1 Introduction

The primary focus of this chapter is the practical application of the validation of computerised systems. The reader therefore should not expect an introduction to all the depth and detail of this complex and wide-ranging topic on the limited pages of the GMP guide. After this chapter, however, the reader should be in the position to validate a system.

With the emergence of the use of computers in the 1980s, the pharmaceutical industry and authorities began to make increasing demands on the quality of these systems. The Blue Book published by the FDA in 1983 is a notable example. These requirements have since become increasingly detailed and have been expanded, culminating in the FDA legislation 21 CFR Part 11 (chapter D.1 21 CFR Part 11 Electronic records; electronic signatures). Due to groans from the industry regarding the immense burden of the documentation, which no longer contributed to the maintenance and improvement of product quality in all cases, the FDA decided that this would no longer be implemented as a compulsory requirement, but only dependent on risk.

Computer validation does not only have to mean increased costs. Improved project control, good documentation, increased productivity, and a reduced maintenance workload are some examples of advantages that are described here for two tablet manufacturing and packaging lines (see figure 1). In addition, validation also leads to better passing regulatory inspections.

2 Basic terminology

Some basic terms are defined in the following. Explanations of specific terms are provided in front of the relevant chapters.

2.1 Validation of computerised systems

The validation of computerised systems means the documented evidence that with a high probability, the system does what it is supposed to do in a reproducible manner.

Validation and qualification are two closely related terms. They are used here in accordance with the glossary of the EU-GMP Guideline (chapter C.7 Glossary), whereby qualification is restricted to equipment, while validation includes additinally to processes and procedures (figure 2).

Figure 2 illustrates the principal composition of a computerised system, which is also reflected in regulations such as the PIC/S Guide PI 011, chapter 6.2 (see chapter F.3 PIC/S Guidance Good Practices for Computerised Systems in Regulated "GXP" Environments (PIC/S PI 011)).

Hardware, the physical existing, tangible component is what can be seen and touched. In embedded simple systems such as washing machines or centrifuges, it is not clear at first glance that these are computerised systems, since the hardware forms the main part of the system.

The software is not visible until the device is started. The software consists of commands, algorithms, and decisions. Two points are important for validation:

• Software does not age. This means that if a function forms the total of A and B today, it will do this reproducibly forever. For validation, this means that one execution of a test is sufficient.
• Software is not steady. It does not follow mechanistic principles, and it is therefore dangerous to draw mechanistic conclusions in the testing of software. Mechanistically, it can be concluded that
  1 + 1 = 2 or that 2 + 1 = 3, if 1 + 2 = 3 and 1 + 3 = 4 and so on.
  Each individual function of a piece of software would have to be tested, which is not possible, since the number of combinations is so enormous that you would never finish testing. Boris Beizer, an expert on software testing, explains this "combinatoric explosion" in his book "The Art of Software Testing". For validation, this means that even a comprehensively tested piece of software may still contain errors.

The controlling system comprises the hardware and software components.

The controlled process on the right-hand side of figure 2 consists of equipment, standard operating procedures, and documentation. The controlling system and the controlled process together form the computerised system. It is important for validation that the validation activities cover the whole system.

The controlled process is the actual function of the computerised system. This is the aim of validation. The validation is performed against this. It must be shown that the process actually runs as described in the specifications.

Wingate Guy: Computer Systems Validation: Quality Assurance, Risk management and Regulatory Compliance for Pharmaceutical and Healthcare Companies, CRC Press, 2004 (p 14).