Define the direction and purpose of each airflow before specifying room pressure differentials. In high-potency manufacturing, a room cascade, a containment enclosure and a process exhaust system form interacting parts of the control strategy. A negative room pressure cannot establish that an operator is protected at an open source, and a negative isolator pressure cannot establish that contaminated exhaust is safely managed.
The engineering objective is a coordinated system that controls release at source, limits migration and responds predictably to disturbances. Setpoints, airflow quantities and alarm limits must follow the process, toxicology, building arrangement and risk assessment. This article deliberately avoids universal pressure or air-change values that could be misapplied to a different facility.
1. Separate primary and secondary containment
Primary containment acts at the process boundary: an enclosure, closed machine, transfer interface or local exhaust arrangement. Secondary containment includes the room and surrounding facility features that limit consequences if material escapes the primary control. Both layers require a defined function and evidence appropriate to that function.
Map the areas around each operation, including corridors, airlocks, adjacent production rooms, technical spaces and waste routes. Identify expected movement of people, materials and equipment. A pressure diagram should relate these spaces to the process rather than treating every room as an isolated numerical target.
Assess how a release could reach an operator before room ventilation removes it. General dilution ventilation may reduce background concentrations but can be insufficient for a concentrated source near the breathing zone. Where release prevention or local capture is feasible, evaluate those controls directly instead of compensating only with more room airflow.
2. Develop the pressure and airflow concept together
Pressure differences arise from the balance between supply, extract and leakage paths. Door position, building leakage, transfer openings and fan operation affect that balance. A design should therefore specify operating conditions and flow relationships, not simply a list of pressure readings expected under closed-door conditions.
Document intended airflow direction at relevant boundaries and the assumptions needed to maintain it. Consider whether a door opening changes the protective function and what happens when two connected spaces are disturbed simultaneously. Airlocks may support segregation, but their use and interlocks must match the actual movement sequence and emergency requirements.
Define acceptable operating ranges and transition behaviour through engineering analysis and risk assessment. The evidence may include balancing measurements, pressure trends, functional challenges and airflow visualisation where suitable. No single method proves every aspect of containment, and visualisation should be interpreted within the tested configuration.
3. Coordinate enclosure extraction with room systems
Containment equipment draws air from somewhere and discharges it somewhere. Identify whether make-up air comes from the room, a dedicated supply or another controlled source. Quantify the interaction across operating modes, including idle equipment, simultaneous use, cleaning and maintenance. Otherwise, one machine starting may disturb another machine or the room cascade.
Review the effects of variable extraction demand, filter loading and control-loop response. A fan or damper may maintain a measured pressure at one point while another critical flow changes. Specify the variables that represent the protective function and consider how sensor location influences what the control system actually knows.
Avoid conflicting controls that repeatedly correct one another. For example, a room controller and an enclosure controller may interact through shared airflow. Agree control priorities, response times and operating limits with the equipment and HVAC suppliers. Verify the integrated behaviour at site because a factory test rarely reproduces the complete building system.
4. Treat the exhaust train as a containment boundary
Trace contaminated air from the point of capture through ductwork, filters, fans and discharge. Identify which components may accumulate active material and which are under positive or negative pressure during each operating mode. The consequences of leakage depend on both contamination and local pressure conditions.
Specify filtration according to the hazard, particle characteristics, emission-control needs and applicable requirements. A HEPA designation concerns filter performance under defined conditions. It does not demonstrate the integrity of housings, seals, ducts, access panels or the assembled exhaust system. Installation and integrity verification need an appropriate technical basis.
Review safe filter replacement, access for inspection, isolation and management of contaminated condensate or collected powder. Consider what maintenance personnel encounter in technical spaces outside the production room. An exhaust system can move the hazard away from the operator while creating a less visible exposure scenario for another worker.
5. Decide recirculation and discharge deliberately
Assess any proposal to recirculate air using a documented evaluation of the substances, filtration arrangement, potential failures and consequences. Do not infer acceptability solely from energy savings or from a filter's nominal efficiency. Applicable occupational, environmental and GMP expectations must be considered in their respective scopes.
For external discharge, review the destination and potential re-entry into occupied spaces or air intakes. Consider maintenance access and the consequences of an abnormal emission. Environmental permitting or discharge obligations depend on jurisdiction and process; they require site-specific review rather than a generic claim that filtered exhaust is unrestricted.
Document whether systems are dedicated or shared and why. Shared exhaust can introduce interactions, backflow paths and maintenance dependencies. Dedicated arrangements can simplify some boundaries but still require suitable design and verification. The choice should follow credible failure scenarios and the operational envelope, not a universal rule attached to the word HPAPI.
6. Define alarms and safe states
Select alarms from the protective function that could be lost. Relevant signals may include enclosure pressure, room differential pressure, extraction availability, filter pressure drop and damper or fan status. A running indication is not necessarily proof that the required airflow exists, and a sensor value is useful only if the measurement remains reliable.
For each alarm, state the trigger, delay where justified, operator response, automatic action and recovery conditions. Excessive nuisance alarms can encourage bypassing; long delays can mask a significant loss of control. Establish the balance through a documented assessment and challenge the configured behaviour during commissioning and qualification as appropriate.
Define what stops and what remains operating after a failure. Stopping a powder-transfer mechanism while maintaining extraction may be appropriate in one scenario; another may need a different controlled response. Loss of power, compressed air, network communication or a sensor should be considered explicitly. Do not equate a general emergency stop with a verified containment safe state.
7. Use a cause-and-effect review
The following matrix illustrates the decisions needed. It is not an instruction to apply the same response to every installation.
| Disturbance | Question to resolve | Possible evidence |
|---|---|---|
| Room door opens | Does the intended segregation remain effective during movement? | Operational airflow and pressure assessment |
| Enclosure extraction is lost | Which process actions stop and how is the boundary maintained? | Functional challenge of the defined safe state |
| Filter loading increases | Is the protective flow maintained within the approved operating range? | Trend review and controlled operating-range verification |
| Shared fan changes state | Can another branch lose capture or experience reverse flow? | Integrated system testing |
| Pressure sensor fails | Is the failure detected and is operation restricted appropriately? | Signal-failure and alarm testing |
| Power is restored | Can equipment restart before the required conditions are re-established? | Restart-sequence verification |
Assign an owner to each interface between equipment controls, the building management system and operating procedures. State which records are retained and how discrepancies are reviewed. A cause-and-effect chart has little value if suppliers implement different interpretations of the same event.
8. Resolve sterile-process interfaces explicitly
Some processes must protect both workers from a potent substance and sterile product from contamination. These objectives can create competing pressure and access considerations. Resolve them through an integrated design with defined barriers, airflow paths, transfer methods and failure responses rather than applying a simple positive-versus-negative pressure slogan.
[REGULATORY REQUIREMENT] EU GMP Annex 1 applies within its sterile-manufacturing scope and includes contamination-control expectations. Its relevance does not turn every potent-powder room into a classified cleanroom or establish an occupational containment target. Identify the actual sterile boundary and the applicable requirements for that process.
[QRM] Assess microbial, particulate and chemical risks together where they interact, while keeping their acceptance bases distinct. A cleanroom classification result does not demonstrate worker exposure control. Likewise, an enclosure operating under negative pressure does not by itself demonstrate protection of a sterile product.
9. Commission and verify the integrated system
Start with installation checks, instrument calibration, duct and filter arrangements, controller configuration and availability of current drawings. Confirm that balancing results correspond to the intended operating modes. Record limitations such as equipment not yet installed or doors held in an unrepresentative position during measurement.
Challenge representative combinations of equipment and room use. Include transitions selected by risk: start-up, shutdown, transfer, cleaning and recovery from relevant faults. Link results to the URS and the cause-and-effect matrix. Factory tests can support this evidence, but site integration requires verification under the installed conditions.
Containment performance studies and occupational exposure assessment then address questions that airflow measurements cannot answer alone. If a surrogate study detects emissions despite acceptable pressure readings, investigate the task and physical boundary. Do not dismiss the result because the HVAC indicators appear normal.
10. Example: an extraction upgrade
A site adds a second powder-handling enclosure to a room served by an existing exhaust system. Each enclosure performs satisfactorily in an isolated test. During simultaneous operation, however, the shared system may have a different operating point and the room balance may change. The design review must establish whether the combined arrangement remains within its approved envelope.
The project team checks the fan and duct capacity, control interactions, filter-loading assumptions and make-up air. It defines operating combinations and failure responses before installation. Site testing then challenges those combinations, including the transition when one enclosure starts or stops, with suitable measurements and acceptance criteria.
This example is a hypothetical engineering scenario, not a reported incident. It shows why component acceptance does not automatically establish integrated performance and why future expansion allowances should be documented in the original design basis.
11. Keep measurements connected to the protective function
Locate pressure taps and other instruments so that their readings represent the intended control question. Document reference spaces, sensing lines and any conditions that invalidate the indication. An unexplained difference between a portable measurement and a permanent display requires investigation of both methods and locations. Correcting a display offset without understanding the discrepancy can leave an airflow or reference-pressure problem unresolved.
12. Review checklist and lifecycle control
- Primary capture and secondary room containment have separate, clear functions.
- Pressure relationships are supported by airflow balances and defined door conditions.
- Equipment, room and shared exhaust controls have agreed priorities and interfaces.
- Filtration, duct integrity, discharge and safe maintenance are assessed as one connected system.
- Alarm responses and restart conditions are documented and verified.
- Sterile-process interfaces have an explicit contamination-control rationale where applicable.
- Site tests cover representative operating combinations and relevant disturbances.
- Exposure-control evidence extends beyond pressure readings and nominal filter ratings.
[GUIDEGXP RECOMMENDATION] Keep approved operating ranges, trends, deviations and changes in a lifecycle record. Reassess after alterations to room use, equipment demand, filters, control logic or ductwork. [OCCUPATIONAL HEALTH REQUIREMENT / GUIDANCE] Use competent review of actual work and exposure evidence to confirm that the system continues to provide the intended protection. A stable display is useful operational information; sustained control requires evidence from the process as it is really performed.
Sources, scope and engineering recommendations
Source status checked on 25 September 2026. Apply each document within its jurisdiction and scope. GEP and GuideGxP recommendations are engineering advice, supported by risk assessment; examples are illustrative. For copyrighted standards and ISPE guides, the public scope and edition were verified; detailed licensed protocols are not reproduced.
- [REGULATORY REQUIREMENT] European Commission — EudraLex Volume 4, Chapters 3 and 5.
- [REGULATORY REQUIREMENT] European Commission — EU GMP Annex 1: Manufacture of Sterile Medicinal Products.
- [OCCUPATIONAL HEALTH REQUIREMENT / GUIDANCE] HSE HSG258 — Controlling Airborne Contaminants at Work.
- [REGULATORY REQUIREMENT] US FDA — 21 CFR 211.46: Ventilation, Air Filtration, Air Heating and Cooling.
- [GUIDANCE] WHO TRS 957, Annex 3 — GMP for Products Containing Hazardous Substances.
- [QRM] ICH Q9(R1) — Quality Risk Management, EMA current version.
