The Attribute Gage R&R

There is not that much information about the attribute gage (gauge) R&R readily available online (that I was able to find), so I thought I'd cover what I've done.  First the basics, an attribute is something you can't quantify, generally a visual inspection- is this part "red" or something like that.  While it generally seems simple, especially to the technical leads, operators can often get tripped up trying to pass or fail parts based on a description or a couple pictures.  In the red example, can operators compare against the Pantone effectively and is this repeatable?  You want to have your acceptance criteria and how you are proposing to test it with trained operators set up beforehand.



Your gage R&R should mimic what you do on the line and should be set up that way.  If the operator does an inspection on the attribute before passing the part, then a final QC does that same inspection, you have two inspections and this should be part of your testing.  You should present this as the entire package when possible.  QA types tend to freak out when they hear you would accept a 10% possibility of passing a bad part, when in reality its 0.1%.  Having the two (or more) inspections will be really helpful when you get to the acceptance criteria portion.



Test Method: You need to determine the number of operators, parts and trials.  Trials is easy, just use three, everyone does, obviously more is better, but three is generally good enough and you don't want to be looking at parts all day.  For operators, you need two, but if you have three or more lines or shifts, you can include those easily enough.  The number of parts is where it gets tricky and you're going to have to make a judgment call.  Generally medical device companies rely on some sort of confidence and reliability based on the severity or RPN of the potential failure, however, in the case of gage R&R everyone seems to follow auto industry guidelines which are usually a smaller quantity, 30 is generally defensible either way.



The Acceptance Criteria:  The key one medical device companies are concerned with is the probability of a miss, which is defined as:

• Probability of a Miss = (# times a bad part was passed) / (# of opportunities) [i.e. number of inspections]

You need to base this on what is acceptable and preferably tie this back into your risk analysis (you may have to increase sample size).  The good news is, if you're doing two of the same inspection, you can set it up so that your acceptance criteria can be something like:

• Probability of a Miss (2 inspections) = (# of times a miss by one operator that were missed by another operator) / (# of opportunities)

In that way you can argue that different types of misses will be caught by different operators, but you are only concerned with the fact that it is caught at some point in the process.  Setting it up this way significantly lowers the likelihood of a miss and allows you some flexibility.



Other Information:  I recommend keeping it simple and only requiring a certain probability of a miss in your protocol (maybe effectiveness as well).  You'll want the rest of the information you can collect documented, but that is a business decision, not a safety decision.  You can cover:

1. Effectiveness - (# of parts correctly identified) / (# of opportunities) [a low effectiveness indicates your process is probably not robust and will give you trouble over time, greater than 70% is generally acceptable]


2. Probability of a false alarm = (# times a good part was rejected) / (# of opportunities) [waste]


3. Repeatability = (# agreements) / (# parts inspected) [calculate per operator and total, if an operator has low repeatability, less than 80% or so, he or she needs retrained]


4. Reproducibility = (# agreements among all operators) / (# parts inspected)


5. Bias = (Probability of a false alarm) / (Probability of a miss) [calculate per operator and total]

The Test Setup:  For this you'll need two experts in the attribute being inspected, the experts will sort out the good parts from the bad, label them in some fashion, and randomize them.  In my experience you should have at least 25% bad parts, even though your process isn't likely to have 25% reject rate (hopefully).  It is nice to include some very marginal parts, but those can be hard to find and agree on.  Don't have the operators performing the test make the parts if you can avoid it.



The Test:  You want to set it up so an operator makes a determination and someone else records it, don't let the operators know the sample being given to them, previous results, or talk amongst themselves.  Do the testing on the line and try to keep the production pace.  During a gage R&R I find the operators tend to err on the cautious side.



The Results:  There you go, you can now say your test method is qualified and have the data to back it up.  You can also make operator decisions based on the results, maybe move one around to catch things earlier in the process, which one is the go to person, etc.  I find the attribute gage R&R easier to perform than the variable one, yet it is generally more important than a dimensional one from a safety perspective because there are more things I can't measure easily.

Why do clinical trials in the US?

I'm searching for a reason and here is the one I came up with:

• The world expert resides in the US and you really need her on your team

I couldn't come up with any more concrete reasons. Maybe you don't know the regulations oversees, but that can be easily taken care of, search the web or buy a book, it will save you in the long run. Even if most of your sales are in the US, I don't think a foreign trial hurts you (as long as your sponsor is halfway respected of course).

If you have a standard device, almost anywhere will do. If you have a new device, find a well respected doctor in Europe and see what kind of magic you can work there at half the regulatory burden and less lawsuit liability.

(Photo from Karen Horton)

Patching Microsoft Windows on medical devices

Law Firm IT has an interesting post on installing the latest Windows patches on medical devices, including this:

"...because the machines were running an unpatched version of Microsoft's operating system used in embedded devices they were vulnerable.

Normally, the solution would be simply to install a patch, which Microsoft released in October. But the device manufacturer said rules from the U.S. Food and Drug Administration required that a 90-day notice be given before the machines could be patched."

I'm not sure if that is completely correct about a required 90 day notice to the FDA before patching Windows. I'll leave that to a regulatory expert.

I do know that any changes to Windows and the medical device software has to be revalidated, at least the potentially affected parts anyway. The revalidation is obviously going to take time and effort and the rewards are often low, especially if you label your device to not be connected to the internet. You want your software guys putting in new features, not screwing around with Windows compatibility for people who are using the device off label. Additionally, the Windows patch needs to be installed, no small feat for a device that is not supposed to be connected to the internet. All of this time adds up and the bottom line is you're never going to be a step ahead of software virii on a medical device, which is why they almost all say do not connect them to the internet.

That being said, Windows with the help of one of several off the shelf software programs, such as Clean Slate, Rollback Rx, and Deep Freeze, can be fairly easily configured so that the chances of a virus are minimized, meaning that you wouldn't have to update Windows with every patch. In fact, this seems like a halfway decent mitigation (along with the aforementioned labeling) to your "device connected to the internet" hazard as part of your risk management.

(Picture by Alexander Fediachov)