Risk-Based Cleaning Validation in Biopharmaceutical API Manufacturing

Published on: 
BioPharm International, BioPharm International-11-01-2005, Volume 18, Issue 11

Validation of a cleaning process demonstrates that it can reliably and effectively remove residue to an acceptable level.

Cleaning validation (CV) is driven by regulatory expectations to ensure that residues from one product will not carry over and cross contaminate the next product.1,2 Regulatory scrutiny is more rigorous in a multiproduct facility compared to a single product establishment. Companies are usually cited either for not having a sound cleaning validation or not meeting the protocol acceptance criteria. Because failing a protocol acceptance criteria is considered a substantial regulatory risk, companies are forced to spend money and resources even though there is minimal or no product risk.

A. Hamid Mollah

It is vital for a successful cleaning validation to have appropriate acceptance criteria. In developing the acceptance criteria, companies may adopt a conservative approach either to prove that they have a sound cleaning validation program or to ensure that field data (results) will reflect the acceptance criteria. The Food and Drug Administration's (FDA) guidance for determining residue limits is that they must be logical (based on understanding of the process), practical, achievable, and verifiable.3 In validation, adequacy of each cleaning procedure requires demonstration that it can reliably and effectively remove or reduce residues to an acceptable level such that residues from the production of one product will not carry over in significant amounts to the next product. Companies today are faced with the challenge of reducing validation costs in an environment that demands increased compliance with current good manufacturing practices (cGMP). FDA's initiative in pharmaceutical cGMPs for the 21st Century is a science and risk-based approach to product quality regulation. The risk- based approach will enhance the ability to focus on identifying and controlling critical factors that effect process and product quality.

When setting the specification for a production process it must reflect product quality so appropriate action can be taken when it deviates from specification. The purpose of setting process input limits is to consistently produce a quality product. On the other hand, the purpose of acceptance criteria in cleaning validation is to ensure acceptable levels of carryover residue. If the same acceptance criteria are used for cleaning validation in cell culture, purification, and formulation/filling processes, a good cleaning validation program can be penalized because the acceptance criteria are too rigid. Therefore, a cleaning validation program based on risk assessment with justifiable and achievable acceptance criteria is crucial. This paper addresses cleaning validation in biopharmaceutical active pharmaceutical ingredients (APIs).

PROCESS RESIDUES IN BIOPHARMACEUTICAL APIS

Many biopharmaceutical products are proteinaceous, and their manufacturing involves media and buffer preparation, cell growth, cell harvest and processing, product purification, and other steps. Biopharmaceutical residues are often composed of proteins, lipids, simple and complex sugars, and salts. For biologically derived products, contaminants could be any one or more of various organic and/or inorganic residues introduced or derived during the production process. Many biopharmaceutical processes also require decontamination with steam prior to cleaning; heat denatured residues are a common challenge. Proteinaceous residue or polysaccharide removal can be difficult due to denaturation, insolubility, foaming, and other factors. The removal of lipid, simple sugar, and salt residues is often less difficult. Validation of a cleaning process requires the demonstration that the cleaning process can reliably and effectively remove or reduce residues to an acceptable level. The validation of a multiproduct cleaning process is more challenging compared to a single product.

Worst-case validation testing strategies reduce the total quantity of validation studies for a system or process. By demonstrating that the cleaning process is consistent and effective for the worst-case conditions, all other conditions are, by default, assured of consistent, effective operation. Worst case may include highest soil (product and others) concentrations in the hardest to clean area. Due to a large number of variable parameters that exist for entire cleaning processes, the worst-case cleaning concept is applied to unit operations or to equipment matrices.

TRADITIONAL CLEANING VALIDATION APPROACH

In a traditional approach, acceptance criteria are derived from industry standards, past experience, company policy, and capability study data. Some companies choose to perform development studies to determine achievable cleaning performance and to set the acceptance criteria based on study results. A clean-in-place (CIP) cycle is developed for a worst-case cleaning scenario in term of soils, dirty hold time, and equipment configuration followed by development runs. If they meet the acceptance criteria, then a validation protocol is developed and a minimum of three runs are performed. When all validation runs meet acceptance criteria, a summary report is written and approved, and the cleaning process is considered validated. However, the company faces a dilemma when validation runs fail. Root cause analysis may show that acceptance criteria are too rigid and are not scientifically based. Because revising acceptance criteria may not be a viable option when a protocol fails at this stage, the company is forced to modify the cycle and return to the development stage.

RISK-BASED APPROACH

In a risk-based approach, the CIP will determine acceptable carryover and ensure no product impact. Acceptance cleaning will depend to a given extent on what other products are manufactured with the same equipment. The level of any residues from earlier cleaning processes present in the final API must be evaluated in the light of the effect it has on the manufacturing process for the API and on the finished drug product. Product, soils, and equipment are reviewed to determine maximum allowable carryover (MACO). Acceptance criteria are determined by dividing the MACO by a safety factor. The safety factor is selected from toxicology and reliability data, the cleaning agent used, and company policy. The stage in API production should be considered when establishing acceptance criteria. Where residues from upstream cleaning steps will be reduced or removed in subsequent processing steps should be taken into account when setting the safety factor. For example, if the maximum allowable level of a specific residue in the finished drug product is 5 ppm, and the API constitutes 0.1 percent of the finished drug product, then the maximum allowable level in the API is calculated to be 5,000 ppm. The effect of process/product residues on the manufacturing process should be considered when setting acceptance criteria. Where a process residue may be allowed in large concentrations based on carry over into the final product, the effects of the residue on the manufacturing process should also be evaluated. A proteinaceous residue left in large amounts on the surfaces of a bioreactor could provide a substrate and energy source for the growth of objectionable organisms.

CIP cycles are developed for worst-case cleaning scenarios in terms of soil type, dirty hold time, and equipment configuration. In choosing cleaning solutions, cost, removal of cleaning chemicals, toxicology (product impact), and environmental (waste removal) are considered. Development runs should be conducted to test the cycle prior to initiating CIP validation. These runs should be designed to evaluate CIP cycle parameters, cleaning chemistries, and equipment configurations, and they should demonstrate a proven acceptable range for the cleaning process. Determining a point of failure for the cleaning process is not required. The developed process should be sufficiently robust to achieve a high degree of assurance of reducing residues to an acceptable level. When the results of the development runs meet the acceptance criteria, a validation protocol is developed and the required number of runs (typically three consecutive runs) are performed. When all runs meet acceptance criteria, a summary report is approved and CIP is considered validated. If acceptance criteria fail, an investigation is performed to determine the root cause of the failure. In this investigation, the company focuses its resources on operational and cycle failure, not acceptance criteria. For equipment failure, the impact on the run is evaluated and the run is accepted or repeated. However, when a validation run fails and the analysis reveals that the cycle is not effective, then the cycle will be modified for better cleaning performance. There will be no change in acceptance criteria. Effective cycle development will significantly increase the probability of first-pass success in validation runs.

Critical parameters for CIP cycles include cleaning detergent concentration, duration of cleaning and rinse steps, flow rates, pressure, and temperature of cleaning and rinse steps. Critical cleaning parameters for manual cleaning and clean-out-of-place (COP) include temperature of cleaning and rinse solutions, duration of cleaning and rinse steps, and cleaning detergent concentration.

Advertisement

RISK-BASED ACCEPTANCE CRITERIA

The following factors should be considered during development of acceptance criteria:

  • Maximum allowable carryover (MACO) and safety sactors

  • Process risk versus patient risk

  • Manufacturing stage (pre, post, and during purification)

  • Cross-contamination between products or product intermediates

  • Single vial concept and worst-case cleaning

Maximum Allowable Carryover (MACO) and Safety Factors

The MACO approach can be used for API, cleaning chemicals, and other soils. The MACO principal has been discussed in detail and calculations are shown in various literature.4,5 For biotechnology processes, detection of the desired API can be challenging, let alone detection and quantitation of a specific contaminant. When steam-in-place (SIP) is used for decontamination prior to CIP, API protein would be denatured. No cross contamination for API is expected for a single product, hence MACO for active ingredients may not apply. In that case, it is expected to establish MACO for other soils and denatured API in terms of total organic carbon (TOC) levels. For cleaning chemicals, the lethal dose (LD50) or the no observed effect level (NOEL) can be applied. The safety factor will depend on data type. A safety factor of 1000 may derive from 10 for intraspecies, 10 for interspecies, and 10 for route differences.

Process Risk versus Patient Risk

Process risks are typically risks to the yields or impurity profiles of the API during the manufacturing process. Process risks are generally categorized as a producer risk as they may affect the cost of manufacture in case of yields, or make the product unsuitable for use, or require reprocessing in the case of atypical impurity profiles. These risks also present a regulatory risk as they may indicate a manufacturing process not in a state of control. These risks are usually less severe than patient risk and may require a smaller safety factor than patient risks. Patient risks are direct or indirect risks of adverse events due to ineffective cleaning. One of the most severe risks is cross-contamination between two different products. This is especially true for potent or cytotoxic products. Where possible, risks of cross-contamination between products should be minimized or eliminated through various mistake-proofing or mitigation methods such as use of dedicated or disposable equipment, on-line measurement of residue levels during cleaning, and other viable methods.

Manufacturing Stage

A significant consideration in assessing patient risk is the manufacturing stage in which a contaminant is introduced. A contaminant introduced in the cell culture/fermentation step will be less likely to be present in the final product than a contaminant introduced post-purification. The number of dilution or purification steps should be factored in when assigning risk levels. Process risk should also take into account the process step in which the contaminant is introduced and the effect of the contaminant on subsequent processing steps. Process risks such as membrane or column fouling, atypical elution profiles, etc. should all be factored into account when assigning risk based on the manufacturing stage.

Cross-contamination

Cross-contamination is a major concern addressed by the cleaning process. When designing a cleaning validation program and evaluating process/patient risks, the potential for cross-contamination between products should be assessed. For biopharmaceutical products, special consideration should be given in areas where there is concurrent manufacture of multiple products and to campaign change-over for multiple products manufactured by the same equipment. A useful tool for evaluating routes for cross-contamination between products is fault tree analysis (FTA), where a team assembles a logicical diagram that illustrates failures required for contamination to occur. A sample FTA diagram is depicted in Figure 1.

Table 1. Matrix Approach for Typical API Manufacturing Equipment

Single Vial Concept and Worst-case Cleaning

The single vial concept is a conservative approach to cleaning validation in which it is assumed that all of a given contaminant resides in a single vial of product. This approach is frequently used in pharmaceutical tablet manufacturing facilities, where there is a significant risk of a contaminant ending up in a single tablet due to batch non-uniformity. This approach leads to stringent acceptance criteria as the single worst-case swab result is used for acceptance or rejection of the entire validation study, even though this worst-case location may only represent a fraction of the total area cleaned. In biopharmaceuticals that are aseptically filled, this approach may be used for any contaminants that occur after final sterile filtration. This approach, while appropriate for final formulation and filling, is not appropriate for APIs that are further processed (diluted and mixed) and sterile filtered prior to final filling. The processing and filtration steps make it much more likely that contaminants will be uniformly distributed throughout a batch rather than in a small volume of product. Averaging of swab values may be more representative of actual process risk for APIs.

Worst-case cleaning is cleaning at a set of parameters within the proven acceptable range for the cleaning process that represent the least effective allowable cleaning process. Worst-case parameters should be determined during cycle development, with the exception of hold times between end of use of the equipment/system and cleaning of equipment (dirty hold times). The cleaning parameters should be run at nominal values during cleaning validation studies for APIs. The performance of equipment under worst-case conditions should be evaluated as part of cycle development studies for cleaning. Validating a dirty hold time greater than the maximum allowable dirty hold is not recommended when an extended hold may change the nature of soils (e.g., flaking). Because dirty hold times between equipment use and cleaning can significantly affect the effectiveness of the cleaning process, worst-case hold times should always be evaluated during cleaning process validation studies. For API manufacture, the amount of safety factor over the maximum allowable dirty hold time may be varied based on the patient and product risk posed by potential contaminants.

MATRIX/FAMILY APPROACH AND BRACKETING

To validate cleaning of multiple pieces of equipment, a matrix approach can be employed. Equipment of similar size and configuration exposed to similar soils can be grouped, and representatives of the group can be analyzed after cleaning operations. For CIP, a single member of a group is evaluated over three runs while other members are analyzed in a single run. In some cases, three runs in a representative tank in worst-case soiling conditions and no run in some tanks may be justified through development studies and monitoring. For manual cleaning and COP, a single member can be analyzed over three runs and other members may not require any testing. The cleaning validation protocol will define the testing requirements for a group of like equipment and justify the test plan. Part of the justification for using a matrix approach should be a risk assessment of cross-contamination effect between products in a given family. Items that are high-risk due to difficulty of cleaning or low MACO should be used as worst-case products, or qualified separately.

To apply the matrix approach, the manufacturing process is reviewed for three main parameters: equipment type (size, surface finish, and configuration), cleaning process, and soil characteristics. Soils are considered to be any residue that could possibly remain on the equipment after the manufacturing process. All manufacturing equipment in a process segment is inventoried and grouped by cleaning procedure and equipment type. The equipment is considered to be of the same group if it is cleaned by the same cleaning procedure and is of equivalent size, shape, and construction. In cases where equipment is exposed to multiple soils in normal usage, the most difficult to clean soil or highest-risk soil is identified. This soil is used as the representative soil for cleaning validation. Representative soils are selected based on solubility, reactivity, toxicity, and difficulty in cleaning. Table 1 shows an example of the matrix approach for API manufacturing systems.

Table 1. Matrix Approach for Typical API Manufacturing Equipment

RISK ANALYSIS TOOLS

The various risk analysis tools recommended for pharmaceuticals include FTA, failure mode and effect analysis (FMEA) and hazard analysis, and critical control point (HACCP).6 ISO 14971:2000 is a risk assessment for medical devices that requires one to define usage, identify hazard, and estimate risk. FMEA can be applied to identify hazard and occurrence probability. It is a preventative tool, with a bottom-up approach to identify all potential failures of a product, process, or system prior to use as well as assessing the effects or consequences of the identified failure modes.7

FTA is a structured top-down approach used to identify the factors that contribute to a failure.8 It can be used by itself as a risk analysis method or in conjunction with FMEA to identify failure risks.

Table 2 illustrates risk analysis for media tanks and bioreactors. Severity and occurrence probability could be a numerical scale (e.g., 1 to 5) or qualitative scale (low/medium/high). Severity and occurrence probability will depend on CIP design, soil characteristics, and product process (single product versus multi-product), hence no value was assigned to these factors in the table. High severity and high occurrence probability may need mitigation to reduce the risk.

Table 2. Risk Analysis for Media Tanks and Bioreactors

SAMPLING CONSIDERATIONS

Cleaning validation demonstrates the removal of production process residues and cleaning agents. A key question is relating what is measured in the rinse water routine monitoring to possible contamination levels of that residue in the subsequent product. Sampling should be indicative of contaminants and avoid redundancy. Swabbing and visual inspection are utilized to directly inspect product contact surfaces and is the primary method for assessment of surface cleanliness. Indirect testing methods should be used for inaccessible areas (e.g., plug port). Potential critical sites or areas where residues are likely to accumulate should be identified for swab sampling. Rinsate sample testing for pH, conductivity, and total organic carbon (TOC) are indirect testing methods to confirm direct inspection results. Rinsate pH and conductivity data may provide effectiveness of cleaning agent removal. The TOC assay will detect organic carbon residues from product residues, cell culture/fermentation media, and other organic materials including organic components of formulated cleaning agents. Control of the microbial and the pyrogen contaminations should be monitored through bioburden and endotoxin testing, respectively.

VISUAL

Visually clean is a regulatory expectation for all cleaning processes.3 Visual analysis is used to evaluate the effectiveness of cleaning procedures and cycles by detecting the presence of visible residues. Jenkins and Vanderweil reported that residual materials could typically be visually detected at the 1 to 4 mg/cm2 level.9 Sensitivity will depend on soil type and concentration and operator's qualification. Sensitivity could be determined during development runs using actual equipment, soil, and qualified operators or as part of a simulation study using qualified operators (people who will perform visual observation). When a study uses actual equipment, soil, and qualified operator, it may be justified that no swab sample is required for validation on the basis of a relationship between swab and rinse results.

ENDOTOXIN AND BIOBURDEN

Due to acidic or caustic properties of the cleaning agents, it is not expected to build up microbial contaminants during cleaning. However, the distribution of the contaminants and proliferation of the microbe during clean hold could be a concern. Validation should identify the source of contaminants and address them. Microbiological analysis is used to evaluate the effectiveness of the cleaning process for reducing the bioburden level. When SIP is used in post-CIP prior to equipment use, a substantial increase in bioburden load may affect SIP performance. The acceptable limit for bioburden is equal to or lower than the product specification for each manufacturing process segment. The total coliform specification is 0 CFU/mL. Endotoxin analysis (Limulus Amoebocyte Lysate Assay) is used to evaluate the effectiveness of the cleaning process for reduction of endotoxin. In the cell culture and purification process, the acceptance limit for endotoxin is equal to or lower than the process specification.

PH AND CONDUCTIVITY

pH and conductivity indicate rinsate acidity or alkalinity. They can be used as indictors for the removal of cleaning agents. If the product is acidic or basic, rinsate pH and conductivity values may be used to evaluate the presence of product residues in the rinse. pH analysis is used to evaluate the effectiveness of rinse procedures by detecting trace quantities of basic or acidic compounds used in the cleaning process. pH analysis of final rinse water may be especially appropriate for process steps such as column chromatography or tangential flow filtration, where pH adjusting agents such as sodium hydroxide (NaOH) are also used as cleaning agents. If traces of NaOH are present after cleaning, there would be minimal risk as it is already a process component. Measurement of final rinse water pH can be a sensitive measure of residual cleaning agent in this case. Concentration curves correlating the concentration of NaOH in the final rinse water to final rinse water pH should be determined to set the acceptance criteria for final rinse water pH. Conductivity is used to evaluate the effectiveness of rinse procedures by detecting trace quantities of cleaning chemicals during water-for-injection (WFI) rinse. A relationship between conductivity and the concentration of cleaning chemical needs to be established. Acceptable carry over of cleaning chemicals should be based on its toxicity such as LD50 and NOEL. A typical CIP process consists of an initial purified water rinse to drain, followed by a caustic step, an acid step, and then a final WFI rinse. In this case, conductivity due to presence of the acid solution is dominant. However, verification should be in place for complete removal of caustic.

RINSATE TOTAL ORGANIC CARBON

Rinsate TOC is an indicator of the presence of "carbonaceous material" in the rinse. Although rinsate TOC is an indirect test, it can be a good indicator of the presence of product/buffer/media or cleaning chemicals in the rinsate. TOC assays for rinse water and surface swab samples are non-specific and are performed to detect organic residues such as residual product and other organic components. To set acceptance limits for these assays, three factors were considered: MACO, suppression of bioburden/endotoxin during post cleaning storage, and CIP system capability. For a multi-product facility, TOC acceptance criteria should be established on the basis of MACO. For single product manufacturing with dedicated equipment and no concern for cross-contamination of active pharmaceutical ingredients, application of MACO may not be applicable. Equipment must be cleaned to the point where residuals will not significantly support growth of microorganisms between equipment uses. Equipment clean hold studies should support that equipment cleaned to TOC acceptance limits for both surface and rinse sampling meet bioburden and endotoxin acceptance limits after storage. Some equipment, due to size or configuration, is impossible to swab. In these cases, rinse sampling is the primary method of evaluation and protocols will include justification of the rinse sample methods utilized. Some buffers contain no organic materials and as a result, TOC testing is not an appropriate test on buffer tanks that contain these buffers.

SWAB TOTAL ORGANIC CARBON

Swab TOC acceptance criteria are usually derived from uniform distribution of the soils throughout the equipment stream. It is expected that a hard-to-clean (worst location) swab area will have higher TOC compared to easy-to-clean surfaces. Using the same acceptance criteria for hard-to-clean areas and other areas may be justified by recognizing that 1) using separate acceptance criteria is not feasible and 2) it represents a worst-case acceptance scenario. There is no need to assume uniform TOC concentration on the surface after CIP when actual surface TOC value after CIP validation run is available.

TOXIC CHEMICALS

Biotechnology production processes may use chemicals of a significantly toxic nature such as Methotrexate or Cyanogen bromide. The acceptable level of toxic chemicals in rinse water is established based on the NOEL drug toxicity rationale. Risk analysis for toxic chemicals should take into account not only patient risk, but risk to production employees and to the environment. Risk analysis should also consider the stage of the production process in which toxic chemicals are used. For example, when Methotrexate, a selection agent, is introduced into the manufacturing process at an early stage in the process (e.g., spinner flasks), it is diluted into large bioreactors prior to purification. This dilution effectively reduces the concentration of Methotrexate to a negligible level in the API prior to purification. Therefore, Methotrexate should not be considered a residue indicative of the cleaning procedure effectiveness, except at early stages in the production processes (spinner flasks and initial scale-up) .

SYSTEM CAPABILITY

System capability will demonstrate the robustness of the cleaning process. Cleaning validation studies should demonstrate that soil residues are reduced to below visual detection level (DL) by consistently meeting visual acceptance criteria. This demonstrates that the cleaning processes are capable of reducing TOC residues to visual DL (e.g., less than 4 mg/cm2) on product contact surfaces. One way to determine system capability is by collecting samples at various times during the cleaning step (e.g., rinse TOC in final rinse). A plot of rinse concentration versus time will show a point when there are no significant changes in rinse concentration with additional rinse time. A relationship between rinse concentration and surface swab results should be established. It is expected to perform a study to determine recovery of TOC residues from equipment surfaces. The linear regression line, passing through the average of negative control sample for each soil, can give a swab TOC concentration for a specific soil level.

PROCESS ANALYTICAL TECHNOLOGY IN CLEANING VALIDATION

FDA defines Process Analytical Technology (PAT) as "a system for designing, analyzing, and controlling manufacturing through timely measurements (i.e., during processing) of critical quality and performance attributes of raw and in-process materials and processes with the goal of ensuring final product quality." PAT in cleaning can be applied to 1) complement the validation and 2) optimize equipment usage based on real time data. In both cases, it is expected to identify parameters that indicate equipment cleanliness. Usually this is done at the final rinse. A selection of parameters that can be monitored on-line is performed for PAT application. Concentration versus time plots for the parameters are determined with a safety factor. For indirect parameters, such as rinse concentration for surface soil concentration, relationships between surface soil levels and rinse water levels need to be established. These relationships should be used during validation studies to establish alert and action limits to be used with PAT.

Types of PAT measurements that can be used to verify cleanliness after the completion of the CIP cycle include conductivity/pH to measure residual cleaning agent, TOC to measure product or cleaning agent residuals, or UV absorbance for protein residues. Other types of measurements may be developed based on the API and cleaning agent.

CLEAN HOLD TIME

To avoid microbial proliferation, post-CIP drying, flushing with WFI, and SIP are utilized for biopharmaceutical processes. It is expected to demonstrate they maintain acceptable microbial quality between the time the equipment is cleaned and the time the equipment is used or steamed-in-place (clean hold time). For equipment not maintained as a closed system, recontamination with dust particles or airborne microbes can contribute to microbial proliferation when combined with moist surfaces. For equipment steamed-in-place, the validation of the SIP process must take into account the bioburden present in the equipment. Even when SIP factors bioburden into account, high microbial burden will cause increased endotoxin levels. Clean hold time is not a risk when SIP is performed immediately after CIP and equipment is maintained as a closed system between SIP and production use.

DISCLAIMER

The information provided in this paper reflects the authors' view and is not intended to represent the official position of Baxter Healthcare Corporation. Actual processes previously or currently implemented by Baxter Healthcare Corp. may differ from those disclosed in this paper. Authors make no representations or warranties regarding these processes implemented by readers of this paper.

A. Hamid Mollah, Ph.D.,Technical Manager, Genentech, Inc.1 DNA Way, South San Francisco, CA, 94080 650.467.1095, amollah@gene.com and Edward K. White, Senior Validation Scientist, QA Validation, Baxter BioSciences Thousand Oaks, CA 91320, 805.375.6779, Fax: 805.480.2883.ed_white@baxter.com

REFERENCES

1. 21 CFR part 211

2. Guidance for Industry, Q7A Good Manufacturing Practice Guidance for Active Pharmaceutical Ingredients, FDA, August 2001 ICH.

3. FDA, Guide to inspections of validating of cleaning processes. Rockville, MD, USA.

4. Cleaning and Cleaning Validation: A Biotechnology Perspective, Brunkow et al, PDA, 1996.

5. Validated Cleaning Technologies for Pharmaceutical Manufacturing, Destin LeBlanc, Interpharm Press, 2000.

6. Mollah, A.H., Risk analysis and Process validation, BioProcess International, Vol. 2, No. 9, 28-36, October 2004.

7. Stamatis, D.H. Failure Mode and Effect Analysis: FMEA from Theory to Execution. Milwaukee, WI, ASQ Press, 1995.

8. International Electrotechnical Commission (IEC). International Standard IEC 1025: Fault Tree Analysis,1990, International Electrotechnical Commission.

9. Jenkins, K.M, and Vanderweil, A.J., Cleaning Validation: An Overall Perspective, Pharm. Tech., V18(4), pp. 60-73, April 1994.