A URS that can be tested at the user connection
A compressor or clean steam generator can satisfy its purchase specification while the manufacturing process receives an unsuitable utility. The missing requirement is often located between the skid boundary and the actual point of use: a hose, a pressure regulator, a drainage arrangement, a changeover sequence or an unmonitored standby branch. A useful user requirements specification, or URS, describes the service the process needs across this complete boundary.
This article addresses clean steam, compressed air, process gases and vacuum. Pharmaceutical water is considered only at its interface with steam generation. The engineering matrices and examples are GuideGxP recommendations: they translate process knowledge into reviewable requirements and do not establish universal GMP limits. A requirement becomes useful when an owner can explain why it exists, how compliance will be demonstrated and what decision follows a failure.
Establish the applicable requirements before selecting equipment
For human medicinal products manufactured under EU GMP, Annex 15 provides the qualification framework and connects the URS to the system lifecycle. Annex 1 adds relevant expectations for sterile manufacturing. The current Commission index remains the starting point for identifying applicable texts; a consultation draft is not automatically an effective requirement. The current ICH Q9(R1) publication supports the scientific risk assessment behind engineering choices.
Technical standards serve a different purpose. ISO 8573-1 provides a classification framework for compressed air contaminants. It does not select the acceptable class for every pharmaceutical application. Hygienic design standards can inform construction specifications where adopted, but the contract must name the edition and applicable sections. Record legal or GMP requirements, compendial obligations, adopted standards, engineering targets and site recommendations in separate fields so that their authority remains visible.
Start with an inventory of users and exposure routes
Identify every connection, equipment owner, product family, manufacturing step and operating mode. Record whether utility contact occurs during production, cleaning, sterilization, drying, transfer or maintenance. A single outlet may have different requirements in different modes. Gas used for a vessel overlay has a different exposure pathway from air operating an external valve actuator, even when both originate from the same compressor room.
Direct contact means the utility reaches product or a relevant primary container surface. Indirect contact includes credible transfer through an intermediate surface or a failed barrier. Non-contact means the documented configuration prevents a credible transfer route during the assessed operating conditions. These labels require evidence: an actuator exhaust directed toward exposed product deserves assessment, and a heat exchanger wall cannot simply be assumed never to leak.
For each user, follow the route from supply to process and in the reverse direction. Vacuum and pressure systems can transmit contamination during shutdown, pressure reversal or faulty valve sequencing. Describe the prevention mechanism and its verification rather than relying on a drawing symbol alone. Include temporary hoses, portable connections and maintenance bypasses in the inventory because they can defeat the intended segregation.
Separate quality, performance and availability
A quality attribute concerns suitability for the application: relevant particles, water, oil, microorganisms, chemical impurities or steam characteristics. A performance requirement concerns delivered flow, pressure, temperature or vacuum under a defined demand profile. Availability describes whether the service remains usable when equipment fails or maintenance occurs. Meeting any one of these does not establish the other two.
Specify the reference conditions for gas flow and the pressure basis for every pressure value. Distinguish pressure dew point from an atmospheric dew point measurement. For steam, identify the boundary at which delivery conditions and condensate quality apply. A generator nameplate capacity does not demonstrate acceptable performance at a distant branch during warm-up. Conversely, a pressure indication inside its operating range does not prove that contamination limits are met.
The URS should reference an approved point-of-use quality specification rather than reproducing uncontrolled copies of limits in multiple documents. Each attribute needs a rationale, analytical method, reporting basis and acceptance decision. Where a limit is still being developed, manage the unresolved requirement explicitly before design approval; do not conceal uncertainty behind expressions such as pharmaceutical grade or high purity.
Build demand from operating scenarios
List normal consumption, start-up demand, intermittent peaks, simultaneous users and the minimum stable demand. Record the production schedule that permits diversity assumptions. Adding every nameplate value may lead to unnecessary capacity; applying an unexplained diversity factor can create shortages. Model realistic combinations and identify the sequence that challenges generation, storage, treatment and distribution most severely.
For a hypothetical project, two process users each demand 40 flow units while a third intermittently requires 30. If production confirms that the two main users overlap and the third can also start, the scenario is 110 units before justified design allowances. If software scheduling prevents that third start, the URS must require the interlock, its failure response and its verification. These illustrative units establish a calculation method, not an operating recommendation.
Evaluate quality at these operating extremes. Dryer performance, filter pressure drop, generator separation and control stability may change with load. Also examine prolonged low demand, idle branches and recovery from shutdown. Expansion capacity belongs in a separate, stated scenario with its own assumptions; spare nozzles and electrical capacity are not evidence that future point-of-use quality has already been qualified.
Use a requirement-to-evidence matrix
The following matrix is an original example. The acceptance criteria refer to site-approved values or functional outcomes because numerical limits must come from the actual process and applicable requirements.
| Requirement | Rationale | Criticality | Acceptance criterion | Verification method | Evidence |
|---|---|---|---|---|---|
| Specified gas quality at the final user connection | Prevent identified product contamination | Product quality | All approved attributes meet the user specification under challenged conditions | Representative point-of-use sampling | Approved protocol, raw results and reviewed report |
| Stable delivery during simultaneous demand | Maintain the process operating envelope | Process dependent | Approved pressure and flow envelope maintained throughout the scenario | Demand challenge with calibrated instruments | Time-aligned trends and acceptance assessment |
| Prevent reverse flow on shutdown | Avoid transfer from process to shared distribution | Contamination control | Defined isolation response prevents the identified transfer pathway | Design review and safe functional challenge | Cause-and-effect record and test results |
| Detect a critical sensor failure | Avoid silent operation without reliable information | Control dependent | Failure is distinguished from a valid reading and triggers the approved response | Simulated signal fault | Alarm log and response verification |
| Accessible filter replacement | Preserve cleanliness during maintenance | Lifecycle quality | Replacement and recovery can follow the approved procedure | Layout review and maintenance demonstration | Access assessment and maintenance record |
Assign each requirement a unique identifier and an owner. Criticality should describe the consequence of failure, not merely repeat the word critical. Maintain links to design decisions, test cases, deviations and final evidence. If a requirement changes, the matrix should expose which drawings, procedures and verification results require review.
Define the distribution and point-of-use boundary
Specify materials, joining methods, cleanliness controls and compatibility with the intended utility and maintenance regime. State which construction records are required and which inspections support acceptance. For steam, address condensate removal, drainage, thermal movement and access to traps. For gases, evaluate contamination introduced by regulators, seals, filters and flexible connections. Applying a water-system rule to every dry gas branch without a mechanism-based justification is poor specification practice.
The final arrangement should identify isolation, pressure control, filtration where required, sampling access and the connection to the process. State who owns the section downstream of the final filter. A removable hose may be part of the qualified system if it participates in normal production. Sampling upstream of that hose answers a different question from testing the utility as the process receives it.
Require an actionable monitoring and alarm strategy
For every monitored parameter, define the measurement purpose, location, range, accuracy needs, response time and calibration access. Separate a process protection function from a maintenance indicator. A filter differential-pressure trend may support maintenance, but it does not directly establish microbial retention or gas purity. Document which quality attributes require laboratory testing and which online measurements provide useful, validated information.
An alarm requirement should identify the trigger, allowed delay where justified, recipient, expected action and record. Include bad sensor status, communication loss, loss of utilities and restart behaviour. If production must stop, define the permitted safe state and the condition for restart. Do not assume that the presence of a red symbol on an HMI guarantees an effective operator response.
For GMP-relevant electronic records, define access control, timestamps, retention, backup, restoration and review responsibilities. Audit trails should be addressed where relevant to the record and system risk. Identify which historian records are needed for an investigation and how they will be associated with manufacturing activity. A trend that cannot be retrieved with its operating context may have little evidential value.
Specify backup as a qualified operating mode
Two generators can share a single feed-water dependency, controller, power supply or distribution bottleneck. Two gas supplies can also share the same vulnerable changeover manifold. Define the failure that redundancy is intended to address and identify common causes. The backup strategy must cover capacity, quality, changeover time, monitoring, maintenance readiness and the maximum permitted operating duration.
A cylinder backup for a nitrogen system introduces regulators, connections, supplier lots and a different pressure profile. Its certificate and nominal purity do not demonstrate quality through the installed backup route. Require verification of that route and its changeover sequence, including the response when backup quality cannot be confirmed. Availability is improved only if the backup can supply an acceptable utility under approved conditions.
Plan qualification while the URS is being written
Define which evidence can be generated during design review, FAT, SAT, commissioning and site qualification. Factory tests can verify skid functions, but they cannot fully demonstrate the installed distribution or every production connection. Reuse sound evidence where justified and traceable; identify what transport, installation and site configuration may invalidate. The objective is complete coverage, not repeated testing with different document titles.
For PQ, select operating conditions and sampling locations that answer the identified quality risks. Include representative users and justified challenges such as high demand, low demand, restart or standby operation. The duration and extent should reflect the system, intended use and relevant variability. A fixed number of days or runs copied from another utility is not a scientific justification.
Make maintenance and turnover part of acceptance
Require maintainable isolation boundaries, clean replacement methods, spare-part identification and recovery criteria. The supplier should explain how critical components are inspected, adjusted and replaced and which changes affect performance. Define the documents needed for release: as-built drawings, component records, calibration, approved software configuration, operating instructions, training, spare parts and resolved quality-impacting deviations.
Ownership must continue after project closure. Assign responsibility for monitoring review, supplier changes, periodic system assessment and requalification decisions. Include energy and water consumption targets as engineering objectives with a defined measurement basis. Their optimisation should remain within the approved quality and performance envelope, including during low demand and standby operation.
Review checklist before procurement approval
- Every user and operating mode has a documented contact assessment and quality specification.
- Pressure, flow and capacity requirements identify measurement boundaries and reference conditions.
- Peak demand and diversity assumptions are supported by a production scenario.
- Distribution, final connections and reverse-flow risks are within an assigned scope.
- Monitoring and alarms lead to defined actions, records and restart decisions.
- Backup operation has a quality verification strategy and common-cause assessment.
- Every significant requirement maps to an acceptance criterion and evidence owner.
- Maintenance, change control and turnover documentation are deliverable requirements.
The practical test is straightforward: ask the supplier, process owner and quality unit to explain how the same requirement will be accepted. If their answers concern different boundaries or operating conditions, revise the URS before equipment selection becomes difficult to change.
Related engineering decisions and references
Develop the feed-water interface with Pharmaceutical Water & WFI Systems. Keep the steam utility boundary aligned with Cleaning, CIP & SIP Systems, and assess aseptic gas connections with Aseptic Fill-Finish & Barrier Systems. The Critical Utilities Systems hub connects requirements to design, testing and lifecycle decisions.
- [GUIDANCE] European Commission, EudraLex Volume 4: applicable EU GMP framework; Annex 15, 2015; Annex 1, 2022; Annex 11, 2011. Applicability must follow product and jurisdiction.
- [GUIDANCE] ICH Q9(R1), EMA Corr.2, 2025: official risk-management guidance.
- [TECHNICAL STANDARD] ISO 8573-1:2010: technical classification standard; public catalogue scope reviewed, protected numerical tables not reproduced.
