How to structure SW documentation with SOUP components

Question

I need to produce some documentation to be compliant with IEC 62304 and, while reading all of the processes needed to be documented, I'm having a couple doubts about how to structure the whole lot of documentation.

My concern is about how to divide all of the documentation in separate documents and what should be included.

The whole software system can be considered composed of 3 main subsystems:

• Firmware on embedded device (#1)
• A companion Android Application (#2)
• An application backend used to ingest, process and save data from the devices (#3)

I'm especially in charge of the latest, which is a fairly streamlined streaming-oriented application which processes and saves data on a DB (a SOUP, in the case of IEC 62304 compliance).

Now, the data saved in the DB is visualized in a Grafana dashboard: in which document should this component be considered? What should be the limit of the scope regarding the #3 application and its interaction with the other components? Since Grafana would be a SOUP, I was thinking about writing about it in the appropriate document where all configurations and SOUP management is. Should I mention/reference inside the SRS of #3 application the requirements for the needed visualizations? Which is the appropriate document where I should put this information?

I'm using as a template reference for all of the documentation needed this blog, since I'm new to software development with ISO/Standard Regulations, but any additional resources as to how structure the whole docs in this context is highly appreciated.

Thank you

Answer 1

The fact that a component is identified as SOUP simply means that you don't have control over the process used to develop that component, so you have to assume it was developed with the worst possible process (no tests, no design, no issue tracking, nothing). Apart from that, a SOUP component is just another component in your (sub-)system.

This means:

• Your SRS should contain the requirements that resulted in the selection for a particular SOUP component. If you use Grafana, there should be a requirement for a dashboard. Without that requirement, why are you making the dashboard in the first place.
• In your architectural, system or subsystem design, you identify the parts that make up that level of abstraction. This is where you identify which of those parts a bought as SOUP and what measures you take to ensure the quality of your overall system.
• In other design documentation, for example in a detailed design where you describe the interaction with the database, you can just reference the external components without explicitly calling out that they are SOUP or not. As far as those designs are concerned, it doesn't matter who developed the external component.