A pharmaceutical process control system has five layers: field instrumentation, the control layer (PLC or DCS), supervisory SCADA and HMI, the manufacturing execution system, and the business layer. Paul Industries designs, builds and installs the first three – instrumentation, control panels and supervisory control – as part of turnkey process systems across the United States, and qualifies them under IQ/OQ/PQ.
Before the components, one ambiguity worth clearing, because it makes most answers to this question confusing.
“Process control system” means two different things
Ask this question and you will get answers about DCS platforms and answers about SOPs, CAPA and quality management – as if they were the same subject. They are not, and conflating them is why the topic reads as a muddle.
| The control SYSTEM | The control STRATEGY | |
|---|---|---|
| What it is | Physical and software infrastructure – instruments, I/O, PLC or DCS, SCADA, panels | The documented set of controls keeping product within specification |
| Made of | Sensors, actuators, controllers, networks, servers | Critical process parameters, in-process controls, specifications, SOPs |
| Governed by | 21 CFR 211.68 and Part 11; GAMP 5 for the software lifecycle | 21 CFR 211.100 and 211.110; ICH Q8-Q10 |
| Delivered by | Engineering, integration and installation | Process development and quality |
| Qualified by | IQ/OQ/PQ of the system | Process validation |
Both are required and neither substitutes for the other. A well-built DCS running an unjustified control strategy produces excellent records of the wrong thing. A sound strategy on unqualified instruments cannot be evidenced. This page covers the system; our process validation guide covers the strategy.
The five layers, and who touches each
| Layer | What it contains | What it does | Notes |
|---|---|---|---|
| 1. Field | Sensors, transmitters, actuators, valves | Measures and acts on the process | Where accuracy is won or lost. Everything above inherits this layer’s data |
| 2. Control | PLC or DCS, I/O, control panels | Executes logic, sequences and interlocks | PLC suits skids and discrete units; DCS suits large integrated plants |
| 3. Supervisory | SCADA, HMI, historian | Visualization, alarms, data logging, trending | Where operators work, and usually where the audit trail sits |
| 4. MES | Manufacturing execution system | Electronic batch records, recipe management, review by exception | A separate project in its own right |
| 5. Business | ERP | Planning, materials, scheduling | Rarely part of an equipment scope |
The field layer is most often under-specified and it sets the ceiling on everything above. A historian cannot record accuracy an instrument never had, and an MES cannot review by exception if the exception was never measurable. Money spent at layer 1 buys more than money spent at layer 4.
Field instrumentation on a hygienic system
This is the part a contractor actually installs, and where hygienic process control differs from general industrial control: the instrument has to measure the process and not compromise the sanitary design of the line it sits in.
| Measurement | Typical technology | Sanitary installation issue |
|---|---|---|
| Flow | Magnetic, Coriolis | Full-bore, flush liner, no cavity. Coriolis adds mass and needs support |
| Temperature | RTD in a thermowell, or flush surface sensor | A thermowell protrudes into the flow – specify a sanitary flush design where cleanability governs |
| Pressure | Flush diaphragm sanitary seal | Never a tapping with a dead leg. The diaphragm must sit flush with the bore |
| Level | Radar, hydrostatic, load cells | Load cells avoid vessel penetration entirely – often the cleanest hygienic answer |
| Conductivity | Toroidal or contacting | The routine CIP and water endpoint – and blind to non-ionic residue |
| TOC | Online analyzer | Compendial water monitoring under USP 643 |
| pH | Sanitary electrode | Needs access for calibration and replacement without breaking the line |
Every instrument is a potential dead leg. An instrument tee installed for convenience rather than designed for flow creates exactly the unswept volume cleaning validation later fails on. Flush-mounted, zero-static and in-line designs exist to avoid this, and choosing them is an installation decision rather than an instrument-selection one. See dead legs and the L/D rule.
Data integrity: 21 CFR Part 11 and ALCOA+
21 CFR 211.68(b) requires controls over computerized systems so that changes are made only by authorized personnel, with input and output accuracy verified. 21 CFR Part 11 then governs electronic records and signatures where records are kept electronically. In practice both are assessed against the ALCOA+ attributes:
- Attributable – who did it, recorded automatically rather than by convention
- Legible – readable and permanent, including after export
- Contemporaneous – recorded when it happened, from a synchronized clock
- Original – the first capture, or a verified true copy
- Accurate – correct, and traceable to a calibrated instrument
- Complete – including repeats, failures and reprocessing, not only successes
- Consistent – sequenced correctly, with a reliable time reference
- Enduring – retained for the record retention period
- Available – retrievable on request for the whole retention period
The three that most often fail on a new system are Attributable, Contemporaneous and Complete. Shared operator logins destroy attributability. Unsynchronized clocks across PLC, SCADA and historian destroy contemporaneity and sequence. And a system configured to log only successful batches is not complete – failures and repeats are exactly what an investigator wants to see. All three are configuration decisions made during installation, and all three are cheap then and expensive later.
GAMP 5 and how much validation a control system needs
GAMP 5 is the industry framework for computerized system validation, and its software categories set the effort. The category is not a judgement about quality – it describes how much of the system is bespoke, and therefore how much needs testing.
| GAMP category | What it covers | Validation effort |
|---|---|---|
| Category 1 | Infrastructure software – operating systems, databases, network | Qualify the infrastructure; do not test the vendor product itself |
| Category 3 | Non-configured products used as supplied | Verify it works for your intended use |
| Category 4 | Configured products – most SCADA, DCS and MES | Test the configuration, not the underlying platform |
| Category 5 | Custom or bespoke code | Highest effort – the code is unique to you and nobody else has tested it |
The practical lever is that custom code carries a permanent validation cost. Every change to a Category 5 element has to be assessed, tested and documented for the life of the system. Configuring a standard platform where possible, rather than writing bespoke logic, is usually the cheaper decision over ten years even when it looks more constrained on day one.
What OQ on a control system actually tests
- Every instrument loop, end to end, against a calibrated reference
- Alarms – each one triggered, annunciated and recorded
- Interlocks, including the conditions they exist to prevent
- Access levels – each role tested for what it can and cannot do
- Audit trail – entries generated, attributable, time-stamped, and not editable
- Power failure and recovery, including what the process does on restart
- Communication loss between layers, and the defined safe state
- Data backup and restore, actually performed rather than assumed
- Sequence execution across the full operating range
- Time synchronization across PLC, SCADA and historian
Failure-condition testing is the half most often skipped, and it is the half that matters. Testing that an alarm appears when you force the condition is straightforward; testing what the process does when power drops mid-sequence, or when the network drops between the PLC and the historian, is where an unqualified system reveals itself.
Related: IQ/OQ/PQ requirements · validation and commissioning · process skid fabrication, where the control panel is built as part of the skid.
Get a single-source quote
Frequently asked questions
What are the essential components of a pharmaceutical process control system?
Five layers. Field instrumentation – sensors, transmitters, actuators and valves that measure and act on the process. The control layer – PLC or DCS with I/O and control panels executing logic, sequences and interlocks. Supervisory SCADA and HMI with a historian for visualization, alarms and data logging. A manufacturing execution system for electronic batch records and recipe management. And the business layer, ERP. The field layer sets the ceiling on everything above it, because no layer can record accuracy an instrument never had.
What is the difference between a control system and a control strategy?
The control system is the physical and software infrastructure – instruments, controllers, SCADA, panels – governed by 21 CFR 211.68 and Part 11 and qualified through IQ/OQ/PQ. The control strategy is the documented set of controls that keeps product within specification – critical process parameters, in-process controls and procedures – governed by 211.100 and 211.110 and confirmed through process validation. Both are required and neither substitutes for the other.
PLC or DCS for a pharmaceutical facility?
PLC-based control generally suits skids and discrete units, where the scope is bounded and the logic is self-contained. DCS suits large integrated plants with many interconnected loops and a need for unified operator interface, alarm management and historian across the whole facility. The decision is usually about integration scope and long-term support rather than raw capability, since both can execute the control adequately.
What does 21 CFR Part 11 require of a control system?
Where records are kept electronically, Part 11 governs electronic records and signatures – access controls limiting actions to authorized personnel, secure computer-generated audit trails that are time-stamped and not editable, record retention and retrieval for the required period, and controls over electronic signatures. Alongside it, 21 CFR 211.68(b) requires controls over computerized systems with input and output accuracy verified.
What is ALCOA+ in pharmaceutical data integrity?
Attributable, Legible, Contemporaneous, Original and Accurate, plus Complete, Consistent, Enduring and Available. The three that most often fail on a new system are attributability, destroyed by shared operator logins; contemporaneity, destroyed by unsynchronized clocks across PLC, SCADA and historian; and completeness, where a system logs only successful batches rather than failures and repeats. All three are configuration decisions made at installation.
What are GAMP 5 categories and why do they matter?
They describe how bespoke a system is, which sets validation effort. Category 1 is infrastructure software, Category 3 is non-configured products used as supplied, Category 4 is configured products such as most SCADA and DCS, and Category 5 is custom code. The practical consequence is that custom code carries a permanent validation cost – every change must be assessed, tested and documented for the life of the system, so configuring a standard platform is usually cheaper over ten years.
How do you install instruments without creating dead legs?
Use flush-mounted, zero-static and in-line designs rather than tapping into the line for convenience. A pressure transmitter needs a flush diaphragm sanitary seal sitting level with the bore, not a tapping. Temperature can use a flush surface sensor rather than a protruding thermowell where cleanability governs. Level can use load cells and avoid vessel penetration entirely. Every instrument tee installed for access rather than designed for flow is an unswept volume that cleaning validation will later fail on.
What does OQ test on a control system?
Every instrument loop against a calibrated reference, every alarm triggered and recorded, interlocks including the conditions they prevent, access levels per role, audit trail generation and non-editability, power failure and recovery behavior, communication loss between layers and the resulting safe state, backup and restore actually performed, sequence execution across the operating range, and time synchronization across PLC, SCADA and historian. Failure-condition testing is the half most often skipped and the half that matters.