How small should a phase be?

A phase should perform one capability with clear entry/exit, parameters, and states. If it cannot be unit-tested in isolation, split it.

How are shared utilities handled across units?

Model utilities (CIP skids, steam) as equipment modules with allocation rules. The dispatcher grants access; phases wait or use alternatives.

Can S88 support hybrid or continuous processes?

Yes. Use phases for discrete capabilities and operations to coordinate long-running states. Hybrid processes benefit from clear structure and parameter governance.

ISA-88 Phases & Equipment ModulesGlossary

ISA‑88 Phases & Equipment Modules – Batch Control Structure

Q: Do we have to remodel our whole plant to use S88?

No. Start with one process cell and refactor monolithic control into equipment/control modules as you introduce phases. Convert incrementally; do not wait for a greenfield.

Q: Where should recipe logic live—PLC or MES?

Orchestration belongs in MES (recipes, parameters, versions); equipment capability and interlocks belong in PLC equipment modules. Mixing these creates configuration drift and audit risk.

Q: What evidence proves S88 control to an auditor?

Show S88 maps, governed master/control recipes, parameter libraries, IQ/OQ/PQ and CSV evidence, eBMR with state transitions and signatures, and SPC/CPV trends tied to phases.

This topic is part of the SG Systems Global regulatory & operations glossary.

Updated October 2025 • Batch Architecture, Procedural Control, Data Integrity • Manufacturing, QA/RA, Automation, IT/OT

ISA‑88 (S88) is the industry standard for making batch control modular, reusable, and auditable. It separates what you do (procedures/recipes) from where/how you do it (equipment/control modules), with phases as the executable building blocks that turn business intent into deterministic machine behavior. When you get S88 right, recipes are portable, equipment is swappable, and deviations are diagnosable. When you get it wrong, every line becomes a bespoke science project, maintenance patches logic in the dark, and QA inherits a stack of batch records nobody can reconcile.

“If your ‘recipe’ is just PLC code with a pretty name, you don’t have S88—you have technical debt.”

TL;DR: Model plants with S88’s physical (process cell → unit → equipment module → control module) and procedural hierarchies (procedure → unit procedure → operation → phase). Keep phases small, deterministic, and parameter‑driven; bind them to qualified equipment modules; and orchestrate execution from a validated MES with an eBMR, audit trails, and UAM. Govern parameters and recipes under Recipe Management and Change Control; integrate devices via SCADA/HMI; validate under CSV/GAMP 5 with IQ/OQ/PQ. No monolithic “do everything” phases. No spreadsheet parameters. No out‑of‑status gear in a critical path.

1) What S88 Covers—and What It Does Not

Covers: standardized batch terminology and models, including the physical model (process cell/unit/equipment module/control module), procedural model (procedure/unit procedure/operation/phase), recipe model (general/site/master/control), and state/command interfaces for phases. It governs how to build, schedule, execute, and record batches in a way that is portable across equipment and scalable across sites. It also covers parameterization, allocation, and exception handling so QA/RA can reconstruct what happened from governed records in the eBMR.

Does not cover: replacing engineering or validation with slogans. S88 won’t fix poor piping, under‑sized drives, or a chaotic SOP stack. And it’s not a license to throw the MES away and hard‑code recipes in PLCs. S88 needs governance, not bravado.

2) Legal, System, and Data Integrity Anchors

Batch records live under Part 11/Annex 11. The batch engine and eBMR require CSV/GAMP 5 controls, unique accounts with appropriate roles & permissions, immutable audit trails, and governed retention. Equipment must be in qualified and calibrated status (IQ/OQ/PQ, Calibration Status). Recipes sit under Recipe Management with formal Change Control. Deviations route to Deviation/CAPA before release. S88 is not just architecture—it’s regulated evidence.

3) S88 Physical Model—Where Things Live

Start with the physical model that defines the plant: Process Cell (the logical boundary for a batch line), Unit (reactor, blender, granulator—where batch steps execute), Equipment Module (pump trains, heating/cooling circuits, filter skids—capability bundles shared by units), and Control Module (the leaves: valves, motors, scales, sensors). The physical hierarchy prevents control spaghetti: phases call equipment modules; equipment modules coordinate control modules. This keeps logic reusable and testable instead of copy‑pasted in 19 PLCs.

4) S88 Procedural Model—How Work Is Described

On the procedural side, S88 defines a Procedure (end‑to‑end batch), subdivided into Unit Procedures (per unit), then Operations, and finally Phases. Phases are the only executable step at the bottom of the tree—small algorithms like “Charge‑A by mass,” “Heat‑to‑Setpoint,” “Agitate‑Hold,” “Filter‑Cake‑Break,” or “CIP‑Rinse.” Operations and Unit Procedures orchestrate phases and pass parameters down; phases interact with equipment modules and control modules. Keep phases atomic and deterministic. If your phase has a flowchart that needs a wall, it’s not a phase—it’s several phases stapled together.

5) Equipment Modules vs. Control Modules—Who Does What

Control Modules are the point devices (open/close, start/stop, read PVs). Equipment Modules coordinate sets of control modules to deliver a capability (move, heat, cool, dose, filter) with interlocks, permissives, and safety logic, independent of any one recipe. Phases request a capability from the equipment module with parameters (e.g., move 1,200 kg from Tote‑12 to Unit‑101 at ≤ 500 kg/h), then await command/response states. This decoupling is the S88 magic: swap a pump skid and the recipe survives because the capability signature stays stable.

6) Phase Interfaces & State Models

A good phase exposes a tight interface: parameters (targets, limits, timers), commands (start, hold, restart, stop, abort), and responses (idle, running, held, complete, stopped, aborted, error). The phase state model controls transitions, timeouts, and interlock reactions. All transitions should be recorded in the eBMR with user/device IDs and timestamps for auditability (audit trail). Don’t hide state changes in PLC latches; expose them to MES/SCADA for visibility and exception management.

7) Recipe Model—From General to Control

S88 defines General, Site, Master, and Control recipes. The Master Recipe should be the single governed source that defines formula, procedures, equipment requirements, processing parameters, and versioning—managed in Recipe Management with formal Change Control. A Control Recipe is the instantiated batch specific to a line, lot, and time. If you’re cloning PLC projects for each batch, you don’t have S88; you have configuration drift and a future recall.

8) Parameters, Limits & Authoring Discipline

Author parameters where they belong: limits and defaults in the master recipe; equipment capability limits in equipment modules; batch‑specific setpoints in the control recipe. Lock UOM and rounding rules in a governed service (UOM Conversion) and enforce windows with alert/action limits. No free‑text setpoints; no dual truth. Present parameters contextually on the HMI and sign significant changes electronically in the audit trail.

9) Allocation, Campaigns & Scheduling

Units and equipment modules need allocation rules and capacity constraints. Use the MES/MOM scheduler (MOM, Production Scheduling, Finite Capacity) to plan campaigns and avoid deadlocks (two batches waiting for the same filter skid). Encode equipment requirements in the master recipe; let the dispatcher match batches to eligible units. Capture allocation and release timestamps in eBMR; QA won’t accept “we think it was Unit‑102.”

10) Exceptions, Holds & Recovery

State models matter when things break. Define hold points (operator, interlock, quality hold), safe stop/abort behaviors, and deterministic restart logic (“restart Operation at Phase X with parameters Y”). Wire deviations into the engine: on critical exception, open a Deviation and hard‑block progression until triage is complete. Don’t “replay” phases to hide interruptions; record reality and disposition later under CAPA.

11) Material Flow, Identity & Traceability

S88 phases often move or transform material. Tie every charge/transfer to lot identity with WMS scans and publish genealogy via EPCIS. Enforce line clearance before starting a procedure (Line Clearance). For critical weigh steps, bind devices and tare logic (Weigh/Dispense) and capture exact quantities, UOM conversions, and device IDs in the eBMR. Claims and labels must consume the same numbers (Label Verification).

12) Cleaning, Setup & Changeover

Treat setup and cleaning as first‑class S88 procedures (CIP/SIP phases, verify‑clean phases, setup/teardown phases) with clear acceptance criteria. Validate cleaning (Cleaning Validation), gather swabs in the right unit procedures, and enforce Hold/Release status prior to start. Hard‑block batch start if equipment state or calibration is out of tolerance (Calibration Status).

13) Integration—MES, SCADA/PLC, HMI

Keep orchestration in the batch engine (MES) and real‑time device control in PLC/SCADA (SCADA). HMIs (HMI) should present state, parameters, and interlocks—not reinvent recipe logic. Phase parameters flow down; event/state/measurement data flow up to eBMR. If your “MES” is a shared spreadsheet editing PLC tags, you’re one power blink away from a recall.

14) Validation—Make It Defensible

Validate the batch engine under CSV/GAMP 5. Qualify equipment and phases with IQ/OQ/PQ. Build a phase test harness: simulate control modules, verify state transitions, timeouts, and alarms; UAT (UAT) should break logic on purpose. Document evidence, sign electronically, and store under Document Control. If you can’t replay a failed batch in a sandbox, you haven’t validated your exceptions.

15) Data Integrity—One Truth, No Shadows

All parameters, versions, states, and outcomes must be attributable, legible, contemporaneous, original, accurate (ALCOA(+)). Ban “temporary” spreadsheets and paper slips. Configure role‑based approvals (UAM), capture reason codes, and sign electronically. Tie user/device identity to each phase start/stop and exception in the audit trail. You cannot defend external math at inspection—move it into validated systems.

16) From Phase Data to SPC/CPV

Phases emit high‑value data: heat‑to‑setpoint time, overshoot, hold stability, filter ΔP curves, dosing hit‑to‑target. Chart them with SPC, quantify capability (Cp/Cpk), and roll into CPV. Use S88 structure to normalize across like units—Operations and Phases are comparable even when hardware differs. Don’t average away control insights; expose drift and fix physics or parameters.

17) Performance & Reliability—OEE Tells the Truth

Downtime in phases slashes throughput. Roll phase start/hold/abort into OEE loss trees and attack chronic sources with TPM. Use S88 structure to isolate whether the problem is recipe logic, equipment module capability, or control module reliability. Stop “retraining operators” for bad valves.

18) Human Factors—HMI, Roles & Clarity

Good HMIs mirror S88: show the procedural tree, current unit procedure/operation/phase, state, interlocks, and next steps. Hide irrelevant controls when a unit is not allocated. Use plain language for reason codes. Link to controlled SOPs and job aids (Digital Work Instructions). Confusing HMIs manufacture deviations.

19) Common Pitfalls & How to Avoid Them

Monolithic phases. Split into atomic phases; keep equipment logic inside equipment modules.
Copy‑pasted PLCs per recipe. Centralize recipe logic in MES; keep PLC focused on equipment capability.
Ungoverned parameters. No free‑text setpoints. Use controlled parameter libraries with UOM and limits.
No allocation logic. Two batches, one filter skid—deadlock. Define equipment requirements and capacity.
Shadow math. Spreadsheets for dosing and conversions. Move to validated services with audit trails.
Out‑of‑status equipment. Block at runtime using Calibration Status and UQ.
Poor exception states. Undefined hold/abort/restart rules lead to rework. Design and validate.
Label/record mismatch. Recipe/eBMR math not reflected on labels—fix with Label Verification.

20) Metrics That Prove Control

Phase success rate and retries per 100 runs by unit.
Average time‑to‑setpoint/variance for heat/cool phases; Cpk vs. windows.
Dose hit‑to‑target and overshoot (see SPC).
Hold/abort frequency and time‑to‑recover by cause code.
Allocation wait time for shared equipment modules.
Audit‑trail health (late entries, edits) on critical phases.
Mass‑balance closure and yield variance tied to dosing phases.

Metrics should drive action—parameter tightening, equipment upgrades, or recipe redesign. If they don’t, you’re measuring for comfort, not control.

21) What Belongs in the S88 Dossier

Physical/Procedural model maps; master recipes (with parameters, UOM, limits); equipment module capability specs; control module lists; allocation rules; state/command definitions; exception/hold/abort logic; integration diagrams (MES/SCADA/HMI); IQ/OQ/PQ and CSV evidence; audit trails; deviations/CAPAs; retention plans; and approvals under Document Control. If it isn’t in the dossier, it doesn’t exist at audit.

22) How This Fits with V5 by SG Systems Global

Structured execution. The V5 platform models the S88 hierarchy explicitly: procedures/unit procedures/operations/phases mapped to units and equipment modules. Recipe parameters live in governed libraries; allocation is enforced at runtime; and device status is verified before a phase runs.

Device‑tight & audit‑ready. V5 binds valves, motors, scales, and sensors to control modules; phases exchange command/response with SCADA; and every state change lands in the eBMR with audit trails and UAM.

Quality & improvement loop. Live dashboards compute SPC and capability on phase KPIs; exceptions open Deviation workflows; approved changes roll through Recipe Versioning. WMS and EPCIS keep genealogy in lock‑step with batch events. Bottom line: V5 makes S88 boringly reliable—the goal.

23) FAQ

Q1. Do we have to remodel our whole plant to use S88?
No. Start by mapping one process cell and its units, then refactor control into equipment/control modules as you introduce phases. Convert monoliths incrementally; do not wait for a fantasy greenfield.

Q2. Where should recipe logic live—PLC or MES?
Orchestration (procedural model, parameters, versions) belongs in the MES; equipment capability/interlocks belong in PLC equipment modules. Crossing those wires creates configuration drift and audit pain.

Q3. How small is “small enough” for a phase?
A phase should do one thing with clear entry/exit, parameters, and states. If you can’t unit‑test it in isolation, it’s too big.

Q4. How do we handle shared utilities (steam/CIP skids) across units?
Model them as equipment modules with allocation. Operations request the capability; the dispatcher schedules access; phases wait or route to alternatives.

Q5. Can S88 work for continuous or hybrid processes?
Yes. Use phases for discrete capabilities (start/stop, setpoints, transfer segments) and operations to coordinate long‑running states. Hybrid lines (granulation, coating) benefit the most from the structure.

Q6. How do we prove control to an auditor?
Show the S88 maps, governed recipes, parameter libraries, IQ/OQ/PQ and CSV evidence, eBMR with state transitions and signatures, and SPC/CPV trends tied to phases. If the story is consistent end‑to‑end, you’re ready.