1. Software Validation in Accredited Laboratories A Practical Guide Greg Gogates Fasor Inc. gdg@fasor.com 26 Sept 2001 A copy of this paper will be maintained on ftp.fasor.com/pub/iso25/validation/

2. 26 Sept 2001NCSL Presentation2 Preamble l ISO guide 25 “Adequate for Use” l ISO 17025 “Suitably Validated” l Validation - Reasonable Assurance l Maintain Design Control l Know what's where! l Keep it Simple l EA/GA(98)95 Draft “EA Guidelines for the use of Computers and Computer Systems in Accredited Laboratories”

3. 26 Sept 2001NCSL Presentation3 Software Classifications l COTS - Commercial Off the Shelf l MOTS - Modified Off the Shelf l CUSTOM - Written from scratch

4. 26 Sept 2001NCSL Presentation4 COTS l Use as delivered l No modifications/customizations l Verify functionality l Verify menu contents l Verify parameter files l Lock down changes l Installation checkout

5. 26 Sept 2001NCSL Presentation5 MOTS l Needs configuration/customization prior to use. l Customizations require validation. l Non-modified portion treated as COTS l Installation checkout.

6. 26 Sept 2001NCSL Presentation6 CUSTOM l Home Brew or Consultant code l Functional Requirements l Software Design l Traceability Matrix l Structural / Functional Tests l Installation Checkout

7. 26 Sept 2001NCSL Presentation7 Software Life Cycle

8. 26 Sept 2001NCSL Presentation8 Products / Systems

9. 26 Sept 2001NCSL Presentation9 Software Configuration Management l What software is on what machine l Store originals on Network Share, Tape, or CD-R l Maintain all published versions l Control Access l Ensure user access

10. 26 Sept 2001NCSL Presentation10 Documentation Configuration Management l Evidence of validation l Evidence of adequate for use l Owners / User manuals l Software Lifecycle documents l Test Evidence

11. 26 Sept 2001NCSL Presentation11 Good Practices - 1  Treat each software product a piece of calibration equipment.  Do checks to ensure nothing changes.  Place software product masters in a read only directory.  Network computers that access a shared program on a server.

12. 26 Sept 2001NCSL Presentation12 Good Practices - 2  Lock spreadsheet cells that contain math.  Password protect configuration files or setup screens.  Backup, back-up, and backup off site!  Plan for hardware/software disaster recovery.  Good information maintained @ ftp://ftp.fasor.com/pub/iso25/validation

13. 26 Sept 2001NCSL Presentation13 Software Checklist - 1 1.Has the Firmware been validated via the calibration by a cal lab who has the capability to thoroughly check the software (i.e. OEM or Authorized partner) (Note: for non-calibratable device Firmware, treat as Software) 2.Have all of the "used" firmware parameters been documented and confirmed that they are correct? 3.Does a Software Requirements document exist for the Software? 4.Does a Software Design document exist detailing either the full design or details of the configuration? 5.Does software testing documents exists describing completed, unique, test cases that exercise the design both +/- and confirms the requirements? 6.Is there a test log showing test failures and corresponding retests/dispositions? 7.Does evidence exist confirming correct software deployment at each target installation? [5.5.11]

14. 26 Sept 2001NCSL Presentation14 Software Checklist - 2 8.Has configuration control been applied to all of their Software/Firmware to ensure that: [4.12.1.4] a)The Software source code location is access controlled. [5.4.7.2.b] b)Firmware/Software formulas & parameters are "locked" to prevent inadvertent changes. [5.5.12] c)Equipment lists identify Software as a separate line item showing correct version and location. [5.5.5] 9.Does evidence exist showing that personnel involved in Custom Software development have adequate training? 10.Do Databases and spreadsheets include "audit trails" to not allow previously data to be obscured? [4.12.2.3] 11.Do adequate instructions exist for the operation & maintenance of the Software? [5.4.1] 12.Does the accuracy of the Firmware/Software meet or exceed the accuracy required by the test method? [5.5.2]

15. 26 Sept 2001NCSL Presentation15 S U M A R Y

16. 26 Sept 2001NCSL Presentation16 QUESTIONS? http://www.sfgate.com/sf/zippy/