Recipe Author Workflow

Recipe author workflow is the governed MES process to translate process design into ISA‑88 recipes and executable logic. It spans drafting operations and phases, defining parameters and materials, binding to equipment models, conducting technical and quality review, impact assessment, verification in a test environment, and controlled release to production. The workflow ensures every change is attributable, contemporaneous, legible, original, and accurate (data integrity), with audit trails and electronic signatures meeting 21 CFR Part 11 and EU Annex 11 expectations.

Practically, it is where unit procedures, operations, and phases are constructed; phase class libraries are reused; critical process parameters (CPPs) and setpoints are constrained; materials and IDs are validated; and interlocks and permissives are defined so that a master recipe can reliably generate control recipes for batches and campaigns, with full traceability to the approved master and its change history.

ISA‑88 defines four recipe types—General, Site, Master, and Control—plus the procedural model (process, process stage, operation, phase). Recipe authoring normally operates at Master (authoritative, reusable definition) and Control (equipment-bound, batch-specific) tiers, while optionally leveraging a Site layer for plant-specific constraints and a General layer for corporate process know‑how. The workflow must keep these separations clear: equipment‑independent logic at appropriate levels and equipment bindings where warranted.

• General recipe: company-level know‑how; equipment‑independent operations and parameters.
• Site recipe: local constraints (utilities, capacities, local specs) layered on general content.
• Master recipe: approved, versioned definition used to generate control recipes.
• Control recipe: execution instance with resolved equipment, lots, setpoints, and effectivity.

Recipe authoring must implement role-based access control with segregation of duties across Author, Technical Reviewer (process/equipment SME), QA/QC Reviewer, and Final Approver/Release Authority. Electronic signatures require unique credentials, meaning, and intent, with secure, computer-generated timestamped audit trails for create/modify/approve activities to meet 21 CFR Part 11 and Annex 11.

• Author: constructs phases/operations, parameters, and materials; drafts justification and risk notes.
• Technical Reviewer: verifies S88 conformance, equipment bindings, interlocks, and data types/units.
• QA/QC Reviewer: checks GMP compliance, data integrity, CPP/CQA alignment, sampling/gate steps.
• Approver/Release: authorizes use, sets effectivity, ensures change control and training are closed.

Where risk dictates, two-person verification can be enforced for critical elements (e.g., formula-locked steps, CPP setpoint ranges). MHRA’s GxP data integrity guidance underscores contemporaneous recording, audit trails, and restrictive permissions to protect recipe content across its lifecycle.

A robust lifecycle resembles a controlled document path but adds model-based testing: Draft → Impact Assessment → Technical Review → QA Review → Simulation/Test → Approval → Release with effectivity windows → Periodic Review/Retire. Versioning includes major/minor semantics, effectivity dates, and applicability rules (e.g., equipment models, product codes, markets). In-flight batches remain bound to their originating control recipe; promotion strategies must avoid mid-batch changes.

1. Draft and link to Change Control (ICH Q10) with risk rationale and acceptance criteria.
2. Run configuration checks; simulate procedural logic against equipment model stubs.
3. Technical and QA reviews; capture comments and rework loops with traceability.
4. Approval with Part 11-compliant signatures; set effectivity and training prerequisites.
5. Promote to production environment; monitor first-use batch; trigger periodic review.

GAMP 5 (2nd ed.) supports risk-based testing proportional to impact: high-risk steps (e.g., sterile boundary moves, dose-setting) warrant deeper verification and negative testing, while low-risk guidance steps can leverage supplier evidence and configuration checks.

To scale safely, authoring leverages class libraries: phase classes (e.g., Heat, Agitate, Transfer), procedure function charts (SFC/SFC-like), unit classes, and equipment modules. Parameters are typed (engineering units, ranges, defaulting rules, calculation formulas), validated, and often tied to CPPs/CQAs. Materials references bind to master data (item/spec codes), with sampling and test gates integrated.

• Phase class library: reusable, validated logic with defined I/O, alarms, and unit sets.
• Unit class library: capabilities and constraints (capacity, agitation range, CIP/SIP states).
• Parameter governance: unit conversion, value ranges, precision, and locking for CPPs.
• Material bindings: item/spec IDs, status checks, expiry/FEFO, and test release gates.
• Interlocks/permissives: equipment state, environmental constraints, and prerequisite confirmations.

Recipe parameters should include metadata (criticality, verification level, witness requirement, change category) to drive authoring checks and execution controls automatically.

For drugs, 21 CFR 211.186 requires controlled master production and control records; 211.188 covers batch records produced during execution. Recipe authoring bridges the two: it is where master content is created and constrained so execution yields accurate batch records. Part 11 and Annex 11 require validated systems, secure audit trails, role-based access, and binding of signatures to records. MHRA emphasizes metadata integrity and contemporaneous entries; these extend to recipe metadata (parameters, ranges, materials).

• Audit trail: creation, modification, approval, effectivity, and decommission timestamps with reason codes.
• Electronic signatures: dual signatures where risk warrants (e.g., critical parameter updates).
• Traceability: link from control recipe to master version, change control, and training records.
• Archival and retrieval: version freeze, export with context (units, libraries, equipment models).
• Periodic review: control to detect drift vs. registered filings and validated state.

Recipe authoring is a Level 3 (MES) responsibility, but it consumes and produces data across ISA‑95 interfaces. Materials (ERP), specifications (QMS/LIMS), equipment status (CMMS/SCADA), and training status (QMS) often gate authoring and release. BOM/routing from ERP aligns with recipe materials and procedural steps; LIMS test definitions drive in‑process and release gates; WMS provides lot/expiry controls and FEFO at execution.

A managed promotion process (DEV → TEST/VAL → PROD) with configuration baselines and checksum/hash validation reduces integration drift. Material and equipment master data synchronization is critical for error‑free instantiation of control recipes.

Recipe authoring functions in a configurable MES are typically GAMP Category 4 (configured) or include Category 5 elements (custom scripts/plug‑ins). Apply ICH Q10/Annex 11 principles and GAMP 5 guidance: scale effort to risk and intended use. Validate the authoring workflow (not only execution) including RBAC, audit trail, versioning, promotion, and e-signatures; test negative paths (unauthorized changes, invalid units, out‑of‑range setpoints) and traceability to URS.

1. Define URS for authoring (roles, approvals, versioning, audit trail, effectivity, promotion).
2. Risk assess functions by impact on patient/user/product quality; prioritize CPP/CQA controls.
3. Qualify environments and promotion controls; test segregation (DEV/VAL/PROD).
4. Verify Part 11/Annex 11 controls: unique IDs, signature meaning, record binding, and audit trail.
5. Establish periodic review, backup/restore tests, and disaster recovery for recipe assets.

Good authoring anticipates execution errors and enforces safeguards: formula-locked steps, forced verification/witnessing on critical steps, parameter tolerance bands, and interlocks. Use consistent units and auto‑conversion; include context prompts and photos/diagrams for human steps (especially devices/packaging). Define exception handlers with controlled deviations and automatic QA holds where risk demands.

• Forced signature steps and two-person e-signature for high-risk operations.
• Permissive conditions linked to equipment states, calibrations, and environmental limits.
• Material identity checks (barcode/GTIN), expiry/FEFO enforcement, and test‑gate steps.
• Alarm rationalization: actionable checks, no “nuisance” confirmations that drive workarounds.
• Batch pause/resume rules; mid-batch recipe change prohibition except via documented deviation.

Document rationale for locked steps and criticality mapping to CPPs/CQAs; align with submission/registration ranges or device DMR controls as applicable.

V5 Ultimate implements a role‑segregated authoring studio with phase/unit class libraries, parameter governance (units, ranges, criticality), simulation, and promotion gates. It binds recipes to item/spec master data, equipment models, and QA test plans; every draft, review, and approval is captured with Part 11‑compliant signatures and audit trails. Release sets effectivity and training prerequisites; in‑flight batches continue on the originating control recipe until closed.

Common failure modes include authoring outside the MES (spreadsheets/scripts) without audit trails; copying control recipes instead of maintaining a master; weak effectivity rules that flip mid‑batch; mixing equipment logic with process logic; inadequate testing of unit conversions and ranges; and promotion without controlled environments. Inspectors often sample the recipe’s change history, impact assessment, and consistency between master content and executed EBR/eDHR data.

• Verify every control recipe instance traces to a single, immutable master version.
• Enforce unit typing and conversion; disallow free‑text numeric entries for CPPs.
• Require documented impact assessments aligned to ICH Q10 for every material/parameter change.
• Baseline and checksum recipe libraries before and after promotion; archive snapshots.
• Train authors on S88 boundaries; periodically review libraries for drift and redundancy.