ISA-88 in practice: recipes, equipment and the separation between them
The physical and procedural models, why a recipe should not name a valve, and what a phase actually is.
Short answer
ISA-88 separates what to make from the equipment that makes it. The physical model divides the plant into process cells, units, equipment modules and control modules; the procedural model divides the recipe into procedures, unit procedures, operations and phases. The rule that makes it work is that a recipe names phases and parameters, never specific equipment, so the same recipe runs on any capable unit.
The idea underneath ISA-88 is one sentence: what you are making and the equipment you make it on are different things, and the software should keep them apart.
Everything else in the standard follows from that, and every plant that has ignored it has the same symptom: a separate program per product, each a copy of the last, all slightly different.
The physical model
The plant, decomposed.
- Enterprise and site. Business level, above the control system.
- Process cell. The set of equipment that makes a batch.
- Unit. Where a major processing activity happens, and where a batch resides at a point in time. A reactor, a mixing vessel. A unit can hold one batch at a time.
- Equipment module. A functional grouping that carries out a finite processing activity: a dosing skid, a CIP set, a heating circuit.
- Control module. The lowest level, a single device or a tight group: a valve, a pump, a control loop.
The useful discipline is the boundary. A control module knows how to open a valve and knows nothing about batches.
The procedural model
The process, decomposed, and deliberately parallel to the physical model.
- Procedure. The whole recipe.
- Unit procedure. Everything done in one unit.
- Operation. A major processing sequence within a unit.
- Phase. The smallest independent piece of process work.
The rule that makes it worth doing
A recipe names phases and parameters. It never names equipment.
A recipe that says 'Charge 400 kg of water via valve XV-107' is bound to one plant configuration forever. A recipe that says 'Charge, material water, quantity 400 kg' runs on any unit with a Charge phase, and the equipment works out which valve.
This is the difference between a plant where a batch moves to a free reactor and a plant where a batch waits for reactor 1 because that is what the recipe says.
Phases, properly
A phase is where most of the engineering effort goes, and it lives in the equipment.
It has a standard interface: start, hold, restart, stop, abort, and a state it reports. It takes parameters. It reports what it did.
The state model is the part usually cut short. A phase that can only run and finish is fine until a batch has to be held mid-charge, and then there is nowhere for the logic to go. Implementing hold, restart and abort properly at the start is much cheaper than adding them to forty phases later.
The recipe types
Four, and they explain a question that comes up constantly.
- General recipe. Site independent, from the laboratory. What to make, in process terms.
- Site recipe. Adapted to a particular site's materials and constraints.
- Master recipe. Bound to a process cell, naming its phases. This is the one in the batch system.
- Control recipe. A copy of the master, made for one batch, with the actual quantities. This is what executes and what becomes the batch record.
The control recipe being a copy is why changing a master recipe does not alter a batch already running, which is exactly the behaviour a regulated plant needs.
Where it goes wrong
- Equipment names in recipes. The primary failure, and the one that eliminates the benefit.
- Phases too large. A single Make phase that does everything is a program with a recipe wrapper.
- Phases too small. A phase per valve produces a recipe that is a wiring diagram.
- No hold or abort. Discovered the first time a batch has to be stopped part way.
- The batch record as an afterthought. What was actually done, with actual quantities and actual times, is the output that matters in a regulated plant, and retrofitting it is much harder than designing it in.
Without a batch engine
Plenty of machines make several products and have no batch software.
The separation is still worth adopting. Recipe parameters in a structure, phases as reusable routines with a state model, and a sequence that invokes them. It is ISA-88 thinking without ISA-88 tooling, and it produces a machine where adding a product is data rather than code.
Common questions
- What is a phase in ISA-88?
- The smallest procedural element that does independent process work: Charge, Heat, Agitate, Transfer. It is implemented in the equipment as reusable logic with a defined interface, and the recipe invokes it with parameters rather than reimplementing it. A phase belongs to the equipment, not to the recipe.
- Why should a recipe not reference specific equipment?
- Because then it only runs on that equipment. The whole benefit of the standard is that a recipe describes the process and any capable unit can execute it, so a batch can be made on reactor 2 when reactor 1 is down without editing anything.
- Is ISA-88 only for pharmaceutical plants?
- No. It came from the process industries and applies wherever there are recipes and shared equipment: food, beverage, speciality chemicals, coatings. Even where formal batch software is not used, the separation of recipe from equipment is a sound way to structure a machine that makes more than one product.
Keep reading
- Safety
SIL or PL: which one does your machine need?
Two standards, two scales, and one machine. Which one applies, how they map to each other, and why the answer is usually ISO 13849.
- Safety
Categories B, 1, 2, 3 and 4, in plain terms
Five architectures, what a single fault does to each, and the practical wiring that goes with them.
- Safety
Safety relay or safety PLC: how to decide
One is a wiring decision, the other is a programming one. The count of safety functions, not the size of the machine, is what settles it.