A relative humidity excursion recorded overnight in midwinter holds the release of a batch. The investigation stalls on its first question: where does the exceeded limit come from? In the specification the value appears with no stated origin, in the qualification protocol it was copied across unchanged, and the alarm carries a delay nobody signed for.
The problem is not the number, but that nobody knows which constraint it answers. Temperature, relative humidity and differential pressure are the parameters regulations require to be controlled without stating any value. The technical work is building the chain from the product constraint to the configured threshold: it is the point of the Cleanrooms & HVAC Systems track where compliance is only as good as the rationale.
Why the range reaches beyond the specification
The band declared in the URS sizes cooling capacity, dehumidification, humidification and outside air, and it is paid for every operating hour. It then becomes an acceptance criterion in qualification, an alarm threshold, and finally the measurement that decides whether a batch saw a condition outside the qualified state. A poorly chosen range produces recurrent deviations and pressure to revise thresholds operationally.
Regulatory framework: control required, values not fixed
Binding text requires temperature and humidity to be controlled and critical differentials monitored, but fixes no value. The only numbers available concern the differential, and the sources qualify them as guidance.
| Source | Status | What it actually binds |
|---|---|---|
| Annex 1 §4.25 | Applicable since 25 August 2023 | Temperature and relative humidity among the qualification tests, with no limits stated |
| Annex 1 §4.14 and §4.16 | As above | Positive pressure and/or airflow towards the lower grade in all operational conditions; minimum 10 Pa between adjacent grades, stated as "(guidance value)"; critical differentials recorded continuously with alarms |
| Annex 1 §4.32 | As above | Differential in the minimum requalification list; maximum 6 months for A and B, 12 for C and D |
| 21 CFR 211.42(c)(10)(ii) and 211.46(b) | eCFR as of 27 August 2026 | Temperature and humidity controls for aseptic processing; equipment controlling air pressure, humidity and temperature. No values |
| FDA, Aseptic Processing Guidance | 2004, nonbinding | On the differential only: 10–15 Pa with doors closed, 12.5 Pa towards an unclassified room |
Two absences carry as much weight as a requirement. §4.25 lists temperature and relative humidity among the qualification tests without fixing their limits [REQUIREMENT]: the acceptance criterion is a site document. The CFR and Chapter 3 §3.12 require air control with no number [REQUIREMENT]. ISO 14644-3:2019 provides the test methods, not the acceptance criteria [STANDARD].
Where each constraint on the range comes from
A defensible range is a set of independent constraints, each with a source and an approver. The final range is their intersection, and they are worth writing separately: when they conflict you must know which one gives way.
| Source of the constraint | What it determines | How it is documented | Who approves it |
|---|---|---|---|
| Stability of the exposed product | Limits during actual exposure | Development and stability data | Development and QA |
| Process and components | Hygroscopicity, electrostatics, primary packaging | Process description | Process owner |
| Envelope and condensation | Upper humidity limit | Surface temperatures and dew point | Building design |
| Gowning and metabolic load | Upper limit in the occupied room | Garment type and session duration | Production and EHS |
| Equipment loads | Cooling and dehumidification demand | Load schedule from equipment data | HVAC design |
| Room tightness and doors | Differential air volume and stability | Tightness test, door opening census | HVAC design |
| Measurement chain | Narrowest band that makes sense | Uncertainty budget, calibration | Metrology |
Product, process and operator
The least negotiable constraint comes from the exposed product: stability over the real duration of exposure, hygroscopicity of powders, electrostatic behaviour of materials. These data do not belong to HVAC engineering: they must be requested from development and cited in the URS with their source document. Where they do not exist, the range comes from a choice and must be declared as one. The second constraint is the operator: grade A/B gowning impedes the dissipation of metabolic heat, and the upper temperature limit is a matter of performance, not comfort.
Envelope, condensation and tightness
The third constraint is physical. Relative humidity depends on the water content of the air and on temperature: a limit stated without its reference temperature does not describe a state of the air. The practical risk is condensation on the coldest point the room air can reach, verified by comparing design surface temperatures against the dew point. For the differential, the equivalent constraint is envelope tightness with the door regime, covered in the article on airflow and pressure cascades.
Capability verification at the worst external conditions
A range is declared only after verifying that the system holds it under the worst external conditions foreseen for the site. Those conditions come from a recognised climate data set and belong in the contract specification: left implicit, the supplier picks them, and the verification is no longer comparable between bids.
The calculation needs two separate balances, because they do not peak at the same hour. The sensible load depends on outside temperature, solar gain and internal loads; the latent load on the absolute humidity of the outside air, on people and on processes. The worst hour for dehumidification is often mild and very humid, not the summer peak.
Part loads and degraded configurations remain. A system sized for the peak may fail to hold a narrow band at low load, because control runs outside its useful range. And since qualification is executed in one season, performance in the other is demonstrated with a full year of trend data [GUIDEGXP].
Set point, operating range, alert and alarm are four different objects
Confusing them is the most common cause of indefensible thresholds. The set point is the value the control loop tracks, an automation configuration parameter under change control. The operating range is the interval within which the process is qualified, and it is the acceptance criterion. The alert is an internal level derived from site trend data, signalling drift while there is still margin to act. The alarm opens a deviation.
Two rules follow. The alarm does not coincide with the edge of the operating range, or it arrives once the event has happened. And the alert is built on operating data, not on the regulatory limit, which by definition anticipates nothing. Set points and alarm configuration are records, as covered in the article on BMS, EMS and data integrity.
The alarm delay is a decision, not a setting
On the differential the signal is intrinsically transient: every door opening, every pass-box cycle, every unit changeover produces an expected excursion. Suppressing those signals with a delay or a deadband is legitimate, but it is suppression of information and must be documented together with the exclusion logic. Four things belong in writing: which transients are recognised as expected; how the system recognises them, preferably through an independent signal — door contact, interlock status — rather than elapsed time alone; the maximum duration accepted, derived from door openings measured on site and from the clean up period established in qualification; and what stays recorded while the signal is inhibited, because §4.16 requires continuous recording of critical differentials: the suppression concerns the alarm, not the data [REQUIREMENT].
A delay chosen by feel fails in both directions: too short and it generates signals the operator learns to ignore, too long and a real loss of cascade becomes indistinguishable from an open door. For temperature and humidity the inertia of the room makes real excursions slow, so a long delay is harder to justify.
Where it is measured, and with what uncertainty
A range is only as good as the point where it is measured. A probe in the return duct gives an average useful for control and unsuited to the exposed product: where the controlling sensor is not the one generating the GMP record, the distinction must be declared. For the differential what matters is a pressure tap away from diffusers and door gaps, and one unambiguous reference for the whole cascade. And the uncertainty of the chain must be compared with the width of the band it polices.
What every range has to demonstrate
| Parameter | Question the range must answer | Typical error |
|---|---|---|
| Temperature | Which limit protects product and process, and which keeps gowning sustainable for the real session duration? | Inheriting the previous project's range |
| Relative humidity, upper limit | Which value controls hygroscopicity and microbial growth and prevents condensation? | Setting it without declaring the reference temperature |
| Relative humidity, lower limit | Which documented constraint requires it: electrostatics, drying, the operator? | Tightening it for prudence, forcing continuous humidification |
| Differential between adjacent grades | Which flow imbalance holds the intended direction in all conditions? | Treating the 10 Pa minimum as a requirement rather than a guidance value [GUIDANCE] |
| Alarm delay | Which expected transient is excluded, and how is it recognised without masking a failure? | Setting it to reduce the number of signals |
Trends, excursions and investigation
Continuous recording achieves little if read only when it sounds: the periodic review must look at the distribution of the parameter inside the band, not only at exceedances. A parameter that sits near an edge is out of control even without alarms.
When the excursion happens, the investigation answers three questions in order: whether the measurement is valid — sensor, calibration, reference, data integrity; whether the event is an expected transient or a loss of capability; whether product or process were exposed outside the qualified state. Only the third concerns the batch, but without the first two it is not defensible.
Annex 1 §4.32 requires requalification within 6 months for grades A and B and 12 months for grades C and D [REQUIREMENT], with the differential in the minimum list. Temperature and relative humidity do not appear in that list although they are among the §4.25 tests: their periodic verification is justified on monitoring data, as in the article on requalification and retrofit.
Justifying the choices through QRM
ICH Q9(R1), Step 4 on 18 January 2023, is the methodological frame and contains no HVAC design parameter. Annex II.4 applies QRM to facilities, equipment and utilities, and so to the selection of critical parameters. §5.3 addresses bias, and here anchoring on the previous project's band dominates; §6.1 adds that an unnecessarily narrow band generates avoidable deviations. The outcome feeds the CCS under §2.3–2.5.
Worked example: Site Vega
Site Vega is a realistic but entirely fictional example: aseptic filling with a grade B background and, adjacent, a grade C dispensing room for a hygroscopic powder. The specification arrives with a narrow humidity band inherited from the previous project.
The team reconstructs the constraints separately. Development documents the upper humidity limit that protects the powder; grade B gowning sets the temperature limit; the envelope calculation shows that condensation on a cold technical surface constrains humidity more than the product does. The lower limit, which no document supported, is widened.
On the differential, the alarm delay is not copied across: door opening durations are measured during commissioning, the exclusion is anchored to the door contact and interlock status, and the rationale is approved with the functional specification. Because qualification runs in winter, a documented review of the summer trends is planned.
Levels of prescriptiveness
| Statement | Level | Source |
|---|---|---|
| Temperature and relative humidity among the qualification tests, with no limits; critical differentials recorded with alarms | [REQUIREMENT] | Annex 1 §4.25 and §4.16 |
| Temperature and humidity control required with no value fixed | [REQUIREMENT] | 21 CFR 211.42(c)(10)(ii) and 211.46(b) |
| Requalification including the differential within 6 and 12 months by grade | [REQUIREMENT] | Annex 1 §4.32 |
| Minimum 10 Pa between adjacent grades; FDA 10–15 Pa with doors closed and 12.5 Pa towards an unclassified room | [GUIDANCE] | Annex 1 §4.14; FDA 2004 |
| Standardised test methods with no acceptance criteria | [STANDARD] | ISO 14644-3:2019 |
| The band is built from product, gowning, loads and system capability | [GEP] | Good engineering practice |
| Alarm delays and transient exclusion logic justified by risk analysis | [QRM] | ICH Q9(R1) Annex II.4 |
| Set point, band, alert and alarm documented as distinct entries | [GUIDEGXP] | GuideGxP recommendation |
Operational checklist
- Collect the product constraint in writing, citing its source document.
- Document the gowning constraint with garment type and session duration.
- Verify the condensation risk before fixing the humidity limit.
- State external design conditions as contractual data and calculate sensible and latent loads separately.
- Verify that the range holds at part load.
- Write set point, band, alert and alarm as distinct entries with an approver.
- Derive alerts from site trend data rather than from the regulatory limit.
- Justify every alarm delay together with the transient exclusion logic.
Recurring mistakes and red flags
- Presenting a temperature or humidity as an industry standard value.
- Treating the 10 Pa minimum as a numeric requirement rather than a guidance value.
- Attributing numeric temperature or humidity limits to FDA.
- Setting an alarm delay with no documented exclusion logic.
If this way of separating requirement, guidance and engineering choice is useful in daily work, the discussion continues in the technical newsletter The Pragmatic GMP.
Key takeaways
- Regulations require temperature and humidity control and monitoring of critical differentials, without fixing any value.
- A defensible range is the intersection of independent constraints, each with a source and an approver.
- The band is declared only after capability verification at the worst external conditions.
- Set point, band, alert and alarm are distinct objects: merging them removes the margin to react.
- The only citable values concern the differential: 10 Pa as the Annex 1 guidance value, 10–15 Pa with doors closed and 12.5 Pa towards an unclassified room per FDA.
References
- EudraLex Volume 4, Annex 1, since 25 August 2023.
- EudraLex Volume 4, Chapter 3.
- 21 CFR Part 211, 211.42(c)(10)(ii) and 211.46(b).
- FDA, Sterile Drug Products Produced by Aseptic Processing, 2004.
- ISO 14644-3:2019, test methods.
- ICH Q9(R1), Step 4 of 18 January 2023.
