PHOTO: PHOTOS.COM

Pharmaceutical water systems are critical in parenteral aseptic manufacturing processes because of their influence on final product quality. Water of pharmaceutical quality is mainly used as a part of the product in formulation processes and as a cleaning agent for vessels and accessories in direct contact with the product, so it must strictly fulfill chemical and microbiological specifications established in internationally recognized monographies such as the United States Pharmacopeia (USP) and the European Pharmacopeia (EP) (1, 2). Pharmaceutical water installations must adhere to technical design criteria, most of which are included in guidelines (3). After several years, those installations may require renovation according to current exigencies and the latest technological advances.

Qualification by stages, from installation design to performance, and incorporating periodical monitoring of key variables at a less-intense frequency than performance qualification contribute greatly to the establishment of water system reliability under the concept of lifetime validation cycle given by USP (4). Nevertheless, daily practice shows that even with validated installations, these systems are not exempt from eventual deviations of their daily normal operation. Risk analysis (RA) methods are usually applied for studying these situations because they illustrate those limitations to which an installation can be subjected concerning failures and facilitate elimination or mitigation of their consequences with anticipated actions.

RA methods have been used in several industrial applications for some time (5). Recently, they have taken on special significance in pharmaceutical manufacturing processes (6, 7). The diversity of methods takes into account model adaptability to characteristics and peculiarities of the analyzed process. In particular, fault tree analysis (FTA) and failure modes and effects analysis (FMEA) have proven their effectiveness in installation analysis.

The present study describes an RA-based approach applied to a pharmaceutical water system, specifically to the water pretreatment and purification (WPP) process. The approach helped determine cause-and-effect complex interrelations in possible fault events through the FTA method, while equipments and components' criticality as well as their failure incidence level on this and other dependent processes was shown using FMEA. An action plan was also obtained that facilitated priorities assignment to improve the installation technically and operationally. In addition, effectiveness of actions was verified during a 15-day system revalidation period.

Process description and considerations

Figure 1 (FIGURE IS COURTESY OF THE AUTHORS)

The WPP process in this study matches the traditional arrangement for this kind of installation (see Figure 1). A first stage of sodium hypochlorite dosage was conceived originally to compensate possible deficits of free chlorine in the tap water supply, thus avoiding bioburden increase throughout the system.

In the coarse-particles removal stage, a Silex fixed bed was originally installed as filtration media, which was the same as the free-chlorine removal stage with a carbon–Silex mixed bed. Independent of their effectiveness, both devices generated inner flow patterns with a high probability of dead-zones formation, which are susceptible to microbiological growth. In addition, fixed-bed recipients constructed of strengthened polyester, softened water-storage tanks made of low-density polyethylene, and pipes and fittings made of poly(vinyl chloride) do not favor system cleaning and disinfection, thereby restricting the process to the use of chemical agents only. Hence the system is obviously far away from fulfilling sanitary requirements, where keeping free chlorine at suitable levels and constant water recirculation to prevent stagnation are the only means to avoid bioburden increments over the amount incorporated by tap-water supplies.

The purification stage, which carries the biggest weight in obtaining water of pharmaceutical quality, was originally designed as a two-stage reverse osmosis (RO) system based on polyamide membranes. Therefore, the previous free-chlorine removal stage is vital to prevent membrane deterioration by oxidation. A sodium hydroxide (NaOH) solution dosage system was incorporated later to ensure a lowering of carbon dioxide content in the pretreated water by converting and eliminating it as bicarbonates through the first-stage rejection stream, thus avoiding electrical conductivity (EC) out of limits (OOL) at the second-stage water product outlet.

Brief overview of the fault tree analysis method

The FTA method can diagnose the reliability and security of processes, mainly those that can be a potential source of hazardous and catastrophic events (8–10). Analysis starts from a top unwanted negative event and then developing all causal intermediate events in a descending way until reaching the final independent events of origin. From this analysis, a representative logical information flow diagram is obtained, in which special symbols depicting logical operators are used (11, 12).

FTA is useful for qualitative analysis because it reveals the various combinations of failures and cause-and-effect relationships that provoke the unwanted top event, as for quantitative analysis in case of calculating the top event occurrence probability from those to which the basic independent event can arise.

Brief overview of the failure mode and effect analysis method

FMEA can be used to discover and analyze all potential failure modes conceivable for a process or system and the effects they can cause as well as to determine how to correct or mitigate those (13–15). Correction is based on the evaluation of the degree of severity and criticality as well as their occurrence and cause detection levels. From there, the actions to be taken are determined.

A list in tabular form is then developed (16). For the WPP process, this list was organized in the same consecutive order of process stages, using the columns as follows (numbers correspond to columns matching the FMEA form):

1. Process equipment and components

2. Equipment and components function or operation

3. Related failure modes including those of nonimmediate detection

4. Effects of each failure mode

Table I: Severity index assignment criteria.

6. Effect criticality, scoring a symbol if S ≥ 8

7. Potential causes ascribable to each failure mode

8. Cause occurrence probability index (O) through an assignment table found elsewhere (16)

9. Current existing controls

10. Control nondetection index (D) through an assignment table found elsewhere (16)

11. Risk priority number index calculation (RPN = S × O × D) for each cause, using maximum S value in case of several effects in a particular failure mode. RPN is used as a ranking of potential failure causes for assigning priority

12. Recommended corrective actions for avoiding failure causes.

In corrective actions, changes for improving process and its controls were taken into account. Such actions were defined for cases in which RPN > 100, as prioritized and for some particular situations in which RPN ≤ 100 also were considered critical.

Process improvement evaluation

Table II: Sampling plan for water pretreatment and purification system performance qualification.

Tap-water expected values were provided from historical analysis reported by the municipality and by results of previous validations. For the rest of variables, the authors referred to process equipment and components requirements, as well as the recognized monographs for pharmaceutical water quality in the case of outlet water product.

Lab analytical equipment was used for offline measurements, such as pHmeter Orion model 30, conductimeter Crison model micro CM2201, total organic carbon (TOC) analyzer Anatoc, LAL analyzer Biowhittaker model Kinetic-QCL, as well as chemical and microbiological specific techniques.

Results from fault tree analysis application

Figure 2 (FIGURE IS COURTESY OF THE AUTHORS)

Figure 3 (FIGURE IS COURTESY OF THE AUTHORS)

Figure 4 (FIGURE IS COURTESY OF THE AUTHORS)

Barriers also were included in the model as conditional events restricting fault-event occurrence, which in principle are process controls. So any failure or negligence on these controls can expose the process to intermediate failures. This is the case of:

• Checking of RO system operational pressure distribution
• Automatic checking of water product EC and its return to the water-softened tank through a three-way on–off valve in case of an OOL detection
• Free-chlorine checking at various points of the process and specially at the RO first-stage inlet
• Checking of cleaning and disinfection performance on equipment prone to generate microbiological contamination
• Visual checking of pressure-group functioning and other automatic devices related to softened-water handling.

An evident complex dependence between intermediate events was observed, which made a model probabilistic solution difficult. For instance, a softener's battery malfunction resulting from any failure can provoke, in a relatively short time, a potential OOL in water-product EC because of ionic content excess, provided that there is a failure in the automatic return device. Moreover, in the long term, this can cause RO membranes scaling in the case of corresponding control failures, then an overpressure on membranes is generated with a consequent airtightness failure in RO modules as a result of O-ring gaskets disruption. Therefore, streammixing can lead to OOLs in all water-product specifications, without discarding a delivering capacity decrease because of permeate area reduction in membranes.

Historical information collected as a result of process supervision was insufficient for determining in good extent occurrence frequencies of basic independent events. Previous information was available for some other processes, but the authors decided not to use them in the present case because of the risk of not fitting the WPP process properly.

Concerning variables such as bioburden and endotoxin contents, which are determined out of line with a substantial delay, these variables can not lead to immediate actions in case of OOL detection and hence their monitoring cannot be considered as an effective barrier restricting related failure occurrence. This factor constitutes one of the process's major weaknesses.

In summary, the FTA model was mainly useful from the qualitative point of view. Thus the authors decided to appeal to the FMEA method for a more practical approach.

Results from failure mode and effect analysis application

Table III:Part of the FMEA applied to water pretreatment and purification process.

A recommended corrective actions plan was aimed in principle to reestablish cleaning, disinfection, and process control activities in a better documented way through official records managed by the QA department. Equipment checking for maintenance and instruments verification and calibration was recommended. In addition, some specific controls must be improved, given the possibility of acquiring water hardness and free-chlorine measuring devices to quantify these variables online.

The authors also decided to incorporate new design elements mainly focused to ameliorate sanitary and operational conditions at the WPP process. The most important changes were as follows:

• Replace the Silex fixed bed by a battery of two centrifuge filters arranged in parallel for retaining coarse particles of more than 50 μm.
• Install a new digital device for controlling softeners' battery operations more precisely
• Install a new totally automated pressure group
• Replace the carbon-Silex mixed bed by a sodium meta-bisulfite (Na₂S₂O₅) dosage system as the principal means of free-chlorine removal, apart from a battery of two carbon cartridge filters arranged in parallel as a safety alternative
• Replace the RO system strengthened-polyester housings and pipes and fittings made of PVC by stainless steel AISI 316L elements. Likewise, all threaded connections between RO modules should be replaced by sanitary tri-clamp connections, the same as pressure-indicator instruments by installing them directly to the measuring points, thereby eliminating all impulse lines to the control board
• Install new safety, drainage and protection elements in the outlet pipeline section from RO second stage to water product storage and distribution tank
• Replace all PVC pipes and fittings through pretreatment stages by stainless steel AISI 304 elements, including sanitary connections as needed.

Results from process performance qualification

Process performance qualification results were documented in the corresponding final report (18). In principle, tap water was still arriving with good microbiological quality, and hardness and alkalinity (the latter related to some extent to carbon dioxide content) showed significant values that were similarly to previous studies. The WPP process still assimilated those loads effectively despite process changes that were directed to improve pretreatments operations with better sanitary conditions throughout the process and taking into account that the essential design of RO membranes arrangement in two stages was kept as originally conceived.

Figure 5 (FIGURES ARE COURTESY OF THE AUTHORS)

Figure 6 (FIGURES ARE COURTESY OF THE AUTHORS)

Figure 7 (FIGURES ARE COURTESY OF THE AUTHORS)

Figure 8 (FIGURES ARE COURTESY OF THE AUTHORS)

As a result of WPP process qualification, the study demonstrated that changes made to the installation and its operation ensure better performance as well as a water product obtained with water for injection quality according to USP and highly purified water quality according to EP.

Conclusion

Applying a risk analysis approach on a WPP process disclosed installation design and operational insufficiencies. A model obtained from the fault tree analysis method became a useful qualitative tool, revealing cause-and-effect complex interrelations between various fault events likely to arise. A model obtained from the failure modes and effects analysis method consolidated information from fault tree analysis and facilitated the establishment of priorities quantitatively on actions to be taken to correct or mitigate those failure modes according to their criticality. Such actions were directed to keep good care of reverse osmosis membranes and a safer reverse osmosis purification process.

Performance qualification carried out during 15 days demonstrated that, after prescribed modifications on the installation and its operation were made, functioning was improved from a chemical and microbiological point of view throughout the process stages, thereby ensuring a water product of pharmaceutical quality. However, risk-threat levels to which the system is subjected do not make it fully reliable. Therefore, the authors recommend that the continued use of water product obtained from this process be limited to washing operations and other technological applications as required. Its direct use in parenteral formulation shall be analyzed cautiously and only in a force majeure case.

Arturo Toledo Rivero, PhD,* is a chemical engineer and head of the R&D department at Liorad Laboratories, Ave. 27A No. 26402, La Lisa, Havana, Cuba, tel. +537 2717935, fax +537 2717899, atliorad@infomed.sld.cu
Nelson Sierra Prado is a microbiologist and head of the validation group, QA department; Anamarys González Alvarez is a chemical engineer and pharmaceutical specialist at the R&D department; and Danelys Cardoza Lobaina is a chemical engineer and quality engineering specialist in the QA department, all at Liorad Laboratories.

*To whom all correspondence should be addressed.

Submitted: Aug. 8, 2007 Accepted: Aug. 20, 2007

References

1. US Pharmacopoeia, Spanish Edition (US Pharmacopeial Convention, Rockville, MD, 2007), pp. 1428–1432.

2. European Pharmacopoeia 5.0 ed. (European Pharmacopoeia, 2005), pp. 2692–2698.

3. ISPE Baseline, Pharmaceutical Engineering Guides for New and Renovated Facilities, vol. 4 (Jan. 2001).

4. US Pharmacopeia, Spanish Edition (US Pharmacopeial Convention, Rockville, MD, 2007), pp. 763–764.

5. B. Dodson and D. Nolan, Reliability Engineering Handbook (1998).

6. US Food and Drug Administration, Pharmaceutical CGMPs for the Twenty-First Century, a Risk-Based Approach (Sept. 2004).

7. ICH Harmonized Tripartite Guideline, Q9: Quality Risk Management (Nov. 9, 2005).

8. R.L. Browning, "Industrial Risk Analysis," Chem. Eng. 109–114, (Oct. 20, 1969).

9. R.L. Browning, "Loss Analysis for Improving Protective Instrumentation Process," Instrument. Technol. 14 (10), 84–90 (1972).

10. P.A. Crossete, "Fault Tree Analysis for System Reliability," Instrument. Technol. 13 (8), 52–56 (1971)

11. "Análisis de Riesgo [Risk Analysis]" www.unizar.es/guiar/1/Accident/Rd1254/An_riesgo.htm#Identifica, accessed Oct. 15, 2007.

12. NASA Lewis Research Center, "Fault Tree Analysis (FTA)," available at http://www.hq.nasa.gov/office/codeq/software/ComplexElectronics/techniques/fault-tree.htm, accessed Oct. 15, 2007.

13. NASA Lewis Research Center, "Failure Mode and Effect Analysis," available at http://www.hq.nasa.gov/office/codeq/software/ComplexElectronics/techniques/fmea.htm, accessed Oct. 15, 2007.

14. W. Monroe Keyserling, "Failure Modes and Effects Analysis (FMEA)," IOE 539 Notes, Industrial and Operations Engineering, University of Michigan, Jul. 21, 2000.

15. Kaiser Permanente, "Failure Modes and Effects Analysis (FMEA)," Team Instruction Guide, Mar. 2002.

16. Diputación Foral de Bizkaia, "AMFE: Análisis Modal de Fallos y Efectos," Librería HOR DAGO, Nov. 7, 2004.

17. Water System Revalidation Protocol, Liorad Laboratories, code P.R.S.06.06, Dec. 2006.

18. Water System Performance Qualification (PQ) Report, Liorad Laboratories, code I.P.R.S.06.06, Mar. 2007.