Software Training Computer Systems Validation for Automated Processes

1
Software Training Computer Systems Validation
for Automated Processes

• presented by
• Norman Wong, Engineer
• Norman.wong_at_ fda.gov
• US Food Drug Administration
• ORA/ORO
• Division of Field Investigation
• Duty Station Seattle District Office, Bothell
  Washington
• presented at
• FMDIC FDA Quality Systems Educational Forum
  Production and Process Controls
• Dallas, TX- 4/23/04

2
Training Approach for Automated Processes

• More hands-on automated process validation
  activities and less computer system software
  development activities
• Provide training on inspectional and case
  development activities
• Focus on validation of automated manufacturing
  processes and less on automated data management
  systems

3
Training Approach for Automated Processes

• More risk based inspectional approaches
• Limiting the risk evaluation to the product and
  patient (e.g., Exclude environmental harm, user
  etc.)
• Making the linkage between the process risk and
  the product risk
• Identifying those significant product and process
  characteristics that should be part of the
  functional requirements/specifications of a
  computer system/computerized process

4
How will we do that?

• 1. Apply inspectional techniques to identify
  computerized systems and audit system validation
  when conducting inspections of medical device
  manufacturing processes.
• Training provides information on identifying
  automated processes and auditing techniques with
  special emphasis on the computerized aspects of
  an automated manufacturing process.

5
How will we do that?

• 2. Recognize the correlation between the general
  principles of process validation and validation
  of automated systems.
• Installation Qualification (IQ)
• Computer System Qualification (IQ, OQ, PQ),
• Operational Qualification (OQ),
• Performance Qualification (PQ)

6
How will we do that?

• 3. Identify critical processes that require
  validation.
• Utilize information available in Risk Analysis
  and Risk Management documents to focus the
  inspection on the more significant processes and
  potential process failure modes.

7
How will we do that?

• 4. Identify the section of the QSR that applies
  specifically to automated processes.
• 21 CFR 820.70(i) Automated processes. When
  computers or automated data processing systems
  are used as part of production or quality system,
  the manufacturer SHALL validate computer software
  for its intended use according to an established
  protocol.

8
A Systematic Approach to Process Validation

• Hazard identification and analysis
• Determination of critical control points
• Establish control limits for each critical
  control point
• Monitor the critical control points to assure
  control is maintained
• Establish predetermined corrective actions to be
  taken if control is not maintained (including
  automated error handling)
• Establish verification procedures (event/alarm
  logs)
• Establish documentation procedures (maintaining
  e-records)

9
What are the phases of an automated process
validation?

• The installation qualification (IQ) is used to
  show that the equipment (including computer
  system) and ancillary systems have been properly
  installed.
• The operational qualification (OQ) demonstrates
  that the equipment (including computer system)
  and process (automated) will produce acceptable
  results. Process limits known as worst case
  operation parameters are determined.
• The performance qualification (PQ) is used to
  establish confidence that the process (including
  automation) is effective and reproducible, and
  can be characterized as stable.

10
Automated Processes

• Typical Automated Processes
• Automated material handling
• Automated assembly (robotic, PCB, welding, etc.)
• Environmental controls (HVAC)
• Automated sampling and acceptance testing (ATE,
  machine vision, etc.)
• Process monitoring (process controlling)
• Process monitoring and QC activities (not process
  controlling)

11
Significant Processes

• Identifying the significant automated processes
• Using information in risk analysis and risk
  management documentation
• Linking potential automated process failure modes
  to product failure mode and patient harm
• Process failure modes that could results in the
  most severe patient harm should be given elevated
  priority

12
Process
RI OCC X SEV X DET
OCC
Severity
Detection
13
Significant Processes

• Other Considerations
• Maturity of the automated process
• Computer system hardware and software changes
• Process interrupts
• Observations noted in facility walkthrough
• Complexity of process
• Difficulties in controlling process
• Manual adjustments
• Number of process variables, I/O count

14
Understanding the Automated Process

• For each significant process
• Identify the significant processing variables
• Identify the key processing variables
• DOE - Experimental data
• Multi variant analysis - Processing data
• Identify inputs and outputs
• Identify what is automated
• Key processing variables, computer hardware,
  software, and ancillary systems will be traced
  through the IQ, OQ, and PQ validation documents
  for the automated process

15
For Automated Device Manufacturing Processes

• Inspectional Considerations
• GMP-related computerized systems SHALL be
  validated. The depth and scope of validation
  depends on the size, complexity, and criticality
  of the computerized application.
• Appropriate installation and operational
  qualifications should demonstrate the suitability
  of computer hardware and software to perform
  assigned tasks.

16
For Automated Device Manufacturing Processes

• Inspectional Considerations
• Verification and validation activities for
  commercially available software are generally
  black box activities to ensure compliance with
  established user functional requirements and
  specifications.

17
Installation Qualification (IQ)

• Establishing confidence that automated process
  equipment and ancillary systems are capable of
  consistently operating within established limits
  and tolerances.
• NO PRODUCT IS PRODUCED

18
Installation Qualification (IQ)

• Two Steps
• Pre-installation (Step 1)
• Validation at the equipment vendor
• Information for installation
• Manufacturer and supplier provided installation
  instructions, operating and maintenance manuals,
  site requirements, part list etc.
• Computer system components are identified

19
Installation Qualification (IQ)

• Physical installation (Step 2)
• Serial/location tag numbers established and
  recorded, components installed, communication
  connections are made
• Verify computer system components (hardware and
  software) are installed correctly
• Manufacturer and suppliers recommendations are
  followed
• Documentation on how installed, who installed,
  and other information the computerized system
  components has been installed per manufacturers
  instructions

20
Installation Qualification (IQ)

• For each significant process
• Begin with the IQ review
• Verify process functional requirements and
  specifications have been established and
  incorporated into the computer system hardware
  and software functional requirements and
  specifications.
• Verify the documentation for configuration
  setups, programmed scripts, and custom
  programming.
• Verify the existence of programming standards or
  justification for a lack of programming
  standards.
• Documentation of software updates, approvals,
  etc., kept current

21
Installation Qualification (IQ)

• The IQ review contd
• Determine the calibration status of computer
  system input devices for significant process
  equipment
• Determine the status of computer system output
  devices for significant process equipment

22
Installation Qualification (IQ)

• The IQ review contd
• Physically inspect the processing facility
  equipment
• Identify IQ activities with a focus on computer
  system and ancillary devices
• Input sensor, PID software, Microcontroller, PLC
• Pick one or more computer system devices and
  verify that hardware and software for the given
  I/O device is documented in the IQ documentation.
  

23
Installation Qualification (IQ)

• The IQ review contd
• Computerized systems should have sufficient
  controls to prevent unauthorized access or
  changes.
• Program security
• Data security

24
Typical IQ Problem Areas

• Some or all I/O devices not identified
• Documents are not controlled
• Some software (program, configuration set up)
  versions not documented
• Incomplete listing of software programs
• Lack of system security verification
• Physical
• Logical

25
Typical IQ Problem Areas

• Process specifications do not match set-up values
  in computer hardware or software specification
  limits
• Data interface problems
• Significant figures
• Data transmission speed
• Memory overload
• Hardware/software compatibility problems
• Operating system, multi-tasking

26
OPERATIONAL and PERFORMANCE QUALIFICATION
27
Operational Qualification (OQ)

• Computer system is matured in IQ/OQ
• Computer system is a component of the automated
  process and does not operate in isolation
• Process development activities continue
• Setting process limits OR
• Verifying established limits
• PRODUCT IS PRODUCED

28
Performance Qualification (PQ)

• Establishing the process (including automation)
  is capable of consistently producing a product
  that meets predetermined specifications
• PRODUCT CONSISTENTLY MEETS PREDETERMINED
  SPECIFICATIONS

29
Performance Qualification (PQ)

• PQ test results
• Review in-process and finished product test data
  and yield consistency
• Review computerized system data
• Alarm and/or error logs
• Event logs

30
Typical PQ Problem Areas

• Failure to update memory variable
• Failure to include observed process
  specifications in software functional
  requirements and specifications
• Product acceptance specifications dont comply
  with DMR product specifications and/or the
  software functional requirements and
  specifications

31
Typical PQ Problem Areas

• Product acceptance issues
• Setting limits
• Statistical data processing
• Averaging data
• Removal of recurring outliers

32
Typical PQ Problem Areas

• Test products without DHR become product for
  distribution
• Failure to maintain electronic raw data when
  there is no hard copy of the required GMP
  document, such as device history record.

33
Review of Current Manufacturing Data

• From Device History Records and non-conforming
  data sources
• Review in-process and finished device acceptance
  test data
• Review computerized process data
• Alarm and/or Error logs
• Event logs
• Yield consistency
• Does this mirror the PQ test results?

34
REALITY

• GMP-Software used in automated computerized
  processes SHALL be validated.
• The depth and scope of validation SHOULD depend
  on the size, complexity, and criticality of the
  computerized application.

35
PROCESS VALIDATION

• If a computer system validation is deficient, the
  process validation will also be deficient.

36
QUESTIONS?