When the power and the air go away: designing the degraded-mode tests of an OQ

A three-second dip on the incoming supply stops a packaging line at two in the morning. The power is back before anyone reaches the panel. Whether the batch stays defensible has little to do with the line restarting. It depends on what happened to the bottles under the filling nozzles, and on whether anything moved before a person told it to.

Those questions belong to the operational qualification (OQ), in the section most protocols treat as a formality. On a syrup packaging line we reviewed, the degraded-mode part of the filler OQ was four lines: electrical cut (no voltage, then voltage return) and service air (pressure drop then loss, then pressure return), each with a box for “process safety” and one for “operator safety”. The structure is sound. The acceptance-criteria column, though, is empty, and a test with nothing in that column can neither pass nor fail.

Two questions, four situations

A degraded-mode test answers two questions at once. Can anyone be hurt, during the loss, on the return, at the restart? And what happens to the product and the data: the units caught inside the machine, the counters, the alarm record, the unit already flagged for rejection?

Run them across a simple grid: energy lost or restored, electrical or pneumatic. Each box needs an answer for people and an answer for product.

Two boundaries first. The OQ does not replace the machine’s safety validation: the builder validates the safety functions and declares conformity, and no qualification test is ever run by defeating one. What the OQ shows is that the machine on your floor behaves as declared, and what that means for the product. Plan these tests with maintenance and the safety officer, on placebo or water, under a work permit. Never improvise them on a batch.

What must not happen when the power comes back

The criteria the GMP template leaves blank already exist in machinery law. The Machinery Directive requires that “the interruption, the re-establishment after an interruption or the fluctuation in whatever manner of the power supply must not lead to dangerous situations”, and then spells out what that means:

• “the machinery must not start unexpectedly”;
• “no moving part of the machinery or piece held by the machinery must fall or be ejected”;
• “the protective devices must remain fully effective or give a stop command”.

Two neighbouring requirements complete the picture. A machine is started only by a deliberate action on a control device, and that applies “when restarting the machinery after a stoppage, whatever the cause”. And for the emergency stop, “disengagement of the device must not restart the machinery but only permit restarting”. Directive 2006/42/EC applies to machinery placed on the EU market until 19 January 2027; Regulation (EU) 2023/1230 will take over from 20 January 2027.

Write those requirements into the protocol as things an observer can see. Nothing moves on restoration. No held load falls. The fault is displayed and recorded. The reset arms the machine without starting it, and the first movement follows a start command from a person.

The test, step by step

A cut test is only worth what is in the machine when you cut.

A sequence that works on a filling line:

1. Load and run. Placebo or water, routine speed, all stations fed, with a marked unit in each machine so you can find it again.
2. Flag a reject. Create a defect a detector will catch, and cut the power while the flagged unit is between the detector and the reject gate. If the tracking register does not survive the restart, that unit leaves with the good ones.
3. Cut, and say which cut you mean. The machine’s own isolator is not a site-wide dip. Test the one your risk analysis names, and write it in the protocol.
4. Observe during the loss: what stops, what holds, what vents, where the product ends up. Note the position each valve takes and compare it with the fail-safe behaviour declared in the installation qualification.
5. Restore. Nothing moves. The fault is shown and time-stamped. Counters, format and batch data are unchanged.
6. Reset and restart. The reset arms, the start command starts, and the machine begins from a defined state, not halfway through a cycle.
7. Account for the product. Identify, remove and record every unit inside the machine, and count them station by station. That number belongs in the procedure operators follow when it happens for real.

Whether the controllers and the historian ride through the dip is a design question: the UPS, and whether anything is wired to tell the system it is on battery. The degraded-mode test shows what the design is worth on the floor.

Air is not electricity

Compressed air fails in two ways, and only one of them looks like a power cut. A sudden loss behaves like the electrical case: grippers open or clamp, cylinders stop where they are, and loads held by air can fall unless the design holds them some other way.

The slow drop is the interesting one. Between “pressure falling” and “machine stopped”, a line keeps running while its functions degrade: caps placed but not seated, cartons half formed, pushers stopping short of the end of their stroke. Bleed the supply slowly and record two things: the pressure at which the machine stops, and whether any unit made on the way down could pass as good. The low-pressure set point then becomes a qualified parameter, and changing it goes through change control like any other qualified setting.

On the return, watch the first movement. A soft-start valve brings the circuit back up to pressure progressively. Without one, the first stroke of every cylinder arrives at full force, which is a safety event and an efficient way to crush whatever was left in a station.

Electricity and air are the two supplies the template names. Add the ones your machines actually depend on: vacuum on the labeller, nitrogen at the filler, and the network link to the serialisation server, whose loss stops a line just as surely as a power cut.

One sentence in the 2003 file needs correcting. It describes the emergency stop as cutting “electrical and pneumatic energies”, yet on many machines the air is deliberately kept on to hold a load in place, precisely so that nothing falls. Read the machine documentation, then prove what it says.

Emergency stop, machine stop, guard opening

These are three events with three different consequences for the product. IEC 60204-1 gives the vocabulary. A stop category 0 removes power to the actuators immediately, an uncontrolled stop. A category 1 brings the machine to a controlled stop and then removes power. A category 2 is a controlled stop with power left on. Which category sits behind each button is a design decision recorded in the machine file, and it decides the state in which the units in process are left.

The 2003 file allowed “authorised technicians” to open a fixed guard while the machine ran, provided they looked after their own safety. That has no place in a modern file. A fixed guard is defined by needing tools to remove it, and work inside a machine is done on a stopped, isolated machine.

The product left in the machine, and the record

Every degraded-mode event leaves a small population of units whose history is unknown. EU GMP is explicit: “Products which have been involved in an unusual event should only be reintroduced into the process after special inspection, investigation and approval by authorised personnel”, with a detailed record of that operation (Chapter 5, §5.60).

Qualification is where you find out what that costs. Count the units held at each station during the test, and you know the size of that population before it happens in production. Check that destroyed units are counted so that the end-of-batch reconciliation still closes (§5.61), and, on a serialised line, that their identifiers are decommissioned in the serialisation system rather than left active.

Data deserves the same attention. After the restart, check the batch counters, the alarm log and its time stamps, and the loaded format. A line that comes back with the previous format selected is a mix-up waiting to happen.

What the regulations ask

EU GMP Annex 15 (2015) builds OQ tests from knowledge of the process and the equipment, including “Tests to confirm upper and lower operating limits, and /or ‘worst case’ conditions” (§3.11), and has the protocols define the acceptance criteria (§2.4). A degraded-mode test without written criteria fails that second requirement before it is even run.

For machinery, the requirements sit in Directive 2006/42/EC, Annex I §1.2.3, §1.2.4.3 and §1.2.6, with Regulation (EU) 2023/1230 to follow from 20 January 2027, and in the standards behind them: IEC 60204-1, ISO 13850, ISO 14118, ISO 14119 and ISO 14120.

The table turns the four situations into criteria you can execute.

The mistakes we see most often

• Testing the loss and not the return. The return is where unexpected movement, lost tracking and silent data loss show up.
• Testing on an empty line. No product in the machine means no product observations.
• “Process safety: OK”. A ticked box with no criterion proves nothing. Write down what you expect to see before switching anything off.
• One cut for every scenario. A machine isolator and a site-wide dip are different events; name the one you tested.
• Never counting the units in the machine. The procedure then says “remove affected product” without saying how much that is.
• Not repeating the tests after a control-system change. A new program version can change the behaviour you qualified, reject tracking included.

Any line can be made to stop. What the qualification has to establish is what the line does in the two minutes after the power comes back.

References

• European Commission, EU GMP Annex 15: Qualification and Validation, 2015, §2.4 and §3.10–3.12.
• European Commission, EU GMP Chapter 5: Production, in operation since 1 March 2015, §5.60 and §5.61.
• Directive 2006/42/EC on machinery, Annex I §1.2.3, §1.2.4.3 and §1.2.6.
• IEC, IEC 60204-1:2016, Safety of machinery: Electrical equipment of machines, Part 1, stop categories (9.2.2).