CDISC Validation: PointCross – Pinnacle21 v.3 comparison: Part 1: installation

There are now two free software packages for performing validations for CDISC submission files on the market, one from PointCross Life Sciences, named MySEND and the Pinnacle21Validator of which the version 3.0.0 has just been released.

In the case of "MySEND", the naming is somewhat confusing, as it also validates SDTM and ADaM sets, so I will further refer to the software packages as "PointCross" and as "Pinnacle21". 

Having different, competing validation tools is a very good thing, as it means than competition can be on quality, rather than on what the FDA is using. At a recent CDISC face-to-face meeting, Lilliam Rosario (FDA Office of Computational Science) stated that "FDA is not tied to any one validation tool in particular and does not advocate using any particular tool". So, if you make a submission and you stated that you used the validation software of vendor XYZ, the FDA should accept this, and take this into account, even when FDA is using something different internally. There are however already first signs that FDA is using both validators discussed here.
We are also expecting that there will soon be even more (and free) offerings of validation software for CDISC submissions.

As there is so much to discuss, I will split up the discussion in different parts. The first part, which is here, is on installation, including platform dependencies, license issues and privacy policies. Other blog entries, still to be developed, may (no decision made yet) concentrate on:

• Scope of the software, features and user friendliness
• Output formats of the validation reports, auto-generation of DRG templates, use of "SDRG in XML"
• Command Line Interface (CLI) for running in batch
• Validation correctness, transparency of rules and their implementation
• False positives and conflicting rules ("we always get a warning whatever we do"): we are currently generating a large set of test cases, which we will make public. 
• Define-XML validation
• Auto-updates, bug fixing mechanism, installation of new CDISC controlled terminology 
• Additional features, such as generation of define.xml, conversion features (e.g. to Dataset-XML, Excel, CSV, …), Trial Design datasets generation, data visualization.

Part 1: Installation 

PointCross

In order to obtain a copy of the software, one must register with an e-mail address. One must also accept the License Agreement, which can be found at http://www.pointcrosslifesciences.com/index.php/sw-license-agreement/. Read it and have your lawyer read it. Personally, I did not find anything alarming. There is also a "privacy policy", which one must also accept to be able to download the software. The "privacy policy" claims to meet GDPR compliance requirements.
After having done a "photo gotcha", the software can be downloaded, there is no need to first wait for an e-mail.

The download comes as a ".exe" file, which only works for Windows (the "requirments" can be found here). Executing the ".exe" file leads to an introduction screen, followed by a screen allowing to select where to install the software. I did not try it, but I presume this can also be a shared drive, a server drive, etc. I ignored the suggested "C:\Users\Jozef\Desktop\" suggestion and directly installed it under "C:\MySEND". In the next step, the software then unpacks itself, which takes a few minutes. Everything needed to run the software seems to have been installed in the same directory that the user selected for installation (later, I found out that the generated Excel reports go into the directory "C:\Users\Jozef\Desktop\PointCross_Data\StudyData\Unknown\ValidationReport").
In the third screen, one obtains a link to a web page with some introduction movies, but these seem not to be present yet.

In my mailbox I used for registering, I found a short e-mail regarding my registration, inviting me to send any comments and issues to them.  I was not asked for setting up an account with username and password or so. A discussion forum seems not to be existing (yet).

The installation does not create a desktop shortcut, but one can easily create one oneself. When then starting the software, the "license conditions" appear,which one (again) needs to accept. Then the "start" screen appears. 

In the next blog, we will further look into the features and options for validations, and do a very first simple validation on an SDTM test or pilot submission.

Pinnacle21 (version 3.0.0)

The Pinnacle21 software can either be obtained for Windows or for Mac OSX. I did not find any "minimal requirements". Although written in Java, P21 Community 3.0.0 comes as a .exe file. When running it, there is no choice where to put the software (one is not asked), it installs in the folder "C:\Users\xxx\AppData\Local\Programs\pinnacle21-community\" where xxx is the name of the user. One can of course always move the software to another (e.g. shared drive) location. It also however installs files at the "AppData\Local\pinnacle21-community-updater" directory. As I haven't checked yet why this is for, I will comment on this later. In the local "My Documents" directory, directories are created for all controlled terminology, generated report files, stylesheets and log files (Pinnacle21 seems to be using Log4J).

The installation also puts a "shortcut" on the desktop, even if one does not want this. The shortcut points to the file "Pinnacle 21 Community.exe" in the above-mentioned directory.
What I haven't tried yet, is to move the software to a shared drive or server drive, which is very useful in companies to be sure that all users are using the same version and configuration. I do not know however how this will work with the CDISC-CT and other important files in the local "My Documents" directory. There are already first voices that some company IT departments do not allow to have the "My Documents" directory to be used.

When starting the software the first time, the "Setup" screen is displayed. Clicking "Next" leads to the "terms and conditions". Copy-paste the text of the license agreement and have your lawyer have a look at it. One of the conditions is that you are not allowed to share any "adapted" materials. Is adding your own (company) version of CDISC controlled terminology an adaption?

After the "I accept", you are prompted to create a user account by providing your e-mail address. For me, it was not clear (yet) what Pinnacle21 is allowed to do with my e-mail address. I did not find anything about this in the license agreement. So, for safety, I created a separate e-mail address. The screen also prompts for a (first) password, but when I added one, and clicked "Next" it said "Incorrect user name or password". Reason is that you first have to click "Create a new Pinnacle ID" (interesting the "21" disappeared here). When you do so, you are prompted to provide some personal information (including your job role – I would suggest that you always state "Other"). Important is that you read (and have your lawyer read) the "Privacy Policy" which is at https://www.pinnacle21.com/privacy. 

I found the following statement pretty scary:
"As further described in Section 2, below, in the course of providing and supporting the Services, Pinnacle 21 may process some limited amounts of information regarding participants in studies, including but not limited to participants in clinical trials (the “Study Participants”). By using the Services and providing Pinnacle 21 with any information regarding Study Participants, you acknowledge and agree that you have the legal right to provide Pinnacle 21 with such information, including but not limited to obtaining any legally-required consents from the Study Participants or ensuring that such consents have been given to a third party. You further acknowledge and agree that, should any Study Participants have any questions related to the use of their information, you are solely responsible for responding to such questions and providing any information as may be required by applicable law, and Pinnacle 21 will have no liability for any claims or complaints by Study Participants arising from your failure to do so."

Also carefully read (and have your lawyer read) Section 2 "Personal Information". In section 1, Pinnacle21 seems to make a distinction between users from the EU and other users regarding personal information: it references the (by the EU rejected) "Privacy shield" as well as "GDPR" rules. 

When you create a password, there are some special requirements: at least one special character and at least one uppercase character.

In the next step, you can then select whether you want to obtain e-mail notifications about updates, webinars and events.

In the last step, you need to add a verification code that is send to you by e-mail. You then think that you are ready to start doing your first validation. The next screen is:

Already giving you some "advertisement". Concerning for me is especially the article "Do you know the Do's and Don’t's of Define.xml?" which is Pinnacle's view on define.xml best practices and surely not that of the CDISC define.xml team, which has often completely different opinions that P21, and also conflicting with our own "Define-XML best practices".

When then clicking "Validator", you can start your first validation!

Next

The next blog entry will look into which validations can be performed (CDISC, FDA, PMDA) and which not, and the CDISC models supported (SDTM, SEND, ADaM) for both packages. It will also look into how CDISC-CT is implemented, and whether there is support for the new Med-RT and for MedDRA and SNOMED-CT (for which a license is required), and of course, we will do our "first validation" on a simple example or pilot submission.

So … stay tuned!

Part 2: Validation features
Part 3: Hot topics