Operational Qualification for VHP, BIBO, Pass Box and APR Door Systems: Functions That Need Evidence

When interlock or alarm logic faults survive OQ undetected, they tend to surface under conditions that are difficult to manage: a door sequence fails mid-transfer, a filter housing opens without confirming pressure neutralisation, or a VHP cycle steps forward despite a sensor fault. None of these failures announce themselves during normal-operation testing because normal-operation testing never forces the condition that reveals them. The practical cost is not only a containment breach risk—it is a qualification programme that must be partially reopened, scripts rewritten, and retesting scheduled against an occupied commissioning timeline. The decision that separates defensible OQ evidence from documentation that satisfies paperwork but not inspectors is whether each critical function has been challenged under a defined abnormal condition, not merely observed during routine cycling.

Operating functions that need challenge evidence

Risk analysis should drive scope selection before any test script is written. One structured approach is to score each operating function for consequence and likelihood, then prioritise those that breach a defined threshold for challenge testing—leaving lower-risk functions to normal-operation checks. Whether or not a numerical risk priority number is used, the underlying discipline matters: if a function’s failure could allow uncontrolled exposure, an undetected cycle abort, or a breach of pressure boundary, OQ evidence for that function needs to demonstrate more than a successful nominal run.

The challenge philosophy behind robust OQ design is to surface failure modes under controlled conditions, before those conditions arise in use. This means testing restart behaviour after an interrupted cycle, verifying repeatability across multiple runs rather than accepting a single pass, and confirming that limit conditions—maximum and minimum values within defined operating ranges—produce the expected response. For VHP, BIBO, pass box, and APR door systems, the functions that typically carry the highest consequence if they fail silently include cycle phase transitions, door access sequencing, filter differential pressure monitoring, and alarm-to-control-system communication paths. Each of these can behave correctly during a standard demonstration run and still carry an undetected fault in the branching logic that governs abnormal states.

The selection of which functions to challenge is itself an auditable decision. If the rationale for including or excluding a function from challenge testing is not documented, a reviewer cannot assess whether the scoping was conservative enough. OQ scope that is set during the validation planning phase and formally linked to the risk assessment creates a traceable basis for that decision—rather than leaving it implicit in the script.

Alarm, interlock and door logic test conditions

Alarm and interlock tests exist not to confirm that the system displays a warning, but to verify that the warning is triggered by the correct condition, that it is logged in a retrievable form, and that recovery from the alarm state requires deliberate operator action rather than automatic resumption. Each of those three elements—trigger accuracy, event logging, and controlled recovery—can pass or fail independently. A system that displays the correct alarm but does not log the event creates an audit gap. A system that logs the event but permits automatic restart without confirmation may not satisfy the data integrity expectations set out under EudraLex Volume 4 Annex 11 for computerised systems involved in GMP-relevant processes.

The alarm simulation requirement carries a specific documentation discipline: the simulation method must be described in the OQ form itself, not reconstructed after the fact from memory or verbal instruction. For a purely mechanical interlock, that might mean physically blocking a sensor flag; for a software-driven door sequence, it might mean introducing a forced signal state. In both cases, the form should record what was done, not just what was observed.

Where door sequencing logic governs containment boundary status—as it does in interlocked pass box or airlock systems—the prohibited-action test carries particular weight. Confirming that an attempt to open the outer door while the inner door is unsealed results in a blocked action, a logged event, and a recovery sequence that requires deliberate reset is not a formality. It is the test that confirms the interlock logic behaves under actual operator-equivalent pressure, not just during scripted normal access.

VHP, BIBO and pass box function records

The records generated during VHP, BIBO, and pass box OQ need to reflect the specific performance of each system’s operating functions, not just the outcome of a successful cycle. For VHP pass box systems, that means documenting cycle parameter behaviour across phases—conditioning, gassing, dwell, and aeration—with reference to the defined operating ranges for each phase, not just the final biological or chemical indicator result. For BIBO housings, it includes confirmation that the bag-in/bag-out sequence executed under the test conditions without pressure boundary loss, with the filter status and differential readings recorded at each step.

The selection of indicators for decontamination cycle qualification should be treated as a design justification activity specific to the agent, equipment geometry, and cycle parameters in use. Chemical indicators used during OQ function as real-time cycle monitors for distribution and penetration; biological indicators, where used, address efficacy under challenge conditions. The indicator type, quantity, and positioning plan should reflect the equipment’s interior geometry and the locations most likely to receive reduced VHP contact—shadow zones, surface recesses, or areas of low air circulation. This positioning rationale belongs in the OQ documentation, not assumed from a generic indicator layout.

Для Пропускна коробка VHP systems specifically, OQ records should capture cycle repeatability across multiple runs under equivalent loading conditions, not a single cycle demonstration. A single successful run does not demonstrate that the system reliably reaches and holds the required parameters across the range of expected operating conditions. Repeatability data from OQ also provides the baseline against which any future deviation from normal cycle behaviour can be assessed—making it a document with operational relevance beyond the initial qualification event. The Протокол валідації VHP: IQ, OQ, PQ для систем з перекисом водню sets out the broader qualification structure within which OQ cycle records sit.

Для BIBO housings, OQ function records should confirm that the bag attachment, filter seating, and pressure integrity checks all occur in sequence and that each step is logged with a time-stamped record accessible for review.

APR door response under defined abnormal states

Pneumatic seal APR doors operate under conditions where the containment consequence of a failure is not equivalent across all failure modes. A failed seal during normal access cycling is a different category of event from a seal that fails to re-engage following a pressure loss event, or a door that does not return to a safe locked state following a power interruption. OQ must distinguish between these conditions in its test design because an inspector reviewing the evidence will ask specifically what was tested, not what could theoretically function.

Power failure testing is not only a data integrity check. It is a functional safety verification: does the system return to a known, defined state after power is restored, and does it require deliberate operator confirmation before resuming process status? Where computerised control systems are involved, EudraLex Volume 4 Annex 11 frames the expectation that data accumulated up to the point of failure is not lost, and that resumption is controlled rather than automatic. For an APR door system integrated with a pressure monitoring and interlock control loop, this means verifying that pressure status records, alarm logs, and door position states are preserved and presented accurately on recovery.

Sensor out-of-range and sensor disconnection tests address a failure mode that is distinct from both normal operation and power failure: the system continues to receive power but receives no valid signal from a monitoring point. The OQ must confirm that this condition is detected as a fault—not ignored or treated as a zero-value reading—and that the process is either prevented from continuing or forced to a controlled hold pending investigation. A system that silently tolerates a disconnected pressure sensor and continues to cycle creates a containment risk that will not be visible in normal-operation test records.

Script detail needed for audit-ready OQ

The bottleneck in OQ programmes for containment equipment is rarely the execution—it is the test script. Vague instructions such as “verify alarm function” are not executable: they do not specify what condition triggers the alarm, what the expected system response is, how the condition is to be simulated, or what constitutes a pass. A reviewer cannot confirm that the test was performed correctly, and a different technician repeating the test may simulate a different condition entirely. Neither outcome supports the traceability that an inspection requires.

Audit-ready script specificity means that each step identifies the exact simulation method, the expected observable response, and a quantified or unambiguous acceptance criterion. The simulation description is particularly important for alarm and interlock tests: if the OQ form does not record how the malfunction was simulated, the test cannot be reproduced or evaluated independently. This is a documentation discipline requirement, not a recommendation about which simulation technique to use—the method is an engineering choice, but the recording of that method is a traceability obligation.

The downstream consequence of vague acceptance criteria is that results become judgment-dependent at the time of review. If the criterion is “system responds correctly,” two reviewers may reach different conclusions from identical test observations. Quantified criteria—including defined response time limits, specific locked/unlocked state requirements, or explicit alarm trigger thresholds—remove that ambiguity and allow the evidence to stand independently of the reviewing individual’s interpretation. This matters most at OQ closure, when the approval decision needs to be defensible to a third party who was not present during testing.

OQ closure based on observed response records

OQ closure is conditional on resolution of deviations, not merely on completion of test runs. A completed test run that produced an out-of-specification result, a missed interlock response, or an unlogged event is not a closed test—it is an open deviation. EudraLex Volume 4 Annex 15 establishes that deviations identified during qualification must be documented with corrective actions, responsible parties, and defined deadlines, and that any changes made as a result must be assessed under change control before the qualification is considered complete. Treating the deviation list as a post-OQ cleanup activity rather than a closure prerequisite is a recurring pattern that delays final approval when inspectors identify open items during review.

The evidence pack that supports OQ closure must allow a reviewer to trace each critical function from its challenge condition through to its recorded outcome and approval status. That means challenge tests, alarm and interlock tests, and repeatability runs need to be present as discrete records—not consolidated into a summary statement that a series of tests was performed. Контрольний список аудиту GMP документації VHP Passbox Validation Контрольний список аудиту GMP документації outlines the documentation elements that support inspection readiness for these systems specifically.

Where a deviation required a hardware or software change, the change control assessment must be completed and the affected functions re-tested before closure is confirmed. An OQ that records a corrective action as “completed” but does not include re-test evidence for the affected function leaves a traceable gap that cannot be closed retrospectively without re-opening the protocol. The closure decision should be made against all deviation records, not against the test completion record alone.

The recurring failure pattern across containment equipment OQ programmes is not a lack of effort in testing—it is that effort is applied to normal-operation confirmation rather than to the challenge conditions that would expose hidden faults in alarm logic, door sequencing, or sensor fault handling. Once a containment system is handed over and in use, identifying and correcting those faults requires controlled shutdown, re-qualification, and a defensible explanation of how the gap survived the original OQ. That is a significantly harder problem than building challenge tests into the protocol before execution begins.

Before finalising any OQ script for VHP, BIBO, pass box, or APR door systems, the team should confirm that every critical function identified in the risk assessment has a corresponding challenge condition, a described simulation method, a quantified acceptance criterion, and a defined recovery procedure—and that none of these elements are left for the executing technician to interpret. Deviations from that standard should be resolved against a change-controlled baseline, not documented as acceptable observations. That discipline is what separates a qualification record that survives inspection from one that requires explanation under it.

Поширені запитання

Q: What if simulating an alarm or sensor fault during OQ could damage the equipment or create a safety incident?
A: The OQ protocol must define safe simulation methods and recovery procedures before any challenge test is executed. A pre-test risk review identifies potential hazards of the test itself, and alternative approaches—such as signal injection at a controller input or software-based sensor override—can be used where direct physical manipulation is unsafe. The agreement on safe test states, which the core OQ planning already requires, extends to protecting people and equipment during the test.

Q: Once OQ is closed and all deviations resolved, what is the immediate next qualification step?
A: The logical next step is Performance Qualification (PQ), where the system demonstrates consistent performance under actual operating conditions with representative loads. OQ closure confirms that critical functions work across their intended ranges; PQ subsequently proves that the integrated process repeatedly achieves its defined acceptance criteria during routine use. The transition requires an approved PQ protocol and is typically gated by formal sign-off of the OQ report.

Q: Does a lower-risk containment application, such as a BSL-2 pass box, require the same depth of alarm and interlock challenge testing?
A: The depth should be proportional to the risk. A documented risk assessment determines which operating functions are critical; functions that score below the agreed risk threshold can be verified through normal-operation testing without full challenge conditions. The key requirement is that any decision to reduce testing scope is traceably justified in the validation plan, so that a reviewer can see why the containment boundary logic did not need the same level of abnormal-state proving as a BSL-3/4 equivalent.

Q: How does the OQ approach described here relate to Factory Acceptance Testing (FAT) and Site Acceptance Testing (SAT)? Can FAT evidence reduce on-site OQ effort?
A: OQ must be performed on-site in the final installed configuration, because FAT and SAT are conducted under different utility, environmental, and control-system conditions. While non‑critical function checks that remain unchanged from FAT may be referenced to avoid duplication, critical challenge tests—especially alarm simulations, interlock logic, and abnormal‑state responses—should be repeated on-site to confirm they behave correctly with the installed infrastructure and final control loop.

Q: Is the additional time and cost of comprehensive OQ challenge testing justified when the equipment runs successfully in normal operation?
A: Yes, because undetected faults in alarm logic, door sequencing, or sensor fault handling that emerge after handover force a controlled shutdown, partial re‑qualification, and a defensible explanation of how the gap survived the original OQ. The upfront investment in challenge‑based OQ is a risk mitigation measure that protects the commissioning schedule from the far higher cost of post‑handover containment‑logic failures and regulatory scrutiny.