Medical Device Firmware Safety & Compliance Review
Review medical device firmware for FDA/ISO compliance gaps and risks
What You Can Do
Conduct rapid, comprehensive safety and regulatory compliance reviews of medical device firmware. You provide source code, design documentation, or test results—Claude analyzes against FDA guidance, ISO 62304, IEC 61508, and industry best practices to identify compliance gaps, security vulnerabilities, and design risks. Get detailed findings reports with remediation priorities and regulatory mapping.
Features
validates electronic record controls, audit trails, and authentication requirements
maps firmware components to development, verification, and traceability requirements
identifies SIL/ASIL levels and validation evidence gaps
detects OWASP Top 10, input validation flaws, weak cryptography, and secure boot issues
generates failure mode analysis with safety impact ratings and mitigation strategies
assesses unit, integration, system, and acceptance test coverage against requirements
creates requirements-to-design-to-test mappings for submission evidence
Example Output
Example 1: Firmware Code Review Finding
- ⚠️ CRITICAL – IEC 61508 SIL2 Violation
Component: sensor_driver.c, line 145
Issue: Unvalidated ADC input directly used in safety-critical dose calculation
Risk: Rogue sensor value causes overdose or underdose
Remedy: Add range bounds validation with documented safe limits; implement exception handling
Standard: ISO 62304:2015 Section 7.2 (Software Design)
Effort: 4 hours to implement, 2 hours to test
Example 2: Compliance Gap
- ❌ MISSING – FDA Traceability Evidence
Gap: No documented link between design requirements and test cases
Impact: Cannot demonstrate verification completeness per FDA guidance
Evidence Needed: Requirements Traceability Matrix (RTM) with requirement-to-test cross-reference
Closure: 2-3 days to create RTM and close mapping gaps
Example 3: Security Risk
- 🔒 HIGH – Wireless Authentication Bypass
Component: wireless_comms.c, uart_receive()
Issue: No authentication on device configuration commands
Exposure: Proximity attacker can reconfigure safety parameters
Mitigation: Implement HMAC-SHA256 with device-specific key; add command audit logging
Standard: IEC 62304 Section 8 (Software Verification)
What's Included
- SKILL.md: Complete firmware review framework with regulatory decision trees and finding severity templates
- FDA Compliance Checklist: 50+ control points for 21 CFR Part 11 and predicate device strategy
- ISO 62304 Traceability Matrix Template: Map development activities to lifecycle processes and verification evidence
- Security Review Worksheet: Guided OWASP/embedded security assessment tailored for medical devices
- FMEA Severity Rating Guide: Failure mode impact analysis with IEC 61508 SIL correlation
- Test Coverage Rubric: Unit, integration, system, and acceptance test adequacy assessment
- FDA Finding Report Template: Severity tiers, regulatory citations, remediation tracking, and submission-readiness summary
Who It's For
- Firmware engineers — pre-QA safety review and design validation before submission
- Quality/Regulatory managers — compliance evidence collection and audit preparation
- FDA regulatory specialists — 510(k)/PMA submission strategy and readiness assessment
- Security architects — embedded system threat modeling and vulnerability prioritization
- Contract manufacturers — third-party vendor firmware qualification and OEM validation
Best For
- Pre-submission regulatory strategy and compliance gap identification
- Design review and architecture safety assessment before coding
- Firmware code security and safety vulnerability screening
- FDA/ISO compliance evidence compilation and traceability mapping
- Third-party vendor firmware audit and supplier qualification
You might also like
You can systematically diagnose database performance bottlenecks by sharing your schema, slow query logs, and execution plans with Claude. It identifies root causes—missing indexes, inefficient joins, lock contention—and provides prioritized recommendations with ready-to-implement SQL. Skip the manual log analysis and get tuning strategies tailored to your workload.
Use Claude to systematically analyze your database queries, execution plans, and schema to identify performance bottlenecks. The skill generates actionable optimization recommendations with SQL rewrites, index strategies, and configuration tuning. You'll receive detailed before-and-after performance analysis to validate improvements and prioritize work by impact.
Rapidly analyze firmware logs and diagnose hardware issues that cause device failures, connectivity problems, and performance degradation. You'll identify root causes from stack traces, crash dumps, and sensor data, then generate specific optimization recommendations. This skill transforms raw device logs into actionable debugging plans that reduce time-to-resolution from hours to minutes.
You'll develop systematic approaches to injectable formulation design, from API selection through sterilization strategy. Claude helps you troubleshoot failed batches by analyzing root causes, recommends regulatory pathways (505(b)(2), ANDA, NDA), and provides science-backed solutions for stability, compatibility, and manufacturability challenges.
You'll design and implement mobile features with architectural rigor, cross-platform considerations, and edge-case handling built-in. This skill generates complete system designs, platform-specific implementation strategies, performance optimization approaches, and testing frameworks. The output is production-ready guidance spanning iOS and Android with security, offline resilience, and deployment strategies included.
Claude analyzes your code diffs and generates standardized commit messages that follow the Conventional Commits specification. The skill automatically determines the correct commit type, scope, and description based on the changes you've made, ensuring your messages are parseable by automation tools while remaining human-readable for code reviewers.
You can transform raw text into structured, labeled datasets for machine learning, analysis, and research. This skill performs named entity recognition, sentiment classification, part-of-speech tagging, and dependency parsing—generating consistent, validated annotations at scale. Use it to prepare corpora, extract entities, classify documents, or perform linguistic analysis without manual annotation.
You can architect multi-node ROS control systems from scratch, including node design patterns, communication flows, and real-time constraints. You'll debug complex node interactions using publisher/subscriber analysis, service call tracing, and action server diagnostics. You can optimize motion controllers through PID tuning, trajectory planning validation, and performance profiling to achieve precise, responsive robotic behavior.