Here’s a good start
The FDA’s analysis of 3140 medical device recalls conducted between 1992 and 1998 reveals that
242 of them (7.7%) are attributable to software failures. Of those software related recalls, 192 (or
79%) were caused by software defects that were introduced when changes were made to the software
after its initial production and distribution. Software validation and other related good software
engineering practices discussed in this guidance are a principal means of avoiding such defects and
Software validation is a requirement of the Quality System regulation, which was published in the
Federal Register on October 7, 1996 and took effect on June 1, 1997. (See Title 21 Code of Federal
Regulations (CFR) Part 820, and 61 Federal Register (FR) 52602, respectively.) Validation
requirements apply to software used as components in medical devices, to software that is itself a
medical device, and to software used in production of the device or in implementation of the device
manufacturer’s quality system.
Unless specifically exempted in a classification regulation, any medical device software product
developed after June 1, 1997, regardless of its device class, is subject to applicable design control
provisions. (See of 21 CFR §820.30.) This requirement includes the completion of current
development projects, all new development projects, and all changes made to existing medical device
software. Specific requirements for validation of device software are found in
21 CFR §820.30(g). Other design controls, such as planning, input, verification, and reviews, are
required for medical device software. (See 21 CFR §820.30.) The corresponding documented results
from these activities can provide additional support for a conclusion that medical device software is
Any software used to automate any part of the device production process or any part of the quality
system must be validated for its intended use, as required by 21 CFR §820.70(i). This requirement
applies to any software used to automate device design, testing, component acceptance, manufacturing,
labeling, packaging, distribution, complaint handling, or to automate any other aspect of the quality
In addition, computer systems used to create, modify, and maintain electronic records
and to manage electronic signatures are also subject to the validation requirements.
(See 21 CFR §11.10(a).) Such computer systems must be validated to ensure accuracy, reliability,
consistent intended performance, and the ability to discern invalid or altered records.
Software for the above applications may be developed in-house or under contract. However, software
is frequently purchased off-the-shelf for a particular intended use. All production and/or quality system
software, even if purchased off-the-shelf, should have documented requirements that fully define its
intended use, and information against which testing results and other evidence can be compared, to
show that the software is validated for its intended use.
The use of off-the-shelf software in automated medical devices and in automated manufacturing and
quality system operations is increasing. Off-the-shelf software may have many capabilities, only a few
of which are needed by the device manufacturer. Device manufacturers are responsible for the
adequacy of the software used in their devices, and used to produce devices. When device
manufacturers purchase "off-the-shelf’’ software, they must ensure that it will perform as intended in their
chosen application. For off-the-shelf software used in manufacturing or in the quality system, additional
guidance is included in Section 6.3 of this document. For device software, additional useful information
may be found in FDA’s Guidance for Industry, FDA Reviewers, and Compliance on Off-The-Shelf
Software Use in Medical Devices.
If you would like me to review your paper, you can send it on to my email address.