When the AI holds the valve: a self-learning controller on a cleanroom HVAC, and where a GMP site draws the line

It is the energy review, late in the year. The utilities engineer puts up the steam bill, then a supplier’s slide: a self-learning controller that runs an air-handling plant and trims fuel without new equipment. The site manager likes it. The QA manager, who has been quiet, asks the question that decides the rest of the meeting: “If it learns on its own, which version of it did we qualify?”

Nobody in the room has a clean answer, and that is not a failure of the people. Reinforcement learning has moved from simulators onto real plants in a few years, while the GMP guidance written for it is still a draft. This article takes one published case and asks what a pharmaceutical site would have to prove before letting something similar near its own air.

What the case actually says

In the October 2022 issue of ISA’s InTech, a Yokogawa engineer who co-invented the algorithm described how the company applied it to the cleanroom HVAC of one of its own semiconductor sensor plants in Japan. Everything below is Yokogawa’s account of its own technology, and the figures are the vendor’s.

The algorithm is called FKDPP, factorial kernel dynamic policy programming. Yokogawa and the Nara Institute of Science and Technology developed it in 2018; the paper that introduced it, tested on a simulated vinyl acetate monomer plant, was presented at the IEEE conference on automation science and engineering in August 2018. The article says the simulation reached optimised operation in about 30 trial-and-error cycles, a figure that belongs to the simulator, not to the plant.

On the plant, the cleanroom HVAC uses about 30 % of the site’s energy, according to Yokogawa. Steam for heating and humidification comes from liquefied petroleum gas, cooling from grid electricity, and waste heat from wafer furnaces is recovered when production provides it. The objectives pull against each other: tight temperature and humidity, the least fuel possible, weather that changes faster than a big room can follow, and heat from production equipment the control system cannot touch.

The controller was commissioned in early 2020, on a quiet day during a planned production outage. It was allowed to experiment with the real equipment and, after about 20 iterations, had a model good enough to run the HVAC for production. It then kept refining that model through 2020 as volumes and seasons changed. Yokogawa reports a 3.6 % reduction in LP gas consumption, with no major capital investment.

The vendor took the technology further afterwards. In a field test at a Japanese chemical plant, FKDPP ran a distillation column for 35 consecutive days, from 17 January to 21 February 2022, on duties operators had until then handled by hand. In March 2023 Yokogawa and the plant owner announced its formal adoption after about a year of operation, with the same model kept in use after a maintenance shutdown and, by the vendor’s count, 40 % less steam than manual control.

Read soberly, the HVAC case is modest: a low-hazard application chosen as a proof of concept, a few percent of fuel, a model that learned on the real plant. The closing claim that the method suits “virtually any manufacturing process” is marketing. What matters for us is simpler: a self-adapting controller acting on an air-handling system, exactly the kind of system a pharmaceutical site qualifies.

One air handler, two jobs

On a sterile or highly controlled site, the HVAC does two things at once, and anyone who has spent time in plant rooms knows they live in the same cabinets.

The first job is energy: which heat source to use, how much outside air to condition, when to run the heat recovery, how hard to drive the chillers. Get it wrong and the bill goes up.

The second job is GMP. EU GMP Annex 1, applicable since 25 August 2023, asks for a filtered air supply that keeps cleanrooms positive to lower grades “under all operational conditions”, with a minimum of 10 Pa between adjacent grades as a guidance value, and temperature and humidity held within ranges that suit product, process and people. On the pressure cascade it is direct:

“Air pressure differences identified as critical should be continuously monitored and recorded.” EU GMP Annex 1 (2022), §4.16

Get the second job wrong and you have an excursion, a deviation, perhaps a batch to assess. Annex 1 even lists a modification to the HVAC system among the changes that can call for a new aseptic process simulation. An inspector sees the air handler as part of the process, not as building services.

The Yokogawa case sits almost entirely on the first job: humidity and temperature limits for semiconductor yield, not a pressure cascade between grade B and grade C. So split the HVAC by function before anyone mentions artificial intelligence.

The top rows are where most of the energy goes and where nobody signs a batch record. The bottom rows are where an inspector looks first.

Learning on the plant versus learning in the lab

The real question is not the algorithm but the word learning, and when it happens. In the HVAC case, the controller learned on the real equipment and kept adapting for months. That is what an energy manager likes: the model follows the seasons on its own. It is also what the draft GMP text puts outside critical use. The European Commission consulted on a new Annex 22, Artificial Intelligence, from 7 July to 7 October 2025, and its scope is blunt:

“The use of dynamic models which continuously and automatically learn and adapt performance during use, is not covered by this document, and should not be used in critical GMP applications.” Draft EU GMP Annex 22, section 1

The same draft limits itself to models with deterministic output, names reinforcement learning among machine-learning approaches in its glossary, and asks for a tested model to be put under change control and configuration control, with its performance and its input data monitored for drift in operation. It is still a draft: the Commission’s EudraLex Volume 4 page lists no Annex 22, and its Annex 11 is still the 2011 revision. A draft is not a requirement, but it is the clearest signal of where European inspectors are heading, and a system qualified today will still be running when the final text applies.

That leaves three ways to run such a controller, and they do not carry the same evidence.

The middle row is where most serious projects will land. It has a price: the controller no longer follows the seasons by itself, so someone decides when a retrained version is worth the paperwork. Anyone who has managed recipe changes on a validated line knows the rhythm.

The architecture that keeps QA calm

Whatever the mode, the design principle that works on site is old and boring: the clever part never owns the limits. It proposes; deterministic layers underneath decide what is allowed.

In practice, the PID loops that hold pressure, temperature and humidity stay in the controller or the building automation outstation, tuned and documented as before (our note on control loops covers that documentation). The optimiser writes setpoints or biases, never valve or damper positions on a GMP-critical loop. Its envelope is clamped in the PLC, not in its own software, and the clamp belongs to the qualified configuration. The GMP monitoring that feeds batch decisions runs on a system the optimiser cannot write to.

Add a watchdog. If the optimiser goes silent, sends values outside the envelope, or the plant enters a state the model never saw (a fan failure, a filter change, a door held open during a transfer), the loops fall back to fixed, qualified setpoints and an alarm tells the operator why. And treat the link between optimiser and controllers as what it is, a network path with write access to production equipment, zoned and controlled like any engineering workstation. Our article on building management systems describes the layers it crosses.

What an inspector would ask

Inspectors rarely start with the algorithm. They start with the intended use and work down:

• Intended use. Which functions does the model influence, which GMP parameters could it move even indirectly, and who approved that description?
• Envelope and version. Where is the clamp enforced, who can change it, which policy runs today and what testing stood behind its release?
• Acceptance criteria. The draft Annex 22 expects a model to perform at least as well as the process it replaces, so the old control strategy must be measured first.
• Drift. How do you know the plant still looks like the data the model was tested on?
• People. Can the shift operator put the system back on fixed setpoints without calling the data scientist, and has anyone actually done it?

None of this is exotic: it is computerised system validation applied to a component whose behaviour was learned rather than written. The ISPE GAMP Guide on artificial intelligence (July 2025) sets out the same life-cycle thinking, and our piece on what AI must prove in pharma covers the wider quality questions.

Where to start

1. Pick a non-GMP utility first: a boiler house, a chilled-water plant, the heat recovery of a warehouse air handler. Same physics, no batch at stake, a real energy meter.
2. Measure the baseline honestly: several weeks of existing control, normalised for weather and load. Without it, any saving is a story.
3. Run in shadow mode. The controller logs what it would do; engineers compare it with what the plant did. Most bad ideas die here, cheaply.
4. Let it act inside a narrow envelope, clamped in the PLC, with a watchdog and a documented fallback. Widen the envelope only on evidence.
5. Freeze, test and release. Write the intended use and acceptance criteria before the test, keep test data apart from training data, and release the policy as a version under change control.
6. Only then look at classified areas, starting with the energy side of their air handlers, and keep the pressure cascade and the monitoring out of reach.

Five common mistakes

• Treating the vendor’s figure as your business case. A few percent of fuel on one plant in one climate says little about yours.
• Starting with the room loops. The savings are upstream, in heat sources and outside air; the GMP exposure is in the rooms.
• Keeping the clamp in the AI software. A limit that lives in the software it constrains is not a limit.
• Calling a retrain a tuning tweak. A new policy is a new version, with change control, testing and a record of what changed.
• Forgetting the night shift. If operators do not know how to switch the optimiser off and what the plant does then, the first odd morning ends with someone overriding things they do not understand.

A learning controller can save real energy on a plant. On a GMP site it earns that right the same way everything else does: a frozen version, a fixed envelope, and limits it can never touch.

References

• Hiroaki Kanokogi, “Case Study: AI-Based Autonomous Control”, InTech, ISA, October 2022.
• Y. Cui, L. Zhu, M. Fujisaki, H. Kanokogi, T. Matsubara, “Factorial Kernel Dynamic Policy Programming for Vinyl Acetate Monomer Plant Model Control”, IEEE CASE, August 2018.
• Yokogawa, press release of 30 March 2023 on the formal adoption of its autonomous control AI at a chemical plant, with the 2022 field test.
• European Commission, EU GMP Annex 1: Manufacture of Sterile Medicinal Products, 2022, §4.14, §4.16, §9.6, §9.38.
• European Commission, stakeholders’ consultation on Chapter 4, Annex 11 and new Annex 22, 7 July to 7 October 2025, with the draft Annex 22 text.
• ISPE, *GAMP Guide: Artificial Intelligence*, July 2025.