EWIElectronic Work Instructions

Electronic Work Instructions — EWI — are the operator-facing presentation of a procedure on a Level-3 MES kiosk. They are not a PDF on a touchscreen. A PDF is a passive document an operator reads; an EWI is an active workflow that sequences each step, refuses to advance until the step's required inputs are present, captures every reading with operator + timestamp + (where required) e-signature, and writes the full interaction trail to the regulated record as it happens.

The distinction matters because the regulations care about it. 21 CFR 211.188 requires "a complete record of each batch produced and the controls exercised over the batch" and is explicit that the record must be made "at the time each step is performed". A PDF-on-a-screen procedure read by an operator who then later writes the values down (or types them into a spreadsheet) does not meet that bar. An EWI does, because the data capture is the procedure execution.

Every credible MES — including V5 Ultimate — ships EWI as its primary execution surface. The kiosk tile is the EWI; the dispense screen is the EWI; the in-process check screen is the EWI; the line-clearance checklist is the EWI. There is no separate "work instruction document" that lives outside the MES. The procedure and the execution are the same artefact, in two states: master (approved, immutable) and instance (an in-flight or completed work order).

Most regulated manufacturers have lived through some combination of three execution surfaces. The differences are not cosmetic.

An ISA-88 phase — the atomic unit of a procedure — becomes one or more EWI steps on the kiosk. Each step has a predictable structure.

1. Step header — what the operator is being asked to do, in plain language drawn directly from the SOP / MMR / DMR. No interpretation by the operator; the step text is what was approved.
2. Required reading — training acknowledgements, SOP version, MSDS (if hazardous chemicals are present). The step does not advance until the required reading is current.
3. Equipment binding — which line, which balance, which mixer, which press. If the bound equipment is out of calibration, under maintenance or wrong-grade for the product, the step refuses to start.
4. Material binding — which lot is being consumed. The kiosk scans the license plate / barcode, verifies status (released, in date, not on quarantine, FEFO-correct), and binds it to the step.
5. Data capture — weights, volumes, temperatures, pH, durations, in-process check results, photos, comments. Captured by typing or by a connected device (balance, vision system, pH meter, scanner, IoT sensor).
6. Limit enforcement — every captured value is compared against the procedure's tolerances. A value out of range either prompts a deviation, blocks the step, or both, depending on the procedure's risk class.
7. E-signature — for steps that require it (per Part 11 §11.10(j) and §11.50), a username + password (and on locked kiosks a biometric / RFID badge) attests the action. The signature is bound to the step row in the operations DB, not a free-floating signature image.
8. Audit-trail write — every interaction (start, advance, deviate, sign, abandon, resume) writes a row to the audit trail with user, timestamp, before/after value, reason.

A naïve EWI is a strict linear sequence: step 1 → step 2 → step N. Real procedures are more interesting. The serious MES platforms (V5 Ultimate included) implement the full ISA-88 procedural model on the kiosk.

Linear sequence

The default. Step N+1 does not appear until step N is signed off. Used wherever the procedure is genuinely serial — most line-clearance, charge-in, dispense and packout sections.

Parallel branches

An operation may permit two phases to run in parallel on different equipment (e.g. blend prep on the IBC while the milling station finishes the prior charge). The EWI shows both queues; either operator can advance either branch; the merge point waits for both branches to complete before the next step appears.

Conditional branches

An in-process check result determines the next step. "If pH within range → proceed; if pH out of range → invoke acid/base adjustment sub-procedure → re-check." The branch is procedure-defined, not operator-improvised — the operator never chooses, the EWI evaluates the captured value and routes the workflow.

Loops and re-checks

Some procedures re-sample until a tolerance is met (e.g. moisture-content sampling during drying). The EWI captures each iteration as its own audit-trail row; the loop exits when the procedure's exit condition is met, and the full iteration history feeds the batch record.

Holds and resume

A deviation or a planned pause puts the work order on hold. The kiosk shows the held state, the reason, and who placed the hold. Resume requires an e-signature from a qualified user. The audit trail captures hold + resume as two events with the gap reason recorded.

An EWI step can capture data in several modes. The mode is procedure-defined, not operator-discretion.

ALCOA+ — the nine principles regulators apply to GxP data — is the test every regulated record has to pass. A properly built EWI satisfies all nine by construction.

21 CFR Part 11 §11.10 requires controls for closed systems including limited access, audit trails, sequence-of-events controls, authority checks, device checks and signature-record linking. Annex 11 §9 requires audit trails; §12 requires security; §14 requires e-signatures equivalent to wet-ink. An EWI satisfies each of these as part of its normal operation, not as a separate compliance overlay.

An EWI step cannot be executed by an operator who is not qualified for it. A serious MES enforces this at the step level, not just at the work-order level.

• Document control — the SOP version that defines this step must be acknowledged by the operator on the current effective version. If the SOP was revised at 09:00 and the operator's acknowledgement is on the prior version, the step blocks at 09:01.
• Training matrix — the operator's training matrix must list the procedure / class / piece of equipment, with the qualification in date. Expired training is a hard block, not a warning.
• Skill-based dispatch — when the EWI queue is built, only steps the operator is qualified for appear. An operator who is qualified to dispense API but not to operate the tablet press only sees the dispense steps in their queue.
• Permission roles — operator, reviewer, supervisor, QA. Some EWI events (release, deviation closure, hold-override) require a role escalation; the kiosk prompts for the higher-permission signature.
• Concurrent occupancy — V5's concurrent-seat licensing enforces that only one operator is logged into any given kiosk at a time, with the session's actions all attributable to that user; switching operators requires sign-out + sign-in.

An EWI does not appear by magic. It is authored as part of the procedure (MMR for pharma, DMR for medical device, master batch instruction for food / supplements) and approved through the same two-person e-signature process that any regulated master document goes through.

1. Author the procedure — procedure header, equipment requirements, material requirements (BOM), step-by-step instructions with tolerances and signatures. Authored in V5 against the same schema the kiosk will execute against; no separate "work-instruction editor" outside the master.
2. Two-person e-sig approval — preparer + independent reviewer per 21 CFR 211.186 / 111.205 / 820.40. The master becomes immutable; edits create v+1.
3. Training assignment — the document-control layer assigns the new (or revised) procedure to the trained-operator pool; operators acknowledge on the current effective version.
4. Work-order release — when a work order is released against the master, V5 deep-copies the full procedure into work_orders.mmr_snapshot. The kiosk EWI executes against the snapshot, not the live master — guaranteeing that an in-flight WO is not affected by a procedure revision mid-batch.
5. Execution — the kiosk surfaces the EWI steps from the snapshot. Captures, signatures, deviations all write back to the operations DB with the snapshot reference.
6. Batch record render — the eBMR / eDHR / batch production record is a deterministic render of the operations DB rows against the snapshot. The PDF is reproducible — same WO, same render, byte-for-byte.

EWI is not itself a regulation; it is the operating model that makes the regulations satisfiable without paper. The relevant clauses for each industry are well known to anyone who has stood in front of an inspector.

• 21 CFR 211.188 (pharma) — batch production and control records must show "complete information relating to the production and control of each batch", including "a statement of each significant step in the manufacture". An EWI is the literal step-by-step capture of that information.
• 21 CFR 211.100 (pharma) — written procedures, deviations must be recorded and justified. The EWI's deviation event + reason + e-signature is exactly that record.
• 21 CFR 820.184 (medical device) — DHR must contain dates of manufacture, quantity manufactured, quantity released for distribution, acceptance records, primary identification label, and any device identification and control number used. Each is an EWI step output.
• 21 CFR 820.70(a) (medical device) — production processes must be controlled to ensure conformance. The EWI's enforced sequencing + limit checking + equipment binding is the control.
• 21 CFR 111.255 (dietary supplements) — batch production records must include identity of equipment, identity of components used, results of monitoring and verification. All EWI outputs.
• EU GMP Annex 11 §4 (computerised systems) — validation. The EWI is what the validation pack validates against — IQ for the kiosks, OQ for the workflows, PQ for the live production runs.
• PIC/S PI 041-1 §6 — data integrity by design. The PIC/S guidance explicitly favours systems where data capture is part of execution (i.e. EWI) over systems where data is transcribed later.

Mistake 1 — "Digital procedure" that is a PDF viewer

If the operator reads the procedure on a tablet but records the values somewhere else, you do not have an EWI; you have a PDF viewer. The regulator's question is "where was the value first captured?" — and the answer has to be "in the EWI" for the record to be original under ALCOA+.

Mistake 2 — Free-typed values without limit enforcement

An EWI that accepts any number an operator types is a transcription tool, not a control. The procedure's tolerances must be enforced at capture — out-of-range either prompts a deviation or blocks the step. Logging the violation post-hoc is not enforcement.

Mistake 3 — Single signature on critical steps

Formula approval, batch release, deviation closure, master revision — all require two-person e-signature per 21 CFR §11.200 and CGMP cross-references. A single signature on these steps is a 483 waiting to be written.

Mistake 4 — Editable history ("correct the last reading")

ALCOA+ requires original + complete. A correction must be a new event with reason, not an overwrite. The audit trail must show both the original value and the corrected value with the user / time / reason of the change.

Mistake 5 — Skipping equipment / material binding

An EWI step that does not bind which equipment and which lot was used cannot support genealogy. Genealogy is the deliverable; binding is the input. If the kiosk is happy to accept "some balance" and "some lot", the eBMR cannot say "balance #4 / lot LSN-2026-118" — and the batch record is incomplete.

V5's kiosk is, end-to-end, an EWI engine. Every tile on the kiosk — Dispense, Blend, Charge-in, Line Clearance, In-Process Check, Sample, Pack-out, Release — is an EWI workflow rendered from the work_orders.mmr_snapshot.

• ISA-88 phase-level execution — V5 renders procedures at the phase level, with sequencing modes (linear, parallel, conditional, loop), container modes (single, shared, reusable), and station modes (single, parallel).
• Enforced equipment + material binding — every step binds the bound equipment and consumed lot to the step row; calibration / training / qualification all check at start, not at audit.
• Connected device capture — RS-232 / USB / Bluetooth balances, OPC UA / Modbus instruments, USB / Bluetooth HID scanners, kiosk camera for vision and photos.
• ALCOA+ by construction — DB rows are the original; signed PDFs render from rows; corrections are events, not overwrites; full audit trail.
• Industry-aware terminology — process tenants see "Formula / Dispense / BMR"; discrete tenants see "Product / Kit / DHR"; the EWI surface adapts via useIndustryProfile(), without code duplication.
• Concurrent-seat licensing — operator sign-in is concurrent-session controlled; switching users requires sign-out + sign-in; actions are attributable to the captured user, not the kiosk.
• Mobile-safe at ≤390 px — every EWI step renders cleanly on a 5" rugged-Android kiosk without horizontal scroll; tables collapse to stack on the narrowest viewport.