ISPE Annual Meeting 29 October 1 November 2017 San Diego, CA

Transcription

1 Special Considerations and Quick Wins for Data Integrity in Process Control Systems Karen Ashworth KACL Introduction What s special about Process Control Systems (PCS)? How do we work out which records are important? How do we identify the data integrity threats to those records? What is a typical PCS data lifecycle / typical threats to data integrity? What might the quick wins be? 1

2 1.0 What s Special about PCS MOSTLY THE FACT THAT IT IS CONNECTED TO A PHYSICAL PROCESS!! Physical Process (not just data) Probably controlled in real time Possibly released in real time DIRECT RISK TO PATIENT SAFETY SOME OTHER CONSIDERATIONS THAT APPLY PARTICULARLY TO PCS Tends to be very multidisciplinary / use multiple suppliers / have many interfaces May be standalone or embedded with process equipment (in which case process knowledge may reside with the supplier rather than the end user) Often has additional complexities due to phased delivery or trying to allow for future processes in a multipurpose plant 2.0 Which PCS Records are Important? ESSENTIALLY, THOSE THAT DIRECTLY LINK TO PATIENT SAFETY AND PRODUCT QUALITY And if we ve done things right, these should be identifiable from the original drug development process: 2

3 2.1 Which PCS Records are Important? Some of these aspects of the control strategy link directly to data that we collect for each batch manufactured: But that is not the end of the story 2.2 Which PCS Records are Important? The per batch data is not sufficient in its own right to say that good quality product is being made. Each aspect of the control strategy also involves some elements that we set up / validate prior to use: 3

4 2.3 Which PCS Records are Important? And these in turn give rise to records (many of which exist outside of the PCS itself and many of which may be paper rather than electronic) 2.4 Which PCS Records are Important? It is, however, the per batch data that the rest of this presentation is going to concentrate on. This is the data that is collected repeatedly throughout the lifecycle of the system, so presents most opportunity for data integrity vulnerabilities. 4

5 3.0 How Do We Identify Data Integrity Threats? If our data is generated through a well defined, consistent process with no manual intervention, we can often deal with data integrity issues by validating that process and then locking down the configurations involved. A poorly defined or inconsistent process or one with a high degree of manual intervention or subjective interpretation means we can t validate out the data integrity threats. Freedom from Manual Intervention and Subjectivity Poorly defined or inconsistent process High degree of manual intervention or subjectivity of interpretation Well defined, consistent process Little or no manual intervention or subjectivity of interpretation Definition and consistency of process to create record 3.1 How Do We Identify Data Integrity Threats? Example 1 Sterilization temperature data automatically captured from a thermocouple, compared to the required sterilization time and temperature and reported as a pass/fail Example 2 Ingredient weighed manually and weight transcribed into control system for storage Example 3 Vision recognition system automatically capturing images and checking packaging quality. Operator override if system cannot decide pass/fail. Example 4 Experimental PAT system being used to predict when to manually stop a tablet coating machine to achieve the correct coating thickness Freedom from manual Intervention and Subjectivity 4 3 Definition and consistency of process to create record 2 1 5

6 3.2 How Do We Identify Data Integrity Threats? Firstly, we need to understand the overall data lifecycle. What data feeds into our critical records? Who owns it? Are the processes it goes through well defined and consistent? What degree of manual intervention / subjectivity is involved? 4.0 What does it look like in PCS? Example high level data flow within a Distributed Control System (DCS) Red = route a temperature value takes into final batch record Blue = manual interventions which might affect it Black = control actions 6

7 4.1 What does it look like in PCS? Example for PCS data lifecycle creation stage ( getting the signal in ) Sensor Any settings? Calibration? Input Card Any settings? Calibration? DCS Controller Settings for range, units, calibration, etc Sample rates? Filtering? Timestamping? Signal wiring Correct? Fault indication? Electrical noise? Comms wiring Correct? Fault indication? Electrical noise? Store & Forward? 4.2 What does it look like in PCS? Example for PCS data lifecycle creation stage ( passing it through to be stored ) DCS I/O Server Metadata re entered? Time stamping? Sample rates? Redundant paths? Data quality indication? Comms wiring Correct? Fault indication? Electrical noise? Store & forward? Network Infrastructure Correct? Fault indication? Electrical noise? Store & forward? DCS Historian Server Metadata re entered? Sample rates? Compaction algorithms? Tamper resistant format? Data quality indication? Interpolation settings? 7

8 4.3 What does it look like in PCS? Example for PCS data lifecycle processing stage ( generating alarms to indicate out of specification ) DCS Controller Fixed alarm settings? Timestamping of alarm? I/O Server Alarm settings? Timestamping? Client Display Manual entries? Access controls? Audit trailed? Alarm status clear to users? Batch Server Recipe settings? Access controls? Audit trailed? Historian Server Same considerations as before for route through to storage 5.0 What are the Quick Wins? A summary of the types of threats to data integrity that we have identified: Threats to validated status of automatic functions System outputs misunderstood or used inappropriately in decision making 8

9 5.1 What are the Quick Wins? Reducing threats to the validated status of automatic functions Some possible quick wins: Adequate initial validation based on the risk to patient safety, product quality and data integrity, the complexity and novelty of the system and the results of supplier assessment. Operating appropriate change control and configuration management systems. Locking down (logically or physically) validated configurations and parameters including those on smart sensors and embedded control devices. 5.2 What are the Quick Wins? Making it less likely that system outputs will be misunderstood or used inappropriately Some possible quick wins: Ensuring data quality indications are clear and are passed through into final record via communications interfaces, calculations or any other processing activities. Ensuring that data retrieval modes are transparent on final reports (e.g. interpolation on trends, filtering and clarity about suppression status on alarm history). Suitable automatic or second person checking of manual activities that use system outputs in decision making (e.g. reconciliation of manual rejection activities) 9

10 5.3 What are the Quick Wins? Reducing the likelihood of accidental poor quality data Some possible quick wins: Appropriate calibration regimes. Checking filtering / logging rates / hysteresis / other sampling algorithms are appropriate to the dynamics of the attribute being measured. Understanding at what point in the processing values and alarms are timestamped and whether this is appropriate to the dynamics of the attribute being measured. Automated data transfer rather than manual transcription if possible. Minimizing manual interventions (e.g. can settings come from a pre validated recipe rather than being manually entered?). Suitable automatic or second person checking of manually entered values (e.g. ingredient dispensing). Training / SOPs / automated prompts which support operators in carrying out tasks consistently and correctly. 5.4 What are the Quick Wins? Reducing the likelihood of deliberate wrong data values Some possible quick wins: Changing design to minimize the need for manual interventions Security management and access controls with appropriate segregation of roles Audit trailing of system activity and review of that audit trail Automatic time synchronization But, above all, a culture of doing it right because it is the right thing to do 10

11 Any Questions? Karen Ashworth KACL 11