Pharmaceutical water — purified water, WFI and why the loop never stops

Water is the highest volume raw material in a pharmaceutical plant, it is used in nearly every step, and it is the one ingredient that supports microbial growth all by itself. That combination is why water gets a dedicated system, dedicated monitoring and more validation attention than almost anything else in the facility.

The grades, and what actually separates them

USP <1231> describes the waters used in pharmaceutical manufacture. Two matter for most plants.

Purified Water (PW) — for non-sterile products, as a cleaning medium, and as feed to higher grades. It carries chemical limits and a microbial action level.

Water for Injection (WFI) — for products that enter the bloodstream.

Here is the part worth getting straight, because it is routinely got wrong: the chemical specifications are essentially the same. WFI is not chemically purer water. What WFI adds is a bacterial endotoxin limit.

The two numbers that run the system

Pharmaceutical water is monitored chemically by two measurements, and between them they cover the two families of contamination.

Conductivity — to USP <645>. Ions conduct; pure water hardly does. So conductivity is a direct, continuous, in-line measure of total dissolved ionic material, with a stage-one limit of 1.3 µS/cm at 25 °C. It is strongly temperature dependent, which is why the limit is quoted against a temperature and why the standard sets out a staged approach rather than a single number.

Total Organic Carbon (TOC) — to USP <643>, limited to 500 ppb. Conductivity is blind to anything that does not ionise, so TOC covers the organic half: breakdown products, extractables, and the organic load that comes with microbial growth.

Bioburden and endotoxin complete the picture, and they are laboratory results rather than in-line ones — plated and incubated, so the answer arrives days after the water was used. That lag is precisely why the engineering controls have to be right: you cannot test your way to compliant water.

How the water is made

The generation train is a sequence, each stage handing the next a feed it can cope with.

Pretreatment takes potable water and removes what would destroy the downstream plant — particulates by filtration, chlorine by activated carbon or metabisulphite dosing, hardness by softening. Chlorine is a membrane poison, so removing it matters; and removing it also removes the only thing keeping the water sterile, which is why everything downstream is a microbial control problem.

Reverse osmosis pushes water through a membrane against osmotic pressure, rejecting dissolved ions, organics and organisms together. Often two passes.

Ion exchange or electrodeionisation polishes the remaining ions out. Electrodeionisation uses an electric field to continuously regenerate the resin, which avoids the chemical regeneration that conventional beds need — and avoids a resin bed sitting exhausted and warm, which is an excellent place to grow things.

For WFI, the classical route is distillation — vapour compression or multiple effect — because a phase change leaves non-volatiles, including endotoxin, behind. Membrane-based WFI production is accepted in the European pharmacopoeia under appropriate control, which is a relatively recent change and one worth checking against the market a product is sold into.

See water and effluent for the raw water and discharge side of the same plant.

The distribution loop is where systems fail

Making compliant water is the straightforward half. Delivering it to twenty points of use, hours later, still compliant, is the half that goes wrong.

The reason is biofilm. Suspended bacteria are easy to kill. Bacteria that have attached to the pipe wall secrete a matrix that shelters them, resists sanitisation, and sheds organisms into the passing flow indefinitely. Once it is established, it is extremely difficult to remove — in practice some systems have to be replaced rather than cleaned.

Everything about loop design follows from that.

It circulates continuously. There is no storage-and-draw arrangement. The water goes round, past every user, all the time. Velocity is maintained to keep the wall scoured.

It runs hot. A WFI loop is typically held above 80 °C and circulated hot, because nothing colonises a surface at that temperature. This is continuous sanitisation rather than a periodic treatment, and it is why WFI loops are so much more reliable microbiologically than ambient ones. Where a loop must run cold for the process, the alternative is periodic sanitisation — hot water, steam or ozone — on a validated frequency.

It drains completely. Pipework is sloped so that the whole system empties, with no low points holding water after a drain down.

A polished stainless steel hygienic water distribution loop running along a white cleanroom wall at head height, joined by tri-clamp fittings. Four diaphragm valves with white handwheels drop off the main line on short branches, and a sanitary diaphragm pressure gauge is mounted in a tee on the top of the header. — Look at how short the branches are. Each user valve sits as close to the header as the body physically allows, because every millimetre beyond it is water the circulating loop no longer reaches.

It has no dead legs.

The dead leg is the classic water system defect

A dead leg is a branch long enough, relative to its bore, that the circulating flow never scours its end. The water in it stands still.

That stagnant volume grows biofilm, and then feeds organisms into every litre drawn through the loop afterwards. The loop is doing its job perfectly; the branch is quietly undoing it.

The old rule of thumb allowed a branch of up to about six diameters. Modern hygienic practice is considerably tighter than that, and the design answer is the same whatever number a specification quotes — take the branch short and put the user valve as close to the header as it will physically go, with a zero-dead-leg valve body where one is available.

Dead legs are also created in service, not just at design: a user is decommissioned, the branch is valved off and left in place, and nobody records that the loop now has a stub on it.

It is built in hygienic materials and finishes. Austenitic stainless, usually 316L, orbitally welded, with the internal surface finished and the welds inspected — see hygienic piping and surface finish. A rough or crevassed surface gives biofilm somewhere to anchor that no amount of velocity will reach.

Monitoring, and where the samples are taken

Conductivity and TOC sit in line and trend continuously. Bioburden and endotoxin are sampled on a schedule, plated and trended, with alert and action levels set from the system’s own history rather than from the pharmacopoeial limit — because in a water system the trend is the signal. A single result at half the limit means little; six consecutive results climbing towards it means the loop is being colonised, and that is the point at which it can still be recovered.

What to take away

WFI is not chemically purer than PW. What it adds is an endotoxin limit, because the water is going into a bloodstream.
Endotoxin survives heat. Sterile is not the same as pyrogen free, and removal needs a separation step, not a kill step.
Conductivity and TOC answer different questions, and neither of them measures organisms.
Chlorine removal protects the membranes and removes the disinfectant — everything downstream is a microbial control problem by design.
Biofilm is the enemy and prevention is the only economic strategy. Keep it moving, keep it hot, keep it drainable, keep it smooth.
Dead legs defeat a good loop, and they get created during service life as often as at design.
Sample at the point of use. That is where the specification applies and where the system actually fails.
Trend rather than test. Microbiological results arrive days late, so the engineering has to be right in advance.