A tunnel can maintain a stable temperature in the hot zone and treat vials in the center and at the edges of the belt differently. It can also achieve the required thermal exposure and lose control of contamination during cooling. Design and validation must therefore track the container along its entire path, from washing to the filler inlet, linking temperature, speed, airflow, operating conditions, and demonstrated endotoxin reduction.
1. Define the required container outcome
Thermal depyrogenation is not synonymous with simple dry heat sterilization. The latter aims at microorganism inactivation; the depyrogenation process must demonstrate the reduction of the relevant challenge. Bacterial endotoxins constitute a specific class of pyrogens: an endotoxin test does not automatically document the elimination of every pyrogen substance. The strategy must link material risk, product requirements, and analytical method.
For each container family, define geometry, material, mass, relevant surface area, post-washing conditions, belt density, and production range. Document compatibility with the treatment, including glass integrity and required functional characteristics. The nominal capacity in vials per minute is only meaningful if associated with these data and a demonstrable operating window.
[QRM] Separately identify the risk of insufficient exposure, thermal damage, and recontamination. A single aggregate score can mask very different mechanisms. Each risk must have a consistent control and proof: thermal mapping does not replace airflow studies, while good environmental classification does not prove endotoxin reduction.
2. Design interfaces before the hot zone
The upstream boundary includes the washer, transfer, accumulation, and tunnel inlet. Specify how residual moisture, delays, stops, and materials left in the line are managed. Changing the initial state of the containers can modify the heating profile. The time elapsed since washing is also a variable to be controlled when it influences the risk of contamination.
The downstream boundary includes the cooling zone, exit, and interface with aseptic filling. Verify the consequences of a filler stoppage on ventilation and containers in transit. Line logic must distinguish between correctly treated material, material involved in an event, and material yet to be treated, without relying solely on operator memory.
[GEP] Formalize an interface matrix with owner, signal, expected state, and failure response. For example, a stop request from the filler must have a defined behavior for the belt, heaters, and airflows. Verify the complete sequence during integrated tests, in addition to individual machine functions.
3. Balance air, pressures, and filtration
Air circulation contributes to both heat transfer and container protection. Distribution, recirculation, extraction, and connection with surrounding areas must be evaluated together. A flow rate change can improve a local temperature but worsen the balance between zones. For this reason, thermal and aerodynamic measurements must refer to the same documented configuration.
[REGULATORY REQUIREMENT] In the context of EU GMP Annex 1, paragraph 8.67, dry heat tunnels require a balance that protects the Grade A sterilization zone and HEPA filters on the supply air. The same paragraph requires integrity testing of filters at least twice a year. Apply this instruction within its scope, without turning it into a universal frequency for any industrial filter.
Define accessible and meaningful measurement points, stabilization conditions, and line configurations to be studied. Include interaction with HVAC and barrier systems. A nominal pressure difference, read with doors closed and no production, does not necessarily describe what happens during a stop or a transfer disturbance.
4. Translate belt speed into real exposure
Speed determines transit time, but the geometric length of the hot zone is not automatically equivalent to the container's useful exposure duration. Glass must heat up, may have different inertia, and travels through zones with non-uniform characteristics. The profile measured on the container is therefore more informative than just the length-to-speed ratio.
Define how actual speed is measured and what evidence allows for the recognition of deviations, slippage, or stops. Link the signal to the time identification of the material involved. A report showing only the setpoint does not prove that the belt followed that value throughout the campaign.
Selecting limit conditions requires a joint evaluation of speed, belt load, and temperature. Higher speed may reduce exposure; a different density may change circulation and heating. Do not assume that a single case represents the worst thermal transfer, the greatest glass stress, and the highest contamination risk simultaneously.
5. Build the thermal map of the path
The study must characterize transversal and longitudinal variability, including center, side positions, and significant inlet conditions. The number and distribution of probes must be derived from geometry, system knowledge, and study objectives. There is no universal number of thermocouples that makes any mapping adequate.
Distinguish air temperature from surface temperature or the part of the container relevant to the process. Document attachment, mass added by the probe, cable routing, and possible movement disturbance. A poorly positioned sensor can measure a condition different from the one intended to be qualified.
Calibration, resolution, acquisition interval, and synchronization must allow for describing the profile without missing significant events. Evaluate post-test verification results and their impact on uncertainty. The readability of a curve does not automatically make the measurement valid: its traceability and adequacy must be demonstrated.
6. Design an interpretable endotoxin challenge
The test must use representative containers, controlled challenge preparation, and an analytical method adequate for recovery from the treated surface. The applied quantity, initial recovery, analytical sensitivity, and expected reduction must form a coherent system. A challenge too close to the analytical limit can make it impossible to demonstrate the required performance.
[REGULATORY REQUIREMENT] Annex 1, paragraphs 8.68–8.69, links thermal depyrogenation validation to a suitable Fh and a minimum three-log reduction of endotoxins. It also requires representative containers, demonstrated recovery, and reconciliation of challenge containers. This is a contextualized requirement of the European GMP guide, not a universal recipe of temperature and time.
Define untreated positive controls, method controls, unique identification, and prevention of accidental contamination of production materials. Reconciliation must document entry, exit, recovered samples, and final destination. An untracked challenge container is an event to be managed, even if the other results are satisfactory.
[GUIDANCE] The second edition of the FDA guidance on pyrogen and endotoxin testing, published in March 2026, emphasizes the importance of sampling, storage, handling, and method suitability. The laboratory must establish how these elements influence recovery; a low result is uninterpretable without adequate analytical controls.
7. Link physical and analytical evidence
A reduction calculated as the difference between the logarithms of the initial recovered quantity and the final one requires both quantities to be valid and comparable. If the final result is below the method limit, the conclusion is a demonstrable minimum limit, not an infinite reduction. The report must explicitly state the treatment of censored results.
Associate each challenge with the thermal profile and the position actually studied. Do not attribute the profile of the center zone to a sample if it traveled near an edge without justification. Similarly, a compliant thermal curve does not resolve an invalid analytical recovery. The two pieces of evidence answer complementary questions.
Fh expresses equivalent thermal exposure according to declared parameters. It should not be confused with F0 for moist heat nor considered an autonomous demonstration of endotoxin destruction. Reference value, model used, and acceptance criteria must be justified in the context of the process and the challenge.
8. Validation decision matrix
| Decision | Necessary evidence | Error to avoid |
|---|---|---|
| Group formats | Comparison of geometry, mass, exposure, and flows | Use only nominal volume |
| Define maximum speed | Profiles and challenges at justified conditions | Confuse mechanical capacity and validated capacity |
| Accept reduction | Initial recovery, residue, and valid controls | Ignore analytical limit |
| Manage a stop | Study of sequence and container tracking | Restart without evaluating involved material |
| Release system | Thermal, aerodynamic, analytical, and functional results | Conclude based on air temperature alone |
9. Example: new format on an existing line
Consider a change from a lightweight vial to one with a thicker base. The outer diameter allows maintaining the same arrangement on the belt, and the supplier declares mechanical productivity unchanged. This does not demonstrate thermal equivalence. The new mass and geometry can alter the heating delay in the relevant surface.
The team compares materials and drawings, verifies post-washing conditions, and conducts development studies with measurements on the container. If a different profile emerges, it evaluates a lower speed or a different thermal window, also checking glass compatibility and line balance. The chosen solution becomes the object of validation according to an approved protocol.
This illustrative example shows why a family must be defined through scientific characteristics. Dimensional equivalence facilitates format change but does not replace the demonstration of exposure and challenge reduction. The final decision must expressly indicate which formats are included and which are excluded.
10. Stops, restarts, and transient conditions
Define the conditions that allow the entry of the first containers after startup. Consider thermal stability, ventilation, pressures, filter status, and recording availability. A generic "machine ready" signal must correspond to verifiable conditions, not just the absence of alarms.
During a stop, some containers may receive excessive exposure while others remain in transition zones. Identify the interval of involved material and segregation rules. Tests must include the restart and return to the qualified condition, with clear responsibilities for operational authorization.
Loss of power or communication requires a defined response. Establish which data remain available, how container position is preserved, and which conditions prevent automatic restart. Technical machine recovery is not equivalent to the acceptance of the material that was present in the tunnel.
11. Routine control and changes
The campaign record must allow for reconstructing the format, configuration, actual parameters, alarms, stops, and affected intervals. The review considers significant events and their management. A signature on the final report does not compensate for the absence of data necessary to evaluate a deviation.
Changes to fans, filters, heating elements, belts, sensors, software, or line interfaces must be evaluated for their impact on the validated configuration. Even a component declared equivalent can alter an important performance. Change control must establish which verifications are necessary before returning to production.
[GUIDEGXP RECOMMENDATION] Keep a summary sheet for each validated family: covered formats, operating window, initial conditions, test references, and rules for anomalies. It is useful for production and maintenance because it makes the boundaries of the validation visible without replacing protocols, reports, or controlled procedures.
12. Checklist before approval
Before approving the report, verify that the described configuration corresponds to the installed one and that every challenge container is reconciled. Check the validity of measurements, outcome of analytical controls, coverage of limit conditions, and closure of deviations. A summary table must allow linking each criterion to the supporting data.
Also verify that production has instructions applicable to the format and that maintenance is aware of interventions subject to prior evaluation. Limits must be consistent across recipe, procedure, report, and validation documentation. Divergences between these documents can create an unintended operating configuration even when the protocol has been executed correctly.
Finally, agree on indicators to follow over time: thermal profile variations, speed events, flow instability, and sensor anomalies. Evaluate trends on comparable conditions. Monitoring does not replace the planned re-qualification, but it helps to recognize deterioration before it becomes an evident failure.
References and paths
Sources verified on September 23, 2026: EU GMP Annex 1, §§ 8.67–8.69; FDA, Pyrogen and Endotoxins Testing: Questions and Answers, Edition 2, March 2026; ISO 20857:2010, scope and status in the official catalog. Consult the applicable compendial procedures in the authorized version in force.
Continue from the Sterilization & Depyrogenation Systems hub to dry heat oven design, process validation, and Aseptic Fill-Finish & Barrier Systems interfaces.
