GUIDELINE FOR VALIDATION

OF AIR SEPARATION UNIT

AND CARGO TRANSPORT UNIT
FILLING FOR MEDICAL OXYGEN
AND MEDICAL NITROGEN
Doc 219/19

EUROPEAN INDUSTRIAL GASES ASSOCIATION AISBL

AVENUE DES ARTS 3-5 • B – 1210 BRUSSELS

Tel: +32 2 217 70 98 • Fax: +32 2 219 85 14
E-mail: [email protected] • Internet: www.eiga.eu
 Doc 219/19

GUIDELINE FOR VALIDATION

OF AIR SEPARATION UNIT
AND CARGO TRANSPORT UNIT FILLING
FOR MEDICAL OXYGEN AND MEDICAL
NITROGEN

As part of a programme of harmonization of industry standards, the European Industrial Gases

Association (EIGA), has published Guideline for Validation of Air Separation Unit and Cargo Transport
Units for Medical Oxygen and Medical Nitrogen, EIGA Doc 219. This publication was originally published
by the Compressed Gas Association, (CGA) as Guideline for Validation of Air Separation Unit and Cargo
Tank Filling for Oxygen USP and Nitrogen NF.

This publication is intended as an international harmonized publication for the worldwide use and
application by all members of the Asia Industrial Gases Association (AIGA), Compressed Gas
Association (CGA), EIGA, and Japan Industrial and Medical Gases Association (JIMGA). Regional
editions have the same technical content as the EIGA edition, however, there are editorial changes
primarily in formatting, units used and spelling. Regional regulatory requirements are those that apply to
Europe.

Disclaimer
All technical publications of EIGA or under EIGA's name, including Codes of practice, Safety procedures and any other technical
information contained in such publications were obtained from sources believed to be reliable and are based on technical
information and experience currently available from members of EIGA and others at the date of their issuance.

While EIGA recommends reference to or use of its publications by its members, such reference to or use of EIGA's publications by
its members or third parties are purely voluntary and not binding.

Therefore, EIGA or its members make no guarantee of the results and assume no liability or responsibility in connection with the
reference to or use of information or suggestions contained in EIGA's publications.

EIGA has no control whatsoever as regards, performance or non performance, misinterpretation, proper or improper use of any
information or suggestions contained in EIGA's publications by any person or entity (including EIGA members) and EIGA expressly
disclaims any liability in connection thereto.

EIGA's publications are subject to periodic review and users are cautioned to obtain the latest edition.

 EIGA 2019 - EIGA grants permission to reproduce this publication provided the Association is acknowledged as the source

EUROPEAN INDUSTRIAL GASES ASSOCIATION AISBL

Avenue des Arts 3-5 B 1210 Brussels Tel +32 2 217 70 98 Fax +32 2 219 85 14
E-mail: [email protected] Internet: www.eiga.eu
EIGA DOC 219/19

Table of Contents
1 Introduction ...................................................................................................................................... 1
2 Scope ............................................................................................................................................... 1
3 Definitions ........................................................................................................................................ 1
3.1 Publication terminology ............................................................................................................ 1
3.2 Technical definitions ................................................................................................................. 2
4 Overview of process ........................................................................................................................ 6
4.1 Background ............................................................................................................................... 6
4.2 Process description .................................................................................................................. 6
5 Plant and process assumptions ....................................................................................................... 7
6 Approach to process validation ........................................................................................................ 8
7 Stage 1—Process design ................................................................................................................ 8
7.1 Incoming air study..................................................................................................................... 8
7.2 Risk analysis ............................................................................................................................. 8
7.3 Hazard analysis and critical control point ................................................................................. 9
7.4 Critical control points ................................................................................................................ 9
7.5 Variations .................................................................................................................................. 9
7.6 Change control ......................................................................................................................... 9
8 Stage 2—Process qualification ........................................................................................................ 9
8.1 Validation master plan ............................................................................................................ 10
8.2 Validation protocols ................................................................................................................ 10
8.3 Typical validation requirements for identified critical control points ....................................... 10
8.4 Sampling ................................................................................................................................. 12
8.5 Development of PQ (PPQ) (objective measures) ................................................................... 12
8.6 Validation summary report ...................................................................................................... 13
8.7 Bridge from legacy validation to new validation model........................................................... 13
8.8 Additional support documentation .......................................................................................... 13
9 Stage 3—Continued process verification ....................................................................................... 13
10 References ................................................................................................................................. 14
Appendix A—Simplified typical air separation unit process flow diagram (Informative) ....................... 15
Appendix B—Failure mode and effects analysis (Informative) ............................................................. 16
Appendix C—Hazard analysis and critical control point (Informative) .................................................. 26

Table 1 IQ requirements ....................................................................................................................... 11

Table 2 OQ requirements...................................................................................................................... 12
Table 3 PQ requirements ...................................................................................................................... 12
EIGA DOC 219/19

1 Introduction

This publication provides the European Industrial Gases Association (EIGA) position and guidance on the
manufacturing, bulk product storage, and cargo transport unit 1 filling validation activities that take place at
a typical air separation unit (ASU) that is manufacturing medical oxygen, medical nitrogen, or both.
Variations from the typical ASU process configurations can exist. Companies shall assess variations and
determine if deviations from this guidance are necessary.

The approach and activities in this publication are designed to ensure that these gases, which are
classified as drug products, have the claimed identity, strength, quality, and purity. Scientific, documented
studies will show that the given utility, system, process, or piece of equipment:

• meets the specifications of its design for its critical elements;

• is properly installed, operated, and maintained;

• is suitable for its intended application;

• is in accordance with principles established and generally accepted by the industrial gas industry;

• meets the requirements of the European Commission’s Good Manufacturing Practice [1] 2; and

NOTE For North America and Canada meet the principles of FDA’s Guidance for Industry, Process
Validation General Principles and Practices, and meets the Health Canada Validation Guidelines for
Pharmaceutical Dosage Forms (GUIDE-0029) [2, 3];

• is capable of consistently producing a product that meets all predetermined specifications and
quality attributes.

2 Scope

This publication addresses validation for ASU cryogenic manufacturing and cargo transport unit filling
processes relating to medical oxygen and medical nitrogen meeting the requirements of the European
monographs.

3 Definitions

For the purpose of this publication, the following definitions apply.

3.1 Publication terminology

3.1.1 Shall

Indicates that the procedure is mandatory. It is used wherever the criterion for conformance to specific
recommendations allows no deviation.

3.1.2 Should

Indicates that a procedure is recommended.

1 For the purpose of this publication, “cargo transport unit” is used to include cryogenic tankers and

cryogenic containers.
2 References are shown by bracketed numbers and are listed in order of appearance in the reference

section.

1
EIGA DOC 219/19

3.1.3 May

Indicates that the procedure is optional.

3.1.4 Will

Is used only to indicate the future, not a degree of requirement.

3.1.5 Can

Indicates a possibility or ability.

3.2 Technical definitions

3.2.1 Automated loading

Computer assisted cargo transport unit filling system.

NOTE The degree of assistance can vary based on the company and application.

3.2.2 Calibration

Process by which an instrument of known accuracy or a certified standard is used to detect, report, or
eliminate variation in the accuracy of the item being tested.

3.2.3 Change control

Formal monitoring program in which qualified representatives of appropriate disciplines review proposed
or actual changes that can affect a validated status.

NOTE The intent is to determine the need for action that would ensure and document that a system is maintained
in a validated state as described in Annex 11 of the GMP Computerised Systems and Annex 15 of GMP Qualification
and validation. Additional information can be found in Good Computer Validation Practices, “Common Sense
Interpretation” [4, 5, 6].

3.2.4 Concurrent validation

Establishing documented evidence that the process does what it purports to do based on information
generated during actual operation of the process, see Annex 11 and Annex 15 of GMP [4, 5].

NOTE This validation is based on establishing documented evidence through review and analysis of testing and
documentation, which is generated concurrently with product manufacture and release, to verify that a process can
consistently meet its predetermined specifications and quality attributes in a controlled, documented environment.

3.2.5 Corrective action

Specific action intended to resolve internally or externally generated non-conformances or customer

complaints.

3.2.6 Critical control point (CCP)

Point, step, or procedure at which control can be applied and a safety hazard can be prevented,
eliminated, or reduced to acceptable levels.

2
EIGA DOC 219/19

3.2.7 Electromagnetic interference (EMI)

Stray, time-varying magnetic flux generated by machinery and power cables.

3.2.8 Failure mode and effects analysis (FMEA)

Disciplined approach used to identify possible failures of a product or service and then determine the
frequency and impact of the failure.

NOTE FMEA is a procedure and tool that helps to identify every possible failure mode of a product or process to
determine its effect on other sub-items and on the required function of the product or process.

3.2.9 Good manufacturing practices (GMP)

The minimum standard that manufacturers of gases for medical use shall meet in their manufacture, pro-
cessing, packing, release and holding processes.

3.2.9.1 United States

Requirements by law for the manufacture, processing, packaging, holding, or distribution of a drug as
established in Title 21 of the U.S. Code of Federal Regulations (21 CFR), referred to as current good
manufacturing practices (CGMP) [7].

3.2.9.2 Canada
Applicable principles and practices (GUIDE-0031) that are acceptable to the Health Products and Food
Branch Inspectorates and that should facilitate compliance of fabricators, packagers/labellers,
distributors, importers, and home care providers of medical gases with Food and Drug Regulations,
C.R.C., c. 870, Part C, Division 2: Good Manufacturing Practices (GMP) [8, 9].

3.2.9.3 European Union

Volume 4 of "The rules governing medicinal products in the European Union" contains guidance for the
interpretation of the principles and guidelines of good manufacturing practices for medicinal products for
human and veterinary use laid down in Commission Directives 91/356/EEC, as amended by Directive
2003/94/EC, and 91/412/EEC respectively [10].

3.2.10 Hazard analysis and critical control point (HACCP)

Prevention-based safety system designed to prevent the occurrence of potential product safety problems.
This is achieved by accessing the inherent risks attributable to a product or process and then determining
the necessary steps that will control the identified risks.

NOTE The hazard analysis serves as the basis for determining the CCPs.

3.2.11 Installation qualification (IQ)

Documented verification that all key aspects of the installation adhere to approved design intentions
according to system specifications and that the manufacturer’s recommendations are suitably considered
in section 5 of Annex 15 of GMP [5].

3.2.12 Maintenance

Ongoing activity that lasts the lifetime of a system and includes preventative maintenance aspects

3
EIGA DOC 219/19

3.2.13 Operating range (OR)

Range of values for a given operating parameter that lies on or below a specified maximum value and on
or above a specified minimum value

3.2.14 Operational qualification (OQ)

Documented evidence that each unit or subsystem operates as intended within its anticipated operating
range [4].

3.2.15 Performance qualification (PQ)

Documented verification that the integrated system performs as intended in its normal operating
environment, see Annex 15 of GMP [5]

3.2.16 Process performance qualification (PPQ)

Within the new FDA guidance document PPQ is equivalent to the definition of PQ [2].

3.2.17 Process qualification

Terminology used in the FDA guidance document is the combined IQ/OQ/PQ(PPQ) [2].

3.2.18 Prospective validation

Validation conducted before the release of either a new product or a product made under a new or
revised manufacturing process to establish documented evidence that a system does what it purports to
do based on a validation plan [4].

3.2.19 Protocol

Written procedure that clearly and accurately defines the steps, equipment, methods, and acceptance
criteria used when conducting a validation study.

3.2.20 Quality control unit (QCU)

Any person or organizational element designated and trained to execute this role and function by the
organisation that is responsible for the duties relating to quality control as defined in CGMP.

NOTE For purposes of validation activities, the QCU should be responsible for the integrity of the study.

3.2.21 Radio frequency interference (RFI)

Interference to normal function caused by high frequency noise imposed on hardware devices.

NOTE Radio frequency noise such as that caused by handheld transceivers (walkie-talkies) is most common.

3.2.22 Retrospective validation

Validation study conducted for a product already in distribution that establishes documented evidence
that a system does what it purports to do based on review and analysis of historic information.

NOTE Retrospective validation is used as a form of corrective action when prospective validation studies were not
conducted before product introduction into the marketplace from the manufacturing operation.

4
EIGA DOC 219/19

NOTE Retrospective validation is no longer considered an acceptable approach within the EU [4].

3.2.23 Revalidation

Repetition of the entire validation process or specific parts of the process to demonstrate that any
changes that have taken place or the passing of time have not altered the performance of the originally
validated equipment, system, or process.

3.2.24 Security measures

Measures designed to protect a system and data from deliberate or accidental damage and prevent
access by unauthorized personnel.

3.2.25 Severity rating

Quantified level of whether or not a product is within specifications and safe to use.

3.2.26 Standard operating procedures (SOP)

Detailed instructions for executing specific tasks or assignments that relate to the installation, operation,
and performance of a system.

NOTE Some companies refer to SOP as work instructions.

3.2.27 Training

Procedures and programs established for personnel performing specific assigned tasks to maintain a pre-
determined level of quality.

NOTE—It includes CGMP information that ensures employees understand their role in the production of regulated
drug products and the implications of noncompliance. It may include on-the-job, formal, and tutorial training elements.

3.2.28 Validation

Establishing documented evidence that provides a high degree of assurance that a specific system will
consistently produce a product meeting its predetermined specifications and quality attributes. [5]

NOTE It is essential that any validation program be documented in a manufacturing or production environment to
ensure that over time the process or system consistently meets all the outlined requirements.

3.2.29 Validation master plan

Document that identifies all systems and subsystems involved in a specific validation effort and the
approach by which they will be qualified and the total system validated. Includes identification of
responsibilities and expectations, see Annex 15 of GMP. [5]

3.2.30 Utilities

Supporting systems used to operate the process control system. Some examples include heating,
ventilation, and air conditioning; compressed air; and electrical power.

5
EIGA DOC 219/19

4 Overview of process

4.1 Background

The ASU is a manufacturing process that separates air into its major components of oxygen, nitrogen,
and argon. This is a cryogenic process using the first and second laws of thermodynamics to produce the
products. The air separation process was developed in the early 1900s and though the manufacturing
equipment has changed with the times to be more energy efficient, the overall process has not changed.
This is a very robust process producing high purity oxygen and nitrogen that are intended for medical
applications. The process is designed with in-process controls, which ensure that the process stays within
established operating ranges. The final product is analysed prior to entering the storage tank. In the event
product does not meet specifications, it is discarded to prevent the non-conforming product from entering
the storage tank. The tanks are routinely tested and each delivery trailer is tested prior to shipment,
assuring that the product meets specifications.

For the purpose of this publication, this scientifically defined process that consistently produces high
grade medical oxygen and nitrogen exceeds their respective specifications as stated in the European
monographs specific for medical oxygen and medical nitrogen. The process has internal self-controlling
dynamics where the final product is measured prior to entering the storage tank where in the event
product would not meet specifications is diverted to the atmosphere protecting the integrity of the storage
tank. Additionally, the tanks are tested as part of the batch process and again each delivery trailer is
tested assuring product meets specifications.

As discussed, the products produced through this process are used in a wide variety of industries. The
gases are used in, but not limited to, steel making, metal refining, pharmaceuticals, food processing,
petroleum processing, glass and ceramic manufacturing, pulp and paper manufacturing or health care
applications. The purity requirements of these industries typically make up 90% of the overall volume
produced, which far exceed the requirements of medical grade gases and greatly minimizes the risks of
the gases used in the healthcare environment.

As described, an air separation plant consistently produces oxygen and nitrogen at very high purity levels.
The following methods can be considered as applicable, assuring the product meets specifications:

• For initial plant start-ups—Once the tanks have been qualified to receive medical products, it is
acceptable to put product in the storage tank once purity is achieved. Products may be shipped
and classified as medical once the process qualification has been completed. Documented
evidence showing the purity of the products meeting specifications shall be captured and
formalized through the validation process;

• For existing air separation plants that have been in industrial production—Products may be
shipped and classified as medical once the process qualification has been completed.
Documented evidence showing the purity of the products meeting specifications shall be captured
and formalized through the validation process; and

• For existing air separation plants that have been previously validated in medical production that
may be going through a process or control system change—Products may be shipped and
classified as medical provided appropriate controls are in place to ensure product quality and
patient safety. Documented evidence showing the purity of the products meeting specifications
shall be captured and formalized through the validation process.

4.2 Process description

The air separation process begins with the incoming air and ends with the transfer of product into cargo
transport units. A diagram of a typical ASU process is shown in Appendix A.

6
EIGA DOC 219/19

Air is filtered, compressed, and routed through a clean-up system for removal of undesirable compounds
such as moisture, carbon dioxide, and hydrocarbons. The air passes through heat exchangers where it is
cooled to cryogenic temperature, then enters a series of distillation columns. In the high-pressure column,
it is physically separated into a vaporous form of nitrogen at the top and oxygen-enriched liquid at the
bottom. In the low-pressure column, it is further separated into low pressure gaseous nitrogen and liquid
oxygen (LOX).

The gaseous nitrogen from the columns is sent to a liquefier where it is converted into liquid nitrogen
(LIN). The LIN is then sent to a storage tank. Other nitrogen streams may be taken from the liquefier such
as reflux for use in the distillation columns.

The oxygen-enriched liquid is withdrawn from the bottom of the high-pressure column and sent to the low-
pressure column for further distillation. The LOX distillate from the bottom of the low-pressure column is
then sent to a storage tank.

An argon-rich stream from the low-pressure column is sent to an argon distillation column for further
purification.

The product from the individual storage tanks is then transferred to cargo transport units for delivery. To
ensure safety and product integrity, the processes and equipment used to transfer the product from the
storage tanks to the cargo transport units are unique to the type of product. Appropriate levels of quality
control are used to ensure adherence to specifications.

5 Plant and process assumptions

Plant and process assumptions used for the development of the risk analysis include:

• Typical liquid plant, as shown in Appendix A;

• Plant staffing is semi-attended and capable of remote monitoring. Product is tested and released
7 days/ week;

• Plant has automated loading and analyser systems;

• Remote access to automated fill control system for troubleshooting;

• Basis for severity and occurrence ratings are European monograph’s purity level of 99.5% with
trip points of 99.5% assay for oxygen and 99.998% calculated for nitrogen or higher internal
specification. Lower trip points may be applicable if piping and analytical control system design
ensures adequate response time of the subject loop;

NOTE Other jurisdictions utilizing other compendial specifications may need to modify the risk assessment
accordingly.

• Due to the unique design and operation of the air separation process, routine production does not
include stoppage and start-ups. Interventions are addressed as purity trip function testing; and

• The ASU process is designed to operate at full capacity. Pilot and scale up applications are not
applicable to air separation, which is a well-defined and established process. Based on historical
knowledge, changing the operational modes including high LIN and high LOX scenarios, only
affects the quantity of the products produced and does not affect the identity, strength, quality,
and purity of the final product. Therefore mode variations are not required to be considered as
part of the validation.

7
EIGA DOC 219/19

6 Approach to process validation

Each step in the manufacturing process shall be evaluated using tools such as failure mode and effects
analysis (FMEA) and hazard analysis and critical control point (HACCP) to ensure finished product meets
predetermined quality attributes. This approach results in the determination of the critical control points
(CCPs), mitigations associated with the CCPs control, qualification protocols, and protocols for
maintaining the validated state.

• Stage 1, Process Design—The commercial manufacturing process is defined during this stage
based on knowledge gained through development. Stage 1 design requirements are addressed in
the risk analysis included in this publication and in each organisation’s risk assessment as
defined in Section 7;

• Stage 2, Process Qualification—During this stage, the process design is evaluated to determine if
the process is capable of reproducible commercial manufacturing. Stage 2 standard IQ/OQ/PQ
(PPQ) as defined in Section 8; and

• Stage 3, Continued Process Verification—Ongoing assurance is gained during routine production

that the process remains in a state of control. Stage 3 is continued process verification and is
defined in Section 9.

7 Stage 1—Process design

Process design is the activity of defining the commercial manufacturing process that will be reflected in
planned master production and control records. The goal of this stage is to design a process suitable for
routine commercial manufacturing that can consistently deliver a product that meets its quality attributes
[8]. The following sections define stage 1 for an air separation plant.

7.1 Incoming air study

For purposes of process validation, organisations shall consider and demonstrate process assurance
based on known data of the quality of the ambient air. This data can be obtained from governmental air
monitoring studies for the locality. For prospective validation, this may be demonstrated via air quality
surveys that examine the critical impurities in the air over time when compared to predefined action limits.
For concurrent validations, evidence may take the form of a statistical evaluation of these impurities in the
finished product when compared to predefined action limits.

An industry study conducted in coordination with a toxicologist showed that the environmental
contaminants are inconsequential to product safety. The evaluation concluded that the substances
identified through this study either did not enter the ASU initially or were reduced to safe levels by the
actions of the ASU process. See CGA TR-3, The Impact of Ambient Air Contaminants on Validation
Requirements for the Air Separation Process [11].

7.2 Risk analysis

A risk analysis is a scientifically based process for quantifying risk. It consists of identifying potential
failure modes followed by the assessment of severity, frequency of occurrence, and likelihood of
detection of each failure mode. The output from the risk analysis is the risk priority number that is derived
from the severity, occurrence, and detection rankings. Details of the risk analysis performed can be found
in Appendix B.

Risk analysis should also include a review of in-process monitoring and process control strategies.

8
EIGA DOC 219/19

7.3 Hazard analysis and critical control point

The failure modes that met or exceeded the ranking threshold identified by the FMEA are entered into the
HACCP decision tree. The following considerations are used:

• A subsequent step in the process can be involved in controlling a failure mode;

• More than one step in a process can be involved in controlling a failure mode;

• More than one failure mode can be controlled by a specific control measure; and

• Those failure modes that meet the criteria of the HACCP decision tree were CCPs (see Appendix
C).

7.4 Critical control points

The following hazards are identified as CCPs:

• transfer process from the ASU/liquefier to product storage tanks;

• storage tanks analyser systems; and

• transfer from storage to cargo transport units.

7.5 Variations

The air separation plant produces medical gases, such as oxygen and nitrogen, and the process is
historically very stable (see Section 4). Potential external variations (i.e. ambient air) are well documented
(see 7.1). The internal variations (potential failure causes) must be addressed by the risk assessment for
the given location.

7.6 Change control

Each organisation should establish a documented management of change process which reviews
changes for their impact on the validated state of the facility. The determination of the validation
requirements as a result of the change is the responsibility of the quality control unit (QCU). Process
qualification steps should be defined (if required) prior to the implementation of the change.

8 Stage 2—Process qualification

During the process qualification stage of the process validation, the process design is evaluated to
determine if it is capable of reproducible commercial manufacture. This stage has two elements: (1)
qualification of the CCPs through the installation and operational qualification protocols; and (2) process
performance qualification (PPQ).

It should be verified that all plant equipment and systems have been installed and function according with
the design specifications. For new plants, this activity is performed and documented during the start-up
and commissioning activities. This documentation should be retained but does not need to be included in
the validation documentation.

Successful completion of stage 2 is necessary before commercial distribution. Products manufactured

during this stage that meet specifications may be released for distribution following the organisation’s
SOPs [2].

9
EIGA DOC 219/19

8.1 Validation master plan

A validation master plan establishes requirements for a validation program and provides the outline and
scope of such a program. The master plan describes the strategy and activities necessary to plan and
implement each phase of the validation activities. It addresses validation documentation requirements,
roles and responsibilities, sequence of execution, and other considerations necessary to complete the
validation effort. This validation master plan may be developed prior to stage 1 but at a minimum shall be
developed as a prerequisite to starting stage 2.

8.2 Validation protocols

Validation protocols include written and approved documents prepared in advance that describe in detail
the activities or tests necessary to generate data that support a determination of process control.
Protocols should specify who is responsible for conducting the tests, what specific method is used for
each test, and how the data are collected and reported. It also specifies the review and evaluation
procedures used to determine if the acceptance criteria are met or, if the acceptance criteria are not met,
what steps are taken.

Typically, validation protocols include requirements for IQ, OQ, and PQ (PPQ). At the conclusion of each
qualification, results are reviewed and approved.

8.3 Typical validation requirements for identified critical control points

The following IQ, OQ, and PQ tables identify the validation activities in a prospective or concurrent
validation. To perform retrospective validation if permitted by GMPs, historical data may be used to
support the requirements specified in Tables 1, 2, and 3.

Deviations encountered during the execution of the validation protocols shall be documented,
investigated and resolved in accordance with the organisations approved procedures.

10
EIGA DOC 219/19

Table 1 IQ requirements
Requirement Transfer process from Storage tank Transfer from
ASU/liquefier to analyser systems storage tank to
product storage tank cargo transport unit tank
Process and instrumentation Column/liquefier to analyser system Cargo transport units fill
diagrams (P&ID): confirm storage tank/vent system from bulk storage
installation matches P&ID including including analyser tank to cargo transport unit
connections and interfaces system
Control wiring diagrams Analyser and control N/A analyser, control valves,
valves and controlling devices
Calibration Limited to verification that Limited to verification that Limited to verification that
calibration system is calibration system is calibration system is
properly installed for the properly installed for the properly installed for the
analyser analyser analyser
Verify equipment attributes match analyser and control analyser analyser, control valves,
design specifications including valves control system, and
environmental considerations (e.g., sample/fill connections
temperature and humidity)
Verify user manuals or equivalent Yes Yes Yes
are available
Support utilities: review of Calibration gases, Calibration gases, Calibration gases, electrical
commissioning documents if electrical and instrument electrical and instrument and instrument gas supply
available gas supply as applicable gas supply as applicable as applicable
Verify specified computer hardware If applicable If applicable If applicable
and software installed per
environmental considerations (e.g.,
temperature and humidity)
Verify analyser methods validation Yes Yes Yes

11
EIGA DOC 219/19

Table 2 OQ requirements
Requirement Transfer process from Storage tank Transfer from
ASU/liquefier to analyser systems storage tank to
product storage tank cargo transport unit
Functional testing of operating Testing analyser over Testing analyser over OR Control system device
parameters OR, system response testing, analyser over OR,
time, and automatic valve automatic valve operation,
operation. prefill and post fill
Power outage system termination on failure,
testing sequence of fill operation,
and analyser response time
testing
Calibration Analyser and automatic Analyser system Analyser, automatic valves,
valves flow or pressure switches
on analyser sample system
Control loop testing Analyser output to valve Cargo fill termination if Analyser to control system
operation (product purity batch tank fails test on and control system output
trip testing), reset to tank, automated systems if to valve operation (product
analyser bypass for applicable purity trip testing)
calibration
Verify EMI/RFI protection Test per protocol or Test per protocol or Test per protocol or control
control per SOP control per SOP per SOP
Verify software/control system SOP, software, SOP, software, SOP, software, hardware,
security hardware, or physical hardware, or physical or physical security
security security
Test instrument calibration review Yes N/A Yes
Data recording N/A If applicable, Annex 11 If applicable, Annex 11
and 15 of GMP should and 15 of GMP should be
be applied [5] applied [5]
Table 3 PQ requirements
Requirement Transfer process from Storage tank Transfer from
ASU/liquefier to analyser systems storage tank to cargo
product storage tank transport unit
Sampling requirements for 24-hr period of time or as As defined by the Minimum of three cargo
prospective and concurrent defined by the organisation’s validation transport unit fills for each
validation organisation’s validation master plan product
master plan
Sampling requirements for A statistically significant A statistically significant A statistically significant
retrospective validation number of consecutive number of consecutive number of cargo transport
production periods storage tank batches units fills for each product
Data review Meets acceptance criteria Meets acceptance criteria Meets acceptance criteria

8.4 Sampling

Based on the evidence presented in Section 4, the level of monitoring and testing over a minimum 24-
hour period or as defined in the organisation’s validation master plan utilizing in-process, make and final
product analytical values can confirm the product is uniform and meets specifications. As an example, a
24-hour period sampling on an hourly basis would provide a minimum number of data points to be
statistically significant.

8.5 Development of PQ (PPQ) (objective measures)

A PQ (PPQ) should be developed that includes in-process control points, make analysers and final
product analyser data for a time period that demonstrates process control utilizing statistical measures or
other methods that assures a state of control.

12
EIGA DOC 219/19

At a minimum the analytical values of products going to storage tanks will be documented or trended over
the duration of the validation period. As these values are typically stable they do not lend themselves to
statistical treatment but do provide assurance of process control.

8.6 Validation summary report

At the conclusion of the validation effort, a report shall be written summarizing the results of the tests
performed, deviations documented and data collected during the execution of the validation protocols.
This report is used for approval of the conclusions and authorization to manufacture product. For a new
ASU, commercial distribution may begin once the process qualification process is complete, the final
report has been approved, and in accordance with company’s SOP. This completes stage 2 of the
process validation.

8.7 Bridge from legacy validation to new validation model

Plants that have been validated using a different procedure need not be re-validated under the new
validation model by providing documented evidence verifying there have been no unplanned departure
from process as designed and no undesired process variability detected.

If during the review a significant unexplained deviation has been noted that can impact the validated state
of the plant, a re-validation following the new validation model should be executed.

Provided there are no significant issues that can impact the validation of the plant a validation verification
system (stage 3) should be developed and maintained as described in Section 9.

8.8 Additional support documentation

Additional support documentation stages 1 and 2 may include the following:

• training records;

• SOP (e.g., calibration, maintenance, management of change, local work instructions, and
their associated records, etc.);

• ambient air quality reports;

• commissioning and plant performance test records, if available;

• batch records;

• documentation of process controls operating in established ranges if not already included in

protocol;

• documentation of any deviations that can affect product quality; and

• analytical methods validation reports for applicable analysers associated with CCPs.

9 Stage 3—Continued process verification

The purpose of the validation verification is to provide continued documented evidence that the process
remains in a state of control (validated state) during commercial distribution. Each organisation should
develop an ongoing program to collect and analyse data that relates to product quality.

13
EIGA DOC 219/19

It is recommended that on an annual basis the organisations program should meet the requirements as
defined in Annex 15 of the GMP, and at a minimum, evaluate the following to assure a state of control
(validated state) [5, 6]: management of change;

• calibration records; and

• maintenance records.

Changes are evaluated for their impact on the validated state of the facility in accordance with 7.6. This
method of change control in conjunction with periodic reviews provides an acceptable system for
determining if the validation status is maintained.

An organisation’s program should also outline the documentation requirements capturing the results of
the validation verification stage. This documentation should be reviewed and approved by the QCU.

10 References

Unless otherwise stated, the latest edition shall apply.

[1] Good Manufacturing Practice www.ec.europa.eu

[2] Guidance for Industry Process Validation: General Principles and Practices, Food and Drug
Administration, 10903 New Hampshire Avenue, Silver Spring, MD 20993. www.fda.gov

[3] GUIDE-0029, Validation Guidelines for Pharmaceutical Dosage Forms, Health Canada, Ottawa,
ON K1A 0S9, Canada. www.hc-sc.gc.ca

[4] Good Manufacturing Practice, Annex 11, Computerised Systems www.ec.europa.eu

[5] Good Manufacturing Practice, Annex 15 , Qualification and validation www.ec.europa.eu

[6] Stokes, Teri, et. al., Good Computer Validation Practices, "Common Sense Interpretation,"
Interpharm/CRC Press, 1994. www.crcpress.com

[7] Code of Federal Regulations, Title 21 (Food and Drug Administration), Superintendent of
Documents, U.S. Government Printing Office, Washington, DC 20402. www.gpoaccess.gov

[8] GUIDE-0031, Good Manufacturing Practices (GMP) for Medical Gases, Health Canada. www.hc-
sc.gc.ca

[9] Food and Drug Regulations, Health Canada, Canadian Government Publishing, Public Works and
Government Services Canada. www.hc-sc.gc.ca

[10] Commission Directives 91/356/EEC, as amended by Directive 2003/94/EC and 91/412/EEC,

European Medicines Agency. http://www.ema.europa.eu

[11] CGA P-8.5, The Impact of Ambient Air Contaminants on Validation Requirements for the Air
Separation Process, Compressed Gas Association, Inc., 14501 George Carter Way, Suite 103,
Chantilly, VA 20151. www.cganet.com

14
EIGA DOC 219/19

Appendix A—Simplified typical air separation unit process flow diagram

(Informative)

Air

Main compressors

Clean-up system
water, carbon dioxide, and
hydrocarbon removal

Heat exchangers
Nitrogen final purity
analyzer
(ppm oxygen)

High Nitrogen
Nitrogen analyzer
(ppm oxygen) pressure liquefier
column

Low pressure
"Off Spec"
nitrogen analyzer LIN vent
(ppm oxygen)

Low
Waste purity pressure
analyzer
(ppm oxygen) column
LOX LIN
Argon feed storage storage
analyzer
(ppm oxygen) tank tank

Oxygen final
purity analyzer "Off Spec"
(assay)
LOX vent LOX cargo LIN cargo
tank loading tank loading

LOX cargo tank LIN cargo tank

loading analyzers loading analyzers

15
EIGA DOC 219/19

Appendix B—Failure mode and effects analysis (Informative)

Tables B-1 and B-2 describe the individual factors that are used to determine the risk index. If the risk index
value equals or exceeds the risk priority cut-off value of 6, that process function proceeds to the HACCP
decision tree described in Appendix C.

NOTE This is an example for a United States and Canadian plant. The FEMA should be modified for other
jurisdictions as required
Plant and process assumptions used for the development of the ASU risk analysis include the following:

• Plant staffing is semi-attended and capable of remote monitoring. Product is tested and released
seven days a week.

• Plant has automated loading and analyzer systems;

• Remote access to automated fill control system for troubleshooting;

• Basis for severity and occurrence ratings are purity level of 99.0% with trip points of 99.5% assay for
oxygen and 99.998% calculated for nitrogen or higher internal specification. Lower trip points could be
applicable if piping and analytical control system design ensures adequate response time of the
subject loop;

• Due to the unique design and operation of the air separation process, routine production does not
include stoppage and startups. Interventions are addressed as purity trip function testing; and

• The ASU process is designed to operate at full capacity. Pilot and scale up applications are not
applicable to air separation, which is a well-defined and established process. Based on historical
knowledge, changing the operational modes including high LIN and high LOX scenarios, only affects
the quantity of the products produced and does not affect the identity, strength, quality and purity of
the final product. Therefore mode variations are not required to be considered as part of the validation.
Table B-1Criteria for FMEA

Definitions of Risk Index Factors Definitions of Risk Index and Risk Priority

Severity Likelihood Likelihood Risk index 2) Risk priority

of occurrence of occurrence of detection 1)
(S) (O) (D) (S x O x D)
1 = Low: within 1 = Low: once a year 1 = High: continuous 1 Minimum
specification and or less or routine
safe for use
2 = Medium 2 = Medium: greater 2 = Medium: periodic 6 3) Cut-off
than once a year (processes that reach
and less than this level are
once a week analysed using
HACCP assessment)
3 = High: out of 3 = High: once a 3 = Low: rare 27 Maximum
specification week or more
product (in either
storage tank or
cargo transport
unit) or unsafe for
use by end user
without detection
1)
Detection rating is based on the most conservative rating of any listed detection mode.
2)
Risk index for determination of high-risk process function (probability of an event happening without being detected).
3)
This value was established to capture and further evaluate (HACCP) potential process control points that had a
combination of high and medium risk index, as an example 3 x 2 x 1.

16
EIGA DOC 219/19

Table B-2FMEA

Occurrence (O)

Detection (D)
Line number

Severity (S)

Risk Index
Potential Current

(SxOxD)
Process cause(s)/ Potential local Potential end
Potential process General Severity Occurrence Detection
function/ mechanism(s) effect(s) of effect(s) of
failure mode controls/ comments comments comments comments
requirements of failure failure failure
detection

1 Incoming air Abnormally Failure to report Overloaded pre Process safety 3 1 Process (2), 2 6 Emergency Emergency Extremely Hydrocarbons
contaminated accidental purification unit product situations, acts situations could rare. Multiple are an
air stream release outside (PPU) and analytical of nature, result in failures asphyxiant.
of plant battery equipment controls (1), and Environmental contaminants in required to Carbon
limits emergency Protection unusually high cause a monoxide in
notification (2) Agencies concentrations. severity rating nitrogen is
recordable or Although not a of 3. tested in both
greater values, product, rated a 3 batch and post
etc. (see SOP) due to severity to fill test of cargo
process. transport unit
2 Air compression Mechanical: Element tears or Compressor Normal air 1 1 Loss of 2 2 Damaged air No known impact Follow There are
intake air filter bypassing fouling particulates to efficiency (2), filter, improper on product quality maintenance indicators such
failure process vibration installation of procedures for as pressure
monitoring (2), cartridges inspections drops and/or
visual (2), and routine
and/or replacement of preventative
monitoring of filters to maintenance
filter pressure reduce that would
drop (2) likelihood of a indicate a filter
failure. (A failure.
failed filter
leads to
expensive
maintenance
problems).
3 Air compression Electrical Motor or switch Loss of air to Process stops 1 2 Product make 1 2 Primarily Valves close by
gear equipment, process, valve shuts (1) electric utility interlock.
electrical utility, machinery shut- power
etc. down interruptions
4 Air compression Controls Hardware, Change of Distillation 1 2 Product make 1 2 High or low flow Shutdowns
software, process column upset, valve shuts (1) can lead to caused by this
operator variables that process stream distillation column failure are
interface could result in outside of instability. rare. Upsets to
loss of air to control limits: the process
process, process stops are infrequent
machinery shut- but
down conservatively
rated a 2.
5 Air compression Mechanical: Rotating Loss of air to Process stops 1 1 Product make 1 1 Valves close by
other element, lube process, valve shuts (1), interlock.
system, etc. machinery shut- vibration
down monitoring (1)

17
EIGA DOC 219/19

Occurrence (O)

Detection (D)
Line number

Severity (S)

Risk Index
Potential Current

(SxOxD)
Process cause(s)/ Potential local Potential end
Potential process General Severity Occurrence Detection
function/ mechanism(s) effect(s) of effect(s) of
failure mode controls/ comments comments comments comments
requirements of failure failure failure
detection

6 Clean up system Mechanical: Saturation, Contaminant Heat exchanger 1 1 See lines 7-9 2 2 Ratings are Not severe: Low Detected
PPU adsorbent degradation of passes through fouling, plant based on lines contaminants will analytically or
Pre purification including adsorbent to heat shut down, 7-9 freeze in heat as indicated in
unit failure of exchanger potential of exchanger and timer
regeneration certain are limited to sequencing or
system contaminants chemical process
(carbon dioxide, properties parameters
water, concentrations such as
hydrocarbons, below threshold temperatures
and nitrous limit value and pressures.
oxide) in trace (TLV®)/ Detection
amounts pass permissible processes are
through (see exposure limits for process
lines 7-9) (PEL) thresholds. safety not for
product purity.
7 Clean up system Mechanical: Saturation, Contaminant Increased 1 1 Periodic 2 2 Purpose of PPU Product purity is Never exceed Periodic
PPU adsorbent, degradation of passes through hydrocarbon analysis (2), is to increase maintained. USP analysis
including adsorbent to heat levels pass process plant reliability Simple specification
failure of exchanger through to analysis (1), and ensure asphyxiant. as long as
regeneration product oxygen. product analysis process safety. oxygen assay
system (1) Hydrocarbons measurement
either freeze out is conducted.
or pass through
PPU. If not
corrected, plant
is shut down for
deriming or
thaw.
8 Clean up system Mechanical: Saturation, Contaminant Increased levels 1 1 Continuously 1 1 Purpose of PPU Product purity is None at levels The plant will
PPU adsorbent degradation of passes through of carbon monitored (1) is to increase maintained. noted in freeze up.
including adsorbent to heat dioxide and plant reliability USP/NF Continuous
failure of exchanger water pass and ensure oxygen analysis with
regeneration through to process safety. monograph carbon dioxide
system product oxygen. Carbon dioxide analyser.
and water
passing through
PPU freeze out
in heat
exchangers. If
not corrected,
plant is shut
down for
deriming or
thaw.

18
EIGA DOC 219/19

Occurrence (O)

Detection (D)
Line number

Severity (S)

Risk Index
Potential Current

(SxOxD)
Process cause(s)/ Potential local Potential end
Potential process General Severity Occurrence Detection
function/ mechanism(s) effect(s) of effect(s) of
failure mode controls/ comments comments comments comments
requirements of failure failure failure
detection

9 Clean up system Mechanical: Saturation, Contaminant Increased levels 1 1 Periodic 2 2 Normal air Levels of nitrous Low Monitoring for
PPU adsorbent degradation of passes through of nitrous oxide analysis (2), concentration is oxide are carbon dioxide
including adsorbent to heat (partially carbon dioxide 0.3 ppm. typically well is done on a
failure of exchanger removed in PPU analysis (1) below TLV limit of periodic basis
regeneration or gel trap) pass 50 ppm for liquid for process
system through to producing plants. safety purposes.
product oxygen. Industry data Carbon dioxide
show typical spike is an
nitrous oxide indication that
levels to be less nitrous oxide will
than 5 ppm. also be passing
through.
10 Clean up system Mechanical: Fatigue, age, Passing Fouling dust 1 1 Visual (2) and/or 2 2 There is no Unusual Sieve detected
PPU separation and thermal particulates into filters pressure drop known impact on occurrence. visually at
screens cycling. process air (2) product quality. Thermal regeneration
stream prior to cycling is blowdown.
dust filters potential root Pressure drops
cause as is or routine
high maintenance
differential would indicate a
pressure filter failure.
across screen.
11 Clean up system Mechanical: Element tears or Heat exchanger Adsorbent 1 1 Loss of 2 2 There is no Maintenance There are
PPU dust filter bypassing of fouling particulates to efficiency (2) known impact on procedures for indicators such
seals process and and/or product quality. inspections as pressure
LOX tank monitoring of and drops or routine
filter pressure replacement of maintenance
drop (2) filters followed that would
to reduce indicate a filter
likelihood of a failure.
failure (a failed
filter leads to
expensive
maintenance
problems).
12 Clean up system Controls Hardware, Contaminant Heat exchanger 1 1 See 2 2 See See "Mechanical: See See
PPU software, and passes through fouling, plant "Mechanical: "Mechanical: adsorbent" lines "Mechanical: "Mechanical:
operator to heat shut down, adsorbent" lines adsorbent" lines 6-9. adsorbent" adsorbent" lines
interface exchanger potential for 6-9. 6-9. lines 6-9. 6-9.
certain
contaminants
(carbon dioxide,
water,
hydrocarbons
and nitrous
oxide) in trace
amounts to pass
through

19
EIGA DOC 219/19

Occurrence (O)

Detection (D)
Line number

Severity (S)

Risk Index
Potential Current

(SxOxD)
Process cause(s)/ Potential local Potential end
Potential process General Severity Occurrence Detection
function/ mechanism(s) effect(s) of effect(s) of
failure mode controls/ comments comments comments comments
requirements of failure failure failure
detection

13 Heat exchanger Mechanical: PPU Freeze-up of Loss of 1 1 Carbon dioxide 2 2

fouling breakthrough or heat exchanger efficiency and analysis (1),
dust filter failure with carbon plant shut down control variable
dioxide and/or changes (2) i.e.,
water or pressure drop,
plugging with temperature,
sieve dust etc.
14 Heat exchanger Mechanical: Age and fatigue Gaseous Gaseous 1 1 Process and 1 1 Overpressure Gaseous or Overpressure Continuous
leak product product product analysis air to nitrogen pipeline product air to nitrogen process and
(nitrogen) (nitrogen) (1) is for industrial product analysis
outside control outside control applications only.
limits limits
15 Heat exchanger Controls Hardware, Loss of gaseous Distillation 1 1 Process 1 1
software, and product flow column upset, analysis (1)
operator control and process stream
interface temperature outside of
balance of heat control limits:
exchanger process stops
16 Distillation Mechanical Piping, packing, Loss of process Distillation 1 1 Process 1 1
process phase trays, etc. purities column upset, analysis (1)
(high pressure process stream
and low pressure outside of
columns and control limits:
associated process stops
equipment)
17 Distillation Mechanical: Piping and Particulates in Particulates into 1 1 Visual indication 2 2 There is no Visual
process phase perlite ingress vessel process stream storage and/or on cold box (2), known impact on observation of
(high pressure cargo transport perlite in fill product quality. cold box
and low pressure unit hose blowdown insulation space
columns and (2), and cold pressure
associated box casing increase and
equipment) pressure (2) icing
18 Distillation Controls General: Loss of gaseous Distillation 1 1 Product make 1 1 See lines 19-23
process phase hardware, process flow column upset, valve shuts (1) regarding
(high pressure software, and control and process stream control loops.
and low pressure operator temperature outside of
columns and interface balance of heat control limits:
associated exchanger process stops
equipment)

20
EIGA DOC 219/19

Occurrence (O)

Detection (D)
Line number

Severity (S)

Risk Index
Potential Current

(SxOxD)
Process cause(s)/ Potential local Potential end
Potential process General Severity Occurrence Detection
function/ mechanism(s) effect(s) of effect(s) of
failure mode controls/ comments comments comments comments
requirements of failure failure failure
detection

19 Distillation Controls Control loop Range of Distillation 1 1 Failures in one 1 1 Detection by

process phase failure: high process control column upset, control loop are devices outside
(high pressure pressure failure is from process stream detected via of the failed loop
and low pressure column nitrogen no effect to outside of interfaces with
columns and purity various degrees control limits: other control
associated of process process stops loops (1),
equipment) upset. process and
product analysis
(1).
20 Distillation Controls Control loop Range of Distillation 1 1 Failures in one 1 1 Detection by
process phase failure: low process control column upset, control loop are devices outside
(high pressure pressure failure is from process stream detected via of the failed loop
and low pressure column nitrogen no effect to outside of interfaces with
columns and purity various degrees control limits: other control
associated of process upset process stops loops (1),
equipment) process and
product analysis
(1).
21 Distillation Controls Control loop Range of Distillation 1 1 Failures in one 1 1 Detection by
process failure: low process control column upset, control loop are devices outside
phase(high pressure failure is from process stream detected via of the failed loop
pressure and low column waste no effect to outside of interfaces with
pressure columns stream various degrees control limits: other control
and associated of process upset process stops loops (1),
equipment) process and
product analysis
(1).
22 Distillation Controls Control loop Range of Distillation 1 1 Failures in one 1 1 Detection by
process phase failure: low process control column upset, control loop are devices outside
(high pressure pressure failure is from process stream detected via of the failed loop
and low pressure column argon no effect to outside of interfaces with
columns and feed purity various degrees control limits: other control
associated of process upset process stops loops (1),
equipment) process and
product analysis
(1).
23 Distillation Controls Control loop Range of Distillation 1 1 Failures in one 1 1 Detection by
process phase failure: low process control column upset, control loop are devices outside
(high pressure pressure failure is from process stream detected via of the failed loop
and low pressure column oxygen no effect to outside of interfaces with
columns and stream purity various degrees control limits: other control
associated of process upset process stops loops (1),
equipment) process and
product analysis
(1).

21
EIGA DOC 219/19

Occurrence (O)

Detection (D)
Line number

Severity (S)

Risk Index
Potential Current

(SxOxD)
Process cause(s)/ Potential local Potential end
Potential process General Severity Occurrence Detection
function/ mechanism(s) effect(s) of effect(s) of
failure mode controls/ comments comments comments comments
requirements of failure failure failure
detection

24 Distillation Controls Control loop Build-up of Potential build- 2 2 Failures in one 1 4 Detection by
process haze – failure, liquid heavy up of heavy control loop are independent
LOX sump liquid oxygen level compounds in compounds in detected via level indication
with drawl. failure the LOX sump the LOX product interfaces with or other
Verification that other control methods
the plant meets or loops (1),
exceeds the 0.2% process and
of the incoming product analysis
air flow with drawl (1).
from the lox
sump.
25 Liquefier Mechanical Rotating Loss of nitrogen Process stops 1 2 Vibration 1 2
process element, lube to process and monitoring (1)
system, etc. machinery shut-
down
26 Liquefier Mechanical: Purge box Air Air 1 1 In process trace 1 1 Air contamination
process air failure, contamination of contamination of oxygen analyser does not exceed
contamination mechanical process process (1) 1%
piping leak, and nitrogen nitrogen
operator
interface
27 Liquefier Electrical Motor or switch Loss of nitrogen Process stops 1 2 Isolation circuit 1 2 Analytical
process gear equipment, to process, (1) control of
electrical utility, machinery shut- product make
etc. down valve isolates
storage tank.
28 Liquefier Controls Hardware, Change of Distillation 1 1 In process 1 1
process software, and process column upset, analysers (1)
operator variables process stream
interface resulting in a outside of
loss of nitrogen control limits,
to process or and process
excessive stops
nitrogen to
process,
machinery shut
down

22
EIGA DOC 219/19

Occurrence (O)

Detection (D)
Line number

Severity (S)

Risk Index
Potential Current

(SxOxD)
Process cause(s)/ Potential local Potential end
Potential process General Severity Occurrence Detection
function/ mechanism(s) effect(s) of effect(s) of
failure mode controls/ comments comments comments comments
requirements of failure failure failure
detection

29 Miscellaneous: Mechanical: Loss of seal gas Oil leakage No effect on 1 1 Low seal gas 2 2 Oil will freeze in Defaulted to
turbines (ASU, air seal gas pressure through meeting product pressure process heat lowest detection
liquefier, and system expander seals specifications shutdown switch exchanger. factor (2) in this
liquefier) (1), turbine Resulting case
restart hydrocarbon-
operational based oils would
procedure (1), be simple
heat exchanger asphyxiant as
performance long as oxygen
monitoring (2), assay is
and low sump maintained.
oil level
indication (2)
30 Miscellaneous: Mechanical: Bearing, lube Turbine Distillation 1 1 Product make 1 1
turbines (ASU, air rotating system, etc. shutdown and column and/or valve shuts (1)
liquefier, and element loss of liquefier upset:
liquefier) refrigeration to process stops.
process
31 Transfer process Mechanical Piping, Inoperative Product less 3 1 Periodic storage 2 6 If automatic Severity is based Multiple
from automatic make and/or than 99.0% tank analysis (2) valves fail in an on the possibility failures
ASU/liquefier to valves for vent valve commingled into and post fill open position or of getting product required to
product storage process storage tank cargo transport leak, process is less than 99.0% cause a

.
tank (automatic isolation and unit test (1) not out of commingled in severity rating
valves) venting specification but the storage tank. of 3
ability to isolate
tank from
process is
inhibited
32 Transfer process Controls Hardware Loss of control Product less 3 1 Periodic storage 2 6 Signal to control Severity is based Multiple
from including make may inhibit than 99.0% tank analysis valve disrupted on the possibility failures
ASU/liquefier to analysers and ability to isolate commingled into (2), post fill and analyser of getting product required to
product storage operator tank from storage tank. cargo tank test failure less than 99.0% cause a
tank (controls) interface process. (1), and commingled in severity rating
analyser the storage tank. of 3
calibration
review (2)
33 Storage tank Mechanical: Piping and Particulates in Particulates into 1 1 Visual indication 2 2 There is no Extremely rare Visual
perlite ingress vessel storage tank storage and/or on storage tank known impact on with one observation of
cargo transport (2), perlite in fill product quality known incident storage tank's
unit hose blowdown insulation space
(2), and storage pressure
tank casing increase and
pressure (2) icing

23
EIGA DOC 219/19

Occurrence (O)

Detection (D)
Line number

Severity (S)

Risk Index
Potential Current

(SxOxD)
Process cause(s)/ Potential local Potential end
Potential process General Severity Occurrence Detection
function/ mechanism(s) effect(s) of effect(s) of
failure mode controls/ comments comments comments comments
requirements of failure failure failure
detection

34 Storage tank Controls Hardware, Under Air ingress to 1 1 Periodic storage 2 2 Major Air condensation Periodic storage
operator pressurization storage vapour tank analysis (2) constituents of will not lower the tankage
interface failure space (applies and post fill air do not purity to less than analysis is the
on tank only to oxygen cargo transport condense. Per 99.0%. daily batch test.
pressurization tanks) unit test (1) CGA guideline,
controls. an automated
minimum
pressure control
system is
recommended.
35 Storage tank Controls Storage tank Invalidate batch Invalidate batch 3 1 Analyser 2 6 All aspects of Multiple
(analyser system) analyser system analysis of analysis of calibration SOP system failures
storage tank storage tank (2) and post fill including fitting, required to
cargo transport sample lines, cause a
unit analysis (1) other hardware severity rating
and software. of 3
Does not
include the
analyser itself
as it is covered
in line 37
“Transfer from
storage to cargo
tanks-
equipment".
36 Transfer from Mechanical Pumping Air or nitrogen Air or nitrogen 1 1 Post fill cargo 1 1 Nitrogen from
storage to cargo system and contamination of contamination of transport unit pump shaft seal
tanks−equipment improperly product product analysis (1) purge source or
purged fill hose air from piping
or piping system system not
being properly
purged per
procedure
37 Transfer from Controls Hardware, Fill valve opens Product less 3 1 Post fill cargo 3 9 Requires a failure Multiple Analyser
storage to cargo software, and before than 99.0% is transport unit of residual being failures calibration
tanks−equipment operator satisfactory commingled analysis (1) out of required to intervals may
(hardware and interface prefill analysis with good specification or a cause a permit product
software) product due to failure of both the severity rating to be released
additional block valve and of 3. and consumed
failures. some other prior to the next
process failure. calibration
check. This
results in
increasing the
detection to a
rating of 3.

24
EIGA DOC 219/19

Occurrence (O)

Detection (D)
Line number

Severity (S)

Risk Index
Potential Current

(SxOxD)
Process cause(s)/ Potential local Potential end
Potential process General Severity Occurrence Detection
function/ mechanism(s) effect(s) of effect(s) of
failure mode controls/ comments comments comments comments
requirements of failure failure failure
detection

38 Transfer from Controls Cargo transport Inability to Product less 3 1 Analyser 3 9 Storage tank Requires a failure Multiple Analyser
storage to cargo unit analyser detect out of than 99.0% is calibration SOP and cargo of residual being failures calibration
transport system specification commingled (2) transport unit out of required to intervals may
units−equipment product in cargo with good analysers are specification or a cause a permit product
(analyser system) transport units product due to typically the failure of both the severity rating to be released
prefill or post fill additional same analyser. block valve and of 3. and consumed
failures. Includes prefill some other prior to the next
and post fill process failure. calibration
analyses. check. This
results in
increasing the
detection to a
rating of 3.
39 ASU Controls Control system Range of Process stream 1 1 Failures in one 1 1 This line is Detection by
component process control outside of control loop are included devices outside
failure: failure is from control limits detected via specifically to of the failed loop
transmitter, no effect to and process interfaces with address the
automatic valve, various degrees stops other control "controls
and input/output of process upset loops (1) and system"
card process and components.
product
analyses (1).

25
EIGA DOC 219/19

Appendix C—Hazard analysis and critical control point (Informative)

The following table describes the determination of the process function. If the risk index value obtained in Appendix B equals or exceeds the risk priority
cut-off value of 6, the process function proceeds to the HACCP decision tree. Important considerations when using the following decision tree are:
The decision tree is used after the hazard analysis;
The decision tree is used when a potentially significant hazard has been identified;
A subsequent step in the process may be more effective for controlling a hazard and may be the preferred CCP;
More than one-step in a process may be involved in controlling a hazard; and
More than one hazard may be controlled by a specific control measure.
Table C-1HACCP decision tree

11) 311) 321) 351) 37) 381)

Incoming air Transfer process Transfer process Storage tank Transfer from Transfer from
from ASU/liquefier from ASU/liquefier (analyser system) storage to cargo storage to cargo
HACCP Question to product storage to product storage transport transport
tank (automatic tank (controls) unit−equipment unit−equipment
valves) (hardware and (analyser system)
software)

Yes, procedures Yes, storage batch Yes, storage batch Yes, post fill cargo Yes, post fill cargo
Do control measures exist at this step or concerning public analysis and post fill analysis and post fill transport unit transport unit
Yes
subsequent steps for the identified hazards? notification as well cargo transport unit cargo transport unit analysis analysis
as internal SOP analysis analysis

No, only identifies Yes, isolates the Yes, isolates the Yes, periodic storage Yes, post fill cargo
Does this step eliminate or reduce the likely potentially storage tank storage tank batch testing and transport unit
occurrence of a hazard to an acceptable contaminated air post fill cargo analysis Yes
level? transport unit
analysis

Could contamination with identified hazards

occur in excess of acceptable levels or could No N/A N/A N/A N/A N/A
increase to unacceptable levels?

Will a subsequent step eliminate identified

hazards or reduce the likely occurrence to an N/A N/A N/A N/A N/A N/A
acceptable level?

Is this a critical control point? No Yes Yes Yes Yes Yes

 NOTE—This hazard analysis is for out-of-specification product (<99.0% purity) reaching the consumer.
1) Refers to line number in Appendix B—FMEA.

26