The distribution architecture is decided in a few weeks, somewhere between drafting the URS and evaluating technical bids, and it commits the next twenty years: energy consumption, maintenance load, utility availability, microbiological risk profile, and the competence required from whoever runs the system at night and in August. Whoever decides rarely has an honest comparison of hot loop, ambient loop and ozonated loop in front of them, because every party tends to present as "the GMP standard" whatever it builds best.
The most common misreading concerns the regulatory starting point itself. Annex 1, clause 6.10, requires WFI to be stored and distributed in a way that minimises microbial growth, and cites constant circulation above 70 °C as an example. That is an example given inside a regulatory text, not a mandatory set point: the requirement is the outcome — minimising microbial growth — not the temperature used to achieve it. Confusing the two produces mirror-image mistakes: imposing a hot loop where the rationale does not support it, or adopting an ambient loop without building the demonstration that the outcome is still achieved and maintained.
Requirement, cited example, engineering choice
Separating the three levels is what makes a design rationale defensible.
- Requirements (Annex 1, in operation since 25 August 2023). Clause 6.7 requires the system to be designed, qualified, monitored and maintained to prevent microbiological contamination, with piping sloped for drainage and dead legs avoided; 6.8 requires qualification that takes seasonal variation into account; 6.9 requires flow to remain turbulent, with the flow rate established during qualification and monitored routinely; 6.12 requires sanitisation according to a predetermined schedule and as a remedial action following out-of-limit or out-of-specification results; 6.13 requires regular ongoing chemical and microbiological monitoring, with alert levels based on initial qualification data and periodically reviewed; 6.15 requires continuous monitoring, such as TOC and conductivity, for WFI systems.
- Example cited in a regulatory text. The constant circulation above 70 °C in clause 6.10, and the thermal treatment above 75 °C mentioned in EMA Q&A EMA/INS/GMP/443117/2017 (in force since 1 August 2017), which explicitly leaves contact times to the manufacturer's validation. These are useful references, not acceptance criteria: if they appear in a site specification, they appear because the site adopted and justified them.
- Site engineering choice. Everything else: operating temperature, ozone concentration, cycle duration, sanitisation frequency, instrument locations, point-of-use release logic. None of these values are copied from another plant: they are established, justified on qualification, historical data and risk assessment, and documented.
The same EMA Q&A observes that RO typically operates at ambient temperature and that this is an ideal environment for biofilm formation. The observation addresses WFI production by non-distillation methods, not distribution: transferring the reasoning to an ambient loop is a legitimate engineering inference, and should be presented as such rather than as a regulatory prohibition that does not exist.
Among non-binding sources, USP <1231> (an informational chapter, official since 1 December 2021) covers system design, materials, sampling, validation, microbial control and sanitisation, ozone included; the ISPE Baseline Guide Vol. 4 Water and Steam Systems (3rd ed., September 2019) and the ISPE Good Practice Guide Ozone Sanitization of Pharmaceutical Water Storage & Distribution Systems (2nd ed., October 2024) are industry guidance. ISO/DIS 25413 on PW and WFI storage and distribution systems is a project under development, with the DIS ballot open since 21 July 2026: it can inform a specification, it cannot be cited as an applicable standard.
Setting the boundary of the comparison
The comparison only means something at equal boundary. All three architectures leave unchanged the feed water quality, compliance with the monograph applicable at the point of use, the turbulent flow of clause 6.9, the absence of dead legs, drainability, and continuous monitoring for WFI. What changes is the mechanism by which microbiological control is maintained in the tank and in the loop, and everything that mechanism drags with it in materials, instrumentation, utilities, procedures and competence. Loop geometry and surface finish remain a separate chapter, covered in designing the distribution loop and in dead legs, slopes and materials.
Hot loop
The principle is continuous suppression of proliferation by maintaining temperature: in normal operation the loop already runs under sanitising conditions, so control does not depend on a periodic event but on the steady state. Hence the perception of robustness — well founded, provided you recognise where the mechanism does not reach.
What it drags with it: insulation of the entire circuit, management of thermal expansion and supports, selection of pumps, seals, gaskets and instruments rated for the operating temperature, continuous heat input, and almost always cooling at users that cannot draw hot water. It adds a scalding hazard to be managed with guarding and procedures, and it stresses the surface under conditions that make rouging monitoring part of the lifecycle programme.
There are three critical points. Cooled branches and point-of-use drops are not at loop temperature, and that is where the residual risk concentrates. Temperature must be demonstrated at the least favourable point of the circuit, not only on the return line where the probe is convenient to install. Tank stratification and behaviour after a substantial draw must be characterised during qualification, because it is in the recovery transient that the assumed steady state proves to be one or not. A hot loop is not sterile and does not exempt anyone from the monitoring required by clause 6.13: it changes the risk profile, not the obligation.
Ambient loop with periodic sanitisation
The principle is the opposite and equally legitimate: no continuous thermal barrier, with control entrusted to design — turbulence, drainability, no stagnation, materials and finish, point-of-use geometry — combined with recurring sanitisation on the predetermined schedule required by clause 6.12. This is the architecture that makes water immediately usable at the point of use, removes cooling exchangers, reduces heat input and simplifies instrumentation and materials.
What it drags with it is less visible but not smaller: planned unavailability, utility consumption, effluent management, and above all a burden of demonstration. If the method is thermal, piping, valves, gaskets, instruments and vent filters must withstand the cycles, and the cycle must be designed to reach the intended conditions at the least favourable point. If it is chemical, you need rinse verification, residue limits defined by the site with an adequate analytical method, material compatibility and operator safety.
The dominant critical point is frequency: a site parameter, not a catalogue figure. It is established from the regrowth kinetics observed on the real system, confirmed in performance qualification and reviewed through trending, exactly like the alert levels of clause 6.13. A frequency copied from another plant is an unverified assumption that holds until the first excursion. And the interval between two cycles is, by definition, the period in which the system is least protected: the sampling plan must detect a drift inside that window, not merely confirm effectiveness immediately after the cycle.
Ozonated loop
The principle is to keep ozone dissolved in the tank and, depending on the design, in the loop — continuously or on programmed cycles — and to destroy it before use. It is an ambient-temperature architecture that replaces the thermal barrier with a reversible chemical one, and it deserves the same rigour as the other two: it is not a compromise, it is a third solution with constraints of its own. Four elements must be addressed explicitly at specification stage.
- Removal of the residual before use. Water delivered at the point of use must not contain residual ozone. Destruction is achieved with dedicated units downstream of the ozonated section, sized on the worst case of flow and concentration, not on the nominal condition.
- Verification of removal. Removal must be demonstrated, not assumed: measurement of the residual downstream of the destruct unit, an interlock preventing delivery until the condition is verified, management of sensor failure or drift, and periodic confirmation by an independent method. The acceptance limit and the analytical method are established and justified by the site. The most delicate moment is the return to service after a cycle or after maintenance, when the point-of-use release logic is the only barrier between an undestroyed residual and the product.
- Compatible materials. Passivated stainless steel is not the problem; elastomers, gaskets, valve diaphragms, O-rings, polymeric components and wetted instruments are. Ozone compatibility must be verified component by component against supplier documentation and written into the purchase specification, because replacement with an "equivalent" but incompatible spare is a routine maintenance event that degrades the system silently. Passivation status and the cleaning programme remain governed by the reference practices (ASTM A967/A967M-25, ASTM A380/A380M-25) and by the materials part of ASME BPE, whose applicable edition must be fixed contractually.
- Cycle parameters established and qualified by the site. Concentration, contact time, frequency, injection points and ozone distribution around the loop are not universal figures: they must be defined, justified and qualified on the real system, demonstrating that the intended condition is reached at the least favourable points. Ozone is consumed along the path as a function of organic load, temperature and materials: the concentration measured at the tank is not the concentration acting at the far end of the loop, and qualification must close that gap with data, not with an assumption of uniformity.
Then come the system consequences: ozone generation and dissolution, destruct units with ageing components and therefore a replacement interval to be justified, ambient ozone detection for personnel safety, more elaborate automation and more surface to qualify. Many ozonated designs still retain the ability to perform a thermal or chemical sanitisation as a remedial action under clause 6.12: a reasonable choice, to be made deliberately rather than discovered missing during the first investigation.
The cross-cutting themes that actually decide the design
Instrumentation and monitoring
Each architecture shifts the centre of gravity of the instrumentation. The hot loop requires temperature probes positioned to represent the least favourable point rather than the most accessible one, and it forces the sample conditioning for the TOC analyser — typically a cooling stage — to be itself a controlled, drainable section included in the sampling plan. The ambient loop shifts the weight onto TOC and conductivity monitoring and onto microbiological frequency. The ozonated loop adds dissolved ozone analysers, with their own calibration and drift, and ambient detectors. Clause 6.15 applies in every case: it is a requirement independent of the architecture.
Alarms, interlocks and set points governing water release are GMP-relevant: they must be qualified, protected, traceable and changed only under change control. An ozone interlock disabled "temporarily" to clear an alarm is an inspection observation already written.
Point of use, cooling and heat exchangers
The point of use is where the bill for the chosen architecture is paid. In a hot loop, a user that cannot draw water at loop temperature requires local cooling on the drop or a cooled sub-loop: either way a segment appears with no thermal protection, and it must be drainable, sanitised on the same schedule as the main system and included in the sampling plan. In an ambient or ozonated loop delivery is direct, but the drop remains a volume that is not circulating between draws. The rule does not change with the architecture: sanitisation and sampling must reach the terminal segment, otherwise you are protecting the loop and not the water actually used.
Heat exchangers are interfaces between product-contact water and service fluids. They must be designed to make a leak detectable — for example with a double wall and an inspectable or monitored interspace — and to manage the pressure differential so that any leak does not travel towards the pharmaceutical water; the direction of the differential and the test criteria are design decisions to be fixed and verified during qualification. Drainability and sanitisability with the chosen method must also be assessed, together with the operating logic: continuously active cooling keeps a section permanently outside loop conditions, on-demand cooling creates a stagnant volume between uses. Two different risk profiles, both manageable, neither free.
Energy and operating balance
This is where unverifiable numbers circulate most freely. There is no typical consumption per architecture: there is a balance to be built on the real system, accounting for heat losses from the insulated circuit and the input needed to compensate them, the heat removed at the exchangers and the cost of the cooling utility, the pumping power needed to maintain the turbulent regime required by clause 6.9 against the actual pressure drop, the energy of the sanitisation cycles multiplied by their frequency and, for the ozonated architecture, generation, any oxygen supply and the destruct units. The comparison is meaningful only if the bids use the same balance boundary, the same draw profile, the same operating hours and the same tariffs, and only if each supplier declares the assumptions behind its figures. A number without assumptions is not data: it is a sales argument, and it should be requested differently in the enquiry.
Sanitisation, excursions and recovery
Clause 6.12 requires sanitisation in two ways: on a predetermined schedule and as a remedial action. The three architectures answer the second case differently. In a hot loop the sanitising condition is the normal condition: after an excursion the question is not how to restore, but what happened — loss of temperature, an isolated branch, a maintenance intervention, the way the sample was taken. In an ambient loop recovery goes through a remedial cycle and a demonstration of restoration, with downtime governed by microbiological incubation times rather than by cycle duration. In an ozonated loop intensification is immediate, but the burden remains of demonstrating that the condition was reached at the affected point and that the residual was removed before return to service.
Clauses 6.13 and 6.14 apply in every case: alert levels based on initial qualification data and periodically reviewed, excursions documented, reviewed and investigated, distinguishing an isolated event from an adverse trend or system deterioration. The EMA Q&A is explicit about the recurring temptation: "Increasing of such limits is not good practice and may mask a failing system". The logic for blocking and releasing points of use during an investigation — which users stop, on what data service resumes, who authorises it — must be defined in procedure before the event. The detail of the cycles and their demonstration is covered in qualification of sanitisation cycles.
Operational complexity and lifecycle cost
Lifecycle cost is not the price of the skid. The items must be estimated with site data and declared assumptions: initial investment, including insulation, exchangers and ozone units; qualification and validation effort, which grows with the number of instruments, interlocks and cycles to be demonstrated; energy, per the balance described above; consumables and spares, with attention to ageing components and compatible gaskets; planned unavailability for cycles and unplanned unavailability for investigations, valued at the real cost of stopped production; competence and training; periodic review and requalification over the service life.
Two asymmetries matter. A lower initial investment can impose a higher recurring burden of demonstration, and the reverse is equally true. And operational complexity is not only a cost: it is a risk factor, because a system that requires more correct decisions from the operator has more ways to be run badly. Weigh it against the site's real organisation, not its ideal one.
Decision matrix
Weights are assigned before looking at the scores and depend on context: markets served, product criticality, layout, available utilities, competence in place. The weight column is deliberately empty.
| Criterion | Weight | Hot loop | Ambient loop + sanitisation | Ozonated loop |
|---|---|---|---|---|
| Control mechanism | Continuous, coincides with normal operation | Discontinuous, depends on schedule and design | Continuous or cyclic, reversible barrier | |
| Typical weak point | Cooled branches and drops | Interval between two cycles | Ozone distribution and residual removal | |
| Recovery after an excursion | Nothing to restore: investigate the cause | Remedial cycle + demonstration of restoration | Intensification + proof of coverage and removal | |
| Critical materials | Temperature rating, expansion, insulation | Compatibility with the chosen method | Ozone compatibility of every non-metallic part | |
| Additional instrumentation | Temperature at unfavourable points, sample conditioning | Baseline + microbiological load | Dissolved ozone, ambient detection, interlocks | |
| Impact on the point of use | Local cooling or cooled sub-loop | Direct delivery | Delivery conditional on residual verification | |
| Dominant energy items | Continuous heat input, cooling, pumping | Pumping, cycle energy | Pumping, ozone generation, destruct units | |
| Qualification effort | Temperature distribution and transients | Cycle effectiveness and frequency justification | Parameters, coverage and removal verification | |
| Competence in operation | Thermal engineering and burn safety | Microbiology and schedule discipline | Ozone handling, safety, dedicated instruments |
Worked example: Site Delta
Site Delta is a teaching example, not a real plant: sterile injectables and an oral solids line, with a WFI loop feeding compounding and filling and a PW loop feeding granulation and parts washing. The first useful decision was to recognise that the two loops need not give the same answer. For WFI the team weighted continuity of microbiological control and simplicity of recovery high, justified by product criticality and the cost of a filling stoppage; for PW it weighted utility availability across shifts and compatibility with users drawing at ambient temperature high, and arrived at a different answer. In both cases the weights were minuted before the scores, and the rationale went into the URS and the risk assessment, traced through to DQ.
The complication came from a WFI user that could not receive hot water. Local cooling on the drop was treated as a sub-system with its own rationale: drainability, inclusion in the sanitisation schedule, a dedicated sampling point, a release criterion after prolonged idleness. This is where many projects lose the advantage of the chosen architecture, because the exception is handled as a piping detail instead of an element of the control strategy. The connected decisions sit in the Pharmaceutical Water & WFI Systems hub.
Common mistakes and red flags
- Citing the 70 °C of clause 6.10 as a requirement in the URS, specifications or protocols: it is an example, and presenting it otherwise weakens the whole document.
- Adopting an ambient loop without building, on your own data, the demonstration that microbial growth is still minimised.
- Copying sanitisation frequency, operating temperature or ozonation parameters from another site instead of qualifying them on your own system.
- Ozonating without documented verification of residual removal at the point of use, or with an interlock nobody has qualified.
- Verifying ozone compatibility on the steel alone, ignoring gaskets, valve diaphragms and polymeric components, and then reintroducing an incompatible spare during routine maintenance.
- Measuring temperature or ozone only on the return line and inferring the condition of the whole loop.
- Excluding drops, sub-loops and exchangers from the sanitisation schedule and the sampling plan.
- Comparing energy bids built on different balance boundaries and draw profiles, or changing set points and interlock logic outside change control.
- Treating a hot loop as "self-sanitising" in order to reduce the monitoring required by clause 6.13.
Red flags: nobody can say on what basis the architecture was chosen; the sanitisation frequency is in the procedure but has no written rationale; the energy balance exists in a single version with no assumptions; the decision was already made and the matrix exists to justify it; the team has no microbiologist and nobody from the function that will run the system.
If you work on decisions like these, The Pragmatic GMP collects technical and regulatory analysis on GMP systems with the same approach.
Key takeaways
- Annex 1 clause 6.10 requires WFI to be stored and distributed so as to minimise microbial growth; constant circulation above 70 °C is an example cited in the text, not a mandatory set point.
- None of the three architectures is universally superior: what changes is the control mechanism, the typical weak point, the recovery path, the critical materials and the distribution of cost.
- Clause 6.12 requires sanitisation both on a predetermined schedule and as a remedial action: design for both.
- For ozone, four elements are mandatory in the design: removal of the residual before use, documented verification of that removal, verified compatibility of every non-metallic component, and cycle parameters established and qualified by the site.
- The weak point of every architecture sits at the point of use and in the drops: sanitisation and sampling must reach them.
- Energy and lifecycle comparisons are worth something only with the same balance boundary, the same operating profile and assumptions declared by every supplier.
- Clauses 6.13 and 6.15 remain valid in every architecture: no design choice reduces the monitoring obligation.
Regulatory and technical references
- EudraLex Volume 4, Annex 1 (C(2022) 5938 final), in operation since 25 August 2023 — clauses 6.7-6.15. health.ec.europa.eu
- EMA/INS/GMP/443117/2017 Q&A Production of WFI by non-distillation methods, since 1 August 2017; EMA/CHMP/CVMP/QWP/496873/2018, in force since 1 February 2021. ema.europa.eu
- USP informational chapter <1231> Water for Pharmaceutical Purposes (official since 1 December 2021), which also covers ozone sanitisation; chapters <643> and <645>.
- WHO TRS 1033, Annex 3 (2021) (who.int); WHO TRS 1025, Annex 3 (2020), which requires validated thermal and/or chemical sanitisation at intervals set by the manufacturer.
- ISPE GPG Ozone Sanitization of Pharmaceutical Water Storage & Distribution Systems, 2nd ed., October 2024; ISPE Baseline Guide Vol. 4 Water and Steam Systems, 3rd ed., September 2019 — industry guidance, not regulatory texts.
- ISO/DIS 25413 Purified water (PW) and water for injection (WFI) storage and distribution systems — a project under development, DIS ballot open since 21 July 2026: not a published standard.
- ASME BPE — applicable edition to be fixed contractually; ASTM A967/A967M-25 and ASTM A380/A380M-25.
- PIC/S PI 009-4 Inspection of Utilities, rev. 4, since 1 January 2021 (picscheme.org); ICH Q9(R1), Step 4 on 18 January 2023; FDA Guide to Inspections of High Purity Water Systems (1993), non-binding (fda.gov).
