This is a ready-to-use qualification protocol. Replace every <<FILL: ...>> placeholder, tailor the test cases to your recipe’s actual phases and exception paths, and route through your normal validation approval process. A filled specimen (partial) follows.
Approval page
| Role | Name | Signature | Date |
|---|---|---|---|
| Author | <<FILL>> | ||
| Manufacturing reviewer | <<FILL>> | ||
| Automation/CSV reviewer | <<FILL>> | ||
| QA approver | <<FILL>> |
1. Objective
To demonstrate that master recipe <<FILL: recipe name and version>> correctly sequences its procedural elements, enforces its parameters and limits, handles exceptions safely, and produces a batch record that faithfully reflects the executed recipe, satisfying 21 CFR 211.186/211.188, EU GMP Annex 11, and 21 CFR Part 11.
2. Scope
| Field | Entry |
|---|---|
| Recipe under test | <<FILL: name, version>> |
| Equipment class / unit(s) used for testing | <<FILL>> |
| Test environment | <<FILL: qualified test/simulation environment, system name>> |
| Prerequisite qualifications | <<FILL: equipment phase library qualification status, MES platform qualification reference>> |
3. System description
<<FILL: brief description of the recipe's product, process, unit procedures, and operations in scope, referencing the process flow diagram or tech transfer package>>
4. Roles
| Role | Responsibility in this protocol |
|---|---|
| Test executor | Runs each test case, records actual results |
| Witness | Independently confirms critical test steps, particularly exception-path tests |
| Automation/CSV reviewer | Reviews test evidence for technical accuracy |
| QA | Reviews and approves the completed protocol |
5. Acceptance criteria
- Every test case in section 7 executes with the stated expected result, or a deviation is raised and resolved per section 6.
- The recipe enforces sequencing (no step advances before its predecessor completes and is signed where required).
- Every exception path tested (phase failure, hold, abort, power recovery) leaves the equipment in a safe, defined state and produces a complete, accurate record of what happened.
- The completed batch record generated by the control recipe matches the master recipe one for one, with the correct version identified.
6. Deviation handling
Any test case that does not produce its expected result is logged as a protocol deviation: description, immediate containment, root cause, corrective action, and re-test result. Deviations are reviewed and dispositioned by QA before the protocol can reach a final “Pass” conclusion. A deviation does not automatically fail the protocol if root cause is understood, corrected, and successfully re-tested.
7. Test cases
| TC # | Step / condition tested | Expected result | Actual result | Pass/Fail | Tester | Date |
|---|---|---|---|---|---|---|
| TC-01 | Normal flow: execute the full procedure end to end with in-range parameters | Recipe completes, all phases sequence correctly, batch record generated matches master recipe structure | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| TC-02 | Sequencing enforcement: attempt to start a later phase before an earlier required phase/signature completes | System blocks the action | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| TC-03 | Parameter boundary: enter a value at the upper acceptable limit of a critical parameter | Accepted, recorded, no alarm | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| TC-04 | Parameter out-of-range: enter a value outside the acceptable limit | System alarms/blocks per design; forces documented operator response | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| TC-05 | Phase failure: force a phase-level failure (e.g. simulated valve fault) | Phase goes to a defined failure/held state, equipment left safe, alarm raised, no silent advance | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| TC-06 | Operator hold/restart: press Hold mid-phase, then Restart | Phase transitions HOLDING to HELD to RESTARTING correctly, with timestamps and operator ID recorded | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| TC-07 | Abort: abort a phase mid-execution | Equipment reaches a safe state per design (e.g. valves close), abort reason captured | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| TC-08 | Power loss and recovery mid-phase | On recovery, system requires operator confirmation of actual equipment state before resuming; does not silently resume against a stale value | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| TC-09 | Electronic signature: complete a required signing step | Signature captures full name, date/time, meaning; re-authentication enforced per design | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| TC-10 | Audit trail: attempt to alter a recorded value as a non-privileged user | System prevents the alteration; any privileged correction is captured with old/new value, user, reason | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| TC-11 | Batch record reconciliation: compare the completed batch record against the master recipe structure | One-for-one match of unit procedures, operations, phases, and recorded data fields | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| TC-12 | Version identification: confirm the batch record captures the exact recipe version executed | Correct version number and status recorded on the batch record | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
8. Attachments
<<FILL: raw data exports, screenshots, signed printouts, deviation reports, referenced by TC number>>
9. Summary and conclusion
| Field | Entry |
|---|---|
| Total test cases | <<FILL>> |
| Passed | <<FILL>> |
| Failed / deviations raised and resolved | <<FILL>> |
| Overall conclusion | <<FILL: recipe qualified for production use / not qualified, pending remediation>> |
| QA disposition | <<FILL: name, date>> |
Filled specimen (excerpt)
Recipe under test: DS Production, Bioreactor Production unit procedure, v4.3. Test environment: qualified MES simulation environment, MES-SIM-02.
| TC # | Step / condition tested | Expected result | Actual result | Pass/Fail | Tester | Date |
|---|---|---|---|---|---|---|
| TC-05 | Phase failure: simulated flow-meter fault during media charge | Phase fails, holds unit, raises alarm, does not advance | Phase transitioned to FAILED, alarm raised within 2 seconds, unit remained closed, no advance to next operation | Pass | K. Iwu | 14 Aug 2026 |
| TC-08 | Power loss/recovery mid-charge | System requires operator confirmation of actual vessel volume before resuming | On restart, system displayed last recorded volume (1120 L) and required operator to enter confirmed actual level (1125 L, verified by level gauge) before Resume was enabled | Pass | K. Iwu | 14 Aug 2026 |
| TC-12 | Version identification on batch record | Correct version recorded | Batch record header showed “Recipe v4.3, effective 10 Aug 2026,” matching the version under test | Pass | K. Iwu | 14 Aug 2026 |
Summary. 12 of 12 test cases passed on first execution; zero deviations raised. Conclusion: recipe v4.3 qualified for production use. QA disposition: approved, R. Nakamura, 20 August 2026.
Common inspection findings this protocol prevents
- Recipe testing that only exercises the happy path, leaving failure and boundary behavior unvalidated until a real deviation exposes it in production.
- No documented evidence that power-recovery behavior was challenged, the exact scenario where a stale recorded state and a different physical reality produce a bad batch.
- A “qualified” recipe with no test case confirming the batch record actually matches the master recipe structure.
How to adapt this protocol
- Add test cases for every phase and exception path specific to your recipe; the twelve cases above are a minimum floor, not a ceiling, for a recipe of meaningful complexity.
- If the recipe includes operator prompts or manual data entry, add a test case confirming forced entry and range-checking behave as designed.
- Scale rigor to risk: a recipe change to a non-critical prompt may need a reduced version of this script, while a new product’s first master recipe should run the full set.