Design Qualification Document-SAMPLE

Design Qualification of TruScan Raman

Handheld Spectrophotometer

SOP ID:

Revision:

Issue date:

Page 1 of 25

1 OBJECTIVE .................................................................................................................................................... 1

2 REFERENCE MATERIAL ............................................................................................................................... 2

3 ROLES & RESPONSIBILITIES ...................................................................................................................... 2

4 PRODUCT FUNCTIONAL REQUIREMENTS FOR TRUSCAN RAMAN HANDHELD

SPECTROPHOTOMETER ...................................................................................................................................... 2

4.1 Introduction .............................................................................................................................................. 2

4.2 System Description Overview .................................................................................................................. 2

4.3 Basic Theory ............................................................................................................................................ 2

4.4 Instrument Overview ................................................................................................................................ 3

5 GMP AND ER/ES ............................................................................................................................................ 4

6 TECHNICAL REQUIREMENTS ...................................................................................................................... 4

6.1 Instrument/Basic Operational Design ...................................................................................................... 5

6.2 IT Infra structure (computer hardware, operating system) ...................................................................... 9

6.3 Application software................................................................................................................................. 9

6.4 Methods and parameters ....................................................................................................................... 10

6.5 Data collection / data entry .................................................................................................................... 11

6.6 Report .................................................................................................................................................... 12

6.7 User properties and access ................................................................................................................... 13

6.8 User account and password management ............................................................................................ 14

6.9 Data integrity / audit trail ........................................................................................................................ 15

6.10 Data backup and restore ....................................................................................................................... 18

6.11 Data transfer (export/import) ................................................................................................................. 18

6.12 Safety ..................................................................................................................................................... 18

6.13 Supplier’s quality system ....................................................................................................................... 19

6.14 Documentation requirements ................................................................................................................ 20

6.15 Service and support ............................................................................................................................... 20

6.16 Training .................................................................................................................................................. 21

6.17 Delivery and installation ......................................................................................................................... 22

6.18 Qualification services ............................................................................................................................. 23

7 DEFINITIONS ................................................................................................................................................ 24

8 MODIFICATION / CHANGE CONTROL ....................................................................................................... 25

9 APPROVALS ................................................................................................................................................ 25

1 OBJECTIVE

The objective of the document is to provide the owner of this document with the critical design qualification criteria for

TruScan Raman Handheld Spectrophotometer for design, reliability, performance and compliance. Specifications are listed

in terms of the design specification requirement, a brief summary justification for the need for the requirement and a

summary explanation of how the design specification was implemented in the product.



SOP ID:

Revision:

Issue date:

Page 2 of 25

2 REFERENCE MATERIAL

The reference materials used to develop the critical design qualification criteria are Ahura Scientific’s internal documents

developed during the initial design of the TruScan such as the User Requirement Document, the System Requirement

Document. These documents are archived under electronic format at an off-site secure location and area available on

demand provided that a non disclosure agreement is signed between Ahura Scientific and the demander.

3 ROLES & RESPONSIBILITIES

It’s the responsibility of QC management to insure that all the validation steps have been executed properly and that all the

documentation pertinent to the validation of the TruScan Raman Handheld Spectrophotometer are available for subsequent

inspection.

4 PRODUCT FUNCTIONAL REQUIREMENTS FOR TRUSCAN RAMAN HANDHELD

SPECTROPHOTOMETER

4.1 Introduction

The TruScan instrument is intended to simplify and secure the receiving goods control of raw materials and packaging

material at pharmaceuticals manufacturing facilities.

The raw materials above are used to produce pharmaceutical products and therefore the instrument must fulfill the

requirements of a pharmaceutical industry. The various physical forms of raw materials to be analyzed consist of:

- Solids (fine powder, micronized powder and granules)

- Liquids (high viscosity and low viscosity)

- Capsule gels (semi-finished product; oil base filled into capsule)

The Ahura Scientific TruScan Raman analyzer is designed for the non-contact analysis of active pharmaceutical ingredients

and excipients for identification purposes. The Raman analyzer is completely self-contained, operating on battery power

(small lithium ion rechargeable cell), and housed within a rugged and sealed enclosure. The unit is constructed with a

stabilized 785-nm solid-state laser source, an integrated imaging module, and a 2048-pixel diode-array-based spectrograph.

All electronics, including a single-board processor, also are fully integrated. The user interface is a simple set of push-

button controls linked to a menu-driven color liquid crystal display. A chemometrics-based spectral search package is

included that provides conclusive identification.

4.2 System Description Overview

The Raman analyzer system is designed to support process development and production of pharmaceutical products. The

system is a hand-held device and operated through a set a push buttons and configurable to operate through a PC. The

output is through the color liquid crystal display and may be communicated over a network. The Raman analyzer operates

by illuminating the materials in a container with a laser and collecting and analyzing the scattered light.

4.3 Basic Theory

Raman spectroscopy is a form of vibrational spectroscopy and as such is related to near- and mid-IR absorption

spectroscopy. Similar to the IR absorption techniques, Raman spectroscopy measures the vibrational frequencies of various

parts of a molecule. These frequencies depend on both the bond strength and mass of the bound atoms as well as other

factors such as intermolecular interactions. The 'pattern' of vibrational frequencies from a molecule is, therefore, highly



SOP ID:

Revision:

Issue date:

Page 3 of 25

characteristic of a given molecular species and, for solid samples, of the crystalline arrangement of those molecules. Raman

spectra may be readily recorded from gasses, liquids and solids.

While IR spectroscopy is essentially based on illuminating the sample with a broad range of wavelengths of IR light and

measuring which are absorbed, a Raman spectrum is obtained by illuminating the sample with a single wavelength of light

from a laser and collecting and analyzing the resulting scattered light. Briefly, the basic experimental arrangement to

perform Raman spectroscopy includes the following steps:

- To obtain a Raman spectrum the sample is illuminated with light from a laser.

- The molecules in the sample 'scatter' the incident laser light. Some of this scattered light contains detailed

information about the molecular properties of the sample.

- The scattered light is collected and analyzed using a Raman spectrometer to produce a Raman spectrum.

- Raman spectra are generally clear, well resolved and rich in features facilitating detailed and unambiguous

interpretation.

- The spectra contain large amounts of information about chemical composition, intra- and intermolecular

phenomena, and the longer range structure of a sample.

4.4 Instrument Overview

4.4.1 System overview

The figure below shows the TruScan instrument. The shaded box in figure 2.1 highlights the parts covered by the Product

Functional Requirement Specifications in this document (the TruScan instrument and its Syncserver application). The user

access levels Admin and Developer need access to a web browser (Internet Explorer – IE).

Detailed system component requirements are stated this Chapter.

Figure 4.1 Overview of the TruScan instrument.

TruScan

Instrument

PC/IE

Sync application

on server/PC

Printer Archive

Network



SOP ID:

Revision:

Issue date:

Page 4 of 25

4.4.2 Operational process

The proposed use of the instrument is:

1. User creates and validates methods. Methods are stored in the instrument.

2. To perform ID verification, user chooses Identification method.

3. User performs ID verification of incoming goods with TruScan.

4. User connects TruScan to network for transfer of result files and reports.

5. Electronic data (result files) are stored on a network data drive for archiving and further processing (such as

signature, second review…)

Data and document created during system use:

• Instrument test data (yearly test and daily test performed by Users)

• Raw data (spectral data and calculated data in the report files)

• Reports (printed report files)

5 GMP AND ER/ES

The TruScan instrument will be used at manufacturing facilities within pharmaceutical organizations, in an area controlled

by Good Manufacturing Practice (GMP) for pharmaceutical production.

The TruScan instrument collects electronic data in GMP environment. The electronic data collected in such environment

must closely follow 21 CFR part 11 Electronic Records & Electronic Signatures (ER/ES) guidance. TruScan complies with

all the 21 CFR part 11 Electronic Records & Electronic Signatures (ER/ES) rules.

Detailed requirements on system and data security are stated in chapter 6 Technical requirements section System and

computer security.

6 TECHNICAL REQUIREMENTS

(Requirements marked with * are GMP requirements)

Operational Performance and –Basic Design

Continued next page



SOP ID:

Revision:

Issue date:

Page 5 of 25

6.1 Instrument/Basic Operational Design

ID Requirement description Implementation in TruScan

6.1.1

Device must Identifies the solids and liquids raw

materials with PASS/FAIL decision and Raman

Spectroscopy

TruScan can identify solid and liquids with

PASS/FAIL decision by Raman spectroscopy. The

TruScan can return some other possibilities and

their probabilities of match if the result was a FAIL.

6.1.2 Device must be identifying materials without

sample preparation

The TruScan can identify materials without sample

preparation

6.1.3

The device must be fitted to use a variety of

power sources.

The system is battery powered or mains powered

via a supplied universal voltage transformer unit.

The transformer unit can use 100 – 240 V, 50 or 60

HZ power when mains powered or for battery

recharging. Battery operating life is no less than 5

hours of continuous use. Battery can be swapped

very easily without tool.

6.1.4 Power Indicator. Visual indication of the battery

power must be present on the device

TruScan displays the battery power level (bars) on

its screen.

6.1.5 Power-Power Savings. Device must have an

inactive power mode to minimize power

consumption when not in use.

TruScan can be put to sleep during inactivity

period. The sleep mode can also be triggered

automatically if the unit is not in use for a defined

period of time.

6.1.6 Power –Low Power Warning. Device must warn

user when battery is running low. Subsequently,

device must be able to soft shut down

automatically

TruScan battery indicator turns read when the

TruScan device is running out of battery. TruScan

will soft shut down automatically if battery is

running low.

6.1.7

Power hard off. Device must be able to

successfully handle a recovery from a brutal

power interruption

TruScan was tested to recover from a power hard

off. However, soft shutdowns are recommended by

the manufacturer. Windows CE and the TruScan

internal software architecture have been designed to

withstand a hard off .

6.1.8

Device must be equipped with a permanently

mounted sign or equivalent that contains:

supplier name, model and serial no and technical

data (voltage, frequency etc).

Instrument is fitted with a permanently mounted

label stating supplier name, model, and serial

number. Power technical data details are molded-

in to the case next to the power input connector (9

VDC, 1.5 A) (power at instrument coming from

universal voltage transformer).

6.1.9 If the instrument contains firmware, its identity

and version must be clear either from a label or

readable on the instrument (display or in the

system).

Instrument Firmware Version is available on

instrument screen for administrator access under

Tools>Settings>Support>Ver

6.1.10 Environmental noise such as Environmental

Light and Stray Light: Environmental light/Stray

Light must not be interferencing with

measurement.

Environment conditions such as neon light or sun

light are considered incertitude and are measured

automatically. TruScan adjust stray light and dark

current automatically.

6.1.11 Detector

In-house manufactured 2048 element silicon CCD

TE cooled detector

6.1.12 Device must have a Raman excitation laser

wavelength between 700 and 800 nm.

TruScan’s excitation laser wavelength is 785 +/-

0.5mm, 2 cm-1

linewidth.



SOP ID:

Revision:

Issue date:

Page 6 of 25

6.1.13 Laser output must be less than 500 mW

Laser is a class3B laser. Laser output is

approximately 350mW or lower.

6.1.14 Source life must be adequate so as to not require

frequent changes.

>10,000 hrs MTBF corresponding to about

2,000,000 ‘runs’ or 1and ½ year of continuous laser

operation MBTF

6.1.15 Device must acquire Raman Spectra in the range

of at least 260cm-1

to 2800cm-1

.

TruScan’s spectral range is at least 250cm-1

to 2875

cm-1

.

6.1.16 Device must have a spectral bandwidth of

≤15cm-1

.

Spectral bandwidth or spectral resolution is 7-10

cm-1

.

6.1.17 The supplier must give suggestions for tolerance

limits for instrument test procedures.

Instrument self-test procedures are built-in to

instrument, and tolerance limits are embedded in

test procedures. These are not user-modifiable.

6.1.18

The system must have performance

characteristics for spectrometer noise, LOD,

LOQ and spectral bandwidth that meet the

acceptance criteria for USP 1120 Raman

qualification protocol and USP 1220 for

validation of analytical methods.

TruScan is designed to perform category IV assays

(identity tests) as detailed in USP <1225>. USP

<1225> indicates that the only data element

required for category IV assay method validation is

specificity. As such, LOD and LOQ are not

relevant. Additionally, spectral bandwidth and

spectrometer noise are not settable/alterable on

TruScan, so it is Ahura Scientific’s interpretation

that the DQ and method validation will be sufficient

to demonstrate sufficiency for the intended use.

6.1.19 Device must be supplied with a statement

referring to the capability of being moved about

to make measurements in various localities

without detrimental effects to performance.

Device must withstand shock and vibration

caused during mobilization and analyzing

activity to maintain accuracy and reproducibility

of results

TruScan is fully handheld and fully portable. It

weighs less than 3 pounds. The TruScan enclosure

form factor measures 12.5 x 5.88 x 3.14 in. It can be

used in any orientation and moved around to be

used at the point of need. The instrument has been

designed for field usage and is not susceptible to

vibration, temperature and shocks.

6.1.20 Device must read material bar codes used at

pharmaceuticals facilities and insert that

information into the data file and the result

report.

Code 39, code 93, code 128, EAN-13, UPC-A,

interleaved 2 of 5 are supported by TruScan

6.1.21 Device must be CE Rating TruScan is CE rated

6.1.22

Device must be supplied with suitable

accessories for measuring solids, powders and

liquids

TruScan is supplied with a nose cone shield that

assists in positioning materials for point and shoot

analysis. TruScan can be used with this accessory to

test solids, liquids and powders. The separate

purchase of a vial holder and tablet holder facilitate

the testing of chemicals in these forms. TruScan can

analyze materials through clear vial, amber vials,

plastic double bags and other transparent containers.

6.1.23 The device must be able to be cleaned with no

detectable damage with the following cleaning

agents: Ethanol; 1% detergent, 5% bleach

aqueous solution

Ethanol, 5% bleach and detergent are perfectly

acceptable cleaning agents for the TruScan unit.

6.1.24 The device must minimize the risk of cross-

contamination

Plastic sleeves for TruScan are available to prevent

cross-contamination



SOP ID:

Revision:

Issue date:

Page 7 of 25

6.1.25

Device must meet USP, NIST and ASTM

requirements for compliance and be supplied

with:

Primary wavelength accuracy (x axis) calibration

check and standards traceable to a national

standards.

Raman laser wavelength accuracy calibration

check and standards

Signal level(y axis) calibration checks and

standards traceable to national standard.

TruScan complies with the requirements of

USP<1120> Raman spectroscopy and its reference

to NIST and ASTM as they pertain to identity

testing (qualitative analysis; note that significant

portions of <1120> only apply to a quantitative

analysis).

Pursuant to the guidance in the ISPE/AAPS/FDA

document “Qualification of analytical instruments

for the use in pharmaceutical industry: A Scientific

Approach”(AAPS PharmSciTech Vol 5, art

22(2004)) and the new USP general chapter <1058>

Analytical instrument qualification (USP 31-NF

26First supplement) the TruScan uses the preferred

holistic evaluation in its ”test function” which tests

all TruScan subsystems in concert to assure that the

instrument is operating in a manner consistent with

its intended use for material identity testing. This

holistic evaluation encompasses 12.1,12.2 and 12.3.

This test is conducted using a polystyrene rod (or

acetaminophen, benzonitrile, acetaminophen,

cyclohexane: ASTME1840 materials) provided by

Ahura as part of its standard offering. All references

come with a certificate of analysis.

If desired, the user can set up additional methods

using ASTM E1840 materials and/or their own site

materials for the purposes of PQ and/or system

suitability testing.

Detailed statements of compliance with US<1120>,

EP 2.2.48 and 21 CFR part 11 are available as

supporting documentation.



SOP ID:

Revision:

Issue date:

Page 8 of 25

6.1.26

User must be able to perform calibration of the

device

TruScan does not need to be recalibrated on a

regular basis. TruScan is calibrated at the factory

directly in accordance with ASTM E1840-96

(2002). Cyclohexane, acetonitrile, and toluene

bands are used to define the x-axis calibration of the

system, and this calibration is subsequently verified

with cyclohexane, acetonitrile, toluene,

acetaminophen (4-acetomidophenol), and

polystyrene. (All five (5) of these materials are

recommended in ASTM E1840-96 (2002)). The

laser is also directly calibrated to zero (0)

wavenumbers at this time, and continuously

monitored thereafter with automated compensation

in software.

The procedure using atomic emission lamps is

common for laboratory spectrometers with tunable

gratings and lasers (for convenient field realignment

and calibration). TruScan’s spectrometer

components are fixed-in-place and hermetically

sealed and can not be field adjusted. A neon atomic

lamp internal to TruScan is simply used to monitor

the calibration in the context of intended use for ID

testing. This function is performed as part of the

“Test” system suitability function on TruScan. A

performance test can be executed to verify and

certify the performance of the TruScan. Protocols

and Standards kit are available.

TruScan is not designed for quantitative analysis.

To enable method transfer between instruments

TruScan is calibrated at the factory using an

externally-placed white light source in full

accordance with ‘method A’ in <1120>.

Furthermore, TruScan is not a laboratory

instrument. TruScan includes a “Test” function that

employs an external polystyrene sample to evaluate

system suitability at the standard point of sampling.

Performance qualification (PQ) regimes may, at the

customer’s discretion, use additional samples.

6.1.27 Device must prompt for preliminary System

Suitability checks before use.

There is no prompt. Before each run, a system

check is automatically performed to insure reliable

data.

6.1.28 Device must be able to be used by non-scientific

operators such that the operator is taken through

a device controlled measurement sequence

TruScan’s embedded workflow software ensures

the correct standard operating procedure or method

is followed for each sample.

6.1.29 Software applications must be configurable in

regard to acceptance limits for Pass/Fail

recognition

The software is not configurable in regard to

acceptance limits Pass/Fail recognition.



SOP ID:

Revision:

Issue date:

Page 9 of 25

6.2 IT Infra structure (computer hardware, operating system)


6.2.1

Handheld device must allow secured

communication with PC/server directly or

through a LAN

TruScan can be networked to a computer through a

cross0ver cable or through a LAN using TCP/IP

protocol. TCP/IP protocol ensures the integrity of

the data and a fail-proof connection. Data generated

on TruScan can be transferred to a PC or a server.

6.2.2 The Transfer application must work on

computers with operating systems Windows

2000, Windows Vista or Windows XP.

Sync application has been tested on computers with

Windows XP Professional installed and Windows

2000 as well as Vista. It is anticipated that it will

also work on windows 7.

6.2.3 It must be possible to use Antivirus program

on the PC/server where the Transfer

application is installed.

Ahura Scientific has run the Sync server software

on computers with Symantec (Norton) Antivirus

Version 10 installed and no problems have been

encountered.

6.2.4

Device must permit the upgrade and update

of the antivirus program.

It is anticipated that Sync will remain compatible

with future Symantec (Norton) Antivirus products,

or that Ahura will issue a new version of Sync that

is compatible with new releases of Symantec

Antivirus products, but without knowledge of future

functionality an absolute guarantee cannot be given.

6.3 Application software


6.3.1

Optional. User properties within the

application software should be connected to

the global user groups in the Corporate

network.

TruScan software is self contained, and does not

have a facility to interrogate corporate user group

database, therefore it cannot access details of

individual users or user groups, and cannot use

those details to configure TruScan user identities

and access privileges.



SOP ID:

Revision:

Issue date:

Page 10 of 25

6.4 Methods and parameters


6.4.1 Device must have a storage capacity to store

identification methods

TruScan has a 1GB storage capacity to store

methods and scans.

6.4.2 * It must be possible to protect / lock methods. Access to methods is permitted only to users with

Developer and Administrator access privileges,

under password protection. There is no separate

password-controlled lock for each method. All

modifications of methods are recorded, together

with identification of modifying user, in the audit

trail.

6.4.3 * Optional. It should be possible to enter a

comment when changing methods or

parameters.

Not possible at present. Note that a method history

can be stored as an html file in the method folder.

6.4.4 *

The system must create a new version of the

method (parameter set) when it is changed;

alternatively log the change in an audit trail

(event log).

The audit log records that the method has changed,

but not what was changed in the method. Method

information is captured elsewhere:

Every time a method or self-test is run, a full

electronic record is created with a snapshot of all of

the relevant information, including the complete

method information.

6.4.5 * It must be possible to print a summary of the

method elements and parameters.

Method summary is available at the Method

Management page in the WebAdmin program.

6.4.6 * The device must give a warning for and report

of communication problems identified during

sync process.

Instrument connection icon on TruScan screen turns

red when attempting to sync but failing to connect

to SyncServer. Sync Error screen reports connection

failure and type (e.g. no host detected).

6.4.7

Optional. Naming of files should be

configurable to contain information on:

• Sample ID

• Barcode

• Method name

• User

to facilitate searching and sorting of result

files.

Sync filenames are configurable (by Administrator)

to include fields:

• SampleID

• Barcode

• Method Name

• User

• Unit Serial No. (always included)

• Pass/Fail

Administrator can also specify which field will

form the first part of the filename.



SOP ID:

Revision:

Issue date:

Page 11 of 25

6.5 Data collection / data entry


6.5.1 * The system must insure that data generated by

the device can be traced to its source (identity

of user, instrument, and software).

Identity of user, instrument serial number, and

software version are embedded in all run and test

data files.



SOP ID:

Revision:

Issue date:

Page 12 of 25

6.6 Report


6.6.1 * Reports must be printable.

The following must be clearly indicated on

every printed page:

• Instrument identity,

• Page number and total no of pages,

• Date and time of measurement

• User identity.

Reports are stored in .pdf and .jpg file formats, both

of which are printable.

Reports include Device serial number, date of

measurement, time of measurement, user identity.

All reports are single page reports, and do not have

a page number.

6.6.2 * The report must contain identifier, for

example Sample ID; to ensure that report can

be traced to its sample.

All reports include Sample ID

6.6.3

Reports must contain:

• Method name

• Raw data (spectrum as a figure)

• Results

• Audit Trail (AT) for the above data.

Reports include:

Method name

Raw data (spectrum and reference spectrum as

overlaid figures

Result (PASS or FAIL).

Audit trail data in report includes:

User name

User login date and time

Instrument serial number

Instrument software version

Instrument last self-test date and time

Instrument last self-test result (PASS or FAIL)

Instrument warnings in force

Method name

Run label

Run calibration test result

Run CCD check result

Run laser power check result

Run date and time

Sample ID

P value

Result (PASS or FAIL)

User note

6.6.4 * The instrumented must log data (time, event,

and user) automatically for every step in a

measurement.

Data is logged (to report and audit log) on

completion of the measurement.

6.6.5

Optional. An administrator should be able to

create, change or remove report templates.

Administrator cannot modify report templates.

Administrator can specify which file formats will be

stored on Sync (Ahura binary format (.ASO)

compulsory; .pdf, .jpg, .txt. .spc are optional).

6.6.6 * Users must not be allowed to change report

templates.

User access privilege level cannot modify report

templates.



SOP ID:

Revision:

Issue date:

Page 13 of 25

System and computer security


6.7 User properties and access


6.7.1 *

Tiered User access with password must ensure

that only duly authorized user can have access

to the device. The different access levels must

insure that method development/modification

and device settings are restricted to select

groups.

3 user access levels exist:

Administrator

Developer

User

All authorized users must be allocated to one of

these levels. Administrator has access to all the

functionalities of TruScan, Developer has access to

method development functionalities and user has

access to run functionalities.

6.7.2 * Optional. It should be possible to show

access levels and their configurations (what

permissions are connected to each access

level) in the system and on a printout.

The administrator can view and print a summary of

unit users and their access levels from the Web

Administration (WebAdmin) interface. Access

levels and their configurations are detailed in the

User Manual, section 4 Menus.

6.7.3 * User authorization must be checked both

when logging directly in the instrument and

when using the web interface.

User name and password checks control direct

access to the instrument and access via the

WebAdmin interface.

6.7.4 * Screen saver on computer must be password

protected.

Standard setting for computer shall fulfill the

requirement. Computer setting should be set up by

IT personnel of the purchasing organization

6.7.5 * Computer screen saver must be activated after

10 minutes of user inactivity.




6.7.6 * The instrument must have a configurable

inactivation setting.

An Administrator can configure the unit to require a

new login after a settable inactivity time of 5 to 30

minutes.

6.7.7 * The computer screen saver must have a

function for manual activation.






SOP ID:

Revision:

Issue date:

Page 14 of 25

6.8 User account and password management


6.8.1 * Users must be configured in the application

with unique names.

Identical names cannot be simultaneously active on

the instrument.

6.8.2 * It must not be possible to delete users, only to

inactivate them.

An Administrator can Inactivate or Delete a user

from the system (an action which is audited in the

system logs).

6.8.3 *

The system security function should give

possibility to configure security principles for

users.

The following settings should be configurable:

• Password validity time (recommended is

3 months).

• Minimum password length

(recommended is 6 characters).

• Number of passwords remembered in

password history per user (recommended is

5).

• Number of failed password entries until

locking (recommended is 3).

TruScan does not impose a limitation on user

password validity time. The establishment of and

adherence to such controls should be assured by

external measures.

TruScan does not impose a minimum password

length. The establishment of and adherence to such

controls should be assured by external measures.

TruScan does not record previously used

passwords. The establishment of and adherence to

such controls should be assured by external

measures.

Administrator can set the number of failed

password attempts permitted before locking access

to the instrument. Administrator can specify that,

once locked, unlocking is by manual action of the

administrator, or by automatic release of lock after a

period of time configured by an Administrator.

6.8.4 * Users must be permitted to change their own

passwords.

Users can change their own passwords on the

instrument without Administrator intervention.

6.8.5 * It must be possible to print a list of current

users.

Administrator can print a User Summary report

from the WebAdmin interface.



SOP ID:

Revision:

Issue date:

Page 15 of 25

6.9 Data integrity / audit trail


6.9.1 * The system must secure that data cannot be

overwritten.

Data cannot be overwritten. If data storage capacity

is full, instrument will refuse to make further

measurements.

6.9.2 *

The device must ensure that data is securely

stored to prevent any tempering deleting or

overwriting attempt. Every change to methods

should be managed through version handling

or an audit trail.

TruScan automatically generates audit trails.

Electronic records cannot be changed once created.

TruScan also maintains a system configuration

audit trail that documents changes made to the

system configuration by developers and

administrators.

Audit trails are delivered to a secure location

(identified by the system administrator in the device

configuration) for permanent storage.

6.9.3 * The system administrator must not be able to

change or delete electronic records (raw data,

reports etc) without this being automatically

traced to the individual.

System administrator cannot change raw data or

reports on the system.

All changes to configuration (users, methods,

settings, etc) are recorded in audit log with user,

date-time details.

6.9.4 * The system clock function of the instrument

that registers time in event logs (for example

access log, audit trail) must not be changeable

by any user.

Administrator can change system clock function.

6.9.5

The system clock function must use Windows

standard format for date and time.

The unit uses the following date format:

mm/dd/yyyy hh:mm pm or dd-mmm-yyyy hh:mm



SOP ID:

Revision:

Issue date:

Page 16 of 25

6.9.6 *

The system must automatically register/log

events in an audit trail, when the user creates,

changes or deletes Electronic Records (raw

data, reports etc).

The unit records in an audit log that the following

events occurred, when they occurred (date and time)

and who initiated the event:

USER EVENTS:

User lock-out

Successful unit login

Failed unit login

Unit logoff

successful web login

failed web login

web log off

user password change

user modified (any modification)

user added

user delete

SIGNATURE EVENTS

active signatures import

active signatures export

active signature add

active signature rename

active signature delete

active signature rename

METHOD EVENTS

method added

method modified (any modification)

method run

method delete

OTHER:

configuration import

configuration modified

note list modified

self-test run

It is not possible to delete raw data, reports, or audit

logs on the system.

6.9.7 *

The system should make possible for the user

to enter a reason for change/delete of ER.

Not applicable. Raw data, reports and audit logs

cannot be changed or deleted by users on the

system. They can be transferred to a location

specified by the administrator during the

synchronization process.



SOP ID:

Revision:

Issue date:

Page 17 of 25

6.9.8 * Audit trail should have at least the following

contents:

• Identity of user who performed activity to

create, change or delete information.

• Date and time when this happened.

• The event that created changed or deleted

the information.

• The reason for the change.

Audit trail includes:

Identity of user who performed activity to create,

change, or delete information.

Date and time of creation, change or deletion of

information.

The category of the information created, changed or

deleted (e.g., Method, User, Configuration setting).

It is not currently possible to record a reason for the

change.

6.9.9 *

New events must not overwrite previously

registered events in the audit trail.

Between Syncs, new events are appended at the end

of the audit log file, and do not overwrite previously

registered events.

During Sync, after confirmation of successful

transfer of the existing audit log file to the secure

archive, the existing Sync file is erased and a new

audit log file is created which will be used until the

next Sync.

6.9.10 * No shutoff of audit trail function must be

possible when the system in use. Audit trail function cannot be switched off.

6.9.11 * It must not be possible for a user to change or

delete audit trail or parts thereof.

The audit log file cannot be amended or deleted in

the system.

6.9.12

Audit trail should be searchable for records,

users, date, time and for type of event.

The audit log file is not accessible to users on the

system. Once transferred to the secure archive, the

audit log file is a text file that can be searched using

a text editor.

6.9.13 * Audit trail must be retrievable in electronic

form as well as in paper printout.

The audit log file is an electronic file that can be

printed once accessed from the secure archive.



SOP ID:

Revision:

Issue date:

Page 18 of 25

6.10 Data backup and restore


6.10.1 * Electronic data and reports must be copied to

another physical storage unit with “X”

equaling number of days interval.

User’s organization must have plan for backing up

data and this plan must be followed the drives and

servers containing the data related to TruScan.

6.10.2 * Electronic data and reports must be

restorable with full integrity from another

physical storage unit.

User’s organization must restore data to network

drives when necessary using the backup plan in

place.

6.11 Data transfer (export/import)


6.11.1 The system must be able to create and store

electronic data and reports in the following

formats: JPEG, PDF, TXT and SPC.

Electronic data and reports can be stored in Ahura

proprietary binary format (.ASO), and in JPEG,

PDF, TXT, and SPC formats.

6.11.2 PDF files should be readable with Adobe

Acrobat Reader version 7.01.

PDF files are readable with Adobe Acrobat Reader

version 7.01

6.11.3 The system should allow further integration

of the data file into a LIMS system

The TruScan creates electronic records in TXT and

PDF formats. These formats can be exploited by a

LIMS system.

SHE


6.12 Safety


6.12.1

All instrument components must be CE

marked and UL certified

The TruScan instrument, mains power and battery

charging transformers, and the battery charging

holder are all CE marked. The instrument is also

UL913 certified.

It is also UL61010-1 and CSA C22.2 No. 61020-2,

EN 616010-1:03/93 +A2:07/95, FDA CDRH

1040.1 certified.

6.12.2 The instrument must have a suitable warning

label for laser radiation.

The instrument has a warning label stating that it is

a CLASS 3B LASER PRODUCT. It also has

generic laser warning labels near the aperture.



SOP ID:

Revision:

Issue date:

Page 19 of 25

Requirements for supplier and delivery


6.13 Supplier’s quality system


6.13.1 *

The supplier must upon request be able to show

certification and/or documents to describe which

quality system that is used for development of the

system (instrument, hardware and software).

Certification and documents describing the quality

system used for development of the system are

available for inspection at the Wilmington,

Massachusetts, USA headquarters of Ahura

Scientific. Completion of appropriate

confidentiality and non-disclosure agreements may

be necessary for access to these documents. Ahura

Scientific is also ISO certified. Registrar for the ISO

certification is NSAI. ISO certificate has a date of

June 17 2009.

6.13.2 * The supplier must have a system for version

handling of documents supporting the system.

Ahura Scientific has a version control system in

place for control of documents supporting the

system.

6.13.3 *

The supplier must have documented statements

that the application software source code is

available for review by the purchasing

organization or by Purchasing organization’s

inspecting authority (for example FDA, MPA).

Ahura Scientific can supply statements that the

software source code is available for review by the

purchasing organization or inspecting authorities

(for example FDA, MPA) at the Wilmington,

Massachusetts, USA headquarters of Ahura

Scientific. Completion of appropriate

confidentiality and non-disclosure agreements may

be necessary for access to these documents.

6.13.4 * The supplier should have documented records of

training and experience for its software

developers.

Training for all personnel is documented in training

records. Education and experience are documented

in resumes (CV) for all employees, including

software developers.

6.13.5 * The supplier should have documented records (for

example copy of certificate) of training and

experience for any service personnel performing

work at Purchasing Organization.

All training records for Ahura Scientific personnel

are on file in the human resources department of

Ahura Scientific.



SOP ID:

Revision:

Issue date:

Page 20 of 25

6.14 Documentation requirements


6.14.1 *

Technical documentation must be delivered with

the system. It should give foundation for

procedures regarding:

• Calibration/instrument tests and maintenance

• System configuration and administration.

A User Manual is supplied with the system which

describes how to carry out:

Instrument tests

Maintenance

System configuration and administration.

A one–time calibration is carried out at the factory.

No further calibration of the device is needed during

its useful life.

6.14.2 * The supplier must have a description of electronic

records (ER) that the system creates, handles and

stores.

The User Manual describes the run reports and

other records that TruScan creates, handles and

stores.

6.14.3 * Manuals for the use and maintenance of the

instrument must be a part of the delivery. One

manual per instrument.

A User Manual is supplied with the system which

describes the use and maintenance of the system.

6.14.4 Documentation must be delivered in both paper

and electronic format. One set of documents in

paper format per instrument.

The User Manual is delivered in electronic format

and paper format.

6.14.5 Documents in electronic format must be delivered

as PDF files alternatively in Word (DOC) format.

Documents in electronic format are delivered as

PDF files.

6.15 Service and support


6.15.1 * Documentation on which parts of the instrument

needs service and how often must be delivered

with the system.

There are no routine service or maintenance

requirements for the instrument. An annual system

evaluation and recertification of performance is

available.

6.15.2 The supplier must present a service agreement

where checkpoints and service frequency are

specified.

A Service Contract is available on request, at

additional cost. Tiered level services are available.

6.15.3 The supplier must have a support function.

Ahura Scientific provides an internet and telephone

based support function.

6.15.4

The supplier should have telephone support during

purchasing organization’s office hours.

Ahura Scientific provides 24 hour, 365 days per

year telephone support, free for the first 12 months,

and as part of the service contract beyond 12

months.

6.15.5 Optional. The supplier should have telephone

support 24 hours a day, 7 days a week. See above.



SOP ID:

Revision:

Issue date:

Page 21 of 25

6.15.6

The supplier must have a procedure in place to

address problems reported by the purchasing

organization.

Issues are captured, updated and resolved via a web

based issue tracking tool. Customer profiles are

maintained in a database associated with the issue

tracking tool. Customers support manager call

customers on ALL reported issues to determine the

level of support provided, timeliness of issue

resolution, etc…

Software Patches and upgrades will be announced

to the purchasing organization by email and/or

regular mail.

6.15.7 The supplier should guarantee that service and

support is available, even if the agency is

transferred to another supplier, for at least 5 years

from delivery.

Ahura Scientific will guarantee that service and

support packages purchased by the purchasing

organization will remain available for the entire

coverage duration even if the agency is transferred

to another supplier.

6.15.8 There will be at least one year warranty that covers

the function of delivered goods. TruScan is supplied with 12 months warranty.

6.15.9 The instrument must be supported for an extended

period of time

The TruScan will be supported for a minimum of 5

years after the last sale. Parts will be available

during this time period.

6.16 Training


6.16.1 * A basic training on the instrument and the

application must be a part of the delivery.

Instrument training on-site is available upon

purchase of the instrument.

6.16.2 * Instructions in setting up and administration of

user groups for access control in the system must

be a part of the delivery.

Instructions and training in setting up an

administering user access control is included in the

IQOQ purchase and is performed during the visit.

6.16.3 Training must be performed at the latest one

month after approved delivery or at an agreed

time.

Training will be provided within one month of

approved delivery date or at a mutually agreed time.

6.16.4 All training must take place on-site at

The purchasing organization manufacturing sites. Training will take place at on site.

6.16.5 * The supplier should give a certificate or equivalent

of accomplished training to each participant.

A Certificate of Completed Training will be

provided to each trained person.



SOP ID:

Revision:

Issue date:

Page 22 of 25

6.17 Delivery and installation


6.17.1 The instrument must have suitable packaging or in

other ways be protected from damage and

moisture during transport.

The instrument will be delivered in suitable

packaging to avoid damage and moisture during

transport. The instrument is delivered in a “Storm”

Case.

6.17.2 The supplier is responsible for delivery of

instrument and application with associated

software licenses.

Ahura Scientific is responsible for delivery of the

instrument and associated software licenses.

6.17.3 Necessary communication cards and cables for

access and control of the instrument must be part

of the delivery.

All communication cards and cables necessary for

access to and control of the instrument will be

supplied as part of the delivery.

6.17.4 The supplier is responsible for performing the

installation. Installation should be performed at an

agreed time and date.

Ahura Scientific will perform the installation at a

mutually agreed date and time.

6.17.5 The supplier should give time and date for the

delivery in an advance notice. Installation should

be started at the latest 30 days after delivery or at

an agreed time and date.

Ahura Scientific will notify the purchasing

organization of the date of delivery in an advance

notice. Installation will be started within 30 days of

delivery or at a mutually agreed time and date.

6.17.6 * The installation must be performed according to a

documented installations procedure that has been

approved by the purchasing organization in

advance.

The installation will be performed according to a

documented installation procedure that will be

approved in advance by the purchasing

organization.



SOP ID:

Revision:

Issue date:

Page 23 of 25

6.18 Qualification services


6.18.1 The supplier should offer services for installation

qualification (IQ) and operational qualification

(OQ) according to documented procedures.

Ahura Scientific offers services for Installation

Qualification and Operational Qualification

(IQ/OQ), according to documented procedures.

6.18.2

It should be possible for the purchasing

organization to require changes or additions to the

supplier’s qualification documents (IQ/OQ).

At the purchasing organization’s request, Ahura

Scientific will supply a copy of the documented

procedures for IQ/OQ in advance. The purchasing

organization can propose changes or additions to

the procedures for consideration by Ahura Scientific

but we request that the requested changes be

submitted 5 business days prior to scheduled on-site

execution so that we have adequate time to review

the changes, file internal documentation, and plan

accordingly. Significant changes to the TruScan

IQ/OQ protocol may necessitate incremental

charges.

6.18.3 The qualification procedure (IQ/OQ) should be

adapted to the system configuration.

The IQ/OQ procedures will be appropriate for the

particular configuration supplied.

6.18.4 * It must be possible for the purchasing organization

to approve the Supplier’s final qualification

documents (IQ/OQ) before qualification of the

system is started.

At the purchasing organization’s request, Ahura

Scientific will supply a copy of the documented

procedures for IQ/OQ for approval by the

purchasing organization’s before qualification of

the system is started.

6.18.5 The acceptance criteria of the supplier for

qualification (IQ/OQ) of the system should be

fulfilled before approval of the delivery.

The system will pass Ahura Scientific’s IQ/OQ

qualification procedure before installation will be

deemed to be complete.



SOP ID:

Revision:

Issue date:

Page 24 of 25

7 DEFINITIONS

User/analyst

User is a person using the system. Examples of users are analysts, service and maintenance personnel and administrators.

Audit Trail A secure, date and time stamped record, which enables reconstruction of course of events for who has created, changed or

deleted an ER and when that has happened. When required, by GxP and/or current SOP, the reason for change should also

be clear.

Electronic Record (ER)

All combinations of text, graphics, data, sound, image or other digitally represented information that has been created

changed, managed, archived, reproduced or distributed in a computerized system.

Hotfix

Something that corrects or fixes an error or a defect in a software or hardware, for example a patch.

Instrument TruScan.

IT Infrastructure

Hardware and software components that the application is dependent upon to function. Infrastructure includes computer

hardware, servers, network, operating system or other embedded software that the specific application uses or builds on.

Template A file used to create reports from the measurements performed by the instrument.

Mandatory requirements

Requirements by GMP or requirements critical for operation, which directly or indirectly influence the system function or

fulfillment of regulatory requirements.

Report

Printout of an analysis can be for example:

• text,

• an image,

• a spectrum.

Record

Information created, received and managed by an organization. Records are used as evidence and information for the

organization's business and/or to fulfill legal obligations.



SOP ID:

Revision:

Issue date:

Page 25 of 25

Raw data/Data

All original records (or verified exact copies of these) that are the result of original observations, measurements and

activities. Data collection of spectra and calculated data and result files that are created.

Sync application

The application installed on a PC or server. The application transfers data from the instrument and places them on a

network drive.

System The system consists of the TruScan instrument and the sync application. The PC/server is not part of the system but is used

both for installation of the sync application and for administrative tasks such as for example user access administration. The

administrative tasks are managed using a web browser.

8 MODIFICATION / CHANGE CONTROL

Any changes or modification to this document must be documented and approved. The likely impact of the change of the

status of the protocol should be evaluated, reviewed, approved and training of those responsible for its execution prior to

implementation.

9 APPROVALS

Written/Revised By: Date:

Name / Department DD-MMM-YYYY

Frederic Prulliere/Product Management

Reviewed By: Date:


Reviewed By: Date:


Approved By: Date:
