A nitrogen generator can pass its factory tests while the installed nitrogen supply fails at a filling machine. A clean steam generator can deliver acceptable condensate while a poorly drained branch supplies wet steam. Qualification must therefore answer a specific question: can the complete utility, in its approved configuration and operating range, supply the quality and availability required by each relevant process interface?
This article covers generation, storage, distribution, controls and points of use for clean steam, compressed air, process gases and relevant vacuum systems. It does not qualify a sterilisation cycle or establish pharmaceutical water requirements. Those interfaces belong with Cleaning, CIP & SIP and Pharmaceutical Water & WFI. The engineering decisions sit within the Critical Utilities Systems area.
Start with a qualification claim that can be tested
[GUIDEGXP RECOMMENDATION] Write the final intended claim before drafting protocols. Identify the utility, supplied users, approved demand envelope, required attributes, operating modes and evidence needed for release. “System qualified” is too broad when only the generator outlet was sampled or the emergency supply was never connected.
Separate three boundaries. The source boundary covers generation or receipt, treatment and storage. The distribution boundary covers the installed network, branches and local conditioning. The process boundary includes the final regulator, filter, hose and connection actually used. Assign owners where these boundaries cross vendor packages, engineering disciplines or production equipment. An unassigned hose is still part of the contamination pathway.
Distinguish quality from availability. A pressure test establishes neither gas purity nor microbiological suitability. Conversely, acceptable laboratory results during low demand do not demonstrate pressure stability during concurrent production. Record the separate acceptance decisions so that a good result in one dimension cannot conceal missing evidence in another.
Regulatory expectations and engineering choices
[REGULATORY REQUIREMENT / EU GMP] For applicable medicinal-product manufacture, Annex 15, effective October 2015, provides the qualification framework; section 8 specifically addresses utilities. Applicability and the current text should be checked through EudraLex Volume 4.
[QRM] ICH Q9(R1), EMA Corr.2, 23 January 2025, informs the risk rationale. The practical consequence is to explain why a test matters, what uncertainty remains and who accepts it. A numerical risk score alone cannot justify omitting evidence for a credible product contamination mechanism.
[TECHNICAL STANDARD] ASTM E2500-25 offers a science and risk based verification approach. It is not a universal list of utility limits. [GUIDANCE] The FDA process validation guidance, January 2011, provides lifecycle context; utility qualification supports, but does not replace, process validation. The workflow below is original GEP and GuideGxP implementation advice.
DQ: resolve uncertainty while design is still changeable
Design qualification should connect the approved user requirements to design evidence. Review actual demand profiles, simultaneous users, minimum consumption, restart conditions and future connections. A supplier’s nominal capacity may refer to conditions unlike the site’s inlet temperature, gas purity target, feed-water quality or cooling availability. Require the proposed operating envelope and its assumptions.
Review contamination pathways from intake or delivery to the final connection. For air, include intake contaminants, dryer performance and oil fractions. For gas generators, consider purity during startup and changing demand. For steam, evaluate separation, heat loss and condensate removal. For vacuum, consider the direction of movement during shutdown, not only during normal suction.
Challenge maintainability before accepting drawings. Can a final filter be changed without exposing an adjacent operating branch? Can instruments be calibrated at their installed ranges? Can sampling be performed without adding an unqualified reducer? Resolve inaccessible drains, undocumented bypasses and ambiguous isolation boundaries before construction converts them into expensive deviations.
Allocate evidence across FAT, SAT and commissioning
Factory acceptance testing is useful for accessible package functions: component identification, control sequences, alarm logic, simulated instrument failures and documented software configuration. Specify which tests use real process conditions and which use simulation. A simulated purity signal demonstrates control response, not gas purity. An unloaded compressor test cannot establish performance of the installed distribution network.
Before reusing supplier evidence, examine the procedure, acceptance criteria, calibration, raw records, configuration and deviations. Decide whether transport, installation or later software changes could invalidate the result. Reuse evidence where justified; repeat the affected verification where it is not. The goal is a traceable argument, not identical test sheets with different headings.
Site acceptance and commissioning address site interfaces: utilities feeding the package, direction of flow, leak tightness, electrical protection, mechanical completion, loop checks, safe venting and initial operation. Classify punch-list items by their effect on safety, quality and testing validity. An unresolved sampling connection may prevent PQ even when the package is mechanically ready.
IQ: prove what was actually installed
Installation qualification reconciles the physical system with approved specifications. Walk down equipment tags, pipe routes, branch destinations, valves, filters and instruments against current drawings. Confirm materials and fabrication records at the level justified by intended use. A certificate for one delivered component does not establish traceability for the whole assembled network.
Include cleaning and preservation records, installation orientation, regulator arrangement, sample-point identification and protection against unintended connections. Establish which documentation is authoritative when a drawing, asset list and vendor manual disagree. Record the resolution rather than silently selecting whichever version makes a test pass.
Calibration evidence should include the measurement range and intended decision. A sensor calibrated far from the operating region may be unsuitable for an acceptance test. Record tolerances, uncertainty where relevant, and traceability. Configure the maintenance and calibration system before turnover so that installed critical instruments do not become invisible after qualification.
OQ: challenge the approved operating envelope
Operational qualification tests the functions and conditions that protect the process. Include justified combinations of high demand, low demand, load changes, startup, shutdown and transfer to backup. Avoid arbitrary overloads outside design limits. Use engineered simulations when a live challenge could create an unsafe condition or contaminate product, and document what the simulation cannot demonstrate.
Test alarm generation, delay, routing, acknowledgement and the required action as one chain. A visible alarm is insufficient if it reaches an unattended workstation or production continues after the supply becomes unsuitable. Check permissives, fail states, sensor faults and recovery after power or communications loss. Reconcile timestamps between control and independent measurement systems.
Redundancy deserves its own scenario. A second compressor sharing the same dryer, electrical supply or control cabinet may leave a common failure unaddressed. Demonstrate the approved transfer sequence and determine whether pressure and quality remain acceptable through the transition. If backup requires a purge or a release check, make that requirement explicit in operating procedures.
PQ: demonstrate performance at relevant points of use
Performance qualification combines representative production conditions with an approved sampling strategy. Select locations according to contact risk, branch characteristics, demand, local conditioning, infrequent use and potential contaminant accumulation. The most distant outlet is not automatically the only worst case. Different locations can be worst cases for pressure, moisture, particles and microbiological risk.
Define exactly what each sample represents. A sample upstream of the final filter characterises supply to that filter; a sample at the operating connection addresses what reaches the process. Both may be valuable, but they answer different questions. Include hoses, adapters and local regulators where they are part of normal use, or document the reason for a different configuration.
Set duration, repetition and seasonal coverage from the process, variability and knowledge gaps. There is no universal utility PQ duration or mandatory number of runs applicable to every design. Identify remaining seasonal uncertainty and its planned verification. Do not turn an unresolved critical question into an unrestricted release merely by extending a monitoring spreadsheet.
A decision matrix for evidence and acceptance
| Claim | Evidence to plan | Decision consequence |
|---|---|---|
| Source produces required quality | Source testing at justified operating conditions, calibrated methods and defined attributes | Accept source capability; retain distribution and user verification as separate obligations |
| Distribution preserves quality | Branch walkdown, appropriate cleanliness evidence and comparisons at justified locations | Investigate local deterioration instead of accepting the source certificate as network evidence |
| Demand is supportable | Time-aligned flow and pressure during justified simultaneous users and transitions | Restrict the operating envelope or correct capacity and control weaknesses |
| Backup protects production | Transfer challenge, common-cause review and recovery checks | Release only the backup mode actually demonstrated and procedurally controlled |
| Point of use is suitable | Representative quality testing through the approved final assembly | Authorise the identified user configuration, not every future connection |
Methods, raw data and deviations
Agree test-method suitability before execution. Particle measurement is not microbiological testing; an aerosol oil result does not establish total oil; a pressure dew-point value needs its pressure basis. For steam, physical quality and condensate chemistry require distinct evidence. A successful utility test also does not establish sterilisation effectiveness in the connected equipment.
Make data reconstructable. Retain sample identifiers, location, operating state, time, equipment, method, units and relevant raw records. Where electronic records support a GMP decision, address access, changes, retrieval and continuity under the applicable computerized-system strategy. EU GMP Annex 11, January 2011, remains the current EudraLex reference verified for this article.
A failed acceptance criterion requires documented assessment, not quiet replacement with a more convenient criterion. Distinguish invalid sampling, instrument malfunction and an actual utility failure using evidence. Preserve the original result and the rationale for additional testing. Review impact on earlier evidence and connected processes before deciding the extent of repetition.
Practical case: a new nitrogen branch
A hypothetical site adds a nitrogen branch for product-contact blanketing. The generator FAT passes and source purity is stable. During OQ, concurrent operation causes a local pressure dip. During PQ, moisture at the new outlet rises after a weekend shutdown, while the source remains unchanged. These observations indicate two questions, not one general “nitrogen problem”.
The team compares pressure before and after the local regulator, records the shared demand and checks the branch sizing. It separately examines the new hose, connection history and stagnant branch exposure, using a controlled sampling assembly to exclude a sampling artefact. Increasing generator pressure would not resolve the moisture investigation and might merely conceal a restrictive regulator.
Release follows documented corrections and affected verification: the demand scenario, local assembly and shutdown recovery are retested against approved criteria. The branch is added to the operating map and monitoring plan. Existing users are assessed for impact from the shared pressure change. The completed report identifies precisely which users and modes are approved.
Turnover checklist and lifecycle ownership
- URS requirements link to approved evidence, deviations and a clear acceptance decision.
- Source, network and final user configurations are identifiable in current drawings and asset records.
- Qualified limits and engineering targets are distinguished in procedures and controls.
- Sampling, alarms, maintenance and calibration have trained owners and executable instructions.
- Backup, shutdown and restart conditions match the modes actually demonstrated.
- Unresolved issues have explicit impact assessments and authorised restrictions where justified.
- Changes to capacity, filters, software, supply source or user connections trigger assessment.
Qualification ends with a controlled handover to routine operation, not with the last sample. Routine monitoring watches the state established by qualification; periodic review examines whether its assumptions remain valid. New demand, recurrent alarms, maintenance findings or a changed gas source can reopen the original justification. A useful qualification package makes those decisions easier because it preserves the reasons behind the tests.
Make the release boundary visible to operations
The turnover record should name the owner and storage location of each approved document. Operators need to understand which temporary connections, replacement hoses or borrowed instruments require an additional assessment. Give any operating restriction a clear trigger, responsible person and removal condition. A restriction hidden in a qualification report will not reliably control a production decision made months later.
