Read-Only OPC-UA Secures GMP Energy Data Integrity
How read-only data flow protects GAMP 5 states whilst cutting energy costs by 15-25%.
Read-only Open Platform Communications Unified Architecture (OPC-UA) is a secure, unidirectional communication profile that protects pharmaceutical energy data integrity by preventing write-access to validated programmable logic controllers (PLCs). The integration of real-time utility tracking within Good Manufacturing Practice (GMP) facilities must not compromise the validated operational status of production lines. Pharmaceutical manufacturers operate under strict regulatory standards requiring absolute control over every computerised system interacting with the production environment. To achieve carbon reduction targets without risking compliance failures, engineering teams must deploy communication protocols that isolate energy monitoring data from active machine control loops.
The Regulatory Tension Between GxP Compliance and Energy Decarbonisation
Energy Demands in Sterile Manufacturing
Cleanroom heating, ventilation and air conditioning (HVAC) systems represent 50 to 80 per cent of total energy consumption in a pharmaceutical manufacturing facility. Under the requirements of BS EN ISO 14644-16:2019, manufacturers must balance cleanroom airflow rates with absolute contamination control. Rising electricity costs and pressure to meet Scope 1 and Scope 2 emission reduction goals mean operations teams must identify energy waste. This creates an immediate requirement for granular utility tracking.
To reduce energy consumption without risking contamination, facility managers require live telemetry from key utility systems. Measuring consumption at the plant level is insufficient. Engineers need to link energy events directly to specific manufacturing batches and operational shifts to pinpoint where energy losses occur.
Data Integrity and the ALCOA+ Standard
The Medicines and Healthcare products Regulatory Agency (MHRA) enforces the MHRA GxP Data Integrity Definitions and Guidance for Industry (2018). Under these rules, any system tracking or storing data that affects the validation state must preserve strict, unalterable electronic records. The framework relies on ALCOA+ principles: data must be Attributable, Legible, Contemporaneous, Original and Accurate, as well as Complete, Consistent, Enduring and Available.
If process engineers pull energy data from the same PLCs that control validated production parameters, any interface to that PLC must guarantee that data cannot be written back, modified or corrupted. This is the core challenge of data integrity in pharmaceutical energy management. Without strict data boundaries, integrating energy sensors can compromise the manufacturing record.
The Validation Burden of Bidirectional SCADA and PLC Integrations
Historically, bringing utility data from the plant floor into an energy management system required direct queries to supervisory control and data acquisition (SCADA) systems or manufacturing execution systems (MES). Any write-access channel, even if unused, forces validation teams to perform exhaustive software testing under GAMP 5 guidelines.
A minor software patch or connection change to a bidirectional link triggers a full validation lifecycle loop consisting of Installation Qualification (IQ), Operational Qualification (OQ) and Performance Qualification (PQ). This high administrative and technical burden often prevents facilities managers from implementing energy efficiency initiatives altogether. They choose to remain with inefficient systems rather than disrupt a validated production environment.
Omni Vision.
Omni Vision delivers turnkey utility metering, CO2 tracking, and AI-powered production KPI intelligence — giving you real-time dashboards and actionable insights across your entire facility.
Understanding OPC-UA Read-Only Architecture in GMP Environments
Separating Read Access from Control Paths
Open Platform Communications Unified Architecture (OPC-UA) is a widely adopted framework for industrial automation. It provides a secure, platform-independent protocol. In a GMP-regulated setting, automation engineers must decouple data monitoring from actual machinery control.
OPC-UA read-only configurations solve this by denying write requests from the client to the server, creating a unidirectional logical channel. A one-way, read-only OPC-UA interface prevents any external software from changing variables in the PLC that govern batch manufacturing parameters. This separation allows facilities to extract utility telemetry safely without risking physical process deviations or parameter shifts.
Logical versus Physical Unidirectionality
Unidirectional data flow can be established through physical or logical methods. Physical unidirectionality, such as using hardware data diodes, guarantees that data can only travel physically in one direction. However, this method often complicates the handshake protocols required by standard industrial networks.
Logical unidirectionality, achieved by configuring the OPC-UA server to reject write services, provides an alternative that maintains standard network physical layers while enforcing strict logical boundaries. This logical isolation ensures that the corporate database or cloud platform can pull values without any mechanism existing to push data back into the controller.
Technical Control of Data Flow at the Protocol Layer
To prevent write-back, the automation engineer configures the OPC-UA access level of each tag in the interface DB strictly to Read (RD). This configuration ensures that if an external client attempts an OPC-UA write service request, the PLC hardware-level security rejects the instruction immediately at the protocol layer.
No software glitch, network exploit or administrative error on the energy platform side can alter the logic or running state of the PLC. This technical control guarantees that the manufacturing parameters remain in their validated state.
Technical Configuration of S7-1500 PLCs for Read-Only OPC-UA Server Access
Step 1: Isolating the Energy Interface Block
To prevent exposing critical process variables, automation engineers create a custom interface in the PLC. This user-defined OPC-UA server interface contains only variables specifically required for energy calculations. In Siemens TIA Portal, the engineer disables the standard, global OPC-UA interface that exposes all tags.
Instead, they build a dedicated interface Data Block (DB) and turn off "Optimised block access" to maintain absolute control over memory offsets. This configuration limits the data-gathering client to a strict, pre-defined subset of registers, keeping sensitive process parameters invisible to the business network.
Step 2: Setting the Access Level to Read-Only
Within the custom interface DB, every variable must be configured with a strict access level of "Read" (denoted as RD in the configuration panel). This step is essential because the standard Siemens TIA Portal configuration defaults newly added tags to Read/Write (RW).
Setting this access level to RD ensures that the OPC-UA engine itself will reject any incoming write requests from the network client at the protocol layer. This setting cannot be bypassed by the client, providing a hard security boundary at the controller level.
Step 3: Deactivating Web API and HMI Write Capabilities
To guarantee that no alternate route can write to these variables, the engineer clears the "Writeable from HMI/OPC UA/Web API" checkbox for each tag. This ensures that even if an operator attempts to overwrite a value via an HMI screen or an external Web API command, the PLC hardware firmware blocks the change.
The variable is effectively sealed, permitting only outbound readings. The control loop continues its operations completely isolated from any external telemetry requests.
Aligning with MHRA GxP Data Integrity and EU Annex 11 Guidelines
Satisfying the Core Tenets of ALCOA+
This MHRA guidance places deep emphasis on the "Accurate", "Original" and "Complete" portions of the ALCOA+ framework. Using a secure, read-only OPC-UA data path ensures that raw sensor data is acquired in its original state directly from the source PLC.
The lack of write access ensures that the original records cannot be overwritten, fulfilling the "Enduring" and "Consistent" requirements. Because the data flow is strictly outbound, there is zero risk of external processes introducing corrupt values into the local PLC register, protecting the integrity of both the batch manufacturing record and the energy log. This strict alignment ensures the facility remains compliant during rigorous regulatory inspections.
Maintaining the Validated State under GAMP 5 (Second Edition)
GAMP 5 Second Edition (2022) focuses on a risk-based approach to computerised system validation. When incorporating Industrial Internet of Things (IIoT) sensors or external analytics tools, keeping a validated state is essential. System integration is categorised according to GAMP 5 software categories.
By configuring the connection to be strictly read-only, the energy monitoring system functions as an isolated data-acquisition system. This configuration prevents the energy tracking platform from influencing any critical process parameters (CPPs) or critical quality attributes (CQAs).
Consequently, the validation team can treat the energy system strictly as a GAMP 5 Category 4 (Configured Product) system. Treating the platform as a Category 4 system simplifies the qualification workload because the software runs on a standardised, configurable product architecture rather than requiring the extensive custom coding associated with GAMP Category 5 systems. This limits the validation overhead from months to weeks.
| GAMP 5 Category | Software Type | Regulatory Validation Strategy | Energy Tracking Application |
|---|---|---|---|
| Category 1 | Infrastructure Software | Qualification of hosting environment; verification of versions. | Operating systems, SQL database engines and virtualisation layers. |
| Category 3 | Non-Configured Products | Verification of installation and standard out-of-the-box fitness for use. | Simple firmware on smart meters and standard calibration instruments. |
| Category 4 | Configured Products | Risk-based functional testing of custom parameter configurations. | Configurable energy management platforms, BMS and SCADA. |
| Category 5 | Custom-Made Software | Complete lifecycle validation, design specifications and unit testing. | Custom PLC ladder logic, bespoke scripts and custom APIs. |
Managing Access Control and Security in Light of the 2026 Revisions
Under EU EudraLex Volume 4, Annex 11 (specifically Clause 9 on Audit Trails), all GxP systems must log any changes to system data or parameters. The draft revision of Annex 11, published in July 2025, which closed consultation in October 2025 and is projected to enter implementation around mid-2026, significantly expands cybersecurity, user access control and audit trail requirements. The revised guidance emphasises role-based access control and multi-factor authentication for critical installations.
Significantly, the draft outlines that accounts with strictly read-only access do not require the same administrative logging overhead as accounts with write permissions. By using a read-only client account to read OPC-UA tags, the energy platform complies with user access governance without needing to generate an audit-trail entry on the PLC for every single data read. This design prevents performance bottlenecks on the control processor.
Omni Vision.
Track energy consumption, emissions, and process parameters with seamless PLC/SCADA integration via Modbus, OPC-UA, and MQTT protocols.
The Role of ALCOA+ in Automated Utility Auditing
Attributability and Contemporaneous Recording
In a paper-based or hybrid energy monitoring setup, technicians manually transcribe meter readings at the end of every week or month. This practice violates the "Contemporaneous" requirement of ALCOA+ and makes "Attributability" difficult to verify.
If a surge in steam consumption occurs on a specific line, there is no automatic way to assign the cause to a specific operator or batch. An automated, read-only OPC-UA logging system records data in real time, automatically associating every utility reading with an exact cryptographic timestamp. This links the energy data directly to the active manufacturing run and operator login.
Ensuring Original and Accurate Records
Under this regulatory framework, data must be a true and complete representation of the physical facts. Manual transcription introduces typing errors, rounding inaccuracies and potential selection bias.
Direct, read-only PLC telemetry guarantees that the energy data matches the original physical measurements recorded by the inline flowmeters and power meters. The inability to write back to the PLC ensures that no post-hoc modification can occur, guaranteeing that the archived record is completely "Original" and "Accurate". This eliminates any suspicion of data tampering during a regulatory audit.
Complete, Consistent and Enduring Storage
Data collected via the read-only OPC-UA interface is transmitted securely to the energy platform. Telemetry is stored in a write-once, read-many (WORM) database or an encrypted cloud database with continuous audit trailing.
This configuration ensures that the energy tracking is "Complete" and "Consistent" over the entire lifecycle of the facility, providing inspectors with an unassailable data trail during GxP or ISO 50001:2018 audits. This long-term storage format withstands hardware failures and software migrations.
Non-Invasive Energy Integration: The Omni Vision Architecture
Technical Deployment of One-Way PLC Telemetry
The Omni Vision Energy Intelligence Platform is EnerTherm Engineering’s comprehensive, turnkey solution for industrial energy management. It integrates EnerTherm Engineering’s precision instrumentation with EPSA’s cloud-based AI analytics engine. This integration relies on secure, non-invasive PLC connectivity using protocols such as Modbus, OPC-UA, BACnet and MQTT. At the core of the architecture is a physical or logical gateway configured for one-way, encrypted data flow. This gateway guarantees zero-write access to the plant PLCs, safeguarding the GMP status of the production facility.
Batch-Level Energy Attribution and Cleanroom HVAC Optimisation
Cleanrooms and sterile areas represent high-energy centres within pharmaceutical plants. The EPSA AI engine processes the read-only data feed to identify HVAC optimisation opportunities without altering validated PLC control loops. By correlating real-time utility consumption (electricity, gas, water, steam, compressed air and oil) with active production schedules, the platform maps energy per batch and cost per tonne.
This batch-level tracking allows quality assurance and operations managers to see exactly where inefficiencies occur, such as running high-airflow HVAC cycles during non-production shifts. Any recommended adjustments are implemented during validated change windows through manual, authorised process changes, maintaining the strict boundary between the energy intelligence platform and the validated production controllers.
Generating Audit-Ready Data Trails for ISO 50001:2018 Compliance
Large pharmaceutical facilities use the ISO 50001:2018 standard to establish structured energy management systems. Aligning this standard with a Pharmaceutical Quality System (PQS) requires automated, reliable and audit-ready data trails. Omni Vision automatically compiles utility usage into standardised, encrypted reports.
This automation removes the need for manual spreadsheet tracking, which is prone to data entry errors and lacks the secure data governance required by auditors. The resulting data streams support Scope 1 and Scope 2 CO₂ emissions reporting and simplify compliance with frameworks such as SECR (Streamlined Energy and Carbon Reporting) and ESOS (Energy Savings Opportunity Scheme).
Risk Assessment and the Path to Simplified Re-Validation
GAMP 5 Risk-Based Qualification Strategies
An essential phase of any pharmaceutical IT project is the Quality Risk Assessment. Using GAMP 5 Second Edition principles, validation engineers identify potential hazards to product quality and patient safety. An interactive bidirectional energy loop (one that could write setpoints back to the HVAC PLC, for example) represents a high risk. It requires exhaustive testing of error handling, boundary limits and cybersecurity controls.
By contrast, establishing a physical and logical one-way read-only architecture limits the risk profile of the entire integration. The risk assessment can demonstrate that even if the external energy cloud platform is completely compromised, the physical manufacturing process remains unaffected.
Mitigating Indirect Access Risks to Validated Code
Regulators and software providers are increasingly focused on indirect access risks. If an external software application connects directly to a validated enterprise resource planning (ERP) or SCADA system, it can inadvertently affect databases containing critical process recipes.
Implementing isolated read-only views or portals prevents unauthorised database or register modifications. This division ensures that the validated code of the plant PLCs remains intact and isolated from the business network. Consequently, the energy management upgrade does not trigger a re-qualification of the existing manufacturing process, saving months of validation effort and avoiding plant downtime.
Deploying Turnkey Energy Intelligence Within 8 to 16 Weeks
Traditional industrial energy management deployments often stall due to extensive engineering reviews and validation delays. The non-invasive, read-only approach of the Omni Vision platform allows a rapid turnkey deployment lifecycle.
The standard deployment spans 8 to 16 weeks, moving from initial site surveys to full dashboard commissioning. Because the integration relies on zero-write OPC-UA tag exposure, the validation pathway is extremely streamlined. Pharmaceutical manufacturing facilities typically achieve a 15 to 25 per cent reduction in energy costs, with a sub-12-month return on investment (ROI), without risking their GMP qualification or violating regulatory data integrity standards.
This article reflects the independent analysis and editorial opinion of EnerTherm Engineering. Product names, trademarks, and brands mentioned belong to their respective owners. EnerTherm Engineering is not affiliated with, endorsed by, or a licensee of any third-party software or product mentioned unless explicitly stated.
Managing Director — EnerTherm Engineering
Dr. François Pierrel is Managing Director of EnerTherm Engineering with over two decades of expertise in thermal design, heat transfer, and industrial energy optimisation. He holds a PhD in Heat Transfer from Cranfield University and a Post-Doctorate from Heriot-Watt University.
