by Derek Hook, Invensys Eurotherm
Pharmaceutical and biotechnology companies are steadily moving towards electronic records as a means of collecting process and environmental data. The 21 CFR Part 11 regulation demands compliance to certain specifications when using Electronic Records as the primary source of data. In brief, the requirement is for secure; tamper proof data, which can also be created in standard format, suitable for import into a spreadsheet or database.Electronic Signatures also have a number of specific requirements such as a minimum number of characters, password expiry, unique name / password combinations and the option for a second signature to permit access. The creation of an audit trail of all data and events, etc., is also a fundamental part of this regulation.This is the requirement, so what are the implications?
New systems being put into place today should be designed with 21 CFR Part 11 in mind, as the trend is clearly to use Electronic Records. This regulation does not only apply to new systems, however. The majority of existing control systems will also need to meet this regulation, sooner or later. The cost implications of achieving compliance of existing systems can be very severe, not just in terms of the replacement of hardware and subsequent software programming but also in the re-validation costs. These validation costs often dwarf the hardware costs involved.
The establishment of remediation teams from multiple disciplines within the organization is a common occurrence. They all struggle with how to achieve 21 CFR Part 11 compliance and how much can be done in what timeframe with the budget allocated. So, what are the options? There are in fact a variety of options, all of which involve hardware, software, programming, changing SOPs and validation. Some remediation options are indicated below. The difference is in the complexity and cost of implementation.
Option 1: Replace the existing control system
You can replace the existing system with a new system with 21 CFR Part 11 compliant features. This has the obvious drawbacks of not only the cost of the hardware and software programming but also the cost of validating the new system. This is good news for instrumentation suppliers but is not a popular option for most pharmaceutical / biotechnology companies.Option 2: Add a compliant computer data acquisition to the existing control system
One way to do this is to add a computer SCADA (Supervisory Control & Data Acquisition) system, which has the 21 CFR Part 11 features, and communicate to the control system. This solution certainly offers a lot of features but is generally relatively high in cost as there is the cost of the software, the generally much higher cost of the programming of the SCADA system and possibly modifying the control system program. Where the operator interface is replaced by a computer, the operator interface has now become more complicated. This over complication of operator access can be a major negative of this approach. Validation costs can also be high.Option 3: Add a compliant, non computer, data logger to the existing control system
The electronic data recorder logs process data and events. These new generation products can provide full compliance with the 21 CFR Part 11 regulation, by offering an auditor option, and provide a high quality operator interface. In association with secure data acquisition the historian software offers an easy way to access data, typically via removal media and / or an Ethernet network. A remote view provided by complimentary software provides a secure view of the data as if you were at the unit itself. This requires hardware cost, (generally relatively low), some configuration, (much simpler than software programming), changing the SOPs (Standard Operating Procedures) and validation of the data logging system (made easier by the availability of validation protocols).This option is probably the most common method of remediation and does provide a relatively straightforward way to gather data, generate an audit trail and to produce reports as required.There is another option to achieve compliance, however:
Option 4: Add a compliant, non-computer, ‘front end’ to the existing control system
All previous options do not address the control system interface itself in a cost effective way. This fourth option does just this.A common scenario is as follows. The control system may consist of a PLC (Programmable Logic Controller) plus an operator interface of some kind, perhaps a simple two-line panel or a multi line panel with some graphics. This system does not meet compliance requirements for Electronic Records or Electronic Signatures. This situation is repeated many times throughout the plant, hence the dilemma of achieving remediation at reasonable cost. The compliant ‘front end’ remediation strategy involves replacing the non-compliant operator interface with a compliant, non-computer, operator interface. In simple terms the existing panel is unplugged and replaced by the new, compliant interface. This has several advantages over conventional remediation strategies:1. The control strategy of the PLC is unaffected, thereby considerably simplifying the complexity of re-validation and hence the time and cost. Only the operator interface is re-validated.2. All operator access to the equipment is now protected and logged, including initiating and stopping a batch, making parameter changes, making operator notes etc.3. The operator interface is greatly enhanced with full color graphics and, possibly, touch screen. The SOPs will need to be changed to accommodate the new operator interface.4. Data is now collected locally, in internal memory and removable media and via the Ethernet network, providing a high level of integrity of the solution5. Implementation cost is relatively low for the high reward achieved, resulting in considerable savings or a wider implementation of 21 CFR Part 11 with the same budget.To connect to devices with different communication protocols, a range of protocol converters is commonly available. The availability of validation protocols also greatly eases the task of re-validation.Conclusion
It is possible to achieve broad 21 CFR Part 11 compliance in a very cost effective manner with the minimum impact on the existing control system.About the Author:Derek Hook B.Sc., of Invensys Eurotherm, has been involved with industrial instrumentation for more than 25 years. He has worked in Europe, North America and South America in technical, marketing and sales positions. Experience with the pharmaceutical and biotechnology industries was first gained in Massachusetts, USA, in the early 1990’s and he is now the pharmaceutical leader for Invensys Eurotherm in the Americas.For further information, contact Derek Hook at: derek.hook@eurotherm.com, Tel: 954 630 2440
