The basic design review of an extension arrives with a question that is rarely settled: should the new grade C suite supporting the filling line be served by the air handling unit that already feeds the oral solids block, or does it need its own? The process engineer brings the loads, the architect the volumes, the supplier a proposal. Nobody has yet written the sentence that matters: how the system must behave when it stops.
HVAC architecture decides what can be shut down without shutting down everything else, and how wide the requalification scope becomes after a change: it is chosen in a few weeks and paid for over the life of the facility. The Cleanrooms & HVAC Systems track treats that choice as a documented decision. No architecture is best in absolute terms: there is the one that makes a specific contamination perimeter defensible. The wrong way to get there is to start from an air change rate read off a table.
Why the choice drives tendering, qualification and operation
The architecture enters the URS as a functional requirement. In tendering it determines comparability: without the perimeter of each unit, redundancy criteria and behaviour on failure, a price gap measures different choices, not efficiency. In qualification it sets the system boundary: a unit serving different perimeters ties their qualifications together, and the periodic requalification of Annex 1 §4.32, at a maximum interval of six months for grade A and B and twelve months for C and D [REQUIREMENT], must find windows suiting both. In operation the real cost is not only energy: it is downtime and restoration of the qualified state.
What actually constrains the design
| Source | Status / date | What it actually constrains |
|---|---|---|
| Annex 1, EudraLex Vol. 4 | In application since 25 August 2023 | Filtration of appropriate efficiency (§4.1); positive pressure or airflow towards the lower grade under all operating conditions (§4.14); airflow visualisation (§4.15); qualification of air volume, differentials, flow direction, temperature and humidity (§4.25); risk-based utilities (§6.1–6.6) |
| Chapter 3 and Chapter 5 | Effective 1 March 2015 | Effective ventilation with temperature, humidity and filtration control (§3.12); technical anti cross-contamination measures including controls on air recirculation (§5.21) |
| Annex 15 | Effective 1 October 2015 | URS, DQ, FAT/SAT, IQ/OQ/PQ, qualification of utilities (§8), change control (§11) |
| WHO TRS 1010, Annex 8 | 2018 | Non-prescriptive guidance; HEPA at least class H13 to EN 1822 or equivalent against cross-contamination [GUIDANCE] |
| FDA Aseptic Processing Guidance | September 2004 | Nonbinding recommendations; contains the only citable ACH figure, in a narrow scope |
| 21 CFR 211.42(c)(10) and 211.46 | In force | HEPA-filtered air under positive pressure, temperature and humidity control, environmental monitoring |
Where the air volume actually comes from
Supply air volume is not a starting figure: it is the outcome of distinct constraints, quantified separately and resolved by taking the most demanding one, not their sum.
- Classification and clean up. Meeting the particulate limits of the grade at rest and in operation, and restoring the at rest condition within the clean up period, given in Annex 1 §4.29(iii) as a guidance value below twenty minutes [GUIDANCE] and determined at qualification.
- Sensible load. Equipment, lighting, fully gowned occupants, building envelope: the constraint that surprises at commissioning, when the real load exceeds the specification.
- Latent load. Process and occupant moisture, infiltration, the range required by product and materials: see the article on temperature and humidity.
- Pressure balance. Supply, return and exhaust offset envelope leakage and sustain the differentials: the pressure cascade is solved together with the air volume.
- Containment. Local exhaust removes air from the balance and can reverse a differential: it is sized on product risk, not room volume.
- Airflow pattern. Where product is exposed, flow geometry matters more than aggregate volume, and the evidence is the §4.15 visualisation [REQUIREMENT].
Annex 1 contains no air change rate requirement: the air change rate is a derived indicator, useful for comparing options, not a target. The only figure citable from a primary source is FDA, whose 2004 guidance calls at least twenty air changes per hour "typically acceptable" [GUIDANCE] and only for ISO 8 supporting rooms; for ISO 7 and ISO 5 it says only that significantly higher rates are normally needed. The ranges circulating in specifications have no primary source: imposing them removes the project's ability to show, with its own data, that the chosen air volume is right.
The air handling unit as a chain of functions
A pharmaceutical AHU is better described as a sequence of functions than as an object: outside air intake and pre-filtration, mixing with return air where recirculation is used, heat recovery, thermal and moisture treatment, fan section, filtration, distribution, terminal filtration. Every function is a failure point and a maintenance point: designing the architecture means deciding where to place it.
Filtration is arranged in stages, with final filters close to the point of supply: terminal filters protect against contamination of the downstream network, filters inside the unit bring that network into the qualified perimeter. In Europe the E/H/U classification remains EN 1822-1:2019 while test methods moved to the EN ISO 29463 series [STANDARD]: a specification citing EN 1822-4 or EN 1822-5 cites withdrawn standards. Test ports and scanning access must appear on the drawings, or qualification becomes improvisation.
Humidification and dehumidification are selected on how demonstrable their controls are — steam in contact with supply air, wetted surfaces, dead legs — not on stated efficiency; any heat recovery able to transfer mass between exhaust and supply needs justification in the CCS.
Recirculation, full fresh air and containment
Chapter 5 §5.21 lists controls on air recirculation among the technical measures preventing cross-contamination, alongside dedicated facilities, self-contained areas, closed systems, isolators, dust extraction and pressure cascades [REQUIREMENT]. It does not require recirculation to be eliminated: it requires it controlled and the control justified.
The options form a continuum: full recirculation within a single perimeter; recirculation with dedicated filtration on the return; recirculation excluded between areas handling different products; full fresh air where no mixing is defensible. The supporting toxicological assessment uses the HBEL logic of the EMA guideline, which does not address zoning or air handling: an input to the risk assessment, not a design rule. ISO 14644-16 is voluntary guidance [STANDARD]: setback and airflow modulation are acceptable only where return to the qualified state is defined and traceable.
Redundancy, failure modes, shutdown and restart
Redundancy is specified only after the failure modes have been listed: fan stoppage, filter loading, damper or valve failure, sensor drift, loss of power, loss of the control system. Each needs three answers: what happens to the differential, what happens to flow direction between adjacent grades, and how long the system can stay there before the qualified state is lost. The minimum of ten Pascal between adjacent rooms of different grade in §4.14 is explicitly a guidance value [GUIDANCE] and must hold under all operating conditions. Duty/standby units, multiple fans, dual power supply and redundant sensors cost space, energy and maintenance: they are justified area by area as a risk decision [QRM].
Behaviour on shutdown and restart belongs in the URS with the same precision as nominal conditions. An unmanaged stop reverses the flows and drags air from lower grades towards higher ones: the sequence must define the shutdown order of supply, return and exhaust, the fail-safe damper positions and the behaviour of interlocked doors. In an emergency, fire logic prevails and the cascade is lost: the CCS must state how the area is recovered. Return to the qualified state runs through parameter stabilisation, differentials and the clean up period, and the control system must know its state and block activity until recovery is complete. This is almost always the widest gap in existing facilities, as in the article on requalification and retrofit.
Maintainability closes the picture: Annex 1 §6.1–6.6 requires pipework and ductwork to avoid recesses and surfaces difficult to clean [REQUIREMENT], and concentrating filters and sensors in unclassified technical corridors is worth more in operation than many efficiency gains.
Comparing architectures
| Architecture | When it is appropriate | What it really costs | Risks to manage in the CCS |
|---|---|---|---|
| Central AHU serving several areas | Same perimeter, similar loads, coordinated campaigns | Coupled availability; wider requalification and change control | Transfer through the common return; simultaneous loss of cascade |
| Dedicated AHU per area or suite | Distinct perimeters, different risks, independent shutdowns | More units to qualify and maintain; more space and skills | Inconsistent calibration; interfaces between areas on different units |
| Full fresh air system | High hazard profile, dust or solvents, no defensible mixing | Maximum energy use; moisture treatment sized on extreme outdoor air | Seasonal sensitivity of humidity; cascade stability across seasons |
| Recirculation with filtration on the return | Single controlled perimeter, energy reduced without losing control | Additional filtration to qualify; more complex return network | Transfer through the return; testability of return filters |
What QRM contributes
ICH Q9(R1), at Step 4 since 18 January 2023, applies QRM to facilities, equipment and utilities in Annex II.4, covering zoning, utility design and qualification scope: it supplies the method, not the parameters. Formality as a continuum (§5.1) calibrates the analytical effort; subjectivity and bias (§5.3) matter, because previous experience often weighs more than project data; product availability (§6.1) legitimises supply continuity as a redundancy criterion.
Worked example: Site Vega
Site Vega is a realistic but entirely fictional example. It produces oral solids in a block served by central units and adds a grade C and D suite for a new sterile filling line; the initial proposal extended an existing unit with spare capacity.
The failure mode analysis produced three findings. The requalification windows clashed with the campaign calendar of the existing block. The common return would have created a transfer path between different products, indefensible without dedicated filtration. The restart of the sterile suite needed a sequencing logic the existing unit could not host without a change control on an area in production. The decision was a dedicated unit, with recirculation confined to the sterile perimeter. On a site with homogeneous products the same analysis could have concluded the opposite and been equally defensible: what makes the decision solid is not the architecture, but the traceability of the reasoning through to URS and CCS.
Decision matrix
| Criterion | Weight | How it is assessed | Evidence to produce |
|---|---|---|---|
| Unit perimeter versus contamination perimeter | No unit serves distinct perimeters without a justified barrier | Air scheme, area/unit matrix, CCS | |
| Independence of shutdown and requalification | Simulation of maintenance windows by grade | Maintenance and requalification plan | |
| Failure mode behaviour and recirculation justification | Effect of failures on differentials; cross-contamination risk | FMEA or HAZOP, risk assessment | |
| Shutdown and restart sequence | Stop order, fail-safe positions, return-to-production conditions | Control functional description, OQ tests |
Levels of prescriptiveness
| Statement | Level | Source and limits |
|---|---|---|
| Appropriate filtration, positive pressure towards the lower grade, recirculation controls | [REQUIREMENT] | Annex 1 §4.1 and §4.14; Chapter 5 §5.21 |
| Twenty air changes per hour "typically acceptable" | [GUIDANCE] | FDA 2004, nonbinding, ISO 8 supporting rooms only |
| Clean up period, guidance value below twenty minutes | [GUIDANCE] | Annex 1 §4.29(iii), determined at qualification |
| Energy optimisation must not compromise compliance | [STANDARD] | ISO 14644-16, voluntary standard |
| Architecture and redundancy justified area by area | [QRM] | ICH Q9(R1) Annex II.4 |
| Test ports and scanning access shown on drawings | [GEP] | Good engineering practice |
| Air change rate is a derived indicator, never a specification requirement | [GUIDEGXP] | GuideGxP editorial recommendation |
Operational checklist
- Map every classified area onto its contamination perimeter before assigning units.
- Calculate clean up, sensible, latent, pressure balance and containment constraints separately, and record which one set the air volume.
- Remove from the specification any air change figure imposed without a primary source.
- Define in the URS the behaviour required on shutdown, setback and restart.
- Run a failure mode analysis per area and turn each outcome into a verifiable requirement.
- Justify recirculation with a risk assessment on the products handled.
- Specify staged filtration, final filter position, test ports and technical-corridor access.
- Check that the standards cited in the specification are the editions in force.
- Simulate maintenance and requalification windows before freezing the design.
- Record in the CCS the outcome of the choice and the residual risks.
Recurring mistakes and red flags
- Starting from air changes and deriving loads and balances from them: it inverts the design logic.
- Attributing air change ranges to standards that do not contain them, or extending the ISO 8 FDA figure to other grades.
- Treating shutdown and restart as procedural matters rather than functional requirements of the control system.
- Extending an existing unit because it has spare capacity, without checking perimeters and requalification windows.
- Confusing CFD with verification: it replaces neither qualification, nor airflow visualisation, nor field testing.
If this way of reasoning — rules verified at source, an explicit line between requirement and guidance, decisions that hold up in inspection — is useful, the The Pragmatic GMP newsletter publishes the same kind of analysis on cleanrooms, utilities and qualification.
Key takeaways
- There is no universally better HVAC architecture: only the one that makes a specific contamination perimeter defensible.
- Air volume follows the most demanding constraint among clean up, sensible and latent load, pressure balance and containment.
- The only citable ACH figure is the FDA 2004 "typically acceptable" value, for ISO 8 supporting rooms only.
- Recirculation is not prohibited: Chapter 5 §5.21 places it among the technical measures to control and justify.
- Failure modes, shutdown and restart are URS requirements, verified at OQ.
References
- EudraLex Vol. 4, Annex 1 (since 25 August 2023).
- EudraLex Vol. 4, Chapters 3 and 5.
- EudraLex Vol. 4, Annex 15.
- ICH Q9(R1) (Step 4, 2023).
- WHO TRS 1010, Annex 8.
- FDA, Aseptic Processing Guidance (2004).
- 21 CFR Part 211.
- ISO 14644-4 and ISO 14644-16.
- PIC/S Publications (PI 009-4, Section 1).
