Another Warning Letter … and we still miss software validation

Glanced through the latest FDA warning letters today.  From the FDA Medical Device & Radiological Health Operations West/Division 3 I see the inspector pointing out “This design validation also fails to include software validation [emphasis mine] to assure software will perform as intended and will not prevent safe operation by the user.”   Of course this is straight from the regs – 21CFR820.30(g). Absolutely one must consider the safe and effective operation of the software when making an argument for design validation.  For those of us familiar with software development, we are always skeptical our software will perform as expected under all operating conditions.

So what does FDA expect with regard to software validation?  A common misconception is that software validation is a very comprehensive test that is executed once the final version of software is created. While a comprehensive test is helpful, testing alone is insufficient to give confidence that software is performing according to all specs, meets the users’ expectations, and that defects will not lead to hazardous situations. FDA guidance recommends, and fully expects, an entire software development lifecycle approach to software quality.  Safe and effective software, at a minimum, should include:

  • designed-in risk control measures
  • other operating self checks of hardware and software

Additionally, the software should be developed under appropriate and sufficient process controls throughout the entire lifecycle.  IEC 62304 is an FDA recognized standard for software development process and IEC 80002-1 contains many excellent best practices for medical device software. These two standards are definitely a good start for ensuring the software development lifecycle process being used is state-of-the-art.

Beyond FDA expectations or requirements under ISO standards, each company should develop their own quality standards – remember published standards like IEC 62304 are meant to be the “bar” which in reality is a minimum.  Our goal as software professionals is to create defect-free designs. Go beyond the bar.  Focus on “real” quality – develop appropriate metrics so that it is clear where the process works well and where it is not working well.  As one professional stated, “Own it. Take responsibility for software errors and make the changes necessary to prevent inserting others.

About the author

Brian Pate helps medical device companies achieve efficient and FDA regulatory compliant product development to produce higher quality and clinically valued software. He began his career in clinical research in 1985 with the Department of Anesthesiology at UAB developing closed-loop control systems for the automated delivery of gases and control. In 1990, he made the switch from university research to the medical device industry designing control systems, communication interfaces, user interface, and other software for real-time embedded systems and clinical information systems, working for medical device companies including Johnson & Johnson, Baxter Healthcare, and GE Medical. Today, he is a Partner and the General Manager of Crisis Prevention and Recovery LLC (dba SoftwareCPR®), a general-purpose regulatory consulting firm that is recognized globally for their expertise with standards and national regulations pertaining to medical device, mobile medical app, and HealthIT software. He has taught the AAMI/FDA course on Software Regulation to FDA Reviewers at FDA and is currently the lead faculty for the public version of that course taught annually along with FDA staff. Brian served on the AAMI/FDA TIR working group that created AAMI TIR32 Guidance on the application of ISO 14971 to Software (later superseded by IEC 80002-1). He later served on the original AAMI/FDA working group that created the AAMI TIR45-2012 TIR Guidance on the use of Agile practices in the development of medical device software and is currently the co-chair leading the creation of the 2nd edition of TIR45. He has served as faculty for all offerings of the AAMI/FDA Compliant Use of Agile Methods public course. Brian also served as an instructor for the AAMI Design Controls course. He is also a member of the Underwriters’ Laboratories Standards Technical Panel 5500, Remote Software Updates. He now serves as a member of the AAMI Software Committee.

Cybersecurity Review

Our cybersecurity experts are NESSUS Pro Licensed and can quickly remediate cybersecurity deficiencies with your medical device or digital health software.  Planning, requirements, validation, and submissions – we can assist with all.

Interested in having a conversation?  Email us to arrange a Zoom meeting or call us at +1 781-721-2921.

Corporate Office

15148 Springview St
Tampa, FL 33624
Partners located in the US (CA, FL, MA, MN), Canada, and Italy.