By now, we have a pretty convincing argument that the product is safe and effective.

Software Validation (CSV)

But wait, there’s more! We have still not sufficiently addressed the software and there’s even more with the manufacturing processes.

We’ll defer discussion of process validations for just a bit and talk about the software validations for our hypothetical enzyme monitoring / reporting system.

We need to consider all the software.

This clearly includes the “desktop” software for programming the device and the analysis / reporting software.

In The Box

But what about that software “in the box”?

That gets into some gray areas when you talk about FPGA code (field-programmable gate array) and other really low-level “programs.”

The current trend is that if it’s coded, it falls in the ‘software’ space with all expectations for controls and management.

For our hypothetical device, let’s assume there are five software components:

• The programming software used at the Doctors office (associates the device with a patient ID and allows entry of profile patient data)
• The user interface (drives a nice color touchscreen)
• The system management software (monitors for events and controls the processes including data transmission)
• The analysis software (takes the data from the sensors and ‘crunches the numbers’)
• The reporting software (receives the data from the device and does the analysis as well as providing the reports)

We can assume the verification (demonstration by objective evidence that each system can meet its [well defined] requirements) is done so we’ll just talk about the validation.

Well-Defined Life Cycle

And we’ll assume the manufacturer has a well-defined life cycle (which would include applicable integration and unit testing!) so we’ll ignore that as well.

So just focusing on validation (demonstration by objective evidence that the system meets user needs and intended use), we’d probably need to consider the following.

Note that the three embedded software components (user interface, system management, and analysis software) in the device would be considered a single “system” but drive unique validation activities).