AI control of pharma WFI water — the invisible utility that decides the batch.

The problem

The WFI SCADA holds the truth. And nobody ties it to the batch in time.

Under normal conditions a pharma WFI loop meets USP <1231> and Ph.Eur. 0169 without difficulty — TOC below 500 ppb, conductivity below 1.3 µS/cm, endotoxins below 0.25 EU/mL. The crack is not in the quality of the water: it is in when and how that quality gets cross-referenced with each batch.

1. The loop's SCADA has the data every second — but it is usually 15-25 years old, GAMP 5 validated, and it exports daily CSVs that nobody cross-references with the MES.
2. The batch MES or EBR knows which point of use drew water and at what time — but it does not know in real time whether TOC drifted for 3 minutes during that draw.
3. The QC lab takes periodic samples for endotoxins — but the results arrive hours later, once the batch has already moved on.

The quality director knows this, and an FDA/EMA audit always asks about WFI-to-batch traceability. The classic system works 99% of the time. That 1% is the OOS that reaches the inspector — and a WFI-driven OOS is not an observation, it is a lost batch and a root cause to document.

How it fits the IRIS system

iLEAN does not replace the SCADA — it cross-references it with the batch at second zero.

The WFI problem is not one of instrumentation: it is information living in islands between the loop SCADA, the batch MES and the QC LIMS. iLEAN acts as the putty that fills those gaps, without asking you to open the validated SCADA or change the LIMS.

Connect reads the SCADA exactly as it is. The agent cross-references with the MES, identifies which batch was drawing water at which point of use, and if TOC, conductivity or endotoxins drift, holds the batch. The person signs — never the other way round.

The iLEAN pieces applied to WFI water control:

• Connect — captures the loop SCADA parameters (TOC, conductivity, temperature, flow, pressure) whether they arrive over modern OPC UA or as a CSV export from a Siemens S7-300. It captures the endotoxin lab results (LAL test) from the LIMS. It captures the CIP/SIP cycles from the cleaning system. All of it, at second zero, without touching anything.
• Agent — cross-references the loop reading with the batch MES/EBR. If TOC rises to 480 ppb for 3 minutes at 14:00, it identifies which batch was drawing water at which point of use at that moment, holds the batch at the next step and generates the deviation file with a cross-referenced root cause (the UV lamp regeneration? the carbon cartridge change? a backflow in the loop?).
• Three rings — the WFI SCADA lives in ring 1 (critical OT, sacred, no inbound connections). iLEAN reads through an armored mailbox: the SCADA only emits, it never receives. The agents that decide live in ring 3, validate in ring 2, and drop signed JSON for ring 1 to pick up. It meets GAMP 5 and the AI Act.

See the full IRIS architecture →

Before and after

Manual WFI traceability vs. cross-referenced traceability with iLEAN

Aspect	SCADA + spreadsheet + LIMS	With iLEAN Connect + Agent
TOC/conductivity reading	SCADA in an island, daily CSV export	Second zero, tied to each batch
Instantaneous deviation	Spotted on review, days later	Immediate detection, batch held
WFI-to-batch traceability	Rebuilt by hand in a spreadsheet	Cross-referenced automatically per point of use
CIP/SIP before the batch	A separate vertical system	Validated and cross-referenced with the schedule
OOS file	Manual reconstruction, weeks	Cross-referenced root cause, ready for CAPA
Changes to the validated SCADA	n/a	Zero — read-only through an armored mailbox

Impact estimate

Impact estimate for your plant — to be validated with your numbers.

The block below is an estimate to be validated with the specific data of your plant. We put it forward so the committee has an order of magnitude; we refine it during the diagnostic.

• Pharma plant with a 15-25 year old WFI generation loop, legacy SCADA (Siemens S7, Rockwell, Wonderware), 20-40 points of use, a LIMS for endotoxins.
• Connect pilot on the WFI SCADA + an agent cross-referencing the batch MES/EBR. Without opening the validated SCADA. First value expected within a few weeks.
• Indicative payback between 4 and 9 months, depending on how often utility-driven OOS events have occurred in recent years and the average cost of a held batch in your portfolio.
• The hard lever is a ≥30% reduction in WFI-driven OOS investigations (most of them are false OOS events that cross-referenced traceability closes in minutes) plus a single batch rescued through inline detection.

And the pharma IT director's reasonable doubt

“What if the AI ends up with access to the validated SCADA and breaks the qualification?” — the iLEAN architecture is designed precisely so that cannot happen. The WFI SCADA lives in ring 1, sacred. The AI lives in ring 3, where it has freedom. Between the two there is a ring 2 that validates and an armored mailbox (a plant-signed file drop) that only opens from the inside. The SCADA only emits; it accepts no inbound connections. The loop's GAMP 5 qualification is never touched. And the model is anchored to sources — error on anchored tasks falls below 1.5% ^[1], against the >10% typical of free generation.

^[1] OpenAI paper “Why Language Models Hallucinate”, 2025 — on the reliability of AI in anchored tasks.