A URS that only requires a "GMP autoclave with a validatable cycle" transfers decisions that belong to the pharmaceutical process to the supplier. The problem emerges when a chamber that complies with the specifications cannot accommodate the actual load, the system records the temperature without documenting heat penetration, or the tunnel reaches the setpoint but lacks reliable proof of endotoxin reduction. The User Requirements Specification must link every technical choice to an intended use, a risk, and a verifiable piece of evidence.
This article proposes an operational method for defining requirements for steam sterilizers, dry heat ovens, and depyrogenation tunnels. The design indications are GuideGxP recommendations to be adapted with Engineering, Production, Microbiology, Automation, and Quality departments. No value for temperature, duration, lethality, or number of probes is assumed to be valid for all processes.
1. Define the result before the equipment
The first requirement describes what must be treated and what result must be demonstrated. For components intended for an aseptic process, identification of critical surfaces, packaging methods, post-treatment protection, and transfer interfaces are required. For a product in its final container, composition, fill volume, thermal sensitivity, container integrity, and the consequences of heating and cooling are needed. For vial depyrogenation, materials, formats, initial conditions, and endotoxin control must be defined.
Sterilization and depyrogenation are not synonyms. The former concerns the inactivation of microorganisms through an adequately developed and validated process; the latter concerns the removal or inactivation of pyrogens, with specific proof required when the goal is the reduction of bacterial endotoxins. A biological indicator does not measure endotoxin removal. An endotoxin test alone does not prove sterility.
Disinfection, sanitization, and biodecontamination have different purposes and application conditions. The URS must prevent a supplier from responding to a sterilization request with a simple disinfection function. For SIP of installed systems and for biodecontamination of barriers, define the interfaces with the respective specialized areas without improperly extending the sterilizer’s perimeter.
2. Make the load a controlled specification
The load is not a note attached to the nominal chamber volume. Prepare a register with families, geometries, mass, materials, packaging, orientation, layout density, and quantity. For hollow parts or complex assemblies, indicate where air or condensate might remain. For liquids, specify the container, closure, filling, and conditions that may modify thermal transfer. For vials in tunnels, include dimensions, glass type, and distribution on the belt.
Identify the minimum load, maximum load, and significant intermediate configurations. The maximum number of pieces does not automatically coincide with the most difficult condition: a reduced configuration can change steam distribution, air circulation, or control response. Mixed loads require a technical justification that demonstrates the compatibility of treatment needs; production convenience does not constitute such a justification.
The URS should request drawings or photographs of the permitted configurations, identification of the carts, and criteria for handling new items. The load family must be based on demonstrable equivalence, not just the trade name. Establish who can approve a new component, what information they must provide, and when a change requires additional development, risk assessment, or new validation.
3. Build capacity based on the actual sequence
Useful capacity includes loading, conditioning, heating, exposure, any drying, cooling, unloading, and maintenance availability. A promise expressed only in daily cycles hides important assumptions. Request a balance based on representative families and declared utility conditions, distinguishing guaranteed performance from preliminary estimates.
Also evaluate external constraints: availability of washed materials, maximum waiting times, spare carts, maneuvering space, personnel flows, and the capacity of downstream operations. For a continuous tunnel, the bottleneck may stem from the combination of vial format, belt layout, qualified speed, and downtime management. Increasing speed to recover production can compromise qualified exposure.
A pass-through configuration requires explicit requirements for loading and unloading sides, interlocks, state segregation, and maintenance. Ask how unauthorized opening on the clean side is prevented after an interrupted cycle, how material is identified, and how the return to service is managed. These functions must be testable, not simply described in the manual.
4. Separate the three thermal strategies
In moist heat, the specification must include air removal, contact of the heating medium with the relevant surfaces, drainage, uniformity, and load penetration. For liquids, product response and container protection may require strategies different from those for porous loads. The number of vacuum pulses must derive from process development and testing, not from a generic preference.
In dry heat, air circulation, thermal distribution, object arrangement, and heating of cold spots have a decisive weight. Request accessibility of filters and fans, thermal expansion management, protection during cooling, and material compatibility. An oven designed for sterilization is not automatically suitable for a depyrogenation objective.
For a tunnel, define the relationship to be demonstrated between the thermal profile, belt speed, airflow, and container behavior. Air temperature in the hot zone does not replace the container profile. The validation plan must provide for the assessment of the endotoxin challenge, its recoverability, and analytical suitability, with responsibilities agreed upon between the site, the laboratory, and the supplier.
5. Specify utilities and boundaries of responsibility
Document the required and available conditions for steam, water, air, electricity, vacuum, drains, and extraction. For each interface, indicate the delivery point, operating range, peak consumption, behavior outside the range, and verification responsibility. Ask what happens if two sterilizers require steam simultaneously or if the available pressure drops during conditioning.
The qualification of clean steam as a utility does not prove the autoclave cycle performance. Similarly, a successful cycle does not replace utility monitoring. The URS must link steam requirements to the specific application and clarify the sampling point and the representativeness of the verification. For generation and distribution, the area reference is Critical Utilities Systems.
Include maintenance access, energy isolation, component replacement, and configuration restoration. An unreachable valve can turn an ordinary intervention into a disassembly that involves the qualified boundary. This is a design and availability issue, as well as a document management one.
6. Translate risks into verifiable requirements
The following matrix is an original example of a structure, not a list of universal criteria. Numerical limits must be defined in the approved project documents before the execution of tests. Each requirement should have a stable identifier, an owner, and a change management method.
| Requirement | Rationale | Criticality | Acceptance Criterion | Verification | Evidence |
|---|---|---|---|---|---|
| Manage the identified load | Ensure medium access and repeatability | Per process QRM | Approved configuration, limits, and performance | Design review and loading studies | Drawing, protocol, and raw data |
| Detect an invalid critical measurement | Avoid improper acceptance | Critical if it influences acceptance | Response and load status compliant with functional spec | Fault challenge | Events, trends, and test report |
| Protect pass-through unloading | Prevent unauthorized transfer | Defined by the barrier | Approved permissives and interlocks respected | Sequence and interruption tests | Door state logging |
| Trace the recipe version | Reconstruct the executed cycle | GMP relevant | Report associated with the version actually used | Controlled change and record review | Audit trail and cycle report |
| Demonstrate depyrogenation | Control endotoxin risk | Critical for intended use | Applicable process and recovery criteria met | Thermal study and justified challenge | Sample traceability and analytical results |
Avoid compound requirements that combine five performance items into a single sentence. If a test only satisfies four elements, the outcome becomes ambiguous. Instead, separate function, performance, recording, and responsibility; maintain the links in the traceability matrix.
7. Request evidence usable by automation
The specification must identify critical parameters, tolerances, necessary sampling, data origin, and acceptance logic. Distinguish the sensor controlling the cycle from the measurement used to detect a non-compliant condition. Request an assessment of common dependencies: two values presented on the screen may come from the same measurement chain and offer no real independence.
Define recipe versioning, authorizations, motivation for changes, alarms, interruptions, restarts, and behavior after power or communication loss. The report must allow for the reconstruction of the cycle identity, load, recipe, phases, measurements, anomalies, and final decision. A signature on a PDF does not resolve the absence of original data needed for review.
For electronic systems, specify retention, recoverability, backup, and restore tests. Coordinate these requirements with Automation & Digital Systems. The supplier must declare what is included in the system and what depends on site infrastructure, procedures, or configurations.
8. Plan qualification and validation without confusing them
[GUIDANCE EU GMP] Annex 15 links qualification to intended use and requires that documentation support life cycle decisions. In the project, DQ, FAT, SAT, commissioning, and IQ/OQ/PQ must have defined objectives and a strategy for using the evidence. A well-documented FAT can support subsequent activities when its usability is justified; it does not prove site conditions that were not present at the manufacturer's facility.
[GUIDANCE EU GMP] Annex 1 distinguishes physical characterization, load configurations, and, where appropriate, biological indicator support. The URS must make the collection of such evidence possible, but machine testing does not replace specific process validation. Agree on probe passage, accessories, instrument synchronization, availability of records, and deviation management.
[TECHNICAL STANDARD] ISO 17665:2024 mainly concerns moist heat sterilization of medical devices. Its invocation in a pharmaceutical project requires an assessment of applicability; it does not replace GMP, the authorized dossier, and product requirements. Avoid contractual formulas that list standards without indicating the edition, relevant scope, and method of verification.
9. Example: a future load changes the decision
A site purchases an autoclave for packaged metal parts and plans to add solution containers later. If the URS only reports chamber volume and maximum temperature, the offer may seem sufficient. The new load, however, introduces thermal inertia, cooling requirements, and possible container pressure constraints. The change cannot be resolved simply by adding a recipe.
The correct decision is to distinguish the initial configuration from future expansion. For each, define loads, performance, accessories, and tests. Ask the supplier which options make expansion feasible, what hardware modifications remain necessary, and which qualification or validation activities will need to be repeated. The cost of preparation thus becomes comparable to a subsequent retrofit.
10. Prepare for management after delivery
The requested document package must be usable by the site: updated diagrams, instrument list, critical components, software versions, approved recipes, maintenance instructions, and criteria for evaluating changes. Request readable and accessible formats for the entire period needed. A proprietary archive requiring an unforeseen license may limit review when the original system is no longer available.
Also define how the supplier communicates obsolescence, equivalent replacements, and software changes. The availability of a spare part does not automatically demonstrate functional equivalence: a probe with different dynamic response, a modified gasket, or a logic update may require different assessments. The URS must request the information needed to make that decision without assuming that every intervention requires a complete repetition of qualification.
Agree on training and knowledge transfer using real-world scenarios: alarm during exposure, loss of recording, incorrect load, and request for recipe modification. The goal is to make personnel capable of recognizing authorized limits, preserving evidence, and initiating the correct assessment path.
11. Checklist for approving the URS
- Intended use and microbiological or endotoxin objective are distinct and approved.
- Load families have identified configurations, boundaries, and owners.
- Capacity considers the entire sequence and utility conditions.
- Barrier, cooling, and transfer interfaces are explicit.
- Every critical requirement has a measurable criterion and expected evidence.
- Recipes, alarms, data, and post-interruption states are verifiable.
- FAT, site testing, and validation have agreed-upon responsibilities.
- Supplier exclusions and future provisions are evaluated.
The main red flag is a URS that describes many components but few acceptance decisions. Before approval, simulate the review of a failed cycle and a new load configuration: if it is not clear what data to collect, who decides, and what conditions allow a return to service, complete those requirements. A good URS makes the process demonstrable and its management sustainable over time.
References and linked paths
Sources verified on September 23, 2026: European Commission, EudraLex Volume 4, Annex 1 and Annex 15; ISO 17665:2024, scope and edition. GMP references must be evaluated with respect to jurisdiction, product, and authorization; the design checklists constitute [GUIDEGXP RECOMMENDATION] and [GEP].
Continue in the Sterilization & Depyrogenation Systems area, or delve into the Cleaning, CIP & SIP and Aseptic Fill-Finish & Barrier Systems interfaces.
