Overview
One common question asked by companies with rooms, buildings, or other enclosures with Heating, Ventilation, and Air Conditioning (HVAC) requirements is, “At what point does an excursion outside the specified range need to be logged?” A few of the most commonly monitored HVAC conditions in pharmaceutical manufacturing are differential pressure (DP), humidity, and temperature, each of which can impact the overall product quality. Alarms are typically used to notify personnel when these conditions go beyond set limits. Alarms are commonly grouped into action alarms, which are set at the edges of the validated range, and alert alarms, which notify personnel when a condition is outside of normal operating conditions. There is normally some space between these two alarm set points which allows time after an alert alarm to make adjustments to bring the system back to normal operation before an action alarm is triggered. Alarms that are too sensitive and trigger too frequently can create an atmosphere where alarms, even legitimate ones, are ignored. These nuisance alarms can be managed with alarm time delays.
Alarms can be adjusted to prevent activations due to small excursions beyond the limit, as long as there is no potential impact to product quality. Two important aspects to consider when configuring these alarm triggers are the duration and intensity of the excursions beyond the limits. Short ventures beyond the limit can have minimal or no impact on product quality. This can be done using time delays or by using trends to analyze the severity of the situation. These adjustments should be counterbalanced with an intensity check to make sure that a condition is not changing fast enough to prohibit personnel from having enough time to react to an alert alarm before an action alarm is triggered. Regardless of how the alarms are configured, testing will need to be done to confirm that the alarm system is operating as designed. Numerous test methods exist in order to thoroughly test the system for all monitored values (temperature, humidity, DP, etc.).
Background
Because of the importance of a properly conditioned manufacturing environment when producing pharmaceuticals, the facility HVAC conditions are of particular interest to regulatory agencies such as the Food and Drug Administration (FDA), European Medicines Agency (EMA), etc. In fact, many regulatory agencies require any deviation from the established acceptable conditions to be recorded with an explanation given as to why the deviation will not negatively impact the product (21CFR211, 2016). One of the most common and effective methods of ensuring that HVAC conditions stay within the designated requirements is by installing alarms that notify personnel when a particular condition has strayed too far from the target.
Some of the most commonly monitored HVAC elements in pharmaceutical manufacturing are temperature, humidity, and DP. Temperature and humidity are both monitored in order to ensure that the product stays stable and does not deteriorate or otherwise change due to an unacceptable amount of energy or moisture in the air. Except for very small spaces (e.g. lab-scale refrigerators) and areas with large sources of heat that is dissipated into the room, the temperature and humidity of a room tend to change slowly. Differential pressure is typically monitored as a means of preventing contamination or providing containment of toxic substances. The air pressure of a particular room or area is kept higher than that of the adjacent areas so that airflows will keep any particulates suspended in the air within a desired area. DP is monitored to ensure that this protection stays in place, but DP is prone to changing much more rapidly than temperature and humidity. In order to provide a buffer against these rapid changes as well as particulate contamination, airlocks are commonly included in a room design. Depending on the room classification and level of containment required, the DP setup across an airlock can be configured into one of three general formats: cascade, bubble, or sink (depicted in Figure 1 below). Cascade is used when either area cleanliness or product containment requirements exist, but not both. The premise for cascading is moving the all the air in one direction towards the “dirty” side. In order to maintain room cleanliness, air would move unidirectionally out of the room by keeping the room pressure higher than that of the adjacent areas (including the airlock), and vice-versa for product containment. The bubble and sink configurations are used when both room cleanliness and product containment requirements are in place. The bubble setup pressurizes the airlock to a higher level than either of the adjoining spaces in order to force air (and any suspended particles) to stay within its starting area. The sink configuration sets the pressure of the airlock lower than both of the adjacent areas in order to trap any particulates within the airlock. The sink configuration does create the risk of trapped particles travelling through the airlock via equipment/personnel transfer, so steps should be taken to ensure that the trapped particles have a frequent means of removal, such as an air feed & return specific to the airlock. (International Society of Pharmaceutical Engineers, 2009)
Figure 1: Airlock Configurations (International Society of Pharmaceutical Engineers, 2009)
While the use of alarms is a well-established good engineering practice, the strategy used to program those alarms can vary, particularly when it comes to when alarms need to be logged. For example, in a large warehouse a temperature monitoring station near an exterior door exceeds the alert alarm limit for a matter of only a few seconds before returning to within the acceptable range. Is it really necessary to log an alarm for a situation when the small localized disturbance clearly won’t impact the large thermal mass of the warehouse as a whole? US Pharmacopeia (USP) chapter 1150 dictates that “controlled room temperature limits the permissible excursions to those consistent with the maintenance of a mean kinetic temperature calculated to be not more than 25° [C]” (<1150> Pharmaceutical Stability). It is highly unlikely that a short disturbance like the one described above would alter the mean kinetic temperature in any significant manner. In addition, if alarms are always triggered and recorded, highly fluctuating conditions, such as DP, could lead to alarms so frequent that personnel are not able to effectively perform the task(s) at hand. These considerations must be tempered by the fact that patient safety takes precedence over all else. Alarm recording should not be reduced to the point that there is a chance for patient safety to be compromised.
One of the most common and effective practices in use today is the use of tiered alarm systems. This approach commonly uses two tiers, action and alert. Action limits are typically set to include the widest range of values for which it has been shown that there is minimal to no risk to product quality. Action alarms are triggered when a condition moves outside of the validated acceptable range, at which point a deviation must be generated. In order to avoid this situation, alert alarms are typically placed at the high and low ends of the normal operating range. The overall structure is depicted in Figure 2 below (International Society of Pharmaceutical Engineers, 2009).
Figure 2: General Layout of Tiered Alarms (International Society of Pharmaceutical Engineers, 2009)
Alert alarms are intended to allow personnel time to make adjustments to the system and/or space in order to avoid exceeding the action limit. Depending on the exact values of the limits, the alert alarms have the potential to trigger more frequently than needed. When these nuisance alarms are present, it can lead to the alarms being ignored even when the alarm is worth acknowledging (known as alarm fatigue). By adding in a time delay, the alarm will only activate if the condition has exceeded the alert limit for a designated amount of time. If properly tuned, this prevents rapidly changing conditions from creating a large number of “false alarms” and will create a more effective alarming system.
Alarm Time Delays
When applying limits to alarms, one aspect to consider is the reduction of nuisance alarms in order to prevent alarm fatigue. This is most commonly addressed in the form of alarm time delays. An alarm time delay prevents an alarm from activating until a designated period of time has passed. This is particularly beneficial for rapidly changing properties, like DP, which can fluctuate in and out of the alarm range quickly for short periods of time (International Society of Pharmaceutical Engineers, 2009). Because alert alarms occur within the validated range that is known not to endanger product quality, there is some flexibility with the length of these time delays. The delays should allow normal operation to occur without unduly hindering the process, while still alerting personnel soon enough to make adjustments before the action limit is reached. When setting the bounds on time delays, two key elements of the excursion beyond the alert limit must be considered: duration and intensity.
The duration of an excursion refers to how long the condition is outside of the normal operating range. The duration is important, because the longer the conditions are outside of the normal operating range, the higher the likelihood that the action limit will be hit. That means that for short excursions outside of the normal operating range, using alarm time delays can help prevent alarm fatigue. Another option for addressing short excursions is using a short-term trend to determine whether or not the condition is in a state of alarm. Trends are particularly helpful for smoothing out “noisy” signals that change extremely rapidly and preventing “false alarms” from a single spike in the signal. This trend should be based on very recently acquired data (on the order of seconds), not historical data. By using only a short time frame for forming the trend, the signal can be smoothed out and any significant failures can still be caught. One example of a trend like this is a time weighted average. This approach averages all signals over a short time span (usually about 4-10 seconds) and compares the average to the alert limit. This prevents a single signal spike from causing an alarm. (International Society of Pharmaceutical Engineers, 2009)
Besides duration, the other important aspect to consider in alarm management is intensity. Intensity refers to the relative speed at which the condition is changing. If a particular monitored condition is changing relatively quickly (compared to its normal rate(s) of change for that condition), there may be a chance that the action limit could be reached within the time delay of the alert alarm. Alternatively, the time delay may prevent operations employees from having enough time to properly react to the alert alarm before the action alarm is triggered. In order to prevent this, the alert alarm should be configured to activate if the rate of change is high enough to potentially activate the action alarm without allowing for enough adjustment time.
Temperature and humidity alarms are not as frequently equipped with time delays as a condition like DP since they tend to change much more slowly. There may also be other means of assessing the risk a particular condition poses to the product. For example, resistance temperature detectors (RTDs) can sometimes by submerged in glycol to simulate the product temperature. If this method is proved to accurately represent product temperature in the area of interest, then no time delay would be needed, since any measurement by the RTD beyond a temperature limit would mean that the product is also beyond the temperature limit. In some cases however (i.e. a small lab-scale refrigerator) time delays may still be appropriate. The same methodology described above should be followed in this situation as well. Enough time should be allowed for normal use to be unencumbered, but the alarm should activate soon enough to allow adjustments to be made that prevent the action limit from being reached. An additional aspect to consider is the placement of the temperature/humidity monitors. If the monitors are positioned directly in front of the door, then the time delay could be longer than the middle of the chamber, since the disruption from opening the door would be more localized at the front of the chamber. In order to understand exactly how disruptions and normal conditions may impact the contents of the chamber, the heat and mass (moisture) transfer properties of each individual chamber being monitored should be studied in conjunction with stability studies of every product stored inside the chamber. The stability studies provide a guide to how each product will react when exposed to varying temperatures and levels of humidity. A good practice is to use the most sensitive product(s) that spend any reasonable amount of time in the chamber when determining the configuration for an alarm. If additional products are added to the chamber after the initial qualification, the alarm configuration may have to be reconsidered accordingly. An alarm time delay should be selected which allows for normal operation while still preventing as much risk of product alteration from temperature or humidity as possible.
Another instance where time delays may be helpful is during setup. Before production begins, it may take some time for the room’s conditions to equilibrate, especially if a clean has been performed recently. In this situation, time delays may be configured to prevent the activation of any applicable alarms for a given period of time while the room reaches its steady state. This can prevent numerous “false alarms” (like high humidity after a clean) that would otherwise need to be addressed. If this strategy is used, it is vital that the time delay has expired or is manually turned off before production begins.
Inevitably, there will likely come a point where a monitored condition (temperature, humidity, DP, etc.) will stray outside the validated operating range. When this happens, an investigation is necessary (21CFR211, 2016). Because of the regulatory requirements to investigate any deviation from the approved and validated process, action alarms generally should not have time delays on them. By promptly alerting personnel to the situation, action alarms help maintain product safety as well as compliance with regulations. Recording the source and time of alarms, as well as other information about the incident and product being made provides the traceability required (US Department of Health and Human Services, 2006).
In certain circumstances when alert alarms are not practical but action alarms may cause alarm fatigue, a time delay on an action alarm may be acceptable. For example, when an airlock door is opened, the DP across that door typically disappears nearly instantaneously. Because the DP changes so rapidly, alert alarms are ineffective, since there is not enough time for stabilization or adjustments before the action alarm is triggered. Therefore, time delays are often applied to action alarms in order to reduce nuisance alarms. The length of the time delay should allow for normal operation, while still activating the alarm once there is a potential for adulteration. Because these delays are on action alarms, a thorough risk-based explanation of why the time delay presents no hazard (despite DP being beyond the validated limit) is required along with supporting documentation and testing. In the previously mentioned example, the alarm time delay should allow personnel to open and pass through the airlock door, but the alarm should be activated if enough time has elapsed that an unacceptable level of airborne particulates could enter into the processing room (e.g. if the door was held open). The rationale for the time delay selection should be explained in the validation documentation, and adequate testing should demonstrate that the time delay does not allow for an unacceptable influx of particulates.
It is often beneficial, especially when maintaining an ISO 14644-1 classification, to monitor airborne particulate levels in the space in addition to DP. This additional monitoring serves as a backup to the DP protection system and helps to easily show compliance with ISO 14644-1. The airflow characteristics of the room, especially the reaction to open doors, should be studied, and a time delay should be selected which allows reasonable operation and prevents as much potential contamination and/or provides as much containment as possible.
Testing
In order to demonstrate that the alarms and time delays function as intended, as required by regulatory agencies, testing must be performed and documented. Sufficient testing after installation but before full-scale use also serves to identify any potential problems that may arise. These problems can then be addressed before releasing the system for full-scale use, at which point problems can require a much more extensive investigation and potentially result in the need to reject or recall product. The exact type of testing required varies based on the alarms in place, the requirements of the HVAC system and room, and other factors that may affect safety and/or product quality.
If temperature and/or humidity are monitored, then temperature and/or humidity mapping of the area is required. This type of area mapping provides a clear picture of the temperature and/or humidity gradients and levels across the space, as well as how effective the HVAC system is at managing these levels over time. Much has been written about the best way of executing this testing, so for the purposes of this paper, the details of area mapping will not be discussed. For more information, read Temperature Mapping – How Many Sensors? by Mark Moody under the white papers section of perfval.com. If alarm time delays or any sort of trending (such as a time weighted average) have been applied to the temperature/humidity alarm triggers, then tests should be written and successfully executed to ensure that the alarms trigger as designed. One means of doing so is by using a controllable source of localized heating, cooling, humidification, or dehumidification that can be positioned near the sensors. Using this sort of equipment will allow enough control over the localized testing environment to adequately test the parameters at hand. It is important to test the system at the normal operating conditions, near the alert and action limits, and beyond the alert and action limits, in order to ensure proper operation across the entire operations spectrum.
When DP alarms are in place, testing should be conducted to ensure that the alarms are configured correctly to provide the appropriate level of protection. The testing should ensure that normal operations will not trigger alarms, but that conditions beyond the designed acceptable zone should activate the alarms. A simple method of doing this is by placing the lower classified space (i.e. the airlock) in a challenge state and monitoring airborne particulate levels in the higher classified space (i.e. the processing room) under normal circumstances and at circumstances that maximize the time delay. This test will show whether or not the alarm delay is effective at maintaining the desired cleanliness level of the room. Another testing option, which can be used in conjunction with particulate testing, is performing a smoke study. Smoke can be generated at the point of interest, such as a door frame, in order to see the air’s behavior when certain actions are performed (a door is opened, equipment is moved in or out, etc.). Unlike particulate tests, smoke studies can be performed across relatively small and localized areas, such as individual pieces of equipment. This testing leads to a much more thorough understanding of the airflow characteristics, which can be particularly helpful in sterile environments or when large equipment must be moved into or out of a classified area. (International Organization for Standardization, 2005)
Conclusion
The most basic purpose of alarms in a pharmaceutical manufacturing environment is to notify personnel when a situation has arisen that might make the product unsafe for use. These alarms however, are only effective if they receive the proper response, which may not happen if they are activated too frequently. Alarm time delays can help minimize “false alarms”. By focusing on the duration and intensity of any excursions beyond alarm limits, an alarm system can be configured to disregard small, inconsequential variations and still notify anyone necessary when a situation worth addressing does arise. Numerous test methods exist to verify that the alarm system is functioning as intended. By sufficiently testing the alarm system after installation, any potential problems can be identified, and the system can be implemented with a high degree of reliability.
About the Author
Andy has a BS in Chemical Engineering from Purdue University. He has supported cGMP compliance projects for the pharmaceutical industry since 2015, in addition to supporting the pharma industry during an engineering co-op in 2011-2012. He has experience in development and execution of validation and system review documentation for process and facility equipment including the associated control systems.
