LADX
Start free
← Resources
Compliance·8 min read·

21 CFR Part 11 where the PLC is concerned

Electronic records, electronic signatures, audit trails, and the parts a controller genuinely has to satisfy.

Short answer

Part 11 applies wherever a system creates, modifies or maintains records required by predicate rule in electronic form. For a PLC and its HMI that usually means batch records, alarm and event history, and any parameter change affecting product quality. The requirements that bite are secure attributable access, a computer generated audit trail of changes with the old and new value, and the ability to produce accurate copies for inspection.

The five IEC 61131-3 languagesLDLadder Diagramgraphical, relay heritageFBDFunction Block Diagramgraphical, signal flowSFCSequential Function Chartsteps and transitionsSTStructured Texttextual, Pascal-likeILInstruction Listtextual, deprecatedOne standard, five notations. Most projects use two.

Part 11 is short, and most of the difficulty comes from people applying it to everything rather than to the records it governs.

What is in scope

It applies to records required by another regulation, the predicate rule, that are kept in electronic form, and to electronic signatures used in place of handwritten ones.

So the first question is not what the system does. It is which records the regulations require, and whether this system holds them electronically.

For a typical packaging or process line: the batch record is in scope. Alarms and events relating to critical parameters are in scope. Changes to a recipe are in scope. The internal state of a conveyor sequence, generally, is not.

Getting this boundary written down early is the single most useful thing on a project. Systems where nobody defined it end up either validating everything at great cost, or discovering at audit that something was out of scope only in somebody's head.

The requirements that actually bite

Attributable access. Individual accounts. Not a shared operator login, and not a keyswitch. Every action traceable to a person.

A computer generated audit trail. Time stamped, recording the old and new value of anything changed, generated by the system rather than typed by a user, and not disableable from within the application.

Accurate and complete copies. The ability to produce records for inspection, in both human readable and electronic form. A record locked inside a proprietary format nobody can export is a finding.

Record retention. For the period the predicate rule requires, retrievable throughout. Which is a genuine problem when the system has a ten year retention requirement and a five year hardware life.

Operational checks. Enforcing the permitted sequence of steps, so a phase cannot be signed off before it has run.

Authority checks. Only authorised individuals can use the system, sign records, or alter a record.

What this means at the controller

Practical consequences for the engineering.

  • Setpoint changes are records. A critical parameter changed on the HMI needs the audit trail entry, with who, what from, what to and when.
  • Recipes need version control and approval. A recipe is a record; changing it is a change to a record.
  • Time has to be right and synchronised. An audit trail with the wrong time is a defective audit trail, and a system whose clock can be adjusted by an operator has an audit trail that can be undermined without leaving a trace.
  • Programme changes need change control. Downloading a modified program to a validated system is a change, assessed, approved and tested.

Electronic signatures

Separate from records, and often over-applied.

A signature under Part 11 requires two distinct identification components, typically a user id and a password, and the signed record must show the printed name, the date and time, and the meaning of the signature, approval, review, responsibility.

Signatures are only required where the predicate rule required a handwritten one. Adding signature steps that no regulation asks for creates an obligation and slows the process for nothing.

ALCOA+ underneath it all

Part 11 is the mechanism; ALCOA+ is what it is trying to achieve. Attributable, legible, contemporaneous, original, accurate, and then complete, consistent, enduring and available.

Reading a proposed design against those nine words finds most of the gaps faster than reading it against the regulation, because they describe the property rather than the control.

Where LADX stands

Worth being plain rather than implying more than is true.

The audit trail records who did what and when, and it deliberately records facts rather than content: which model wrote a program, how many rungs, whether the validator objected. That is enough to reconstruct a sequence of events and it is not a validated system.

Nothing here has been through IQ, OQ and PQ at a customer's site, because that is something a site does with its own quality function, not something a supplier can do on their behalf.

Common questions

Does Part 11 apply to the PLC itself?
It applies to the records, wherever they are created and kept. A PLC that holds no records and simply executes control may be out of scope, while the HMI or historian holding the batch record is firmly in scope. In practice the boundary is drawn in the validation plan and the whole system is assessed together.
What must an audit trail record?
Who made the change, what changed including the previous and new value, when in a form that cannot be altered, and where a change is to a critical parameter, why. It must be computer generated, independent of the operator, and it must not be possible to switch it off or edit it from the application.
Is a shared operator login acceptable?
No. Part 11 requires records to be attributable to an individual, which a shared account cannot do. The practical objection, that individual logins slow operators down, is met with sensible session timeouts and badge readers rather than by abandoning attribution.

Keep reading