SOUP (Software Of Unknown Provenance) is software that is used in a medical device but was not developed to be used in a medical device, or without all the documentation to prove it was.
While in some cases the use of SOUP is not desirable, in most applications the use of SOUP for some functionality is perfectly acceptable and often the preferred option. A lot of the time SOUP can be documented within a couple of days depending on what it is and how it is used.
SOUP is not inherently risky
Medical device manufacturers do not need to be afraid of SOUP. Well-established open-source libraries have often been tested far more thoroughly than anything a device manufacturer could develop in-house.
How to manage SOUP under IEC 62304
IEC 62304 requires SOUP to be identified, evaluated for known anomalies, and included in risk management. The level of documentation required depends on the safety class of the software item that uses it.
Zentis has documented SOUP across dozens of medical device projects, from small embedded libraries to complete operating systems.
