SECTION F. DESIGN VERIFICATION FOR MEDICAL DEVICES

SECTION F. DESIGN VERIFICATION

I. REQUIREMENTS

§ 820.30(f) Design verification.

• Each manufacturer shall establish and maintain procedures for verifying the device design.
• Design verification shall confirm that the design output meets the design input requirements.
• The results of the design verification, including identification of the design, method(s), the date, and the individual(s) performing the verification, shall be documented in the Design History File.

Cross-reference to ISO 9001:1994 and ISO/DIS 13485 section 4.4.7 Design verification.

II. DEFINITIONS

§820.3(y) Specification means any requirement with which a product, process, service, or other activity must conform.

§ 820.3(z) Validation means confirmation by examination and provision of objective evidence that the particular requirements for a specific intended use can be consistently fulfilled.

1. Process Validation means establishing by objective evidence that a process consistently produces a result or product meeting its predetermined specifications.
   
   
2. Design Validation means establishing by objective evidence that device specifications conform with user needs and intended use(s).

§820.3(aa) Verification means confirmation by examination and provision of objective evidence that specified requirements have been fulfilled.

III. DISCUSSION AND POINTS TO CONSIDER

Verification and validation are associated concepts with very important differences. Various organizations have different definitions for these terms. Medical device manufacturers are encouraged to use the terminology of the quality system requirements in their internal procedures.

To illustrate the concepts, consider a building design analogy. In a typical scenario, the senior architect establishes the design input requirements and sketches the general appearance and construction of the building, but associates or contractors typically elaborate the details of the various mechanical systems. Verification is the process of checking at each stage whether the output conforms to requirements for that stage. For example: does the air conditioning system deliver the specified cooling capacity to each room? Is the roof rated to withstand so many newtons per square meter of wind loading? Is a fire alarm located within 50 meters of each location in the building?

At the same time, the architect has to keep in mind the broader question of whether the results are consistent with the ultimate user requirements. Does the air conditioning system keep the occupants comfortable throughout the building? Will the roof withstand weather extremes expected at the building site? Can the fire alarm be heard throughout the building? Those broader concerns are the essence of validation.

In the initial stages of design, verification is a key quality assurance technique. As the design effort progresses, verification activities become progressively more comprehensive. For example, heat or cooling delivery can be calculated and verified by the air conditioning designer, but the resultant air temperature can only be estimated. Occupant comfort is a function not only of delivered air temperature, but also humidity, heat radiation to or from nearby thermal masses, heat gain or loss through adjacent windows, etc. During the latter design phases, the interaction of these complex factors may be considered during verification of the design.

Validation follows successful verification, and ensures that each requirement for a particular use is fulfilled. Validation of user needs is possible only after the building is built. The air conditioning and fire alarm performance may be validated by testing and inspection, while the strength of the roof will probably be validated by some sort of analysis linked to building codes which are accepted as meeting the needs of the user-subject to possible confirmation during a subsequent severe storm.

Validation is the topic of Section G of this guidance document. The remainder of this section focuses on verification principles.

TYPES OF VERIFICATION ACTIVITIES. Verification activities are conducted at all stages and levels of device design. The basis of verification is a three-pronged approach involving tests, inspections, and analyses. Any approach which establishes conformance with a design input requirement is an acceptable means of verifying the design with respect to that requirement. In many cases, a variety of approaches are possible.

Complex designs require more and different types of verification activities. The nature of verification activities varies according to the type of design output. The intent of this guidance document is not to suggest or recommend verification techniques which should be performed by device manufacturers. Rather, the manufacturer should select and apply appropriate verification techniques based on the generally accepted practices for the technologies employed in their products. Many of these practices are an integral part of the development process, and are routinely performed by developers. The objective of design controls is to ensure adequate oversight by making verification activities explicit and measuring the thoroughness of their execution. Following are a few examples of verification methods and activities.

• Worst case analysis of an assembly to verify that components are derated properly and not subject to overstress during handling and use.
• Thermal analysis of an assembly to assure that internal or surface temperatures do not exceed specified limits.
• Fault tree analysis of a process or design.
• Failure modes and effects analysis.
• Package integrity tests.
• Biocompatibility testing of materials.
• Bioburden testing of products to be sterilized.
• Comparison of a design to a previous product having an established history of successful use.

For some technologies, verification methods may be highly standardized. In other cases, the manufacturer may choose from a variety of applicable methods. In a few cases, the manufacturer must be creative in devising ways to verify a particular aspect of a design.

Some manufacturers erroneously equate production testing with verification. Whereas verification testing establishes conformance of design output with design input, the aim of production testing is to determine whether the unit under test has been correctly manufactured. In other words, production testing is designed to efficiently screen out manufacturing process errors and perhaps also to detect infant mortality failures. Typically, a small subset of functional and performance tests accomplish this objective with a high degree of accuracy. Therefore, production testing is rarely, if ever, comprehensive enough to verify the design. For example, a leakage test may be used during production to ensure that a hermetically-sealed enclosure was properly assembled. However, the leakage test may not be sensitive enough to detect long-term diffusion of gas through the packaging material. Permeability of the packaging material is an intrinsic property of the material rather than an assembly issue, and would likely be verified using a more specialized test than is used during production.

DOCUMENTATION OF VERIFICATION ACTIVITIES. Some verification methods result in a document by their nature. For example, a failure modes and effects analysis produces a table listing each system component, its postulated failure modes, and the effect of such failures on system operation.

Another self-documenting verification method is the traceability matrix. This method is particularly useful when the design input and output are both documents; it also has great utility in software development. In the most common form of the traceability matrix, the input requirements are enumerated in a table, and references are provided to each section in the output documents (or software modules) which address or satisfy each input requirement. The matrix can also be constructed "backwards," listing each feature in the design output and tracing which input requirement bears on that feature. This reverse approach is especially useful for detecting hidden assumptions. Hidden assumptions are dangerous because they often lead to overdesign, adding unnecessary cost and complexity to the design. In other cases, hidden assumptions turn out to be undocumented design input requirements which, once exposed, can be properly tracked and verified.

However, many verification activities are simply some sort of structured assessment of the design output relative to the design input. When this is the case, manufacturers may document completion of verification activities by linking these activities with the signoff procedures for documents. This may be accomplished by establishing a procedure whereby each design output document must be verified and signed by designated persons. The presence of the reviewers' signatures on the document signifies that the design output has been verified in accordance with the signoff procedure.

SECTION G. DESIGN VALIDATION

I. REQUIREMENTS

§ 820.30(g) Design validation.

• Each manufacturer shall establish and maintain procedures for validating the device design.
• Design validation shall be performed under defined operating conditions on initial production units, lots, or batches, or their equivalents.
• Design validation shall ensure that devices conform to defined user needs and intended uses and shall include testing of production units under actual or simulated use conditions.
• Design validation shall include software validation and risk analysis, where appropriate.
• The results of the design validation, including identification of the design, method(s), the date, and the individual(s) performing the validation, shall be documented in the Design History File.

Cross-reference to ISO 9001:1994 and ISO/DIS 13485 section 4.4.8 Design validation.

II. DEFINITIONS

§820.3(y) Specification means any requirement with which a product, process, service, or other activity must conform.

§ 820.3(z) Validation means confirmation by examination and provision of objective evidence that the particular requirements for a specific intended use can be consistently fulfilled.

1. Process Validation means establishing by objective evidence that a process consistently produces a result or product meeting its predetermined specifications.
   
   
2. Design Validation means establishing by objective evidence that device specifications conform with user needs and intended use(s).

§820.3(aa) Verification means confirmation by examination and provision of objective evidence that specified requirements have been fulfilled.

III. DISCUSSION AND POINTS TO CONSIDER

Whereas verification is a detailed examination of aspects of a design at various stages in the development, design validation is a cumulative summation of all efforts to assure that the design will conform with user needs and intended use(s), given expected variations in components, materials, manufacturing processes, and the use environment.

VALIDATION PLANNING. Planning for validation should begin early in the design process. The performance characteristics that are to be assessed should be identified, and validation methods and acceptance criteria should be established. For complex designs, a schedule of validation activities and organizational or individual responsibilities will facilitate maintaining control over the process. The validation plan should be reviewed for appropriateness, completeness, and to ensure that user needs and intended uses are addressed.

VALIDATION REVIEW. Validation may expose deficiencies in the original assumptions concerning user needs and intended uses. A formal review process should be used to resolve any such deficiencies. As with verification, the perception of a deficiency might be judged insignificant or erroneous, or a corrective action may be required.

VALIDATION METHODS. Many medical devices do not require clinical trials. However, all devices require clinical evaluation and should be tested in the actual or simulated use environment as a part of validation. This testing should involve devices which are manufactured using the same methods and procedures expected to be used for ongoing production. While testing is always a part of validation, additional validation methods are often used in conjunction with testing, including analysis and inspection methods, compilation of relevant scientific literature, provision of historical evidence that similar designs and/or materials are clinically safe, and full clinical investigations or clinical trials.

Some manufacturers have historically used their best assembly workers or skilled lab technicians to fabricate test articles, but this practice can obscure problems in the manufacturing process. It may be beneficial to ask the best workers to evaluate and critique the manufacturing process by trying it out, but pilot production should simulate as closely as possible the actual manufacturing conditions.

Validation should also address product packaging and labeling. These components of the design may have significant human factors implications, and may affect product performance in unexpected ways. For example, packaging materials have been known to cause electrostatic discharge (ESD) failures in electronic devices. If the unit under test is delivered to the test site in the test engineer's briefcase, the packaging problem may not become evident until after release to market.

Validation should include simulation of the expected environmental conditions, such as temperature, humidity, shock and vibration, corrosive atmospheres, etc. For some classes of device, the environmental stresses encountered during shipment and installation far exceed those encountered during actual use, and should be addressed during validation.

Particular care should be taken to distinguish among customers, users, and patients to ensure that validation addresses the needs of all relevant parties. For a consumer device, the customer, user, and patient may all be the same person. At the other extreme, the person who buys the device may be different from the person who routinely uses it on patients in a clinical setting. Hospital administrators, biomedical engineers, health insurance underwriters, physicians, nurses, medical technicians, and patients have distinct and sometimes competing needs with respect to a device design.

VALIDATION DOCUMENTATION. Validation is a compilation of the results of all validation activities. For a complex design, the detailed results may be contained in a variety of separate documents and summarized in a validation report. Supporting information should be explicitly referenced in the validation report and either included as an appendix or available in the design history file.

SECTION H. DESIGN TRANSFER

I. REQUIREMENTS

§ 820.30(h) Design transfer.

• Each manufacturer shall establish and maintain procedures to ensure that the device design is correctly translated into production specifications.

Cross reference to ISO 9001:1994 and ISO/DIS 13485 section 4.2.3(c) Quality planning.

II. DISCUSSION AND POINTS TO CONSIDER

Production specifications must ensure that manufactured devices are repeatedly and reliably produced within product and process capabilities. If a manufactured device deviates outside those capabilities, performance may be compromised. Thus, the process of encapsulating knowledge about the device into production specifications is critical to device quality.

The level of detail necessary to accomplish this objective varies widely, based on the type of device, the relationship between the design and manufacturing organizations, and the knowledge, experience, and skills of production workers. In some cases, devices are produced by contract manufacturers who have no involvement in the development and little or no contact with the designers. At the other extreme, some devices are hand-crafted by skilled artisans with extensive knowledge about the use of the product.

One normally associates the term "production specifications" with written documents, such as assembly drawings, component procurement specifications, workmanship standards, manufacturing instructions, and inspection and test specifications. While these types of documents are widely employed in medical device production, other equally acceptable means of conveying design information exist, and manufacturers have the flexibility to employ these alternate means of communication as appropriate. For example, each of the following could constitute "production specifications" within the meaning of the quality system requirements:

• documentation (in electronic format as well as paper)
• training materials, e.g., manufacturing processes, test and inspection methods
• digital data files, e.g., programmable device files, master EPROM, computer-aided manufacturing (CAM) programming files
• manufacturing jigs and aids, e.g., molds, sample wiring harness to be duplicated

Historically, shortcomings in the production specifications tend to be manifested late in the product life cycle. When the design is new, there is often intensive interaction between the design and production teams, providing ample opportunity for undocumented information flow. Later, as production experience is gained, some decoupling often occurs between design and production teams. In addition, key personnel may leave, and their replacements may lack comparable training, experience, or institutional knowledge.

Particular care should be taken when the product involves new and unproved manufacturing processes, or established processes which are new to the manufacturer. It may not be possible to determine the adequacy of full-scale manufacturing on the basis of successfully building prototypes or models in a laboratory and testing these prototypes or models. The engineering feasibility and production feasibility may be different because the equipment, tools, personnel, operating procedures, supervision and motivation could be different when a manufacturer scales up for routine production.

No design team can anticipate all factors bearing on the success of the design, but procedures for design transfer should address at least the following basic elements.

• First, the design and development procedures should include a qualitative assessment of the completeness and adequacy of the production specifications.
• Second, the procedures should ensure that all documents and articles which constitute the production specifications are reviewed and approved.
• Third, the procedures should ensure that only approved specifications are used to manufacture production devices.

The first item in the preceding list may be addressed during design transfer. The second and third elements are among the basic principles of document control and configuration management. As long as the production specifications are traditional paper documents, there is ample information available to guide manufacturers in implementing suitable procedures. When the production specifications include non-traditional means, flexibility and creativity may be needed to achieve comparable rigor.