Pharmaceutical Manufacturing Line

Rationale: Production Supervisor and Plant Manager stakeholder need: 75% OEE is the pharmaceutical industry minimum acceptable threshold for commercial viability; falling below this threshold jeopardises product supply continuity and plant economics. Derived from Normal Production Campaign scenario (300,000 tablets/day ibuprofen campaign).

Rationale: FDA/EMA Regulatory Inspector stakeholder need: 21 CFR Part 11 and Annex 11 are mandatory legal requirements for electronic records in pharmaceutical manufacturing. An incomplete audit trail constitutes a critical GMP deficiency that can trigger a warning letter, consent decree, or product recall. Derived from Electronic batch record data integrity failure hazard.

Rationale: QC Analyst stakeholder need: real-time PAT monitoring prevents out-of-specification product from reaching patients. Automatic diversion on CQA breach eliminates the latency of offline laboratory testing. Derived from Out-of-specification dosage form released to market hazard and PAT Sensor Drift Degraded Operation scenario.

Rationale: EHS Officer stakeholder need: potent compound airborne exposure is the primary occupational health risk in pharmaceutical manufacturing. MoP basis: OEB 1-5 classification scale is the industry-standard banding system defined in ISPE Risk-MaPP Baseline Guide and referenced in EMA (European Medicines Agency) Guideline on Setting Health Based Exposure Limits; OEL banding requires corresponding containment strategy per COSHH Regulation 7 engineering controls hierarchy.

Rationale: EHS Officer and Production Supervisor stakeholder need: 10-second emergency stop time is consistent with machinery safety directive EN ISO 13850 performance level requirements for pharmaceutical equipment in GMP environments. Slow emergency stop risks operator injury and product contamination. Derived from Emergency Stop mode and Tablet Press Mechanical Jam Failure scenario.

Rationale: FDA/EMA Regulatory Inspector stakeholder need: compliance with GMP regulations is a legal prerequisite for product release; non-compliance results in regulatory action up to facility closure. Derived from Pharmaceutical regulatory compliance framework entity.

Rationale: QC Analyst and Production Supervisor stakeholder need: cross-contamination limits are defined by MACO (Maximum Allowable Carry-Over) calculations per EMA cleaning validation guideline. Exceeding these limits causes drug product adulteration. Derived from Cross-contamination between drug products hazard and Product Changeover Cleaning Validation scenario.

Rationale: FDA/EMA Regulatory Inspector stakeholder need: serialization is a legal requirement for drug traceability and anti-counterfeiting. Failure to serialize 100% of units within 24 hours creates regulatory violations and prevents product distribution. Derived from Drug serialization and track-and-trace system external entity.

Rationale: Production Supervisor stakeholder need: partial production capability prevents complete supply chain disruption during minor equipment faults. 50% minimum throughput is the commercial viability threshold for continued manufacturing against urgent patient supply orders. Derived from Degraded Production mode and PAT Sensor Drift scenario.

Rationale: GMP Material Handler and Regulatory Inspector stakeholder need: bidirectional traceability is required by FDA 21 CFR 211.188 and EU GMP Chapter 4. The 4-hour reconstruction requirement aligns with FDA CDER recall assessment timelines; failure to produce genealogy delays field corrections and increases recall scope.

Rationale: QC Analyst and EHS Officer stakeholder need: ISO Class 7 is the minimum cleanroom classification required for tablet and capsule manufacturing under EU GMP. Positive pressure prevents particulate ingress. Loss of pressure differential is a critical GMP excursion requiring batch investigation. Derived from Cleanroom environmental control failure hazard.

Rationale: Equipment Maintenance Technician and EHS Officer stakeholder need: LOTO is required by OSHA 29 CFR 1910.147 and EU Machinery Directive 2006/42/EC. PLd is the minimum performance level for pharmaceutical equipment with medium frequency use and moderate injury severity. Derived from Tablet press mechanical entrapment hazard.

Rationale: Patient stakeholder need: pharmacopoeial compliance directly ensures patient safety and therapeutic efficacy. AV ≤ 15.0 at Stage 1 and potency 98-102% are USP/Ph.Eur. release criteria; out-of-range product poses direct patient harm risk including under-dosing and over-dosing. This is the terminal quality gate for all manufactured product.

Rationale: Derived from STK-001 (OEE ≥ 75%). 300,000 tablets/12-hour shift is the system design capacity from the Normal Production Campaign scenario; OEE tracking is the mechanism by which compliance with the 75% OEE threshold is measured and demonstrated.

Rationale: Derived from STK-002 (21 CFR Part 11 / EU Annex 11 EBR compliance). Cryptographic hashing on every write and 15-minute backup intervals are the technical controls that satisfy data integrity requirements. 15-minute interval ensures a maximum of 15 minutes of data loss in a catastrophic failure, meeting typical GMP data recovery expectations.

Rationale: Derived from STK-003 (real-time PAT with automatic diversion). 30-second sampling ensures sufficient time resolution for blend uniformity and granule size monitoring. 5-second model evaluation and 2-second actuation give a total response latency of 7 seconds, which is within the 10-second diversion window before the affected material exits the process vessel.

Rationale: Derived from STK-REQ-004 (OEL containment integrity) and H-001 airborne potent compound exposure hazard. MoP basis: 0.5 m/s inward airflow specification derived from EU GMP Annex 1 (2022) Section 4.6 (negative pressure room design for hazardous substances) and COSHH (Control of Substances Hazardous to Health) Regulation 7 engineering control hierarchy; -50 Pa minimum pressure differential consistent with ISPE Risk-MaPP (Baseline Guide for Risk-Based Manufacture of Pharmaceutical Products) OEB 4 containment strategy.

Rationale: Derived from STK-005 (emergency stop ≤ 10 seconds) and EN ISO 13850. 3-second drive de-energisation and 5-second valve closure are the subsystem-level allocations of the 10-second total emergency stop time budget. These values are achievable with standard pneumatic valve actuators and safety-rated drive modules.

Rationale: Derived from STK-011 (ISO Class 7 cleanroom maintenance) and Cleanroom environmental control failure hazard. 60-second alert and 120-second action response times align with EU GMP Annex 1 environmental monitoring expectations. Temperature and humidity affect granule moisture content and tablet hardness; action limits require production halt to protect batch quality.

Rationale: Derived from STK-010 (material traceability). The genealogy database is the technical implementation of bidirectional traceability; it must be queryable to reconstruct batch history within FDA CDER 4-hour recall assessment window. All equipment IDs, operator IDs, and material lot numbers must be captured in real-time during processing.

Rationale: Derived from STK-007 (cross-contamination limits) and Product Changeover Cleaning Validation scenario. TOC ≤ 500 µg/L is the ICH Q3C Class 2 solvent threshold used as a surrogate for cleaning verification; electronic sign-off lock prevents operator bypass. The EBR lock is the enforcement mechanism ensuring cleaning validation is never skipped.

Rationale: Derived from STK-009 (degraded production at ≥ 50% throughput) and PAT Sensor Drift Degraded Operation scenario. 15-minute manual sampling interval is the maximum interval consistent with EU GMP in-process testing requirements in the absence of continuous PAT monitoring. 30-second notification ensures operator awareness before manual testing regime begins.

Rationale: Derived from STK-008 (EU FMD / US DSCSA serialization). GS1 DataMatrix is the mandated barcode standard under EU FMD Delegated Regulation 2016/161. 0.5% reject rate is the equipment supplier performance specification; 2-hour upload window satisfies the 24-hour regulatory reporting window with margin for data review.

Rationale: Derived from STK-012 (LOTO PLd) and Tablet press mechanical entrapment hazard. Electronic lockout verification adds a software layer to physical LOTO that prevents inadvertent restart by a second operator; EBR logging creates the GMP evidence trail required for OSHA compliance and incident investigation.

Rationale: Derived from STK-013 (pharmacopoeial specification compliance). Weight ±5%, hardness, and thickness ±2% are in-process control (IPC) limits defined in the product master batch record; automated rejection eliminates human judgment errors in OOS handling. AV > 15.0 triggers mandatory L2 retest or batch rejection per USP 905.

Rationale: Worker protection from potent compound exposure is a primary stakeholder requirement (H-001, H-003). OEL compliance is mandated by COSHH (Control of Substances Hazardous to Health Regulations 2002) and OSHA 29 CFR 1910.1000 PEL requirements. The 80 percent alarm threshold provides a response window before the OEL action limit is breached.

Rationale: ICH Q8 requires that CPPs and CQAs be identified, monitored, and documented as part of the validated design space. This system-level requirement ensures the manufacturing line generates the data required for regulatory filings (NDA, MAA). Analysis verification is appropriate because compliance with data completeness and format requirements can be demonstrated by reviewing the EBR data structure against ICH Q8 guidance.

Rationale: EU Delegated Regulation 2016/161 is a legal requirement for all prescription medicines placed on the EU market from 9 February 2019. Non-compliance results in inability to sell product in EU. Test verification requires a connection to the EMVS test repository to confirm that serialisation data is correctly formatted and accepted by the external system.

Rationale: SIL-2 IEC 61508 requirements mandate that safety functions — not just their design documents — be verified by test. EN ISO 13849-1 (Safety of machinery: safety-related parts of control systems) compliance analysis (PLr, MTTFd, DC calculations) establishes the design meets the required performance level, but the safety functions themselves (E-stop response, guard interlock, brake engagement) must be tested under realistic operating conditions to demonstrate the actual realised performance level. Verification by Analysis alone is insufficient for SIL-2 functional safety claims.

Rationale: OEE tracking is a primary stakeholder requirement for production efficiency. The SEMI E10 standard provides an unambiguous OEE calculation methodology. The 75 percent threshold is the industry benchmark for world-class pharmaceutical manufacturing. Test verification is required because OEE calculation accuracy depends on the integration of downtime, speed loss, and quality rejection data streams from multiple subsystems.

Rationale: FDA PAT Guidance requires that PAT instruments be calibrated and their performance verified before use. An out-of-calibration PAT instrument that continues to drive real-time release decisions would constitute a data integrity failure (H-004). Test verification confirms that the calibration check workflow triggers correctly and that real-time release is actually suspended when calibration status is invalid.

Rationale: Automatic deviation record generation at the point of CPP exceedance is required by ICH Q10 (Pharmaceutical Quality System) to ensure no exceedances are missed in manual batch review. The 10-minute availability target ensures the QA Manager can make a real-time batch hold decision before additional product is produced under the exceedance conditions.

Rationale: Equipment cleaning status control is a primary H-002 cross-contamination mitigation. An equipment item with expired clean status that is inadvertently assigned to a new batch would result in potential cross-contamination without detection. Test verification confirms the assignment block is enforced across all equipment status states and the reason is communicated clearly.

Rationale: Structured shift handover with EBR documentation prevents loss of critical operational context between shifts. The Tablet Press Jam ConOps scenario occurs on night shift — unresolved deviations from the previous shift that are not formally documented at handover could result in incorrect batch disposition decisions.

Rationale: Physical facility and layout constraints for the manufacturing line are required by EU GMP Annex 1 and FDA 21 CFR Part 211 to ensure product quality, containment, and cleanroom classification are maintained. The specification of classified rooms and controlled access is not derivable from functional requirements alone and must be explicitly stated to support facility qualification activities.

Rationale: Normal production mode executes batch logic semi-autonomously; any autonomous control system operating in a regulated pharmaceutical environment must have a defined human-in-the-loop override per FDA guidance on computer-aided manufacturing and IEC 61508 requirements for Functionally Autonomous systems with SIL classification. The 60-minute limit prevents indefinite bypass of safety functions while allowing short-term operational decisions.

Rationale: Specifying the physical location and construction of sensors implementing the normal production environmental monitoring requirement (SYS-REQ-006) is needed to support facility qualification documentation. Physical embodiment of the monitoring function during normal production must be defined separately from the functional monitoring requirement.

Rationale: SYS-REQ-006 requires continuous monitoring of cleanroom differential pressure, temperature, and humidity during Normal Production mode. This requirement defines the physical sensor infrastructure required to fulfil that monitoring obligation. EU GMP Annex 1 (Manufacture of Sterile Medicinal Products) and ISO 14644-2 (Cleanrooms and associated controlled environments — Monitoring) specify instrument accuracy requirements. The 12-month calibration interval is consistent with GMP instrument qualification norms. Resolves lint finding: 'normal production lacks Physical Object trait but has physical embodiment'.

Rationale: The PCS is classified as Functionally Autonomous (controlling equipment without continuous human input) per EN ISO 13849-1 (Safety of machinery — Safety-related parts of control systems). Autonomous control systems require hardware-level safety overrides that cannot be defeated by software failure — IEC 61508 (Functional safety of E/E/PE safety-related systems) clause 7.4.2 requires manual overrides for SIL-2 systems. The 250ms E-stop response is the maximum reaction time that limits rundown energy in tablet press and granulator applications. This resolves the lint finding: 'process control system is Functionally Autonomous but has no safety/override constraints'.

Rationale: Lint finding: 'normal production' concept (hex 40B53A50) lacks Physical Object trait but SYS-REQ-006 imposes physical monitoring constraints. This requirement provides the physical embodiment specification for the environmental monitoring infrastructure that executes during Normal Production mode, resolving the ontological mismatch. Derived from SYS-REQ-006 (cleanroom monitoring parameters and response times) and consistent with SYS-REQ-025 (sensor mounting) and SYS-REQ-026 (4-20mA loop infrastructure). EU GMP Annex 1 mandates continuous environmental monitoring in classified zones during production.

Rationale: H-003: Fine pharmaceutical powder (API and excipient particles <100um) in enclosed equipment with ignition sources (motors, static discharge, hot surfaces) creates a dust explosion hazard. ATEX Directive 2014/34/EU mandates equipment classification and protection measures. The 25% LEL trigger provides a 4:1 safety margin per EN 14034. Nitrogen inerting reduces oxygen below the Limiting Oxygen Concentration. SIL 2 allocation reflects catastrophic severity with rare frequency.

Rationale: The PCS executes SIL-2 safety functions (LOTO enforcement per SYS-REQ-016) and controls potent compound containment (SYS-REQ-004). Cyber intrusion could bypass safety interlocks, release hazardous compounds, or corrupt batch records. IEC 62443-3-3 SL-2 provides the minimum mitigations for industrial control systems with potential safety consequences. Network isolation prevents lateral movement from enterprise IT systems, a common OT attack vector.