This is a ready-to-use design worksheet. Complete one worksheet per phase before the phase is built in the recipe editor, so exception handling is decided on purpose rather than improvised after a deviation. Replace every <<FILL: ...>> placeholder. A filled specimen follows.
Phase identification
| Field | Entry |
|---|---|
| Phase name | <<FILL>> |
| Parent operation / unit procedure | <<FILL>> |
| Normal (happy-path) behaviour, one sentence | <<FILL>> |
| Critical parameter(s) this phase controls | <<FILL>> |
Exception design matrix
Identify every abnormal path the phase can encounter and decide, before building it, what the system does and what the operator does.
| Failure mode | Designed system behaviour | Operator action | Record captured |
|---|---|---|---|
<<FILL: e.g. parameter reads outside range at a checkpoint>> | <<FILL: e.g. phase fails, holds equipment, raises alarm, does not advance>> | <<FILL: e.g. acknowledge, assess, decide corrective step or deviation>> | <<FILL: e.g. phase state trail, alarm log, deviation reference>> |
<<FILL: e.g. equipment fault mid-phase (valve, pump, sensor)>> | <<FILL>> | <<FILL>> | <<FILL>> |
<<FILL: e.g. power loss then recovery mid-phase>> | <<FILL: must force operator confirmation of real-world state before resuming; never silently resume against a stale value>> | <<FILL>> | <<FILL>> |
<<FILL: e.g. operator-initiated Hold>> | <<FILL>> | <<FILL>> | <<FILL>> |
<<FILL: e.g. operator-initiated Abort>> | <<FILL: equipment must reach a safe, defined state, never an ambiguous one>> | <<FILL>> | <<FILL>> |
<<FILL: e.g. required data entry missing or out of format>> | <<FILL>> | <<FILL>> | <<FILL>> |
Design rules checklist
| # | Rule | Confirmed for this phase? |
|---|---|---|
| 1 | Every abnormal path leaves the equipment in a safe, defined state, never an ambiguous one | <<FILL: Y/N>> |
| 2 | Power recovery never silently resumes against a stale recorded value; it forces operator confirmation of the physical state | <<FILL: Y/N>> |
| 3 | Every exception path produces a complete record (state transitions, timestamps, operator ID, reason) | <<FILL: Y/N>> |
| 4 | Hold, restart, and abort are each tested from every state the phase can realistically be in, not just from “running” | <<FILL: Y/N>> |
| 5 | Any manual override or bypass available to an operator is itself logged and requires a reason | <<FILL: Y/N>> |
Sign-off
| Role | Name | Date |
|---|---|---|
| Automation engineer (design) | <<FILL>> | <<FILL>> |
| Manufacturing reviewer | <<FILL>> | <<FILL>> |
| Validation/CSV reviewer | <<FILL>> | <<FILL>> |
Filled specimen
Phase identification. Phase name: “Charge media to 1500 L (range 1485-1515).” Parent: Prepare operation, Bioreactor Production unit procedure. Normal behaviour: opens the charge valve, monitors flow totalizer, closes valve automatically at target volume. Critical parameter: charge volume, 1485-1515 L acceptable range.
| Failure mode | Designed system behaviour | Operator action | Record captured |
|---|---|---|---|
| Flow totalizer reads outside range at end of charge | Phase fails, holds the unit, raises an alarm; does not advance | Acknowledge alarm, assess, decide top-up or raise a deviation | Phase state trail, alarm log, deviation reference if raised |
| Charge stalls mid-phase (valve fault) | Phase goes to HELD, closes the charge valve to a safe position | Investigate valve fault, restart or abort per SOP | HELD duration, restart/abort command with timestamp and operator ID |
| Power loss mid-charge, then recovery | On restart, system displays last recorded volume and requires operator confirmation of the actual vessel level before Resume is enabled | Verify real level against recorded value, confirm or correct, then resume or abort | Power-recovery prompt, confirmed value, operator signature |
| Operator presses Hold during charge | Phase to HOLDING then HELD, charge valve closes safely | Resume when ready, or abort | Hold/restart transitions with timestamps |
Design rules checklist. All five rules confirmed Yes for this phase, with rule 2 specifically verified in protocol test case TC-08 of the paired qualification test script.
Sign-off. Automation engineer: K. Iwu, 6 August 2026. Manufacturing reviewer: process lead, 7 August 2026. CSV reviewer: T. Wren, 8 August 2026.
Common inspection findings this worksheet prevents
- A recipe phase where nobody decided what happens on a fault, power loss, or abort until it happened for real in production and became a deviation.
- Power recovery that silently resumes production using a stale in-system value instead of the actual physical state, the exact gap that makes a bad batch.
- Exception paths that leave the operator to improvise because the “happy path only” design never specified a defined safe state.
How to adapt this worksheet
- Complete one worksheet per phase that touches a critical parameter or a safety-relevant action; simple, low-risk phases can share a lighter version of this analysis.
- Feed the completed matrix directly into the corresponding test cases of the paired master recipe qualification test script, so every design decision here gets challenged during qualification.
- Revisit this worksheet whenever the phase’s equipment or control logic changes, since a new failure mode can appear even when the recipe parameters themselves are unchanged.