End-to-End Remediation - Not Scan-and-Leave
Find it. Understand it. Fix it. Prove it. See how ESL closes the engineering loop for FDA software evidence - across source, build artifacts, and binary-only systems.
Static Code Analysis Alone Is Not Enough: Add Unit Testing & Code Coverage
Seven FDA enforcement cases. One consistent pattern: teams that passed system-level testing and managed static-analysis findings were still cited for missing code-level verification. The full brief maps each case to the exact ESL solution with Parasoft tools.
Read the brief →Inovytec Ventway Sparrow - FDA 510(k) with Parasoft C/C++test
?Before ESL
- • Embedded ventilator software needed FDA 510(k) compliance with no static analysis baseline
- • No customized rule set mapped to FDA 510(k) certification requirements
- • Code quality issues hidden across the embedded C/C++ codebase
- +1 more on the case page
VAfter ESL
- • ESL deployed Parasoft C/C++test with FDA 510(k)-customized static analysis rules
- • Every Ventway Sparrow release now runs Parasoft static analysis configured to FDA regulation definitions
- • 100% of FDA 510(k) certification rules and guidelines passed
- +2 more on the case page
Result: FDA 510(k) certification achieved. Parasoft C/C++test became the testing solution of choice at Inovytec, with ESL providing ongoing local support as Parasoft’s authorized Israeli distributor.
When Code Coverage Becomes an FDA Issue - Five Enforcement Cases Decoded
?Before ESL
- • FDA Warning Letter (Xoran, 2024): coverage not tied to software risk - three corrective responses rejected as inadequate
- • Medtronic PMA deficiency: branch coverage and configuration-specific testing questioned - FDA asked which branches, which config
- • Medtronic dead-code review: 100% reported coverage but FDA challenged dead code, ROM/RAM variants, and timing effects underneath
- +3 more on the case page
VAfter ESL
- • ESL deployed Parasoft C/C++test module-by-module on-target instrumentation - overhead bounded by single module, not full firmware
- • Risk-tiered coverage: MC/DC for safety-critical modules, branch for moderate-risk, statement for low-risk - exactly what FDA expects
- • Coverage aggregation: unit, system, host, and manual test coverage merged into one unified project report
- +3 more on the case page
Result: ESL’s approach transforms code coverage from a percentage chase into a defensible regulatory argument: what was tested, what was not, why the gaps are acceptable, and how evidence maps to software risk. Demonstrated on SensorDemo with 29 auto-generated tests finding real defects - the kind of evidence package that answers FDA questions before they are asked.
AI-Based Cardiac Imaging Device
?Before ESL
- • Unknown open-source components in the build
- • No SBOM produced for FDA submission
- • 340 unresolved static analysis findings (MISRA C:2023)
- +2 more on the case page
VAfter ESL
- • CycloneDX SBOM with VEX decisions generated by SBOMator™
- • All CVEs triaged: 12 remediated, 8 documented with compensating controls
- • 12 real defects fixed by ESL engineers; 328 false positives filtered
- +2 more on the case page
Result: FDA 510(k) clearance achieved with zero software evidence deficiencies flagged in the substantive review.
Embedded Firmware AI Medical Device (Binary-Only)
?Before ESL
- • Firmware available only as compiled binary - no full source tree
- • No component inventory for the supply chain
- • No coverage data from cross-compiled target
- +1 more on the case page
VAfter ESL
- • SBOMator™ extracted SBOM from firmware binary - no source required
- • 14 CVEs correlated; 3 critical vulnerabilities patched in upstream components
- • On-target testing: module-by-module instrumentation, results merged
- +2 more on the case page
Result: PMA submission included complete software evidence package. SBOMator’s binary-only capability was critical - no other tool could produce the SBOM from firmware alone.
Cloud-Based AI Diagnostic SaaS
?Before ESL
- • Containerized deployment with 47 dependencies - no inventory
- • No §524B cybersecurity evidence prepared
- • Static analysis backlog of 180 findings (CERT C/C++, CWE)
- +1 more on the case page
VAfter ESL
- • Container SBOM generated by SBOMator™ (CycloneDX + VEX)
- • Section 524B evidence mapping: premarket + postmarket monitoring plan
- • ESL fixed 41 real defects; remaining 139 triaged as false positives or accepted deviations
- +2 more on the case page
Result: De Novo granted. FDA reviewer specifically noted the cybersecurity evidence package as comprehensive and well-organized.
Multi-Platform AI Medical Software (Desktop + Mobile + Cloud)
?Before ESL
- • 3 platforms (C++ desktop, C# server, Java mobile) - no unified evidence
- • No consistent coding standard enforcement across platforms
- • Coverage measured differently on each platform - not comparable
- +1 more on the case page
VAfter ESL
- • SBOMator™ produced SBOMs for all 3 platforms from source, packages, and containers
- • Parasoft C/C++test for C++, Parasoft dotTEST for C#, Parasoft Jtest for Java
- • Unified coverage methodology: branch coverage for all Class B components
- +1 more on the case page
Result: 510(k) cleared. ESL’s technology-independent execution was key - one team, one evidence standard, three platforms.
Bring ESL the software - not a cleaned-up demo
We will build, clean and connect the evidence. Start with a software evidence scoping workshop.
Schedule Scoping Workshop →