GAMP 5 Good Practice Guide-Matt Safi

Validation of Automation Systems

GAMP5

1 Pharma Bio Solutions Ltd

www.chinapat.com

Different Terminology

Computerised Systems Automation Systems Control Systems Control Equipment

Data Management systems

Pharma Bio Solutions Ltd2

Computerised System: A system including the input of data, electronic processing and the output of information to be used either for reporting or automatic control:SFDA: Good Manufacturing Practice for pharmaceutical products

www.chinapat.com

US FDA

Automated processes. When computers or automated data processing systems are used as part of production or the quality system, the manufacturer shall validate computer software for its intended use according to an established protocol. All software changes shall be validated before approval and issuance. These validation activities and results shall be documented.

PART 820 QUALITY SYSTEM REGULATION


www.chinapat.com

EMEA

Validation: The extent of validation necessary will depend on a number of factors including the use to which the system is to be put, whether the validation is to be prospective or retrospective and whether or not novel elements are incorporated. Validation should be considered as part of the complete life cycle of a computer system. This cycle includes the stages of planning, specification, programming, testing, commissioning, documentation, operation, monitoring and modifying.

Commission Directive 3003/94/ECAnnex 11 Computerised system


www.chinapat.com

SFDA

Where automated and monitoring systems are used for these applications they should be validated to ensure that critical process requirements are met.

Good Manufacturing Practice for pharmaceutical products, Part II Annex Chapter 12 Terminal Sterilisation:212


www.chinapat.com

Functional Hierarchy, ISA-S95


Business Logistics SystemsPlant Production Schedulingand Operational Management

Level 4

Manufacturing Control SystemsArea Supervision, Production

Scheduling, Reliability AssuranceLevel 3

DiscreteControlSystems

Levels 2,1,0BatchControlSystems

ContinuousControlSystems

www.chinapat.com

Process Control Systems Level 1 & 2


Process Control systems

Configurable

Controllers, Analysers

Embedded

Machine+ PLC+ HMI

Standalone

PLC+ SCADA DCS

www.chinapat.com

Examples of Process Control System

Standard hardware, Configurable (no programming only parameterisation) HPLC Controllers (Temperature Controller, pH Controller, etc.)

pH Embedded: Generally standard hardware, Software may include just

parameterisation, partial programming or full programming Freeze Dryer control system, Autoclave control system, etc.

Standalone: Requires custom hardware, and software requires programming SCADA + PLC, DCSSCADAPLC,DCS BMS & EMS system API Control system Plant SCADA systemSCADA


www.chinapat.com

Validation of Automation System

GAMP5(Good Automated Manufacturing Practice)

A RisK Based Approach to Compliant GxP

Computerised SystemGxP


www.chinapat.com

GAMP5 V Model (1)

Planning URS Risk Assessment Vendor Assessment & Selection

Quality Plan

Specification Functional Specification Hardware Design Specification

Software Design Specification

Software Module Specification

Risk Assessment Design Qualification


www.chinapat.com

GAMP5 V Model (2)


Configuration & Coding Build system hardware Configure system software

Integrate hardware & software

Verification

Code Review FAT Protocol & Execution FAT

SAT Protocol & Execution SAT

Reporting

Final Documentation Final Quality Report and handover

www.chinapat.com

Computerised System Life Cycle

www.chinapat.com

What GAMP5 Is and Isnt?GAMP5

It is not about making documents GAMP5 is a Guideline which is accepted by major regulatory

bodies as a methodology for the development and operation of Control Systems GAMP5

It is about ensuring the Brain of a Machine or a Process work properly and is fit for its intended use.

It is about Building Quality onto a Control System throughout its Life Cycle.

It defines the steps to be taken at each stage of Control System Life Cycle

It defines Roles and Responsibilities of User and Suppliers


www.chinapat.com

Process Owner: The person ultimately responsible for the business process or processes being managed

System Owner: The person ultimately responsible for the

availability , support, and maintenance of a system and for the security of the data residing on that system

Subject Matter Expert: Those individuals with specific expertise in a particular area or field. SME should take the lead role in the verification of computerised systems. SME responsibilities include planning and defining verification strategies, defining acceptance criteria, selection of appropriate test methods, execution of verification tests and reviewing resultsSMESME

Key Personnel

www.chinapat.com

Scalable Life Cycle Activity

Life cycle activities should be scaled according to:

System impact on patient safety, product quality and data integrity

GxP Assessment GxP Impact Assessment

System complexity and novelty Software category Hardware Category


www.chinapat.com

GxP Assessment, GxP


Does the system generate, manipulate or control data supporting regulatory safety and efficacy submissions?

Yes / No

Does the system control critical parameters and data in preclinical, clinical, development, or manufacturing?

Yes / No

Does the system control or provide data or information for product release?/

Yes / No

Does the system control data or information required in case of product recall?

Yes / No

Does the system control adverse event or compliant recording or reporting?

Yes / No

Does the system support pharmacovigilance?()

Yes / No

www.chinapat.com

System Impact Classification


Worst case impact on patient safety

High = potential for serious injury or deathMedium = potential for minor injuryLow = potential for little harm to patient== =

Worst case impact on product quality

High = potential for release of product which would cause serious injury to a patientMedium = potential for release of product which would cause minor injury to a patientLow = potential for poor quality product which would not be released or would not cause harm to patient===

Worst case impact on data integrity

High = loss of data integrity such that product recall could not be carried out or release could be made of product which would cause serious injury to a patientMedium = loss of data integrity such that release could be made of product which would cause minor injury to a patient Low = loss of data integrity such that product would need to be scrapped or data records not essential to product release or recall might be lost or impaired== =

www.chinapat.com

Category Typical Approach

1, Standard Hardware Components

Document manufacturer or supplier detail, serial number and version number

Correct installation to be verified

Configuration Management and Change control apply

2, Custom Built Hardware Components

As per above plus:

Design specification

Acceptance testing

Configuration and Change control apply


GAMP 5 Hardware Categories

www.chinapat.com

GAMP 5 Software Categories Category Description Typical examples Typical Approach

1, Infrastructure Software

Layered software

Software used to manage the operating environment

Operating systems

Database engines

Middleware

Programming languages

Spreadsheets

Version control tools

Network monitoring tools

Record version number, verify correct installation by following approved installation procedure

3, Non-configured

Runtime parameters maybe entered and stored, but the software can not be configured to suit the business process

Firmware based applications

COTs software

Abbreviated Life cycle approach

URS

Risk based approach to supplier assessment

Record version number, verify correct installation

Risk based test

Procedure in place for maintaining compliance


www.chinapat.com

GAMP 5 Software Categories Category Description Typical examples Typical Approach

4, configured

Software, often very complex, that can be configured by the user to meet the specific needs of the users business process. Software code is not altered

DAQ systems

SCADA

DCS

BMS

HMI

LIMS

ERP

Clinical trail monitoring

Life cycle approach

Risk based approach to supplier assessment

Supplier QMS

Record version number, verify correct installation

Risk based testing in a test environment

Risk based testing within the business process

Procedure in place for maintaining compliance

5, Custom

Software custom designed and coded to suit the business process

Internally, externally developed IT applications.IT

Internally, externally developed process control applications.

Custom ladder logic

Custom firmware

Spreadsheet (macro)()

Same as cat 4 plus 4

More rigorous supplier assessment, with possible supplier audit

Possession of full life cycle

Design and source code review


www.chinapat.com


Software Category 3 3

www.chinapat.com


Software Category 4 4

www.chinapat.com

Software Category 55


www.chinapat.com

Example of GAMP5 Categories

Item Hardware Category Software Category

Configurable (Controllers, weigher, etc)

1 3

Embedded Standard (PLC + HMI)

1 3

Embedded Non-Standard(PLC + HMI)

1 or 2 3, 4 ,5

Standalone (DCS, SCADA+PLC)

2 3, 4 ,5


www.chinapat.com

User Requirement Specification


Most important document Describes what the system is supposed to do Normally written by the end user, maybe also be provided by supplier.

Controlled Document For Cat 3 written for a specific solution 3 For Cat 4 & 5 It is written in general 45 Sufficient, Realistic, Measurable, Achievable

Testable: Clear, Precise, basis for formal testing

Traceable: Design and testing Define priority: Mandatory, Beneficial, Nice to have

www.chinapat.com


Functional Specification

A Functional Specification is a key document in defining how the customer functional requirements, as defined in the user requirements specification, are to be met.

Functional Specification is the responsibility of the supplier

It is written in response to URS URS

It provides the main basis for FAT FAT

It needs to be approved by User.

Generally may require further revision during the project life cycle.

www.chinapat.com


Test Phases A system test phases depends on its size and complexity

Typical test phases include Software Module testing Internal integrated testing

Hardware Software

FAT test FAT Hardware Software

SAT test SAT Hardware (IQ) IQ Software (OQ) OQ

www.chinapat.com

Test Protocols A Test 'protocol' or 'specification' defines the testing to be carried out to verify

that the system (or its individual elements) meets pre-defined requirements.

A project may include Software Module Test Protocol, FAT protocol, SAT protocolFATSAT

Depending the size of the project there maybe a separate Hardware Test protocol

Test Protocols are the responsibility of the supplier They should be approved by User.

Generally may require further revision during the FAT.FAT


www.chinapat.com

Risk Management

Change & Configuration Management

Design Review

Traceability

Document Management

Supporting Processes

www.chinapat.com


On-going Operation

Maintaining compliance and fitness for intended use of GxP Validted system throughout its life cycleGxP

Users of the system must be able to demonstrate that they have considered and reviewed maintenance requirement and supports needs for the system and decided what procedures and records should be established and maintained.

www.chinapat.com

On-going Operation activities

Performance Monitoring Incident Management Corrective and Preventive Action Repair activity Periodic Review Backup & Restore Security Management Archival and Retrieval


www.chinapat.com

Project Stages

www.chinapat.com

Matt SafiPharma Bio Solutions LtdDifferent TerminologyUS FDAEMEASFDAFunctional Hierarchy, ISA-S95Process Control Systems Level 1 & 2Examples of Process Control System Validation of Automation SystemGAMP5 V Model (1) GAMP5 V Model (2) Computerised System Life CycleWhat GAMP5 Is and Isnt?GAMP5Key PersonnelScalable Life Cycle ActivityGxP Assessment, GxP System Impact Classification 18GAMP 5 Software Categories GAMP 5 Software Categories Software Category 3 3Software Category 4 4Software Category 55Example of GAMP5 CategoriesUser Requirement Specification 26 27Test ProtocolsSupporting Processes 30On-going Operation activitiesProject Stages

Documents

GAMP 5 Good Practice Guide-Matt Safi