A vial line in closed RABS closes seven years of media fills without one contaminated unit. Then an inspector compares the last APS protocol against three batch records: the protocol specifies four hours of filling, two operators, six interventions; the records show nine-hour shifts, five operators rotating, a stopper bowl reload absent from the simulated list and two stoppages for jams. Seven years of passing results said nothing about the real process.
This is where Aseptic Process Simulation stops being a periodic obligation and becomes a design decision: the APS demonstrates that the aseptic process, as those people run it on that line, stays in control. In the lifecycle it sits downstream of equipment qualification and upstream of routine operation. Whoever designs it chooses what the site can claim to have validated.
Where the problem starts
A non-representative APS does not fail, and that is what makes it dangerous: what is not simulated cannot contaminate. Without intervention recording in the URS there is no data to build the list from; if qualification never explored the extremes of speed and format, nobody knows the worst case; if the layout makes a realistic intervention impracticable, it gets removed from the protocol rather than resolved in design.
Annex 1 sets an explicit boundary: 9.35 states that «APS should not be used to justify practices that pose unnecessary contamination risks» [REQUIREMENT]. A passed APS does not make a risky practice acceptable: if a manual intervention is avoidable by design, simulating it does not authorise its persistence. This is the pivot of the whole design, and it reverses the defensive logic of many protocols: the APS does not legitimise what exists, it measures it.
The regulatory picture
| Source | Status and date | What it actually binds |
|---|---|---|
| EU GMP Annex 1, C(2022) 5938 final | In application since 25 August 2023; only 8.123 deferred to 25 August 2024 | Section 9: representativeness, interventions, campaign, manual operations, abort. Clauses 9.40–9.47 govern simulated batch size, incubation, inspection, growth promotion, acceptance and repeat: read them at source |
| FDA, Sterile Drug Products Produced by Aseptic Processing (2004) | FINAL, current version; no revision published | Nonbinding recommendations, not an EU requirement. §IX.A: initial runs, requalification, run size, incubation, acceptance |
| 21 CFR 211.113(b) | In force | «Such procedures shall include validation of all aseptic and sterilization processes» |
What the APS must imitate
Scope and surrogates
Clause 9.33 requires the APS to closely imitate routine aseptic manufacturing and include all critical steps, from sterilisation or decontamination through to container sealing [REQUIREMENT]: the scope does not begin at the filling needle. It also calls for additional aseptic steps for non-filterable products, allows surrogates for sterile powders, and requires process air in place of inert gas unless anaerobes are sought – the most neglected point on lines filling under nitrogen, which suppresses much of the expected aerobic flora. Simulating individual unit operations is permitted only with documented justification covering the complete process.
Where actual process conditions affect microbial viability, 9.32 requires alternative procedures that still reproduce routine operations, and surrogates that do not inhibit growth [REQUIREMENT]. Growth promotion is the evidence that the system could have revealed contamination: with non-fertile medium an APS has no result.
Interventions
Annex 1 8.16 and 9.34 build the mechanism: an authorised list of allowed and qualified interventions, both inherent and corrective, whose procedures must first be assessed through risk management and then through APS, and kept current [REQUIREMENT]. Unqualified interventions only in exceptional circumstances, with quality unit authorisation. The list is written for production, not for the APS, which verifies it. Structural reduction of interventions is decided upstream: the analysis of first air and Grade A interventions precedes a defensible list.
Campaigns, stoppages, lyophilisation
In campaign manufacturing, 9.36(xii) requires simulation of the risks of both the beginning and the end of the campaign and demonstration that campaign duration poses no risk; (xiii) adds that an end-of-campaign APS may serve as additional assurance or for investigation, but must be justified in the CCS and does not replace the routine APS [REQUIREMENT]. Clause 9.38 calls for considering an APS before shut down, prolonged inactivity, decommissioning or relocation; where a lyophiliser is involved, 8.123 – the only point deferred to 25 August 2024 – requires operator intervention to be minimised. Finally 9.48: «An APS run should be aborted only under circumstances in which written procedures require commercial lots to be equally handled» [REQUIREMENT], which closes the door on the convenient abort.
Worst case as a document, not a slogan
«Worst case» is not an adjective: it is a documented construction, variable by variable, with a rationale and a verification method for duration, operators and shifts, number and type of interventions, planned and unplanned stoppages, line speed, configuration and format.
Speed is where intuition misleads: high speed means more units, more mechanical stress and more corrective interventions; low speed extends the exposure of open containers and the time operators spend in the critical zone. There is no general answer: the worst speed must be determined for the specific line and format, from process development data and intervention history, and written into the protocol with its rationale [QRM]. The same holds for duration, where the full longest shift is often impracticable and the opening window is almost never the severe one.
Representing the process
| Routine element | How it is represented | Why it is worst case | Typical misrepresentation |
|---|---|---|---|
| Inherent interventions | All those listed, at the expected frequency | Repetitive: frequency is the risk | Simulated once each «for coverage» |
| Corrective interventions | Same sterile tools, same posture | Unplanned, under time pressure | Performed by the best operator in ideal conditions |
| Shift change and format | Real rotation; justified bracketing of formats | Concentrates entries; format drives exposure | One team for the whole run, bracketing without rationale |
| Filling atmosphere | Process air in place of inert gas (9.33) | Does not suppress the expected aerobic flora | Nitrogen kept «for fidelity to the process» |
| Lyophiliser interface | Transport, loading and unloading of partially stoppered vials | Exposes open containers outside the filling zone | Cycle declared «not aseptic» |
Two regulatory frameworks, two logics
A site that exports must satisfy both, and the stricter criterion is not always the same one. This is not about aligning numbers: the frameworks differ in legal nature and structure.
| Subject | EU GMP Annex 1 | FDA 2004 (nonbinding recommendations) |
|---|---|---|
| Initial qualification | No citable figure for automated lines | «We recommend that at least three consecutive separate successful runs be performed during initial line qualification» |
| Manual operations | 9.39: each container, closure and equipment train validated with each operator through 3 consecutive successful APS, then revalidated with one APS approximately every 6 months [REQUIREMENT] | No equivalent clause |
| Requalification and personnel | Section 9; for manual operations, 9.39 | «Routine semi-annual qualification conducted for each processing line»; personnel entering the aseptic core take part in a media fill at least once a year |
| Run size | 9.40–9.47: read the text | «A generally acceptable starting point for run size is in the range of 5,000 to 10,000 units»; below 5,000 units the media filled units at least equal the maximum batch size |
| Incubation and acceptance | 9.40–9.47: read the text | «Incubation time should not be less than 14 days», temperature at no time outside 20–35 °C; three size bands with distinct investigation and revalidation thresholds |
| Isolators | Section 9, CCS | §IX.A.4: a lower proportion of media fill units is justifiable given the absence of direct human intervention |
The FDA column is entirely [GUIDANCE]; the EU column holds one figure quotable with confidence, that of 9.39, [REQUIREMENT] limited to manual operations. Where the table says «read the text» there is no regulatory vacuum: there is a clause to read at source, without importing FDA values by analogy.
Three distinctions that change the protocol
APS is not sterility testing. The sterility test analyses a batch sample, with limited statistical power; the APS simulates the whole process with criteria referred to the population of filled units, and is not closed by repeating a test.
Sterility assurance is not the sterility test. The first is the sum of design, controls, monitoring and data that makes contamination improbable; the second is terminal, low-sensitivity evidence.
APS is not equipment qualification. The qualification of lines, RABS and isolators shows that the equipment performs the specified functions within defined limits; the APS, that the process run on that equipment by those people keeps microbiological control. A perfectly qualified isolator can host a badly governed process, and no machine performance will reveal it.
QRM and CCS
Every scoping choice is a risk management decision under ICH Q9(R1): hazards along the aseptic path, contribution of interventions and interfaces, assessment against stated criteria, review [QRM]. The rationale for exclusions must be traced as rigorously as that for inclusions: exclusions are what an inspector checks. In the CCS the APS appears twice, as an integrated control and as a data source for trending; 8.19 further requires aseptic operations, including APS, to be observed by personnel with specific expertise [REQUIREMENT].
Worked example: Site Octans
"Site Octans" is a realistic but entirely fictional example. It fills two vial formats in closed RABS, in campaign, under nitrogen, with lyophilisation downstream; for eight years its APS runs all pass. The protocol, never revised in substance, covers the larger format only, nitrogen «for fidelity to the process», three hours at nominal speed, the intervention list from qualification, and the lyophiliser excluded because «it is not an aseptic phase».
The error surfaces through an environmental monitoring trend, not an APS: excursions cluster around lyophiliser loading and the first hours after the shift change, two windows never represented. The review finds three linked defects. Nitrogen was suppressing the aerobic flora recovered by EM, against 9.33. The list was frozen at qualification while batch records had for years contained two recurring corrective interventions never authorised, in breach of 8.16. Loading exposed partially stoppered vials inside the scope that 9.33 extends to sealing.
The correction was not «repeat the media fill»: the list was rebuilt from real production data, the scope extended to the lyophiliser per 8.123, process air adopted, the shift change covered, bracketing justified. The first APS under the new scope produced one contaminated unit: not a deterioration of the process, but the first APS capable of revealing anything. The cycle that followed is the frame of troubleshooting and retrofit.
Levels of prescriptiveness
| Statement | Level | Source |
|---|---|---|
| In manual operations each operator participates in 3 consecutive successful APS, then one APS approximately every 6 months | [REQUIREMENT] | Annex 1, 9.39 |
| APS cannot justify practices that pose unnecessary contamination risks | [REQUIREMENT] | Annex 1, 9.35 |
| A run is aborted only where written procedures would require the same for a commercial lot | [REQUIREMENT] | Annex 1, 9.48 |
| Run size 5,000–10,000 units as a starting point; incubation not less than 14 days, never outside 20–35 °C | [GUIDANCE] | FDA 2004, §IX.A |
| Worst-case speed must be determined per line and format, not assumed to be the highest | [QRM] | ICH Q9(R1), site data |
| The rationale for scope exclusions is documented as that for inclusions | [GUIDEGXP] | Editorial recommendation |
Checklist
- State the simulated scope with explicit start and end, per 9.33.
- Rebuild the intervention list from real batch records, reconciled with 8.16.
- Determine the worst speed by comparing the fast and slow scenarios.
- Cover shift changes, stoppages and restarts with representative durations.
- Verify process air where routine uses inert gas.
- Justify the bracketing of containers, closures and equipment trains.
- Include the lyophiliser interface, where present, per 8.123 and the CCS.
- Define abort conditions in advance, anchored to commercial lot procedures.
- Schedule protocol review at every change of format, layout, recipe or shifts.
Recurring errors and red flags
The first warning sign is years of passing APS results on a protocol never changed in substance: production always changes, and a frozen protocol has stopped representing it. The second is an intervention list shorter than the one derivable from batch records: production is running unqualified interventions, an 8.16 problem the APS does not cure. The third is simulated filling under inert gas, presented as fidelity to the process when it is growth suppression. The fourth is the discretionary abort: a run stopped because «it was going badly» rather than because a written procedure required it. The fifth is treating the APS and EM boundary as separate: if EM flags excursions in windows the APS does not represent, one of the two needs correcting.
Designing a representative APS means accepting that you may discover something: a protocol built to pass produces useless data, one built to represent produces an uncomfortable result now and then and usable information always. Choosing the verification that can fail over the one that reassures is the thread of The Pragmatic GMP.
Key points
- A non-representative APS does not fail: what is not simulated cannot contaminate.
- Annex 1 9.35 forbids using the APS to legitimise unnecessarily risky practices.
- The scope runs from sterilisation or decontamination to container sealing.
- Worst case is a documented construction, variable by variable.
- The only Annex 1 figure quotable with confidence on APS is that of 9.39, on manual operations; the FDA 2004 values are nonbinding recommendations.
- A site that exports satisfies both frameworks, and the stricter criterion varies.
