Autoclave & Sterilizer Installation

How to perform IQ OQ PQ for steam sterilizers

How to perform IQ OQ PQ for steam sterilizers: qualification runs in three sequential stages that each answer a different question. Installation Qualification (IQ) asks whether the sterilizer and the utilities feeding it were installed as designed. Operational Qualification (OQ) asks whether the empty chamber performs correctly across its full operating range. Performance Qualification (PQ) asks whether the machine reliably sterilizes the actual loads the facility will run. A stage cannot be compressed or run out of order — PQ data collected on a sterilizer whose steam supply was never qualified proves nothing, because the variable that most often causes failure was never controlled.

The distinction that matters commercially, and the one most published guidance skips: IQ and a large part of OQ are decided by the installation, not by the sterilizer. A correctly built machine bolted to an incorrectly built utility system fails OQ on steam quality and keeps failing until the pipework changes. Paul Industries installs the sterilizer and the clean steam, feedwater, drainage and compressed air systems that feed it, then hands over the documentation package the validation team needs to execute IQ without chasing missing evidence.

Stage 1 — Installation Qualification (IQ)

Installation qualification documents that the unit as installed matches what was specified and what the manufacturer requires. That means verifying model and serial against the purchase specification, chamber level and door seal alignment, utility connections confirmed at the required pressures and capacities, drain fall adequate to clear condensate, instrument calibration certificates in place, and safety devices and interlocks present and functioning. Drawings are reconciled to as-built condition. Gaps found here are cheap to correct; the same gaps found during performance qualification are not.

Equipment documentation review

Verify the model and serial number against the purchase order and the User Requirement Specification. Collect the manufacturer data package, general arrangement drawings, electrical schematics, the P&ID, spare parts list, material certificates for product-contact and steam-contact components, and the operating and maintenance manuals. Confirm the software and firmware version installed matches the version named in the specification and record it — an undocumented firmware revision invalidates the OQ that follows.

Physical installation verification

Confirm the unit is level, correctly anchored, and has the clearances the manufacturer requires for door swing, service access and panel removal. Verify utility connections against the P&ID: clean steam supply line size and material, feedwater supply and quality, cooling water, compressed air, electrical supply voltage and phase, and the drain. Confirm the chamber drain discharges through an air break to prevent back-siphonage, that the drain line is sized and sloped to carry condensate away continuously, and that no downstream restriction can flood the chamber. Verify room ventilation and heat rejection are adequate for the installed load.

Safety system verification

Confirm the pressure vessel carries a valid manufacturer data report and that the safety relief valve is correctly rated, sealed and certified for the vessel MAWP. Verify door interlocks physically prevent opening under pressure, confirm the door seal and its air or steam supply, and check emergency stop function and earth bonding continuity.

Instrumentation verification

Every instrument the validation will rely on — chamber and drain temperature sensors, jacket and chamber pressure transducers, cycle timers, the recorder and the independent monitoring probes — must carry current calibration certificates traceable to a national standard. Record instrument tag, range, location, calibration date, due date and the certificate number. Independent probes must be calibrated separately from the machine control instruments, because a control sensor cannot verify itself.

IQ acceptance criteria

IQ passes when every checklist item is verified, every deviation is recorded and closed or formally justified, as-built conditions reconcile with the engineering drawings, and the full document set is assembled and signed. Any open deviation that affects thermal performance must be closed before OQ begins.

Stage 2 — Operational Qualification (OQ)

OQ demonstrates that the empty sterilizer performs correctly across its specified operating range, with control limits and alarms proven. It is run empty deliberately: the object is to characterize the machine and its utilities without the confounding thermal mass of a load.

Vacuum leak testing

Applies to pre-vacuum sterilizers. The chamber is evacuated, isolated, and the pressure rise measured over a defined period. EN 285 specifies a leak rate not exceeding 1.3 mbar per minute. A failure points at the door gasket, valve packing, instrument fittings, or a joint on the vacuum leg — and pipework joints are a more common cause than the door, though the door is usually blamed first.

Bowie-Dick testing

Applies to pre-vacuum sterilizers and proves air removal, not sterilization. A standard test pack or process challenge device is run in an otherwise empty chamber on a dedicated cycle, typically 134 °C for 3.5 minutes. A uniform color change passes; a pale or patchy center indicates residual air or non-condensable gases. Repeated Bowie-Dick failure after the door and pump are cleared is nearly always a steam-supply problem, not a machine problem.

Empty chamber heat distribution studies

Calibrated thermocouples are distributed through the empty chamber to prove thermal uniformity. Sensors go to the geometric center, each corner of the usable space, adjacent to the drain, and alongside the machine control probe so control and independent measurement can be compared directly. Three consecutive conforming cycles are run at each sterilization setpoint to be qualified. The drain sensor matters more than any other: it is normally the coolest point and is the reference the controller uses.

Steam quality testing to EN 285

Steam quality is measured at the sterilizer connection, not at the generator, because the pipe run between them is what degrades it. EN 285 sets three limits.

These three tests are the most frequent cause of an OQ stall, and all three are decided by how the steam system was designed and installed. That is why the installer, not only the validation body, has to be in the room when steam quality fails.

Control, alarm and interlock challenge

Prove the sterilizer responds correctly to abnormal conditions: over-temperature and under-temperature alarms, low steam pressure, door interlock during cycle, power interruption and recovery behavior, printer or data recorder failure, and abort handling. Confirm the cycle aborts and the load is flagged non-sterile where the specification requires it.

OQ acceptance criteria

OQ passes when three consecutive empty-chamber cycles at each qualified setpoint meet the uniformity band, steam quality conforms to all three EN 285 parameters, vacuum leak rate is within limit, Bowie-Dick passes, and every alarm and interlock behaves as specified. Chamber temperature is typically required to hold within a band of 0 to +3 °C of setpoint, with inter-sensor spread commonly specified at not more than 1 °C once equilibrium is reached — confirm the exact band against your own validation protocol, as facilities differ.

Stage 3 — Performance Qualification (PQ)

Performance qualification proves the autoclave consistently sterilizes your actual loads rather than an empty chamber. Each distinct load pattern is mapped with thermocouples at the positions expected to be coldest, accumulated lethality is calculated as an F0 value at every probe, and biological indicators are placed at the same worst-case locations for independent confirmation. Runs are repeated to demonstrate reproducibility rather than a single success. Load patterns are then documented and controlled, because an operator improvising a new configuration has stepped outside the qualified state.

Worst-case load determination

Define load patterns that represent the hardest thermal challenge the sterilizer will face in routine use: maximum mass, densest packing, largest wrapped items, greatest number of containers, tightest permitted arrangement. Every routine load must fall inside the envelope bounded by the qualified worst cases. Document the load map with photographs and a written configuration so operators can reproduce it exactly — an unreproducible load map is the most common reason a PQ has to be repeated.

Loaded chamber heat penetration studies

Thermocouples are placed inside the load, not in the free chamber space: at the center of the densest item, inside the largest container, at the geometric center of the pack, and at any point identified as slow to heat during OQ. Three consecutive conforming cycles are run per load configuration. The coolest measured point in the load defines the cycle, and the F₀ delivered at that point is what the process is judged on.

Biological indicator challenge studies

Geobacillus stearothermophilus is the reference organism for moist heat, supplied at a population of 10⁶ or greater with a certified D₁₂₁ value. Indicators are placed alongside thermocouples at the identified cold spots, then incubated after the cycle. No growth in the challenge indicators, together with growth in the positive control, confirms the biological challenge was valid. A positive control that fails to grow invalidates the run — the indicators may simply have been dead on arrival.

Load dryness testing

Applies to porous and wrapped loads. Packs are weighed before and after the cycle; EN 285 limits the mass increase from retained condensate, commonly applied at not more than 1% for textile loads. Wet packs are treated as a sterility breach because moisture provides a path for recontamination through the wrapping, so a dryness failure fails the load regardless of the thermal data.

PQ acceptance criteria

PQ passes when three consecutive cycles per load pattern show all load sensors reaching the required exposure temperature and hold time, F₀ at the coolest point meeting or exceeding the specified minimum, all biological indicators showing no growth with valid positive controls, load dryness within limit, and no unexplained deviation. The report is then compiled, reviewed and approved to formally release the sterilizer for production.

How do you calculate F₀ for a steam sterilization cycle?

F₀ expresses the lethality delivered by a cycle as an equivalent number of minutes at 121.1 °C. It lets you compare cycles that run at different temperatures for different times, and it is how the coolest point in a load is judged.

The accumulated lethality is the sum, across the whole cycle, of the lethal rate at each measured temperature multiplied by the time interval:

F₀ = Σ 10^{(T − 121.1) / z} × Δt
where T is the measured temperature in °C, z is the z-value (10 °C for moist heat), and Δt is the logging interval in minutes.

Two consequences follow, and both are worth internalizing. Because the relationship is logarithmic, every 10 °C above 121.1 °C multiplies the lethal rate tenfold, so a cycle at 134 °C accumulates lethality roughly twenty times faster than one at 121 °C. And because lethality accrues throughout heat-up and cool-down, not only during the hold, a slow-heating dense load can bank meaningful F₀ outside the exposure phase — which is exactly why F₀ is integrated from the load probe rather than assumed from the setpoint.

A minimum F₀ of 8 minutes is widely applied to terminal moist-heat sterilization, while the overkill approach targets a 12-log reduction of the biological challenge and is commonly specified at F₀ of 12 minutes or more. Confirm the figure required against your own validated cycle specification and the applicable pharmacopoeial requirement rather than adopting a general figure.

The half-cycle method

In the overkill approach, the sterilizer is challenged at half the intended exposure time with biological indicators in place. If a half-length cycle still gives complete kill, the full production cycle carries at least double that lethality, which establishes the required safety margin without having to run destructive tests on the production cycle itself.

Best practices for thermal mapping pharmaceutical autoclaves

Best practices for thermal mapping pharmaceutical autoclaves come down to sensor count, sensor placement, calibration discipline and honest interpretation of the coolest point. Teams searching for best practices for thermal mapping pharmaceutical autoclaves are usually already mid-study. Mapping is not a formality — it is the study that locates the spot the whole cycle will be judged on for the rest of the machine life.

Calibrate before and after, and prove the drift. Every thermocouple is calibrated against a traceable reference immediately before the study and again immediately after. Post-study drift beyond the protocol limit, commonly 0.5 °C, invalidates the data from that sensor. Skipping the post-study check is the single most common data-integrity finding in mapping work, because without it there is no evidence the sensors were accurate when the readings were taken.

Place sensors where heat arrives last, not where it is convenient. The drain, the geometric center, each corner of the usable chamber volume, and a probe adjacent to the machine control sensor for direct comparison. In PQ the sensors move into the load: densest item, largest container, center of the pack.

Use enough sensors, and scale with chamber volume. Too few and the cold spot is missed entirely; the study then certifies a machine whose slowest point was never measured.

Map at every setpoint you intend to run, and repeat for each qualified load pattern. A machine mapped only at 121 °C is not qualified to run 134 °C. Run three consecutive conforming cycles — a single passing run demonstrates possibility, not reproducibility.

When validation fails, the sterilizer is usually not the problem

Published validation guidance is written from the machine and the protocol outward. It tells you what to test and what the limit is, and then stops. What it rarely tells you is where to look when the number comes back wrong — and in our experience the answer sits in the utilities and the pipework far more often than in the sterilizer itself. A validation team can re-run a failing test indefinitely; only a change to the installation will move the result.

The table below maps the failure you observe to the root cause that most often produces it, and to the correction that actually resolves it.

The handover package that lets IQ proceed without delay

Most IQ delays are not technical. They are a validation engineer waiting on documents nobody assembled during construction. Paul Industries assembles this package as the work proceeds and hands it over as a single reviewed set:

• As-built P&IDs and general arrangement drawings reconciled against what was physically installed, with field changes redlined and incorporated rather than left as annotations
• Weld logs, welder qualifications and coupons traceable weld by weld, with the inspection record for each
• Material test reports for pipe, tube, fittings and valves, heat-number traceable to the installed run
• Slope and drainability verification demonstrating the system drains fully, with no pockets that hold condensate
• Passivation and cleaning records including procedure, chemistry, contact time and verification results
• Pressure test and leak test records for every system installed
• Utility capacity calculations showing the steam, feedwater, air and electrical supplies were sized for peak concurrent demand
• Instrument calibration certificates traceable to national standards, with tag, range, location and due date
• Turnover index mapping every document to the IQ checklist item it satisfies

That last item is the one that saves the most time. A document set that exists but cannot be navigated is only marginally better than one that does not exist.

FDA requirements for pharmaceutical autoclave validation

FDA requirements for pharmaceutical autoclave validation are not set out as a single autoclave rule. They sit inside the cGMP regulations as general obligations that a sterilization process must be validated, monitored and controlled, and they are then given practical shape by consensus standards and FDA guidance. The regulation tells you the outcome required; the standards tell you how to demonstrate it.

The practical reading: FDA will not hand you an autoclave checklist. It will expect you to show a validated process, data integrity across the records that prove it, and a rationale for the acceptance criteria you chose. Recurring citations in this area concern inadequate load pattern qualification, missing or unjustified requalification, and cycle data held in systems without adequate audit trail control.

How often should an autoclave be requalified?

There is no universal interval. Annual requalification is the common default, and it is defensible when supported by a risk assessment, routine monitoring and change control — but the interval must be justified, not simply asserted. A risk-based interval considers cycle criticality, load variability, utilization, monitoring in place, machine age and deviation history.

Certain changes trigger requalification regardless of where the calendar sits:

• A new or modified load pattern outside the qualified worst-case envelope
• Replacement or repair of a control sensor, transducer, valve or the vacuum pump
• Any change to the control software or firmware
• Relocation of the sterilizer, or modification to the steam, feedwater, air or drainage systems serving it
• A change of steam source, or addition of another large consumer to a shared header
• Recurring deviations, failed biological indicators or repeated wet packs
• A change to the sterilization setpoint, hold time or cycle configuration

The utility change on that list is the one most often missed. Modifying pipework elsewhere in the building can alter what arrives at the sterilizer, and a system qualified against the old supply is no longer qualified against the new one.

What is parametric release, and when is it appropriate?

Parametric release means releasing a sterilized load on the physical cycle data alone — temperature, pressure and time — without waiting for biological indicator incubation. It is permitted only where the process is thoroughly characterized and continuously controlled, and it requires an extensively validated cycle, calibrated and redundant instrumentation, full cycle data capture with audit trail, robust change control, and regulatory acceptance of the approach for that product. It suits high-volume terminal sterilization of a stable product on a well-characterized machine. It is not a shortcut for a facility whose validation is already unsteady.

How to select an autoclave validation service provider for pharmaceutical use

Facilities asking how to select an autoclave validation service provider for pharmaceutical use usually compare quotes on price per protocol. That comparison hides the variable that decides the schedule, which is whether anyone on the job can correct a failure once it is found.

The short answer to how to select an autoclave validation service provider for pharmaceutical use: judge the method, not the price. Questions worth asking before awarding the work:

• Are your thermocouples calibrated before and after every study, and is post-study drift reported? If drift is not reported, the data cannot be defended in an audit.
• Do you measure steam quality at the sterilizer connection, to all three EN 285 parameters? Measuring at the generator, or measuring dryness alone, leaves the most common failure modes unexamined.
• How many independent sensors will you use, and what is the placement rationale? A sensor count offered without a rationale is a price, not a method.
• What happens when a test fails? Many validation providers can document a failure precisely and cannot correct it. Establish who diagnoses the root cause and who performs the physical remediation before you need the answer.
• Who is responsible for the utilities? If steam quality fails, a provider with no mechanical capability will hand you a report and leave. The pipework still has to change.
• Will you supply protocols, or execute ours? Both are legitimate; the cost and the review burden differ sharply.
• What is the deliverable, and who reviews it? Ask to see a redacted example report before committing.

Paul Industries approaches this from the mechanical side. We install sterilizers and the clean steam, feedwater, drainage and compressed air systems that serve them, we support IQ and OQ execution with the documentation and site work those stages need, and when a qualification test fails on a utility or piping cause we are able to correct the installation rather than only record the result. Independent validation bodies and in-house quality teams remain responsible for protocol approval and final release — our role is to make the physical plant capable of passing, and to fix it when it is not.

Common autoclave validation failures and what they mean

Why do wet packs happen?

Retained condensate in porous loads, caused by wet incoming steam, a jacket running too cool, inadequate drying vacuum, a restricted or badly sloped drain, or loads packed too tightly and too heavy. Wet packs are treated as a sterility breach because moisture creates a wicking path through the wrapping. Correct the steam and the drainage before adjusting the load, since load changes only mask a supply defect.

Why do Bowie-Dick tests fail?

Air, or gases behaving like air, remaining in the chamber during exposure. Causes include an air leak into the chamber during vacuum, non-condensable gases carried in the steam, an underperforming vacuum pump, or a vacuum pump seal-water supply running too warm to condense properly. If the door and the pump have been cleared, measure the steam.

Why do biological indicators fail?

Genuine under-processing at the indicator location, indicators placed where the cycle was never qualified, degraded or mishandled indicators, or an incubation error. Always check the positive control first: no growth in the positive control invalidates the entire run and points at the indicators, not the sterilizer.

Why does temperature uniformity fail?

Condensate pooling in the chamber from a restricted drain or failed trap, air pockets from incomplete removal, steam supply unable to hold pressure under demand, or a control sensor drifting away from the independent probes. Compare the drain sensor against the control sensor first — a widening gap between them is the classic signature of a drainage problem.

Why does a machine pass qualification and fail in routine production?

Almost always because qualification was run under conditions production does not reproduce: a quiet plant with no competing steam demand, a load lighter than routine, or an operator packing more carefully than the written load map requires. Qualify under realistic concurrent utility demand, and make the load map specific enough that it cannot be improved upon by accident.

Autoclave validation questions we are asked most

More questions we are asked

Moist heat vs dry heat vs chemical sterilization: choosing the method

The method is chosen by what the load tolerates, not by preference. Moist heat is the default because it is fastest and best characterized; everything else exists because something in the load cannot take it.

The distinction that catches people: sterilization kills organisms; it does not remove endotoxin. Endotoxin is heat stable, so a steam cycle that achieves complete kill leaves the endotoxin behind — and killing gram-negative organisms actually releases it. If endotoxin is the concern, the answer is depyrogenation or removal, not a longer autoclave cycle.