Regulatory Issues

Qualification of Network
Components and Validation of
Networked Systems

etworked systems with integrated or bringing IT infrastructure into initial

N distributed databases are increasingly

used in the pharmaceutical industry,
and like all computerized systems,
they must be qualified and validated to
demonstrate their suitability for their intended
use. Although the validation of stand-alone
computer systems is well described (1), many
compliance with established standards
through planned qualification processes.
Once in compliance, the infrastructure
should be maintained using documented
standard processes and quality assurance
activities. The effectiveness of the program
should be periodically audited.
companies are still uncertain about how to Ongoing updates on recent developments
qualify networks and networked systems. But in network validation and compliance can be
Ludwig Huber and FDA is increasingly looking into such found on the web sites of FDA (www.fda.
Rory Budihandojo systems, as evidenced by recent warning gov), the GAMP forum (www.gamp.org), and
letters and inspection reports. Networked PDA (www.pda.org), as well as some private
systems and their applications need to be sites such as www.labcompliance. com and
To comply with 21 CFR Part 11,
validated for compliance reasons, but that www.computervalidation.com. Our objective
your networked systems require
validation is also important for business is to provide practical recommendations for
the same validation and
reasons. Missing data in an electronic batch qualifying individual network components
qualification steps as those for a record or laboratory information system or and validating networked systems (as part of
single computer. Shared servers lost data from a research project can be the validation of the applications that are
and multiple access also add disastrous for a company and its employees. supported by the network).
requirements that are unique to Production delays caused by network failures
networks. are also costly. FDA Expectations
We will highlight the qualification of FDA is inspecting networked systems and
Italicized words in this article are
network components (switches, hubs, has issued related warning letters and 483s
defined in “The Glossary” of the
routers, software) and the validation of or inspectional observation reports. Studying
article’s online version at
networked systems, assuming that readers such letters and reports is instructive
www.biopharm-mag.com. are already familiar with the principles of because they highlight what inspectors are
computer system validation and with looking for and what mistakes others are
network technology. (Reference 1 is a good making. The following excerpts are from
source for beginners on the subject of warning letters available publicly on the
computer validation; network technology FDA web site.
and terminology can be found in reference 2 Two network-oriented warning letters
and similar books.) issued this year contain information for
Network quality assurance has been laboratory information management systems
addressed by Crosson, Campbell, and and stability test programs. The second letter
Noonan who recommend that a network be also contains information on databases.
qualified (because it is a piece of equipment) The network program lacked adequate validation
Ludwig Huber is worldwide product manager for and then managed through documented and/or documentation controls. For example:
pharmaceutical solutions at Agilent Technologies control (3). Olthof discussed information v The system design documentation has not been

GmbH, PO Box 1280 D-76337, Waldbronn, technology (IT) quality in a paper at the maintained or updated throughout the life of the
Germany, +49.7243.602.209, ECA conference (4). A special interest . . . software dating back to 1985 despite
fax +49.7243.602.501, [email protected], group at the Good Automated significant changes and modification[s] that
www.agilent.com. Rory Budihandojo is head of Manufacturing Practice (GAMP) forum (5) have taken place. These include program code,
R&D for IT quality and testing at the Centre of emphasized that quality assurance principles functional/structural design, diagrams,
Excellence, GlaxoSmithKline, Collegeville, PA are critical to the management of the IT specifications, and text descriptions of other
19426. infrastructure. That group recommended programs that interfere with [this program].
18 BioPharm OCTOBER 2001
 v The software validation documentation failed during the transport and traffic control practice to validate all computer systems used
to adequately define, update, and control functions. Data integrity and security are for generating and evaluating critical data.
significant elements customized to configure the ensured by controlled and properly managed
system for the specific needs of the operations. network access and by appropriate security Networked Systems
v Validation documentation failed to include for data stored within the network. The diagram in Figure 1 shows a typical
complete and updated design documentation, Computer systems used in regulated client/server networked system connecting
and complete wiring/network diagrams to environments must be qualified and client computers in a laboratory and offices
identify all computers and devices connected to validated to demonstrate suitability for their to a server located in a computer room. The
the . . . system. intended use. That means all systems computer room also hosts mail servers.
v The QCU [Quality Control Unit] failed to (including networks) used for work Laboratory computers with data system
ensure that adequate procedures were put in regulated by Good Laboratory Practices, applications software acquire data using
place to define and control computerized Good Clinical Practices, and Good TCP/IP protocols and control equipment
production operations, equipment qualifications, Manufacturing Practices (together referred with built-in local area network (LAN) cards.
documentation review, and laboratory to as GXPs) must be validated. The Application software on the client computers
operations. (6) electronic record regulations in 21 CFR is also used for data evaluation. Computers
Part 11 give more detail on which computer are connected to servers through a hub. Each
The . . . computer system that is accessed by systems are regulated: all systems that server uses a relational database (such as
personnel from various departments to include create, modify, maintain, archive, retrieve, that from Oracle, www.oracle.com) with
manufacturing, testing laboratory, and Quality or distribute electronic records (10). To customized applications for data
Assurance lacked the following: ensure compliance, we recommend that you management; for control charting and other
v Audit trail function of the database to ensure analyze all information that FDA may statistical evaluation; for review, backup,
against possible deletion and loss of records. request during an inspection. If documents archiving, and retrieval of data; and for
v Absence of documentation defining the or data ever went through a computer or generating electronic signatures compliant
database, operating system, location of files, and other device with the possibility of being with 21 CFR Part 11.
security access to database. modified, then that computer or device Other examples of networked systems
[. . . .] should be validated. frequently used in the biopharmaceutical
Your response fails to discuss extending the Validation is therefore necessary for industry include enterprise asset
retrospective evaluation to other elements of the computers that acquire and evaluate critical management (EAM) systems, manufacturing
system needing to be defined and controlled as data from measurement systems in plant resource planning (MRP) systems,
part of the overall configuration management. (7) control and also for office computers that manufacturing execution systems (MES)
generate reports submitted to FDA. Word with electronic batch record functionality,
An FDA 483 from July 2000 cited a processing systems that generate standard and electronic document management
company for insufficiently documented operating procedures (SOPs) also must be systems (EDMS). The arrangement can be
training records: validated; and frequently, the computers the same for these systems as shown in
There are no records to document that the running them are connected through Figure 1; validation requirements can be the
Information Technology (IT) service provider networks. In addition to meeting regulatory same as well.
staff personnel have received training that requirements, it is simply good business
includes current good manufacturing practice
regulations and written procedures referred to by
the regulations. (8)
Office Laboratory

FDA’s warnings and inspection reports HPLC HPLC

repeatedly emphasize controlled updates, a
GC
focus of this article. Additional examples
and updates of extracts from warning letters
related to computer and network compliance LAN
can be found at the Labcompliance web
site (9).
Mail File Application
Server Server Server
What to Validate
Hub
Networks are systems connecting several Database
Computer
computers and peripheral devices. The main Room
purpose of a network is to transport and
WAN
control data traffic. Whether data are stored
on the network servers or elsewhere, a
network must provide assurance that data Figure 1. Example of client/server networked system (4)
integrity and security have been maintained
BioPharm OCTOBER 2001 19
Regulatory Issues

Testing always should follow a test plan and

• List user requirement specifications be compared against previously specified
Design Qualification • Determine functional (design) specifications acceptance criteria.
• Perform vendor qualification Performance qualification (PQ) is the last
• Check complete arrival as purchased phase, which includes testing the entire
Validation Plan

Installation Qualification • Check correct installation of computer system for specific application performance.
and network hardware and software PQ could involve a complete analysis using
sample equipment for specific hardware,
• Test key operational functions of hardware
Operational Qualification
and software
accessories, and software. It also includes
• Test security functions preventive maintenance. For example, PQ
would include both regular disk
• Test system for specified application maintenance and change control.
Performance Qualification • Establish preventive maintenance routine
• Determine backup and contingency
planning procedures Specific Requirements
• Establish change control and security Network computer systems have some
maintenance protocols specific characteristics that differ from
Figure 2. The 4Q model qualification phases of networked systems standalone equipment and need to be
addressed during validation. Unlike stand-
Validating a networked system requires for other components, then the validation of alone computer systems, which consist of
qualifying its individual components (such network-specific tasks should be added to the homogeneous hardware and software,
as the applications running on each validation plan. A networked component networks are heterogeneous. They usually
computer) and authorized access to the should be treated like any other piece of include a variety of hardware components,
system, as well as qualifying data transfer equipment that is installed and qualified. several software applications, and
between the related computers (that is, the A network component should be treated communication protocols. A change to one
interfaces of the components at both sites). like a piece of equipment, which is installed component can influence many other
The whole system, including the network and qualified (for example, chromatography components and applications.
itself, is validated by running typical daily software functions such as peak integration Cabling designs and specifications are as
applications under normal and worst-case and quantitation). Typical network functions important as the hardware and software in a
conditions and then verifying that the system such as limited access and network networked system — mainly because network
and its functions are meeting previously transactions should be qualified. Because of components can be far away from each other.
specified criteria. the complex nature of a network, a cross- Many people and departments often access
Both for qualifying the components and functional team should control validation the network as a common resource, so
for validating the complete system, it is activities. For the validation of the network, security issues are quite important. Networks
important to define a validation box. The any structured approach (such as a life cycle can include both components that must
goal of a validation box is achieved by model) should be followed; see, for comply with regulations and those that aren’t
subdividing the network into subnetworks example, the 4Q model in Figure 2. It regulated. IT personnel have not always been
(or sub-LANs) containing network involves design, installation, operational, trained in the GXPs.
components that are used by each and performance qualification.
application. A validation box helps define Design qualification (DQ) is the first step, Validation Plans and Teams
which parts of the complete network must ensuring that the design of a network meets Validation master plans are not required by
be qualified and which are unaffected. The the user’s requirements. In this phase, the regulation, but FDA inspectors may ask for
validation box for the laboratory data system user requirements for each function are an explanation of your company’s approach
in Figure 1 would include the lab computers, specified. For example, a user requirement toward validation. The master plan is a good
the file server, the applications server, and could state, “There should be limited access tool for demonstrating that approach, and
the database. Limiting the network to the networked system.” The required plans should be available for both multisite
qualification tasks to those components used function to ensure that requirement could be and single-site companies. Validation master
by the network applications saves time. stated, “There should be user ID and plans help ensure consistent and efficient
password entry fields when entering the implementation of validation throughout a
The 4Q Model system.” The computer system vendor site and throughout a company. If already
Validation of networked systems should, in should be qualified during the DQ phase. available, such plans can be extended easily
principle, follow the validation practices of Installation qualification (IQ) is the second to include networks and networked systems.
all other computer systems. Everything that phase. An individual checks whether an We recommend starting with a generic plan
is important in validating a single computer instrument arrives as purchased, installs and adding network specifics. For example,
is also important in validating a network. network components, and completes the include network terms in the glossary.
Network validation activities should follow a necessary documentation. Generic network specifications (such as
validation plan. If such a plan already exists Operational qualification (OQ) is the third cabling, security, and vendor qualification)
step, when critical key functions are tested. should be part of the master plan. It should
20 BioPharm OCTOBER 2001
Regulatory Issues

include recommendations for backup, problems at the application level. End users how many concurrent users can work on the
contingency planning, disaster recovery, also should be able to determine whether a network. Another user requirement is limiting
change control, validation reports, and network continues to operate effectively and authorizing access to the system.
archiving. The plan also should include after the validation activities are complete. Functional specifications define what
naming conventions, which make it easier to QA personnel should be part of the functions the system or its components will
identify components and track data flow validation team to ensure that documentation, need to meet those goals.
within a network. Templates for daily control, and use are in compliance with Two other types of specifications to
operations should be included as appendices regulations and company policies. The include in a validation master plan are
for consistent implementation, and reference software engineering department should be design and environmental specifications.
should be made to existing SOPs. The involved if all or part of the software has been Design specifications, which can be
master plan will be a good foundation for developed in house. Otherwise, vendor included as part of the functional
individual project validation plans. representatives can be included. Consultants specifications, specify the design of the
Validation teams can coordinate validation can be brought onto the team if necessary; computer hardware, software, connectors,
activities for networked systems. The they can be a great help with initial, big and cables necessary to meet specific
complexity of networks requires more than network validation projects. functional specifications and to ground
one expert for definitions, qualifications, electrical connections adequately.
and (most important) change control. The Types of Specifications Environmental specifications detail the
validation team should include expert IT All validation activities should begin with the environmental conditions (such as
professionals. They can best describe what single most important step: setting temperature or humidity) under which the
might go wrong with a system and how specifications. Good specifications can be network will be expected to operate.
individual network components can affect used throughout validation activities. User When establishing network
each other. requirements set as specifications define what specifications, be sure to answer these
Laboratory personnel (or others who will users intend to do with the networked system. questions: How much traffic will the
use the network) should be part of the team Typical requirements for networks include network carry, especially under highest-load
because they should be aware of possible sharing and printing files and determining or worst-case conditions? What is the

22 BioPharm OCTOBER 2001 Info #20 Info #4

Regulatory Issues

Installation testing and/or OQ process. Test modules and

Project-Specific Documentation
The steps for installing a network are similar systems after installation, after changes, and
Project-specific documentation must be to those for installing other computer systems. at regular maintenance intervals. When a
reviewed periodically and updated if Check whether the equipment (the computer change is made, the changed component
necessary. Include the following hardware, the software, the network hardware, should be tested to see whether it still works
documents in your project-specific cables, and operating manuals) arrived as in the system, but other components also
documentation: purchased. Determine whether all equipment should be tested because they may be
Acceptance testing protocols or and accompanying materials are undamaged affected by the change. Testing requires
operational qualification protocols and clean. Verify that the environmental written test plans with set parameters and
Backup requirements
tolerances are as specified (including acceptance criteria. A test plan must be
temperature, humidity, radio frequency, and approved before a test starts.
Disaster-recovery planning procedures electromagnetic interference). Determine Critical functions should be checked
Installation qualification documents whether physical security specifications have regularly. For example, some devices have
Logbook with changes
been met (for example, lockable hardware checks required by 21 CFR Part 11, and the
should prevent unauthorized access to the accuracy of network transactions needs to be
Maintenance procedures server’s RAID system). checked as well. Besides the generic tests
Network components master list (for Install components according to the applicable to all computers, some tests are
example, components that are deemed vendor’s recommendations. Configure and specific to networks. See the “Network-
critical for network operation) document all network settings (such as the Specific Testing” box for recommendations.
Project plans
router settings). Give a unique identifier to The accuracy of networking transactions
all parts: hardware, software, cables, should be checked. Make sure that data are
Report summaries firmware, and operating systems. Also safely transported between client and server
Risk assessments for testing, backup, record the version numbers of network- computers. That should be verified as part of
and contingency planning specific software and firmware and of the normal OQ, but technology is also available
System and network diagrams (for
hardware, software, and cables that are part to automate this verification by regularly
example, floor plans, topological
of the network infrastructure master list. calculating checksums or hash values for
diagrams, and cabling diagrams)
Version numbers can be more easily tracked each file, attaching those numbers to the
if entered into a database or an appropriate files, recalculating the numbers after a data
Training records related to specific network configuration management tool. transaction, and comparing the new values
computer systems Diagrams. Create system drawings and with the previous ones still attached. Those
User requirements (functional, design, diagrams as part of the installation process. steps should be automatically executed by
and environmental specifications) Such drawings are essential for setting up a software without requiring manual
Vendor assessments
network or networked systems, but they are interaction. Software should automatically
even more important for maintaining those report and document errors. Hash
systems. The diagrams should be kept with algorithms are commercially available, such
maximum actual distance between other IQ documents and include physical as MD5 software from RSA (www.rsa.com).
individual network components? How many diagrams (such as component locations and If the checksums or hash algorithms are
users will be on the network concurrently? cabling) and logical diagrams (such as implemented correctly, calculations are done
What are the risks and impacts of a server TCP/IP schemes and how components so fast that they have no measurable impact
failure? How often will backup and interrelate with each other). In the case of on the performance of the system.
archiving be performed? Under what dynamic IP addressing systems, the If multiple clients use exactly the same
environmental conditions will the network diagrams should indicate how dynamic IP hardware and software configuration, you
operate? What protocols will be used addressing will be used (including the may question whether it is necessary to test
(GPIB-IEEE or TCP/IP, for instance)? Will procedure for submasking IP addresses). each one separately. The answer to that
the workstations currently in place be Diagrams will enable IT personnel and question should be based on the risk
adequate for the networked activity, or inspectors to trace data and traffic flow, assessment: the impact each client could
should they be replaced by or augmented ensuring data integrity and security. Networks have on product quality and the probability
with new ones? change frequently, so maintaining the of client-specific errors. In most cases, the
Each of those questions and their answers diagrams with documented version control is risk incurred by testing only a percentage of
are important when setting specifications. important. We recommend procedures for clients is acceptable.
The anticipated users should answer regular (perhaps quarterly) review. Most of the above suggestions test the
questions appropriate to them, and each networked system itself or applications
question should be discussed by members of Testing running on that network (for example,
the validation team. Networks should be tested in the transactions between two or more system
development environment by the supplier, components). Some testing of critical
but they should also be tested in the user’s components could also be done. For
environment as part of the acceptance
24 BioPharm OCTOBER 2001
instance, one test could check a switch Network-Specific Testing
buffer to ensure that no data are lost.
Start up and shut down networked
Data Backup and Contingency Planning systems (document messages that
Procedures should be in place for backup and reflect that the network was successfully
recovery of data. Risk assessment determines started or shut down). Switch off and on
the timing of backups — frequency increases network components (for example,
for more critical data and with the increased hubs, routers, and switches), and note
likelihood of data loss. Hardware and the impact of the action on the network
software are commercially available, but operation.
individual devices should be qualified and Conduct security tests, such as by
validated for backup and restoration. In the logging on with both correct and
event of total destruction of a server, you incorrect passwords. Grant
should be able to completely recover its administrator-level access, and assure
database to another server without data loss, that administration personnel are aware
and that too should be validated. of functions they can and cannot do in a
Networked systems can fail for a variety regulated network environment. Check
of reasons. Badly designed applications that password administration works
running on a network can fail, and single correctly. For example, check that
components can also fail. When designing passwords of four characters have been
the network, the following questions should tried when the password policy specifies
be answered: Will processes continue when minimum password lengths of six
one or more single components fail? How characters.
will that affect the course of business? What Verify that sessions unlock and that
is the likelihood of failure? How will data be user-specific automated time outs, if
recovered once the network is again any, work. Verify access to task and file
available? Your company’s answers to those permissions. For example, if an operator
questions will determine the stringency of its has permission to review data, try
contingency plan (to continue network modifying such data to see whether the
operation if one or more components cease system behaves as expected. Check
to function). Such a plan is equally important that network backup and restoration of
for regulatory and for business reasons. data work correctly.
Contingency planning should start with
risk assessment: How much will it cost Verify how the system behaves and
when data are lost? How does the risk of recovers from system failures, triggering
data loss compare with the cost of a failures through disconnecting and
contingency plan? reconnecting network components. Test
Validated redundancy systems can help error messages and the actions required
keep a system operable. Other types of for specific ones as part of this task.
network contingency plans can include the Check that the audit trail of network
use of a hot site. Because time is critical in transactions is correct. Verify that
recovering network operations, correct data are transferred under
consideration should be given to the type or normal and high-traffic conditions.
set of qualifications run at the hot site; Check that individual software modules
sometimes it may not be feasible to run a and systems are free from virus
full set of qualifications. Practice the plan infections. Form a system integrity
before disaster strikes, of course, and ensure response team (SIRT), whose function
that it is safely stored and can be retrieved is to provide damage assessment in
easily in the event of trouble. case of an external or internal breach.

Maintaining Security
Networks change frequently, whether something, you need to ask yourself several
changes are made to hardware, software, or questions. Is the change really needed?
both. All changes should be managed, Compare benefits and costs. Cost
controlled, and documented. In some cases calculations should not only include those
revalidation may be required, which can be a for purchasing but also validation, which
huge effort. Before deciding to change can be higher. How will the change affect
Info #17 BioPharm OCTOBER 2001 25
Regulatory Issues

the system and its components? What will should be present: project specific plan, or add network-specific information to
need to be tested and documented after the documentation describing validation for an existing computer validation master plan.
change? Who should be informed about it? each project and generic documentation Form a project-specific validation team.
Those questions must be answered by a describing policies, master plans, and Develop user requirements along with
validation team rather than an individual. A processes. Templates can facilitate functional and design specifications.
chemist in the laboratory can hardly estimate consistent implementation and use. Good Treat each network component like a
the impact of adding another client to an documentation is very important for piece of equipment, which must be
already busy network. But IT specialists can troubleshooting. qualified, but qualify only those that are
do that best when informed by that chemist Generic documentation should include the used when running applications. Install
as to the potential data traffic coming from validation master plan and additions to individual components and test components
the new computer. existing computer validation master plans and (qualification). Integrate components and
Requalify network components after each procedures for adding and removing network test them. Validate the networked system by
change, with qualification results components; connecting to the network; running complete applications. For complex
documented. Update the contents of controlling network security, including networks, don’t test everything; be selective.
equipment databases and drawings after the physical and logical security, password Use risk assessment. If you have 20 identical
change. Limited access to computer rooms, policies, and administration procedures; clients with identical software, testing two
computer hardware, network hardware, and network management between multiple sites; or three of those clients can be enough.
selected tasks and data should be checked configuration management; change control For changes, evaluate whether each
regularly. Maintain access rights and update procedures (equipment, hardware, software, change is really needed and assess whether
those rights when employees change jobs. firmware, cables, connectors), and training it makes good business sense to implement.
records for GXP regulations. After you have made a change, test its
Documentation All procedures should be reviewed yearly effects on other components. Don’t assume
All validation activities, including with regular confirmation that they are being that everything else still works as before
qualification and validation plans and results followed. Practice version control for when a change has been made. Don’t forget
for networked systems and databases, should changes. Project-specific documentation to continue qualification through all change
be documented. Two types of documents must be reviewed periodically and updated control procedures.
if necessary. See the Develop backup, contingency, and
“Project-Specific disaster-recovery plans. Documentation
Documentation” must be in order: SOPs, templates,
box for a list of maintenance logs, and so on. And train
what to include. people — even your IT staff — on
techniques and operations, but also on the
Implementation regulations.
In summary, the
qualification of References
network (1) L. Huber, Validation of Computerized
Analytical Instruments (Interpharm Press, Inc.,
components and Buffalo Grove, IL, May 1995).
validation of (2) N. Jenkins and S. Schatt, Understanding Local
networked systems Area Networks: Easy Introduction to Network
are equally Concepts and Products (SAMS Publishing,
Indianapolis, 1998).
important for (3) J.E. Crosson, M.W. Campbell, and T. Noonan,
meeting regulations “Network Management in an FDA-Regulated
and business Environment,” PDA Journal 53(6), 280–286
requirements. We (1999).
(4) H. Olthof, “GXP Requirements for IT
recommend Infrastructure,” presented at the ECA
following a stepwise conference: FDA 21 CFR Part 11 Compliance
approach. for Pharmaceutical Laboratories (European
Follow good Compliance Academy, Copenhagen,
Denmark), October 2000.
computer validation (5) IT Infrastructure Special Interest Group,
practices. It is most Quality Assurance (GAMP, Tampa, FL, 2000),
important to follow draft document.
(6) J.C. Famulare, Warning Letter #320-01-08
life cycle procedures (Center for Drug Evaluation and Research,
in validation and 11 January 2001). Available at
qualification. www.fda.gov/foi/warning_letters/m5056n.pdf.
Develop a network (7) J.C. Famulare, Warning Letter #320-01-07
(Center for Drug Evaluation and Research,
qualification master
Continued on page 46
26 BioPharm OCTOBER 2001 Info #16
Glossary Network Qualification continued from page 26
11 January 2001). Available at www.fda.gov/
bus An electronic pathway along which they are, where they are located, and how foi/warning_letters/m5057n.pdf.
signals are sent from one part of a they are used). (8) “FDA 483 Observations Related to IT”
(Labcompliance, July 2000). Available at
computer to another. A PC contains fault tolerance The ability of a system to www.labcompliance.com/publications/
several buses, each used for a different respond gracefully to unexpected lit-references.htm.
purpose. The address bus allocates (9) “FDA 483 Inspectional Observations and
hardware or software failures. The lowest Warning Letters Related to Computers”
memory addresses. A data bus carries level of fault tolerance is an ability to (Labcompliance web site). Available at
data between the processor and the continue operation in the event of a power www.labcompliance.com/computer/
memory. The control bus carries signals failure. Many fault-tolerant computer fda-observations.htm.
from the control unit. (10) Code of Federal Regulations, Food and
systems mirror all operations — that is, Drugs, “Electronic Records; Electronic
checksum A record of the number of bits perform each on two or more duplicate Signatures,” Title 21, Part 11 (U.S.
transmitted and included with a systems — so that if one fails the other Government Printing Office, Washington DC),
transmission so that the receiving can take over. issued March 2000. Also Federal Register
62(54), 13429–13466. Available at
program can determine whether the same File transfer protocol (FTP) The TCP/IP Internet www.fda.gov/ora/compliance_ref/ part11. BP
number of bits arrived. If the counts protocol used when transferring single or
match, it’s assumed that the complete multiple files from one computer to
transmission was received. another. hot site A site designated to operate a
client/server A network architecture in network if the normal operation center
GPIB-IEEE A general purpose interface bus
which each computer or process on the fails (for example, in case of a natural
standard from the Institute of Electrical
network is either a client or a server. disaster or fire).
and Electronic Engineers, which develops
Servers are powerful computers or standards for computers and the hub A common connection point for
processors dedicated to managing disk electronics industry. This standard allows devices in a network, such as a LAN. A
drives (file servers), printers (print up to 15 intelligent devices to share a hub contains multiple ports. When a
servers), or network traffic (network single bus, with the slowest device packet of data arrives at one port, it is
servers). Clients (PCs or workstations on participating in the control and data copied to the other ports so that all
which users run applications) rely on transfer handshakes to drive the speed of segments of the LAN can see all packets.
servers for resources such as files, the transaction. A passive hub serves simply as a conduit
devices, and even processing power. for data, enabling it to go from one device
GXP All of the regulations that apply to
data flow Movement of information (or segment) to another. So-called
Good Laboratory Practices, Good Clinical
between clients and servers that is intelligent hubs (or manageable hubs)
Practices, and Good Manufacturing
tracked to ensure accuracy and security. include additional features that enable an
Practices, taken as a whole.
administrator to monitor traffic passing
data system applications software The software handshake Requires the recipient of a data through the hub and configure each port.
that controls equipment, such as record to acknowledge to the sender that A third type of hub, called a switching
chromatographs, and acquires, evaluates, the record has been received. hub, actually reads the destination
prints, and stores data.
hash algorithms (hash values) A hash value is address of each packet and forwards it to
distributed databases Computing is said to be an algorithmic method. Sometimes called the correct port.
“distributed” when the programming and the “digest” of a document in digital form, information technology (IT) The broad area
the data that computers work on are a number is generated from a string of concerned with all aspects of managing
spread out over more than one computer, text. The hash is substantially smaller and processing electronic and
usually over a network. than the text itself, generated by a formula computerized information. Some
electronic document management system (EDMS) A that makes it extremely unlikely for some companies refer to the department as
system for tracking and locating electronic other text to produce the same value. information services (IS) or management
documents and for managing them Hashes are used in security systems to information services (MIS).
throughout their life cycle. ensure that transmitted messages have
integrated databases Databases that have
enterprise asset management (EAM) Knowledge not been tampered with. The sender
two or more components merged together
within a company exists in many forms: in generates a hash of the message,
into a single system. Increasingly, the
databases, knowledge bases, filing encrypts it, and sends it with the message
term “integrated” is reserved for software
cabinets, and peoples’ heads. All too itself. The recipient then decrypts both the
that combines word processing, database
often one part of an enterprise repeats the message and the hash, produces another
management, spreadsheet functions, and
work of another part simply because that hash from the received message, and
communications into a single package.
knowledge is poorly tracked. EAMs allow compares the two. If they’re the same, it
is highly probable that the message was local-area networks (LANs) Networks with
companies to manage legacy and object
transmitted intact. computers geographically close together
components, inventorying assets (what

46 BioPharm OCTOBER 2001

Glossary
(in the same building). Wide-area networks address.
(WANs) have computers farther apart, RAID Short for redundant array of
connected by telephone lines or radio independent (originally inexpensive) disks,
waves. RAID is a way of storing the same data in
mail server A mail server handles incoming different places (thus, redundantly) on
and outgoing email for Internet users. Most multiple hard disks. By placing data on
mainframes, minicomputers, and computer multiple disks, input and output operations
networks have an e-mail system. Some can overlap in balance, improving
electronic-mail systems are confined to a performance. Since multiple disks increase
single computer system or network, but the mean time between failure (MTBF),
most have gateways to others, enabling storing data redundantly also increases
users to send electronic mail anywhere in fault tolerance.
the world. relational database A type of database that
manufacturing execution system (MES) A system stores data in related tables. A relational
that delivers information on plant database is powerful because it doesn’t
production activities. MES programs guide, assume how data are related or how they
initiate, respond to, and report on plant will be extracted. As a result, the same
activities as they occur, resulting in rapid database can be viewed in many different
response to changing conditions. ways.
manufacturing resource planning systems (MRP) routers Devices that connect any number of
Production tracking systems used primarily LANs and use headers and forwarding
in the 1980s, which are now being primarily tables to determine where packets go.
replaced by EAMs. Routers use ICMP, an extension of IP, to
MD5 A digital signature algorithm used to communicate with each other and
verify data integrity that is claimed to be as configure the best route between any two
unique to that specific data as a fingerprint. hosts. Very little data filtering is done
Developed by Ronald L. Rivest of MIT, through routers.
MD5 creates a digital signature, requiring submasking Masks are filters that selectively
that large files be compressed by a secure include or exclude certain values. For
method before being encrypted with a example, when defining a database field, it
secret key. MD5 is a one-way hash is possible to assign a mask that indicates
function, meaning that it takes a message what sort of value the field should hold.
and converts it into a fixed string of digits, Values that do not conform to that mask
also called a message digest. When using cannot be entered. Masks are hierarchical,
a one-way hash function, one can compare and submasks are filters within filters.
a calculated message digest against the subnetworks (sub-LANS) Within a network,
message digest that is decrypted with a subnetworks are another name for nodes.
public key to verify that the message hasn’t
been tampered with. This comparison is switch In networks, a device that filters and
called a hash check. forwards a packet to its next destination. A
switch may also include the function of a
networked systems (networks) A group of two or router in a generally simpler and faster
more computer systems (hardware, mechanism.
software, and peripherals) linked together.
Computers on a network are sometimes TCP/IP Transmission control
called nodes. Computers and devices that protocol/Internet protocol, enables devices
allocate resources for a network are called to exchange information over a network.
servers. validation box Defines a set of network
node Any device attached to the network components that are required on the
that is capable of communicating with other network — for example, a networked
network devices.. A node can be a chromatography data system.
computer or some other device, such as a
printer. Every node has a unique network

BioPharm OCTOBER 2001 47