Because batch manufacturing is fraught with automated functions and constant change, ensuring safe processes is paramount to a successful end product. In pharmaceutical manufacturing, it’s important to carefully follow standard operating procedures (SOPs) to preclude any unforeseen events—or exceptions.

"One of the issues in exception reporting is you can’t wait to produce a product that will be dumped, so you have to respond to exceptions immediately," said Roddy Martin, service director at AMR in Boston.

An exception is when something goes wrong in the batch process—an occurrence "outside the normal or desired behavior" of the process, according to ISA’s batch standard, 88.01, which offers a few examples of events that might need exception handling: control equipment malfunction, fire or chemical spills, or unavailability of raw materials or plant equipment. (See ANSI/ISA-88.01-1995, Batch Control Part 1: Models and Terminology.)

One example of an exception in pharmaceutical manufacturing is if a temperature does not meet the standard operating procedures. In making a batch of creams and ointments, large stationary vessels melt down a wax material with oils and other ingredients, said Elwyn Anderson, director of safety, environment, maintenance, and security services at GlaxoSmithKline in Research Triangle Park, N.C. While pumping heated water through the vessel, "we make sure the water is at a certain temperature," he said. "If the SOP says to heat it to 180°, and it only gets to 170°, that would be a violation of the SOP, and it would require an exception report."

Not only is following the SOP important, but being precise with weights is also crucial in avoiding exceptions, especially in the blending procedure. "In agitating the contents of a huge vessel, we must lock the vessel into the mixing unit, seal it, and agitate it a certain number of minutes," Anderson said. When agitation stops, there’s a preweighed material and a process to add lubricant. "If you don’t follow procedures exactly, you’ll get an exception report," he said.

In pharmaceuticals, when the Food and Drug Administration approves a molecule, the first thing it asks is how a manufacturer will make the product and to prove it will produce the same result every time, Martin said. "If it doesn’t, the manufacturer would have to dump the batch. A batch would only be dumped if it wasn’t recoverable—if the output product posed a safety problem to a consumer or if it was unacceptable to the product specification," he said. In pharmaceuticals, this might occur when a chemical reaction had taken place that led to an unsafe product.

Designing processes from the ground up is one way to avoid exceptions. "When a product is approved, engineering and process groups have to design a robust process that will consistently produce that result," Martin said. "They follow a methodology to ensure that all the most likely scenarios have been accounted for in the design of the actual equipment."

Because a manufacturer can’t accommodate every single exception when designing the plant, it looks at the most likely event that could take place and designs that safety into the process, Martin said. That’s where a hazards and operability analysis team comes in.

At the 1999 World Batch Forum, Velumani Pillai from Pharmacia & Upjohn, Inc. and Baha Korkmaz from Automation Vision, Inc. offered their views on exception handling design for batch processes ("Guidelines for exception handling design for batch processes").

The pair said they believe "exception monitoring should operate continuously," and they gave a "real life" example from Trevor Kletz’s HAZOP and Hazan: Identifying and Assessing Process Industry Hazards (1992), a book that provides the basics of applying hazards and operability analysis (HAZOP) and hazard analysis (Hazan) to identify and assess hazards in the process industries. The real life example describes an event that would have benefited from a HAZOP team, had it been involved in the software design of the exception handling:

"An alarm indicated a low oil level in a gearbox . . . when the catalyst had just been added to the reactor and the computer had just started to increase the flow of cooling water to the reflux condenser. As instructed, the computer kept the flow small, the reactor overheated, the relief valve lifted and the contents of the reactor were discharged to the atmosphere."

The example continues to explain how a HAZOP would have been advantageous in this situation—in the exception handling software design—to discuss the operating manager’s intent. When instructing the applications engineer to ensure all controlled variables were left as they are when the alarm sounds, did he mean for the cooling water flow or the temperature of the reactor to be left unchanged?