Mobile Robot Qualification in GMP Cleanrooms: URS to PQ

Why a Robot Is Not an Ordinary Equipment Purchase

In a GMP facility any equipment that comes into contact with the product, the primary packaging or the controlled environment is subject to qualification. A mobile robot that drives through a Grade B or Grade C area, or that carries materials between classified rooms, is inside the quality system from the day it arrives. That changes four things at once.

Dimension	Ordinary industrial purchase	GMP purchase
Acceptance criteria	Vendor specification	User requirement specification approved by QA
Documentation	Datasheet and manual	DQ, IQ, OQ, PQ protocols and reports
Change control	Vendor release notes	Firmware updates under change control before install
Cleaning	Operational preference	Validated cleaning procedure with residue limits
Periodic review	Optional	Scheduled, documented, with continued suitability conclusion

The practical consequence is that the robot is treated less like a vehicle and more like a piece of process equipment that happens to move. A site that buys on specification alone and starts the documentation afterwards will routinely discover that the vendor's standard evidence pack does not answer the questions QA actually asks, and that the gap cannot be closed by the vendor after the fact.

The other shift is temporal. Qualification adds eight to twenty weeks to a project that would otherwise take four, and that timeline runs on QA resource rather than vendor lead time. Projects that fail to plan for it do not fail technically; they fail to reach commercial supply on the date the business expected.

The Qualification Sequence

The sequence below is the conventional staged approach and is what most QA functions will expect to see. Each stage has an entry condition and a signed output, and skipping a stage is the most common cause of a failure at the next one.

Stage	Question answered	Typical duration	Output
URS	What must the robot do, in which grade, with what evidence	3 to 6 weeks	Approved user requirement specification
DQ	Does the offered design meet each requirement	2 to 4 weeks	Design qualification report with requirement traceability
IQ	Is it installed as specified, with correct utilities and documents	1 to 3 weeks	Installation qualification report, asset registered
OQ	Does it function across its operating range, including deviations	3 to 6 weeks	Operational qualification report with test evidence
PQ	Does it work in production, over repeated shifts, with real loads	4 to 8 weeks	Performance qualification report, release to use
Periodic review	Is it still fit for purpose	Annual, 1 to 2 weeks	Continued suitability conclusion

The OQ stage is where mobile robots differ most from static equipment, because the operating range includes navigation behaviour that cannot be tested standing still. A credible OQ exercises the robot at its worst case: the busiest route at shift change, the narrowest doorway in the facility, the lowest state of charge at which it is still expected to complete a task, and the network conditions during a handover between access points.

PQ then has to demonstrate reliability rather than capability. A typical acceptance criterion is a defined number of consecutive production shifts with task completion above a stated threshold and zero unplanned stops in a classified area, logged and signed by operations rather than by the project engineer.

The Evidence Package QA Will Ask For

Most of the delay in a first deployment comes from documents that were never requested at the quotation stage. The list below is the working set for a mobile robot intended for classified areas; a vendor that cannot supply it at tender stage is a schedule risk regardless of price.

Document	Why QA needs it	Common gap
Materials of construction declaration	Contact surfaces, cleaning compatibility	Only the outer shell is declared, not the wheels or bumpers
Surface roughness data	Cleanability of horizontal surfaces	No measurement on the top deck
Particle and airflow test report	Impact on the grade of the room	Tested in a test facility, not on site
Cleaning agent compatibility matrix	Validated cleaning procedure	Only one agent tested, typically a neutral detergent
Firmware and software version record	Change control baseline	Version not frozen at IQ
Data integrity statement	Audit trail, e-signature, record retention	No exportable audit trail
Cybersecurity assessment	Network segmentation, patch policy	No patch policy, no supported lifetime
Spare parts and obsolescence plan	Continued suitability over the asset life	No commitment beyond warranty
Change notification agreement	Right to approve changes affecting quality	Silent over-the-air updates enabled

Two of these deserve specific attention because they are structural rather than administrative. A robot whose firmware updates automatically is incompatible with change control: the site must be able to approve, schedule and document each update, which means the vendor must support a locked version and a managed upgrade path. And a robot with no exportable audit trail cannot satisfy data integrity expectations for any record the system is trusted to hold, including task completion in a GMP area.

The materials declaration gap is particularly frequent. Vendors declare the robot housing, then the site's cleaning validation discovers that the wheels are a porous compound that retains residue, or that the bumper is fixed with adhesive that is not compatible with the site's sporicidal agent. Both are discoverable at DQ and expensive to correct at PQ.

Cleanroom Constraints That Decide the Platform

Before any commercial comparison, three environmental properties decide which platforms are even eligible. They are measured, not asserted, and they interact with the facility's own classification.

Property	Requirement in a Grade C or D area	Requirement in a Grade B area	How it is verified
Particle generation at the outlet	ISO Class 7 compatible, no measurable increase	ISO Class 5 compatible under all motion states	Airborne particle count during operation
Airflow disturbance	No disruption of unidirectional flow at working height	No disruption within the critical zone	Smoke study or anemometer survey
Surface cleanability	Smooth, non-porous, no horizontal ledges	Same, plus validated wipe-down procedure	Visual inspection plus residue testing
Cleaning agent compatibility	Neutral detergent, IPA wipes	Sporicidal agents, low-residue wipes	Material compatibility test coupons
Movement protocol	Controlled routes, door interlocks	Air-lock discipline, no simultaneous entry	Documented route and interlock test

The airflow point is the one most often underestimated. A mobile robot moving along a corridor in a Grade B area generates a wake, and that wake can disrupt the unidirectional flow a biosafety cabinet or an isolator depends on. The test is not whether the robot is clean, but whether the room stays clean while the robot is moving, and it must be demonstrated in the actual production layout rather than in a test room.

Grade D and Grade C areas carry the same questions in a milder form, and many transfer and logistics robots in pharmaceutical facilities operate exclusively in these grades. A platform designed for a non-classified warehouse will often fail the surface cleanability criterion at the point where the site tries to write the cleaning procedure, even if particle counts are acceptable.

Validation Timeline and What Drives It

The eight to twenty week qualification estimate is a range because the drivers differ by site. The table below shows where the time actually goes for a single robot serving a transfer route between a Grade C dispensing room and a Grade D packaging hall.

Activity	Duration	Dependency	Can it run in parallel
URS drafting and QA review	3 to 6 weeks	Process owner availability	Yes, with tendering
Vendor evidence review	2 to 3 weeks	Documentation completeness	Yes, with DQ
Site survey and route mapping	1 to 2 weeks	Production access windows	Yes, with DQ
Installation and IQ	1 to 3 weeks	Utilities, network, door interlocks	No
OQ testing	3 to 6 weeks	Access to classified areas during production	Partly
Cleaning validation	2 to 4 weeks	Site laboratory availability	Yes, with OQ
PQ runs	4 to 8 weeks	Production schedule readiness	No
QA review and release	2 to 3 weeks	All reports signed	No

Two dependencies dominate: access to classified areas during production, and QA reviewer availability. Both are internal constraints that the project cannot buy its way out of. A realistic plan therefore sequences OQ around production windows identified before the project starts, and books QA review time at the same point the protocols are approved rather than when they are complete.

The single largest schedule saver is a vendor evidence pack that is complete at tender. Sites that received particle data, cleaning compatibility and a materials declaration before purchase reported qualification timelines at the low end of the range; sites that discovered gaps during OQ were consistently above eighteen weeks, because a re-test in a classified area requires a new access window and often a new round of QA review.

Operating the Robot Inside the Quality System

Release to use is the beginning of the obligation, not the end. Four ongoing controls determine whether the robot remains qualified, and each needs an owner named in the validation report.

Control	Frequency	Owner	Record
Cleaning verification	Per shift, with periodic residue testing	Production	Cleaning log linked to the asset
Performance monitoring	Continuous, reviewed monthly	Operations	Task completion and stop-reason report
Change control	Per firmware, route, or payload change	Engineering with QA	Change record with impact assessment
Periodic review	Annual, or after any significant change	QA	Continued suitability report

Change control is where most sites accumulate risk over time. A route change looks like an operational adjustment, but it can alter the material flow through classified spaces, and therefore needs a documented assessment. The same is true of a payload change, a new dock location, or a battery replacement with a different cell supplier.

There is a second, quieter risk in the integration with the site's other systems. Where the robot reads tasks from a manufacturing execution system or writes completion records back into it, the robot becomes part of a validated data path, and its interface needs to be described in the validation documentation. Sites that treat the robot as standalone avoid this requirement initially but usually re-open the validation when they later integrate, which is more expensive than specifying the interface once.

Fleet scale adds a third consideration. Once there are several units across multiple buildings, the fleet software itself becomes quality-relevant, because it allocates tasks and holds the audit trail. Programs that intend to scale should validate the fleet layer at the same time as the first unit rather than treating it as an operational tool, and the multisite deployment sequencing used for other robot programmes applies here with the QA gates added. For sites in adjacent regulated manufacturing such as food and beverage, the same documentation instincts apply in a lighter form, as set out in the food manufacturing deployments on this site.

Common Failures and Their Cost

The failure modes below recur across pharmaceutical deployments. Each is avoidable at the specification stage and expensive to correct afterwards.

1. The URS is written from the vendor datasheet. Requirements become what the product already does, and the QA function rejects the document because it does not describe the process need. Cost: a four week rewrite at the start of the project.
2. Particle testing only on a test bench. The site test fails during OQ because the production layout has different airflow, and a re-test needs a shutdown window. Cost: six to ten weeks of schedule.
3. Automatic firmware updates left enabled. An update lands after IQ and the configuration baseline is void. Cost: full re-verification of the affected functions.
4. Cleaning procedure written after installation. The agent selected turns out to be incompatible with a surface on the robot. Cost: replacement parts plus a new validation round.
5. No obsolescence commitment. The platform is discontinued in year four and continued suitability cannot be maintained. Cost: unplanned replacement of a validated asset.

None of these is a technology problem. All five are specification and documentation problems, and all five are cheaper to prevent than to fix. A tender that requires the evidence pack up front, freezes the software version at IQ, and names a supported lifetime cost almost nothing to write and eliminates most of the list.

Frequently Asked Questions

What does GMP compliance mean for a mobile robot?

It means the robot is qualified against an approved user requirement specification through design, installation, operational and performance qualification, with documented cleaning and change control, and reviewed periodically. Compliance is a documentary state of the asset, not a certification held by the vendor.

How long does it take to qualify a robot for a classified area?

Between eight and twenty weeks in addition to procurement and delivery. The low end applies where the vendor evidence pack is complete at tender and the site can offer production access windows for operational qualification; the high end applies where particle testing or cleaning validation has to be repeated on site.

Can a standard warehouse robot be used in a Grade D area?

Sometimes, but only if its surfaces are smooth and non-porous, its cleaning agents are compatible, and its particle generation is measured rather than assumed. Most warehouse platforms fail the cleaning compatibility requirement, which is usually discovered when the site tries to write the cleaning validation procedure.

Do firmware updates have to go through change control?

Yes. Any change to software that affects the robot's behaviour in a classified area is a change to a qualified system and must be assessed and documented before installation. The vendor must support a locked version and a managed upgrade path.

For facilities that also move materials and consumables through classified corridors, the platform envelope is set out on the AOMAN D1 delivery robot page and should be read alongside the user requirement specification rather than instead of it.