Control Recipe

ISA-88 defines four recipe levels — General, Site, Master, Control. The first three are reusable templates. The fourth, the Control Recipe, is single-use: it exists for one batch, carries that batch's identity, and dies when the batch closes.

• Batch identifier — the lot/batch number that will appear on the BMR and on every label.
• Target batch size — the actual quantity for this run, may differ from master's nominal within the allowed bracket.
• Equipment allocation — specific unit instances assigned at release time (Reactor R-201, Drier D-3).
• Material lots — specific lots reserved for this batch (replacing the master's generic component references).
• Calculated setpoints — agitation, temperature, ramp rates resolved from any master-recipe formulas.
• Scheduled IPCs — sampling points with planned timestamps relative to phase start.
• Operator/reviewer assignments — trained personnel rosters for the planned shifts.

1. Planner releases the work order against a master recipe and target batch size.
2. MES snapshots the entire master recipe into the WO (immutable JSONB).
3. MES generates the control recipe by binding equipment, lots, setpoints, IPC times.
4. Equipment-arbitration step allocates specific unit instances; rejects if any required unit is unqualified, dirty, or calibration-due.
5. Material-reservation step picks lots (FEFO/FIFO/specific-lot per master) and places reservations in inventory.
6. Setpoint resolution — any master-recipe formulas (e.g. "agitation 50 rpm per 100 L") are evaluated against the actual batch size.
7. Roster check — trained operators available for the planned shifts; otherwise WO release is blocked.
8. Control recipe materialises into the kiosk tile + PLC download buffer; WO state moves to Released.

Once a batch starts, the control recipe is read by two consumers:

• The MES kiosk surfaces manual phases (dispense, sample, visual check) one at a time, with the parameters from the control recipe and the live tolerance bands.
• The control system (DCS/PLC) downloads automated phases as ISA-88 sequential function charts; phase state changes (idle → running → complete) are reported back to the MES.
• Both sides write to the same batch record. A manual dispense and an automated reactor heating are equally bound to the control recipe and equally captured in the BMR.

When a phase completes, the control recipe advances to the next operation. Conditional branches (if assay < 90%, run rework phase) are resolved at runtime against IPC results.

A control recipe is mutable only through a formal deviation. The change must be:

• Justified — written rationale tied to a deviation ID.
• Approved — appropriate QA role per the deviation matrix.
• Bounded — must stay inside the master recipe's design space (or escalate).
• Audit-trailed — before/after captured under Part 11 + Annex 11.

• Generating the control recipe from the live master instead of the snapshot — opens a window where a mid-process master revision corrupts an in-flight batch.
• Allowing equipment allocation after start — risks an unqualified unit being grabbed during a phase change.
• Material lot substitution at the kiosk without deviation — silent change of formulation.
• Operator-edited setpoints without deviation — Part 11 violation.
• Control recipe stored as a flat copy of the master instead of as a derived child — cannot reconstruct lineage at audit.
• Conditional branches not implemented; operator decides on the floor whether to do rework — undocumented logic.
• Roster check skipped — untrained operator executes a critical step.
• Batch ID assigned after start — labels printed during execution carry the wrong ID.