For PLC Qualification to be compliant with FDA requirements; a chain of protocols and documentation must be established. In this chain of documentation the User Requirements specification (URS) is probably the single most important document to get "right". Since most documents, post the URS, will either fully, or partially, base their contents on the URS, it is essential that this document clearly, concisely and in a manner that is testable, specifies the exact requirements of the end user. It is also essential that these exact testable requirements remain attributable through the development of the Functional Specification (FS) and the Design Specification (DS) to the actual lines or groups of lines of code that enable them.
The Validation Master Plan (VMP), must be specific about this and all cGMP requirements, and instruct all personnel involved in the PLC Qualification processes program, of the importance of maintaining this traceability through the Installation Qualification (IQ) - Operational Qualification (OQ) - Performance Qualification (PQ).
Traceabilty of URS functionality, to lines of code is an essential element in PLC Qualification processes (CSV). Once this traceability is establish future maintenance and modification of software is made much simpler and more manageable.
The guide-lines laid out in Good Automated Manufacturing Practices (GAMP 5), for the PLC Qualification processes used in automated systems including automatic PLC validation processes for manufacturing equipment, control systems, automated laboratory systems, manufacturing execution systems and computers running laboratory database systems; are generalized and none specific. Such guidelines are a useful when it comes to scoping your PLC Qualification activities. However it must be remembered at all times that the 'GAMP' series of publications are all collective ideas garnered from around the industry and at times, does try to be all things; to all people.
These discrepancies can; at times, mean certain sections appear to contradict other sections. On a recent project, when a group was set up to extrapolate a validation Risk Assessment (VRA) document from within GAMP 5 deliberations, they found they could not agree and four weeks later; they were still divided. Unable to reconcile their company's requirements with the alternative strategies given in the GAMP series of publications. It bodes well to never forget that GAMP 5 is a guide from the end users point of view. The actual legal requirements come from the regulators, and obviously takes precedence. Validation Online's computer and PLC Qualification protocols start with the development of a detailed three layer URS and progress through the VMP - IQ - OQ - PQ. Each of these documents are interactive fully detailed and simple to use. Each are preceded with an SOP which guides the user through all phases of protocol generation completion.
The verification that the end users requirements as detailed in the URS have been fully satisfied, is paramount to the equipment being correctly qualified. Often this is hard to verify since the traceability from URS functionality to the actual hardware or software utilized is lost in the various specification designations that range from the functional specification to the design specification to code requirements. However unless the effort is made to maintain this traceability, computer validation processes is easily flawed and future maintenance and or modifications can become extremely problematic.
The Validation Master Plan - VMP, must be specific about this requirement and instruct all personnel involved in the qualification program, of the importance of maintaining this traceability.
This testing verifies the execution flow of software, including decision paths, inputs and outputs, It also involves creating test cases, test vectors, oracles, and executing the software against these tests known values. The results are then compared with these expected or known values for correct behavior of the software. Because the number of execution paths and conditions increases exponentially with the number of lines of code, testing for all possible execution traces and conditions for the software is impossible.
Code inspections and testing can reduce coding errors; however, experience has shown that the process needs to be complemented with various other methods. One such method is static analysis. This somewhat new method largely automates the software verification process. The technique attempts to identify errors in the code, but does not necessarily prove their absence. Static analysis is extensively used to identify potential and actual defects in source code.
A code verification solution that includes abstract interpretation can be instrumental in assuring software safety and a good quality process. It is a sound verification process that enables the achievement of high integrity in embedded devices. Regulatory bodies such as the pharmaceutical regulators.
There is no regulatory requirement to re-validate a process as long as that process operates in a state of GMP control and no changes have been made to the process or output product, the process does not have to be revalidated. Whether the process is operating in a state of control is determined by analyzing day-to-day process control data and any finished device testing data for conformance with specifications and for variability.
When equipment is moved to a new location, installation and operation should be re-qualified. By comparing data from the original installation and operation qualification (IQ and OQ,) and the re-qualification, the manufacturer can determine whether there have been any changes in equipment performance as a result of the move. Changes in equipment performance should be evaluated to determine whether it is necessary to revalidate the process.
Part 820.75 of the regulation requires that validated processes be monitored and controlled so that when changes or process deviations occur, a manufacturer will know to review and evaluate the process and perform revalidation when appropriate. 21 CFR 820.75(c ) requires you to have documented procedures in place for evaluating; when revalidation is required.
Recent research has highlighted that in the pharmaceutical and bio-medical industry, thirty two percent of all equipment procurement is unsatisfactory. The major problem has been identified as companies not specifying in sufficient detail and or accuracy, what their actual needs are. The lack of a fully detailed company approved User Requirements Specification (URS) , leads to many companies having to resort to otherwise un-necessary and costly retrospective actions in modifying the equipment or producing unspecified documentation or engineering drawings, post procurement. These extraneous GMP requirements often cost more than the equipment.
This Qualification, Risk & Requirements Plan (VrrP) is one document designed specifically to replace three. The contents of the three original documents were completely revised and edited into a more compact and interactive format. Resulting in the document becoming notably easier to use and quicker to review and amend. This new format will make a very significant difference to the man hours required to produce and execute these documents. There will also be a very noticeable reduction in the time required for the reviewing and approving tasks. This new document titled the VrrP replaces the VP, VRA & URS and now compliments our equally new 4Q Protocol, which integrates the DQ/IQ/OQ/PQ into one document. This is an essential step forward for companies seeking to reduce validation costs without sacrificing regulatory compliance.
This new 4Q Equipment Validation Protocol (4Q-Equip) has been designed specifically to replace four standard protocols. By taking the contents of the these four protocols and carefully weaving them into one notably easy to use protocol, we have made significant progress in reducing validation paperwork. Reductions of up to 75% have been quoted as the likely total. Integrating the old style DQ/IQ/OQ/PQ protocols into one 4Q document will be an enormous savings in man hours in the authoring, reviewing, updating and approving tasks. With the simultaneous introduction of the new Validation risk & Requirements Plan (VrrP) which integrates the VP, VRA & URS into one document - equipment validation has been reduced to two document.
This quite revolutionary two document package is all that is required to fully validate; to cGMP standards, equipment used in a regulated facility. A lot of effort has gone into ensuring that repetitive instructions and actions have been designed out and innovative and intuitive risk-based methodologies have been incorporated. Both documents are prefaced with a methods Standard Operating Practice (SOP) document. These SOP’s lead you through the task of converting these highly detailed templates into your very own company bespoke protocols. The hyperlinks and cross-references within the package are; not only unique, but also highly cost effective and intuitive to use. Each document is preloaded with the test scripts (complete with acceptance criteria). All test and inspection scripts are written in MS word, to facilitate simple editing of text, layout, tables and schematics.
This document was specifically designed to be compliant with the all of the FDA, EC and WHO legislation and guidance documentation and over 1700 have been used in submissions to regulatory authorities. This combined IQ/OQ/PQ protocol along with the appropriate interrelated plans and assessment documents will not only validate the item under qualification but it will also produce the thorough audit trail needed to meet all internal or external regulatory reviews and or inspections.