Abbott Chemistry Analyzer Warning Letter

Abbott 2/7/00 Alcyon Chemistry/ blood analyzer

This warning letter cites software issues many times. The full letter is available by using the link provided. Some excerpts are provided below:

2. Failure to establish and maintain procedures needed to correct and prevent the recurrence of nonconforming product and other quality problems [21 CFR 820. 100(a)(3)]. For example,

The Corrective and Preventive Action Procedure (DA-01 ADD Dallas Quality System Manual) fails to identify the procedures to be used for identifying and tracking software related complaints.

The practice of “closing” uncorrected software and/or instrument problem reports against one version of software and renumbering them for possible correction in a subsequent version of the software is not described in the CAPA procedures.

4.Failure to establish and maintain procedures that will verify the effectiveness of corrective and preventive action(s) taken [21 CFR 820.100(a)(4)]. For example,
There are numerous unresolved hardware and software reliability problems associated with the Alcyon Analyzer. Problems including known system lock-up and system reliability issues were identified prior to the release of software version 1.0 in April 1998. Some of these problems still exist and additional reliability problems have since been identified and remain uncorrected in the current software version 1.5. There are no plans to address these problems with the corrective actions to be implemented with software version 1.8, proposed for release in July 2000.

System Problem Reports identified under DAL _____ covered several lock-up problems and failed to provide sufficient information to determine if a software revision introduced a new lock-up problem or if the specific lock-up problem was in a pre-existing version of the software.

5.Failure to document all activities and results required for the corrective and preventive action system [21 CFR 820.100 (b)]. For example,
There is no assurance all complaints involving software defects are recorded in a software problem export. A System Problem Report was not generated for _____ ticket # _____ dated 5/15/99 involving AxSYM software error.
There is no assurance software problem reports are accurately associated the correct version of software. For example, in AxSYM SPR DAL _____ the field for affected version references version 3.04; however, the narrative in the detailed problem description references version 3.60.

6. Failure to establish and maintain procedures to ensure the design requirements relating to the Alcyon software are appropriate and address the intended use including user needs [21 CFR 820.30(c)]. Specifically, neither the ADD Software Development Requirements nor the Product Version Description Document (PVDD) for the Alcyon software version 1.5 make reference to any boundary condition(s) such as minimum, maximum or normal number of tests the Alcyon device is designed to perform within a given time period. Additionally, the PVDD for software version 1.7 contains no documentation showing that user needs have been addressed in the current software revision 1.5 or the next software version (1.8) as evidenced by over _____ open enhancement system problem reports.

Failure to establish and maintain procedures that verify and document that the design output conforms to design input requirements and that the design outputs were documented, reviewed and approved prior to release [21 CFR 820.30 (f)]. Specifically, The Verification and Validation Test Protocol #_____, used in the testing of software versions 1.6 and 1.7, did not define the number of repetitions to be used in the performance of the stress test, the boundary conditions for volume and load, and the criteria used to accept the test results.

The PVDD Version 1, Alcyon rev 1.5 showed over _____ open System Problem Reports (SPRS) at the time of its release in November 1998.

The PVDD, Version 2, Alcyon rev.1.0 for software version 1.7 showed open SPRS which had been identified as software problems during the testing of versions 1.0 through 1.5, e.g. DAL _____ and DAL _____

Failure to establish and maintain procedures for the documentation, verification, review and approval of design changes before their implementation [21 CFR 820.30(i)]. For example,

Engineering Change Process procedure No. DA-04, Rev. K, dated 6/28/99, used for post-production changes did not have provisions for addressing pre-production change control and risk analysis.

ECN _____ dated 10/1 2/99, Software version 1.5, which was under development, was used in design verification and validation when the protocol specified that version 1.02 was to be used. There was no documented protocol approval of this design change prior to its implementation.

Observations 1, 6: We are not convinced that the use of a simulator to run worst case scenarios will identify all the conditions contributing or leading to the system lock-ups. Use of a simulator requires the input of known conditions or variables and may not consider conditions that may exist in real time use. The use of a simulator alone is not a substitute for full and complete validation of the software. Please explain how you plan to handle unresolved hardware and software problems.

Observation 2: Although the SOP (Q04.02, ADD Software Development Process) may correct the problem, we remind you that is should incorporate the consideration of user needs which may or may not be completely identified through a review of the SPRS. Please explain if this procedure is to be implemented division-wide. If not, why? Please provide an explanation as to why it will require nearly 3 months to implement the SPR Review Procedure.

Finally, we acknowledge receipt of and concurrence with your company’s decision to recall the Alcyon 300/300i from the United States market place. However, we remain deeply concerned that these deviations may impact other devices made at the Irving, Texas facility and those Alcyon devices that will be marketed in foreign countries. We remind you of your commitment given to this agency on 12/22/99 not to distribute any of the Alcyon 300/3001 devices until the software problems have been corrected and FDA approval of software version 1.8, has been obtained.

About the author

Amy enjoys researching and writing about developments in medical technology and how that intersects with US law. She received her J.D. from the University of Florida Levin College of Law in 2020 and now works as a Regulatory Associate for SoftwareCPR®, a general-purpose regulatory consulting firm that is recognized globally for their expertise with standards and national regulations pertaining to medical device, mobile medical app, and HealthIT software.

SoftwareCPR Training Courses:

Being Agile & Yet Compliant (Public)

Our SoftwareCPR unique approach to incorporating agile and lean engineering to your medical device software process training course is now open for registration!

  • Agile principles that align well with medical
  • Backlog management
  • Agile risk management
  • Incremental and iterative software development lifecycle management
  •  Frequent release management
  • And more!

3 days virtual (Zoom) with group exercises, quizzes, examples, Q&A.

Lead Instructor: Mike Russell

Next public offering: Dec 3, 4, & 5, 2024 – 12:00 pm to 5:00 pm CET

Register Now


 

IEC 62304 and other emerging standards for Medical Device and HealthIT Software

Our flagship course for preparing regulatory, quality, engineering, operations, and others for the activities and documentation expected for IEC 62304 conformance and for FDA expectations. The goal is to educate on the intent and purpose so that the participants are able to make informed decisions in the future.  Focus is not simply what the standard says, but what is meant and discuss examples and approaches one might implement to comply.  Special deep discount pricing available to FDA attendees and other regulators.

3-days onsite with group exercises, quizzes, examples, Q&A.

Instructor: Brian Pate

Next public offering:  TBD

Call or email now to schedule a private, in-house class. The fall schedule is filling up!

Email training@softwarecpr.com to request a special pre-registration discount.  Limited number of pre-registration coupons.

Registration Link:

TBD

 


 

Medical Device Cybersecurity (Public or Private)

This course takes a deep dive into the US FDA expectations for cybersecurity activities in the product development process with central focus on the cybersecurity risk analysis process. Overall approach will be tied to relevant standards and FDA guidance documentation. The course will follow the ISO 14971:2019 framework for overall structure but utilize IEC 62304, IEC 81001-5-1, and AAMI TIR57 for specific details regarding cybersecurity planning, risk characterization, threat modeling, and control strategies.

2-days onsite with group exercises, quizzes, examples, Q&A.

Instructor: Dr Peter Rech, 2nd instructor (optional)

Next public offering:  TBD

Corporate Office

15148 Springview St.
Tampa, FL 33624
USA
+1-781-721-2921
Partners located in the US (CA, FL, MA, MN, TX) and Canada.