Reliability Engineering Into Design Controls

Reliability Engineering into Design Controls

Patil, Hineiti, Bielefeld Eli Lilly and Company Converging Technologies is Leading to New Types of Drug Device Combination Products -Consumer Drug Delivery “Systems”

Drug Science Material Science

Biomedical Information

Disease Science Digital Devices Personalized Medicine Drug Delivery

Nanotechnology Genetic Science Disease State Management Medical Science Medical Information Systems

Biotechnology

Reliability is the probability that a product or system will function appropriately without failure for a specified period of time under a pre-determined set of conditions.

Ref: FDA Design Control Guidance for Medical Device Manufacturers

Per BS 5760, Part 2 1994, a one shot device: “is an item which is required to perform its function only once during normal use. Such items will usually be destroyed during their normal operation and cannot therefore be fully tested. The reliability required from one shot devices is normally high.”

Space Electronics Healthcare Exploration

Consumer Military/Defense Products

Autoinjectors fall into the category of one-shot devices. Generically, autoinjectors have a button of some sort that releases a spring to push a plunger rod into a syringe.

The plunger rod pushes a plunger, and thus pressurizes the syringe and dispenses the medication through a needle.

In our case study, we will consider the use of the fictional ‘Uno Shooter’ autoinjector as a rescue device which needs a high degree of reliability.

Button TM

Uno Shooter Uno ShooterTM by Desparamos

Activation force is an essential performance requirement of the Uno ShooterTM autoinjector.

Design and Development Phases FDA Design Control Guidance Requirements Gathering Phase 0 Feasibility Feasibility Concept Concept Needs Phase Phase User Company Confidential ©2017 Eli Lilly and Company Lilly ©2017 Eli Company Confidential Engineering Translation Formative Factors Phases 1, 2, 3 Human Design Input Design Verification and Validation Loops Design Development Efforts Human Factors Loops Verification and and Verification Design Phase Design Process Design Design Reviews Validation Design Output

Phases 4, 5 Manufacturing / Launch / Manufacturing Design Transfer Design & Manufacturing Field / Field Activity Surveillance Medical Device Phase 8 Reliability and Design Controls

User Needs

Engineering Design Input Translation Design Process Design Output Design V&V Manufacturing and Continuous Improvement Design Phase

Design Risk Assessment Subsystem FMEA/FTA 1 R%C% Sample Size to Demonstrate Reliability Product Reliability Subsystem Reliability Field Demonstrate Reliability Reliability Risk Goal 2 Pass? Failure Assessment Testing Demonstrated Assessment R%C% R%C% Information Reliability (RDT) Test Subsystem Duration Reliability Process 3 R%C%

Root Cause Analysis

System level reliability goal is established based on the device and application risk classification. The risk classifications are unique to each organization. Depending on the categorization of the device and application risk, the minimum acceptable target reliability and confidence intervals are selected.

Product Risk

Application Risk

Considerations Sample Size Required for Reliability Demonstration in Setting Reliability Goals Reliability Test Duration

Essential Performance Requirements and Secondary Requirements

Cost Considerations in Design Efforts

This function gives the probability of a product operating for a certain amount of time without failure.

• Reliability function is a function of time. i.e. every reliability value has an associated time value • The reliability function is specified as follows:

R(t) = x%

Where: t = time x = probability of meeting the essential performance requirements

• Example: R(100 hours) = 95%

• The reliability function is also associated with a statistical confidence level.

Many times, acceptable risk has to be established on a case-by-case basis, taking into account the intended application Catastrophic (device itself and how it is used) and the RISK RISK operating environment. System Risk is defined as Minimum the probable rate Negligible Critical Level Acceptable of occurrence of Reliability a hazard causing Risk Requirements harm and the for the System degree of severity Assessment of the harm. System Level Minor Serious Reliability Goal

The reliability test Once the system, protocol details the total subsystem and The reliability goal number of samples component level determines the number required, total test reliability goals are set, of samples required for duration, sampling reliability at each level the testing and the total approach, pass/fail RDT is demonstrated by test time (or cycles). criteria, acceptable testing. number of failures, etc.

Successful RDT implies that the component is able to demonstrate the required reliability.

Verification and Validation Reliability Demonstration (V&V) Testing Testing (RDT)

• Performed to demonstrate that the product meets design • Performed to demonstrate that the specification requirements product meets the required reliability • Helps test the design targets specification limits of the product • Helps test the design margins of the • V&V test data alone is not product sufficient for RDT

Note: V&V test data could be leveraged for reliability testing.

• Performance of a clinical function, other than that related to basic safety, where loss or degradation beyond the limits specified by the manufacturer results in an unacceptable risk. • “Essential Performance is most easily understood by considering whether its absence or degradation would result in an unacceptable risk.” – ASCA Definitions and References – https://www.fda.gov/downloads/medicaldevices/newsevents/workshopsconferences/ucm608070.pdf – [ANSI AAMI ES60601-1:2005/(R)2012 and A1:2012, C1:2009/(R)2012 and A2:2010/(R)2012, clause 3.27]

Reliability of one shot devices/systems can only be demonstrated statistically by sampling some of the items and fully testing them.

Failure Modes and Effects Analysis (FMEA)

Critical to understand failure mode

Core aspect of medical devices risk management

FDA states that risk management has to be built into the process

Implementation of FMEA for devices is at the discretion of the medical devices company

ISO 14971

Name/ Potential Failure Potential Severity Potential Occurrence Detection Detection RPN Recommended Responsibility/ Part Number Mode Effect(s) of Cause(s) of Method Action Target Date S*O*D Failure S Failure O D

Part Number, Manner in which Effects on other Lists all Detection Design actions Responsible Item Number or the part or components, potential controls to to reduce parties for action Function component subsystem or causes for reduce or severity, items and could fail systems the potential prevent occurrence estimated target Ex: structural failure mode occurrence and/or detection completion date failure, considered corrosion etc.

Failure Modes Effects Summary (FMES)

Grouping of single failure modes that produces the FMEA same effect. FMES FMEA Ex: In a syringe, breaking of the needle or breaking of the piston flange will both cause in failure of the syringe to deliver desired dose and would be classified similarly.

Determine: • Sub-system that is the most critical • Sub-system with a high failure rate • Effect that the sub-system has on overall reliability of the system

Advantages of the Accelerated Degradation Approach • Utilizing some of the readily available tools can give a good estimate of the Accelerated testing means faster sub-system reliability. (i.e. finite estimates of subsystem life parameters element analysis (FEA), HALT testing, design of experiments, etc.) Combined degradation analysis

• One of the tools is the Accelerated Can be applied to destructive and Degradation Approach non-destructive systems.

Representative numbers.

Warehouse and Storage Representative elements. The preconditioning For example only. elements are determined One-shot devices, by tracing the stages that Shipping before being tested, the device/system will should be endure from Handling preconditioned to manufacturing all the way ‘worst-case reasonable until it is in the hands of Customer foreseeable conditions.’ the customer and/or it is Storage put to use. Use by Customer

Attribute Sampling Plan Variable Sampling Plan Pass/Fail Quantitative

Attribute Variable Combination 1 Combination 2 Combination 3 Reliability Confidence Sample Size Reliability Confidence K-Value Sample Size K-Value Sample Size K-Value Sample Size 90 90 22 90 90 1.737 22 1.867 15 2.066 10 90 95 29 90 95 1.788 29 1.926 20 2.355 10 95 95 59 95 95 2.026 59 2.167 35 2.566 15 98 98 194 98 98 2.34 194 2.545 75 2.682 50 99 99 459 99 99 2.55 459 2.679 200 2.947 75

• Reliability is a basic patient expectation • Integration of reliability into design controls is essential for success • Setting system reliability goals with tighter subsystem reliability goals is key • Preconditioning needs to include the entire supply chain • Reliability by Design sets up Process and Supplier Reliability

Thank you

David Shore Eli Lilly and Company Reliability in Manufacturing

• An in-control and capable manufacturing process is critical to maintaining Reliability • Reliability by Design sets up Process and Supplier Reliability • Process Reliability involved your company’s processes • Supplier Reliability involves other companies processes

Large Pharmaceutical company with small device organization

Different terms for control strategy

Button Drug: CQA (Product) or CPP/CIPC (process) TM

Device: Essential Performance Requirements (Product Only)

Different application of risk management methodology Uno Shooter

Pharmaceutical Process 21 CFR 210/211 ICH Qx, EU GMP Product Formulation Research Drug and Filling

Combination Product Customer

Device Manufacture Risk Acceptance Development and Design Components and Transfer Subassembly 21 CFR 820 ISO13485 & ISO14971

Medical Device Process Regulatory Requirements

ControlControl strategies 21 CFR 820 Quality System Regulation (US) strategiesfor medical for Previous control medicaldevices devices strategy terms (including the (e.g. CQA, CPP, devicedevice portion portion of CIPC) are derived of combination EN ISO 13485:2016 Medical devices – Quality management productscombination) are systems – Requirements for regulatory purposes from ICH Q7 and productsnot governed) are bynot ICH Q8, which governedthe same by the are not applicable Guidance for Industry and FDA Staff: cGMP samestandards/ standards/ Requirements for Combination Products to medical regulations asas ■ “…constituent parts of a combination product devices drug products. retain their regulatory status (as a drug or device, for drug products. example) after they are combined”

Devices don’t have Critical Quality Attributes. We recognize that devices can impact drug CQAs

Critical Process Parameters (CPP) are defined as “a parameter that impacts a drug product CQA” Regulatory Requirements CPPs and CIPC are registered as part of the drug product submission

Device regulations do not contain the same level of process parameters or controls

X X

Define patient impact.

Results in Impacts a PHA creation of a Has drug Critical Severity of Major or regulatory Quality Harm >/=3 Critical impact Attribute Defect (CQA)

If Process Step failure results in patient impact it is a Key Process Step.

Preliminary Hazard Analysis is created during drug/device development.

Initial foundation for risk based control strategy

Specific to a given drug/device

Documents the Hazard (Source of Harm)

Harm to the Patient

Severity of Harm

Documents the impacted drug CQA where applicable

The basis for determining impact to the patient in the device assembly process control strategy

Developed with input from both device and drug representatives and is approved by Medical, Regulatory and Quality representatives.

Improved Definitions Defined new device specific terminology Process User for process step and control classification. Requirement (PUR)

Process Step vs. Process Component Input

Process Process Product Output Control Control

Process steps are classified as Key or Non-Key X

Process steps are classified based on impact to safety, function and regulatory compliance.

Key process steps are qualified unless there is a qualified 100% control of the output

Generic Manufacturing Process

Unload Orient Create Create Label Secondary Case Pack Palletize Components Components Sub Assemblies Assemblies Assemblies Packaging

Process Step Process Step Process Step Process Step Process Step X XProcess Step Process Step XProcess Step XProcess Step XProcess Step Process Step Process Step Process Step Process Step Process Step Process Step Process Step X

New terminology is being introduced to avoid “critical” term as this can be confused with drug product terms (CQA/CPP/CIPC) Criteria for determining Key vs. Non-Key process step is the same as critical vs. non-critical Change: Define “Patient Impact” Define device specific controls in compliance with device quality system requirements

The pFMEA is created separately for each process or logical group of processes which produce semi-finished or finished inventory (i.e. dial printers, device sub-assembly or final assembly, device or subassembly labeling, packaging)

The pFMEA defines risk to the patient related to the assembly process

Generic Manufacturing Process

Unload Orient Create Create Label Secondary Case Pack Palletize Components Components Sub Assemblies Assemblies Assemblies Packaging

Process Step Process Step Process Step Process Step Process Step Process Step R R R R R X X Process Step XProcess Step XProcess Step XProcess Step Process Step RProcess Step RProcess Step RProcess Step RProcess Step RProcess Step RProcess Step X

Patient impact (Severity of Harm) is derived from the PHA

R=Risk The pFMEA is a living document that must be maintained throughout the lifecycle of the product

Process Design Specification / PUR

Design specifications are A subset of the design verifiable device system specifications become requirements that are linked Process User Requirements to device product (PURs) requirements.

PURs are global • Apply to any process assembling a given device either manual, semi- automatic or fully automatic • Classified based on their association with a process step • PURs take on the classification of the associated process step

pFMEA pFMEA Inputs Outputs

Process Steps

Potential Failure Modes

Cause of Failure

PHA (Hazard, Harm, and Severity Score)

Controls Residual Risk

Occurrence and Detection Process Step Classification Scores Requirement (PUR) Requirements Classification

Process Step • A logical group of components that converts inputs into outputs Orient Create Components Sub Assemblies

Process Step Process Step Classification XProcess Step X Process Step

Process Step Process Step • Component classification in discreet manufacturing operations such as device assembly is done at the process step level • Process steps are classified as Key or Non-key based on potential impact

Button Activation Force X-Y N Lot Release (Product Design Specification Controls Product / / Product Assembly Assembly Product and Product

Requirements Specification PUR)

Key Key Process Key Key Sensor Process Spring indicator- Spring Button Process Upper Body Snap Check- 100% indicator- Vision indicator- Snap Force Orientation Position Set Up Position Position Fit Verification PM Measurement

OUTPUTS Tool CONTROLS & PROCESS &

Spring Placement Button / Upper Body Snap Together Steps

Process Process Placement Verification

Body Spring Button Inputs Upper Process

Spring Vision Design Button Body Upper Specification Specification Specification Specification TECHNICAL TECHNICAL REFERENCES Incoming Inspection Controls: Controls: Controls: Supplier Type of Steel / Gauge, Controls: Type of Resin, Type of Resin, Mold Validation, Reliability Number of Windings, Vision Equipment, Mold Validation, Interference Dimensions, Purchased Part Qualification Manufacture Requirements SPC of Key Dimensions SPC of Key Dimensions

Autoinjectors fall into the category of one-shot devices. Generically, autoinjectors have a button of some sort that releases a spring to push a plunger rod into a syringe.

The plunger rod pushes a plunger, and thus pressurizes the syringe and dispenses the medication through a needle.

In our case study, we will consider the use of the fictional ‘Uno Shooter’ autoinjector as a rescue device which needs a high degree of reliability.

Button TM

Uno Shooter Uno ShooterTM by Desparamos

Activation force is an essential performance requirement of the Uno ShooterTM autoinjector.

Activation Force for the Uno Shooter can be impacted by a subset of Process Steps

Requirement – Button Activation Force of x:y Newtons

Generic Manufacturing Process

Unload Orient Create Create Label Secondary Case Pack Palletize Components Components Sub Assemblies Assemblies Assemblies Packaging

Patient impact (Severity of Harm) is derived from the PHA

R=Risk

Supplier Management Process Flow from GHTF/SG3/N17R9:2008 Project Quality Team Regulatory Assurance Requirements Commercial Audit Agreement

Engineering Quality Studies Agreement Validation BOM items Laboratory on Site Accreditation Approved Technology Process Transfer Validation Clear Validation Plan requirements to Process Protocol meet both Master Plan compliance and Facility Flow patient needs Document Qualification Owned by (PFD) Quality and the Functional Business

Commissioning vs. Qualification • In general, Non Key Process Steps are commission only • If a Process Step is classified as Key, you need to look at the controls that are in place for that process step • If the control is a 100% automated control, you would qualify the control and commission the process step • Example: Qualify the vision system and commission the printing process

Commissioning vs. Qualification If the control is statistically based (not 100%) you would qualify the process step.

Example:

Snap Fit step 49 The controls are force measurement and 100% vision verification In-line controls Samples pulled periodically for batch release You are checking 100% of the assemblies Qualify the force measurement and validate the vision system

Defines what must be done to return a system to production after an event, such as maintenance or repair

At a minimum, there should be defined return to service criteria for every Key Process Step as they, by definition, can impact the patient

Return to service procedures may not be applicable for system changes or upgrades that are not like for like

• These changes may require re-validation

Return to service criteria should be nothing more than what is already being done to confirm proper functionality of a given process step

• Vision system – Verify pass/fail of challenging tooling • Snap Fit station – Station Setup SOP • Execution of a pre-approved Verification Test Script 9/11/18 Company Confidential Copyright © 2000 Eli Lilly and Company 50 Control Strategy Lifecycle

pFMEA is a Key Document in Manufacturing

Captures known risks as production begins Patient and Caregiver Feedback

Evaluated as part of deviations / complaint investigations / feedback • Captures learnings and verifies controls are still appropriate

Closing the loop around post- market surveillance can be extremely beneficial to process improvement.

Early Failures – “Infant Mortality” Later Failures 120 100 90 100 80 70 80 60 60 50 40 40 Patient and Caregiver Feedback 30 20 20 10 0 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 Early Failures indicate Manufacturing Issues Later Failures indicate Environmental and Handling Issues

Closing the loop around post- market surveillance can be extremely beneficial to process improvement.

Patient Risk Management

Assembly Process Steps Process Patient Impact pFMEA Requirements Verification Return to PURs Defined Process Steps and Controls Feedback Assessed Completed Classified Activities Service Defined Defined Classified Received

There are multiple ties back to patient risk throughout the building of the control strategy.

The control strategy continues to evolve throughout the product lifecycle.

Process User Process Risk Return to Preliminary Requirements Assembly Analysis Process Step Requirement Control Verification Service/ Return Hazard Analysis Process Steps Classification Classification Classification Activities (PURs) (pFMEA) to Use Criteria

Living document PURs/General Definition of Post Harm to the A subset of the through User Inputs vs. Commissioning maintenance/ Patient product design Outputs product Requirements/ specifications lifecycle: Design event needs to Constraints incorporate learning from feedback

What it takes Verify validated to make a Qualification state before good product returning to production

• Rahul Patil • Gialdy Irizarry • Chris Bielefeld

Thank you