Automating a biologics process: recipes, PAT, continuous runs and the data a GMP site must specify

Day 23 of a perfusion run. The bioreactor has been feeding a capture column continuously for three weeks, the column switches cycles on its own, and at ten past three in the morning the in-line pH reading starts to drift. The controller does what it was told and adds base. When the day shift arrives, three questions are waiting for them, and none of them is about cell culture. Which material, already loaded on the column, saw the excursion? Did the probe drift, or the process? And who changed the alarm limit that stayed silent, and when?

Those are automation questions. For years they were easy to dodge, because each unit operation arrived as a skid with its own controller, its own recipe editor and its own clock, and the batch record was put together afterwards from printouts. A feature in Automation.com Monthly (August/September 2025) describes the move from these islands to connected, data-driven plants built on open standards. I agree with the direction. What it costs a GMP site in specification, qualification and data integrity is a separate conversation, and the one this article is about.

Put simply: when a biologics process becomes one automated train, what does the site have to write down before the first run, and what must it be able to prove after it?

From islands to a train

The integration problem is real, and mostly unglamorous. A bioreactor controller, a chromatography system and a tangential flow filtration skid from three suppliers bring three data models, three ways of naming a step and three opinions on what time it is. Wire a few signals between them, add a historian, and the plant will run. The record a Qualified Person reads, though, is then stitched together after the event, and context leaks out at every seam.

EU GMP Annex 11 already asks for the two things that make those seams visible. For critical systems, an up-to-date system description detailing ‘data flows and interfaces with other systems’ (§4.3). For systems that exchange data electronically, ‘appropriate built-in checks for the correct and secure entry and processing of data’ (§5). That is still the January 2011 text; the revision put to consultation from 7 July to 7 October 2025 has not replaced it yet. In the United States, 21 CFR 211.68(b) says much the same in older words: computer input and output ‘shall be checked for accuracy’. Four things then change, and each lands on a different desk.

1. The recipe gets a structure

Batch control has had a reference model since the 1990s: ISA-88, published internationally as IEC 61512. Its first part has just been revised. IEC 61512-1:2026, the second edition, was published on 20 February 2026 and replaces the 1997 text. The principle it restates is the one a GMP site cares about most. Recipe procedural elements stay separate from equipment procedural elements, so that operations can define recipes ‘without the need of changes in equipment procedures’. The new edition also distinguishes two kinds of equipment module, generic and recipe-aware; only the recipe-aware ones carry procedural control and can be called as phases of a recipe.

For qualification, that separation is what you are paying for. The equipment logic (what it means to charge medium, or to equilibrate a column) is tested once, with its limits and error handling, as Annex 11 §4.7 asks. The master recipe that chains those phases becomes a document owned by the process people and changed under change control, without anyone reopening the code. Part 4 of the series (IEC 61512-4:2009) then models the batch production record around the control recipe that actually ran.

None of this works unless the suppliers play along. A skid whose ‘recipe’ is a page of setpoints in its own HMI, with no states a batch manager can command, cannot become a phase. Write that into the purchase specification. Discovering it at the site acceptance test is too late and expensive.

2. Measuring during the process

The FDA’s guidance on process analytical technology, published in September 2004 and still current, defines PAT as a system for designing, analysing and controlling manufacturing ‘through timely measurements (i.e., during processing) of critical quality and performance attributes of raw and in-process materials and processes’ (section IV); ICH Q8(R2) repeats the definition. The sample may be taken at-line, diverted on-line, or never leave the stream at all (in-line). Two further points matter to the automation team. Analysers added to existing equipment go in ‘after risk analysis’, and a PAT batch record may hold charts of ranges and distributions, which means secure access to the underlying data.

For a biologics train, ICH Q13 Annex III gives examples: in-line release tests for pH, osmolality and protein concentration, online tests for purity, charge heterogeneity and aggregation. Potency still needs offline testing (§2.3). Real time release testing, defined in ICH Q8(R2) and covered by EU GMP Annex 17, ‘is not a regulatory requirement for CM implementation’ (Q13 §4.2). Whichever route a site takes, a PAT analyser is more than an instrument. It has a model, a calibration that lapses and a decision hanging off it, and each of those needs an owner and a test.

3. Running for weeks instead of days

ICH Q13, adopted on 16 November 2022 and issued by the FDA as guidance in March 2023, applies to continuous manufacturing of drug substances and drug products for chemical entities and therapeutic proteins. Its Annex III describes the train in the opening scene almost exactly: a perfusion bioreactor feeding continuous capture chromatography, then virus inactivation, polishing, virus filtration and tangential flow filtration, linked directly or through surge tanks.

Three of its ideas land straight in the control system. First, the batch. Q13 keeps the ICH Q7 definition but lets batch size be set by quantity of output, quantity of input, or run time at a defined mass flow rate (§2.2), so the automation has to know at any moment which batch a given litre belongs to. Second, residence time distribution: understanding how material travels and spreads ‘allows input materials to be traced throughout production’ (§3.1.6), and in practice that trace is a model running beside the control layer. Third, diversion, with criteria ‘to trigger the start and end of the diversion period and restart of product collection’ and margins for the uncertainty of the model (§3.1.6, §4.2).

Q13 also has two warnings that could be pasted into a specification as they stand. Averaging over the whole run hides disturbances, so averaging intervals should match the measurement frequency and the process response. And data lapses, such as a probe out for recalibration, need a risk assessment and alternative controls (§4.2). EU GMP Annex 2 adds that continuous monitoring data from processes such as fermentation ‘should form part of the batch record’ (Part A §53), and that with multiple harvests ‘the period of continuous cultivation should be within specified limits’ (Part B5).

Long runs stretch validation too: Q13 Annex III §3.2 asks for the cell age limit to be established for continuous conditions. Showing that a process stays in control over weeks is statistical work, and scrolling through a log will not do it; see control charts for ongoing process verification.

4. Single-use: the bag becomes part of the record

EU GMP Annex 1, fully applicable since 25 August 2024, lists the parts of a single-use system as ‘bags, filters, tubing, connectors, valves, storage bottles and sensors’ (§8.131). Each piece is checked on receipt, with its certificate of conformance and proof of sterilisation documented (§8.138). Annex 1 is written for sterile products, but Annex 2 points biologics makers to it for classified areas and names single-use components and closed systems among its cross-contamination measures (Part A §8(c)).

Seen from the control system, a single-use sensor is an instrument calibrated in someone else’s factory, and its identity changes every batch. If its lot is scanned into the control recipe at set-up, it is in the record. If not, it lives on a label that ends up in the waste bin with the bag. Q13 Annex III §2.2 adds that connections used for long durations or changed often ‘should be evaluated as potential contamination risks’, which makes every change-out an event the record should carry.

The data: what turns a bioreactor trend into evidence

All of the above produces data, and data integrity is where the islands do most damage. The FDA’s December 2018 guidance asks for data that are attributable, legible, contemporaneously recorded, original or a true copy, and accurate, and defines metadata as ‘the contextual information required to understand data’. A dissolved oxygen value without its unit, batch, unit procedure, probe identity and time stamp is a number. It is not yet a record; the part of the record that makes the number mean something goes through why.

Three points are specific to an automated train. Time first: when three controllers keep three clocks, nobody can reconstruct an excursion with confidence, so synchronisation is a requirement with a tolerance, not a nice-to-have. Then originals. The FDA separates static from dynamic records, and a printed trend does not preserve a dynamic one. Finally changes: Annex 11 asks for a risk-based audit trail of GMP-relevant changes (§9), with who and when recorded (§12.4). An alarm limit on a PAT signal is exactly that kind of change. In the opening scene, it is the one nobody can trace.

Most sites I see live in the second row and plan for the fourth. The third row is where specification work pays off, because that is where a handful of supplier choices get forced into one model.

Eight lines for the specification

1. Phases, not screens. Every skid exposes its operations as recipe-aware equipment phases, with states and parameters a batch manager can command and read, in the sense of IEC 61512-1.
2. One master recipe. Recipe parameters live in one place, under version control and change control. No setpoint that matters to quality can be edited in a local HMI without leaving a trace.
3. One clock. All controllers, analysers and servers synchronise to one time source, with a stated tolerance that is tested at OQ and monitored afterwards.
4. Batch context on every value. Each recorded value carries batch, unit, phase, instrument identity and unit of measure, so the record can be rebuilt without relying on anyone’s memory.
5. PAT as a controlled system. Each analyser has a defined use, a model under version control, a calibration and maintenance plan, and a stated behaviour when its data lapse.
6. Diversion as logic. Start, stop and restart criteria for diversion are written into the control system, together with the residence time model they rely on, and every diversion is recorded with its cause and quantity.
7. Single-use identity. Assembly and sensor lot numbers are captured electronically at set-up and linked to the batch; each change-out is logged as an event.
8. Audit trail and review. GMP-relevant changes, alarm limits and analyser settings included, are audit-trailed with who, when, old value, new value and reason, and the audit trail can be reviewed per batch in a form a reviewer can actually read.

Each line should trace to a test. That is what Annex 11 §4.4 means when it asks for user requirements ‘traceable throughout the life-cycle’, and a URS that drives the qualification shows how to write them that way.

Where to start

Begin with a drawing. One diagram of every skid, analyser, server and interface, with what crosses each line. It is the system description Annex 11 §4.3 asks for anyway, and the seams show up the moment it is on the wall.

Then resist the urge to redesign the whole plant. Bring the next skid you buy in as an ISA-88 phase, with its interface written into the purchase order, and learn from that one.

Sort out time before analytics. Synchronise the clocks and give every value its batch context before spending money on predictive models; a model trained on mislabelled data is a liability with a dashboard. And sit down with quality to agree which electronic record is the original for each piece of data. The historian export should stop being the batch record by default.

Five common mistakes

• Buying skids on process performance alone. The bioreactor that grows cells best but exposes no states or recipe interface will cost more in integration than it ever saved in titre.
• Treating the PAT probe as an ordinary transmitter. Its value feeds a decision, so its model, calibration and data lapses need the same control as the decision itself.
• Averaging over the whole run. A run-long average looks reassuring and hides exactly the excursion Q13 asks you to detect.
• Leaving diversion to the operator. If start and stop criteria live in a procedure rather than in the logic, the quantity diverted depends on who is on shift.
• Keeping single-use identity on paper. The bag lot is part of the batch genealogy. Recorded by hand, it is the first thing to go missing in an investigation.

On day 23, all three questions should be answered by a query rather than a meeting: which material, which probe, which change, already in the record before anyone asks.

References

• U.S. FDA, Guidance for Industry: PAT, A Framework for Innovative Pharmaceutical Development, Manufacturing, and Quality Assurance, September 2004.
• ICH, Q13 Continuous Manufacturing of Drug Substances and Drug Products, adopted 16 November 2022.
• European Commission, EudraLex Volume 4, GMP guidelines (Annex 1, 2022; Annex 2, 2018; Annex 11, 2011).
• U.S. FDA, Data Integrity and Compliance With Drug CGMP: Questions and Answers, December 2018.
• IEC, IEC 61512-1:2026 Batch control, Part 1: Models and terminology.
• Automation.com Monthly, The Future of Process Automation in Bioprocessing, 4 September 2025 (the starting point of this article).