With the building of a new plant, the project team have been adamant and have even listed the BMS to be purchased for the new plant to be of the "non validated " type! After much discussion, the terminology BMS was Changed to EMS (as if that makes any difference!) so as not to have the BMS validated/qualified.
Has anyone perform a risk assessment on a BMS and is willing to pass a few tips my way as to explain the neccessity of qualifying a BMS?
Your help will be most appreciative.
Here are a few questions that need to be answered.
[LIST=1]
The answer is yes to most of the questions such as alarm alert and action limits have already been established, put in place and tested, yet not documented!!! critical parameters can be changed from any PC within the facility(various access levels) etc with no control of the access codes. With all the above, I still cannot get the criticallity of the BMS through to the team. The perception is that it is there, but will be a ‘hidden’ unit with temp/RH/DP etc logged manually (Pen and Paper!)
Thanks for the help
So then they are taking their readings from an un-validated source. Their data would no good. If they react to a computer based system (alarms) then the alarms should be validated. If they base quality decisions from a computer system, then validate. It is very difficult to persuade people who don’t want to listen.
[quote=meyert]Here are a few questions that need to be answered.
[LIST=1]
The original thread is a bit misleading here. Regards this unit, the M in BMS/EMS was never meant to mean management, rather monitoring. This was agreed to by all parties (Validation, QA and Engineering). The idea was that set points, and other elements could not be altered remotely. This opposite holds however, therefore the original assumptions made around the impact assessment were incorrect and this should be revised. This is the sticking point between the validation team and the project engineers. The information generated by the system was only ever meant to be for maintenance engineering purposes. However, this has changed. The onus therefore lies on Quality and Validation to convince the project team otherwise. Alternatively, the system use parameters needs to be locked down and defined in a procedure emphasizing it’s use as an information purposes only system!
Monitoring or Managing…it really makes no difference for BMS. It is still a computer system that is responsible for the environmental quality.
- Using manual monitoring, you will never be able to respond that the temperature, humidity or pressure was maintained. You can respond that at the moment in time you took the reading, it was maintained.
- I would contend that it is not critical, else, continuous monitoring would be instituted. I thought continuous monitor was required. Are you putting in chart recorders too?
3/4. Once alarms are active, the system would be validated. - So you are going to set dampers and screw them in place so they cannot change? And you are going to set the fan speed and not allow it to adjust as your filters load? That means, as your filters load, you will fall out of your validated range.
I think I understand. This scenario is very common where validation is seen as a burden or of little value except generating paper. Also, it is typical to “dumb down” the system so that it doesn’t fall into the criteria of GMP. (ie manual readings, no alarms). This was common practice in the early 2000’s, I haven’t seen this technique in a while. Ton’s of manual work to stay in the 90’s.
- Not a big deal if it was purely for maintenance response.
- No chart recorders. Continual visual displays off calibrated gauges. Checks instituted at start, middle and end of shifts, 3 shifts daily, Temp/RH/Pressure, all displays in area.
3/4. Intended alarms are of the Audiovisual type and are linked to the primary controllers on the AHU. The system can send alarms, but it was never intended to manage this function. - Dampers adjusted manually, set and locked in place. Fan speed taken care of via variable speed drives linked to to pressure sensors. These ramp up as filter resistance increases. these are controlled via the AHU controllers, not the monitoring system. The capability to change the fan speeds does not exist on the system as there are no links to any of the VSD’s.
Don’t get me wrong, I’m not agreeing with the project team stance, and I certainly don’t believe in staying in the '90’s, fun time that it was!! As far as the current use is concerned, I definitely fall on your side of the line. I was merely attempting to give a more clear picture of the situation as it stands, as this was not well elucidated in the original post. Validation is there to prove fitness for intended purpose. Under the initial use assumptions, no GMP critical elements would be controlled and adjusted by the computer system. Validation and engineering would take care of proving that the individual AHU component controllers were working within their ranges, as these were the primary control units. Alarms would be audiovisual indicators in the GMP critical areas linked to these controllers. However, the intended use has definitely changed, what with the guys using it to adjust set points, play around with cooling and heating parameters, etc!! Additionally, within our system, it is very simple to ensure the system gets validated. We simply have to revise the original impact assessment assumptions under change management, get project quality to approve it, and hey presto, CSV here we come. I am all for validating these types of systems, but it is very important to have all the background information at hand as well…
Thanks for the quick reply here. Forget about what the system WAS going to be used for and lets concentrate on the system that IS installed and IS in use. The fact remains that the critical parameters (Temperature,RH and indirectly, Fan speed) can be altered at anytime without anyone knowing.
Just to answer the questions that meyert put forward,
How will they monitor temperature, humidity and pressure differentials in the building? Will you use electronic records from the BMS to support your Environment? Manual monitoring from calibrated gauges will be the primary quality record
Are these environmental parameters considered critical to product quality? Yes
Will there be alarms in system? Yes, all the critical parameters are monitored and alarm limits have been set
How will you react to alarms? Contacting of the correct personnel for the specified alarm
Will the BMS be controlling airflow to classified air space? I know of course it will.
If you make a change to the system, do you need a change control that includes QA approval? No, and this is where I have a huge problem and cannot get buy-in
Will you be controlling door interlocks with the BMS? Why do you have door interlocks? No, the door interlocks are controlled via another system.
Do you validate WFI or clean steam? Yes
Do you control temperature, humidity and/or pressure? Why?Yes, via the AHU control and the BMS
As can be seen, nothing is misleading here whatsoever!
And now to come back to my original question of 'Has anyone perform a risk assessment on a BMS and is willing to pass a few tips my way as to explain the neccessity of qualifying a BMS?'
Once again, thanks for the help.
:mad:How can QA not approve a Change Control, when the document is controlled and regulated by QA. Of course there is a QA approval associated with any change that might be made to the system. Note that parameter changes are completely different to system/design changes (Changing an RH target from 55 % to 53 % should not require a change control as it is part of system functioning and maintenance. Changing required RH specification from less than 55 to less than 35 % would require change management, as it would necessitate a system design change. Let’s not get confused between the two). Critical design/user specification changes would definitely require change management. Altering a parameter to stay in spec which does not necessitate a system change (say specification is for temp to be between 16 - 24 degrees. setting controller to 19, finding that this renders the area too cold, then resetting to 21 to maintain it)? Not so…
If this was a true management system, regulation would be a 100 % function of the computer and a controller would be unnecessary. However, this setup only sends a setpoint. The regulation/climate control function is completely 100 % managed by the AHU controller. Unplug the monitoring system, and you can still do whatever it is that you want to do. Primary climate control ultimately still resides on the AHU. So, original post misleading? IMHO, absolutely!
Regards the BMS risk assessment, standard approach applies. lock down system description. include full functionality range and intended application. define system components and component functionality. list potential risk events associated with components. rate event seriousness/criticality. rate likelihood of occurrence. rate likelihood of detection. list and score mitigation/fault recovery factors. extrapolate data and revise original criticality assumptions.
End of discussion from my point. Thanks for the help.
Dear all,
Please let me to discuss this issue with you:
Our vendor of BMS software informed us that he can provide us with validated software as per 21 CFR part 11 if our system of HVAC system is validated , Actually our HVAC system has been tested/qualified at handover of the project 12 years ago, actually some changes of AHU controllers / temp+ %RH transmitters have been changed during this period without revalidation ,
Our vendor of validated software is committed to ensure the calibration status of all critical additional components he is going to install (e.g. transmitters).
Can we do PQ for the integrated BMS system without revalidation of current HVAC.
Please for your help.
Thanks