A probe gets replaced, a model gets updated, a link goes down. The guideline asks that the dossier say what takes over during that time, and the answer is written at scoping rather than on the day the question arrives.
ICH Q13 lists the continuity plan among the information expected in the dossier wherever a model is associated with an analytical procedure for release testing: contingency testing and monitoring plans instituted for when the model is not available, for example when gaps in PAT data occur or in case of PAT equipment failure (Table 1, CTD sections 3.2.S.4 and 3.2.P.5).
§ 4.2 adds the example everyone recognises, and it places it within RTRT: recalibrating a near infrared probe. A model update is a period during which the method changes version.
An installation that has prepared that answer moves through these periods on a written course of action. Here is what that page holds.
In short
Six answers written before start-up: the criterion that declares the measurement unavailable and who makes that call, the control that takes over, what happens to the material produced during the period, the condition for return to service, the record, and the frequency threshold that opens an investigation. They fit on one page.
What the guideline asks, section by section
And Table 1 asks for it in two places, not one. A row higher, at CTD sections 3.2.S.2.4 and 3.2.P.3.4, it already expects, for process models used as part of the control strategy, the information ensuring their correct application “including contingency plan when the model is not available”. A release model and a control model each call for their own, and the two are not written in the same place in the dossier.
The general rule sits one level up. At § 3.1.5, Process Monitoring and Control, the guideline asks that assessment of the risks associated with data gaps inform whether contingency methods are warranted, and it names three examples: PAT recalibration, refill of a feeding system, failure of system components. That is the sentence covering the four situations below, rather than the table row alone.
Four situations, and they call for different answers
The word “unavailable” covers four states the system knows very differently. Telling them apart is what turns a general instruction into a course of action.
| Situation | What the system still knows | What takes over |
|---|---|---|
| Planned maintenance source change, window cleaning, periodic requalification | Everything outside the intervention window, whose date is known in advance | The production plan, which places the window outside a campaign. No material concerned while the window holds |
| Model update | The instrument measures. The version in force stays the previous one until the new one is approved | The version in force, or the substitute control if the material running has moved outside its domain |
| Out of domain | A good deal: Hotelling’s T² and the Q residual say the sample presented is not the one the model knows | The confirmatory control, and a process investigation if it repeats |
| Equipment down fault, loss of communication, power | Nothing over the period concerned, which is what makes it the most demanding | The substitute control, with its sampling plan, for all the material produced over that period |
The first three lines can be scheduled. The fourth is the only one that arrives unannounced, and it is the one the plan exists for.
What a continuity plan holds
Six written answers, and they fit on one page. Each is settled with production, quality control and quality assurance, before commissioning.
- The criterion that declares the measurement unavailable, and who calls it. A threshold on a diagnostic indicator, an instrument alarm, an absence of data over a defined period. While the criterion stays implicit, the decision is taken in the heat of the moment.
- The control that takes over, named. Its method, its sampling plan and the response time it needs. It is often the laboratory control that steps back in, and it does so all the better for having kept its method current.
- What happens to the material produced during the period. Released on the substitute control, held, or diverted from the collected stream depending on the manufacturing mode.
- The condition for returning to service. What is verified, over how many batches or minutes, and who calls the restart.
- The record. Period, reason, substituted controls, decision taken and by whom. That is what gets read again at inspection.
- The frequency threshold. Beyond a number of occurrences over a period, the situation opens an investigation. Writing that threshold down saves debating it at the moment it is crossed.
These six answers are also what puts a figure on what a day without measurement represents, and therefore what settles whether redundancy is justified. Breaking down the cost of a control.
The recalibration case, which the guideline names
ICH Q13 cites recalibrating a near infrared probe as an example of a data-collection lapse whose risk is assessed — at § 4.2, under the development of the data collection approach for RTRT, where the proposed control strategy must then include the alternative or additional quality controls. The reason is precise: during the update the analytical method changes version, and a version is what a release rests on.
Three points are settled beforehand, and they belong to change management as much as to technique.
- The version in force stays identified throughout the operation, and the previous one stays retrievable afterwards. ALCOA+ principles apply to the model as to any data. What a declaration of conformity leaves to you.
- Production continues on the substitute control if the material running moves outside the domain of the version in force. That is the one case where an update becomes pressing, and the one that prepares best.
- The comparison of performance before and after belongs to the update file, alongside the data that motivated the decision. What keeping a model alive asks for.
What continuity changes in the design
An installation designed with its continuity plan shows four choices, all made at scoping.
- The fallback is one level down. A measurement that steers becomes a measurement that documents for the length of the interruption. The lower level of ambition stays usable, and it is already described. The three levels of ambition.
- Absent or doubtful data carries a marker. A blank, a zero and a value flagged invalid are handled differently downstream, and the choice is made at acquisition. Where the measurement lands, and who reads it back.
- Redundancy is settled on a calculation. A second probe, a replacement instrument made available by the service contract, or the off-line control: the three compare on the same basis. And redundancy and backup answer two distinct questions: a mirrored set covers the hardware, a backup kept apart covers whatever propagates. The model, its configuration and its calibration sets are therefore held outside the redundant system. What a service contract really buys.
- The real-conditions verification protocol also serves the return to service. Written once for performance qualification, it is replayed after every intervention. What the Deploy phase holds.
Frequently asked questions
Does this plan apply outside continuous manufacturing?
ICH Q13 expects it in the dossier for continuous manufacturing. In batch manufacturing the requirement is carried differently: an analytical method that supports a conformity decision has a defined course of action for when it is not available, and an auditor asks for it as a procedure. Writing it once serves both modes.
How long can an installation run without its in-line measurement?
As long as the substitute control keeps up with the decision pace. The ratio between the decision window and the duration of the replacement method gives the answer, and it is calculated at scoping. When that ratio gets tight, redundancy justifies itself.
Who calls the unavailability, and who calls the restart?
Two named roles, with a deputy. In a regulated environment production, quality control and quality assurance are all concerned, and a decision taken by one of the three alone gets reopened at the next audit. The plan gains from naming functions rather than people, so it survives team moves.
Our model goes out of domain several times a week. What does that say?
That the domain was established on a narrower population than the real variability, or that the process has moved since. Both are diagnosed on the residuals and on a stable control material. It is good news in the plain sense: the detection is doing its job, and it points to where the model should be enriched.
Where to start when nothing is written?
With one page and one meeting. The six answers above, settled with production and quality, already make a defensible continuity plan. The rest — redundancy and return-to-service protocol — follows from what that page reveals.
Tell us what your production does for an hour without measurement. We will tell you what is left to write.
Forty-five minutes is enough to place the four situations on your installation, name the control that takes over, and see whether redundancy is justified on your own figures.