Topic · IEC 62304

What is IEC 62304, and how do I keep the software design document true in CI?

Gist

IEC 62304 is the medical device software lifecycle. Class A, B, or C sets the rigor. The useful artefact is an SDD whose units still match the graph. Proof prints that document from the current traces with proof doc generate sdd, then fails the merge when the graph is stale.

proof doc generate sdd --output docs/sdd.html

Keep the notified body if you need a certificate. Keep ISO 14971 for risk. Keep ISO 13485 for the QMS. Proof is none of those, and it is not a 510(k).

Request demo Last DHF vs this push

01 · The dated design file

A handbook is not an SDD. An SDD from last Class C review is not this push.

Clause 5.3 asks for software architectural design. Clause 5.4 asks for detailed design. A person can fill those once. The next commit does not reopen the DHF.

The four jobs that are not medical-specific (checkable shalls, re-derived links, MC/DC, a named reviewer) live on the DO-178C page. ISO 26262 Part 6 is automotive: the SDD artefact for that regulator lives on ISO 26262. This page is the medical document: render the SDD from the graph you already gate.

Class A is no injury. Class B is non-serious injury. Class C is death or serious injury. Proof maps its own assurance levels onto that ladder. Formal methods on the shalls you wrote (Kind2 realizability, Z3 data lemmas) scale with the class. They are not a notified-body assessment. Clause 5.2.4 wants the risk analysis re-evaluated. That is ISO 14971. Proof does not write it. Jama still authors the shall. SOUP still needs an owner who can name the version.

proof validate --preflight
proof doc generate sdd --format html --output docs/sdd.html
proof audit --fail-level warn

The first command rejects a sentence the templates cannot parse. The second renders HTML (or Markdown) from loaded project data. PDF is a separate path and currently fails. The third is the standing gate. Generating docs before traces are refreshed is how the DHF got stale in the first place.

02 · The exhibit

Same Class C headings. A date, or this graph.

The file still has the section titles. The graph moved. Click the tabs.

Word / ALM export

Opened Clause 5.3 / 5.4 from last release
SW-REQ-12 still in the appendix

Sections present

This push

The unit design changed. The DHF did not.

No re-render

Word / ALM export

Still last release. Still a date.

Keep the risk file

Proof

Ask does sdd still match traces
Gate audit --fail-level warn

Merge blocked if the graph is stale

Same Class C headings. A date, or this graph. Click the tabs.

Who	What they notice	What they lose
IEC 62304 / notified body	The standard, Class A through C, the certificate	They write the requirement. Keep them. Proof does not replace the standard and is not a qualified tool.
Jama / Polarion	A stored shall, a SOUP list, a DHF folder	They author the programme. They do not emit the SDD from the current graph. Keep them.
VectorCAST / LDRA	A qualified C toolchain and a structural-coverage kit	They still win at medical C with a notified body. The four-jobs H1 lives on DO-178C-style.
Proof	Current traces rendered into `sdd`, then the same audit on every push	No ISO 14971. No ISO 13485 QMS. Tests are not executed. Not a 510(k).

The generate command loads the project, then one template, then one format:

proof doc list-templates
proof doc generate sdd --format md --output docs/sdd.md
proof doc generate sdd --format html --output docs/sdd.html
proof audit --fail-level warn

Unknown template names fail before render. Unsupported formats fail before render. HTML and Markdown are the supported pair. PDF is classified separately and currently errors. Treat generated output as a view of the graph, not as a second source of shalls. If documentation coverage is low, the SDD is a thin print of a thin graph.

We have not run this template against a frozen IEC 62304 corpus, and we have not scored it against VectorCAST or LDRA on the same pack. The loss is named, not scored.

03 · The honest loss

A green Proof audit is not Class C.

Class A through C still belong to the programme. Proof will not sign Class C. It will not pretend a named reviewer is a notified-body assessment.

Clause 5.7 wants software system testing against the requirements. Proof traces coverage. It does not run the suite. Keep go test. Clause 5.5 wants units implemented. Auto-linking is a pointer, not a compiler. SOUP (software of unknown provenance) still needs a person who can name the version and the anomaly list. Proof will not invent that inventory.

ISO 14971 is risk management. Proof does not write the hazard analysis. That H1 lives on hazard analysis to code. ISO 13485 is the quality system. Proof is not a QMS. IEC 61508 is the parent industrial standard; it is not this H1.

Jama still authors. The four jobs still live on that URL. The automotive SDD still lives on ISO 26262. The NASA SRS still lives on NPR 7150.2D.

Request demo How the install is bought

04 · Nearby questions

What people type next.

I need DO-178C style verification but I'm not in aerospace. What can I use? The four jobs, not the Type Certificate. DO-178C-style.

What is ISO 26262, and how do I keep the software design document true in CI? Automotive Part 6. Same sdd template, different regulator. ISO 26262.

What is ISO 14971? Risk management for medical devices. Proof does not write it. Keep the risk file. Hazard analysis.

What is a requirements traceability matrix, and how do I keep it true? Clause 5 wants the links re-derived, not pasted. RTM.