From URS to Acceptance Evidence: Defining and Testing Interfaces in Pen Injector Assembly

In pen injector assembly, detecting an abnormal condition is only the first part of a quality decision. The result must remain associated with the correct physical assembly, trigger the specified action, and produce retrievable evidence, even during interruptions. This technical article presents a requirements-to-evidence method for interface acceptance testing. It uses an illustrative cartridge final-assembly sequence to examine identity management, state transitions, reject confirmation, communication failures, and restart controls. A challenge matrix and evidence checklist distinguish component testing from verification of the complete decision chain. The examples are proposed test designs, not reported production results.

The Interface Is the Test Object

Pen injector preassembly builds an empty mechanism from its components. Cartridge-based final assembly subsequently integrates a filled cartridge with that mechanism. Orientation and dimensional verification are important upstream; force–displacement monitoring and seating checks are relevant to downstream joining operations.¹^,² Their inspection outputs become inputs to another function: deciding what happens to the assembly.

A station may correctly identify an unacceptable result while the line associates it with the wrong nest, loses the decision during a stop, or records a reject command without verifying removal. Demonstrating sensor performance does not, by itself, demonstrate this decision chain.

Likewise, nominal throughput does not describe behavior during result delays, buffer accumulation, or recovery. Capacity analysis provides the operating context in which interface tests should be selected.³ Testing only slow, isolated station movements may miss conditions present during the intended production sequence.

EU GMP Annex 15 identifies the user requirements specification (URS) as a reference throughout the validation lifecycle.⁴ Earlier discussion of integrated assembly examined how separately supplied systems affect project readiness.⁵ Here, the focus is narrower: converting a defined interface into a requirement, a deliberate challenge, an observable response, and retained acceptance evidence.

Write Requirements That Can Fail a Test

“The machine shall provide automatic rejection” describes a capability, but leaves its acceptance ambiguous. A testable requirement defines the triggering condition, affected assembly, required state, physical response, and evidence.

An illustrative requirement is:

When a completed press-fit result is outside the approved acceptance window, the associated assembly shall be assigned reject status. The line shall verify its removal before that assembly can enter the conforming-output path. If identity or removal cannot be established, the affected material shall remain controlled under the approved exception procedure.

The functional specification must resolve how that behavior is implemented. It should define the result deadline, transport position, verification method, and handling of an unanswered reject confirmation. The protocol then tests those defined limits rather than choosing convenient limits during execution.

Keep the measurement claim separate. Establishing that a curve is associated with the correct unit does not establish that the curve detects every relevant physical defect. Measurement suitability, acceptance-window development, and finished-device performance require their own evidence.¹ This separation prevents a tracking test from being presented as a product-performance test.

Define Identity Beyond the Reusable Pallet

A reusable pallet identifies a carrier, not permanently the product it carries. If the same pallet returns with another assembly, the data system must distinguish successive occupancy events.

One possible design combines batch identifier, pallet or nest identifier, and load-cycle identifier. Other architectures are acceptable if they establish the required association. Neither this proposed key nor individual product serialization is a universal regulatory requirement; the appropriate traceability granularity follows the process and quality-system assessment.

The test should challenge the relationship, not merely confirm that an identifier appears on the human-machine interface (HMI). Run an identified challenge assembly followed by a conforming assembly on the same carrier. Verify that the earlier result cannot populate the later record. For multiple nests, challenge adjacent positions to expose one-position offsets or incorrect indexing.

Controlled manual removal deserves a separate test. If an operator empties a nest, the tracking system must not silently attach the removed assembly’s data to the next occupant. Test the authorized removal workflow, required acknowledgment, and subsequent loading sequence. Record which physical test piece occupied each location independently of the control system being tested.

Specify Permitted State Transitions

An inspection result and a physical disposition are different states. Useful distinctions include: awaiting result, accepted at the tested operation, reject pending, reject removal confirmed, and unresolved status. “Accepted” here means the relevant operation met its criteria, not that the finished medicinal product has been released.

The critical question is which transitions the design permits. An alarm reset should not automatically convert unresolved material to accepted material. A reject command should not equal reject confirmation. A completed result should remain distinguishable from an operation interrupted before completion.

The following example assumes an indexed final-assembly transport. After pressing, the system evaluates the curve and schedules a rejected assembly for removal at a downstream station. A controlled stop occurs after classification but before removal. On restart, the line must either recover a verified mapping or apply its approved material-clearance procedure. If position, joining completion, or handling integrity is uncertain, retained electronic status alone cannot justify continuation.

This does not prescribe recovery of every interrupted assembly. A process may require clearing all affected work in progress. Where selective recovery is permitted, its justification must address physical condition as well as data continuity. The challenge test verifies the approved strategy; it does not invent a more permissive strategy to reduce scrap.

Challenge Transitions, Not Only Defective Parts

Known nonconforming components can challenge orientation or dimensional detection.² Interface testing adds faults that may occur even when the assembly itself is geometrically acceptable: missing results, delayed messages, failed removal confirmation, and interrupted sequences. Table 1 links illustrative requirements to challenge conditions, observations, and retained evidence.

These are protocol concepts, not completed tests. Fault injection must be authorized, safe, and reversible. A software-injected result tests result handling; it does not demonstrate that the physical sensor detects a defect. Record that limitation explicitly.

Challenge selection should address the actual sequence: a pending result, a completed decision awaiting removal, and a removal awaiting confirmation expose different failure opportunities. Include conforming control assemblies around challenged assemblies so that a shifted reject action is visible. Recover every test piece and reconcile its observed disposition with the recorded decision.

There is no universal number of repetitions. Justify coverage using risk, transport positions, operating range, and implementation complexity. All predefined challenge outcomes must meet the criteria; a finite successful test set does not establish a zero-defect production rate.

Test the Acknowledgment Gap

Communication testing should include more than unplugging a cable before transmission. A particularly useful challenge occurs when the destination receives a record but the sender does not receive its acknowledgment. Retrying that transfer can create duplicates unless the receiving system recognizes the same event.

One implementation uses a persistent event identifier and duplicate-aware processing. Another may use a validated queue-and-reconciliation mechanism. The acceptance criterion is the intended outcome: retained records preserve their identity, value, and meaning, without silent loss or an additional disposition action caused by retransmission.

Distinguish acknowledgment of receipt from confirmation of physical action. A controller’s receipt of a reject message does not demonstrate that the assembly entered the reject container. Conversely, loss of a reporting-system connection may require a different response from loss of the control signal responsible for rejection.

Where local buffering is permitted, define its capacity, alarm threshold, production response, and recovery rules. Challenge the relevant boundary and reconcile records after reconnection. Do not assume that unlimited production during an outage is acceptable.

The FDA’s Part 11 guidance ties applicability to required records and how electronic records are relied upon, rather than the presence of automation alone.⁶ EU GMP Annex 11 addresses test scenarios, error handling, electronic data exchange, and backup restoration.⁷ Operational retry testing should therefore not be confused with demonstrating archive retrieval or backup restoration; each has a different failure mechanism.

Make Evidence Independent Enough To Investigate

A screenshot of a green dashboard is insufficient if the same tracking error could affect both the decision and its display. Evidence should connect physical observations with retained system records.

For the stopped-reject scenario, retain the approved requirement and test revision, software/configuration baseline, inspection-recipe version, test-piece loading map, interruption point, expected response, observed response, and record identifiers. Capture reject confirmation separately from the reject command. Timestamp relationships may help reconstruct the sequence, but timestamps alone should not be treated as unique product identities. Table 2 summarizes the information needed to interpret an interface test record.

If a challenge fails, preserve the original outcome. A software correction and successful retest do not erase the deviation. Assess whether the change affects other tracking paths, timing assumptions, or earlier evidence, then select justified regression tests. Traceability links explain that decision; a completed checklist alone does not.

Allocate Evidence Between Factory and Site

Factory acceptance testing (FAT) can establish defined tracking, rejection, restart, and simulated communication behavior on the supplied configuration. Its report should identify which receiving systems, utilities, materials, and interfaces were real and which were simulated.

Site acceptance testing (SAT) addresses dependencies that were unavailable or changed: installed transport alignment, actual network settings, receiving-system mappings, user roles, and site recovery procedures. A successful simulated acknowledgment at FAT does not establish correct processing by the customer’s actual system.

Annex 15 permits justified use of certain FAT evidence without repetition at installation/operational qualification when functionality is unaffected by transport and installation.⁴ This is an evidence assessment, not a blanket exemption. Record why each result remains applicable and identify outstanding site tests. Acceptance testing also does not replace product verification, process validation, or the manufacturer’s batch-release decisions.

Conclusion

Interface acceptance is demonstrated when a requirement can be followed through a controlled challenge to the correct physical disposition and retrievable records. For pen injector assembly, the meaningful test object is not only the sensor or controller. It is the association between the assembly, its process result, the required action, and the evidence that survives interruption.

References

1. Xu J. Engineering high-speed pen injector final assembly machine: solving the cartridge press-fit challenge. Pharmaceutical Technology. 2026. View source

2. Xu J. Engineering high-speed pen injector pre-assembly machine: overcoming dimensional variability in multi-component mechanism integration. Pharmaceutical Technology. 2026. View source

3. Xu J. Overcoming fill-finish capacity bottlenecks in automated pen injector assembly lines. Pharmaceutical Technology. 2026. View source

4. European Commission. EU GMP Annex 15: qualification and validation. EudraLex Volume 4. 2015. View source

5. Xu J. From fragmented procurement to integrated assembly: how the injectable device industry is rethinking equipment strategy. ONdrugDelivery. 2026;191:136-139. View source

6. US Food and Drug Administration. Part 11, Electronic Records; Electronic Signatures: Scope and Application. FDA Guidance for Industry. 2003. View source

7. European Commission. EU GMP Annex 11: computerised systems. EudraLex Volume 4. 2011. View source