A Model for the FDA General Principles of Software Validation

Abstract

<p>Several institutions and agencies around the world, from both the private and public sectors, have adopted the practice of software validation and certification to ensure higher levels of confidence in software. The US Food and Drug Administration (FDA) is one of these organisations. The FDA has published several guidance documents concerning the validation of medical device software or the validation of software used to design, develop, or produce medical devices. In its guidance documents for both the medical software industry and FDA staff, the FDA recommends certain activities to be undertaken and certain deliverables to be prepared. The FDA believes that undertaking these activities as well as preparing these deliverables will achieve higher confidence in the software quality and, accordingly, better validation.</p> <p>In this thesis, we question the clarity and practicability of the FDA approach for medical software validation. We examine the FDA approach by evaluating the FDA guidance documents. We base our analysis on distinguishing between product and process aspects. By bearing in mind these two concepts, we believe that the FDA validation approach leads to confusion in the minds of both software producers and evaluators and it may well lead to lower quality software than desired being certified, while the FDA considers its approach as the least burdensome. As a demonstration of our claim, we analyse "Quality Planning" as the first activity in the FDA approach. We discuss the corresponding effort for this activity in another product-oriented evaluation approach, the Common Criteria (CC) for Information Technology Security Evaluation. As its main objective, the comparison aims to highlight both the inconsistency and the vagueness of the FDA evaluation function.</p> <p>The FDA guidance documents are natural language in specifying their recommendations because of the wide audience to which they are addressed and the consequent need for simplicity. However, the specification is not sufficiently explicit and precise to be able to impose a contract (obligation) between the two parties (software producers and evaluators). Having illustrated the drawbacks of the FDA approach, with comparison to the CC, as they appear in the "Quality Planning" activity, we use the Product/process (P/p) method to model this activity and all subsequent ones. Despite the application of the P/p method herein to medial device certification, a critical area of application, the P/p method takes a general systems approach. It is appropriate to a variety of areas and has proven its applicability in many field. Thus, reconsideration of these issues by the FDA will lead to a more objective evaluation function and higher confidence in the medical software, which represents the most important concern among the evaluation community and the general public.</p>