Industrial Internet of Things Appliance
FDA Guidances
• Software Validation, 820.70(i)
Section 820.70 pertains to Production and Process Controls: "Develop, conduct, control, and monitor production
processes to ensure devices conform to specifications." [page 56]
Subpart (i) refers to Automated Processes in particular. "When computers or automated data processing systems are used as part of production or the quality system, the manufacturer shall validate computer software for its intended use according to an established protocol. All software changes shall be validated before approval and issuance. These validation activities and results shall be documented."
If you choose to use a computer in any of your manufacturing processes, the FDA requires software validation: "Any software used to automate any part of the device production process or any part of the quality system must be validated for its intended use, as required by 21 CFR §820.70(i). This requirement applies to any software used to automate device design, testing, component acceptance, manufacturing, labeling, packaging, distribution, complaint handling, or to automate any other aspect of the quality system." [page 3]
• Verification vs. Validation
These two terms are sometimes used interchangeably; however, the FDA considers them two separate issues.
Software verification is specified requirements needed to build the device correctly.
Whereas software validation is about intended use.
"Software validation is a matter of developing a 'level of confidence' that the device meets all requirements and
user expectations for the software automated functions and features of the device."
Read more here on page 6.
• Examples of plant floor controls that require FDA software validation include [page 30]:
- Programmable logic controllers (PCs)
- digital function controllers
- statistical process control
- supervisory control and data acquisition (SCADA)
- robotics
- human-machine interfaces (HMIs)
- input/output devices
- computer operating systems
• Software updates, upgrades, and changes require FDA software validation.
"When software is upgraded or any changes are made to the software, the device manufacturer should
consider how those changes may impact the 'used portions' of the software and must reconfirm the
validation of those portions of the software that are used. (See 21 CFR §820.70(i).)"
• Key to FDA software validation is documenting 1) the intended use and 2) the dependence on the software.
• The device manufacturer is ultimately responsible for all FDA software validation.
• An MES gateway appliance with closed architecture is considered an off-the-shelf, black-box solution to the FDA.
It eliminates the need for FDA software validation and PLC software validation along with its weeks of personnel hours but still complies with FDA regulations surrounding 21 CFR 820.70(i) for production line data exchange.
• cGxP: Set of regulations that manufacturers must meet in order to stay compliant. It is a set of guidelines to ensure the safety of products or services.
The "c" stands for current. "G" means good. The "x" symbolizes the industry that's being regulated. "P" denotes practice.
The focus of cGxP is meticulous documentation.
There are three categories cGMP, cGCP, and cGLP
• cGMP: Current Good Manufacturing Practice:
- Learn what regulations are enforced by the FDA.
- Why CGMPs are important.
- How the FDA determines if a manufacturer is complying with CGMP regulations.
- The FDA's expectations on complying with these regulations.
• cGCP: Current Good Clinical Practice
Read more about the general validation principles that the FDA considers applicable to the validation of medical device software.
• cGLP: Current Good Laboratory Practice
cGLP refers to process validation. If you would like to learn more about the general principles and practices, click here.