246 ´ ˇ Roman Holy, Jaroslav Pozivil / ISA Transactions 41 (2002) 245–2542. The aim of the paper means of S88’s well-structured modularization and its split of process equipment from procedural The S88 standard, Part 1 ͓2͔, deﬁnes models and control. The advantages and suitability of the useterminology for physical plants, procedures, and of S88 principles for FDA validation is well docu-recipes. As the standard has already been intro- mented in literature, for example, in Refs. ͓7–9͔duced in most of the cited references, we do not where validation system life cycles can also bethink it is necessary to reprint it here. For more found.detailed references, we recommend reviewing the The validation effort is needed to prove that thestandard itself or the following articles: Refs. ͓3͔, ﬁnal equipment performance and capabilities meet͓4͔, or our paper ͓5͔. the requirements. Systematic quality control dur- S88 establishes a framework for speciﬁcation of ing the creation process can establish a traceablerequirements for the batch process control, and for control mechanism conﬁrming whether the designtheir subsequent translation into application soft- meets the requirements, and the installation corre-ware. The framework consists of a variety of deﬁ- sponds to the design. If the design process is undernitions, models, and structures. It is not, however, control and well documented, conﬁrming qualitya guide for how to apply the deﬁnitions/structures, control may require substantially lower validationetc. Therefore, the main goal of our work was to effort.create a methodology for decomposition of func-tional requirements in terms of S88 models andstructures, as this is something the ISA standardlacks. This methodology was tested on a real prob-lem described in the case study below. 4. Case study3. Problem analysis We have been involved in a pilot project at ICN Czech Republic, Inc., a manufacturer of pharma- Existence of a good project methodology is a ceuticals. The main goal of our pilot project atnecessity for any large project, and the methodol- ICN was to design a prototype of a new batchogy should provide a tool for allocating the re- control system for Nystatin separation ͑a batchsources and information in an organized and efﬁ- process producing the pharmaceutical substancecient way. In our project we have followed ͑with Nystatin from the intermediate product manufac-some adjustments depending on our speciﬁc tured by a fermentation process͒ that would be inneeds͒ the methodology described in the S88 accordance with current standards, would useImplementation Guide by Fleming and Pillai ͓6͔. modern technology, and would demonstrate feasi-The project methodology has six phases and sev- bility and beneﬁts of such a system.eral key attributes—some of which are described For implementation of the control system webelow. have used the software InBatch™ Wonderware® The automation engineering effort is heavily ͓10͔. InBatch is a ﬂexible batch management soft-front-end loaded. The entire methodology is de- ware designed to be consistent with the ISA stan-signed to make changes easier to implement. At dard S88. It is integrated within the framework ofany given time, the current version of documents the Wonderware FactorySuite 2000 package; forshould be able to describe the state of the process visualization the package offers InTouch ͑human-control. Any change is evaluated against the im- machine interface software͒, and we have usedpact on all the previous phases of the project and this tool too.is fully documented before it is implemented. Fi- The aim of the case study was to apply the ISAnally, testing and validation of the installed system S88-based methodology to an existing industrialforms a part of the overall control system design. plant manufacturing Nystatin.As the process is being designed, the critical pa-rameters are deﬁned along with the protocol fortesting and the acceptance criteria for each param- 4.1. Plant descriptioneter. The use of the S88 standard enables and helps to The new control system is intended for only apass FDA validation. This is done mainly by part of the whole Nystatin production, its separa-
´ ˇ Roman Holy, Jaroslav Pozivil / ISA Transactions 41 (2002) 245–254 247 Fig. 1. Schematics of the case study plant.tion. To protect what ICN viewed as sensitive kieselguhr, and activated carbon is prepared, anddata, some of the following, such as compositions its content is then poured into A121. After this,of some solutions, is replaced by anonymous des- formic acid is added. The content of A121 is trans-ignations or is omitted. The technology can be di- ferred into ﬁltrating centrifuge O123.vided into ﬁve sections listed below ͑simple sche-matics are shown in Fig. 1͒. 4.1.2. Filtration of extraction4.1.1. Extraction of dry mycel Filtration in O123 is performed through a layer Solvent A is charged into extraction vessel A121 of fabric coated with kieselguhr, and the ﬁlter cake͑cooled using brine͒, then oxalic acid is added is washed using solvent A. Filtrate is collected inwhile stirring. A barrel of a mixture of dry mycel, an H126 tank; ﬁltration cake is considered waste,
248 ´ ˇ Roman Holy, Jaroslav Pozivil / ISA Transactions 41 (2002) 245–254 Fig. 2. Systems hierarchy.although samples are taken for analysis from ev- 4.2. Aims of the projectery batch. Filtrate from H126 is next ﬁltered inplate ﬁlter F122A and membrane ﬁlter F122B and • Automation of the process;then transferred into A122 for pH adjusting. • reduction of paperwork and computerized data logging; and4.1.3. Treatment of extraction • easier validation of the control system by A sample is taken from A122, and then the ex- FDA regulations.tract is treated by solvent B ͑ﬁltered through the The proposed integration of information and con-bacterial ﬁlter͒ to reach the required pH. trol systems from the crystallization reactor to the manager’s personal computer is shown in Fig. 18.104.22.168. Crystallization The level we have been operating on was that of Crystallization is performed in either A123A or procedural and operator control.A123B. An amount of RO water speciﬁed by therecipe is added into the vessel and the content ofthe vessel is then slowly heated. Addition of theextract starts upon reaching the required tempera- 5. Control system speciﬁcation andture, and during this time solvent C and Syntron B decompositionare also added. The content of the vessel is heatedto another recipe-deﬁned temperature, and, after it Batch control projects usually involve other lay-is reached and samples are taken, it is then cooled. ers existing above S88 models and terminology. Although terms such as recipes, units, operations,4.1.5. Separation and washing of the product phases, and equipment modules have been de- Mother liquor is centrifuged from the product in ﬁned, S88 is unsatisfactory in providing designO122, and suspension and washing of the product guides and examples. Fortunately, a lot of efforttakes place in A131. The washing liquid is re- was directed towards this since the publication ofmoved from the product in centrifugal separator the S88 standard. For the more complex decompo-O131. sition methodologies and examples we would like
´ ˇ Roman Holy, Jaroslav Pozivil / ISA Transactions 41 (2002) 245–254 249 Fig. 3. Framework of S88 models in the presented methodology.to recommend Refs. ͓6͔ or ͓11͔, the latter based on odology is shown in Fig. 3. There are two mainthe PhD/thesis of Bunch ͓12͔. Both of these meth- differences expanding the S88 mapping:odologies have strong and weak aspects in theirstructure and description. Inspired by these efforts, 1. Connections ͑deﬁned in the framework ofand in order to avoid some of their weak points, transfer classes͒ have been added to thewe have deﬁned our own decomposition approach. physical model in order to simplify the deﬁ-This approach better suits our needs and is in good nition of procedures.agreement with both the S88 standard itself and 2. Process phases have been deﬁned and usedthe batch management software used—InBatch. as a common element both to the physicalThe structure of application of S88 models in the model and to the procedural control model,framework of the proposed decomposition meth- and they link these two models together. Fig. 4. Algorithm of the proposed methodology.
250 ´ ˇ Roman Holy, Jaroslav Pozivil / ISA Transactions 41 (2002) 245–254 The algorithm of the proposed methodology is different types of phases—automatic, semiauto-shown in Fig. 4. More detailed descriptions of all matic, and manual—with three different levels ofsteps in the algorithm, together with examples connections to low level control systems. All nec-from the process in which it was used, follows. essary phases for each process and transfer class have been identiﬁed resulting in a total of 59 pro- cess phases and 15 transfer phases.5.1. Physical model 6. The sixth step should produce phase logic controlling and connected equipment modules. In 1. The ﬁrst step deﬁnes the boundaries between the best case, this should be done in parallel withcell͑s͒ of interest and the rest of the site/area. In phase development in the above step. This step, asour case, the solved problem was the part of the well as the seventh step below, was not applied inprocess between process stages of weighing ͑fer- our prototype.mentation cell͒ and drying—the Nystatin separa- 7. The seventh step deﬁnes control modules andtion. In this process, only one product is being their elements.manufactured—Nystatin. 2. The second step establishes the deﬁnitions oftrains and process stages. Two trains can be de- 5.2. Procedural control modelﬁned for our process cell as the cell contains twoparallel crystallization reactors. In our model only 8. The eighth step of the algorithm is a logicalone train has been deﬁned, because there was no continuation of the seven previous steps and startsspecial need to distinguish between the two reac- the deﬁnition and decomposition of the proceduraltors and the deﬁnition, and use of two trains would control model, using outputs of previous steps, es-decrease the ﬂexibility of the designed control sys- pecially phases. In this step, the number of proce-tem. Five process stages, mentioned in the plant dures is determined. In our case, two proceduresdescription, have been also deﬁned—extraction, were deﬁned ͑the procedure for Nystatin produc-ﬁltration, extract treatment, crystallization, and tion and another one for the cleaning in place pro-separation, as well as the washing process stage. cess, sterilization͒. In the following text we deal 3. The third step includes identifying process only with the ﬁrst procedure.units. Here is another expansion of the S88 stan- 9. The ninth step establishes unit procedures,dard, because the unit deﬁnition involves not only which are usually related to the process stages andprocessing of one batch ͑or partial batch͒ of mate- process classes deﬁned above, although we cannotrial but also a storage of materials, e.g., hold tanks exclude exceptions. Seven unit procedures wereor bulk storage vessels. This approach was par- deﬁned in the framework of our prototype.tially enforced by selected software. Fifteen units 10. The tenth step of this methodology is thewere deﬁned—eight process units and seven most subjective. The S88 standard’s deﬁnition ofunits—tanks. In this step, connections describing operation is very general and it enables differenttransfer of materials between units must be also explanations and implementations. The softwaredeﬁned. The case study contains a total of 23 con- we selected supports this kind of ﬂexibility. Thisnections. enables us to deﬁne boundaries between opera- 4. The fourth step is designed to classify all the tions in the framework of one unit procedure atunits and connections into process classes and any chosen point. The objective was to divide unittransfer classes. This object-oriented approach procedures into logical pieces—operations—shows its advantages mainly during decomposi- whenever it seemed suitable, with the aim of mak-tion of large models with many same or similar ing procedures more clear and structured. As anunits and/or connections, once a class is deﬁned it example, the unit procedure, extraction, is in ouris not necessary to deﬁne each object separately. A implementation divided into three operations:total of eight process classes and 15 transfer setup, the extraction itself, and transfer. In thisclasses were deﬁned. way, 12 operations were deﬁned. 5. The ﬁfth step involves identifying speciﬁc 11. The eleventh step uses the above-deﬁnedprocess phases ͑in the framework of process phases to implement demanded process actions.classes͒ and transfer phases ͑in the framework of Displaying the phases by means of sequentialtransfer classes͒. The methodology distinguishes function charts ͑SFC’s͒ made this easier and more
´ ˇ Roman Holy, Jaroslav Pozivil / ISA Transactions 41 (2002) 245–254 251ﬂexible ͑it enables use of both serial and parallel and MichVypn͒, manual charge of the mate-sequencing, and logical transitions͒. rial ͑RucnPrid͒ and some others, and their 12. The twelfth step establishes necessary steps ͑phase͒ formula parameters ͑e.g., tempera-to implement deﬁned phases. This and the next ture for the cooling phase with the defaultstep were not applied in our prototype. value 8.5 °C and high and low limits 12 °C 13. The thirteenth step establishes necessary ac- and 5 °C, respectively͒, and their tags ͑A – 121-ChlaZapn-Teplota-ACT for a cur-tions to implement the steps deﬁned above. rent value of the temperature͒. 14. The fourteenth and ﬁnal step is a ‘‘debug- • Units that have the same processing capa-ging’’ step that allows returning to previous deﬁ- bilities are assigned to the same processnitions and modifying them or adding new ones. class. Each unit has processing capabilitiesIn the end, the result should be a perfect physical that are deﬁned by phases of the processmodel and procedural control model—structured class. There is only one unit ͑A121͒ for theaccording to the S88 structured models/ process class A – 121.recommendations and functional/system require- • Transfer classes and their phases are deﬁnedments. in a similar way—within them, connections ͑e.g., pipes, hoses, ﬁlters͒ are deﬁned.6. Batch software implementation For readers who would like to go into more implementation-speciﬁc details we would recom-6.1. Process model—equipment mend Wonderware materials as the primary source ͓10͔. The plant’s ͑or only one process cell’s͒ equip-ment and its processing capabilities, as well as itscontrol and information requirements, are deﬁned 6.2. Recipe—procedural control modelin the framework of the process model. The modelestablishes the rules by which the plant’s equip- Procedural control is typical for batch processes.ment and control systems are conﬁgured to pro- In order to carry out a process-oriented task it di-duce batches. rects equipment-oriented actions so that they occur In this part, confusion can arise between the in an ordered sequence. In InBatch, there are noviews of S88 and those of InBatch. InBatch ties ‘‘independent’’ procedures ͑the highest element ofboth S88 models ͑physical model and process the procedural control model͒, because they aremodel͒ together in one editor ͑Process Modeling created in the framework of recipes. This is logicalEditor͒, as this is the simplest way of describing because the recipe is in the end the place wherethe characteristics of the equipment in the physical the procedures are used. The procedure consists ofplant. It becomes logical when one realizes that user-deﬁned operations required to produce oneevery unit ͑sometimes also a connection—e.g., a batch of a ﬁnal product or an intermediate product.ﬁlter͒ has some processing capabilities. The pro- The recipe’s equipment requirements necessitatecess model itself is an abstract construct, as it be- linking to available processing capabilities ͑i.e.,comes a reality at the time the procedure ͑as a part phases͒. Each operation and its phases are associ-of the control recipe—the procedural control ated with a process class. In addition to the proce-model͒ is applied to the equipment ͑physical dure, the recipe editor allows us to deﬁne themodel͒, and it starts the batch processing ͑or just a header, equipment requirements, and the formula.simulation͒. Main characteristics of recipes can be described as The process model uses an object-oriented ap- follows:proach with advantages: • Procedures for both operations ͑e.g., • All the characteristics of the units are de- charge—extraction—PlneniExtrakce͒ and ﬁned in the framework of process classes phases ͑e.g., process phases: the start of ͑e.g., A – 121 or O – 131͒, together with their cooling—ChlaZapn, the start of stirring— process phases ͑for A – 121 the following MichZapn, and manual charge of material— phases have been deﬁned—the start and the RucnPrid; transfer phase: acknowledged end of cooling ͑ChlaZapn and ChlaVypn͒, charge—PotvPrid͒ are edited in a SFC for- the start and the end of stirring ͑MichZapn mat to allow for parallel and/or sequential
252 ´ ˇ Roman Holy, Jaroslav Pozivil / ISA Transactions 41 (2002) 245–254 operations and phases. Phase properties can selected phases by enabling the ‘‘check be also edited ͑e.g., temperature of the phase by’’ check box during the conﬁguration of ChlaZapn͒. the phase. During recipe execution, this • The master recipe is equipment and path in- option requires the operator and the super- dependent, and it allows scaling of batch visor, or another person with a compa- sizes. The master recipe is transformed into rable security level, to enter his/her secu- a control recipe dynamically during run rity identiﬁcation and password before the time. The master recipe is edited in the recipe editor. phase can end. Enabling ‘‘check by’’ auto- matically enables the ‘‘acknowledge’’ and • The control recipe starts as a copy of a spe- ciﬁc version of the master recipe and is then the ‘‘done by’’ check boxes. modiﬁed as necessary with scheduling and ͑2͒ Entry of numeric data, where the batch con- operational information speciﬁc to a single trol system checks the validity of values, and batch. It contains product-speciﬁc process if they are not in the predeﬁned range ͑de- information necessary to manufacture a par- termined by high and low deviations and/or ticular batch of the product. It may be modi- high and low limits͒ it does not allow ﬁed to account for momentary raw material completion of the phase in a standard way. qualities and actual equipment to be utilized. In such a case it is necessary to correct the The control recipe is used during batch pro- appropriate value or to abort the phase. All duction or simulation in the framework of events and corrections are logged and easily the batch display editor. reported. This allows very ﬂexible recipe modeling andbatch management ͑including on-line parameterchanges͒. We can deﬁne a different sequence of 6.4. Flexible batch simulation and productionoperations and phases and their parameters with-out changing the process model or even recoding This describes the way in which process func-the PLC. It is usually called a ‘‘recipe-driven’’ tionality and procedural functionality are linkedprocess. together into a ﬂexible batch production or simu- lation. General process classes ͑master recipe͒ are6.3. Security clearances and safety transformed into actual process units ͑control recipe͒: In our prototype of the control system, we have • General procedure ( master recipe) ⇒actualconcentrated mainly on two security and safety is- process in the equipment ͑according to thesues. control recipe͒. ͑1͒ The three levels of access authorization in- • Process class extraction reactors clude the following A – 121⇒unit A121. ͑a͒ Acknowledging prior to the end of the phase by using the ‘‘acknowledge’’ but- • Transfer class H1XXA121⇒connection H134A121. ton, without an operator’s security identi- ﬁcation. • Phase: the start of cooling ͑ChlaZapn͒ of process class extraction reactors ͑A – 121͒ ͑b͒ Veriﬁcation of the data entry and/or the and default parameters⇒cooling in the reac- start or the end of the phase by enabling tor A121 to the required temperature the ‘‘done by’’ check box during the con- ( 8.5 °C) . ﬁguration of the phase. During recipe ex- • Phase: acknowledged charge ͑PotvPrid͒— ecution, this option requires the operator, add 650 l of methanol ͑default value͒ into a or another person with a necessary secu- reactor ͑transfer class H1XXA121͒ rity level, to press the ‘‘acknowledge’’ ⇒ adding 650 l of methanol ͑actual value͒ button and then enter his/her security with the lot code 1548/8989 into the reactor identiﬁcation and password before the A121. phase can end. • Security clearance request ͑for the phase, ac- ͑c͒ Veriﬁcation and conﬁrmation of critical knowledged charge–PotvPrid͒ for the opera- data entry and/or the start or the end of tor is also shown.
´ ˇ Roman Holy, Jaroslav Pozivil / ISA Transactions 41 (2002) 245–254 253Table 1 stopping pumps, and changing the setpointsComparison of our results with those of Love and Bunch of controllers. The number of such actions͓11͔. should decrease by 70% after the batch con-Methodology of Bunch, Our methodology trol system is implemented.1998 • Product quality improvement—a reduc- tion of operator-induced variability shouldLacks precise instructions Deﬁnes algorithms forfor decomposition at decomposition at physical occur. This improvement is also supportedphysical model and model and procedural by easy and automated data acquisition, byprocedural control model control model level better processing of the data, and by fasterlevel control interventions.Contains unnecessary and Deﬁnes and uses the term • Cycle time reduction and yieldquestionable rules phase as shared by two improvements—based on our experience models with implementation of these and similarIs not tied to SW Suitable for SW control systems in real plants, there shouldimplementation implementation ͑in InBatch͒ appear at least some cycle time reduction. InAllows only sequential Allows use of SFC’s and a manually controlled process, there areoperations and phases parallel phases and many occasions where an operator does not operations execute a phase at the earliest possible timeDoes not deﬁne connections Uses the term connection because of outside reasons ͑e.g., he wants tobetween units deﬁned within transfer drink his coffee ﬁrst͒. Through one batch, all class of these delays can add up to a signiﬁcant Deﬁnes and differentiates amount of wasted time. Automation also manual phases usually results in yield improvements. Auto- matic recording of all events, actions, and time makes operators more precise and prompt. This system of linking of the control recipe pro- • Flexibility—when the procedural control iscedure to the equipment control remains formally separated from the equipment control, thethe same both for simulation and for actual control process becomes much more ﬂexible. Most͑manufacturing͒. After the process model and the changes in the recipe procedure do not re-recipes are simulated, and successfully tested and quire either changes in physical model orvalidated, the process model ͑namely, its phases code changes in PLC’s.and their control/status tags͒ can be connected to • Reliability—ensuring that all necessary in-programmable logic controllers or to any other put and output parameters are within pre-control system used to perform phase logic and/or deﬁned ranges is one of the most importantinterface functions with the manufacturing equip- beneﬁts. It is not possible to complete ament, and the production can start. phase, an operation, or a whole batch with wrong parameter values anymore, or to for-7. Discussion get about the signature on the operation sheet. This is very important for FDA audits. The results of this work are compared to results • Validation—many batch control systems based on InBatch have already been vali-published in Love and Bunch ͓11͔. The main ad- dated by the FDA, and this documents thevantages of our new methodology over the old one suitability of this software. By designing theare described in Table 1. phase logic so that the phases are indepen- Aside from well measurable beneﬁts of intro- dent of one another, validation of the soft-ducing the new control system, such as lower ware ͑whether built on InBatch or on othermanpower requirements, the system can cause software͒ is greatly simpliﬁed. Documenta-other not precisely predictable effects. Among tion and testing of each phase’s functionalitythose ‘‘non-tangible’’ beneﬁts are need to be done only once. The recipe pro- cedure is created and documented separately • Operator efﬁciency—a good measure of from the phase deﬁnitions and tested only to the workload on operators is to count the ensure that these phases are called upon in a number of operator actions, which include, proper sequence and with correct param- e.g., opening and closing valves, starting and eters. Consequently, changes to the recipe/
254 ´ ˇ Roman Holy, Jaroslav Pozivil / ISA Transactions 41 (2002) 245–254 procedure do not necessitate testing or docu- Guidelines for the application of ISO 9001:1994 to the mentation changes at the phase level. development, supply, installation and maintenance of ˇ computer software ͑ISO 9000-3:1997͒, CNI, Praha, • Data availability—this is enabled by auto- matic saving of both process and procedural 1998. ͓2͔ ISA—The International Society for Measurement and data to prepared databases on the MS-SQL Control, ANSI/ISA-S88.01, Batch Control, Part 1: server. These data are available for other Models and Terminology, ISA standard, 1995. processing. The beneﬁts of such availability ͓3͔ Bastiaan, H.K., Process model and recipe structure, of data are not directly quantiﬁable, but the the conceptual design for a ﬂexible batch plant. ISA effect on the optimization effort can be sig- Trans. 36, 249–255 ͑1998͒. niﬁcant. ͓4͔ Crowl, T.E., S88.01 Concepts Streamline Control Software Application for Biotech Plant, ISA technical8. Conclusions paper, 1998. ͓5͔ ´ ˇ Holy, R. and Pozivil, J., How to Apply S88 Models to This paper shows how the models of the ISA a Complex Manufacturing Process, Proceedings of the 12th International Conference on Process Control PCS88 standard can be implemented in new batch ´ 99, Tatranske Matliare, Slovakia, 1999.control systems, with special attention to the phar- ͓6͔ Fleming, D.W. and Pillai, V., S88 Implementationmaceutical industry. The approach deﬁned by us Guide. McGraw-Hill, New York, 1998.was described in the paper, and the new suggested ͓7͔ Salazar, J., Batch standards enable computer valida-decomposition methodology was also presented. tion. Pharm. Dev. Technol. 20, 46 –52 ͑1996͒. Our case study and all other published papers ͓8͔ Webb, M., Computer system implementation, batchprove that the S88 standard has large potential to standards and validation. ISA Trans. 34, 379–385 ͑1995͒.signiﬁcantly improve the performance of the batch ͓9͔ Nelson, P.R. and Shull, R.S., Organizing for an initialpharmaceutical industry. Software vendors who implementation of S88. ISA Trans. 36, 189–195supply better packages for batch control systems ͑1997͒.compliant with the ISA standard, larger function- ͓10͔ Wonderware, InBatch User’s Guide, Wonderware, Ir-ality, and higher reliability support this potential. vine, 1999. ͓11͔ Love, J. and Bunch, M., Decomposition of require- ment speciﬁcations for batch process control. Trans.References Inst. Chem. Eng., Part A 76, 973–979 ͑1998͒. ͓1͔ FDA, 21 CFR 11, Electronic Records, Electronic Sig- ͓12͔ Bunch, M., A Speciﬁcation Methodology for Applica- natures, Final Rule, March 1997. EN ISO 9000-3, tion Software for Batch Process Control Consistent Quality management and quality standards—Part 3: with S88, PhD thesis, University of Leeds, 1998.