And now, let's add software development - Medical Devices - Applying ISO9001:2000

[Quality Queen]

Hi everyone! I'm hoping someone can help me to shed light on this situation.

Our company is currently registered to ISO13485:1996 and will (hopefully) soon begin our updating to the 2003 version. However, our company is also taking on a few new projects that include software development, which is something completely new for us.

I've found some guidance on applying ISO9001:2000 to software development which I suspect will help me greatly, however is there a separate standard for software or something specific about software and medical devices that I should be addressing?

Thanks in advance!

 

[Al Rosen]

Hi everyone! I'm hoping someone can help me to shed light on this situation.

Our company is currently registered to ISO13485:1996 and will (hopefully) soon begin our updating to the 2003 version. However, our company is also taking on a few new projects that include software development, which is something completely new for us.

I've found some guidance on applying ISO9001:2000 to software development which I suspect will help me greatly, however is there a separate standard for software or something specific about software and medical devices that I should be addressing?

Thanks in advance!

Quality Queen, look at IEC 60601-1-4, General requirements for safety - Collateral Standard: Programmable electrical medical systems

 

[Govind]

I've found some guidance on applying ISO9001:2000 to software development which I suspect will help me greatly, however is there a separate standard for software or something specific about software and medical devices that I should be addressing?
Thanks in advance!

QQ,
The guidelines for applying ISO9001:2000 to software development is
ISO90003:2004. This standard links to various ISO/IEC standards in Software Quality Engineering. Example 12207, 15271,15288 IEEE standards 1059 etc.

As suggested by Al Rosen, IEC 60601-1-4, General requirements for safety - Collateral Standard: Programmable electrical medical systems
and some more:
ANSI/AAMI/ISO 14971-Risk Management - Part 1: Application of Risk Management
ANSI/AAMI SW68-Medical device software - Software life cycle processes
ANSI/AAMI HE74-2001-Human Factors Design Process for Medical Devices
and other related standards.

Iam not from the medical devices field. You may want get more feedback from other members on the application of these Medical device software standards.

Govind.

 

[Quality Queen]

Thanks! That gives me an excellent head start

 

[rgijzels]

QQ,

I suggest that you obtain the TickIT Guide at www.tickit.org. The TickIT Guide interprets ISO 9000 as it applies to software.

Another way to go is GAMP (Good Autmated Manufacturing Practices). It's based on best practices in the software industry and recommended by FDA.

https://www.labcompliance.com/regulations/gamp.htm
https://www.ispe.org/gamp/
(broken link removed)

Good luck!

Gijs

 

[wrodnigg]

QQ,
Another way to go is GAMP (Good Autmated Manufacturing Practices). It's based on best practices in the software industry and recommended by FDA.

This is not quite correct.

The scope of the GAMP Guide is the Validation of Automated Systems.

And automated systems are defined as

Abroad range of systems, including automated manufacturing equipment, control systems, automated laboratory systems, manufacturing execution systems and computers running laboratory or manufacturing database systems. The automated system consists of the hardware, software and network components, together with the controlled functions and associated documentation.

The Guide provides a general approach suitable for all types of automated systems.

Therefore the GAMP Guide is primarily written for automated production equipment.

To my opinion one should consider that fact. And one shall not use the GAMP Guide 1by1 for software developing projects. It can give the direction, but is was designed for manufacturing equipment, not for software development.

For a Software Company a good start is the already mentioned ISO 90003:2004. And there is the (broken link removed).
And especially for medical device software, one should read the SW68 Guide.

And finally a new standard for Medical Device Software Risk Management "AAMI/TIR XX:200X" (SWN004) is in draft status right now.

The central element is the software development model, which shall support the whole lifecycle. Which belief one follows is not as important as to know that one follows a belief (and to implement the necessary elements (traceabilty) in the development model).

Many books have been written on software development, and we cold discuss this topic for years...

Important is, that there is a development process, and this process is documented with fixed phases and milestones... And one should not try to follow too many standards the same time, becaus then you get lost in details...

 

[rgijzels]

Yes ... the scope of GAMP is validation of automated systems. To be more specific ... the Guide draws together key principles and practices and describes how they can be applied to determine the extent and scope of validation for different types of automated systems. However, no automated system without software ... Therefore, GAMP distinguishes 5 different Software Gategories:
1. Operating Systems
2. Standard Instruments, Micro-controllers, Smart Instrumentation
3. Standard Software Packages
4. Configurable Software Packages
5. Custom Built or Bespoke Systems

For each software category, GAMP suggests a software development life cycle process based on best practices in the software industry.

Furthermore, the FDA recommends GAMP in their CSV Guide (broken link removed) :

"Although the GAMP document has been written specifically with manufacturing systems in mind it is recommended as a general reference as the principles contained within it are general and can be applied to the validation of systems of all types"

 

[Al Rosen]

Furthermore, the FDA recommends GAMP in their CSV Guide (broken link removed) :

"Although the GAMP document has been written specifically with manufacturing systems in mind it is recommended as a general reference as the principles contained within it are general and can be applied to the validation of systems of all types"

That is not the government FDA site. Notice the .com in the address denoting a commercial site. The FDA site is https://www.FDA.gov. I've attached the FDA's guidance on software validation that wrodnigg had linked to.

 

[rgijzels]

You are absolutely right ... fda.com is not fda.org ... but the statement still holds. I'm only giving advice based on more than 10 years experience within a global company dealing with the FDA on a regularly basis. And I can tell you this ... the FDA fully supports the GAMP effort and references to GAMP in many of their publications on fda.gov.

By the way ... if you scroll back, you will see that I also linked that FDA guidance document. In my opinion, that should be your first reading ... if you are a newbie to md software validation.

 

[rgijzels]

fda.com is not fda.gov