欧盟发布《计算机化系统验证指南》-2018年8月1日

2018-04-10 GMP办公室

近日，EDQM发布了其新的《计算机化系统验证指南》，以帮助药企在实验室信息管理系统（LIMS）、电子文档管理系统等计算机化系统验证提供指导。该指南是由一个核心文件和2个附件组成。该指南的三个部分将于2018年8月1日起开始强制实施。

该文件对不同计算机化系统的验证策略作出如下分类：                        

Classification

分类Definition

定义Examples

举例Action

措施

Exempted

豁免的No calibration function无校准功能

Framework/layered Software基础架构/分层式软件Calculator, microscope,  photo or video

camera, standard  office PC, Microwave, etc.

计算器、显微镜、照相或录像机、标准办公电脑、微波等

Operating system  (e.g. Windows, Linux, Unix), network  software, security software (virus  check, firewall), office application  software (Word, Excel), database

software (e.g. Oracle,  SQL, Access), etc.

操作系统（如Windows、Linux、Unix，网络软件）、安全软件（杀毒、防火墙），办公应用软件（Word、Excel），数据库软件（如Oracle,  SQL, Access））等None

无

Simple

简单的Small part of software

软件的小部分

Restricted Customisation

有限的定制化pH meter, oxidisers,  incubator, titration processor,  colorimeter, thermo hygrograph/hygrometer, balance, particle sizer, UV/VIS  spectrometer, liquid scintillation  counter, TLC analyser, AAS, micro plate counter,  image analyser, polarimeter,  CombiStats, etc.

pH计、培养箱、滴定处理器、色度计、温湿度计、天平、粒度仪、UV/VIS分光光度计、液体闪烁计数器、TLC分析仪、AAS、微孔板计数器、图像分析仪、旋光仪、CombiStats（生物稀释测定结果统计分析软件）等Simplified   validation

简化的验证

- Calibration

校准

- Function  control test

功能控制测试

Extended amount  of Functionality software

扩展功能软件

Extendedcustomisation

高度定制化LIMS (Laboratory  Information Management System), ERP  (Enterprise Resource Planning), eDMS (electronic Document Management System), ELN  (Electronic Laboratory Notebooks),  user-developed Excel spreadsheet,  user-developed Access application,  automated sample processing systems, liquid  chromatograph (LC, HPLC), gas  chromatograph (GC) including auto sampler and  detection systems (UV, VIS, IR, MS, NMR, radioactivity or fluorescence monitor, etc.),  biological analyser, ECG, etc.

LIMS（实验室信息管理系统）、ERP（企业资源规划系统）、eDMS（电子文件管理系统）、ELN（实验室电子笔记本）、用户自行开发的Excel电子表格、用户自行开发的访问应用程序、自动样品处理系统、液相色谱（LC、HPLC）、气相色谱，包括自动进样检测系统（UV, VIS, IR, MS, NMR, 放射性或荧光监测等）、生物分析仪、ECG等Validation

验证

Complex

复杂的

部分翻译如下：

VALIDATION OF COMPLEX COMPUTERISED SYSTEMS

复杂计算机化系统的验证

Note: Mandatory requirements in this guideline and its annexes are defined using the terms «shall» or «must». The use of «should» indicates a recommendation. For these parts of the text other appropriately justified approaches are acceptable. The term «can» indicates a possibility or an example with non-binding character.

注：本指南及其附录的强制要求明确使用“shall”或“must”。使用“should”表示建议。对此，其他适当的合理方法也是可以接受的。使用“can”表示可能或不具约束力的举例。

1. INTRODUCTION

介绍

This is the 2nd Annex of the core document “Validation of Computerised Systems”, and it should be used in combination with the latter when planning, performing and documenting the validation steps of complex computerised systems Excel spreadsheet validation is described in the 1st Annex of the core document and not subjected here.

此为核心文件《计算机化系统验证》的第二个附录，当计划、执行和记录复杂计算机化系统验证时，应与其一起使用。EXCEL电子表格的验证见附录一，本文不适用。

2. USER REQUIREMENTS SPECIFICATIONS (URS)

用户需求规范（URS）

The selection and purchase of new software and the associated computer and laboratory equipment should follow a conscious decision-making process based on the requirements for the intended use of the computerised system. A User Requirements Specification (URS) should describe the functional and technical requirements of the computerised system, as defined by the OMCL, in terms of both software and hardware. It should also cover the aspects of information security and

data integrity.

新软件和相关计算机和实验室设备的选择和购买应遵循基于计算机化系统的既定使用需求的决策程序。用户需求规范（URS）应描述计算机化系统软件和硬件的功能和技术要求。同时，应包括信息安全和数据可靠性方面的要求。

Some of the items that can be included are:

包括：

a) Description of the software used (e.g. Excel, Access, Oracle), including version;

软件的描述（如EXCEL、Access、Oracle），包括版本

b) Requirements on hardware components and operating system;

硬件配件和操作系统的要求

c) Description of functions;

功能的描述

d) Description of the attributes of data;

数据属性的描述

e) Terminology (e.g. important especially for the consistent description of input masks /fields);

专业术语

f) Database design, including masks and fields as well as a map of the data relationships;

数据库设计，包括mask和field以及数据关系图

g) Specifications of macros, formulas and control commands;

宏指令、公式和控制命令的规范

h) Specifications of the data inputs (e.g. format, decimal places, units);

数据输入的规范（如格式、小数位数、单位）

i) Specification of the mandatory fields for data;

数据必填项目的规范

j) Specifications of the protection of masks, working sheets or the whole application;

Mask、工作表或整个应用的保护

k) Planning of the data migration, if applicable;

数据迁移的计划，如适用

l) Specifications for traceability of data entry and changes (audit trail) of interfaces to other system components, if applicable.

数据输入、修改（审计追踪）

The URS shall be released by a responsible person. Changes to the requirements are possible but the changes should be traceable and the URS document should be version controlled or an equivalent system established in order to ensure traceability. New or changed requirements should be communicated to all persons involved.

URS应由具备相应责任的人发行。用户需求可以修改但应可追溯，用户需求文件应进行版本控制或使用具备同等效力的系统以确保可追溯性。新增或修改用户需求应向所有相关人员沟通。

3. INSTALLATION QUALIFICATION (IQ)

安装确认（IQ）

The correct installation of the system in the IT environment with defined hardware and operating software shall be documented and tested. Detailed installation procedures should be available and carried out by well-trained personnel only.

系统硬件和操作软件在IT环境的正确安装应被记录并测试。应有详细的安装规程并只能由受良好培训的人员实施。

Checklists with predefined installation steps and acceptance criteria can ensure the correct installation of the system and the traceable qualification of the installation.

检查表，包含既定安装步骤和接受标准可以保证系统的正确安装和安装确认的可追溯性。

In most cases, the computerised system is connected to a computer network with interfaces to other software (other applications) and hardware (computer equipment or laboratory equipment). It must be ensured that the system is correctly integrated and that all components are operative.

大多数情况下，计算机化系统通过界面与计算机网络连接到其他软件（其他应用）和硬件（计算机设备或实验室设备）。应确保系统正确完整，所有部件可用。

The IQ typically includes:

IQ通常包括：

a) A check of the required system resources both of the server and client, when applicable (e.g. supported operating system, database engine, performance of the processor, free space on the hard disk, memory, access rights for installations);

检查系统资源，包括服务器和客户端，如适用。（如支持的操作系统、数据库引擎、处理器性能、硬盘可用空间、内存、访问权限）

b) Documentation of the components of the system (as a minimum, a description of the components and version of the relevant components with date of implementation);

系统部件的文件记录（至少描述部件和版本）

c) List of users or user groups with access to the application, including type of access;

可用访问应用的用户或用户组清单，包括访问类型。

d) Integration test and/or communication test for the interfaces to other systems/equipment.

与其他系统/设备的接口的连接测试和/或通讯测试

Often the installation is supported by the supplier and the internal IT unit.

通常，安装由供应商和内部IT部门支持。

4. OPERATIONAL QUALIFICATION (OQ)

运行确认（OQ）

The proper functioning of the software shall be checked by testing the key functions, e.g. calibration and quantification (internal standards, external standards), peak identification, and calculation of system suitability parameters.

软件的正常运行应通过测试关键功能来检查，如校准和定量（内部标准品，外部标准品）、峰鉴定和系统适应性参数的计算。

Ideally, a raw data set can be used for which the results are known. These raw data sets are often provided by the supplier of the software, are processed by the software and the results are then compared to the expected values.

理论上，可以用一组已知结果的原始数据序列进行测试。这些原始数据序列通常由软件供应商提供，通过软件处理，结果与预期数值对比。

If no such data sets are available, example raw data sets can be acquired by running typical samples. The results of the processed raw data sets should be verified by recalculating the key parameters (e.g. calibration curves from peak areas of standards) using standard (e.g., spreadsheet) software.

如果没有这样的数据序列，可以通过运行典型的样品来获取原始数据序列。这些原始数据序列的结果应使用标准软件（如电子表格）验算关键参数（如标准品的峰面积校正曲线）。

Raw data from the testing of functions affecting the measurement result and its associated measurement uncertainty (input and output data, screenshots) shall be documented within the qualification report.

功能测试的原始数据影响测试结构，其相关测量不确定度（输入、输出数据，截屏）应被记录于确认报告中。

Operational qualification should be repeated in a risk-based approach after installation of new software modules, new software versions, new service packs, patch updates, or after major changes in the software structure of the computer (e.g. new anti-virus software). A similar approach should be taken for every change in hardware platform or system upgrades.

在安装新的软件模块、新的软件版本、新的服务程序包、补丁更新后，或在计算机的软件结构发生重大变更后应基于风险进行运行再确认。对于每次硬件平台的变更或系统升级，也应采取类似的方法。

5. PERFORMANCE QUALIFICATION (PQ)

性能确认

The aim of the performance qualification is to demonstrate that a computerised system is suitable for its intended purpose in the user’s own environment as defined in the URS. The user requirements shall be tested in the PQ phase to cover the overall business use of the system in the daily routine.

性能确认的目的是证实计算机化系统在用户自身环境下符合其URS中定义的用途。应在PQ阶段测试用户需求，覆盖系统日常事务中的总体业务应用。

The PQ typically includes:

PQ通常包括：

a) Tests of functions (e.g. with a data set to ensure each feature of the application is tested);

功能测试（如使用数据序列确认应用软件的每一个特性）

b) Negative or limit test (e.g. input of values outside the specified range);

负面或边界测试（如输入超出规定范围的数值）

c) Test of alarm displays, if applicable (e.g. display of an OOS result);

报警显示测试，如适用（如OOS结果展示）

d) Unauthorised input of data and access to the application;

数据非授权输入和应用软件非授权访问

e) Tests of aberrant data (e.g. input of data in the wrong data format);

异常数据测试（如输入错误格式数据）

f) Backup system and restore test;

备份系统和恢复测试

g) Verification of data migration, if applicable;

数据迁移确认，如适用

h) Conformity with requirements of data protection, if applicable;

数据保护是否符合要求，如适用

i) Black box test as acceptance testing of the whole system.

黑盒测试作为整个系统的可接受性测试

Each test scenario should be traceable to the URS being tested and should describe the expected results, the acceptance criteria and the observed results. Each deviation from the expected results and acceptance criteria must be discussed in the test report. A deviation can either lead to a change in the system and the test being run again or be accepted and documented with an update of the corresponding URS. Raw data from the testing (input and output data, screenshots) shall be documented within the qualification report.

每一个测试均应可以追溯至URS并应描述预期结果、接受标准和测试结果。所有不符合预期结果和接受标准的偏差均应在测试报告中论述。偏差可能引起系统变更并重新测试，也可能判定可接受并记录，更新相应的URS。应在确认报告中记录测试的原始数据（输入、输出数据，截屏）。

6. RELEASE FOR USE

放行使用

A summary of all the test findings shall be presented in a validation report, including any deviation and the corrective actions taken. When all deviations are resolved or accepted, a formal release of the system is issued.

验证报告应总结所有测试的结果，包括所有偏差和采取的纠正措施。当所有偏差均得到解决或接受后，系统才可以正式放行。