software validation in accredited laboratories a practical guide greg gogates fasor inc....

Software Validation in Accredited

Laboratories

A Practical Guide

Greg Gogates

Fasor Inc.

[email protected]

26 Sept 2001

A copy of this paper will be maintained on ftp.fasor.com/pub/iso25/validation/

26 Sept 2001 NCSL Presentation 2

Preamble ISO guide 25 “Adequate for Use” ISO 17025 “Suitably Validated” Validation - Reasonable Assurance Maintain Design Control Know what's where! Keep it Simple EA/GA(98)95 Draft “EA Guidelines for the use of

Computers and Computer Systems in Accredited Laboratories”


Software Classifications

COTS - Commercial Off the Shelf

MOTS - Modified Off the Shelf

CUSTOM - Written from scratch


COTS Use as delivered No modifications/customizations Verify functionality Verify menu contents Verify parameter files Lock down changes Installation checkout


MOTS

Needs configuration/customization prior

to use.

Customizations require validation.

Non-modified portion treated as COTS

Installation checkout.


CUSTOM

Home Brew or Consultant code

Functional Requirements

Software Design

Traceability Matrix

Structural / Functional Tests

Installation Checkout


Software Life Cycle

R equirem ents

D esign

C onstruction

Testing

C onfiguration m anagem ent

Insta lla tion/C heckout

TraceabiliityMatrix

Qu

alit

y S

yste

m


Products / Systems

Com puterSystem 1

Com puterSystem 2

Softw areProduct A

Softw areProduct C

Softw areProduct B


Software Configuration Management

What software is on what machine

Store originals on Network Share,

Tape, or CD-R

Maintain all published versions

Control Access

Ensure user access


Documentation Configuration Management

Evidence of validation

Evidence of adequate for use

Owners / User manuals

Software Lifecycle documents

Test Evidence


Good Practices - 1 Treat each software product a piece of

calibration equipment.

Do checks to ensure nothing changes.

Place software product masters in a

read only directory.

Network computers that access a

shared program on a server.


Good Practices - 2 Lock spreadsheet cells that contain math.

Password protect configuration files or setup

screens.

Backup, back-up, and backup off site!

Plan for hardware/software disaster recovery.

Good information maintained @

ftp://ftp.fasor.com/pub/iso25/validation


Software Checklist - 1

1. Has the Firmware been validated via the calibration by a cal lab who has the capability to thoroughly check the software (i.e. OEM or Authorized partner) (Note: for non-calibratable device Firmware, treat as Software)

2. Have all of the "used" firmware parameters been documented and confirmed that they are correct?

3. Does a Software Requirements document exist for the Software?

4. Does a Software Design document exist detailing either the full design or details of the configuration?

5. Does software testing documents exists describing completed, unique, test cases that exercise the design both +/- and confirms the requirements?

6. Is there a test log showing test failures and corresponding retests/dispositions?

7. Does evidence exist confirming correct software deployment at each target installation? [5.5.11]


Software Checklist - 2

8. Has configuration control been applied to all of their Software/Firmware to ensure that: [4.12.1.4]

a) The Software source code location is access controlled. [5.4.7.2.b]

b) Firmware/Software formulas & parameters are "locked" to prevent inadvertent changes. [5.5.12]

c) Equipment lists identify Software as a separate line item showing correct version and location. [5.5.5]

9. Does evidence exist showing that personnel involved in Custom Software development have adequate training?

10. Do Databases and spreadsheets include "audit trails" to not allow previously data to be obscured? [4.12.2.3]

11. Do adequate instructions exist for the operation & maintenance of the Software? [5.4.1]

12. Does the accuracy of the Firmware/Software meet or exceed the accuracy required by the test method? [5.5.2]


ConfirmPurchased

Product M eetsRequirements

Softw are Desired

ConfirmPurchased

Product M eetsRequirements

Define Design

W hat Type C U S TO M

M O TS

C O TS

Verify UserParameters

BuildCustomizations/

M odificationsBuild Code

DefineRequirements

Test Product

InstallProduct onto

System(s)

Val

idat

ion

S U M M A R Y


QUESTIONS?

http://www.sfgate.com/sf/zippy/

software validation in accredited laboratories a practical guide greg gogates fasor inc....

Documents