Software Validation for Equipment - Question

[PeterLe]

Our Quality group has identified a few pieces of equipment within our company that requires software validation. These pieces of equipment do have custom software. We also have an SME that is responsible for completion of these software validations.

I gave the SME the list of equipment that needs software validation and the SME comes back with the following responses for the equipment:

These equipment all have successful process validations on file, which means their operating software has been shown capable of meeting functional requirements. If current operating software is already in Doc Control, that addresses this item. If not in Doc Control, DCO current operating software now.

Equipment Qualification should demonstrate that the operating software is capable of meeting functional requirements. That should suffice to cover the software validation gap.

Basically he’s claiming since the equipment has gone through equipment qualification and/or process validation, that the equipment has met functional requirements thus not needing software validation.

I’ve looked at a couple of the equipment qualification protocols and nothing in the protocol explicitly states that software will be tested.

How should I approach this and especially what are your thoughts regarding his response? Thank you so much!

 

[Marcelo]

Re: Question Regarding Software Validation for Equipment

The response makes no sense regarding the requirement of software validation.

ISO 80002-2 Medical device software -- Part 2: Validation of software for medical device quality systems will be published in a while. It was created to help manufacturer fulfill the ISO 13485 software validation requirements.

It uses a risk-based approach to software validation.

 

[Ajit Basrur]

Re: Question Regarding Software Validation for Equipment

I agree with Marcelo.

In addition, refer to these documents:

General Principles of Software Validation; Final Guidance for Industry and FDA Staff

AAMI TIR-36: Validation of software for regulated process

 

[PeterLe]

Thank you for your responses!

Just to be clear on my understanding, if none of the process validation protocols or the equipment qualification protocols/reports explicitly tests the software, then my colleagues response doesn't hold correct?

On the other side, if the protocols/reports does state it will test the software then my colleague's response holds.

Again, many thanks for your responses!

 

[Ajit Basrur]

I would suggest you to go through the FDA Guidance Document to get a better understanding on the software validation. You mention that there is a custom software and thus the complexity increases.

There is GAMP 5 document that categorizes software into 4 categories - Category 1 for Infrastructure, Category 3 for Commercially Off the Shelf (COTS), Category 4 for Modified off the Shelf (MOTS), and category 5 for custom or bespoke systems.

The requirements for the custom software is intense and typically shall follow different stages namely,

User Requirements
Functional Requirements
Design
Construction or Coding
Testing by the Software Developer
User Site Testing

The Process Validation may be done as part of the user site testing. In addition, ensure procedures related to change control, or any other maintenance are in place.

 

[yodon]

Ajit (as he always does) hits the nail on the head. Software validation is more than just testing. It should consider the entire life cycle, including consideration of how to keep the software in a validated state when things are changing (the software itself, support software packages the SW uses, the OS on which it runs, the hardware on which it runs, ...)