Historians, SCADA & PLC
Data Historian, Supervisory Control and Data Acquisition, Programmable Logic Controller
This is the layer where software touches physics. In the ISA-95 / IEC 62264 hierarchy, PLCs sit at Level 1–2, executing deterministic control logic against sensors and actuators in real time; SCADA sits above them, giving operators supervisory visibility, setpoint access, and alarm management; and the historian is the time-series database that captures what every instrumented point did, at resolutions no batch record could carry. Together they are the plant's nervous system: the autoclave cycle, the bioreactor cascade, the purified-water loop, and the HVAC pressure regime all run here.
What this page does not claim
A system class is not a product. SPEQ describes what a CTMS or a LIMS is; the vendor directory at /tools lists the products that implement one, and a GAMP category is a property of an implementation, not of a class.
What a Historians, SCADA & PLC actually is
This is the layer where software touches physics. In the ISA-95 / IEC 62264 hierarchy, PLCs sit at Level 1–2, executing deterministic control logic against sensors and actuators in real time; SCADA sits above them, giving operators supervisory visibility, setpoint access, and alarm management; and the historian is the time-series database that captures what every instrumented point did, at resolutions no batch record could carry. Together they are the plant's nervous system: the autoclave cycle, the bioreactor cascade, the purified-water loop, and the HVAC pressure regime all run here.
The regulatory weight of the layer is easy to underestimate because most of its data never appears in a batch record. It surfaces when something is contested: an investigation reconstructs the excursion from historian trends, continued process verification draws on the same time series, and an inspector asked to accept that a sterilisation cycle ran as claimed will want the recorded profile, not the summary. 21 CFR 211.68 places automatic and electronic equipment squarely under GMP control, and EU GMP Annex 11 applies to the computerised parts of this layer exactly as it does to an eQMS.
Data integrity has a particular shape down here. Values are compressed and filtered on their way into the historian — deadbands, exception reporting, interpolation — and each of those settings is a decision about what the permanent record will contain. Clock synchronisation across controllers, SCADA nodes, and the historian decides whether an event sequence can be reconstructed at all. Setpoint changes and alarm suppressions made at an operator station are regulated actions needing attributable audit trails, and PIC/S PI 041-1 explicitly extends data-integrity expectations to control-system data that supports GMP decisions.
Validation of the layer blends disciplines. The equipment side follows ASTM E2500 and the ISPE Baseline Guide Vol. 5 (2019) risk- and science-based verification model under good engineering practice; the software side follows GAMP 5, where PLC logic written for the application is treated as custom, SCADA and historian platforms as configured products, and the category is assigned per element of the implementation, not per box. Because this layer is also the plant's attack surface, the ISA/IEC 62443 series — the joint ISA/IEC standards for industrial automation and control system security — increasingly defines the security posture that GMP IT controls alone were never designed to provide.
WHERE THE BOUNDARY ACTUALLY SITS
Not the execution layer. The MES orders the phase and records the batch context; the PLC runs it. Recipe enforcement and operator signatures belong one level up.
MES / EBR owns it →Not the batch record. The historian holds everything the process did; the EBR holds what the batch record requires. A trend supports an investigation — it does not substitute for the reviewed record.
MES / EBR owns it →Not the analytical measurement layer. PAT analysers and their chemometric models are a distinct system class, even when their outputs land in the historian as tags.
PAT owns it →Not a model. The historian records what happened; a digital twin predicts what will. Feeding one from the other does not merge their obligations.
Digital Twins owns it →WHAT IT HOLDS, AND WHAT CROSSES ITS BOUNDARY
CORE RECORDS
- Time-series process values for every historised point, with the compression settings that shaped them
- Alarm and event logs — activation, acknowledgement, suppression, and shelving, each attributable
- Audit trails of setpoint and parameter changes made from operator stations
- PLC logic and configuration versions, with the change control that authorised each download
- Batch and phase context markers that let a time series be sliced per batch
- Instrument calibration status for the points whose values the layer records
- Recorded cycle profiles for sterilisation, lyophilisation, and other parameter-critical operations
DATA FLOWS OUT
Process values, phase completion status, and equipment states consumed into the electronic batch record for automated steps
Alarm excursions and cycle failures that cross the deviation threshold, escalated with their time-series context
Historical and live time-series data used to build, calibrate, and synchronise process models
Real-time process signals feeding the continuous line's control strategy and residence-time tracking
HOW THIS CLASS IS USUALLY VALIDATED
- SPEQ synthesis: this layer is validated per element, not per cabinet — application PLC logic is GAMP 5 Category 5, SCADA and historian platforms Category 4, and instrument firmware typically Category 1 infrastructure; the category is a property of each implemented element, and the retired Category 2 is not available as a shortcut for any of them.
- The equipment and automation are verified together under ASTM E2500: the control logic that makes a qualified autoclave deliver its cycle is inside the qualification boundary, not an IT annex to it.
- Historian configuration is validated as a record-keeping decision: compression, deadband, and scan-rate settings for GMP-relevant points are specified, justified, and tested, because they define what the permanent record can ever show.
- Time synchronisation and audit-trail integrity across controllers, SCADA, and historian are verified explicitly — an event sequence that cannot be ordered across systems cannot support an investigation.
SPEQ synthesis, not a rating. This is SPEQ’s reading of how this system class is commonly approached, offered to help you scope your own work. A GAMP category is a property of a specific implementation, not of a product class, and one deployment routinely spans several. It is not a classification service and does not replace your own documented risk assessment.
- Stage 1 · Reactive
Control code is undocumented and lives only in the running PLC; chart recorders and screenshots stand in for a historian; setpoint changes are unattributable. Investigations reconstruct events from operator memory because the data either was not kept or cannot be trusted.
- Stage 2 · Defined
GMP-critical loops are qualified, alarm philosophies exist on paper, and a historian captures the major points. Compression settings are vendor defaults, clocks drift between systems, and PLC changes are controlled in principle but verified inconsistently.
- Stage 3 · Controlled
The layer is under engineering and change control as one system: logic versions match their approved source, historised points are specified with justified compression, clocks are synchronised, and alarm handling — including suppression — is attributable and reviewed. Investigations pull trends, not recollections.
- Stage 4 · Predictive
The historised data is worked, not just stored: alarm rationalisation is driven from event statistics, control-loop performance is monitored, and CPV draws directly on the time series. OT security under the ISA/IEC 62443 model is managed with the same discipline as GMP compliance.
- Stage 5 · Adaptive
The control layer is an adaptive asset: golden-batch profiles and live trends are compared continuously, drift is flagged before it becomes an excursion, and data from this layer feeds process models with known provenance — the plant learns from its own signals inside a controlled framework.
SPEQ’s shared five-stage progression, labelled synthesis. It is not the FDA QMM rating scale and not the scored maturity-assessment domains — assess your quality system for those.
WHAT AN INSPECTION PROBES, AND WHERE IT GOES WRONG
INSPECTION SIGNALS
- Whether the recorded cycle data for parameter-critical operations — sterilisation above all — actually exists at the claimed resolution and matches the qualified cycle.
- Whether setpoint changes and alarm suppressions are attributable to an individual, or whether a shared SCADA login makes the audit trail decorative.
- Whether the running PLC logic matches the approved, versioned source — an unexplained difference is a change-control finding regardless of intent.
- Whether historian compression settings were consciously specified for GMP points, or whether the permanent record is shaped by defaults nobody can justify.
- Whether clocks agree across the layer well enough to reconstruct an event sequence during an investigation.
COMMON RISKS
- Treating the PLC as part of the machine and exempting its logic from software change control — until a modified rung surfaces in a deviation.
- Historian compression that quietly flattens the very transients an investigation would need to see.
- Alarm floods that train operators to acknowledge without reading, defeating the supervisory layer's entire purpose.
- Flat OT networks where an office workstation can reach a production controller, leaving the layer one phishing email from an integrity event.
- Orphaned legacy controllers whose logic nobody can read, running critical utilities on institutional memory.
WHO WORKS IN IT, AND WHERE IT IS SHAPED
ROLES
- Automation / controls engineer
- Process control system administrator
- Metrology and calibration technician
- Production operator at the SCADA console
- CSV analyst covering the automation layer
- OT security engineer
DELIVERY-LIFECYCLE PHASES
[ POSITION IN THE FRAMEWORK ]
6 OF 7 DIMENSIONS · 26 LINKSThe plant's control and data layer — PLCs execute, SCADA supervises and alarms, the historian keeps the time-series record — where software touches physics and a contested sterilisation cycle is reconstructed from the recorded profile.
06 · QUALITY MATURITY — HISTORIANS, SCADA & PLC, REACTIVE TO ADAPTIVE
Control code is undocumented and lives only in the running PLC; chart recorders and screenshots stand in for a historian; setpoint changes are unattributable. Investigations reconstruct events from operator memory because the data either was not kept or cannot be trusted.
GMP-critical loops are qualified, alarm philosophies exist on paper, and a historian captures the major points. Compression settings are vendor defaults, clocks drift between systems, and PLC changes are controlled in principle but verified inconsistently.
The layer is under engineering and change control as one system: logic versions match their approved source, historised points are specified with justified compression, clocks are synchronised, and alarm handling — including suppression — is attributable and reviewed. Investigations pull trends, not recollections.
The historised data is worked, not just stored: alarm rationalisation is driven from event statistics, control-loop performance is monitored, and CPV draws directly on the time series. OT security under the ISA/IEC 62443 model is managed with the same discipline as GMP compliance.
The control layer is an adaptive asset: golden-batch profiles and live trends are compared continuously, drift is flagged before it becomes an excursion, and data from this layer feeds process models with known provenance — the plant learns from its own signals inside a controlled framework.
SPEQ’s shared five-stage progression, labelled synthesis — not the FDA QMM rating scale. Where does your organization sit? Score your quality system →
07 · REGULATORY & EVIDENCE
GOVERNING STANDARDS · 9
Derived from the 9 standards SPEQ maps to this subject, across 6 regulatory bodies: FDA, EMA, ISPE, ASTM, MHRA, PIC/S.
RECORDS & OBJECTIVE EVIDENCE
- Time-series process values for every historised point, with the compression settings that shaped them
- Alarm and event logs — activation, acknowledgement, suppression, and shelving — each attributable
- Audit trails of setpoint and parameter changes made from operator stations
- PLC logic and configuration versions, with the change control that authorised each download
- Recorded cycle profiles for sterilisation, lyophilisation, and other parameter-critical operations
COMMON INSPECTION FINDINGS
- Recorded cycle data missing at the claimed resolution, or not matching the qualified cycle
- Setpoint changes and alarm suppressions unattributable because of a shared SCADA login
- Running PLC logic not matching the approved, versioned source
- Historian compression settings never specified for GMP points, flattening the transients an investigation needs
- Clocks that do not agree across the layer, so an event sequence cannot be reconstructed
Choosing, validating, and living with Historians, SCADA & PLC
SPEQ curates the software directory and does not endorse, certify, or rank any vendor. Listing is not a recommendation, and this catalog describes the system class, not the product.
FREQUENTLY ASKED
Is a PLC a computerised system under Annex 11?
Yes, where it performs a GMP function. EU GMP Annex 11 applies to computerised systems used as part of GMP-regulated activities, and a PLC sequencing a sterilisation cycle or controlling a bioreactor is exactly that, however industrial its packaging. In practice the obligations are met jointly with equipment qualification: the logic is specified, version-controlled, and verified as part of the qualified system under an ASTM E2500 approach, rather than validated as a standalone IT application. What the framing does not permit is exempting the logic from change control because it lives in a cabinet.
Does historian data have to be part of the batch record?
Not all of it — but the parts a GMP decision relies on must be managed as GMP records. The batch record carries the values and summaries the master batch record requires; the historian holds the full time series behind them. Where a release decision, an investigation, or continued process verification draws on historised data, that data needs integrity controls: justified compression, protected storage, synchronised timestamps, and defined retention. The practical failure mode is discovering during an investigation that the trend you need was compressed into a straight line by a default setting.
What GAMP category applies to SCADA and PLC software?
It depends on the element, which is the point. SCADA and historian platforms configured for the site are typically GAMP 5 Category 4; application-specific PLC logic written for your process is Category 5; underlying firmware and operating layers are Category 1 infrastructure. GAMP 5 Second Edition (2022) retired the old Category 2 that firmware once occupied, and it treats the category as a property of each implemented element rather than of the product on the invoice. A single packaging line routinely contains all three postures at once. This framing is SPEQ synthesis, not a classification service.
How does IEC 62443 relate to GMP validation?
They answer different questions about the same equipment. Validation demonstrates the system does what its specification intends; the ISA/IEC 62443 series addresses whether an adversary can make it do something else — through zone-and-conduit network segmentation, security levels, and hardening requirements for industrial automation and control systems. A validated but unsegmented control network can still lose data integrity in an afternoon. Mature organisations run the two in parallel: quality owns the validated state, OT security owns the 62443 posture, and change control is the point where they meet.