PLC Ladder Logic Software V&V

A recent question I received after one of my webinars:

Ques:  Software Val as part of the DHF- Do lab equipment processes controlled by Programmable Logic Controllers (PLCs) such as for valves to open a door or for temperature control count as software? Or would they be verified / validated as part of the function they control?

Ans:  You could do it either way, and usually software V&V as I outlined in the webinar addresses both, as I do "black box" software V&V (check software operation by the hardware's operation) for all software validations, to see the software's operation by validating the hardware's operation.

With PLC ladder logic, I do both, "white" and "black box" V&V , i.e., a "code" review by a "white box" review of the ladder logic, often by annotating each "rung" as to what that "rung" says versus what it actually does, and also by running the process / hardware controlled by the ladder logic ("black box").

As mentioned, this isn't the only way to do it. But it's the approach I and others have taken and has passed numerous US FDA and EU (and Asian) N-B inspections.  

--   jel@jelincoln.com

Added "...(and Asian)..." in last paragraph. - JEL, 07/07/25

The 510(k), IDE, Q-Sub, De Novo and PMA Programs for New (or Substantially Changed) Devices Marketed in the US

The US FDA has several programs by which a new medical device can be marketed in the US. They are basically separated by the US FDA’s Classification under 21 CFR 800-series, which in turn is guided primarily by risk of use to the patient / end user.  Class I devices only have to meet basic regulatory requirements, e.g., General Controls, the CGMPs, which for devices is 21 CFR 820.

Higher risk devices must be reviewed by the FDA prior to commercial sale in the US.  Class II devices generally are cleared by the FDA through the 510(k) review process, which focuses on “substantial equivalence” to a previously cleared and currently marketed “predicate device”.  Rarely are clinical trials required for 510(k)s. Clearance by the FDA allows the product to be marketed in the US.

If clinical trials are required for some Class II devices, they can sometimes by addressed only by hospital IRBs (Institutional Review Boards).  If the trial is necessary for new, novel Indications for Use, then the FDA needs to be involved prior to the clinicals.  This is done by a Q-Submission, to start a dialog with the FDA about the route to market for the proposed device, and/or an IDE (Investigational Device Exemption) submission to the FDA to allow the manufacture, shipment and clinical use of a somewhat experimental (investigational) device.     

The U.S. FDA mandates that the "Traditional" 510(k) submission address 21 basic requirements.  The "Special" and "Abbreviated" 510(k)s must also address them, but in different ways, e.g., ties to an existing 510(k) or certification to adherence to consensus standard(s).  In addition, the FDA Task Force has identified several problem areas with the existing medical device 510(k) process, leading to the growing push by the Agency to broaden the usage of the 510(k) process, under “Breakthrough Devices” (newer technology) or the STeP (new safety features) programs. Access to these newer programs is through the Q-Sub.

If a device is higher risk. It won’t be listed in the 21 CFR 800-series.  In such a case, it may be submitted to the FDA under a request for consideration as De Novo (a lower risk class III, possibly Class II, device).  If higher risk, definitely Class III, it will be submitted under the PMA (Pre-Market Approval) process.  Extensive clinical trials will be involved, and the process can take a couple of years or more (the 510(k) process generally is completed in about a half year).  Both the De Novo and PMA can benefit with initial dialog with the Agency via the Q-Sub.   Approval by the FDA allows the product to be marketed in the US.  The De Novo pathway results in the product subsequently being addressed under the 510(k) program.  Class III devices approved under the PMA program still require similar future products to also be reviewed under the PMA program.

-- jel@jelincoln.com  

 US FDA's New eSTAR Electronic Submission Portal:

eSTAR is the new FDA electronic submission program for 510(k)'s, etc.:

https://www.fda.gov/medical-devices/how-study-and-market-your-device/voluntary-estar-program

Mandatory as of Oct 01, 2023 for 510(k)s:

https://www.fda.gov/medical-devices/how-study-and-market-your-device/voluntary-estar-program#voluntary 

-  jel@jelincoln.com

Corrected eSTAR, 01/21/24 JEL

 Pre-production samples for Device 510(k) test submissions

Basically all the testing has to reflect what the marketed product will be, at least initially.  Any changes made afterward your company will have to validate.  So if you go from machined plastic to injection molded plastic, you will have to do some of the tests over again to show no change to its effect to the patient, that usually satisfies the FDA. Incidentally, the FDA reviews your / lab test data in the 510(k) that we submit, not actual samples.  We won't be submitting physical samples, just descriptive information - Pictures, drawings, specs, test/lab data/reports, ...

However, the initial product has to be "substantially equivalent"(SE) to the predicate device, the 510(k) or De Novo submission (note:  the FDA has recently encouraged "beneficial iteration" rather than 100% SE (of old technology) per their 510(k) modernization programs - Breakthrough Technologies and STeP (safety improvements)) *.  Differences must be minor in most cases, and all test data must show that they are basically SE, especially in the areas of safety to patient and effectiveness. 

Companies have machined parts out of some plastics, those resistant to crazing / cracking (e.g., polycarbonate...).  Usually they use limited cavity, short-run tooling initially before expanding to multiple cavity, production run tooling, to save costs and allow for some changes.  Changes are usually driven by field data, the FDA does not usually get involved in design issues other than evaluating potential safety concerns, and then, they state their issues, but they don't recommend fixes - that's left to the company.

Change to the product over its lifetime is allowed / encouraged by the FDA, as long as some basics remain the same, e.g., Indications for Use, Safety and Effectiveness issues, operating principles, radical material changes, Cautions / Warnings, and similar, per some Guidance Documents - if those change, then a new 510(k) has to be filed. And all changes must be validated to prove the change did what it was intended to do, without any unintended consequences.  All such change data has to be retained by the company and is subject to FDA inspection.  

A  Contract Manufacturer can themselves subcontract.  However, all parties must adhere to the CGMPs, but the top level company is responsible for ultimate CGMP compliance for the entire supply chain, which is defined in Quality Agreements, contractual arrangements, Purchase Orders, annual internal and vendor audits, QC part inspections, etc.

-- jel@jelincoln.com  04/07/2023

* 510(k) mod program references added 10/13/2023 - JEL

Medical Device Regulatory Career Training:

A recent question from one of my webinars and my response:

I attended the recent Medical Device labeling webinar and I have a question... 
Mr. Lincoln, as someone who is just getting started in my work with medical
devices, would you recommend the RAC training and certification? Is there
another training that you would recommend that will help me understand the
registration process as well as make me an appealing candidate for medical
device roles?
I appreciate any advice you can offer!

My answer:  

RAC certs are useful to employers to see a basic level of expertise in devices.  I also recommend knowledge of technical writing, verbal communication skills, ability to read drawings / drafting, some basic business / industrial statistics / 6 sigma / SPC, flow charts, cause and effect diagrams, etc.  Learn the basics of the 510(k) and the applicable CGMPs (devices are 21 CFR 820) which can be self-taught off the FDA's website. The FDA has many guidance documents of 510(k)s, IDEs, PMAs, DeNovo, the CGMPs, clinicals, data integrity, cybersecurity, etc., which are good to read, reread to gain familiarity of basic regulatory requirements.  If you're in devices, also look at pharma, etc., for principles that apply to all, e.g., the 2011 guidance document on pharma process validation which discusses basic statistical principles of reduction of variation, homogeneity within lots, consistency between lots, etc., a common goal of all manufacturing. 

And, or course, selective appropriate webinars.

Best regards, John

jel@jelincoln.com

I would add to the above, knowledge of your products and their use in the field (see below on visits to hospitals, et al), knowledge of the manufacturing / assembly processes for those products - spend time on the shop floor, in general, and especially if you have to draft or check the accuracy of an SOP), and some general knowledge of the functions / responsibilities of the other departments in your company. - JEL, 08/14/2025 

One of the most useful texts on industrial statistics is "DataMyte Handbook: A Practical Guide to Computerized Data Collection for Statistical Process Control", out of print, but which was given to engineers, etc., for decades, free. The section on SPC is the value, the catalog is outdated.  You can usually find one available on Amazon or E-bay, several editions, where the SPC section is basically the same, for a reasonable price (+/- $10.00 USD) - covers many of the tools used in the FDA's device and pharma Production and Process Controls (SPC, 6 Sigma, et al) section of the CGMPs. FDA Guidance Documents can be Googled, or searched on fda.gov - start search with the general subject, then select guidance document or other applicable reference, go there and usually you will get further sources to check as well. Beware of AI, as, while it can be useful, can also provide misleading or wrong information on specialized aspects of regulatory requirements.  Also check with Marketing or Management to see if you can go to a hospital or...  with a company rep to see the actual use of your products on patients, reality vs theory!  -- JEL, 07/07/25

Compiling the DHF Q&A:

I attended the Effective Design Control (21 CFR Part 820.30) webinar on 01Feb2023 and found the information presented to be very useful. Thank you for the invite to send follow-up questions.

Our company divides product development into 5 phases: Product Initiation, Feasibility, Optimization, Validation & Transfer, and Launch. Each of these phases has a checklist of actions and deliverables applicable for the phase. We consider these checklists, our Design Plan. One of my goals this year is to streamline the DHF compilation process. My email to you is to confirm that I am interpreting the following 2 points correctly:

1) I liked what you said on slide 10, "Not all of the records generated during the project are design outputs and as such do not need to be retained in the Design History File", that only the outputs need to be retained. For example: No, the email from Finance noting what the pricing should be for the product does NOT need to be retained in the DHF or Supply Agreements.

My Answer:

That's correct per FDA requirements.  I did say that key interim inputs / outputs should be captured under either the DI or DO DHF "file" tabs. Your company should define what are "key" to show the path from initial DI to final DO, and the SOP should state where (under which heading) those interim DI/DO's should be placed.  And I mentioned that the DHF can serve a valuable additon to your company's IP, so that's also a consideration as to any supplemental information you'd also want to include beyond the CGMP minimums.

2) Currently, our checklists note the date the action/deliverable was completed. I noticed on slide 6 that adding the completion dates for each individual activity is not necessary. This makes sense to me because the date that the phase review takes place IS recorded in the meeting minutes for the phase review and those are all retained in the DHF. 

My answer:

Again true.  However having a record of start and completion dates for each Milestone / Task / Deliverable may be of use to your company in providing a more accurate time frame for future similar activities than a "guestimate" and may be desirable to retain for that reason.  However, if the key dates are addressed in the Review minutes for each phase / milestone/task which should be retained in the DHF also, there's no need for redundancy.  As a project leader on these type of projects, I usually liked to keep such information on my Gantt Charts, which charts were then added to the DHF, usually in the beginning of the File, under Plan.

-- jel@jelincoln.com

 

Retroactive Combination Product DHF Compilation

Question from a recent seminar:

I attended the Effective Design Control seminar today, 1Feb2023. Thank you for providing a thorough and informative seminar.
To follow up on my previous question about design control requirements for drug-device combinations for ophthalmic vial (Class 1 device) that was approved as a drug.
We are looking to develop design history file for the an approved, marketed product. We are thinking to leverage the product development reports and documents from 32P of the NDA. What are your thoughts on this approach? What gaps are there between 32P and required docs for Class 1 device design history file. We can also leverage the process validation documents. What about PQ documents? We are working to compile the document package and not reinvent the wheel for an approved product already in commercial production.

My Answer:

Nothing wrong with your approach.  A little "reverse engineering" / retrospective compilation.  Not the most desirable to the FDA as it defeats some of the purpose of Design Control, i.e., affecting the initial design process to produce a safer device.  Your approach is certainly appropriate as some of the the Combo / NDA information would have come from the DHF had such been developed first.  It's similar to the approach I would take in compiling a DHF after the fact. In a combo product per 21 CFR 4, if the drug is the higher risk component, your CGMP "operating system" is 21 CFR 210, -211, with 21 CFR 820.30, Design Control, to be added for the device component.  Design control is focused on the device component, and the effects of any drug-device interactions primarily.  

Device design V&V (Verification and Validation) can also be compiled retroactively (again the least desirable to the FDA, vs concurent and prospective (most desirable)), but acceptable. The IQ/OQ/PQs are for the production / test equipment and software.  Your device design V&V should focus on the Device / Combo Requirements / "User" Needs, as per the slide  on Product Verification / Testing Examples slide, e.g., biocompatibility, functionality, sterility, etc., and consideration of the drug / device interaction, e.g., leachables, also system biocompatibility, stabiltiy, shelf life, packaging/shake and drop/cross country shipping and similar. Each one of these verifications would generally be a lab test report, and put all together, would make up the device validation.

Wherever possible, by all means, use already developed material, and merely fill in the gaps to complete the DHF.  Include  a description of what was done and why in your cover narrative in the DHF. Don't forget reference to a Risk Management File (ISO 14971; mandatory) and maybe a Use / Human Factors Engineering File (IEC 62366-1; possibly if your device has some not too familiar use interface features).  I have not seen any problem with this approach in my personal experience with both the FDA and N-B inspectors.

-- jel@jelincoln.com

To clarify, the FDA expects a DHF to be completed prior to design transfer, so it can affect the product design to improve safety and usability of the device.  My above-referenced use of retrospective development of a DHR is usually helping a client after they got a 483 or Warning Letter for failing to have a DHF.  It's assumed by the FDA that when you file a marketing request (510(k), PMA, IDE, NDA, ANDA, Combo device...) that you've followed the CGMPs to get to that point, which includes compiling a DHF for devices or combo products having a device component. - JEL, 07/07/25