See what Pharma4i produces

USER REQUIREMENTS SPECIFICATION

Water for Injection Storage and Distribution System

URS-WFI-001 · REVISION 0.1

Document status	Draft
System name	[Enter system name]
Equipment type	Pharmaceutical Water — WFI Storage and Distribution
Site	[Enter site]
GxP impact	Direct impact
Prepared by	[Enter author]
Date	[DD-MMM-YYYY]

This document was drafted with software assistance. It is a draft and has no validity until reviewed and approved by qualified personnel in accordance with the site quality system. All bracketed values must be supplied and all Section 6 assumptions confirmed before this document is issued. Pharma4i does not perform or record document approval; responsibility for review, approval, signature and document control rests with the approving persons named in Section 8.

HOW TO USE THIS TEMPLATE

Values shown as [TO BE CONFIRMED] are deliberate. They are parameters that must be supplied by the user department; the template does not assume them because an assumed capacity, sanitisation temperature or hold time is a specification error that reaches a supplier as though it were a decision.

Section 6 lists the configuration assumptions carried while drafting. Each must be confirmed or corrected before the document is issued. Appendix A defines the worst-case conditions that govern design verification and qualification; every one of them should be challenged during qualification, not only the convenient ones.

Table of Contents

1. Purpose and Scope

1.1 Purpose

This User Requirements Specification defines the requirements of the user for a Water for Injection storage and distribution system to be installed at [site]. It states what the user requires; it does not state how those requirements are to be achieved, which is the responsibility of the supplier and is assessed during Design Qualification.

1.2 Scope of the system

• The WFI storage tank, including its vent filter, spray ball, level instrumentation and relief devices.

• The distribution loop, including supply and return pipework, distribution pumps, heat exchanger and all valves.

• All points of use listed in the point-of-use schedule, including point-of-use coolers and sample valves.

• The thermal sanitisation function and its control.

• Online monitoring instrumentation for temperature, flow, pressure, level, conductivity and total organic carbon.

• The control system, operator interface, and the GMP records it generates.

1.3 Out of scope

• The WFI generation system upstream of the storage tank, which is the subject of a separate specification.

• Pretreatment and feed water systems.

• Point-of-use hoses, connectors and their management.

• Site utilities upstream of the connection points defined in the utility schedule.

• Building services, room HVAC and environmental monitoring.

• Laboratory testing methods and the sampling programme itself, which are defined in site procedures.

2. System Overview

2.1 System description

The system stores Water for Injection produced by the existing generation system and distributes it under continuous hot circulation to the points of use listed in the point-of-use schedule. Water is held and circulated at not less than 80 °C to maintain microbial control, with point-of-use coolers provided where a lower temperature is required at the outlet.

The distribution loop is a single circulating loop returning to the storage tank. Loop temperature is maintained by a heat exchanger of double tube sheet construction. Duty and standby distribution pumps provide continuous circulation with automatic changeover on failure.

2.2 Process context

WFI from this system is used in [state the uses: final rinse of product contact equipment, formulation, injection preparation, and similar]. Water quality therefore has a direct impact on product quality and on patient safety, and the system is classified as direct impact.

2.3 Interfaces to other systems

• WFI generation system — demand signal, generation status, out-of-specification diversion status.

• Building management system — alarm annunciation only, with no control authority over the WFI system.

• Points of use — mechanical and, where applicable, control interfaces to formulation, washing and filling equipment.

• Laboratory information management system — export of online monitoring data for correlation with laboratory results.

2.4 GxP impact assessment

The system is classified as GxP, direct impact. WFI is in direct contact with product or with product contact surfaces; its quality attributes are product quality attributes; and the system generates GMP records used in the assessment of batch quality. All requirements in this specification are therefore subject to qualification, and the control system is subject to EU GMP Annex 11 and, where applicable, 21 CFR Part 11.

3. Definitions and Abbreviations

Term	Definition
ALCOA+	Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, Available
ASME BPE	American Society of Mechanical Engineers Bioprocessing Equipment standard
CFU	Colony Forming Unit
DQ	Design Qualification
EU	Endotoxin Unit
FAT	Factory Acceptance Test
GAMP	Good Automated Manufacturing Practice
GMP	Good Manufacturing Practice
IQ	Installation Qualification
OQ	Operational Qualification
P&ID	Piping and Instrumentation Diagram
POU	Point of Use
PQ	Performance Qualification
Ra	Roughness average, surface finish
SAT	Site Acceptance Test
TOC	Total Organic Carbon
URS	User Requirements Specification
WFI	Water for Injection

4. Referenced Documents

• EU GMP Annex 1 — Manufacture of Sterile Medicinal Products (2022 revision), where WFI is used in aseptic processing.

• EU GMP Annex 11 — Computerised Systems.

• EU GMP Annex 15 — Qualification and Validation.

• 21 CFR Parts 210, 211 and 11, where the site supplies the United States market.

• USP General Chapter <1231> — Water for Pharmaceutical Purposes; USP <643> Total Organic Carbon; USP <645> Water Conductivity.

• USP and Ph. Eur. monographs for Water for Injection.

• ASME BPE — Bioprocessing Equipment.

• GAMP 5 — A Risk-Based Approach to Compliant GxP Computerised Systems.

• [Site validation master plan, site engineering standards, point-of-use schedule, utility schedule.]

5. Requirements

Each requirement carries a unique identifier, a category, a priority and the qualification stage at which it is verified. Requirements are written to be verifiable. Where a requirement is governed by a worst-case condition, that condition is named and cross-referenced to Appendix A.

ID	Category	Requirement	Priority / Verification
URS-001	Operational	The system shall store and distribute Water for Injection meeting the requirements of the current USP and Ph. Eur. monographs for Water for Injection.	Mandatory PQ
URS-002	Operational	The system shall deliver a peak instantaneous demand of [TO BE CONFIRMED] L/min and an average daily consumption of [TO BE CONFIRMED] L/day. Worst case: Peak demand with all high-draw points open simultaneously, as defined in Appendix A, WC-01.	Mandatory PQ
URS-003	Operational	The system shall operate continuously, 24 hours per day, 7 days per week, with planned shutdown limited to [TO BE CONFIRMED] hours per year.	Mandatory PQ
URS-004	Operational	The storage tank shall have a nominal capacity of [TO BE CONFIRMED] L, sized to buffer peak demand without the generation system falling below its minimum turndown. Worst case: Minimum tank level coincident with peak draw, WC-05.	Mandatory DQ
URS-005	Operational	The distribution loop shall serve [TO BE CONFIRMED] points of use, listed with their location, required flow and required temperature in the point-of-use schedule.	Mandatory DQ
URS-006	Operational	The system shall recover to full specification within [TO BE CONFIRMED] hours following a planned shutdown, without requiring drain and refill.	Desirable PQ
URS-007	Functional	WFI shall be stored and distributed under continuous hot circulation at a temperature not less than 80 °C at every point in the loop, measured at the least favourable location. Worst case: Coldest point in the loop, normally the return leg at maximum draw, WC-02.	Mandatory OQ / PQ
URS-008	Functional	The distribution loop shall maintain a return flow velocity of not less than 1.0 m/s, or a demonstrated turbulent flow with Reynolds number greater than 10,000, at all operating conditions. Worst case: Minimum return velocity at maximum simultaneous draw, WC-01.	Mandatory OQ
URS-009	Functional	The system shall be fitted with duty and standby distribution pumps with automatic changeover on failure, and an automatic duty rotation to prevent stagnation in the standby pump. Worst case: Standby pump branch is a low-flow zone; see WC-07.	Mandatory OQ
URS-010	Functional	Loop temperature shall be maintained by a heat exchanger of double tube sheet construction with a monitored and drainable interspace, providing leak detection between the WFI and the heating medium.	Mandatory IQ / OQ
URS-011	Functional	The storage tank shall be fitted with a spray ball providing demonstrated full wetted coverage of the internal surface, including the headspace, at the specified supply pressure and flow. Worst case: Tank at minimum operating level with the highest headspace to wet, WC-05.	Mandatory OQ
URS-012	Functional	The storage tank shall be fitted with a hydrophobic vent filter of 0.22 micrometre rating, electrically heated to prevent condensate blinding, and capable of in-place integrity testing without breaking the sterile boundary. Worst case: Maximum tank discharge rate creating maximum air ingress through the vent filter, WC-06.	Mandatory IQ / OQ
URS-013	Functional	Points of use requiring water below loop temperature shall be served by dedicated point-of-use coolers arranged so that the cooled volume is returned to loop temperature, or drained, when the point of use is not drawing. Worst case: Point-of-use cooler branch is the highest microbial risk location in the system, WC-04.	Mandatory OQ
URS-014	Functional	The system shall provide a thermal sanitisation cycle capable of raising every point in the loop, including every point-of-use branch and cooler, to not less than [TO BE CONFIRMED] °C for not less than [TO BE CONFIRMED] minutes. Worst case: Coldest point during sanitisation, normally the most hydraulically remote point-of-use branch, WC-03. Sanitisation temperature and hold time drive the sterility assurance of the system and shall be specified by the user; they are not assumed.	Mandatory OQ
URS-015	Functional	Tank level shall be controlled automatically, with high, high-high, low and low-low alarms, and with pump protection preventing operation below the minimum level.	Mandatory OQ
URS-016	Functional	The system shall deliver a minimum dynamic pressure of [TO BE CONFIRMED] bar g at the most hydraulically remote point of use under peak demand. Worst case: Most remote point of use at peak simultaneous draw, WC-01 and WC-08.	Mandatory PQ
URS-017	Data / records	The control system shall continuously record loop supply temperature, loop return temperature, tank level, loop flow, loop pressure, online conductivity and online TOC, at an interval not exceeding one minute.	Mandatory OQ
URS-018	Data / records	The system shall record every sanitisation cycle, capturing the temperature profile at each monitored location, the hold period achieved, the operator who initiated the cycle, and the cycle outcome.	Mandatory OQ
URS-019	Data / records	All alarms shall be recorded with the alarm condition, time of onset, time of acknowledgement, the acknowledging operator and time of clearance.	Mandatory OQ
URS-020	Data / records	Records shall be retained for not less than [TO BE CONFIRMED] years and shall be exportable in a human-readable format that retains the associated audit trail and metadata.	Mandatory OQ
URS-021	Data integrity	Records shall be attributable, legible, contemporaneous, original and accurate, and shall remain complete, consistent, enduring and available throughout the retention period. ALCOA+; EU GMP Annex 11, MHRA and FDA data integrity guidance.	Mandatory OQ
URS-022	Data integrity	The system clock shall synchronise with the site time server. Users shall not be able to alter system time, and any time synchronisation change shall be recorded. Annex 11 clause 9.	Mandatory OQ
URS-023	Data integrity	The system shall support automated backup of all GMP records, and restoration of those records shall be demonstrated during qualification. Annex 11 clause 7.2.	Mandatory OQ
URS-024	Data integrity	No function shall permit deletion or overwriting of a recorded value. Corrections shall be made by a new entry that preserves the original.	Mandatory OQ
URS-025	Security and access	The control system shall provide role-based access control with individual named user accounts. Shared or generic accounts shall not be permitted. Annex 11 clause 12; 21 CFR 11.10(d).	Mandatory OQ
URS-026	Security and access	The system shall provide at least the roles Operator, Supervisor, Engineer and Administrator, with the permissions of each defined in the functional specification and configurable only by an Administrator.	Mandatory OQ
URS-027	Security and access	Critical setpoints, including sanitisation temperature and hold time, alarm limits and calibration parameters, shall be modifiable only by authorised roles and every change shall be recorded.	Mandatory OQ
URS-028	Security and access	The system shall enforce automatic session timeout after a configurable period of inactivity, and shall require re-authentication to resume.	Mandatory OQ
URS-029	Audit trail	The system shall maintain a secure, computer-generated, time-stamped audit trail recording the operator identity, date, time, previous value and new value for every GMP-relevant change. Annex 11 clause 9; 21 CFR 11.10(e).	Mandatory OQ
URS-030	Audit trail	The audit trail shall not be editable or disableable by any user, including administrators, and shall be reviewable within the application without recourse to the database.	Mandatory OQ
URS-031	Audit trail	The system shall support periodic audit trail review, with a filterable view and an exportable report of changes over a selected period.	Mandatory OQ
URS-032	Interfaces	The system shall interface with the upstream WFI generation system, exchanging demand signal, generation status and out-of-specification diversion status.	Mandatory SAT
URS-033	Interfaces	The system shall provide monitored signals to the site building management system for alarm annunciation, without permitting control of the WFI system from that system.	Mandatory SAT
URS-034	Interfaces	The system shall provide the physical and electrical interface at each point of use defined in the point-of-use schedule, including any interface to filling or formulation equipment.	Mandatory SAT
URS-035	Interfaces	Where sample results are managed in a laboratory information management system, the system shall support export of online monitoring data in a defined format for correlation with laboratory results.	Desirable OQ
URS-036	Environmental	The system shall operate within the site utility envelope: electrical supply [TO BE CONFIRMED], plant steam or heating medium [TO BE CONFIRMED], cooling medium [TO BE CONFIRMED], and compressed air [TO BE CONFIRMED].	Mandatory IQ
URS-037	Environmental	All drain connections shall discharge through an air break to prevent backflow, and shall be visible for inspection.	Mandatory IQ
URS-038	Environmental	All hot surfaces accessible to personnel shall be insulated or guarded such that touchable surface temperature does not exceed 60 °C.	Mandatory IQ / SAT
URS-039	Environmental	Pipework shall be installed with a continuous fall of not less than 1 in 100 towards designated drain points, so that the entire distribution system is fully drainable. Worst case: The highest point and the longest horizontal run are the critical locations for drainability, WC-09.	Mandatory IQ
URS-040	Environmental	Loop pipework routed through classified areas shall be finished and supported so as not to compromise the cleanability of the room, and shall be installed clear of walls and ceilings for inspection.	Mandatory IQ
URS-041	Materials	All product contact surfaces shall be stainless steel 316L, with a mechanically polished and electropolished internal surface finish of Ra not greater than 0.4 micrometres.	Mandatory IQ
URS-042	Materials	All product contact welds shall be automatic orbital welds. A weld log shall be maintained, and not less than [TO BE CONFIRMED] percent of welds shall be boroscopically inspected and documented.	Mandatory IQ
URS-043	Materials	The system shall be passivated after installation in accordance with a documented procedure, and a passivation certificate shall be provided.	Mandatory IQ
URS-044	Materials	Material certificates in accordance with EN 10204 Type 3.1 shall be provided for all product contact materials, traceable to the installed components.	Mandatory IQ
URS-045	Materials	Elastomers and polymers in product contact shall comply with USP Class VI and 21 CFR 177.2600, shall be suitable for continuous service at loop temperature, and shall be listed with their service life.	Mandatory IQ
URS-046	Materials	All valves in product contact shall be sanitary diaphragm valves of zero static or zero dead leg design, installed so that the branch is self-draining.	Mandatory IQ / DQ
URS-047	Materials	No dead leg in the distribution system shall exceed three internal pipe diameters (3D), measured from the internal wall of the main loop to the point of closure of the branch. Worst case: The longest branch in the system defines the worst case for microbial risk, WC-07. ASME BPE. Where site standard permits 6D, that shall be stated and justified; 3D is the design intent.	Mandatory DQ / IQ
URS-048	Cleaning	The complete system, including the tank, loop, all branches and all points of use, shall be fully drainable to a designated low point without dismantling. Worst case: Verified with the system at rest from the highest point, WC-09.	Mandatory IQ / OQ
URS-049	Cleaning	The sanitisation cycle shall be initiated from the operator interface, shall run automatically, and shall not be capable of being declared successful where any monitored location failed to achieve the required temperature and hold.	Mandatory OQ
URS-050	Cleaning	Sample valves at each sampling location shall be of sanitary design, self-draining, and shall permit sampling without contaminating the sample or the system.	Mandatory IQ
URS-051	Cleaning	All instruments requiring calibration shall be accessible without dismantling major assemblies and shall be removable without breaching the loop where the system is in operation.	Mandatory DQ / IQ
URS-052	Cleaning	The supplier shall provide a preventive maintenance schedule stating each task, its frequency and estimated duration, and shall guarantee spare parts availability for not less than ten years.	Mandatory DQ
URS-053	Safety	The storage tank shall be protected against overpressure and vacuum by a rupture disc and a pressure and vacuum relief arrangement, with rupture disc failure detected and alarmed.	Mandatory IQ / OQ
URS-054	Safety	An emergency stop shall be provided at the skid and at each remote pump location, placing the system in a defined safe state without creating a hazard from stored thermal energy.	Mandatory SAT
URS-055	Safety	Interlocks shall prevent operation of distribution pumps against a closed system and shall prevent sanitisation while any point of use is open to an operator-accessible outlet.	Mandatory OQ
URS-056	Safety	Sanitisation shall not be capable of being started without a positive confirmation step, and every point of use shall be visibly indicated as locked out for the duration of the cycle.	Mandatory OQ
URS-057	Safety	Noise emitted by the system shall not exceed 80 dB(A) measured at one metre under normal operation.	Desirable SAT
URS-058	Documentation	The supplier shall provide, prior to Factory Acceptance Testing: general arrangement drawings, piping and instrumentation diagrams, isometric drawings, electrical schematics, control system documentation, a functional design specification and a design qualification package.	Mandatory DQ
URS-059	Documentation	The supplier shall provide FAT and SAT protocols for user review and approval not less than four weeks before the respective test.	Mandatory DQ
URS-060	Documentation	The supplier shall provide IQ and OQ protocols and supporting documentation aligned with EU GMP Annex 15, together with a full turnover package including weld logs, boroscopy records, material certificates, slope verification records and passivation certificates.	Mandatory IQ
URS-061	Documentation	The supplier shall provide operation and maintenance manuals, a spare parts list with part numbers, and a documented change notification procedure for any modification affecting form, fit, function or materials.	Mandatory IQ
URS-062	Documentation	The supplier shall provide training for operators, maintenance personnel, and quality and validation personnel, covering operation, sanitisation, sampling, fault recovery, audit trail review and user administration.	Mandatory SAT
URS-063	Regulatory	The system shall comply with the current USP and Ph. Eur. monographs for Water for Injection and with USP General Chapter 1231.	Mandatory PQ
URS-064	Regulatory	WFI delivered at every point of use shall meet: conductivity in accordance with USP General Chapter 645; total organic carbon not greater than 500 ppb; bacterial endotoxins not greater than 0.25 EU/mL; and total aerobic microbial count not greater than 10 CFU per 100 mL. Worst case: Sampled at the worst-case points defined in Appendix A during each PQ phase.	Mandatory PQ
URS-065	Regulatory	The system shall be designed, installed and qualified in accordance with EU GMP Annex 15 and the site validation master plan.	Mandatory DQ
URS-066	Regulatory	The control system shall comply with EU GMP Annex 11 and, where applicable to the site, 21 CFR Part 11.	Mandatory OQ
URS-067	Regulatory	The system shall be designed and documented in accordance with GAMP 5, and the supplier shall state the GAMP software category of the control system.	Mandatory DQ
URS-068	Regulatory	Equipment design shall follow ASME BPE for hygienic design, surface finish, fabrication and examination of product contact components.	Mandatory DQ / IQ
URS-069	Qualification	The system shall support a three-phase Performance Qualification: Phase 1 with daily sampling of every point of use, Phase 2 confirming the sanitisation regime, and Phase 3 over one year confirming seasonal and feed water variation.	Mandatory PQ
URS-070	Qualification	Sample points shall be provided at the tank outlet, the loop supply, the loop return, each sub-loop return and each point of use, and shall be individually identified and shown on the P&ID.	Mandatory IQ
URS-071	Qualification	Temperature mapping ports shall be provided at each worst-case location listed in Appendix A, sufficient to demonstrate that sanitisation acceptance is met at the least favourable point. Worst case: Mapping shall include every location in Appendix A; a cycle demonstrated only at favourable points is not acceptable.	Mandatory IQ / OQ
URS-072	Qualification	The supplier shall provide hydraulic calculations demonstrating that the minimum return velocity and minimum point-of-use pressure are met under the worst-case demand condition defined in Appendix A.	Mandatory DQ
URS-073	Qualification	Every requirement in this specification shall be traceable through design qualification, factory and site acceptance testing, and installation, operational and performance qualification, as recorded in the traceability matrix.	Mandatory DQ
URS-074	Qualification	The system shall permit challenge of the worst-case conditions listed in Appendix A during qualification without modification to the installed system.	Mandatory OQ

6. Assumptions

The following configuration assumptions were carried while authoring this specification. Each shall be confirmed or corrected by the responsible person before this document is issued. An assumption that reaches a supplier unconfirmed becomes a requirement nobody decided.

Ref	Assumption
A-01	Loop configuration is a single hot circulating loop at 80 °C with point-of-use coolers where lower temperatures are required. To be confirmed against the point-of-use schedule.
A-02	Sanitisation is by hot water at loop temperature, using the circulating loop itself. Pure steam sanitisation is not assumed and would change the pressure rating and drainage design.
A-03	The storage tank is vertical, dished-end, jacketed and mounted at grade. Tank geometry affects spray ball selection and headspace behaviour.
A-04	A single loop serves all points of use. If sub-loops are required, each sub-loop return becomes an additional worst-case location.
A-05	Feed to the tank is from an existing WFI generation system whose capacity and turndown are known and adequate.
A-06	The heating and cooling media are available at the site utility envelope stated in URS-036, at the pressures and temperatures given in the utility schedule.
A-07	Ambient conditions in the areas served do not require trace heating beyond insulation.
A-08	Point-of-use hoses and connections are outside the scope of this specification and are covered by the site hose management procedure.

Confirmation

Statement	Confirmed by	Date
All assumptions above, and all bracketed values in Section 5, have been reviewed and confirmed or corrected.

7. Acceptance and Traceability

7.1 Verification method per requirement

Each requirement in Section 5 carries its verification stage. Design Qualification verifies that the proposed design satisfies the requirement. Factory and Site Acceptance Testing verify construction and installed function. Installation Qualification verifies materials, finishes, slopes, welds and documentation. Operational Qualification verifies function across the operating range, including the sanitisation cycle. Performance Qualification verifies sustained water quality over the three-phase programme.

7.2 Traceability approach

A traceability matrix shall be maintained listing every URS identifier against the design document that satisfies it and the test document that verifies it. No requirement shall be closed without a documented verification result, and no test shall be performed that does not trace to a requirement.

7.3 Worst-case conditions

Qualification shall challenge the system at its least favourable conditions, not at its most convenient. Appendix A defines the worst-case conditions for this system, the reason each is a worst case, the requirements it governs and the qualification stage at which it is challenged.

A sanitisation cycle demonstrated only at the loop supply header, a velocity calculation performed only at average demand, or a PQ sampling plan that omits the point-of-use coolers, will not demonstrate control of this system. Each condition in Appendix A shall be either challenged or formally justified as not applicable.

8. Approvals

This document is prepared for review and approval in accordance with the site quality system. Signature below indicates that the signatory has reviewed this specification and accepts it as a true statement of the user requirement.

This document has no validity until reviewed and approved by qualified personnel under the site quality system, and shall not be issued for quotation or used as the basis for Design Qualification until all bracketed values are supplied and all Section 6 assumptions are confirmed.

Role	Name	Department	Signature	Date
Author		Engineering
Reviewer		Operations / Production
Reviewer		MSAT
Reviewer		CQV / Validation
Reviewer		EHS
Reviewer		Automation / IT
Reviewer		Contamination Control
Quality approval		Quality Assurance

9. Revision History

Revision	Date	Description of change	Author
0.1	[DD-MMM-YYYY]	First draft.

Appendix A — Worst-Case Conditions Register

These are the conditions under which the system is least able to meet its requirements. Design verification and qualification shall address each one. A condition assessed as not applicable shall be recorded as such with a justification, not omitted.

Ref	Condition	Why it is the worst case	Requirements governed	Challenged at
WC-01	Maximum simultaneous demand	All high-draw points of use open together. Produces the lowest loop return velocity, the lowest return temperature and the lowest pressure at the remote point of use — three critical parameters degrade at once.	URS-002, URS-008, URS-016, URS-072	OQ / PQ
WC-02	Lowest temperature point during normal circulation	Normally the loop return leg during peak draw, or an uninsulated section. Microbial control depends on every point staying above 80 °C, so the coldest point governs.	URS-007, URS-017	OQ
WC-03	Least favourable point during sanitisation	Normally the most hydraulically remote point-of-use branch or a cooler bypass. Sanitisation acceptance must be demonstrated here, not at the supply header.	URS-014, URS-071	OQ
WC-04	Point-of-use cooler branch	Water is held below loop temperature in a small volume with intermittent flow. This is the highest microbial risk location in a hot loop and the usual source of excursions.	URS-013, URS-064	PQ
WC-05	Tank at minimum operating level	Worst case for spray ball coverage of the headspace, for pump suction conditions, and for the ratio of headspace to stored volume during sanitisation.	URS-004, URS-011, URS-015	OQ
WC-06	Maximum tank discharge rate	Maximum air ingress through the vent filter. Governs vent filter sizing, heater duty and the risk of condensate blinding.	URS-012	OQ
WC-07	Longest branch and standby pump leg	The greatest dead leg in the system, and any duty/standby arrangement where one leg is intermittently stagnant. Governs the 3D limit and duty rotation.	URS-009, URS-046, URS-047	DQ / IQ
WC-08	Most hydraulically remote point of use	Lowest available pressure and lowest temperature. Defines the hydraulic design case together with WC-01.	URS-016, URS-072	PQ
WC-09	Highest point and longest horizontal run	Worst case for drainability and for retained water after shutdown. Slope and drainability are verified here.	URS-039, URS-048	IQ
WC-10	Extended low-demand period	Weekend or shutdown with minimal draw. Worst case for stagnation, for thermal loss and for the first-draw quality on restart.	URS-003, URS-006	PQ
WC-11	Worst-case feed water quality	Seasonal maximum in feed water TOC, hardness, chloride or microbial load. Challenges the generation system and, through it, the distribution loop.	URS-063, URS-064, URS-069	PQ Phase 3

Note on worst-case selection. The conditions above are derived from the system configuration assumed in Section 6. If the configuration changes — a second sub-loop, ozone rather than thermal sanitisation, an ambient rather than hot loop — this register must be reworked. In particular, an ambient loop makes every branch a microbial worst case rather than only the cooled ones.

Appendix B — Traceability Matrix

To be completed by the validation team as qualification documents are raised.

URS ID	Requirement summary	Design reference	Test reference	Result
URS-001	The system shall store and distribute Water for Injection meeting the requirements of the current…
URS-002	The system shall deliver a peak instantaneous demand of [TO BE CONFIRMED] L/min and an average da…
URS-003	The system shall operate continuously, 24 hours per day, 7 days per week, with planned shutdown l…
URS-004	The storage tank shall have a nominal capacity of [TO BE CONFIRMED] L, sized to buffer peak deman…
URS-005	The distribution loop shall serve [TO BE CONFIRMED] points of use, listed with their location, re…
URS-006	The system shall recover to full specification within [TO BE CONFIRMED] hours following a planned…
URS-007	WFI shall be stored and distributed under continuous hot circulation at a temperature not less th…
URS-008	The distribution loop shall maintain a return flow velocity of not less than 1.0 m/s, or a demons…
URS-009	The system shall be fitted with duty and standby distribution pumps with automatic changeover on …
URS-010	Loop temperature shall be maintained by a heat exchanger of double tube sheet construction with a…
URS-011	The storage tank shall be fitted with a spray ball providing demonstrated full wetted coverage of…
URS-012	The storage tank shall be fitted with a hydrophobic vent filter of 0.22 micrometre rating, electr…
URS-013	Points of use requiring water below loop temperature shall be served by dedicated point-of-use co…
URS-014	The system shall provide a thermal sanitisation cycle capable of raising every point in the loop,…
URS-015	Tank level shall be controlled automatically, with high, high-high, low and low-low alarms, and w…
URS-016	The system shall deliver a minimum dynamic pressure of [TO BE CONFIRMED] bar g at the most hydrau…
URS-017	The control system shall continuously record loop supply temperature, loop return temperature, ta…
URS-018	The system shall record every sanitisation cycle, capturing the temperature profile at each monit…
URS-019	All alarms shall be recorded with the alarm condition, time of onset, time of acknowledgement, th…
URS-020	Records shall be retained for not less than [TO BE CONFIRMED] years and shall be exportable in a …
URS-021	Records shall be attributable, legible, contemporaneous, original and accurate, and shall remain …
URS-022	The system clock shall synchronise with the site time server. Users shall not be able to alter sy…
URS-023	The system shall support automated backup of all GMP records, and restoration of those records sh…
URS-024	No function shall permit deletion or overwriting of a recorded value. Corrections shall be made b…
URS-025	The control system shall provide role-based access control with individual named user accounts. S…
URS-026	The system shall provide at least the roles Operator, Supervisor, Engineer and Administrator, wit…
URS-027	Critical setpoints, including sanitisation temperature and hold time, alarm limits and calibratio…
URS-028	The system shall enforce automatic session timeout after a configurable period of inactivity, and…
URS-029	The system shall maintain a secure, computer-generated, time-stamped audit trail recording the op…
URS-030	The audit trail shall not be editable or disableable by any user, including administrators, and s…
URS-031	The system shall support periodic audit trail review, with a filterable view and an exportable re…
URS-032	The system shall interface with the upstream WFI generation system, exchanging demand signal, gen…
URS-033	The system shall provide monitored signals to the site building management system for alarm annun…
URS-034	The system shall provide the physical and electrical interface at each point of use defined in th…
URS-035	Where sample results are managed in a laboratory information management system, the system shall …
URS-036	The system shall operate within the site utility envelope: electrical supply [TO BE CONFIRMED], p…
URS-037	All drain connections shall discharge through an air break to prevent backflow, and shall be visi…
URS-038	All hot surfaces accessible to personnel shall be insulated or guarded such that touchable surfac…
URS-039	Pipework shall be installed with a continuous fall of not less than 1 in 100 towards designated d…
URS-040	Loop pipework routed through classified areas shall be finished and supported so as not to compro…
URS-041	All product contact surfaces shall be stainless steel 316L, with a mechanically polished and elec…
URS-042	All product contact welds shall be automatic orbital welds. A weld log shall be maintained, and n…
URS-043	The system shall be passivated after installation in accordance with a documented procedure, and …
URS-044	Material certificates in accordance with EN 10204 Type 3.1 shall be provided for all product cont…
URS-045	Elastomers and polymers in product contact shall comply with USP Class VI and 21 CFR 177.2600, sh…
URS-046	All valves in product contact shall be sanitary diaphragm valves of zero static or zero dead leg …
URS-047	No dead leg in the distribution system shall exceed three internal pipe diameters (3D), measured …
URS-048	The complete system, including the tank, loop, all branches and all points of use, shall be fully…
URS-049	The sanitisation cycle shall be initiated from the operator interface, shall run automatically, a…
URS-050	Sample valves at each sampling location shall be of sanitary design, self-draining, and shall per…
URS-051	All instruments requiring calibration shall be accessible without dismantling major assemblies an…
URS-052	The supplier shall provide a preventive maintenance schedule stating each task, its frequency and…
URS-053	The storage tank shall be protected against overpressure and vacuum by a rupture disc and a press…
URS-054	An emergency stop shall be provided at the skid and at each remote pump location, placing the sys…
URS-055	Interlocks shall prevent operation of distribution pumps against a closed system and shall preven…
URS-056	Sanitisation shall not be capable of being started without a positive confirmation step, and ever…
URS-057	Noise emitted by the system shall not exceed 80 dB(A) measured at one metre under normal operation.
URS-058	The supplier shall provide, prior to Factory Acceptance Testing: general arrangement drawings, pi…
URS-059	The supplier shall provide FAT and SAT protocols for user review and approval not less than four …
URS-060	The supplier shall provide IQ and OQ protocols and supporting documentation aligned with EU GMP A…
URS-061	The supplier shall provide operation and maintenance manuals, a spare parts list with part number…
URS-062	The supplier shall provide training for operators, maintenance personnel, and quality and validat…
URS-063	The system shall comply with the current USP and Ph. Eur. monographs for Water for Injection and …
URS-064	WFI delivered at every point of use shall meet: conductivity in accordance with USP General Chapt…
URS-065	The system shall be designed, installed and qualified in accordance with EU GMP Annex 15 and the …
URS-066	The control system shall comply with EU GMP Annex 11 and, where applicable to the site, 21 CFR Pa…
URS-067	The system shall be designed and documented in accordance with GAMP 5, and the supplier shall sta…
URS-068	Equipment design shall follow ASME BPE for hygienic design, surface finish, fabrication and exami…
URS-069	The system shall support a three-phase Performance Qualification: Phase 1 with daily sampling of …
URS-070	Sample points shall be provided at the tank outlet, the loop supply, the loop return, each sub-lo…
URS-071	Temperature mapping ports shall be provided at each worst-case location listed in Appendix A, suf…
URS-072	The supplier shall provide hydraulic calculations demonstrating that the minimum return velocity …
URS-073	Every requirement in this specification shall be traceable through design qualification, factory …
URS-074	The system shall permit challenge of the worst-case conditions listed in Appendix A during qualif…

DESIGN QUALIFICATION

Water for Injection Storage and Distribution System

DQ-WFI-001 · REVISION 0.1

Project reference	PRJ-2026-0009
Equipment reference	EQ-02 — WFI Storage and Distribution System
Document status	Draft
Generated from	URS-WFI-001 Revision 0.1
Supplier	[Supplier name]
Design review date	[DD-MMM-YYYY]
Prepared by	[Enter author]

This document was drafted with software assistance. Verdicts are screening judgements against the supplier documentation listed in Section 3 and must be verified against those source documents by qualified personnel. This document has no validity until reviewed and approved in accordance with the site quality system. Pharma4i does not perform or record document approval; responsibility for review, approval, signature and document control rests with the approving persons named in Section 11.

Related Documents

This document forms part of the qualification package for PRJ-2026-0009 EQ-02. Documents marked Planned have not yet been produced.

Document	Number	Rev	Status	Relationship
User Requirements Specification	URS-WFI-001	0.1	Issued	Source of this document
Design Qualification	DQ-WFI-001	0.1	Draft	This document
Factory Acceptance Test protocol	FAT-WFI-001	—	Planned	Derived from this document
Site Acceptance Test protocol	SAT-WFI-001	—	Planned	Derived from this document
Installation Qualification	IQ-WFI-001	—	Planned	Derived from URS and DQ
Operational Qualification	OQ-WFI-001	—	Planned	Derived from URS and DQ
Performance Qualification	PQ-WFI-001	—	Planned	Derived from URS and DQ
Validation Summary Report	VSR-WFI-001	—	Planned	Derived from all of the above

Table of Contents

1. Introduction

This Design Qualification records the verification that the design proposed by the supplier meets the requirements stated in URS-WFI-001 Revision 0.1 for the Water for Injection storage and distribution system.

Design Qualification does not introduce requirements. Every entry in this document is a verdict against an existing requirement or against a worst-case condition identified in the User Requirements Specification. Where the specification did not fix a value, no verdict is possible and the requirement is listed as not yet defined.

This document is the documented evidence that the design was reviewed against the user requirement before manufacture, as required by EU GMP Annex 15.

2. Scope

2.1 Design documentation reviewed

The verdicts in this document are based solely on the supplier documentation listed in Section 3. No verdict is based on verbal assurance, on drawings not listed, or on assumed standard practice.

2.2 Out of scope

• The WFI generation system, which is equipment item EQ-01 in this project and is the subject of a separate specification and Design Qualification.

• Reject handling, diversion and generation sanitisation, which are addressed in the EQ-01 documentation. See Appendix C.

• Point-of-use hoses and connectors.

• Site utilities upstream of the connection points.

3. Reference Documents

Document	Number	Revision / date
User Requirements Specification	URS-WFI-001	Rev 0.1
Supplier Functional Specification	FS-001	Rev 2
Supplier Design Specification	DS-003	Rev 1
General Arrangement drawing	GA-002	Rev C
Piping and Instrumentation Diagram	P&ID-005	Rev B
Isometric drawings	ISO-011	Rev B
Hydraulic calculation	CALC-004	Rev A
Material test certificate pack	MTC pack	As submitted
Passivation procedure	QP-018	Rev 1
Operation and maintenance manual	MAN-007	Rev 1
Supplier quotation	[Quotation number]	As submitted
EU GMP Annex 15 — Qualification and Validation	—	Current
EU GMP Annex 11 — Computerised Systems	—	Current

4. Methodology

Each requirement in URS-WFI-001 was compared against the supplier documentation listed in Section 3 and assigned one of the following verdicts.

Verdict	Meaning
Met	The documentation demonstrates that the design satisfies the requirement in full.
Partially met	The design satisfies part of the requirement, or satisfies it under conditions narrower than the requirement states.
Not met	The documentation shows a design that conflicts with the requirement.
Not addressed	The documentation is silent on the requirement. Silence is recorded as a finding; it is not interpreted as compliance.
Not yet defined	The User Requirements Specification did not fix the value, so no verification is possible. The finding is against the specification, not the design.

4.1 Review participants

Discipline	Name	Role in review
Engineering
Operations
MSAT
CQV / Validation
EHS
Automation / IT
Contamination Control
Quality Assurance

4.2 Limitations of this review

Verdicts were produced by comparison against the listed documents only. They are screening judgements and require verification against the source documents by qualified personnel before this document is issued. Where a verdict carries low confidence, the underlying evidence was indirect and the reviewer should treat it as unverified.

5. Acceptance Criteria

A requirement is judged met only where the supplier documentation states, in terms that can be checked, that the design achieves what the requirement demands, under the conditions the requirement specifies. A design that satisfies a requirement at nominal conditions but not at the worst-case conditions identified in the specification is judged partially met, not met.

The design is considered suitable for the intended use only where every requirement classified Critical in the specification is met, and every worst-case condition is addressed or has a recorded justification for exclusion.

6. Design Qualification Results

One row per requirement of URS-WFI-001 Revision 0.1, in specification order. No requirement is omitted.

URS ID	Requirement (abridged)	Verdict	Design ref	Evidence and observation
URS-001	The system shall store and distribute Water for Injection meeting the requirements of the current USP and Ph. Eur. monog…	Met	FS-001 §2.1	System specified to produce and distribute WFI to USP and Ph. Eur. monograph requirements.
URS-002	The system shall deliver a peak instantaneous demand of [TO BE CONFIRMED] L/min and an average daily consumption of [TO …	Not yet defined	—	The URS leaves peak demand and daily consumption as [TO BE CONFIRMED]. No design verification is possible. Observation: Peak demand must be fixed in the URS before the hydraulic design can be verified.
URS-003	The system shall operate continuously, 24 hours per day, 7 days per week, with planned shutdown limited to [TO BE CONFIR…	Not yet defined	—	Permitted annual shutdown is [TO BE CONFIRMED] in the URS.
URS-004	The storage tank shall have a nominal capacity of [TO BE CONFIRMED] L, sized to buffer peak demand without the generatio…	Not yet defined	—	Tank capacity is [TO BE CONFIRMED] in the URS. Supplier has offered 5,000 L on the quotation but the requirement is not fixed. Observation: Confirm the required capacity, then re-verify against the offered 5,000 L vessel.
URS-005	The distribution loop shall serve [TO BE CONFIRMED] points of use, listed with their location, required flow and require…	Not yet defined	—	Point-of-use count is [TO BE CONFIRMED] in the URS. The supplier P&ID shows 12.
URS-006	The system shall recover to full specification within [TO BE CONFIRMED] hours following a planned shutdown, without requ…	Not addressed	—	No recovery time following planned shutdown is stated in any supplier document. Observation: Request the supplier state the expected recovery time and the basis for it.
URS-007	WFI shall be stored and distributed under continuous hot circulation at a temperature not less than 80 °C at every point…	Partially met	FS-001 §4.2	Design states loop maintained at 80–85 °C. The measurement location is given as the loop supply header. Observation: The URS requires 80 °C at the least favourable point, not at the supply header. Confirm the coldest point and how it is monitored.
URS-008	The distribution loop shall maintain a return flow velocity of not less than 1.0 m/s, or a demonstrated turbulent flow w…	Partially met	CALC-004 rev A	Hydraulic calculation demonstrates 1.12 m/s return velocity. The calculation is performed at average demand of 40 L/min. Observation: Velocity must be demonstrated at maximum simultaneous demand, not average. See worst-case condition WC-01.
URS-009	The system shall be fitted with duty and standby distribution pumps with automatic changeover on failure, and an automat…	Partially met	FS-001 §5.1, GA-002	Duty and standby pumps are provided with automatic changeover on failure. Observation: No automatic duty rotation is described. The standby pump leg is a stagnant branch between manual changeovers.
URS-010	Loop temperature shall be maintained by a heat exchanger of double tube sheet construction with a monitored and drainabl…	Met	DS-003 §3.4	Double tube sheet heat exchanger specified with drainable, monitored interspace and leak detection to the control system.
URS-011	The storage tank shall be fitted with a spray ball providing demonstrated full wetted coverage of the internal surface, …	Partially met	DS-003 §2.2	Spray ball specified with stated coverage of the vessel internal surface. Observation: No coverage verification method is offered, and headspace coverage at minimum operating level is not addressed. See WC-05.
URS-012	The storage tank shall be fitted with a hydrophobic vent filter of 0.22 micrometre rating, electrically heated to preven…	Partially met	DS-003 §2.6	Hydrophobic 0.22 µm vent filter, electrically heated, is specified. Observation: In-place integrity testing without breaking the sterile boundary is not described. Confirm the test connection arrangement.
URS-013	Points of use requiring water below loop temperature shall be served by dedicated point-of-use coolers arranged so that …	Not addressed	—	No point-of-use cooler arrangement appears in any supplier document, although the point-of-use schedule identifies four points requiring water below loop temperature. Observation: This is a significant gap. Point-of-use coolers are the highest microbial risk location in a hot loop. See WC-04.
URS-014	The system shall provide a thermal sanitisation cycle capable of raising every point in the loop, including every point-…	Not yet defined	—	Sanitisation temperature and hold time are [TO BE CONFIRMED] in the URS. The supplier proposes 85 °C for 30 minutes but no requirement exists to verify against. Observation: Sanitisation temperature and hold time must be fixed by the user before the cycle can be qualified.
URS-015	Tank level shall be controlled automatically, with high, high-high, low and low-low alarms, and with pump protection pre…	Met	FS-001 §6.3	Level control with high, high-high, low and low-low alarms, and pump low-level protection.
URS-016	The system shall deliver a minimum dynamic pressure of [TO BE CONFIRMED] bar g at the most hydraulically remote point of…	Not yet defined	—	Minimum dynamic pressure at the remote point of use is [TO BE CONFIRMED] in the URS.
URS-017	The control system shall continuously record loop supply temperature, loop return temperature, tank level, loop flow, lo…	Met	FS-001 §7.1	All listed parameters recorded at 30-second intervals, exceeding the one-minute requirement.
URS-018	The system shall record every sanitisation cycle, capturing the temperature profile at each monitored location, the hold…	Partially met	FS-001 §7.4	Sanitisation cycles are recorded with the temperature profile and outcome. Observation: The operator who initiated the cycle is not recorded. Required by the URS and by records controls.
URS-019	All alarms shall be recorded with the alarm condition, time of onset, time of acknowledgement, the acknowledging operato…	Met	FS-001 §7.5	Alarms recorded with onset, acknowledgement, acknowledging operator and clearance.
URS-020	Records shall be retained for not less than [TO BE CONFIRMED] years and shall be exportable in a human-readable format t…	Not yet defined	—	Retention period is [TO BE CONFIRMED] in the URS.
URS-021	Records shall be attributable, legible, contemporaneous, original and accurate, and shall remain complete, consistent, e…	Partially met	FS-001 §8.1	Records described as attributable, legible and contemporaneous. Observation: Enduring and available over the retention period are not addressed; no archival strategy is described.
URS-022	The system clock shall synchronise with the site time server. Users shall not be able to alter system time, and any time…	Met	FS-001 §8.5	NTP synchronisation to site time server; system time not user-alterable.
URS-023	The system shall support automated backup of all GMP records, and restoration of those records shall be demonstrated dur…	Partially met	FS-001 §8.6	Automated daily backup to a site network location is described. Observation: Restoration is not described and no restoration test is offered during qualification.
URS-024	No function shall permit deletion or overwriting of a recorded value. Corrections shall be made by a new entry that pres…	Met	FS-001 §8.3	No delete or overwrite function on recorded values; corrections by new entry.
URS-025	The control system shall provide role-based access control with individual named user accounts. Shared or generic accoun…	Met	FS-001 §9.1	Role-based access with individual named accounts; generic accounts not permitted.
URS-026	The system shall provide at least the roles Operator, Supervisor, Engineer and Administrator, with the permissions of ea…	Met	FS-001 §9.2	Operator, Supervisor, Engineer and Administrator roles with defined permissions.
URS-027	Critical setpoints, including sanitisation temperature and hold time, alarm limits and calibration parameters, shall be …	Partially met	FS-001 §9.3	Setpoint changes restricted to Engineer and Administrator roles. Observation: Calibration parameters are modifiable at Supervisor level. The URS requires authorised roles only; confirm whether Supervisor is intended to be authorised.
URS-028	The system shall enforce automatic session timeout after a configurable period of inactivity, and shall require re-authe…	Met	FS-001 §9.5	Configurable inactivity timeout with re-authentication.
URS-029	The system shall maintain a secure, computer-generated, time-stamped audit trail recording the operator identity, date, …	Met	FS-001 §10.1	Audit trail records operator, date, time, previous and new value for GMP-relevant changes.
URS-030	The audit trail shall not be editable or disableable by any user, including administrators, and shall be reviewable with…	Not met	FS-001 §10.2	The functional specification states the audit trail "may be disabled by the Administrator for maintenance purposes." Observation: The URS requires that the audit trail not be disableable by any user including administrators. This is a direct conflict and must be resolved before design freeze.
URS-031	The system shall support periodic audit trail review, with a filterable view and an exportable report of changes over a …	Partially met	FS-001 §10.4	Audit trail is viewable in the application with date filtering. Observation: No exportable report over a selected period is offered. Required to support periodic review.
URS-032	The system shall interface with the upstream WFI generation system, exchanging demand signal, generation status and out-…	Met	FS-001 §11.1, P&ID-005	Interface to generation system exchanging demand, status and diversion signals.
URS-033	The system shall provide monitored signals to the site building management system for alarm annunciation, without permit…	Met	FS-001 §11.2	Monitored alarm signals to BMS, read-only, no control authority.
URS-034	The system shall provide the physical and electrical interface at each point of use defined in the point-of-use schedule…	Partially met	GA-002, P&ID-005	Mechanical interfaces shown at all points of use. Observation: Control interfaces to the two formulation vessels are not described. Confirm signal requirements.
URS-035	Where sample results are managed in a laboratory information management system, the system shall support export of onlin…	Not addressed	—	No data export capability for correlation with laboratory results is described. Observation: Desirable requirement. Confirm whether it is being carried forward.
URS-036	The system shall operate within the site utility envelope: electrical supply [TO BE CONFIRMED], plant steam or heating m…	Not yet defined	—	The URS leaves the utility envelope as [TO BE CONFIRMED]. Observation: Complete the utility schedule and re-verify against the supplier utility list.
URS-037	All drain connections shall discharge through an air break to prevent backflow, and shall be visible for inspection.…	Met	P&ID-005	All drains shown discharging through an air break, visible for inspection.
URS-038	All hot surfaces accessible to personnel shall be insulated or guarded such that touchable surface temperature does not …	Met	DS-003 §7.2	Insulation specified to limit touchable surface temperature to 55 °C.
URS-039	Pipework shall be installed with a continuous fall of not less than 1 in 100 towards designated drain points, so that th…	Partially met	ISO-011 rev B	Isometric drawings show a stated fall towards drain points. Observation: The fall is shown as 1:150 on two horizontal runs against the URS requirement of 1:100. See WC-09.
URS-040	Loop pipework routed through classified areas shall be finished and supported so as not to compromise the cleanability o…	Not addressed	—	Routing through classified areas and support arrangements are not described.
URS-041	All product contact surfaces shall be stainless steel 316L, with a mechanically polished and electropolished internal su…	Met	DS-003 §1.1, MTC pack	316L specified throughout, mechanically polished and electropolished to Ra 0.38 µm, with mill certificates provided.
URS-042	All product contact welds shall be automatic orbital welds. A weld log shall be maintained, and not less than [TO BE CON…	Not yet defined	—	Boroscopy percentage is [TO BE CONFIRMED] in the URS. The supplier offers 10%. Observation: Fix the required percentage in the URS. 10% is at the low end of common practice.
URS-043	The system shall be passivated after installation in accordance with a documented procedure, and a passivation certifica…	Met	QP-018	Passivation procedure provided; certificate to be issued on completion.
URS-044	Material certificates in accordance with EN 10204 Type 3.1 shall be provided for all product contact materials, traceabl…	Met	MTC pack	EN 10204 Type 3.1 certificates provided for all product contact materials, traceable to component tags.
URS-045	Elastomers and polymers in product contact shall comply with USP Class VI and 21 CFR 177.2600, shall be suitable for con…	Partially met	DS-003 §1.4	EPDM gaskets specified, stated as USP Class VI compliant. Observation: 21 CFR 177.2600 compliance is not stated, and no service life at 85 °C continuous is given.
URS-046	All valves in product contact shall be sanitary diaphragm valves of zero static or zero dead leg design, installed so th…	Met	P&ID-005, DS-003 §1.6	Sanitary diaphragm valves of zero static design throughout, shown self-draining.
URS-047	No dead leg in the distribution system shall exceed three internal pipe diameters (3D), measured from the internal wall …	Not met	DS-003 §1.7	The design specification states dead legs are controlled to 6D. Observation: The URS requires 3D. This is a direct conflict. Six diameters is a materially different microbial risk and must be resolved before design freeze. See WC-07.
URS-048	The complete system, including the tank, loop, all branches and all points of use, shall be fully drainable to a designa…	Partially met	ISO-011 rev B	Drain points provided at identified low points. Observation: Full drainability without dismantling is not demonstrated for the two point-of-use branches on the north elevation.
URS-049	The sanitisation cycle shall be initiated from the operator interface, shall run automatically, and shall not be capable…	Partially met	FS-001 §6.7	Sanitisation initiated from the operator interface and runs automatically. Observation: The cycle is declared complete on elapsed time. It does not verify that every monitored location achieved the required temperature and hold. See WC-03.
URS-050	Sample valves at each sampling location shall be of sanitary design, self-draining, and shall permit sampling without co…	Met	DS-003 §4.1	Sanitary self-draining sample valves at all listed locations.
URS-051	All instruments requiring calibration shall be accessible without dismantling major assemblies and shall be removable wi…	Partially met	GA-002	Instruments shown at accessible locations. Observation: Removal without breaching the loop in operation is not described for the loop return conductivity cell.
URS-052	The supplier shall provide a preventive maintenance schedule stating each task, its frequency and estimated duration, an…	Met	MAN-007	Preventive maintenance schedule provided with tasks, frequency and duration. Ten-year spares availability confirmed in the quotation.
URS-053	The storage tank shall be protected against overpressure and vacuum by a rupture disc and a pressure and vacuum relief a…	Met	DS-003 §2.8	Rupture disc with burst detection, and combined pressure and vacuum relief.
URS-054	An emergency stop shall be provided at the skid and at each remote pump location, placing the system in a defined safe s…	Met	FS-001 §12.1	Emergency stop at the skid and at the remote pump station.
URS-055	Interlocks shall prevent operation of distribution pumps against a closed system and shall prevent sanitisation while an…	Partially met	FS-001 §12.3	Interlock prevents pump operation against a closed system. Observation: No interlock prevents sanitisation while a point of use is open to an operator-accessible outlet. This is a scald hazard.
URS-056	Sanitisation shall not be capable of being started without a positive confirmation step, and every point of use shall be…	Not addressed	—	No positive confirmation step before sanitisation start and no point-of-use lockout indication are described. Observation: Combine with URS-055 into a single supplier query on sanitisation safety.
URS-057	Noise emitted by the system shall not exceed 80 dB(A) measured at one metre under normal operation.…	Met	DS-003 §7.4	Predicted 74 dB(A) at one metre.
URS-058	The supplier shall provide, prior to Factory Acceptance Testing: general arrangement drawings, piping and instrumentatio…	Met	Document register rev 3	All listed documents provided prior to FAT.
URS-059	The supplier shall provide FAT and SAT protocols for user review and approval not less than four weeks before the respec…	Met	Quotation §5	FAT and SAT protocols offered six weeks before each test.
URS-060	The supplier shall provide IQ and OQ protocols and supporting documentation aligned with EU GMP Annex 15, together with …	Partially met	Quotation §5	IQ and OQ protocols offered. Observation: Weld logs, boroscopy records and slope verification records are not listed in the turnover package scope.
URS-061	The supplier shall provide operation and maintenance manuals, a spare parts list with part numbers, and a documented cha…	Met	MAN-007	O&M manuals, spare parts list and change notification procedure provided.
URS-062	The supplier shall provide training for operators, maintenance personnel, and quality and validation personnel, covering…	Partially met	Quotation §6	Operator and maintenance training offered. Observation: No training on audit trail review or user administration for QA and validation personnel.
URS-063	The system shall comply with the current USP and Ph. Eur. monographs for Water for Injection and with USP General Chapte…	Met	FS-001 §2.1	Compliance with the WFI monograph requirements stated.
URS-064	WFI delivered at every point of use shall meet: conductivity in accordance with USP General Chapter 645; total organic c…	Partially met	FS-001 §2.3	Conductivity, TOC and microbial limits stated and matched to the URS. Observation: Bacterial endotoxin limit is not stated in any supplier document.
URS-065	The system shall be designed, installed and qualified in accordance with EU GMP Annex 15 and the site validation master …	Met	Quotation §5	Qualification approach aligned to EU GMP Annex 15.
URS-066	The control system shall comply with EU GMP Annex 11 and, where applicable to the site, 21 CFR Part 11.…	Partially met	FS-001 §8	Annex 11 addressed. 21 CFR Part 11 applicability is stated as "available on request". Observation: Confirm whether Part 11 applies to this site and, if so, that it is in the scope of supply.
URS-067	The system shall be designed and documented in accordance with GAMP 5, and the supplier shall state the GAMP software ca…	Met	FS-001 §1.3	Control system stated as GAMP category 4, configured product.
URS-068	Equipment design shall follow ASME BPE for hygienic design, surface finish, fabrication and examination of product conta…	Met	DS-003 §1	Hygienic design, surface finish and examination stated to follow ASME BPE.
URS-069	The system shall support a three-phase Performance Qualification: Phase 1 with daily sampling of every point of use, Pha…	Partially met	Quotation §5	Supplier supports a PQ programme. Observation: Only Phase 1 and Phase 2 are within the scope of supply. Phase 3 over one year is excluded. Confirm who executes Phase 3.
URS-070	Sample points shall be provided at the tank outlet, the loop supply, the loop return, each sub-loop return and each poin…	Met	P&ID-005	Sample points at the tank outlet, loop supply, loop return and each point of use, individually tagged.
URS-071	Temperature mapping ports shall be provided at each worst-case location listed in Appendix A, sufficient to demonstrate …	Not addressed	—	No temperature mapping ports are shown at the worst-case locations listed in the URS. Observation: Without mapping ports at the least favourable points, sanitisation acceptance cannot be demonstrated where it matters. See WC-03.
URS-072	The supplier shall provide hydraulic calculations demonstrating that the minimum return velocity and minimum point-of-us…	Partially met	CALC-004 rev A	Hydraulic calculation provided. Observation: Performed at average demand. The worst-case demand condition required by the URS is not calculated. See WC-01.
URS-073	Every requirement in this specification shall be traceable through design qualification, factory and site acceptance tes…	Partially met	Traceability matrix rev 1	A traceability matrix is provided. Observation: It traces to the supplier functional specification, not to URS requirement identifiers. Request re-issue traced to URS IDs.
URS-074	The system shall permit challenge of the worst-case conditions listed in Appendix A during qualification without modific…	Not addressed	—	No statement that the installed system permits challenge of the worst-case conditions without modification.

7. Verification Against Worst-Case Conditions

The specification identifies conditions under which the system is least able to meet its requirements. A design demonstrated only at nominal conditions has not been shown to meet the specification. Each condition below is verified separately.

This is the section in which most design gaps are found. A supplier who demonstrates compliance at average demand has demonstrated nothing about behaviour at peak.

Ref	Condition	Verdict	Design ref	Evidence and observation	Governs
WC-01	Maximum simultaneous demand	Partially addressed	CALC-004 rev A	Hydraulic calculation performed at 40 L/min average demand. Observation: The condition is not calculated. Return velocity, return temperature and remote-point pressure all degrade together at peak; none is demonstrated at that condition.	URS-008, URS-016, URS-072
WC-02	Coldest point during normal circulation	Not addressed	—	Loop temperature is stated at the supply header only. Observation: The coldest point is not identified and is not monitored. Microbial control depends on it.	URS-007, URS-017
WC-03	Least favourable point during sanitisation	Not addressed	—	Sanitisation is verified on elapsed time at the supply header. Observation: No mapping ports and no acceptance at the least favourable point. A cycle demonstrated at the header does not demonstrate control.	URS-014, URS-049, URS-071
WC-04	Point-of-use cooler branch	Not addressed	—	No cooler arrangement appears in the design. Observation: Four points of use require sub-loop temperature water. This is the highest microbial risk location in a hot loop and it is undesigned.	URS-013, URS-064
WC-05	Tank at minimum operating level	Partially addressed	DS-003 §2.2	Spray ball coverage stated for the vessel internal surface. Observation: Headspace coverage at minimum level is not addressed and no coverage verification is offered.	URS-004, URS-011, URS-015
WC-06	Maximum tank discharge rate	Addressed	DS-003 §2.6	Vent filter sized for the stated maximum discharge rate with heater duty calculated.	URS-012
WC-07	Longest branch and standby pump leg	Not addressed	DS-003 §1.7	Dead legs stated as controlled to 6D. Observation: Conflicts with the URS 3D requirement, and no duty rotation is provided for the standby pump leg. Two stagnation risks in one condition.	URS-009, URS-046, URS-047
WC-08	Most hydraulically remote point of use	Partially addressed	CALC-004 rev A	Pressure calculated at the remote point at average demand. Observation: Not calculated at peak. The URS pressure requirement is itself undefined.	URS-016, URS-072
WC-09	Highest point and longest horizontal run	Partially addressed	ISO-011 rev B	Fall towards drain shown throughout. Observation: Two runs at 1:150 against the URS requirement of 1:100.	URS-039, URS-048
WC-10	Extended low-demand period	Not addressed	—	Not considered in any supplier document. Observation: No first-draw or restart strategy after a low-demand period.	URS-003, URS-006
WC-11	Worst-case feed water quality	Not addressed	—	Feed water variation is treated as the generation system scope. Observation: Correct as far as it goes, but the distribution PQ Phase 3 must still cover seasonal variation and Phase 3 is excluded from supply.	URS-063, URS-064, URS-069

8. Summary of Findings

8.1 Requirements

Verdict	Count	Note
Met	32
Partially met	24
Not met	2	Direct conflict; must be resolved before design freeze.
Not addressed	7
Not yet defined	9	Finding against the specification, not the design.

Total requirements verified: 74.

8.2 Requirements not met — resolution required before design freeze

• URS-030 — the functional specification permits the audit trail to be disabled by an administrator. The specification requires that it not be disableable by any user. Direct conflict.

• URS-047 — the design specification states dead legs controlled to 6D against a specification requirement of 3D. Materially different microbial risk.

8.3 Worst-case conditions

Verdict	Count	Note
Addressed	1
Partially addressed	4
Not addressed	6

8.4 Requirements not yet defined in the specification

The following requirements could not be verified because the User Requirements Specification does not fix a value. These are findings against the specification and must be closed before the design can be qualified.

URS-002, URS-003, URS-004, URS-005, URS-014, URS-016, URS-020, URS-036, URS-042

9. Observations Register

Each observation below requires resolution with the supplier. Resolution and closure are recorded on this register.

Observation	Against	Verdict	Description / Resolution
DQ-OBS-001	URS-002	Not yet defined	Peak demand must be fixed in the URS before the hydraulic design can be verified. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-002	URS-004	Not yet defined	Confirm the required capacity, then re-verify against the offered 5,000 L vessel. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-003	URS-006	Not addressed	Request the supplier state the expected recovery time and the basis for it. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-004	URS-007	Partially met	The URS requires 80 °C at the least favourable point, not at the supply header. Confirm the coldest point and how it is monitored. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-005	URS-008	Partially met	Velocity must be demonstrated at maximum simultaneous demand, not average. See worst-case condition WC-01. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-006	URS-009	Partially met	No automatic duty rotation is described. The standby pump leg is a stagnant branch between manual changeovers. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-007	URS-011	Partially met	No coverage verification method is offered, and headspace coverage at minimum operating level is not addressed. See WC-05. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-008	URS-012	Partially met	In-place integrity testing without breaking the sterile boundary is not described. Confirm the test connection arrangement. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-009	URS-013	Not addressed	This is a significant gap. Point-of-use coolers are the highest microbial risk location in a hot loop. See WC-04. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-010	URS-014	Not yet defined	Sanitisation temperature and hold time must be fixed by the user before the cycle can be qualified. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-011	URS-018	Partially met	The operator who initiated the cycle is not recorded. Required by the URS and by records controls. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-012	URS-021	Partially met	Enduring and available over the retention period are not addressed; no archival strategy is described. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-013	URS-023	Partially met	Restoration is not described and no restoration test is offered during qualification. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-014	URS-027	Partially met	Calibration parameters are modifiable at Supervisor level. The URS requires authorised roles only; confirm whether Supervisor is intended to be authorised. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-015	URS-030	Not met	The URS requires that the audit trail not be disableable by any user including administrators. This is a direct conflict and must be resolved before design freeze. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-016	URS-031	Partially met	No exportable report over a selected period is offered. Required to support periodic review. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-017	URS-034	Partially met	Control interfaces to the two formulation vessels are not described. Confirm signal requirements. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-018	URS-035	Not addressed	Desirable requirement. Confirm whether it is being carried forward. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-019	URS-036	Not yet defined	Complete the utility schedule and re-verify against the supplier utility list. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-020	URS-039	Partially met	The fall is shown as 1:150 on two horizontal runs against the URS requirement of 1:100. See WC-09. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-021	URS-042	Not yet defined	Fix the required percentage in the URS. 10% is at the low end of common practice. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-022	URS-045	Partially met	21 CFR 177.2600 compliance is not stated, and no service life at 85 °C continuous is given. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-023	URS-047	Not met	The URS requires 3D. This is a direct conflict. Six diameters is a materially different microbial risk and must be resolved before design freeze. See WC-07. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-024	URS-048	Partially met	Full drainability without dismantling is not demonstrated for the two point-of-use branches on the north elevation. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-025	URS-049	Partially met	The cycle is declared complete on elapsed time. It does not verify that every monitored location achieved the required temperature and hold. See WC-03. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-026	URS-051	Partially met	Removal without breaching the loop in operation is not described for the loop return conductivity cell. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-027	URS-055	Partially met	No interlock prevents sanitisation while a point of use is open to an operator-accessible outlet. This is a scald hazard. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-028	URS-056	Not addressed	Combine with URS-055 into a single supplier query on sanitisation safety. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-029	URS-060	Partially met	Weld logs, boroscopy records and slope verification records are not listed in the turnover package scope. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-030	URS-062	Partially met	No training on audit trail review or user administration for QA and validation personnel. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-031	URS-064	Partially met	Bacterial endotoxin limit is not stated in any supplier document. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-032	URS-066	Partially met	Confirm whether Part 11 applies to this site and, if so, that it is in the scope of supply. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-033	URS-069	Partially met	Only Phase 1 and Phase 2 are within the scope of supply. Phase 3 over one year is excluded. Confirm who executes Phase 3. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-034	URS-071	Not addressed	Without mapping ports at the least favourable points, sanitisation acceptance cannot be demonstrated where it matters. See WC-03. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-035	URS-072	Partially met	Performed at average demand. The worst-case demand condition required by the URS is not calculated. See WC-01. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-036	URS-073	Partially met	It traces to the supplier functional specification, not to URS requirement identifiers. Request re-issue traced to URS IDs. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-037	WC-01	Partially addressed	The condition is not calculated. Return velocity, return temperature and remote-point pressure all degrade together at peak; none is demonstrated at that condition. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-038	WC-02	Not addressed	The coldest point is not identified and is not monitored. Microbial control depends on it. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-039	WC-03	Not addressed	No mapping ports and no acceptance at the least favourable point. A cycle demonstrated at the header does not demonstrate control. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-040	WC-04	Not addressed	Four points of use require sub-loop temperature water. This is the highest microbial risk location in a hot loop and it is undesigned. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-041	WC-05	Partially addressed	Headspace coverage at minimum level is not addressed and no coverage verification is offered. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-042	WC-07	Not addressed	Conflicts with the URS 3D requirement, and no duty rotation is provided for the standby pump leg. Two stagnation risks in one condition. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-043	WC-08	Partially addressed	Not calculated at peak. The URS pressure requirement is itself undefined. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-044	WC-09	Partially addressed	Two runs at 1:150 against the URS requirement of 1:100. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-045	WC-10	Not addressed	No first-draw or restart strategy after a low-demand period. Resolution: ________________________________ Closed by: ____________ Date: __________
DQ-OBS-046	WC-11	Not addressed	Correct as far as it goes, but the distribution PQ Phase 3 must still cover seasonal variation and Phase 3 is excluded from supply. Resolution: ________________________________ Closed by: ____________ Date: __________

10. Conclusion

Based on the review recorded in this document, of 74 requirements in URS-WFI-001 Revision 0.1: 32 are met, 24 are partially met, 2 are not met, 7 are not addressed, and 9 could not be verified because the specification does not fix a value.

Of 11 worst-case conditions, 1 are addressed, 4 are partially addressed and 6 are not addressed.

The design is [ suitable / suitable subject to resolution of the observations listed in Section 9 / not suitable ] for the intended use.

The bracketed judgement above is drafted from the counts recorded in this document. It is a judgement for the reviewer and must be confirmed, amended or replaced by qualified personnel before this document is issued. Pharma4i does not make this determination.

Note for the reviewer: two requirements are in direct conflict with the design (Section 8.2) and four worst-case conditions are unaddressed, including the point-of-use cooler arrangement, which is undesigned. On the counts recorded here, a conclusion of "suitable" without qualification would not be supportable.

11. Approval and Sign-off

Signature below indicates that the signatory has reviewed this Design Qualification, has verified the verdicts against the source documents listed in Section 3, and accepts the conclusion recorded in Section 10.

Role	Name	Department	Signature	Date
Author		Engineering
Reviewer		Operations
Reviewer		MSAT
Reviewer		CQV / Validation
Reviewer		Automation / IT
Reviewer		Contamination Control
Quality approval		Quality Assurance

12. Revision History

Revision	Date	Description of change	Author
0.1	[DD-MMM-YYYY]	First draft.

Appendix A — Traceability

Each requirement of URS-WFI-001 against its verdict and the design document that satisfies it. The test reference column is completed as FAT, SAT, IQ, OQ and PQ documents are raised.

URS ID	Requirement summary	Criticality	DQ verdict	Design ref	Test ref
URS-001	The system shall store and distribute Water for Injection meeting the requirements of the …	Mandatory	Met	FS-001 §2.1
URS-002	The system shall deliver a peak instantaneous demand of [TO BE CONFIRMED] L/min and an ave…	Mandatory	Not yet defined	—
URS-003	The system shall operate continuously, 24 hours per day, 7 days per week, with planned shu…	Mandatory	Not yet defined	—
URS-004	The storage tank shall have a nominal capacity of [TO BE CONFIRMED] L, sized to buffer pea…	Mandatory	Not yet defined	—
URS-005	The distribution loop shall serve [TO BE CONFIRMED] points of use, listed with their locat…	Mandatory	Not yet defined	—
URS-006	The system shall recover to full specification within [TO BE CONFIRMED] hours following a …	Desirable	Not addressed	—
URS-007	WFI shall be stored and distributed under continuous hot circulation at a temperature not …	Mandatory	Partially met	FS-001 §4.2
URS-008	The distribution loop shall maintain a return flow velocity of not less than 1.0 m/s, or a…	Mandatory	Partially met	CALC-004 rev A
URS-009	The system shall be fitted with duty and standby distribution pumps with automatic changeo…	Mandatory	Partially met	FS-001 §5.1, GA-002
URS-010	Loop temperature shall be maintained by a heat exchanger of double tube sheet construction…	Mandatory	Met	DS-003 §3.4
URS-011	The storage tank shall be fitted with a spray ball providing demonstrated full wetted cove…	Mandatory	Partially met	DS-003 §2.2
URS-012	The storage tank shall be fitted with a hydrophobic vent filter of 0.22 micrometre rating,…	Mandatory	Partially met	DS-003 §2.6
URS-013	Points of use requiring water below loop temperature shall be served by dedicated point-of…	Mandatory	Not addressed	—
URS-014	The system shall provide a thermal sanitisation cycle capable of raising every point in th…	Mandatory	Not yet defined	—
URS-015	Tank level shall be controlled automatically, with high, high-high, low and low-low alarms…	Mandatory	Met	FS-001 §6.3
URS-016	The system shall deliver a minimum dynamic pressure of [TO BE CONFIRMED] bar g at the most…	Mandatory	Not yet defined	—
URS-017	The control system shall continuously record loop supply temperature, loop return temperat…	Mandatory	Met	FS-001 §7.1
URS-018	The system shall record every sanitisation cycle, capturing the temperature profile at eac…	Mandatory	Partially met	FS-001 §7.4
URS-019	All alarms shall be recorded with the alarm condition, time of onset, time of acknowledgem…	Mandatory	Met	FS-001 §7.5
URS-020	Records shall be retained for not less than [TO BE CONFIRMED] years and shall be exportabl…	Mandatory	Not yet defined	—
URS-021	Records shall be attributable, legible, contemporaneous, original and accurate, and shall …	Mandatory	Partially met	FS-001 §8.1
URS-022	The system clock shall synchronise with the site time server. Users shall not be able to a…	Mandatory	Met	FS-001 §8.5
URS-023	The system shall support automated backup of all GMP records, and restoration of those rec…	Mandatory	Partially met	FS-001 §8.6
URS-024	No function shall permit deletion or overwriting of a recorded value. Corrections shall be…	Mandatory	Met	FS-001 §8.3
URS-025	The control system shall provide role-based access control with individual named user acco…	Mandatory	Met	FS-001 §9.1
URS-026	The system shall provide at least the roles Operator, Supervisor, Engineer and Administrat…	Mandatory	Met	FS-001 §9.2
URS-027	Critical setpoints, including sanitisation temperature and hold time, alarm limits and cal…	Mandatory	Partially met	FS-001 §9.3
URS-028	The system shall enforce automatic session timeout after a configurable period of inactivi…	Mandatory	Met	FS-001 §9.5
URS-029	The system shall maintain a secure, computer-generated, time-stamped audit trail recording…	Mandatory	Met	FS-001 §10.1
URS-030	The audit trail shall not be editable or disableable by any user, including administrators…	Mandatory	Not met	FS-001 §10.2
URS-031	The system shall support periodic audit trail review, with a filterable view and an export…	Mandatory	Partially met	FS-001 §10.4
URS-032	The system shall interface with the upstream WFI generation system, exchanging demand sign…	Mandatory	Met	FS-001 §11.1, P&ID-005
URS-033	The system shall provide monitored signals to the site building management system for alar…	Mandatory	Met	FS-001 §11.2
URS-034	The system shall provide the physical and electrical interface at each point of use define…	Mandatory	Partially met	GA-002, P&ID-005
URS-035	Where sample results are managed in a laboratory information management system, the system…	Desirable	Not addressed	—
URS-036	The system shall operate within the site utility envelope: electrical supply [TO BE CONFIR…	Mandatory	Not yet defined	—
URS-037	All drain connections shall discharge through an air break to prevent backflow, and shall …	Mandatory	Met	P&ID-005
URS-038	All hot surfaces accessible to personnel shall be insulated or guarded such that touchable…	Mandatory	Met	DS-003 §7.2
URS-039	Pipework shall be installed with a continuous fall of not less than 1 in 100 towards desig…	Mandatory	Partially met	ISO-011 rev B
URS-040	Loop pipework routed through classified areas shall be finished and supported so as not to…	Mandatory	Not addressed	—
URS-041	All product contact surfaces shall be stainless steel 316L, with a mechanically polished a…	Mandatory	Met	DS-003 §1.1, MTC pack
URS-042	All product contact welds shall be automatic orbital welds. A weld log shall be maintained…	Mandatory	Not yet defined	—
URS-043	The system shall be passivated after installation in accordance with a documented procedur…	Mandatory	Met	QP-018
URS-044	Material certificates in accordance with EN 10204 Type 3.1 shall be provided for all produ…	Mandatory	Met	MTC pack
URS-045	Elastomers and polymers in product contact shall comply with USP Class VI and 21 CFR 177.2…	Mandatory	Partially met	DS-003 §1.4
URS-046	All valves in product contact shall be sanitary diaphragm valves of zero static or zero de…	Mandatory	Met	P&ID-005, DS-003 §1.6
URS-047	No dead leg in the distribution system shall exceed three internal pipe diameters (3D), me…	Mandatory	Not met	DS-003 §1.7
URS-048	The complete system, including the tank, loop, all branches and all points of use, shall b…	Mandatory	Partially met	ISO-011 rev B
URS-049	The sanitisation cycle shall be initiated from the operator interface, shall run automatic…	Mandatory	Partially met	FS-001 §6.7
URS-050	Sample valves at each sampling location shall be of sanitary design, self-draining, and sh…	Mandatory	Met	DS-003 §4.1
URS-051	All instruments requiring calibration shall be accessible without dismantling major assemb…	Mandatory	Partially met	GA-002
URS-052	The supplier shall provide a preventive maintenance schedule stating each task, its freque…	Mandatory	Met	MAN-007
URS-053	The storage tank shall be protected against overpressure and vacuum by a rupture disc and …	Mandatory	Met	DS-003 §2.8
URS-054	An emergency stop shall be provided at the skid and at each remote pump location, placing …	Mandatory	Met	FS-001 §12.1
URS-055	Interlocks shall prevent operation of distribution pumps against a closed system and shall…	Mandatory	Partially met	FS-001 §12.3
URS-056	Sanitisation shall not be capable of being started without a positive confirmation step, a…	Mandatory	Not addressed	—
URS-057	Noise emitted by the system shall not exceed 80 dB(A) measured at one metre under normal o…	Desirable	Met	DS-003 §7.4
URS-058	The supplier shall provide, prior to Factory Acceptance Testing: general arrangement drawi…	Mandatory	Met	Document register rev 3
URS-059	The supplier shall provide FAT and SAT protocols for user review and approval not less tha…	Mandatory	Met	Quotation §5
URS-060	The supplier shall provide IQ and OQ protocols and supporting documentation aligned with E…	Mandatory	Partially met	Quotation §5
URS-061	The supplier shall provide operation and maintenance manuals, a spare parts list with part…	Mandatory	Met	MAN-007
URS-062	The supplier shall provide training for operators, maintenance personnel, and quality and …	Mandatory	Partially met	Quotation §6
URS-063	The system shall comply with the current USP and Ph. Eur. monographs for Water for Injecti…	Mandatory	Met	FS-001 §2.1
URS-064	WFI delivered at every point of use shall meet: conductivity in accordance with USP Genera…	Mandatory	Partially met	FS-001 §2.3
URS-065	The system shall be designed, installed and qualified in accordance with EU GMP Annex 15 a…	Mandatory	Met	Quotation §5
URS-066	The control system shall comply with EU GMP Annex 11 and, where applicable to the site, 21…	Mandatory	Partially met	FS-001 §8
URS-067	The system shall be designed and documented in accordance with GAMP 5, and the supplier sh…	Mandatory	Met	FS-001 §1.3
URS-068	Equipment design shall follow ASME BPE for hygienic design, surface finish, fabrication an…	Mandatory	Met	DS-003 §1
URS-069	The system shall support a three-phase Performance Qualification: Phase 1 with daily sampl…	Mandatory	Partially met	Quotation §5
URS-070	Sample points shall be provided at the tank outlet, the loop supply, the loop return, each…	Mandatory	Met	P&ID-005
URS-071	Temperature mapping ports shall be provided at each worst-case location listed in Appendix…	Mandatory	Not addressed	—
URS-072	The supplier shall provide hydraulic calculations demonstrating that the minimum return ve…	Mandatory	Partially met	CALC-004 rev A
URS-073	Every requirement in this specification shall be traceable through design qualification, f…	Mandatory	Partially met	Traceability matrix rev 1
URS-074	The system shall permit challenge of the worst-case conditions listed in Appendix A during…	Mandatory	Not addressed	—

Appendix B — Documents Reviewed

Every document on which a verdict in this Design Qualification is based. A verdict citing a document not listed here is an error and must be corrected before issue.

Document	Number	Revision	Date received
Functional Specification	FS-001	Rev 2
Design Specification	DS-003	Rev 1
General Arrangement drawing	GA-002	Rev C
Piping and Instrumentation Diagram	P&ID-005	Rev B
Isometric drawings	ISO-011	Rev B
Hydraulic calculation	CALC-004	Rev A
Material test certificate pack	MTC pack	—
Passivation procedure	QP-018	Rev 1
Operation and maintenance manual	MAN-007	Rev 1
Supplier quotation	[Number]	—

Appendix C — Subjects Outside the Scope of the Specification

The following subjects are mandatory for this equipment type but are not addressed by URS-WFI-001, because they belong to the WFI generation system, equipment item EQ-01 in this project. They are therefore not verified by this Design Qualification and are addressed in the EQ-01 documentation.

Subject	Where addressed
Recovery, reject handling and diversion	WFI generation system, EQ-01. Not within the scope of supply for the distribution system.
Generation sanitisation regime	WFI generation system, EQ-01. The distribution loop sanitisation regime is addressed at URS-014 and remains undefined.

A subject listed here is neither verified by this document nor by the specification it verifies against. Confirm it is genuinely covered in the EQ-01 documentation before relying on this exclusion.

Appendix D — Abbreviations

Term	Definition
ASME BPE	American Society of Mechanical Engineers Bioprocessing Equipment standard
CFU	Colony Forming Unit
DQ	Design Qualification
DS	Design Specification
EU	Endotoxin Unit
FAT	Factory Acceptance Test
FS	Functional Specification
GAMP	Good Automated Manufacturing Practice
GA	General Arrangement
IQ	Installation Qualification
OQ	Operational Qualification
P&ID	Piping and Instrumentation Diagram
PQ	Performance Qualification
Ra	Roughness average
SAT	Site Acceptance Test
TOC	Total Organic Carbon
URS	User Requirements Specification
WFI	Water for Injection

FACTORY ACCEPTANCE TEST PROTOCOL

Water for Injection Storage and Distribution System

FAT-WFI-001 · REVISION 0.1

Project reference	PRJ-2026-0009
Equipment reference	EQ-02 — WFI Storage and Distribution System
Document status	Draft
Generated from	URS-WFI-001 Rev 0.1 and DQ-WFI-001 Rev 0.1
Supplier	[Supplier name]
Works location	[Works location]
Planned test dates	[DD-MMM-YYYY] to [DD-MMM-YYYY]
Prepared by	[Enter author]

This protocol was drafted with software assistance. It has no validity until reviewed and approved by qualified personnel in accordance with the site quality system, and must not be executed before approval. Acceptance criteria are taken from URS-WFI-001 and are not independently established by this document. Pharma4i does not perform or record document approval.

Related Documents

This protocol forms part of the qualification package for PRJ-2026-0009 EQ-02.

Document	Number	Rev	Status	Relationship
User Requirements Specification	URS-WFI-001	0.1	Issued	Source of requirements
Design Qualification	DQ-WFI-001	0.1	Issued	Source of observations to close
FAT Protocol	FAT-WFI-001	0.1	Draft	This protocol
FAT Report	FAT-WFI-001-R	0.1	Draft	Records execution of this protocol
Site Acceptance Test protocol	SAT-WFI-001	—	Planned	Verifies requirements deferred from FAT
Installation Qualification	IQ-WFI-001	—	Planned	Planned
Operational Qualification	OQ-WFI-001	—	Planned	Planned
Performance Qualification	PQ-WFI-001	—	Planned	Planned
Validation Summary Report	VSR-WFI-001	—	Planned	Planned

Table of Contents

1. Introduction and Purpose

This protocol defines the tests to be performed at the supplier works to verify that the Water for Injection storage and distribution system, as manufactured, conforms to the requirements of URS-WFI-001 Revision 0.1 that can be verified in a works environment, and to confirm closure of the observations raised in DQ-WFI-001 Revision 0.1.

Factory Acceptance Testing establishes no new requirements. Every acceptance criterion in this protocol is taken from the User Requirements Specification. Where the specification does not fix a value, no criterion is stated and no test is performed; the requirement is recorded as untestable and the finding is against the specification.

Successful completion of this protocol is a precondition of shipment. It does not constitute qualification of the system.

2. Scope

2.1 In scope

• Verification of construction, materials, surface finish and documentation against the specification.

• Function testing of the control system, alarms, interlocks and safety devices.

• Performance testing of the distribution pumps and instrumentation on potable water.

• Verification of the storage vessel, spray ball coverage, vent filter and relief devices.

• Closure of Design Qualification observations capable of resolution at the works.

• Challenge of worst-case conditions capable of being created at the works.

2.2 Out of scope

• Any test requiring Water for Injection, site utilities, the site network or a classified environment. These are listed in Section 11.

• The WFI generation system, equipment item EQ-01.

• Site installation, passivation and the qualification programme following delivery.

3. Reference Documents

Document	Number	Revision
User Requirements Specification	URS-WFI-001	Rev 0.1
Design Qualification	DQ-WFI-001	Rev 0.1
Supplier Functional Specification	FS-001	Rev 2
Supplier Design Specification	DS-003	Rev 1
Piping and Instrumentation Diagram	P&ID-005	Rev B
Isometric drawings	ISO-011	Rev B
Instrument index	IDX-009	Rev 2
Electrical schematics	ELE-014	Rev 4
EU GMP Annex 15 — Qualification and Validation	—	Current
EU GMP Annex 11 — Computerised Systems	—	Current

4. Responsibilities

Execution is by the supplier, witnessed and recorded by the user disciplines listed. A test performed without the required witness present is not valid and shall be repeated.

Discipline	Name	Responsibility
Supplier		Executes the tests, provides equipment, media and documentation
Engineering		Witnesses execution, records results, raises deviations
CQV / Validation		Confirms protocol compliance and deviation classification
Operations		Witnesses operability tests
Automation / IT		Witnesses control system, access control and audit trail tests
EHS		Witnesses safety and interlock tests
Quality Assurance		Approves the protocol and the report

5. Test Prerequisites

The following shall be confirmed before any test is performed. Testing shall not begin until every item is satisfied, and the confirmation shall be recorded.

• This protocol is approved and the approved copy is present at the works.

• The equipment is mechanically complete against the general arrangement drawing, and any incomplete item is listed and agreed before starting.

• The reference documents in Section 3 are available at the works at the revisions stated.

• All test instruments listed in Section 6 are present and hold valid calibration certificates.

• Potable water, compressed air and electrical supply are available at the works at the stated conditions.

• Control system software is at the version recorded in FAT-037, and the version is recorded before testing begins.

• All personnel listed in Section 4 are present or have delegated in writing.

6. Test Instruments and Calibration

Every instrument used shall hold a valid calibration certificate traceable to national standards. The required accuracy is stated relative to the tolerance being verified: an instrument whose accuracy equals the acceptance tolerance cannot demonstrate compliance.

Instrument	Used in	Required accuracy	Cal. cert / due
Surface roughness tester	FAT-003	Resolution 0.01 micrometres or better
Boroscope	FAT-004	Suitable for the smallest pipe bore in scope
Digital level	FAT-007	Accuracy 0.1 degrees or better
Pressure gauge	FAT-009	Accuracy 1% of span or better, range to 1.5 x design
UV inspection lamp	FAT-010	365 nm
Surface temperature probe	FAT-011, FAT-034	Accuracy 1 degree C or better
Flow meter	FAT-014	Accuracy 2% of reading or better
Signal simulator	FAT-016, FAT-017	Accuracy 0.1% of span or better
Sound level meter	FAT-033	Class 2 or better
Calibrated rule / calipers	FAT-006	Resolution 1 mm or better
Stopwatch	FAT-024	Resolution 1 second

7. Acceptance Criteria and Handling of Failures

A test passes only where the recorded result satisfies the stated acceptance criterion in full. A partial result is a failure.

Where a test fails, execution continues unless the failure creates a safety hazard or prevents subsequent tests. Each failure is recorded as a deviation with a classification of critical, major or minor, entered in the deviation log at Appendix B, and carried to the punch list where rework is required.

A critical deviation prevents shipment until closed and retested. A major deviation prevents shipment unless a documented concession is approved by Quality Assurance. A minor deviation may be carried to site with an agreed closure date.

No acceptance criterion in this protocol may be amended during execution. If a criterion is found to be wrong, testing of that item stops and the specification is corrected through change control.

8. Test Scripts

Tests are presented in specification order. Each cites the requirement it verifies and, where applicable, the Design Qualification observation it closes.

FAT-001 — Verify the supplier documentation pack is complete and current before testing begins.

Test ID	FAT-001
Traces to	URS-058
Objective	Verify the supplier documentation pack is complete and current before testing begins.

Method

1. Request the document register.

2. Confirm each document listed in the URS documentation requirement is present.

3. Record document number and revision for each.

Acceptance criterion

All documents required by URS-058 are present, at a stated revision, and match the document register.

Test instrument	—	Result
Performed by		Pass / Fail		Date

FAT-002 — Verify material certificates for all product contact materials.

Test ID	FAT-002
Traces to	URS-044
Objective	Verify material certificates for all product contact materials.

Method

1. Obtain the material certificate pack.

2. For each product contact item, trace the certificate to the installed component tag.

3. Confirm certificate type.

Acceptance criterion

EN 10204 Type 3.1 certificates present for every product contact item, traceable to component tags.

Test instrument	—	Result
Performed by		Pass / Fail		Date

FAT-003 — Verify product contact material and surface finish.

Test ID	FAT-003
Traces to	URS-041
Objective	Verify product contact material and surface finish.

Method

1. Confirm material grade from certificates and component markings.

2. Measure internal surface finish at five accessible locations using a calibrated profilometer.

3. Record each reading.

Acceptance criterion

Material is 316L. Ra not greater than 0.4 micrometres at every measured location.

Test instrument	Surface roughness tester, resolution 0.01 micrometres or better	Result
Performed by		Pass / Fail		Date

FAT-004 — Verify orbital weld records and boroscopic inspection.

Test ID	FAT-004
Traces to	URS-042
Objective	Verify orbital weld records and boroscopic inspection.

Method

1. Review the weld log against the isometric drawings.

2. Confirm each product contact weld is recorded.

3. Review boroscopy records against the required percentage.

Acceptance criterion

ACCEPTANCE CRITERION NOT DEFINED IN THE URS. The required boroscopy percentage is [TO BE CONFIRMED] in URS-042.

Test instrument	Boroscope	Result
Performed by		Pass / Fail		Date

FAT-005 — Verify valve type and installation.

Test ID	FAT-005
Traces to	URS-046
Objective	Verify valve type and installation.

Method

1. Identify every product contact valve against the P&ID.

2. Confirm sanitary diaphragm type and zero static design.

3. Confirm each branch is self-draining by visual inspection with the skid level.

Acceptance criterion

All product contact valves are sanitary diaphragm, zero static design, installed self-draining.

Test instrument	Spirit level	Result
Performed by		Pass / Fail		Date

FAT-006 — Verify dead leg dimensions against the specification.

Test ID	FAT-006
Traces to	URS-047 | Closes DQ-OBS-032
Objective	Verify dead leg dimensions against the specification.

Method

1. Measure each branch from the internal wall of the main loop to the point of closure.

2. Express as a multiple of internal pipe diameter.

3. Record every branch.

Acceptance criterion

No dead leg exceeds three internal pipe diameters (3D) as required by URS-047.

Test instrument	Calibrated rule / calipers	Result
Performed by		Pass / Fail		Date

FAT-007 — Verify slope of skid-mounted pipework.

Test ID	FAT-007
Traces to	URS-039
Objective	Verify slope of skid-mounted pipework.

Method

1. Level the skid to its installed datum.

2. Measure fall on each horizontal run using a calibrated level.

3. Record fall as a ratio.

Acceptance criterion

Continuous fall of not less than 1 in 100 towards designated drain points, on all skid pipework.

Test instrument	Digital level, accuracy 0.1 degrees or better	Result
Performed by		Pass / Fail		Date

FAT-008 — Verify drainability of the skid.

Test ID	FAT-008
Traces to	URS-048
Objective	Verify drainability of the skid.

Method

1. Fill the skid pipework with water.

2. Open all drain points.

3. After 15 minutes inspect all low points and branches for retained water.

Acceptance criterion

No retained water in any accessible section of skid pipework after draining.

Test instrument	—	Result
Performed by		Pass / Fail		Date

FAT-009 — Hydrostatic pressure test of the assembled skid.

Test ID	FAT-009
Traces to	General construction and safety verification
Objective	Hydrostatic pressure test of the assembled skid.

Method

1. Blank off the skid at its battery limits.

2. Fill with potable water and pressurise to 1.5 times design pressure.

3. Hold for 30 minutes and inspect all joints.

Acceptance criterion

No pressure drop and no visible leakage over the hold period.

Test instrument	Calibrated pressure gauge, accuracy 1% of span or better	Result
Performed by		Pass / Fail		Date

FAT-010 — Verify spray ball coverage of the storage vessel.

Test ID	FAT-010
Traces to	URS-011 | Closes DQ-OBS-006
Objective	Verify spray ball coverage of the storage vessel.

Method

1. Coat the internal surface of the vessel, including the headspace, with riboflavin solution.

2. Operate the spray ball at design flow and pressure for the design duration.

3. Inspect all internal surfaces under ultraviolet light.

4. Photograph any area showing residual fluorescence.

Acceptance criterion

No residual fluorescence on any internal surface, including the headspace and all internal fittings.

Test instrument	UV inspection lamp, riboflavin solution	Result
Performed by		Pass / Fail		Date

FAT-011 — Verify vent filter installation and heater function.

Test ID	FAT-011
Traces to	URS-012 | Closes DQ-OBS-007
Objective	Verify vent filter installation and heater function.

Method

1. Confirm filter rating and hydrophobic construction from the certificate.

2. Energise the heater and record surface temperature after 30 minutes.

3. Confirm the integrity test connection is present and accessible.

Acceptance criterion

Filter is 0.22 micrometre hydrophobic. Heater raises housing above dew point. Integrity test connection permits testing without breaking the sterile boundary.

Test instrument	Surface temperature probe	Result
Performed by		Pass / Fail		Date

FAT-012 — Verify overpressure and vacuum protection.

Test ID	FAT-012
Traces to	URS-053
Objective	Verify overpressure and vacuum protection.

Method

1. Confirm rupture disc rating and burst detection installation.

2. Verify the pressure and vacuum relief device rating against the design.

3. Function test the rupture disc burst detection signal.

Acceptance criterion

Rupture disc rated to design, burst detection signal reaches the control system and raises an alarm.

Test instrument	—	Result
Performed by		Pass / Fail		Date

FAT-013 — Verify the heat exchanger construction and interspace leak detection.

Test ID	FAT-013
Traces to	URS-010
Objective	Verify the heat exchanger construction and interspace leak detection.

Method

1. Confirm double tube sheet construction from the certificate and by visual inspection.

2. Confirm the interspace is drainable.

3. Introduce water into the interspace and confirm detection and alarm.

Acceptance criterion

Double tube sheet with drainable, monitored interspace. Leak detection raises an alarm at the control system.

Test instrument	—	Result
Performed by		Pass / Fail		Date

FAT-014 — Verify distribution pump performance and automatic changeover.

Test ID	FAT-014
Traces to	URS-009 | Closes DQ-OBS-004
Objective	Verify distribution pump performance and automatic changeover.

Method

1. Run the duty pump on potable water and record flow and head at three points on the curve.

2. Simulate duty pump failure.

3. Record time to standby pump start and flow restoration.

Acceptance criterion

Pump performance within the supplier curve tolerance. Standby starts automatically on duty failure and restores flow.

Test instrument	Calibrated flow meter and pressure gauges	Result
Performed by		Pass / Fail		Date

FAT-015 — Verify automatic duty rotation between distribution pumps.

Test ID	FAT-015
Traces to	URS-009 | Closes DQ-OBS-004
Objective	Verify automatic duty rotation between distribution pumps.

Method

1. Review the control system configuration for a duty rotation function.

2. If present, force the rotation interval and observe changeover.

Acceptance criterion

The control system rotates duty between pumps automatically at a configurable interval, so that neither leg remains stagnant.

Test instrument	—	Result
Performed by		Pass / Fail		Date

FAT-016 — Verify instrument loop checks and recording interval.

Test ID	FAT-016
Traces to	URS-017
Objective	Verify instrument loop checks and recording interval.

Method

1. For each instrument, apply a simulated input at 0, 50 and 100 percent of span.

2. Confirm the value displayed at the HMI and the value recorded.

3. Confirm the recording interval.

Acceptance criterion

Every loop reads correctly at all three points within instrument accuracy. Recording interval does not exceed one minute.

Test instrument	Calibrated signal simulator	Result
Performed by		Pass / Fail		Date

FAT-017 — Verify tank level control and alarms.

Test ID	FAT-017
Traces to	URS-015
Objective	Verify tank level control and alarms.

Method

1. Simulate level at each alarm setpoint in turn.

2. Confirm alarm annunciation and recording.

3. Confirm pump protection operates at low-low level.

Acceptance criterion

High, high-high, low and low-low alarms annunciate and are recorded. Pumps stop at low-low level.

Test instrument	Signal simulator	Result
Performed by		Pass / Fail		Date

FAT-018 — Verify alarm recording content.

Test ID	FAT-018
Traces to	URS-019
Objective	Verify alarm recording content.

Method

1. Raise three alarms of different types.

2. Acknowledge each under a named user account.

3. Clear each and review the alarm record.

Acceptance criterion

Each alarm record contains the condition, onset time, acknowledgement time, acknowledging operator and clearance time.

Test instrument	—	Result
Performed by		Pass / Fail		Date

FAT-019 — Verify emergency stop function.

Test ID	FAT-019
Traces to	URS-054
Objective	Verify emergency stop function.

Method

1. Operate the emergency stop at the skid.

2. Confirm the system enters the defined safe state.

3. Repeat at the remote pump station.

Acceptance criterion

Both emergency stops place the system in the defined safe state without creating a hazard from stored thermal energy.

Test instrument	—	Result
Performed by		Pass / Fail		Date

FAT-020 — Verify interlocks.

Test ID	FAT-020
Traces to	URS-055 | Closes DQ-OBS-038
Objective	Verify interlocks.

Method

1. Attempt pump start against a closed system.

2. Attempt to initiate sanitisation with a point of use simulated open.

Acceptance criterion

Pump start is prevented against a closed system. Sanitisation cannot be initiated while a point of use is open to an operator-accessible outlet.

Test instrument	—	Result
Performed by		Pass / Fail		Date

FAT-021 — Verify access control and user accounts.

Test ID	FAT-021
Traces to	URS-025
Objective	Verify access control and user accounts.

Method

1. Attempt login with a generic account.

2. Create a named account and log in.

3. Attempt an action outside the assigned role.

Acceptance criterion

Only named individual accounts permitted. Role permissions enforced. Generic accounts cannot be created.

Test instrument	—	Result
Performed by		Pass / Fail		Date

FAT-022 — Verify configured user roles.

Test ID	FAT-022
Traces to	URS-026
Objective	Verify configured user roles.

Method

1. Log in as each of the four roles in turn.

2. Confirm the permissions available match the functional specification.

Acceptance criterion

Operator, Supervisor, Engineer and Administrator roles present with permissions as specified.

Test instrument	—	Result
Performed by		Pass / Fail		Date

FAT-023 — Verify restriction of critical setpoint changes.

Test ID	FAT-023
Traces to	URS-027 | Closes DQ-OBS-025
Objective	Verify restriction of critical setpoint changes.

Method

1. Attempt to change sanitisation setpoints, alarm limits and calibration parameters at each role level.

2. Record which roles can change which parameters.

Acceptance criterion

Critical setpoints modifiable only by authorised roles, and every change recorded.

Test instrument	—	Result
Performed by		Pass / Fail		Date

FAT-024 — Verify session timeout.

Test ID	FAT-024
Traces to	URS-028
Objective	Verify session timeout.

Method

1. Log in and leave the session idle for the configured period.

2. Confirm the session locks and requires re-authentication.

Acceptance criterion

Session times out after the configured period and requires re-authentication to resume.

Test instrument	Stopwatch	Result
Performed by		Pass / Fail		Date

FAT-025 — Verify audit trail content.

Test ID	FAT-025
Traces to	URS-029
Objective	Verify audit trail content.

Method

1. Make a setpoint change under a named account.

2. Review the audit trail entry.

Acceptance criterion

Audit trail records operator, date, time, previous value and new value.

Test instrument	—	Result
Performed by		Pass / Fail		Date

FAT-026 — Verify that the audit trail cannot be disabled.

Test ID	FAT-026
Traces to	URS-030 | Closes DQ-OBS-027
Objective	Verify that the audit trail cannot be disabled.

Method

1. Log in as Administrator.

2. Attempt to disable the audit trail.

3. Attempt to edit or delete an audit trail entry.

Acceptance criterion

The audit trail cannot be disabled, edited or deleted by any user, including Administrator.

Test instrument	—	Result
Performed by		Pass / Fail		Date

FAT-027 — Verify audit trail review and export.

Test ID	FAT-027
Traces to	URS-031
Objective	Verify audit trail review and export.

Method

1. Filter the audit trail by date range and by user.

2. Attempt to export the filtered record.

Acceptance criterion

Audit trail is reviewable in the application with filtering, and exportable as a report over a selected period.

Test instrument	—	Result
Performed by		Pass / Fail		Date

FAT-028 — Verify that recorded values cannot be deleted or overwritten.

Test ID	FAT-028
Traces to	URS-024
Objective	Verify that recorded values cannot be deleted or overwritten.

Method

1. Attempt to delete a recorded value at each role level.

2. Make a correction and confirm the original is preserved.

Acceptance criterion

No function permits deletion or overwriting. Corrections create a new entry preserving the original.

Test instrument	—	Result
Performed by		Pass / Fail		Date

FAT-029 — Verify backup and restoration.

Test ID	FAT-029
Traces to	URS-023
Objective	Verify backup and restoration.

Method

1. Trigger a backup.

2. Restore the backup to a test instance.

3. Confirm records and audit trail are intact after restoration.

Acceptance criterion

Backup completes and restoration reproduces all GMP records and the associated audit trail.

Test instrument	—	Result
Performed by		Pass / Fail		Date

FAT-030 — Verify the sanitisation cycle sequence and completion logic.

Test ID	FAT-030
Traces to	URS-049 | Closes DQ-OBS-036
Objective	Verify the sanitisation cycle sequence and completion logic.

Method

1. Initiate a sanitisation cycle in simulation mode.

2. Observe the sequence of steps.

3. Force a simulated temperature failure at one monitored location and observe the cycle outcome.

Acceptance criterion

The cycle runs automatically and cannot be declared successful where any monitored location failed to achieve the required temperature and hold.

Test instrument	—	Result
Performed by		Pass / Fail		Date

FAT-031 — Verify sample valve type and installation.

Test ID	FAT-031
Traces to	URS-050
Objective	Verify sample valve type and installation.

Method

1. Identify every sample valve against the P&ID.

2. Confirm sanitary design and self-draining installation.

Acceptance criterion

Sanitary, self-draining sample valves at every location shown on the P&ID.

Test instrument	—	Result
Performed by		Pass / Fail		Date

FAT-032 — Verify instrument accessibility for calibration.

Test ID	FAT-032
Traces to	URS-051 | Closes DQ-OBS-041
Objective	Verify instrument accessibility for calibration.

Method

1. For each instrument requiring calibration, confirm access without dismantling major assemblies.

2. Confirm removability without breaching the loop where the system is in operation.

Acceptance criterion

All instruments accessible without dismantling. Removable without breaching the loop in operation.

Test instrument	—	Result
Performed by		Pass / Fail		Date

FAT-033 — Measure noise emission.

Test ID	FAT-033
Traces to	URS-057
Objective	Measure noise emission.

Method

1. Operate the skid at full duty.

2. Measure sound pressure level at one metre from the skid at four positions.

Acceptance criterion

Noise does not exceed 80 dB(A) at one metre.

Test instrument	Calibrated sound level meter, class 2 or better	Result
Performed by		Pass / Fail		Date

FAT-034 — Verify insulation and hot surface protection.

Test ID	FAT-034
Traces to	URS-038
Objective	Verify insulation and hot surface protection.

Method

1. Confirm insulation is fitted to all specified surfaces.

2. Where the skid is operated hot at the works, measure touchable surface temperature.

Acceptance criterion

No accessible surface exceeds 60 degrees C.

Test instrument	Surface temperature probe	Result
Performed by		Pass / Fail		Date

FAT-035 — Verify spare parts list and maintenance schedule.

Test ID	FAT-035
Traces to	URS-052
Objective	Verify spare parts list and maintenance schedule.

Method

1. Review the preventive maintenance schedule for task, frequency and duration.

2. Review the spare parts list for part numbers and availability statement.

Acceptance criterion

Maintenance schedule states task, frequency and duration. Spare parts list complete with part numbers and a ten-year availability statement.

Test instrument	—	Result
Performed by		Pass / Fail		Date

FAT-036 — Verify equipment tagging and nameplates.

Test ID	FAT-036
Traces to	General construction and safety verification
Objective	Verify equipment tagging and nameplates.

Method

1. Compare every tag on the skid against the P&ID and instrument index.

2. Confirm nameplate data on major items.

Acceptance criterion

All tags match the P&ID and instrument index. Nameplates present and legible on all major items.

Test instrument	—	Result
Performed by		Pass / Fail		Date

FAT-037 — Verify control panel construction and software version.

Test ID	FAT-037
Traces to	General construction and safety verification
Objective	Verify control panel construction and software version.

Method

1. Inspect the panel against the electrical schematics.

2. Record the PLC and HMI software versions and checksums.

Acceptance criterion

Panel built to schematic. Software versions and checksums recorded for configuration management.

Test instrument	—	Result
Performed by		Pass / Fail		Date

FAT-038 — Verify sanitisation record content.

Test ID	FAT-038
Traces to	URS-018 | Closes DQ-OBS-014
Objective	Verify sanitisation record content.

Method

1. Run a simulated sanitisation cycle under a named account.

2. Review the cycle record.

Acceptance criterion

The record contains the temperature profile at each monitored location, the hold achieved, the initiating operator and the outcome.

Test instrument	—	Result
Performed by		Pass / Fail		Date

FAT-039 — Verify sanitisation start confirmation and point-of-use lockout indication.

Test ID	FAT-039
Traces to	URS-056 | Closes DQ-OBS-039
Objective	Verify sanitisation start confirmation and point-of-use lockout indication.

Method

1. Initiate a sanitisation cycle.

2. Observe whether a positive confirmation step is required.

3. Observe point-of-use indication during the cycle.

Acceptance criterion

A positive confirmation step is required before start, and every point of use is visibly indicated as locked out for the duration.

Test instrument	—	Result
Performed by		Pass / Fail		Date

FAT-040 — Verify elastomer specification and compliance.

Test ID	FAT-040
Traces to	URS-045 | Closes DQ-OBS-030
Objective	Verify elastomer specification and compliance.

Method

1. Review the elastomer schedule and certificates.

2. Confirm compliance statements and stated service life.

Acceptance criterion

Elastomers comply with USP Class VI and 21 CFR 177.2600, suitable for continuous service at loop temperature, with stated service life.

Test instrument	—	Result
Performed by		Pass / Fail		Date

9. Worst-Case Condition Challenges

The specification identifies conditions under which the system is least able to meet its requirements. Four can be created at a works environment. The remainder require the installed system and are deferred with a stated reason; a deferral is a record, not an omission.

Ref	Condition	At FAT	Basis	Outcome / deferral
WC-05	Tank at minimum operating level	Challenged	FAT-010 verified spray ball coverage. Coverage was tested at the design flow and pressure with the vessel empty, which is the condition that exposes the full headspace.	Two shadowed areas found. See DEV-004.
WC-06	Maximum tank discharge rate	Challenged	Vent filter sizing and heater duty reviewed against the stated maximum discharge rate at FAT-011.	Filter and heater adequate. Integrity test access is the finding, not the sizing.
WC-07	Longest branch and standby pump leg	Challenged	FAT-006 measured every branch. FAT-015 tested for duty rotation.	Both elements failed. Nine branches exceed 3D and no duty rotation exists. DEV-001 and DEV-006.
WC-09	Highest point and longest horizontal run	Partially challenged	FAT-007 measured slope on skid pipework only.	Site-installed pipework slope is verified at IQ. Two skid runs already fail at 1:150.
WC-01	Maximum simultaneous demand	Not challengeable at works	The loop is not installed and the points of use do not exist at the supplier works. Loop hydraulics cannot be created.	Deferred to OQ. The supplier hydraulic calculation at this condition remains outstanding at DQ-OBS-045.
WC-02	Coldest point during normal circulation	Not challengeable at works	Requires the installed loop at operating temperature with site heating medium.	Deferred to OQ. The coldest point is not yet identified in the design.
WC-03	Least favourable point during sanitisation	Not challengeable at works	Requires the installed loop, site utilities and mapping ports which are not in the design.	Deferred to OQ. Mapping ports outstanding at DQ-OBS-044.
WC-04	Point-of-use cooler branch	Not challengeable	No cooler arrangement exists in the design.	Design resolution required before any stage can challenge this condition.
WC-08	Most hydraulically remote point of use	Not challengeable at works	Requires the installed loop.	Deferred to OQ.
WC-10	Extended low-demand period	Not challengeable at works	Requires extended operation in service.	Deferred to PQ.
WC-11	Worst-case feed water quality	Not challengeable at works	Requires the generation system and seasonal variation in service.	Deferred to PQ Phase 3.

10. Design Qualification Observation Closure

The following observations from DQ-WFI-001 are addressed by this protocol. Closure is recorded in the FAT report and the Design Qualification observation register is updated; no parallel register is created.

Observation	Test	Subject	Closed / Not closed
DQ-OBS-032	FAT-006	Verify dead leg dimensions against the specification.
DQ-OBS-006	FAT-010	Verify spray ball coverage of the storage vessel.
DQ-OBS-007	FAT-011	Verify vent filter installation and heater function.
DQ-OBS-004	FAT-014	Verify distribution pump performance and automatic changeover.
DQ-OBS-004	FAT-015	Verify automatic duty rotation between distribution pumps.
DQ-OBS-038	FAT-020	Verify interlocks.
DQ-OBS-025	FAT-023	Verify restriction of critical setpoint changes.
DQ-OBS-027	FAT-026	Verify that the audit trail cannot be disabled.
DQ-OBS-036	FAT-030	Verify the sanitisation cycle sequence and completion logic.
DQ-OBS-041	FAT-032	Verify instrument accessibility for calibration.
DQ-OBS-014	FAT-038	Verify sanitisation record content.
DQ-OBS-039	FAT-039	Verify sanitisation start confirmation and point-of-use lockout indication.
DQ-OBS-030	FAT-040	Verify elastomer specification and compliance.

11. Requirements Not Testable at Factory Acceptance

A supplier works cannot produce Water for Injection, cannot supply site utilities, and is not connected to the site network. The following requirements therefore cannot be verified here. Each is deferred to a named later stage and carried in the traceability matrix.

This section exists because a weakened test is worse than a deferred one. A water quality test performed on potable water, or a sanitisation test performed on plant steam, would produce a passing result that demonstrates nothing.

URS ID	Why it cannot be verified at the supplier works	Verified instead at
URS-001	WFI cannot be produced or supplied at the supplier works. Testing on potable water would not demonstrate the requirement.	PQ
URS-002	Peak demand is [TO BE CONFIRMED] in the URS, and true demand can only be created by the installed points of use.	OQ
URS-003	Requires extended operation in service.	PQ
URS-004	Tank capacity requirement is [TO BE CONFIRMED] in the URS.	IQ
URS-005	Point-of-use count is [TO BE CONFIRMED] in the URS. Points of use are installed at site.	IQ
URS-006	Requires operation in service following a planned shutdown.	PQ
URS-007	Loop temperature at the least favourable point requires the installed loop and site heating medium.	OQ
URS-008	Return velocity at operating conditions requires the installed loop with all points of use connected.	OQ
URS-013	No point-of-use cooler arrangement exists in the design. Nothing to test. See DQ-OBS-011.	Design resolution required
URS-014	Sanitisation temperature and hold time are [TO BE CONFIRMED] in the URS, and the cycle requires site utilities at temperature.	OQ
URS-016	Minimum dynamic pressure requirement is [TO BE CONFIRMED] in the URS. Pressure at the remote point requires the installed loop.	OQ
URS-020	Retention period is [TO BE CONFIRMED] in the URS.	OQ
URS-021	Enduring and available over the retention period cannot be demonstrated at a works test.	OQ
URS-022	Time synchronisation requires connection to the site time server.	SAT
URS-032	Interface to the WFI generation system requires the installed system.	SAT
URS-033	Interface to the site building management system requires the site network.	SAT
URS-034	Point-of-use interfaces require the installed points of use and connected equipment.	SAT
URS-035	Export to the laboratory information management system requires the site system. Not currently in the design. See DQ-OBS-033.	SAT
URS-036	Site utility envelope is [TO BE CONFIRMED] in the URS and the connections are made at site.	IQ
URS-037	Drain connections and air breaks are made at site.	IQ
URS-039	Slope of site-installed pipework. Skid pipework is tested at FAT-007.	IQ
URS-040	Routing through classified areas is a site installation matter.	IQ
URS-043	Passivation is performed after installation at site.	IQ
URS-063	Water quality against the monograph requires WFI in service.	PQ
URS-064	Conductivity, TOC, endotoxin and microbial limits require WFI in service and laboratory testing.	PQ
URS-069	The three-phase PQ programme runs in service over one year.	PQ
URS-070	Sample point installation is verified at site. Sample point type is verified at FAT-031.	IQ
URS-071	Temperature mapping ports at worst-case locations are a site installation matter. Ports are not shown in the design. See DQ-OBS-044.	IQ
URS-072	Hydraulic calculation at the worst-case demand condition is a design deliverable, not a works test. Outstanding at DQ-OBS-045.	DQ closure
URS-073	Traceability across the qualification programme cannot be closed at FAT.	VSR
URS-074	Ability to challenge worst-case conditions is confirmed once installed.	OQ
URS-059	FAT and SAT protocol provision is verified by this protocol existing; SAT protocol review is confirmed before SAT.	SAT
URS-060	IQ and OQ protocol and turnover package completeness is verified at delivery.	IQ
URS-062	Training delivery occurs at site.	SAT
URS-065	Qualification approach compliance is assessed across the programme.	VSR
URS-066	Part 11 applicability is unresolved at DQ-OBS-047 and requires site scope confirmation.	SAT

Total requirements deferred: 36. Requirements tested at FAT: 37.

12. Deviation Handling

Each failure is recorded at the point of occurrence with the test identifier, a factual description of what was observed, and the classification. Classification is agreed between the user witness and Quality Assurance at the time, not retrospectively.

The deviation log at Appendix B is completed during execution and reproduced in the FAT report. A deviation is closed only by a retest against the original acceptance criterion, or by a documented concession approved by Quality Assurance.

13. Punch List

Items requiring action before shipment or before Site Acceptance Testing are recorded here during execution.

Item	Description	Raised by	Owner	Due

14. Approval and Sign-off

Approval below authorises execution of this protocol. It does not constitute acceptance of the equipment.

Role	Name	Department	Signature	Date
Author		Engineering
Reviewer		CQV / Validation
Reviewer		Operations
Reviewer		Automation / IT
Reviewer		EHS
Quality approval		Quality Assurance

15. Revision History

Revision	Date	Description of change	Author
0.1	[DD-MMM-YYYY]	First draft.

Appendix A — Traceability

Every requirement of URS-WFI-001 against its FAT disposition. A requirement not tested here shows the stage at which it is verified instead.

URS ID	Requirement summary	FAT test	Disposition	Result
URS-001	The system shall store and distribute Water for Injection meeting the requirements of the curre…	—	Deferred to PQ
URS-002	The system shall deliver a peak instantaneous demand of [TO BE CONFIRMED] L/min and an average …	—	Deferred to OQ
URS-003	The system shall operate continuously, 24 hours per day, 7 days per week, with planned shutdown…	—	Deferred to PQ
URS-004	The storage tank shall have a nominal capacity of [TO BE CONFIRMED] L, sized to buffer peak dem…	—	Deferred to IQ
URS-005	The distribution loop shall serve [TO BE CONFIRMED] points of use, listed with their location, …	—	Deferred to IQ
URS-006	The system shall recover to full specification within [TO BE CONFIRMED] hours following a plann…	—	Deferred to PQ
URS-007	WFI shall be stored and distributed under continuous hot circulation at a temperature not less …	—	Deferred to OQ
URS-008	The distribution loop shall maintain a return flow velocity of not less than 1.0 m/s, or a demo…	—	Deferred to OQ
URS-009	The system shall be fitted with duty and standby distribution pumps with automatic changeover o…	FAT-014	Tested at FAT
URS-010	Loop temperature shall be maintained by a heat exchanger of double tube sheet construction with…	FAT-013	Tested at FAT
URS-011	The storage tank shall be fitted with a spray ball providing demonstrated full wetted coverage …	FAT-010	Tested at FAT
URS-012	The storage tank shall be fitted with a hydrophobic vent filter of 0.22 micrometre rating, elec…	FAT-011	Tested at FAT
URS-013	Points of use requiring water below loop temperature shall be served by dedicated point-of-use …	—	Deferred to Design resolution required
URS-014	The system shall provide a thermal sanitisation cycle capable of raising every point in the loo…	—	Deferred to OQ
URS-015	Tank level shall be controlled automatically, with high, high-high, low and low-low alarms, and…	FAT-017	Tested at FAT
URS-016	The system shall deliver a minimum dynamic pressure of [TO BE CONFIRMED] bar g at the most hydr…	—	Deferred to OQ
URS-017	The control system shall continuously record loop supply temperature, loop return temperature, …	FAT-016	Tested at FAT
URS-018	The system shall record every sanitisation cycle, capturing the temperature profile at each mon…	FAT-038	Tested at FAT
URS-019	All alarms shall be recorded with the alarm condition, time of onset, time of acknowledgement, …	FAT-018	Tested at FAT
URS-020	Records shall be retained for not less than [TO BE CONFIRMED] years and shall be exportable in …	—	Deferred to OQ
URS-021	Records shall be attributable, legible, contemporaneous, original and accurate, and shall remai…	—	Deferred to OQ
URS-022	The system clock shall synchronise with the site time server. Users shall not be able to alter …	—	Deferred to SAT
URS-023	The system shall support automated backup of all GMP records, and restoration of those records …	FAT-029	Tested at FAT
URS-024	No function shall permit deletion or overwriting of a recorded value. Corrections shall be made…	FAT-028	Tested at FAT
URS-025	The control system shall provide role-based access control with individual named user accounts.…	FAT-021	Tested at FAT
URS-026	The system shall provide at least the roles Operator, Supervisor, Engineer and Administrator, w…	FAT-022	Tested at FAT
URS-027	Critical setpoints, including sanitisation temperature and hold time, alarm limits and calibrat…	FAT-023	Tested at FAT
URS-028	The system shall enforce automatic session timeout after a configurable period of inactivity, a…	FAT-024	Tested at FAT
URS-029	The system shall maintain a secure, computer-generated, time-stamped audit trail recording the …	FAT-025	Tested at FAT
URS-030	The audit trail shall not be editable or disableable by any user, including administrators, and…	FAT-026	Tested at FAT
URS-031	The system shall support periodic audit trail review, with a filterable view and an exportable …	FAT-027	Tested at FAT
URS-032	The system shall interface with the upstream WFI generation system, exchanging demand signal, g…	—	Deferred to SAT
URS-033	The system shall provide monitored signals to the site building management system for alarm ann…	—	Deferred to SAT
URS-034	The system shall provide the physical and electrical interface at each point of use defined in …	—	Deferred to SAT
URS-035	Where sample results are managed in a laboratory information management system, the system shal…	—	Deferred to SAT
URS-036	The system shall operate within the site utility envelope: electrical supply [TO BE CONFIRMED],…	—	Deferred to IQ
URS-037	All drain connections shall discharge through an air break to prevent backflow, and shall be vi…	—	Deferred to IQ
URS-038	All hot surfaces accessible to personnel shall be insulated or guarded such that touchable surf…	FAT-034	Tested at FAT
URS-039	Pipework shall be installed with a continuous fall of not less than 1 in 100 towards designated…	FAT-007	Tested at FAT
URS-040	Loop pipework routed through classified areas shall be finished and supported so as not to comp…	—	Deferred to IQ
URS-041	All product contact surfaces shall be stainless steel 316L, with a mechanically polished and el…	FAT-003	Tested at FAT
URS-042	All product contact welds shall be automatic orbital welds. A weld log shall be maintained, and…	FAT-004	Tested at FAT
URS-043	The system shall be passivated after installation in accordance with a documented procedure, an…	—	Deferred to IQ
URS-044	Material certificates in accordance with EN 10204 Type 3.1 shall be provided for all product co…	FAT-002	Tested at FAT
URS-045	Elastomers and polymers in product contact shall comply with USP Class VI and 21 CFR 177.2600, …	FAT-040	Tested at FAT
URS-046	All valves in product contact shall be sanitary diaphragm valves of zero static or zero dead le…	FAT-005	Tested at FAT
URS-047	No dead leg in the distribution system shall exceed three internal pipe diameters (3D), measure…	FAT-006	Tested at FAT
URS-048	The complete system, including the tank, loop, all branches and all points of use, shall be ful…	FAT-008	Tested at FAT
URS-049	The sanitisation cycle shall be initiated from the operator interface, shall run automatically,…	FAT-030	Tested at FAT
URS-050	Sample valves at each sampling location shall be of sanitary design, self-draining, and shall p…	FAT-031	Tested at FAT
URS-051	All instruments requiring calibration shall be accessible without dismantling major assemblies …	FAT-032	Tested at FAT
URS-052	The supplier shall provide a preventive maintenance schedule stating each task, its frequency a…	FAT-035	Tested at FAT
URS-053	The storage tank shall be protected against overpressure and vacuum by a rupture disc and a pre…	FAT-012	Tested at FAT
URS-054	An emergency stop shall be provided at the skid and at each remote pump location, placing the s…	FAT-019	Tested at FAT
URS-055	Interlocks shall prevent operation of distribution pumps against a closed system and shall prev…	FAT-020	Tested at FAT
URS-056	Sanitisation shall not be capable of being started without a positive confirmation step, and ev…	FAT-039	Tested at FAT
URS-057	Noise emitted by the system shall not exceed 80 dB(A) measured at one metre under normal operat…	FAT-033	Tested at FAT
URS-058	The supplier shall provide, prior to Factory Acceptance Testing: general arrangement drawings, …	FAT-001	Tested at FAT
URS-059	The supplier shall provide FAT and SAT protocols for user review and approval not less than fou…	—	Deferred to SAT
URS-060	The supplier shall provide IQ and OQ protocols and supporting documentation aligned with EU GMP…	—	Deferred to IQ
URS-061	The supplier shall provide operation and maintenance manuals, a spare parts list with part numb…	—	Not in FAT scope
URS-062	The supplier shall provide training for operators, maintenance personnel, and quality and valid…	—	Deferred to SAT
URS-063	The system shall comply with the current USP and Ph. Eur. monographs for Water for Injection an…	—	Deferred to PQ
URS-064	WFI delivered at every point of use shall meet: conductivity in accordance with USP General Cha…	—	Deferred to PQ
URS-065	The system shall be designed, installed and qualified in accordance with EU GMP Annex 15 and th…	—	Deferred to VSR
URS-066	The control system shall comply with EU GMP Annex 11 and, where applicable to the site, 21 CFR …	—	Deferred to SAT
URS-067	The system shall be designed and documented in accordance with GAMP 5, and the supplier shall s…	—	Not in FAT scope
URS-068	Equipment design shall follow ASME BPE for hygienic design, surface finish, fabrication and exa…	—	Not in FAT scope
URS-069	The system shall support a three-phase Performance Qualification: Phase 1 with daily sampling o…	—	Deferred to PQ
URS-070	Sample points shall be provided at the tank outlet, the loop supply, the loop return, each sub-…	—	Deferred to IQ
URS-071	Temperature mapping ports shall be provided at each worst-case location listed in Appendix A, s…	—	Deferred to IQ
URS-072	The supplier shall provide hydraulic calculations demonstrating that the minimum return velocit…	—	Deferred to DQ closure
URS-073	Every requirement in this specification shall be traceable through design qualification, factor…	—	Deferred to VSR
URS-074	The system shall permit challenge of the worst-case conditions listed in Appendix A during qual…	—	Deferred to OQ

Appendix B — Deviation Log

Completed during execution.

Deviation	Test	Description	Classification	Status

Appendix C — Abbreviations

Term	Definition
DQ	Design Qualification
DEV	Deviation
FAT	Factory Acceptance Test
HMI	Human Machine Interface
IQ	Installation Qualification
OQ	Operational Qualification
P&ID	Piping and Instrumentation Diagram
PL	Punch list item
PQ	Performance Qualification
PLC	Programmable Logic Controller
Ra	Roughness average
SAT	Site Acceptance Test
URS	User Requirements Specification
VSR	Validation Summary Report
WFI	Water for Injection