What Biopharma Often Overlooks In A Scheduled Shutdown
A conversation between Nate Forrest of A-BIO and Life Science Connect's Jon O'Connell
Implementing new equipment usually gets all the attention. Shutting down a facility for routine maintenance, replacement, or relocation is less exciting but critically important.
The work crosses multiple teams and almost always includes bringing in contractors for equipment installation and construction, setting the stage for an intricate dance in logistics and opening the door for intense regulatory attention.
Nate Forrest, principal owner and managing partner at A-BIO, leads a consulting firm that helps coordinate these complex routines. He offered to answer some of our high-level questions about what's involved.
When should shutdown planning begin, and what does the runway look like as you're leading up to the moment of turning everything off?
Forrest: It's a bit of a loaded, nuanced question, and the answer is rooted in how you answer three fundamental questions about scope, timeline, and risk.
First and foremost is: What are we trying to achieve and at what scope?
From there you need to understand what type of time you're dealing with. Is it a rolling outage where you pause a few vial thaws so you can create a window in each area as you roll through the building? Or maybe you're creating a total outage where you stop production after a batch finishes, and then you don't have anything going on for a period of time.
And then the third question is about how much operational risk you are willing to absorb coming back online. If you've got a firm date, you're probably going to start planning sooner than if there's flexibility.
Once you understand where you stand with these questions, you're able to then craft an execution plan that affirmatively balances complexity, risk and practicality to estimate when you should start. I will say we often run into situations where we are behind the ball, so we don't necessarily start as soon as we would like.
We have worked on shutdown programs of incredibly high complexity. For example, we worked on a shutdown that was conceptualized in 2018, with an overall total outage window of four months for a commercial facility.
We put it on hold in 2020, and there was about a two-year period where they didn't think they were going to implement the program because they couldn't secure the outage, but it got revived in January 2022 and finally started in November 2023.
That's almost a four-year period of planning to execute that outage, which for what it was, was absolutely necessary. That shutdown required an understanding of every weld and segment of piping that we were taking out and putting in.
Conversely, we're now starting to plan for a rolling outage in September of this year. It's smaller in scope and less complex, so you're looking at two months of planning to get ready.
I would say the common situation where it's a maintenance-driven routine shutdown period with potentially some smaller projects, you're typically looking at six to 12 months in advance for a robust and well-planned shutdown.
How do you sequence a shutdown for interconnected systems. Is there a general approach to avoid contamination risks or extra regulatory scrutiny?
Forrest: The primary mechanism that we use is change control. Most pharmaceutical facilities are going to have some sort of change control process within their quality management system.
Anytime you shut down an operating facility, it's an upset event for those related systems, which are most often validated to be in near-continuous operation. The change control system offers a mechanism to plan, execute, and document appropriately.
At its core, a well-defined change management plan is going to address most of the regulatory scrutiny you might get. If you can show a regulator that you've documented how you turn it off, do the work, and turn it back on, you're going to be in pretty good shape. Conversely, no plan and no risk assessment would put you in a poor position.
What constitutes being well-defined goes back to your original question on sequencing.
Your general flow is going to start with process equipment, which is decontaminated and cleaned. Utilities are going to be shut down as required in sequence. For example, if I have a pure steam generator, I'm going to turn that off before I turn off my purified water, because otherwise I will starve that pure steam generator. And then the cleanrooms are typically taken out of service — environmental monitoring and gowning are suspended for a period of time. Then, if required, the HVAC units are taken down as the last step. At that point, your outage has begun.
We consider contamination control heavily in the risk assessment. We are documenting the contamination control strategy within those change controls or within a stand-alone plan in parallel with those change controls. The facilities and equipment need to be protected as much as possible to ensure that you're not getting any crossover from shutdown-generated contamination.
Practically, what does that entail? We like to keep air handlers running if we can to help clear contaminants from the area. However, you don't want those contaminants going back into your ducts. We do things like protect the ducts with air filters taped to the wall at the return duct so they can catch all that dust, and those are replaced at some frequency during the shutdown.
We rely heavily on clean construction techniques with things like temporary walls, enclosures, adjusting room pressurizations to make sure we're getting appropriate containment and not letting dust go everywhere throughout the facility, and defined cleaning routines — what I typically refer to as "construction clean" – to maintain control of dust and particulate levels. That's people using mops and buckets daily to clean certain areas. And then maybe there's a frequency at which you wipe down the walls and ceilings to further keep the contamination levels down.
On the process equipment side, we're also potentially looking at periodic cleaning to minimize microbial growth. Process equipment is rarely completely dry. Residual water remains in those pipes, and water is the primary catalyst for contamination to grow. We want to at least be aware of the risk. If I'm shut down for a week, that's probably not a huge deal. If I'm shut down for four months, as soon as I'm able to start cleaning the equipment, I might get into a routine where I clean the equipment once every week or every two weeks, whatever we decide is appropriate based on risk.
How do you distinguish between what can wait versus what must happen in a specific order?
Forrest: Shutdowns are inherently risky endeavors. That's driven by existing field conditions and the complex interactions with various systems. When we're going through planning for these, the first thing we look at is what we can do offline and ahead of the shutdown period to get as much work as possible out of the way.
Any weld, inspection, documentation review, or shakedown test that we can execute in advance is a risk mitigation that removes effort from the critical period.
In some cases, we've set up testing environments for new equipment and reduced shutdown commissioning timelines originally planned to last for weeks down to days.
Some areas have flexibility in execution. For example, preventive maintenance operations oftentimes have the ability to float within a schedule, and you can find a window when it makes sense, but others are going to be more rigid, and the sequence is often dictated by the practicality of the situation.
You can't start up a system still under construction, and you can't commission a system that's waiting for automation downloads. Those are examples of firm prerequisites that we need to make sure are sequenced appropriately.
Distinguishing between what has and does not have flexibility typically comes back to documentation like your SOPs and your change controls. If my preventive maintenance SOP allows for a three-month window from a maintenance target date to execute , and it's not shutdown dependent, I have a lot of scheduling flexibility. If that preventive maintenance requires an outage, for instance the passivation of a water-for-injection loop that happens every three to five years, that usually has very specific sequencing with very little wiggle room. We’re going to take the utility system offline and drain it, do the maintenance passivation activity, and then that WFI system is likely needed for commissioning equipment and, therefore, I won’t have much flexibility in that.
Similarly, change controls are often going to define sequencing requirements for various systems. This essentially puts the risk assessment early in the planning process. If you get that right up front, you'll give yourself flexibility as the situation evolves in execution.
What specific GMP implications for taking a facility offline do companies often underestimate?
Forrest: Three areas are worth discussing, and they're people, equipment, and processes.
For people, it's getting detailed, cross-functional alignment on what's required to bring a facility back online, particularly between contractors and the associated internal functions of engineering, manufacturing, QA, and validation.
Construction and service providers who haven't spent a ton of time working in these daily operations are not natively going to understand the nuances of your documentation and return-to-service requirements. So that alignment is going to come from well-documented handoff expectations, and you're probably not going to have that in a change control. It's going to be in some sort of facilitated medium where we write down the process flow that identifies what happens and who's responsible at each step to make sure those handoffs are done correctly.
Another thing that plays well into that is well-defined system boundaries that ensure we're all talking about the same thing. You'd be surprised at the confusion that bubbles up when you say, "Well, I'm talking about the WFI system."
Are you talking about the WFI still, the storage tank, the distribution loop? It can be many different things depending on how we're approaching the work within the shutdown. So, getting clear alignment that, for example, the system boundary encompasses the WFI still and the storage tank, but not the distribution loop, now we're all on the same page.
Finally, if you want to watch a room spin, don't appropriately define a workflow or a boundary and get the scope and roles and responsibilities right. Your quality and validation teams need to be confident that you have a handle on the situation. If you don't have things well defined, you're not going to get them to be amenable to assessing the dynamic situation in a reasonable manner. Good definition allows them to understand the situation and puts them in a good position to make reasonable decisions that are appropriately based on the risk of the situation. When it's chaos, it's going to bring you to a grinding halt, which is exactly what you don’t want to happen while a system is trying to come back online.
As you noted, recommissioning is more complicated than simply doing the shutdown steps in reverse. Any specific callouts for coming back online?
Forrest: Just because you have a passing commissioning or qualification test doesn't necessarily mean a system's going to be operationally ready to do what you need from a process or operational need. Not all test protocols are capable of fully challenging a system for real-world conditions, especially if you're using water as your primary testing fluid.
Protein-based fluids behave differently than water in process systems. Depending on the situation, an engineering run may not be feasible. We typically combat that with hypercare coverage as we get back into operations, watching critical systems and ops in real time. That way, we're able to provide feedback and make adjustments rapidly so the batch can be carried forward.
Hypercare will scale back as you continue to process batches. You may have people watching everything for the first batch and then, OK, well, we know where the pain points are, so we're only going to watch operations A and B on the next batch.
About The Expert:
Nate Forrest is a principal owner and managing partner at A-BIO. He has over 20 years of experience in early-stage clinical manufacturing through commercial scales. He has a diverse background in the management of functional areas, capital projects, and CMO programs and previously worked as a program manger at GSK and, before that, held a number roles in biologics manufacturing. Connect with him on LinkedIn.