Total physical separation between autoclave control and monitoring instrumentation is one valid solution — but it isn’t the only one. Modern integrated PLC-based systems can deliver superior compliance with the same provision.
Introduction
Annex 1 §8.50 of the EU GMP guidelines states:
“Each heat sterilisation cycle should be recorded either electronically or by hardcopy, using equipment with suitable accuracy and precision. The system should have safeguards and/or redundancy in its control and monitoring instrumentation to detect a cycle not conforming to the validated cycle parameter requirements and abort or fail this cycle (e.g., by the use of duplex/double probes connected to independent control and monitoring systems).”
This provision has often been interpreted as a requirement for complete separation between control and monitoring systems. That interpretation prioritises physical separation without considering advancements in modern control technologies — and the real drawbacks of strict separation, such as reduced real-time verification and inefficient data management.
Historical context: where the separation requirement came from
Traditional sensor separation practices emerged in an era of analog control systems where interference and limited processing capabilities necessitated independent monitoring and control systems. Older electromechanical systems could not reliably process multiple outputs, leading to the adoption of redundant but separate monitoring approaches to maintain accuracy.
Against that backdrop, Annex 1 §8.50 recommended double sensors connected to independent systems to prevent control-system influence over monitoring functions. But modern control systems — PLCs and SCADA — offer advanced input processing, real-time validation, and enhanced data integrity, which challenges the necessity of strict physical separation.
The two configurations
Configuration 1 — Total Separation
- Sensor 1 connects to the PLC, which both controls the system and monitors Sensor 1
- Sensor 2 connects to an independent chart recorder, which monitors Sensor 2
- No communication exists between the two systems, ensuring strict separation
Configuration 2 — Integrated System
- Both sensors are connected to the PLC
- The PLC controls the autoclave valve and transmits data to the HMI, which monitors both sensor readings
- The system integrates monitoring and control, allowing real-time cross-checking
Debunking the myth: must double sensors be fully independent?
Many assume that double sensors must be connected to completely independent systems to comply with §8.50. However:
- Independent systems increase risk. Without real-time comparison, discrepancies are identified only through manual review — increasing the likelihood of human error and delayed detection of sensor malfunctions
- Integrated systems enhance reliability. Real-time cross-checking improves discrepancy detection, sensor-drift identification, and calibration verification, ensuring continuous data integrity and faster issue resolution
The impact of total separation on reliability
Total separation eliminates real-time cross-verification, which is essential for maintaining sensor accuracy. Manual comparison between independent systems is prone to human error and delays in identifying deviations. Conversely, integrated systems:
- Enable automated real-time verification
- Reduce the risk of unnoticed sensor drift or calibration issues
- Improve overall process reliability by allowing immediate intervention
Optimising redundancy using double sensors
To meet §8.50 while improving efficiency, a more effective approach involves:
- Simultaneous sensor connection. Both sensors connect to a single PLC or SCADA system for real-time comparison
- Continuous discrepancy monitoring. Automated alerts when sensor readings exceed predefined thresholds
- Alarm triggers & cycle aborts. Immediate alarms or cycle termination if discrepancies indicate potential sterilisation failure
- Ensured data integrity. Recording both sensor readings to maintain traceability and Part 11 compliance
Pure steam autoclave control: separation through physics
Most modern autoclaves use a unique control mechanism that relies on a fundamental property of pure steam: the direct correlation between steam pressure and temperature. This permits an alternative form of separation:
- Pressure sensor (control). Regulates steam pressure to maintain sterilisation temperature
- Temperature sensor (monitoring). Verifies chamber conditions at the coldest spot (drain sensor)
- Cross-verification. Real-time comparison of pressure and temperature ensures sterilisation conditions are consistently met
This setup naturally provides separation without requiring independent recording devices, while enhancing monitoring reliability.
Inconsistencies across equipment types
Interestingly, other critical sterilisation equipment — such as freeze dryers and depyrogenation tunnels — are not required by Annex 1 to maintain the same level of sensor separation as autoclaves. These systems typically:
- Connect all sensors to the same control system for real-time verification
- Detect discrepancies automatically to ensure data integrity
This inconsistency suggests that the strict separation requirement for autoclaves may be rooted in historical practice rather than purely technical necessity.
Implementing §8.50: a practical approach
Annex 1 suggests: “… by the use of duplex/double probes connected to independent control and monitoring systems.” This is an example rather than a mandatory requirement. Alternative approaches can be justified if they maintain compliance through:
- Automated data validation — PLCs performing real-time sensor comparison
- Routine calibration & maintenance — ensuring sensor accuracy through scheduled checks
- Advanced alarm & abort mechanisms — immediate response to deviations beyond set thresholds
Regulatory considerations
There is no inherent technical requirement for complete separation between monitoring and control systems. Alternative solutions may offer superior technical benefits. However, implementing the Annex-suggested configuration (Configuration 1) has the advantage of regulatory approval without requiring additional justification.
Other configurations may necessitate a technical assessment to demonstrate compliance with the core regulatory requirement:
“To have safeguards and/or redundancy in its control and monitoring instrumentation to detect a cycle not conforming to the validated cycle parameter requirements and abort or fail this cycle.”
For companies purchasing a new autoclave, I recommend selecting a model with a built-in, separate paperless chart recorder and ensuring the computerised control system can verify chamber temperature using more than one sensor.
For companies whose legacy autoclave lacks an independent monitoring system, a technical assessment should be conducted to verify that the autoclave’s control and monitoring system meets the requirements outlined in §8.50.
Conclusion
Annex 1 §8.50 emphasises redundancy to ensure product quality and data integrity — it does not explicitly mandate independent monitoring and control systems. Modern technology allows manufacturers to enhance reliability while maintaining compliance through:
- Multiple sensors for monitoring — flexible temperature sensors positioned in the chamber improve sterilisation validation
- Real-time discrepancy detection — advanced control systems provide automated monitoring
- Data integrity & traceability — digital systems ensure compliance with Part 11
- Pure-steam correlation — pressure-temperature cross-verification adds another layer of validation
- New autoclaves with built-in chart recorders — simplify regulatory approval
- Technical assessments — when a separate monitoring system is not available, to ensure regulatory compliance
This approach optimises process reliability, compliance, and efficiency, minimising unnecessary redundancy while ensuring a robust sterilisation process.
Acknowledgments
Thanks to Jim Agalloco for his valuable support and insights in the preparation of this paper. Thanks to Rachel Shimonovitz, National Inspector for Good Manufacturing Practices (GMP) for Medicinal Products — Israeli Ministry of Health — for providing the regulatory perspective and ensuring alignment with relevant guidelines. Thanks to Gefen Ben-David for creating the diagram that illustrates the discussed concepts.
