A control panel can show every indicator green while a utility fails to meet process needs. Available pressure does not establish absence of oil; dew point does not measure microorganisms; filter differential pressure does not demonstrate integrity. Useful monitoring connects each measurement to a precise question, a decision and an accountable owner.
For clean steam, compressed air, process gases and vacuum, the strategy must cover availability, performance, quality and trustworthy data. These dimensions interact but are not equivalent. The first decision is not how many sensors to install. It is which conditions can compromise product, how quickly they develop and what evidence is needed to detect and manage them.
Define what every parameter means
[QRM] Start with intended use, process requirements, risks and barriers. For each measurement document function, location, operating range, units, acquisition frequency, use of the data and consequences of signal loss. Connect it to users and manufacturing stages. A value without physical and temporal context may be accurate yet offer little support for a GMP decision.
Do not automatically call every utility parameter a critical process parameter. Criticality follows the demonstrated relationship with product quality and process control. An engineering parameter may support diagnostics or maintenance; another may support a critical barrier. Distinguish these functions before assigning alarms, review responsibilities and document controls. The same instrument type can serve different purposes at different locations.
The parameter matrix should connect requirement, measurement, detectable failure, action and functional test. Also record what the measurement cannot detect. This prevents a dashboard containing an increasing number of signals from being interpreted as comprehensive proof of quality without a technical basis.
Current requirements and applicable references
[REGULATORY REQUIREMENT] For computerised GMP activities in the EU, Annex 11 addresses validation and system controls. At the source check on 22 September 2026, EudraLex still lists the January 2011 revision. The 2025 consultation on revision is not treated here as an effective requirement. Annex 1, the 2022 revision, provides the relevant sterile-manufacturing utility context.
In the United States, 21 CFR 211.68 establishes requirements for automatic equipment and related systems, including checks, calibration and data controls within its scope. [GUIDANCE] FDA's December 2018 data-integrity guidance is final and nonbinding; it explains reliability and accuracy expectations. ICH Q9(R1) supports decisions proportionate to quality risk.
[TECHNICAL STANDARD] Measurement standards apply to the selected variable and method; they do not automatically create GMP limits. [GEP] Control logic must be demonstrated on the system. [GUIDEGXP RECOMMENDATION] Maintain one parameter matrix with approved versions of thresholds, delays, actions and responsibilities linked to requirements and testing.
Pressure, temperature and flow
Source pressure describes general availability; measurement near a user can reveal local losses and transitions. Define absolute or gauge pressure, useful range and reference. In vacuum, lower absolute pressure means greater vacuum. Ambiguous labels can invert alarm interpretation. The interface scale should correspond to the quantity actually measured, including the direction that represents an unacceptable condition.
Temperature can support steam control, condensation prevention or treatment assessment. For steam, pressure and temperature alone do not establish dryness, non-condensable gases, superheat and condensate chemistry. A consistent physical relationship provides useful information, not a replacement for the specific required checks. Ensure operators understand which attributes remain dependent on other evidence.
Flow measurements need stated units and reference conditions. Consumption, instantaneous flow and totalised volume answer different questions. An increase may indicate additional demand, leakage or a sequence change. Compare production, valve configuration and modifications before attributing it to equipment failure. The measurement range should cover actual operation, including low flows where they matter.
Dew point and quality attributes
Interpret pressure dew point at the measurement pressure. A sensor downstream of pressure reduction may require justified conversion before comparison with the line specification. Sample conditioning, response time, sensor contamination and tubing temperature can affect results. Choose location according to purpose: observing the dryer and verifying the user are different functions.
For onsite-generated gases, a selective analyser reports its measured attribute, such as residual oxygen. Do not assign complete purity measurement to that instrument. Identify interferences, calibration gas, range, response and behaviour without sample flow. A stable value can represent a stagnant sample rather than a stable process. The monitoring design should make that distinction detectable where it affects decisions.
Particles, oil, moisture and microbiology require suitable methods. Online monitoring can detect rapid variation of the available attribute, while periodic laboratory testing covers other attributes or confirms performance. The evidence is complementary. Frequency and sampling location follow risk, qualification, knowledge and applicable requirements. Neither a continuous trace nor a laboratory certificate should be interpreted beyond its measurement scope.
Filters, separators and vacuum
Differential pressure helps identify flow resistance but also depends on flow and gas conditions. Compare readings from similar operating states. A sudden reduction may reflect lower demand or a pathway problem; it is not automatically an improvement. Monitoring does not replace required integrity tests or verification of adsorption capacity.
For vacuum, combine user pressure, pump status, relevant flow, separator level and appropriate exhaust information. High separator level can precede liquid carryover. A running pump does not establish that the required vacuum reaches the process. Include detection and response for level-sensor failure when that sensor supports an important protective function.
Shutdown and takeover sequences should record command, actual valve position where measured and system response. If backflow is a risk, verify protection during power loss and restart. Measurements support that verification, but an uneventful trend does not demonstrate the effectiveness of a barrier that has never been challenged. Consider shared separators and exhaust paths when reviewing standby performance.
Locate sensors to observe the relevant event
Location affects representativeness, delay and maintenance. A header sensor may not observe the worst branch condition. Long sample tubing adds transport time, adsorption or condensation; uncontrolled sample flow changes response. Document the complete route from process to displayed value and demonstrate that the measurement chain is suitable for its purpose.
Access and replacement must preserve continuity and quality. Assess isolation, purging, protected ends and restoration after calibration. When a measurement is temporarily disabled, define alternative control, permitted duration, responsible person and reactivation criterion. A disabled signal must not appear as a normal measurement. The display should make the difference understandable to the next shift without relying on a separate verbal explanation.
Build thresholds, delays and actions together
Separate operating range, engineering target, any alert level and action criterion. Values derive from process, user requirements, risk, qualification and data, rather than a universal table for all utilities. The margin between threshold and unacceptable condition should consider uncertainty, instrument response, sample transport and the time available for intervention.
A delay can avoid alarms for harmless transitions, but needs justification from process dynamics. Do not use it to hide recurring excursions. Distinguish activation delay, signal persistence, hysteresis, acknowledgement and reset. Operator acknowledgement neither proves removal of the cause nor authorises deletion of the event. Where a condition clears before acknowledgement, its historical record should remain interpretable.
For each alarm define understandable text, justified priority, immediate action, recipient, escalation and reset conditions. An alarm without a practical response becomes noise. Automatic protection and safety alarms require their own assessment. Do not assume that a SCADA notification replaces an independent function where one is needed. Test the relationship between notification and actual protective action.
Measurement, interpretation and response matrix
| Signal | Useful information | What it does not establish | Response to define |
|---|---|---|---|
| Point-of-use pressure | Availability during use | Chemical purity | Process management and investigation |
| Dew point | Measured moisture condition | Absence of microorganisms | Treatment and affected-user assessment |
| Filter differential | Resistance under present conditions | Sterilising integrity | Flow, filter and maintenance checks |
| Selective analyser | Specific attribute | Every impurity | Confirmation, diversion or isolation |
| Vacuum separator level | Remaining collection capacity | Absence of backflow | Action before carryover and protection check |
| Communication loss | Unavailable data | Normal process condition | Degraded state and alternative control |
SCADA, historian and data integrity
Identify data supporting GMP decisions and data used for diagnostics. For decision records, retain values, times, units, signal quality, relevant configuration and enough context to reconstruct use. Exported reports should preserve missing, out-of-range and manually substituted data indications. Do not silently convert communication loss to zero or the last known value.
Acquisition frequency and storage rules should preserve meaningful events. Long averages or excessive compression can hide a transition. Verify time synchronisation across instrument, controller, historian and production records. A time discrepancy can make identification of exposed operations uncertain even when each system stores its own data correctly. Test the complete reporting path, including any transformation applied during export.
Manage individual access, privileges, configuration changes and review according to risk. Relevant audit trails should be understandable and reviewable. A log that nobody examines is not sufficient control by itself. Verify backups and restoration capability. Document communication failure, local buffering, data recovery and duplicate handling so the record does not become misleading after an outage.
Calibration and testing of the complete function
Calibration checks metrological performance across the intended range; it does not demonstrate the entire signal pathway. Qualification or functional verification should cover units, scaling, location, alarm, time, recording and actuator response. Failure simulation should challenge the intended function, rather than only force a software value while leaving the rest of the chain untested.
An out-of-tolerance calibration result requires retrospective assessment consistent with error, period, use and available data. Do not merely adjust the instrument and close the maintenance ticket. Interval selection follows criticality, stability, experience, environment and applicable instructions. After replacement, check identification, contact materials, tightness and proper reactivation of functions. Record both the condition found and the condition after adjustment where relevant.
Example: a dew-point alarm during machine changeover
A dryer shows brief dew-point increases during transfer to the standby compressor. The team does not eliminate the alarm by extending its delay. It compares original data, sample pressure, switching sequence and load. It checks whether the event reaches users and whether the sensor represents the transition correctly.
The investigation distinguishes a genuine variation from a sampling artefact and identifies potentially affected operations. Correction may concern control, treatment or measurement, according to evidence. The challenge is repeated under defined conditions and revised thresholds and actions are approved. Subsequent trends demonstrate stability without erasing earlier events or treating one favourable repeat as closure of the original investigation.
Review and maintain the strategy
Review recurring alarms, disabled signals, response times, missing data, calibration, interventions and analytical quality. Distinguish alarm frequency from risk: fewer alarms do not demonstrate improvement when thresholds are unsuitable. Connect deviations and changes to reassessment of the monitoring strategy, including whether new users have changed response-time requirements.
The review should also examine whether operators can perform the assigned actions. An escalation contact may be obsolete, a local valve may be inaccessible or a laboratory result may arrive after the original decision window. These are weaknesses of the control strategy even if sensors remain calibrated. Update procedures, training and tests together, preserving traceability from the reason for change to the final approved configuration.
- Every measurement has a defined purpose and interpretation boundary.
- Location, units and reference conditions are verified.
- Thresholds and delays have an approved rationale.
- Every alarm has an action, owner, escalation and reset rule.
- Missing data and disabled measurements remain visible and traceable.
- Calibration and testing cover the chain needed for the decision.
- Online evidence and periodic testing are integrated without false equivalence.
Connect the strategy through Critical Utilities Systems. For gas and aseptic-barrier consequences, consult Aseptic Fill-Finish & Barrier Systems. Steam events should be coordinated with the process interfaces in Cleaning, CIP & SIP Systems.
References
- EudraLex Volume 4: current Annex 1 and Annex 11 versions.
- EU GMP Annex 11, January 2011: computerised GMP systems.
- 21 CFR 211.68: automatic equipment and related controls.
- FDA Data Integrity, December 2018: final nonbinding guidance.
- ICH Q9(R1): quality risk management.
