Transcription
White PaperSoftware Development for Medical DevicesOvercoming the Challenges of Compliance, Qualit y and CostSoftware is fast becoming the differentiator for manufacturers ofmedical devices. The rewards of software innovation are balanced bythe risks and challenges of regulation, stringent quality requirements,market pressures, and significant complexity. Balancing thesecompeting interests requires tailored application lifecycle managementtools that address the unique needs of medical devices companies.Page 1 of 9 Software Development for Medical DevicesPTC.com
White PaperSoftware can serve as a source of innovation and akey differentiator for medical devices, especially giventhe adaptability of software and the speed at whichsoftware changes can be prototyped and implemented.Software is also becoming more voluminous andcomplex, which creates significant risk.To further complicate matters, software componentsused in medical devices fall under regulatory scrutiny.Two prominent regulatory bodies include the FDA formedical device products marketed in the U.S., and theEuropean Medical Device Directive for medical deviceproducts marketed in the European Union.Food and Drug Administration (FDA):21 CFR Part 11 & Part 820The U.S. Code of Federal Regulations (CFR), including21 CFR Part 11, Electronic Records and ElectronicSignatures and 21 CFR Part 820 Quality System (QS)Regulations (as well as ISO 13485 specifications)defines a number of practices and processes whichmust apply to the development of software that actsas a component of a medical device or is used to aid inthe production or manufacturing of a device.European Medical Device Directive (MDD): 93/42/EECThe Medical Device Directive (MDD) is a harmonisedEuropean standard which protects against the risksassociated with the design, manufacturing andpackaging of medical devices. Compliance with therequirements of the Medical Devices Directive isdeclared by placing the CE marking on the product,and supplying the device with a Declaration of Conformity. Conformity requires a series of assessmentsand examinations of the quality system and examination of the product type and design dossier relatingto the product.In addition to market-specific regulatory requirementssuch as the FDA 21 CFR 820 and the European UnionMedical Device Directive, ISO 13485 provides an overarching ISO standard for quality management systems;Page 2 of 9 Software Development for Medical DevicesMedical Devices Defined“Any instrument, appliance, material , includingthe software necessary for its proper application,intended by the manufacturer to be used for humanbeings for the purpose of diagnosis, prevention,monitoring, treatment or alleviation of disease “ISO 13485, Quality systems – Medical devices:Particular requirements for the application of ISO 9001Medical Device Software Software used as a component of a medical device Software that is a medical device Software used in the production of a device Software used to manufacture a device Software used in the implementation ofthe quality systemGeneral Principles of Software Validation;Final Guidance for Industry and FDA Staff, Jan 2002.Likewise, ISO 14971 focuses on risk managementsystems. Implementing each of these ISO standardsand attaining certification can help uncover greaterglobal market opportunities and make it easier tosatisfy the market-specific regulatory requirements.Regulatory pressures and increasing complexity –coupled with the increasing globalization of the market – creates an environment in which quality, reliability and safety compete with the business needs toreduce time-to-market and increase product development efficiency.This paper reviews some of the key challenges facingthe medical device industry and examines the rolethat a comprehensive and coherent Global SoftwareDevelopment platform – which manages all assets andprocesses in software-containing product development– can play in meeting these challenges.PTC.com
White PaperTop Software Challenges in theMedical Device IndustryCompliance Management of Documentation and RecordsDevice and Software Quality Growing Volume of Software and Product Variantsputs Quality at Risk Cost and Consequences of Recalls Identification and TraceabilityCycle Time and Cost Document Controls and Change Management Increasing Market Demand and Competition Managing Risk and Reducing Recalls Coordination Across Groups (Internal and Suppliers)ComplianceChallengeGlobal Software Development SolutionBenefitsManagement of Documentationand Records All documents can be stored and versioned withappropriate access controls Reduce effort to create DHFfrom weeks to minutes Automatically generates design history file DHFreportsIdentification and Traceability Unique identification of each document and asset Significant time savings Named trace relationships between all assetsDocument Controls andChange ManagementManaging Risk andReducing Recalls Automated workflow for effective processenforcement Automated and enforcedprocesses Powerful change control automatically documents allallowed changes Full change history withoutoverhead Simplified electronic tracking of requirements, risksand mitigations with relationships and dependencies Reduced risk Automatically compute Risk Priority Number (RPN) Automated support for V-Model with named relationshipsbetween requirements, design, and software assets andtheir associated verification and validation assetsPage 3 of 9 Software Development for Medical Devices Improve productivity whilemaintaining complianceand managing riskPTC.com
White PaperManagement of Documentation and RecordsIdentification and TraceabilityKey Challenge: Massive volume of documentation isdifficult to manage and reduces team productivity.Key Challenge: Creating and maintaining tracerelationships between records is arduous andtime consuming.Solution Summary: Consolidate storage of all documentation in a system that supports electronic signatures.Throughout the product lifecycle, a significant amountof documentation and records is required by bothmanufacturer and regulator in order to demonstratethorough design controls, document controls andaudit history. In the design and development phase,regulatory requirements such as CFR 820 SubpartC titled “Design Controls” specifies that a “manufacturer shall establish and maintain procedures toensure that the design requirements relating to adevice are appropriate and address the intended useof the device.” the European Medical Device Directiveprovides similar guidance that “the application mustdescribe the design, manufacture and performancesof the product in question ” Further advice is alsoprovided by both regulatory bodies on steps to betaken for reviewing, verifying and validating designs.The FDA specifies the retention of a design history file(DHF) to record all design change history, while theMDD specifies a similar technical file package todocument testing data, risk analysis, requirementsand cross-reference with any change documentation.These detailed records, requirements specificationsand design documents are commonly maintainedthrough the use of Microsoft Office tools or some formof issue tracking tool, in order to prioritize and managechange records. This approach makes it difficult tokeep all of this disparate data accurately synchronized.Collaboration by email or sharing documents onnetwork drives is also inefficient, often resulting ininconsistencies or untimely communication.To solve these challenges requires consolidation ofkey product documentation in one coherent GlobalSoftware Development platform, with change controlover all assets. In addition, the platform that storesthese documents and records needs to auditablycapture asset history. Finally, the storage of electronicsignatures on records or changes is often required byregulatory bodies (e.g., US Federal 21CFR Part 11).Page 4 of 9 Software Development for Medical DevicesSolution Summary: Simple, automated trace management and reporting.In addition to the storage of documentation and records,the identification and traceability of relationshipsbetween those artifacts is also important. Traceabilityensures that individual assets such as requirements,design specifications or software code can be tracedthrough the entire product development lifecycle –including connection to any needed corrective orpreventive action that might arise). Achieving thistraceability can be overwhelming to manage manuallyeven for a single medical device; it can result in tracesacross hundreds of documents. Managing these tracesacross disparate toolsets and repositories can requireperson-weeks of effort and can result in human erroror omissions.To minimize the overhead in this process, capturingall assets in a coherent Global Software Development platform permits automation that ensuresthat each document – as well as the individual elements of a document or software component – hasa system-generated unique identifier. As users thendecompose requirements into more detailed technical requirements, specifications and software components, they can establish trace relationships usingthese unique identifiers.Automated trace reporting from within a single GlobalSoftware Development platform can also aid in theidentification of missing traces and highlight areasof concern. This ability also means that traceabilitymatrices from the product documentation set can begenerated with mouse-clicks instead of taking weeks.PTC.com
White PaperDocument Controls and Change ManagementManaging Risk Exposure and Reducing RecallsKey Challenge: Cost-effective change managementand capture of change history.Key Challenge: Tracking risk with associated preventiveand corrective actions is a large burden, especially iftracking is manual.Solution Summary: One coherent platform with automated change control and workflow support.With any product lifecycle, change is inevitable. Ina highly regulated environment, it is critical that allaspects of change are documented and auditablycaptured. To effectively track changes, it is importantto have a method of tracing the change to the specificaffected requirement. This traceability is best served byrequirements documented in a shared repository, withclear identifiers that distinguish between requirements.A requirements change process can be similar to acoding change or defect tracking process. You firstneed to describe the change and the scope, and thenthe change needs to follow a defined process thatinvolves review and authorization. Change recordsshould be reviewed by a change review board orproject team that has the necessary skills to evaluatethe importance of the change and the cost or impactof implementing it.As change is implemented, it is critical to auditablyidentify which change occurred, both within thedocumentation and within the software. A coherentGlobal Software Development platform addressesthis need by providing process and workflow controlsthat support the recording, prioritization and reviewof change records, with complete traceability to thedocumentation and affected software artifacts. Thesechange records can then be reported on and automatically included in history files and change reports tosatisfy regulatory reporting requirements.Page 5 of 9 Software Development for Medical DevicesSolution Summary: Automated failure modes and effectanalysis (FMEA) support integrated with change management.Product defects are less expensive to fix if they’refound early in the development process. In the medicaldevices market, product recalls can impact not onlyproduct profitability, but can also affect the overallcorporate brand. To mitigate this risk, organizationsmust implement best practices that identify preventivemeasures and take corrective action. This need placesan additional burden on traceability.Preventive action is the practice of determining potentialproduct faults and taking proactive measures to reducethe likelihood of occurrence. FMEA is one approach toimplementing support for preventive action. FMEAprovides an analytical approach to potential failuremodes and their associated causes. When consideringpossible failures in a design – which can impact safety,cost, performance, quality and reliability – an engineercan get much information about how to alter the development/manufacturing process, to avoid these failures.FMEA provides an effective tool to determine whichelement presents the greatest risk based on priority orseverity, and therefore which action is needed to preventa problem before it arises. An adaptable data model istherefore required to be able to effectively capture theserisks, prioritize them and trace them to their preventiveor corrective action. The same model must containevidence demonstrating that the risk has been mitigated.Corrective action is required to respond to a varietyof real-world events and conditions, including nonconformance, and audit issues, as well as customer- orpatient-reported complaints. When a complaint orother issue is captured, it should automatically triggeran appropriate workflow to communicate that concernto reviewers who are responsible for taking furtheraction. This capability needs to be tightly integratedwith the change management process and is bestaddressed by managing all the assets and activities in asingle Global Software Development platform.PTC.com
White PaperDevice and Software QualityChallengeGlobal Software Development SolutionBenefitsGrowing Volume of Softwareand Product Variants putsQuality at Risk Reuse of key engineering assets, includingrequirements, code and test cases Ability to perform impactanalysis Tracability links across projects and products tomeasure the true cost of defects and change requests Measure the costs of defectsand ensure resolution acrossthe entire product line Traceability to corrective action and preventive action Minimize the recurrence ofdefectsCost and Consequences ofRecalls Impact analysis capabilities to identify impact acrossthe entire product lineGrowing Volume of Software and ProductVariants Puts Quality at RiskKey Challenge: Dealing with the complexity ofsoftware products and product lines.Solution Summary: Reuse capabilities and traceabilityprovide greater understanding of complex softwareproducts and the dependencies or impact of changeacross the product line, leading to better quality andless rework/error.The introduction of more advanced medical devicetechnology such as products with additional monitoringtechnology means that the volume of software as anoverall component of medical devices is increasing.The introduction of software into the medical devicesindustry creates added complexity. Design documentation and change management practices are notlimited to hardware components. The challenge withsoftware is its inherent propensity to be reused. Asreusable software modules or components are developed for so-called “utility functions,” the cost of tracking where that software is used increases. This reuseand increased complexity can be difficult to manage,if done so poorly, the quality and reliability of thesoftware are jeopardized.Page 6 of 9 Software Development for Medical Devices More quickly identify theoverall impact and costof compliance or adverseeventsSoftware Product Lines and variant managementbecome key concepts to support the complexity ofmultiproduct-line software development. The benefitto an organization in formally adopting a softwareproduct lines methodology is in the economies ofscale, for the reuse of requirements, design specsand source code. However, these reuse practices alsorequire sophisticated practices and processes formanaging reuse and for dealing with software defectsacross the product lines. Change management anddefect management processes need to support thecategorization by product line for accurate measurement of the true cost of change and complaints.Using a Global Software Development platform tomanage software development and documentation formedical devices is the ideal path for companies thatwant to leverage the software product lines approach.Greater reuse and modularization of software lead togreater efficiency, shorter cycle times and moreconsistent software quality.PTC.com
White PaperCost and Consequences of RecallsKey Challenge: Timely assessment of nonconformityto assess impact and resolution and to protect brand.Solution Summary: Impact analysis capabilities arecritical to identifying the overall impact of nonconformity, the true cost and scope of an issue, and theissues root cause.How well a company manages regulatory non-conformity matters can have a significant effect on the futuresuccess of the product, the extent of the company’sliability (or financial loss) in the event of significant problems, and the value of a company’s brand and reputation.To reach a recall decision, careful analysis and evaluation of adverse-event reports and identification ofspecific products or product lots are required. Impactanalysis capabilities are essential to truly identify therevisions of software that may be affected by a defectand to understand the extent of that defect. Traceabilityis another key factor in being able to demonstratethat the necessary Corrective and Preventive Action(CAPA) plan has been put in place and that the necessary root-cause analysis has been conducted.A company’s success in interacting with regulatorsand communicating with health-care professionals,the media, and its own employees can have a majorimpact on future perceptions of the company as wellas possible liability. It is also important to determinewhether a device failure occurred and to identify andcorrect its cause in order to get that product backon the market after a recall, to recoup the productinvestment to date.If all product documentation and software are storedin a comprehensive and coherent Global SoftwareDevelopment platform, not only is it less likely that nonconformity observations/citations will be issued (sinceregulatory reporting has been consistent and accurate),but the time and effort required to respond to nonconformity are drastically reduced. This translates intomore rapid and more accurate responses, which canmitigate the potential risk and damage of nonconformity.Cycle Time and CostChallengeGlobal Software Development SolutionBenefitsIncreasing Market Demandand Competition Process improvement Simplify areas of process;encourage lean andagile practices whereappropriate Streamlined process Electronic signature and approvals process Automated compliance reportingCoordination Across Groups(Internal and Suppliers) Automate compliancereporting as a byproductof the process Geographically distributed development andcommunication Improved internalcommunication Capability to import and export the data forseamless interchange Improved externalcommunication Process automation and enforcementPage 7 of 9 Software Development for Medical DevicesPTC.com
White PaperIncreasing Market Demand and CompetitionKey Challenge: Launching innovative products andremaining competitive in a global market.Solution Summary: Automation of processes tostreamline the amount of time required to attainpremarket approval and deliver product to market.For medical device companies, there is a constant needto balance agility with compliance and quality. Largercompanies can be at a competitive disadvantage asmore of smallerniche players are introduced into themarket. Innovation must be encouraged regardlessof company size, but not at the cost of compliance andquality issues that could hinder brand credibility.Annual growth in the medical device industries is estimated at six percent annually with market demand rising.Medical device companies are particularly interestedin learning how to automate the internal approvals ofpremarket approval paperwork and ensure that regulatory submissions are timely and thorough enoughto pass the stringent quality regulations in place.Management of software and documentation in acoherent Global Software Development platformmeans that internal processes will not bottleneck withthese agencies – thereby preserving the time-to-marketfor new and updated medical device products. This isequally important for smaller organizations bringingtheir first device to market and larger firms withmultiple product lines.Coordination Across Groups(Internal and Suppliers)Key Challenge: Leveraging a global network ofresources and suppliers.Solution Summary: Collaboration capabilities thatprovide realtime notification across disparate,geographically distributed teams and capabilitiesfor importing/exporting data for suppliers.Many parties are involved in the development, launchand maintenance of innovative medical device products.Large medical devices companies may structurethemselves internally to take advantage of geographically distributed resources, maximizing the amount ofdevelopment that occurs over a 24-hour period. Additionally, communication with suppliers is continuousto ensure supply chain dependencies are understood.Support for geographically distributed teams mustinclude effective communication and traceabilityacross geographical and cultural boundaries. Thisensures that common processes are followed and thattraceability and compliance documentation can easilybe generated regardless of who may be involved in theengineering process.Communication with external suppliers should besimplified through emerging technology standardssuch as Requirements Interchange Format (RIF) toallow requirements documents and specifications tobe seamlessly shared between suppliers and OEMs.Although these standards evolved out of the automotiveindustry, by adopting XML they made it possible for adiversity of product companies to produce documentation that is more easily shared – reducing turnaroundtimes for change requests and defects.Any solution deployed to manage requirements,documentation, source code and other assets acrossa distributed development organization must enableaccurate and consistent collaboration among disparatestakeholders. The ideal solution is a Global SoftwareDevelopment platform that has the adaptability toaddress the functional and technology requirements ofthose disparate stakeholders, while seamlessly scalingacross the enterprise.Page 8 of 9 Software Development for Medical DevicesPTC.com
White PaperConclusionPTC Integrity Business Unit LocationsGiven that software represents the great opportunityfor innovation and competitiveness as well as a greatchallenge in terms of risk, complexity and regulation,medical device organizations must take controlof their software development with appropriatetechnology solutions.North America1 800 613 7535The reality is that the complexity and rate of change forembedded software are rapidly outpacing the abilityof organizations to address these issues with manualprocesses and disconnected point tools. The only way tomitigate risk while “priming” the organization for continuous innovation is through the consolidation of all software assets and activities into a single, unified solution.Only with such a solution will medical device organizations get the end-to-end traceability that is needed forsuccess, while avoiding the problems, errors and delaysthat are generated by “best-of-breed” solutions.United Kingdom 44 (0) 1252 453 400Germany 49 (0) 711 3517 750Asia Pacific 65 6830 8338Japan 81 3 5422 9503For more information visit: PTC.com/product/integrity.NOTE: The timing of any product release, including any features or functionality,is subject to change at PTC’s discretion. 2012, PTC. All rights reserved. Information described herein is furnished forinformational use only, is subject to change without notice, and should not beconstrued as a guarantee, commitment, condition or offer by PTC. PTC, the PTCLogo, PTC Creo, PTC Elements/Pro, PTC Mathcad, PTC Windchill, PTC WindchillPDMLink, Pro/ENGINEER, and all PTC product names and logos are trademarksor registered trademarks of PTC and/or its subsidiaries in the United States andin other countries. All other product or company names are property of theirrespective owners. The timing of any product release, including any features orfunctionality, is subject to change at PTC’s discretion.7514–Software for Medical Devices-WP–EN–1112Page 9 of 9 Software Development for Medical DevicesPTC.com
ISO 13485, Quality systems – Medical devices: Particular requirements for the application of ISO 9001 Medical Device Software Software used as a component of a medical device Software that is a medical device Software used in the production of a device Softwar
