component. If you use Grafana, there should be a requirement for a dashboard. Without that requirement, why are you making the dashboard in the first place.
  • In your architectural, system or subsystem design, you identify the parts that make up that level of abstraction. This is where you identify which of those parts a bought as SOUP and what measures you take to ensure the quality of your overall system.
  • In other design documentation, for example in a detailed design where you describe the interaction with the database, you can just reference the external components without explicitly calling out that they are SOUP or not. As far as those designs are concerned, it doesn't matter who developed the external component.
  • I see, thank you very much for your response. Would you suggest, then, broadening the scope of SRS #3, rather than strictly limiting it to the requirements concerning only the ingestion/processing/output on db part?
    – fedexist
    Commented Jan 7, 2019 at 13:33
  • @fedexist, I am not sure I would call that broadening the scope. The requirements of a subsystem should cover all the functionality of the subsystem, regardless of what you buy or make yourself. Those requirements should actually exist already before you decide to build or buy a component. Commented Jan 7, 2019 at 16:41
  • Right, thank you very much for your response, very useful.
    – fedexist
    Commented Jan 8, 2019 at 7:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.