|
Autoclave
Control Systems | Current Trends and Validation
Many of the currently operating
autoclave control systems were
developed and installed with little or no regard to good software development
practices. These systems are generally unreliable, unvalidatable and quickly
becoming unsupportable. Where does your system fall and what action needs to be
taken?
Mark Thompson
Managing Director
Honeyman Group Ltd
Introduction
Anybody who has been involved in the process of steam sterilisation will
appreciate that although the principles are simple, the mechanisms and processes
applied to achieving these simple principles are both complex and subtle.
To achieve sterilisation we need to replace all of the air in contact with the
load to be sterilised with steam of the right quality and of the right
temperature and pressure for the correct length of time. The books and standards
referenced at the end of this article detail how this should be achieved.
This article focuses on how such a process can be properly instrumented and
controlled, examining the unique considerations for autoclaves.
History
The requirements for the control and instrumentation of an autoclave have
changed little over the last 20 years. However the manner in which these
requirements are satisfied has changed significantly. This change has mirrored
the rest of the pharmaceutical industry, and industry in general as the
introduction of microprocessor based control has provided operational
flexibility undreamed of previously. Whilst the change from electro-mechanical
control to microprocessor based control systems is well documented and
understood, the impact that this change has had and the way in which it has had
to be managed varies according to the type of system.
What needs to be considered for autoclaves is the difference between automated
packages and automated production processes. Production processes are very
application specific and the applications are often unique, therefore the
engineering solution applied is unique. This is of course based upon tried and
tested solutions and best practice, but no two installations are quite the same.
Automated packages however such as autoclaves or freeze dryers are not as
application specific, they are often procured as a stand alone package and other
than the connection of services they have no direct link to the process. There
are many installations throughout the pharmaceutical industry that are very
nearly identical. There is therefore no need to redesign the autoclave package
for every installation; the user requirements are more often met by
configuration of a standard package rather than a redesign. For this reason,
these packages are slower to change and therefore generally lag behind
developing standards such as GAMP1 .
Whilst some autoclave suppliers embraced the emerging standards and worked hard
to deliver software packages validated to current acceptable standards and
practices, others continued to develop software control systems job by job. This
would involve copying the software from the previous job and then modifying to
suit the new job with little or no trace-ability. The best that could be hoped
for with the later system was to validate only the function by performing black
box testing.
Another influence on the development and supply of autoclaves was the heightened
awareness during the 80’s for the need to validate sterilisation processes.
There were several serious incidents involving poor control of sterilisation
processes, which resulted in an increased focus by both the industry and the
regulatory bodies.
This increased focus created a boom in the late 80’s and early 90’s of new
autoclave sales to the pharmaceutical industry as companies reacted by reviewing
internal systems and equipment. Many older installations required significant
upgrade work to bring them to current standards and it was generally more
economic to install a new autoclave which would come with a 10 year guarantee on
the chamber.
At the same time there was an increased focus on automated systems and computer
systems validation, again as a reaction to some incidents in the 80’s. This
started a journey through the 90’s of frustrated users and suppliers who due to
the lack of any formal guidance on computer systems validation applied widely
varying standards across processes and throughout the industry. Although a never
ending journey it is now well under control largely due to the guidance provided
by professional bodies such as the GAMP1 Forum.
It is important that this background is understood because this process has
moulded the autoclave installations operating today.
Current Situation
The autoclaves currently in operation have instrumentation and control packages
varying from relay controlled with simple Bourdon tube pressure and vacuum
gauges and a chart recorder, to microprocessor controlled systems with full
SCADA2 functionality.
From experience the systems which are often the most troublesome and the least
well validated are some of the systems installed in the late 80’s and
early 90’s where microprocessor based control systems were applied widely with
little or no recognition of good control system software requirements. These
systems not only failed to meet the validation requirements for control system
software, which as mentioned previously were ill defined at that time, but many
also failed to meet the good practice of the time. The worst examples have
control system software which has no documented development, no configuration
management, no version control, a large amount of dead code and were simply
copied and modified job by job to achieve the autoclave functionality required.
Some of these systems are still in operation and are generally unreliable,
unvalidatable and quickly becoming unsupportable.
Where does your system fall and what action needs to be taken?
Audit of Existing Installations
If you do not know where your control system falls on the above scale of
validated to unvalidatable, an audit of the installation is essential. A simple
audit approach is described below. This is not meant to be a retrospective
validation where you would commence with a URS3 and FDS4
then undertake a comprehensive assessment against this documentation. The audit
is a more selective assessment to establish among other things whether or not
retrospective validation is an option.
Data Gathering
Before any system can be compared to the necessary standards you need to
establish the current status. This data gathering exercise can be the most time
consuming. It must include all ‘as built’ and ‘as validated’ documentation,
maintenance history, validation history, change control and the current status.
The current status must be established by monitoring operation of the autoclave
and downloading as much of the software and configurable settings as possible.
This assessment should establish whether or not the documentation accurately
reflects the operation and in extreme cases whether or not the autoclave
operates as the user thinks it operates.
Gap Analysis
Once a clear picture has been established as to the current status, comparison
with the pertinent standards can commence.
Software Categorisation
Categorisation of the control system software will assess the extent of any
further validation work that may be required. This categorisation is explained
in GAMP31, the categories are listed in
Table 1 together with
examples for an autoclave installation. The examples are not exhaustive and are
typical only, for each piece of equipment and software package there are good
and bad examples which will consequently change the categorisation. Also there
are different system configurations that will change the categorisation e.g. the
autoclave control system could fall into either category 4 or 5 dependent upon
whether it was based upon good configurable software or application
specific.
Many of the autoclave control systems that were sold as
configurable software packages cannot be treated as such because the necessary
control was not applied to their development. Therefore the control system would
have to be treated as application specific. What software validation
documentation does exist is unlikely to satisfy the requirements for application
specific software.
A fully instrumented and controlled modern autoclave installation could include
Smart transmitters, PLC control and a SCADA package running on a PC. As
Table 1
shows this will include elements that fall into each category. It is important
that this is understood and documented since this will dictate the level of
validation required for each software package and system component.
Risk Assessment
Following the categorisation of the software a risk assessment should be
undertaken to identify the impact that each software package and system
component has on sterilisation effectiveness. A standard risk assessment
approach can be taken here, assessing consequence and probability.
Table 2
illustrates one approach that can be taken listing all possible failures and
then assessing each one.
The risk assessment approach need not be prescriptive, it is
better to use the system that is understood on the site and by the people
undertaking the risk assessment. It is usual to assign a score to each of the
above which will give a total score for the failure.
The conclusion of the Gap Analysis is reached by combining the findings of the
categorisation exercise shown in
Table 1 with the risk assessment shown in
Table
2, a scoring matrix can be used for this.
Action Plan
The Gap Analysis will clearly identify where action is required. This action
will range from nothing other than documenting the audit findings to a complete
replacement of an unvalidatable control system. A thoughtful approach here can
actually prevent the knee jerk reaction of replacing the whole control system.
Whatever your perception of the control system, the audit is a very worthwhile
exercise as it may lead to a solution where some retrospective validation in the
form of additional documentation or testing can be applied. This will not only
save money but significantly reduce the level of operational disturbance and
risk involved in control system replacement.
If the only solution is a control system replacement, or if this is justified
through reliability or supportability problems, then what solutions are
available?
Control System Solutions Available
The autoclave suppliers bespoke control system packages are coming under
increasing competition from the more conventional approach of utilising industry
standard control and SCADA2 systems. Indeed some of the autoclave
suppliers are offering these packages. This has the great advantage of allowing
the operating site to maintain their site standards for control systems hardware
and software by specifying all of the control system components (PLC5,
HMI6, SCADA2, PC operating system etc).
The software should be specified, written, tested and documented in full
compliance to acceptable standards e.g. GAMP31 or to your internal
standards. The software and all documentation should be fully traceable
throughout the project with all documentation accurately reflecting the changes
and developments made throughout the project lifecycle. Although this sounds
straightforward it is rarely achieved. The discipline required to achieve this
fully validated system should not be taken for granted, everything must be done
before placing a contract for an upgrade to ensure that the company employed has
the necessary understanding and ability to deliver this.
This is not advocating that autoclave control system software should be written
from new for each application. A package such as an autoclave is ideally suited
to having a library of software modules or objects that can be selected
dependent upon the application and then configured by the user. However this can
only be done when the quality, development and testing of the software modules
is documented and verified. I have audited systems where this has been done
thoroughly, but then no adequate change control system has been applied by the
supplier, therefore the good development work and documentation is useless.
Particular attention should be given to code reviews where the software engineer
will explain the functionality of the code linking this to the FDS4
and DDS7 and ensuring that any software descriptors are meaningful to
others. From experience this is the single most valuable step in the software
development lifecycle, ensuring that the software not only does what it should
but that it is written and documented in a quality manner that can be understood
by others. Another technique is to include control systems technicians in the
code reviews. This can provide benefits by improving long term support in house
as a thorough understanding of the code structure is obtained.
This approach ensures a solution that meets any site standards, is validated to
an industry recognised standard and can be supported through the lifetime of the
installation.
This addresses the control system requirements for an autoclave installation.
However a control system is only as good as the quality of data it receives.
Therefore the audit and any subsequent upgrade should also cover the measurement
systems connected to the control system. Discussed below are the specific issues
to consider for autoclaves.
Measurement
The critical parameters for moist heat sterilisation are steam quality,
temperature and time. The critical measurements for the sterilisation process
are temperature, pressure and time.
Temperature
A typical multi-cycle (porous load and fluids) autoclave could have the
following temperature probes:-
Jacket temperature
Chamber temperature
Drain temperature
Load Probe temperature
Air detector temperature
Air filter temperature
Simulator temperature
Typically these temperature elements will be Class A (EN 60751: 1996) Platinum
resistance thermometers. The accuracy that Class A defines over the measuring
range is as follows
0oC ± 0.15 oC
150
oC ± 0.45 oC
EN2859 and HTM201010 ask for a loop accuracy of ± 0.5oC . However as the
accuracy of the element alone is ±0.45oC it is unlikely that a loop accuracy
of ± 0.5oC will be achieved when we consider transmitter accuracy, recorder
accuracy and ambient temperature effects. This is not a robust loop design, the
theoretical loop accuracy lies outside the ±0.5oC tolerance specified in the
standards. Although the loop will be calibrated within this tolerance there is
no real safety margin. Therefore be very careful when setting the recalibration
frequency.
Because of the criticality of these temperature measurements, some installations
choose to go further than this either by increasing loop accuracy or by
providing other means of verification.
One method of improving loop accuracy is to use Platinum resistance thermometers
better than class A, these can be sourced from some suppliers (often referred to
as 1/10th DIN). This increased element accuracy will provide a greater safety
margin for the loop accuracy.
An independent means of verifying temperature during an autoclave cycle can be
installed. This is actually a requirement of the standards but is infrequently
applied. This independent means can be achieved by specifying an additional
element within the temperature probe; therefore the duplex probes will become
triplex. This additional probe is then wired to a socket on the side of the
control panel. During an autoclave cycle a calibrated Pt100 transmitter can be
plugged into this socket and a comparison made between this indication and the
front of panel temperature indication. Whilst this is not a true loop
calibration it is a very good check which can be carried out with no disturbance
to the autoclave installation or operation and with the minimum of effort.
Therefore this could very easily be carried out on a monthly basis to provide
more confidence between true loop calibrations which are usually carried out on
a 3 or 6 monthly basis dependent upon history.
Pressure
A typical autoclave installation will have chamber and jacket pressure
measurement. The critical measurement here is the chamber pressure since
sterilisation temperature is achieved by controlling steam pressure in the
chamber not by controlling on temperature directly.
For porous load autoclaves the pressure loop must have a range of 0 to 3.5Bar
absolute [Bar(a)] and have a loop accuracy of between
±0.5% to ±1.6% at the
sterilisation pressure, depending upon which standard you choose to work to.
(See Table 3).
Accuracy throughout the rest of the autoclave cycle is less
important than repeatability. Repeatability is important as it is necessary to
ensure for example that the negative pulse is as it was during validation, the
fact that the negative pulse is 150mBar(a) absolute rather than 130mBar(a) is
less important provided it is consistent.
The pressure transducer has an arduous duty due to the internal temperature
fluctuations throughout the cycle (ambient to 136ºC) and due to the external
influences of the autoclave plant room, which can also have temperature
fluctuations and high humidity. These are the factors to consider when selecting
the transducer, good temperature compensation within the transducer and a robust
compact design.
Calibration
The critical calibrations are temperature, pressure and time.
Temperature
As discussed above there are ways of providing a quick check facility on the
temperature loops by wiring temperature elements to sockets, this is not however
a true calibration. Consideration needs to be given as to how the temperature
probes can be calibrated when the autoclave is designed and installed. From
experience many installations require the dismantling of parts of the autoclave
and unclipping a lot of cable before a temperature probe can be removed for
calibration, this not only lengthens the time needed for calibration but also
disturbs the ‘as validated’ status of the autoclave installation.
When the loop is being calibrated consideration should be given to calibration
at the actual sterilising temperature rather than just dividing the 0 to 150ºC
range into four.
Pressure
As with temperature there are ways of providing a quick check facility for
pressure loops by simply installing a boss adjacent to the pressure transducer.
In addition to the quick check this boss can actually be used for the pressure
loop calibration. By installing a pressure transmitter (with calibration
traceability to a national standard) into the boss adjacent to the transmitter
to be calibrated, the readings can be compared throughout a porous load cycle,
which should cover the full operating range of the transducer both rising and
falling. This is generally an acceptable and very representative calibration
since it is carried out in the actual operating environment and with the minimum
of disturbance.
(This approach cannot be taken for the temperature quick check comparison since
you are using an uncalibrated temperature element for performing the quick
check)
Time
A very often forgotten calibration is important for two reasons.
Firstly, it is essential that the sterilisation hold time is accurate, therefore
a calibration of this using a certified stopwatch is essential. The required
accuracy is ±1.0% over the sterilisation hold time.
Secondly, computer clocks are not accurate; how far has the time drifted since
it was set? Since this forms the basis of batch documentation some check on the
accuracy of the computer time is required. This could be as simple as a
quarterly check against the speaking clock. As with all calibrations this needs
to be checked more frequently when first installed so that the frequency can be
extended as confidence is gained.
Future Trends
Standard Control Solutions
The use of industry standard control equipment and solutions will continue, so
treating the autoclave like any other piece of process equipment. There will of
course be standard software modules that can be picked for particular
applications.
Application Specific Solutions
For simple autoclave applications where there are only one or two production
cycles, or applications where changes to production cycles are very unlikely, or
applications where a very high integrity approach is required by the user then a
truly application specific solution could be adopted where there is no user
configuration whatsoever. The cycles would be written specific to the intended
use including all test cycles, and would not be taken from a library of software
modules.
Chart Recorder
Why have a separate chart recorder? The reference in the standards to the use of
a separate chart recorder is probably a legacy from the time when control
systems were unvalidated and a secondary means of checking timebase, temperature
and pressure were essential. This chart printout was particularly useful as a
batch record that could be attached to other batch documentation. If the
aspiration is to have a fully validated control and instrumentation system on
autoclaves why is it necessary to have a secondary chart recorder?
Most modern autoclave installations incorporate a SCADA package that can log and
printout cycle parameters as required. Therefore the current situation is that
there will be two cycle printouts that will not always be the same. Due to loop
tolerances, sampling intervals and different speed of responses, the two
printouts will never be identical, which one do you believe?
The correct approach should be to have a properly validated and maintained
control and instrumentation package. Efforts should be applied to ensuring and
maintaining this. There should then be the confidence to eliminate secondary
checking packages such as chart recorders. A quality assurance rather than a
quality control approach. The SCADA2 printout would then become the batch record
and compliance with 21CFR11 would be required for the SCADA2 system.
Another consideration is that some companies internal standards and a
requirement of the European standards is the installation of secondary elements
in the temperature probes as discussed above in calibration. If this approach is
taken and the auxiliary chart recorder is used it can mean the installation of a
triplex RTD probe, one element for control, one for the chart recorder and one
wired to the calibration check socket. This approach of having one control and
indication loop backed up by two levels of checking is quite unique to
autoclaves. Other equally critical pharmaceutical process plant does not require
this level of redundancy.
It is possible to forsee that with the quality of control solutions available
now, such that if they are properly implemented by people who understand
sterilisation and control systems, it is logical to move away from the level of
duplication currently insisted upon.
Smart Instrumentation
The instrument considerations for the main measurements of temperature and
pressure are quite specific to an autoclave as discussed above. Space is at a
premium, cable runs are short and the duty is arduous. The duty is arduous for
temperature measurement mainly in consideration of the load probe which even
when protected by a flexible stainless steel conduit is prone to get run over by
the loading trolleys and damaged. In the case of pressure measurement,
temperature linearity is a big consideration, the requirement for a transducer
capable of measuring 0 to 3.5 Bar(a) is standard, but then to be able to
maintain the required accuracy with a 20 to 136 degree temperature range is not
easy.
The application where smart instrumentation could be applied is the chamber
pressure transmitter. There are two key requirements for measuring chamber
pressure, firstly for the control of the autoclave, pulsing, sterilising hold
pressure and drying etc. where the measurement loop is expected to have an
accuracy of ± 1% at the sterilisation hold pressure. The second requirement for
measuring chamber pressure is for performing the leak rate test where an
accuracy of ± 1% over a range of 0 to 160mBar(a). Although the standards ask for
a separate pressure transmitter for the leak rate test, some installations try
to satisfy both measurement requirements with one transducer. From experience
the required accuracy for leak rate testing is seldom achieved with the pressure
measurement loop used for chamber pressure control. However because the
calibration over the full range is satisfactory and the pressure readout is to
two decimal places of mBar, the user thinks the leak rate test measurement is
accurate. In practice the absolute accuracy is less important than the linearity
and repeatability for this leak rate test. What is important is that the
pressure has moved by less than 13mBar over the 10 minute period, whether or not
this was from 40mBar to 53mBar or from 50mBar to 63mBar is not as important.
Therefore when selecting pressure transducers for the autoclave installation it
is important to check all constituents of the overall accuracy figure that will
be quoted by the manufacturers. The temperature effect is very important due to
the constant temperature cycling, and the linearity and repeatability is very
important to ensure the leak rate figures are representative.
A smart pressure transmitter could be given the signal to recalibrate during the
leak rate test such that the transmitter was working over a 0 to 160mBar(a)
range rather than 0 to 3.5 Bar(a). Whilst any inaccuracy in the transducer would
remain unchanged the transmitter accuracy could be improved.
Other than this one application no immediate benefits are obvious for the
application of smart instrumentation to autoclaves in the near future.
Conclusion
Before embarking on any upgrade, audit your current system, it may be
redeemable. If it is, it is likely to be at a fraction of the cost of an
upgrade. If it is not, the audit will have established clear project
deliverables and business justification for the upgrade.
The benefit of the latest control upgrade solutions are considerable. However,
do not assume that the new solution will be fully compliant with GAMP31 or
similar recognised standards. Many of the problems with some existing systems
discussed above still can apply. Installations are still occurring where
software is copied from job to job with little or no control over software
development and testing. An audit by a control system engineer on the proposed
supplier is essential, GAMP31 gives guidance as to how this should be carried
out. This audit must include a review of software history if modular
configurable software is to be applied and must include discussions with the
software engineer who will be working on your project.
Clearly define your requirements and do not be swayed by what suppliers are
willing to provide. There is no reason why the solution that meets your needs
cannot be applied, provided this is defined and agreed up front.
References:
GAMP1 GAMP 3 1998 (Good Automated Manufacturing Practice) For
Validation of Automated Systems in Pharmaceutical Manufacture
SCADA2 Supervisory Control And Data Acquisition
URS3 User Requirements Specification
FDS4 Functional Design Specification
PLC5 Programmable Logic Controller
HMI6 Human Machine Interface
DDS7 Detailed Design Specification
MTBF8 Mean Time Between Failure
EN 2859 Sterilisation. Large Steam Sterilisers Requirements and Testing
HTM 201010 Sterilisation of Medical Devices and Medicinal Products
Recommended Reading:
Understanding the Operation and Validation of Autoclaves –
A Practical Approach
By Brian Reeks
EN 285 Sterilization – Steam Sterilization Large Sterilizers Requirements and
Testing
EN 554 Sterilization of Medical Devices – Validation and Routine Control of
Sterilization by Moist Heat
HTM 2010 Sterilization of Medical Devices and Medicinal Products
|
