ISO 11135 Process Validation: MPQ, PPQ & Routine Control

Process Validation · ISO 11135:2014

Yayınlayan Hangzhou Bocon | EO Sterilization Process Validation & Qualification Support

An ISO 11135 process validation programme is not a single test. It is a chain: process definition, installation and operational qualification, then a performance qualification split into a microbiological and a physical half. Break one link and the stated sterility assurance level rests on an assumption nobody actually tested.

The ISO 11135 Process Validation Chain

ISO 11135:2014 separates two ideas that purchase orders routinely merge. Validation is the documented programme that shows a process consistently delivers product meeting specification (3.57). Qualification is the equipment evidence: installation qualification (IQ'su, 3.20) and operational qualification (OQ, 3.23). Performance qualification (Güç kalitesi, 3.26) is where the product, the load and the microbiology finally meet.

In practice PQ is delivered in two halves. Microbiological performance qualification (MPQ) uses biological indicators and process challenge devices to prove lethality at the hardest-to-sterilize location. Physical performance qualification (PPQ) proves the same cycles hold temperature, nem, pressure and concentration inside the specified window while the product and its sterile barrier system survive. A report that contains only IQ and OQ is a qualification report, not a validation report, and auditors read the difference immediately.

The sequence is fixed because each stage supplies an input the next one cannot invent. OQ needs calibrated instruments that IQ documented. MPQ needs a PCD whose resistance was justified during process definition. PPQ needs OQ data to prove the cycle it repeats is the cycle that was qualified. For a wider view of how these clauses map onto equipment design, see the ISO 11135 uyumluluk kılavuzu.

Process Definition: The Part Auditors Read First

Process definition is the first deliverable of ISO 11135 process validation, and the written argument for what the cycle must do. It starts with the product: malzemeler, sterile barrier system, maximum load configuration, and the effect of repeated exposure if reprocessing is permitted. It ends with a specification that names every process parameter, its tolerance, and the challenge device that will police it.

Three decisions carry most of the risk.

• Product family and processing category. A product family (3.33) is a group that can be sterilized by the same specified conditions; a processing category (3.31) is a set of families whose challenge is no greater than the group PCD. Products with very different cycle times or barrier formats should not share a family, because the shared specification then has to cover the widest tolerance and loses resolution.
• Load pattern. The same carton stacked differently produces a different internal temperature and humidity profile. One documented pattern per chamber, and routine production must follow it, including orientation such as porous face to porous face. Simulated product used during qualification must be equal to, or worse than, the family it represents in density, volume and void space.
• Tolerance envelope. The most sensitive product in the family defines the limits: its maximum tolerated temperature, humidity and pressure-change rate must sit outside the qualification extremes, not inside them. If the cycle reaches the product limit, packaging seals and polymer dimensions become the failure mode.

Bioburden belongs here too. The number and resistance of microorganisms on the product and inside the barrier system set the challenge MPQ will test, so it is monitored under a defined programme, typically at least quarterly, with the interval justified by risk and history (ISO 11737-1). A validation built on a single bioburden sample is a validation with an unknown starting point.

IQ'su: The Evidence Package, Not the Walkthrough

Installation qualification proves the chamber and its support systems were supplied and installed as specified. The deliverable is a package, not a signed visit: drawings, component certificates, utility connections, calibration status and a leak-tightness check of the vessel and piping.

• Chamber and door structure, seals, hinges and interlock; piping and valve schedule against the P&ID.
• Gas supply, buharlaştırıcı, vacuum system, exhaust and abatement connected, labelled and tested.
• Electrical supply stability, control cabinet layout and wiring consistent with the approved drawings.
• Every pressure, temperature and humidity instrument calibrated, with certificates inside the validity window.
• EO storage and handling consistent with the applicable regulations, and operating instructions covering fault conditions and alarms.
• Chamber leak test completed, since pressure integrity underpins both OQ and MPQ; the procedure is described in the chamber leak test guide.

The classic IQ failure is timing: instruments calibrated for the factory acceptance test expire before OQ begins, so the OQ data are technically traceable to nothing. A second failure is a missing instrument list, which makes the OQ traces impossible to audit years later.

OQ: Proving Control at the Limits

The OQ stage of ISO 11135 process validation demonstrates that the installed equipment performs across its operating range, including the limits it will be allowed to run at. For an EO sterilizer that means preconditioning, conditioning, gaz enjeksiyonu, maruziyet, kaldırma, flushing and aeration, each with a recorded variable rather than a nominal set point.

Preconditioning and conditioning

Ön koşullandırma (3.27) happens before the cycle, in a room or chamber, to bring the load to a specified temperature and humidity. Qualify it with the production load, not a convenient sample, and place sensors at the positions that will be worst case in routine operation. Typical acceptance is ±5 °C and ±15% RH across the load, with the transfer time from preconditioning to cycle start recorded and capped, commonly at 60 dakika. Incoming product temperature varies by season, so the preconditioning duration has to be justified against the coldest load, not the average one.

Şartlandırma (3.7) happens inside the cycle, before EO admission, and is where steam injection under vacuum raises the load to the working humidity. Dynamic conditioning, adding steam while pulling vacuum, distributes moisture more evenly than a static steam-then-vacuum sequence, but either method has to be demonstrated at the load’s worst position rather than at the chamber probe.

Variables the OQ must exercise

Concentration deserves a number because it is quoted loosely in tenders. Industrial cycles commonly run 450–800 mg/L, with 550 mg/L ± 50 a frequent production setting; above roughly 1,500 mg/L the additional lethality is negligible while gas cost, residuals and reaction products keep rising. A workable split is a lower concentration for MPQ, a higher one for PPQ and the production value in between, provided the PCD still fails and passes where it should at each level.

Exposure time is usually set by the half cycle method: run at 50% of the intended exposure and require all BIs negative. If they are, the full cycle has at least double the delivered lethality. Removal is measured rather than assumed: repeated vacuum cycles accumulating roughly 300 kPa of pressure change are a common target before the load is considered stripped of the bulk of the gas.

MPQ: The Microbiological Half

Microbiological PQ is the centre of ISO 11135 process validation and answers one question: at the hardest-to-sterilize location in the specified load, does the process deliver the required SAL? The evidence is a biological indicator with a known resistance, placed inside a process challenge device that is harder to penetrate than the product it stands for.

A conventional EO BI uses Bacillus atrophaeus (historically Bacillus subtilis var. niger) at a population of about 1.0 × 10⁶ spores per carrier. Under the reference conditions of 600 ± 30 mg/L, 54 ± 1 °C and 60 ± 10% Sağ, its D value (3.8), the time to reduce the population by 90%, should fall between roughly 2.6 Ve 5.8 dakika. The exact value is stated on the certificate lot, and the validation uses that value, not a catalogue average.

The PCD (3.28) adds a diffusion barrier around the BI, usually the same sterile barrier system used for product, so the challenge includes the packaging rather than bypassing it. Two PCD versions are used, with the product itself as the baseline:

The test sequence is a ladder, not a single run. A fractional or short cycle first establishes where the product, IPCD and EPCD fail and in what order. Then the half cycle at the planned exposure should return all BIs negative. A shorter run afterwards must return positives, otherwise the challenge was too weak to prove anything and the cycle is effectively overkill by accident. Three consecutive runs at the chosen exposure demonstrate reproducibility, and the BI sterility test follows ISO 11737-2, with incubation at 30–35 °C for the organisms used.

PPQ: The Physical Half

Physical PQ repeats the qualified cycle while measuring what MPQ cannot: temperature and humidity distribution through the load, the pressure profile the packaging actually sees, and whether the product still meets its functional specification afterwards. It typically consists of three consecutive half cycles plus at least one full cycle, so the reproduction data and the production parameters come from the same campaign.

• Load temperature and humidity mapped at the worst positions identified in OQ, not only at the chamber probe.
• Product function and dimensions tested after exposure, including the components most sensitive to heat and moisture.
• Sterile barrier system integrity checked by the appropriate physical method after the cycle.
• EO and ethylene chlorohydrin residuals measured against the ISO 10993-7 limits for the device’s contact category.
• Acceptance criteria agreed and signed in the protocol before the first run, never negotiated afterwards.

Routine Control, Release and Parametric Release

Validation licenses a window; routine control proves each production cycle stayed inside it. Every cycle record should carry the preconditioning temperature and humidity at the worst position, the transfer time to cycle start, each phase with its pressure and temperature, EO charge or concentration, maruziyet süresi, removal and flushing cycles, aeration time and temperature, and the PCD result.

Product release normally requires the cycle record to meet specification and the biological indicators to be negative. The PCD used in routine production must be no less resistant than the PCD qualified in MPQ; a weaker routine device quietly invalidates the release decision. Where parametric release (3.25) is claimed, the process must measure humidity and EO concentration directly during the cycle and demonstrate that the physical measurements alone predict the microbiological outcome. It is a measurement capability, not a paperwork exemption, and the controller must be specified for it from the start. The operating routines that surround these records are set out in the ETO sterilizer operation and maintenance SOP.

The regulatory context matters here as well: in the United States, the FDA sterilization guidance for medical devices treats cycle parameters, bioburden and residuals as one control package, which is why a validation file assembled only at PQ stage tends to be incomplete.

Revalidation, Change Control and Equivalence

ISO 11135 process validation does not end at the PQ report: the standard expects the validation to be reviewed at least annually, with IQ, OQ and PQ status confirmed and routine data compared against the qualified parameters. MPQ and PPQ are commonly repeated at least every two years, and sooner when a trigger fires. The annual review is a decision with a written rationale, not a calendar entry.

Equivalence is the route that avoids repeating full PQ for every product or chamber. Following AAMI TIR28, it requires a complete validation on at least one system, IQ and OQ on the candidate, a documented comparison of process parameters including tolerances, and a microbiological short or half cycle that shows the candidate is no more challenging than the validated system. Equivalence is a technical argument with data behind it; a similar chamber and the same recipe are not an argument.

Sıkça Sorulan Sorular

How long does ISO 11135 process validation take?

There is no fixed duration in the standard. A typical programme runs three MPQ cycles and three PPQ cycles, each of which may take 8–24 hours depending on preconditioning, exposure and aeration, plus product testing and residual analysis. Calendar time is usually dominated by protocol review, BI incubation and residual testing rather than chamber time.

What is the difference between MPQ and PPQ?

MPQ is the microbiological half: it uses biological indicators and process challenge devices to prove the required SAL at the hardest-to-sterilize location. PPQ is the physical half: it proves the same cycle holds temperature, nem, pressure and concentration within tolerance and that product and packaging still meet specification.

Can one PCD cover an entire product family?

Evet, if the family was defined around that PCD and the PCD is at least as resistant as the hardest location in every member. Adding a product with denser packaging or a longer lumen to an existing family requires a technical review and, often, a short cycle to show the original PCD still challenges the new worst case.

Is parametric release allowed under ISO 11135:2014?

It is allowed, but only with direct measurement of humidity and EO concentration during the cycle and a demonstrated correlation with the microbiological outcome. A controller that records pressure and temperature alone cannot support parametric release, and most installed systems require a sensor and analyser upgrade before the option is credible.

How often must validation be repeated?

Review annually and repeat MPQ and PPQ at least every two years as a working baseline, or sooner after any trigger in Table 4. The written justification for a reduced scope is part of the validation record; a decision to skip revalidation without documented evidence is the gap auditors find most often.

Referans: ISO 11135:2014 (3.7, 3.8, 3.20, 3.23, 3.25, 3.26, 3.27, 3.28, 3.31, 3.33, 3.46, 3.57) · ISO 11737-1 and ISO 11737-2 · ISO 10993-7 · AAMI TIR28. Acceptance limits shown are typical industry values and are confirmed in the approved protocol for each installation.