Medical device firmware
Board support, RTOS and update paths for the microcontroller at the heart of the device.
- BSP, board bring-up and RTOS integration
- Bootloaders and field updates that roll back safely
- Toolchain migration with a MISRA re-check
Industries · Medical Electronics
Medical device firmware and its evidence, engineered and verified in India.
Device firmware, IEC 62304 verification evidence, risk controls traced for ISO 14971, power profiling and security for connected devices, for teams building medical electronics. Engineering led from Bengaluru.
01 The challenge
Medical Device Firmware and Its Evidence.
Device firmware and IEC 62304 verification evidence, using tools whose vendors state their qualification, with software risk controls traced to tests.
Software in a medical device is judged by what happens when it fails. IEC 62304 sets the software lifecycle and scales the verification work by safety class, from Class A to Class C. ISO 14971 governs how risk is managed across the product, and IEC 60601 covers the safety of the electrical equipment. The engineering problem is producing verification evidence that holds up to review without slowing down the team that writes the code.
GSAS builds that evidence into the daily work. Klocwork runs static analysis with MISRA and security checkers on every change. TESSY by Razorcat automates unit testing with coverage measurement for the software unit verification IEC 62304 asks for at Class B and Class C, and Razorcat states the tool is qualified for IEC 62304. Arm Keil MDK Professional carries Arm’s safety-certified compiler for Cortex-M microcontrollers, which Arm states is certified to IEC 62304 Class C.
For medical device start-ups and established manufacturers in India, GSAS engineers set up the development infrastructure with traceability from requirements and software risk controls to tests, write and verify the firmware, and hand over the reports the quality and regulatory team needs. Safety classification, the risk management file and regulatory submissions stay with the manufacturer.
02 What we engineer
Six medical device services, mapped onto the device.
Each card lights the part of the device and its software lifecycle that service touches, from the firmware on the microcontroller to the records your quality team keeps.
- 1. Device firmware: BSP, RTOS, bootloader
- 2. Software lifecycle: IEC 62304 Class A to C
- 3. Risk controls: Traced for ISO 14971
- 4. Verification: Unit tests and coverage
- 5. Battery and power: Sleep and active current
- 6. Connected device: Secure boot and TLS
-
-
IEC 62304 verification evidence
The software verification evidence IEC 62304 expects at each safety class, produced as the code is written.
- MISRA C baseline with deviation records
- Tool classification and vendor qualification kits deployed
- Compliance and coverage reports exported per release
-
Unit testing and static analysis
Every change checked and tested, with each software risk control traced to the test that verifies it.
- Requirements-based unit tests with statement, branch and MC/DC coverage
- Static analysis for MISRA, CWE and CERT findings on every change
- Risk control measures traced from requirement to test
-
Power profiling and battery life
Current measured on the real device, so a battery life figure rests on data.
- Sleep and wake current profiled peripheral by peripheral
- Firmware energy optimisation and power-mode tuning
- Battery life estimation and validation testing
-
Security for connected devices
A device that talks to a phone, a hub or the cloud, secured from boot to link.
- Secure boot chain and signed firmware images
- TLS and DTLS configuration for connected devices
- Key provisioning and device identity in production
-
IEC 62304 and MISRA training
Your engineers taught the lifecycle and the rules by engineers who apply them on projects.
- IEC 62304 medical device software lifecycle
- Hazard analysis, FMEA and fault tree methods
- Static analysis set-up and MISRA compliance
03 How we work
From requirement to release, with evidence at every step.
The same discipline from the first commit to the release build: each stage leaves something your quality team, your auditor or the next engineer can check.
-
01
Plan
- Safety class
- Tool use matched to your Class A, B or C
- Coding rules
- MISRA C baseline and deviation process
- Traceability
- Requirements and risk controls linked to tests
Rules and tools agreed before the first commit
-
02
Build
- Firmware
- BSP, RTOS and bootloader on the target
- Analysis
- Static analysis gating every change in CI
- Unit test
- Requirements-based tests with coverage
Findings reach the developer who made the change
-
03
Verify
- On target
- Tests and trace on the real core
- Power
- Sleep and active current against the battery budget
- Records
- Coverage and compliance reports per release
Evidence handed to your quality and regulatory team
- Half-acre build and test site, Bengaluru Rural, opened 2026
- Doddaballapur
- Specialists, engineering led from Bengaluru
- 40+
- In 9 Indian cities
- 11 offices
- Certified by TÜV Rheinland
- ISO 9001:2015
04 Capabilities
The GSAS capability pages behind Medical Electronics.
Each service above is a full practice at GSAS. These are the pages that describe it in depth.
- Embedded Software Engineering Medical device firmware written to produce IEC 62304 evidence, and low-power design.
- Safety & Compliance Engineering IEC 62304 verification evidence, with software risk controls traced to tests for ISO 14971.
- Testing & Verification Unit testing with traceability, code coverage, static analysis for safety classes A/B/C.
- Test & Measurement Integration Battery life characterization, power profiling, EMC pre-compliance measurements.
05 Tools
The tools Medical Electronics teams use, and GSAS engineers use too.
GSAS is a value added distributor/reseller for these products. We have a dedicated FAE team ready to help you with custom built solutions matching your needs.
-
Perforce Klocwork Klocwork by Perforce is a scalable SAST tool for C, C++, C#, Rust, Java, JavaScript, Python, and Kotlin, built for DevSecOps with incremental analysis, MISRA, CERT, and CWE enforcement, and TUV SUD certified ISO 26262 and IEC 61508 tool qualification. Deployed and supported across India by GSAS. -
Razorcat TESSY Automated dynamic unit, module, and integration testing for embedded C/C++ with MC/DC coverage. Qualified by Razorcat for safety-related software development per IEC 61508, IEC 62304, ISO 26262 and EN 50128. Buy in India from GSAS. -
Arm Keil MDK A productivity, debugging, and reliability platform for professional Cortex-M development, MDK v6 brings dual IDE workflows, safety-certified compilers, Arm Fixed Virtual Platforms, and subscription licensing. Buy in India from GSAS. -
Razorcat CTE: Classification Tree Editor Graphical test case design tool using the Classification Tree Method, creates systematic, low-redundancy test specifications for TESSY and other test execution tools. Buy in India from GSAS.
06 Standards
Standards listed for Medical Electronics, and the tools placed against each.
A chip shows a published qualification scope where one exists, and the bare standard name where none does.
MEDICAL IEC 62304
MEDICAL IEC 60601 No tool mapped
MEDICAL ISO 14971 No tool mapped
MEDICAL FDA 21 CFR Part 11 No tool mapped
IEC 60601, ISO 14971, FDA 21 CFR Part 11 are listed in this page's standards set, but no tool in the table below carries a published qualification against them, and GSAS does not claim one. Which of these applies to a given programme depends on its scope, jurisdiction and certification basis.
| Tool | Applicable Standards |
|---|---|
| Klocwork (Perforce) | IEC 62304 up to Class C |
| Perforce QAC | IEC 62304 up to Class C |
| Arm Compiler for Embedded FuSa | IEC 62304 Class C (qualified releases) |
| embOS-Safe (SEGGER) | IEC 62304 Class C |
| TESSY (Razorcat) | IEC 62304 |
07 Working together
Three ways to start, depending on where your device is.
A first device, an existing product line, or a design delivered for a client.
-
01
Medical device start-ups
First device to first release
Firmware, a verification pipeline and an IEC 62304 evidence trail from the first commit, so the software records are not rebuilt by hand before release.
- Firmware and bring-up
- MISRA and unit tests in CI
- Power and battery profiling
-
02
Established manufacturers
Existing products, new releases
Static analysis baselines on existing code, unit test coverage brought up to the safety class, and tool qualification material ready for the next design change.
- MISRA baseline on legacy code
- Coverage to the safety class
- Tool qualification kits
-
03
Contract design houses
Devices built to a client brief
Engineering capacity and a ready verification set-up for design houses delivering medical electronics, with reports the client’s quality team can take straight into its own records.
- Firmware capacity
- Verification set-up
- Reports per release
08 Contact
Building a medical device or its next release?
Tell us the device, its software safety class and the microcontroller it runs on. GSAS replies from Bengaluru with scope and a proposal: firmware, verification evidence, power profiling and security.
Questions
Medical Electronics engineering with GSAS in India
What medical device engineering services does GSAS provide in India?
GSAS provides medical device firmware, IEC 62304 verification evidence, unit testing and static analysis with traceability to software risk controls, power profiling and battery life validation, security for connected devices, and IEC 62304 and MISRA training. Engineering is led from Bengaluru.
Can GSAS help us produce IEC 62304 evidence for a Class C device?
Yes. GSAS sets a MISRA C baseline with deviation records, writes requirements-based unit tests with statement, branch and MC/DC coverage, and classifies how each tool is used, deploys the vendor qualification kits and helps prepare the tool documentation for the way you use them. Safety classification and the software development plan stay in your quality system. This work produces the evidence for them.
How does GSAS support ISO 14971 risk management?
Risk analysis and the risk management file belong to the manufacturer. Where a risk control is implemented in software, GSAS traces it from requirement to the test that verifies it and hands over the verification results for your file.
Does GSAS obtain regulatory approval for medical devices?
No. Regulatory submissions and approvals, whether to CDSCO, the FDA or a notified body, remain with the manufacturer and its regulatory team. GSAS provides the engineering and verification evidence that goes into them.
Can GSAS measure the battery life of a portable medical device?
Yes. GSAS profiles sleep and wake current peripheral by peripheral, correlates power events with firmware execution, tunes power modes, and estimates and validates battery life against your budget.
Does GSAS also supply the medical device development tools?
Yes. GSAS is a value added distributor/reseller for the static analysis, unit test and compiler tools on this page, and its engineers use the same tools on customer projects.
Blog
Latest Thinking: Medical Electronics
Static Analysis Perforce Medical Electronics
Static Analysis for Medical Device Software: IEC 62304 and FDA Compliance in India
IEC 62304 governs the software lifecycle for every medical device sold with embedded or standalone software, and static analysis is how most manufacturers satisfy its coding-standard and verification requirements. Here is what the standard actually requires, how FDA compliance evidence works, and which certified tools Indian medical device teams can use, from GSAS Micro Systems, an authorized engineering partner in India.
18 Jul 2026 · 9 min read
Compliance & Safety Perforce Razorcat
Shift-Left for Safety-Critical Code: Perforce QAC Static Analysis + Razorcat TESSY Dynamic Testing for MISRA, IEC 62304 and FDA Compliance in India
Run Perforce QAC static analysis first to enforce MISRA and clean the code, then Razorcat TESSY for dynamic unit testing and MC/DC coverage. Together they form a complete shift-left toolchain for IEC 62304 medical-device and FDA-regulated software, both from one authorized engineering partner in India, GSAS Micro Systems.
5 Jun 2026 · 11 min read
emUSB SEGGER Medical Electronics
SEGGER emUSB-Host for Indian Medical and Industrial Products on STM32H7 and i.MX RT
Indian medical-device and industrial-controller teams turning a Cortex-M product into a USB host for mass-storage, barcode scanners, printers, and vendor-specific peripherals pick SEGGER emUSB-Host for class-driver coverage, commercial support, and IEC 62304 traceability.
15 Apr 2026 · 9 min read
emUSB SEGGER Medical Electronics
SEGGER emUSB-Host MSC: USB Mass Storage File Transfer for Indian Medical and Industrial Devices
How SEGGER emUSB-Host with the MSC class, combined with emFile, delivers production-grade USB stick file transfer for Indian medical devices, industrial HMIs and test equipment.
15 Apr 2026 · 10 min read
emWin SEGGER Medical Electronics
Building Custom emWin Widgets for Indian Medical Devices and HMI: STM32H7 and i.MX RT1170 in Production
How Indian medical-device and industrial HMI teams build custom SEGGER emWin widgets for patient monitors and control panels on STM32H7 and NXP i.MX RT1170, with day/night skinning, gesture handling and commercial licensing via GSAS.
15 Apr 2026 · 9 min read
SystemView SEGGER Medical Electronics
SystemView for IEC 62304 Medical Device Evidence: SEGGER SystemView in India
How Indian medical device teams use SEGGER SystemView to turn qualitative RTOS reassurance into quantitative, auditable evidence for IEC 62304 Class B and Class C design history files.
15 Apr 2026 · 9 min read
Compliance & Safety Perforce Automotive & Mobility
AI-Assisted Code Remediation for Safety-Critical C and C++
Perforce has extended AI-assisted code remediation across both Perforce QAC and Klocwork, delivered through a Static Analysis MCP server that Perforce describes as IDE-agnostic and Code-Assist tool-agnostic, with support for private, air-gapped environments. The fix is proposed by AI. The finding it is fixing still comes from the qualified analysis engine, and a developer approves every change.
22 Mar 2026 · 8 min read
Compliance & Safety Perforce Arm
Functional Safety for Indian Automotive and EMS: Meeting ISO 26262 and IEC 61508
A practical guide to functional safety standards for Indian automotive, two-wheeler, and EMS teams, covering ISO 26262, IEC 61508, IEC 62304, and the GSAS safety toolchain from Perforce, Arm, Segger, and Razorcat.
22 Mar 2026 · 3 min read
Compliance & Safety Perforce Automotive & Mobility
Static Application Security Testing: Why 50% of Vulnerabilities Start in Source Code
Half of all security defects originate at the source code level. SAST tools like Klocwork identify vulnerabilities during development, before they reach production. Here's what Indian engineering teams need to know.
22 Mar 2026 · 2 min read
Compliance & Safety Perforce Automotive & Mobility
Writing Secure C Code: Best Practices for Indian Embedded Engineers
Exploitable coding errors, not sophisticated attacks, are behind a large share of security incidents in embedded systems. Here is how Indian engineering teams can adopt secure C coding practices using proven frameworks and tools.
22 Mar 2026 · 3 min read
Compliance & Safety Perforce Automotive & Mobility
What Is CWE? Understanding Common Weakness Enumeration for Secure Embedded Software
CWE stands for Common Weakness Enumeration, the community-developed catalogue of software and hardware weakness types that names the coding patterns behind recurring vulnerabilities in embedded C and C++.
22 Mar 2026 · 4 min read
Compliance & Safety Perforce Automotive & Mobility
What Is Linting and Why It Matters for Embedded C/C++ Teams in India
Linting is automated analysis of source code that detects likely errors, unsafe constructs and coding-standard violations without executing the program, and for safety-critical embedded C and C++ it is only the first of three analysis layers.
22 Mar 2026 · 5 min read