Motionwell Automation builds and retrofits production equipment that has to satisfy 21 CFR Part 11, and implements the electronic device history record systems that sit on top of it. The most recent was ordered as a standalone system by a medical device OEM, accepted in August 2026, and is now going in one site at a time. This page covers the machine side of Part 11 — the part quality consultants tend to hand to the equipment builder and hope for the best.
The short answer. 21 CFR Part 11 is the FDA rule that says an electronic record and an electronic signature carry the same weight as paper and a wet signature, provided the system holding them can show who did what, when, and that nothing was changed quietly afterwards. On a production machine that translates into six concrete things: named user accounts with real authority levels, a computer-generated time-stamped audit trail the operator cannot switch off, electronic signatures carrying the signer’s printed name plus date, time and meaning, a synchronised clock, records exportable as accurate and complete human-readable copies, and validation evidence that all of the above works. Everything else is procedure.
What is 21 CFR Part 11, and when does it actually apply?
Part 11 was issued in 1997 in three subparts: general provisions, controls for electronic records, controls for electronic signatures. The heart of it is 11.10, eleven lettered controls for closed systems — systems where access is managed by the people responsible for the records. A machine on your own plant network is a closed system. Once records leave into a service you do not control, 11.30 adds expectations around encryption and digital signature standards.
The rule never stands on its own. It applies because a predicate rule requires the record and you have chosen to keep it electronically. For drug products that predicate is 21 CFR 211.188, batch production and control records. For medical devices it is 21 CFR 820, which since 2 February 2026 has been the Quality Management System Regulation incorporating ISO 13485:2016 by reference. The phrase “device history record” is no longer a defined term the way it was under the previous Quality System Regulation, but the obligation survives in ISO 13485 clause 7.5.1: records for each batch showing what was made, how much was approved for release, and who verified it.
FDA’s 2003 guidance on scope and application narrowed the practical interpretation and stated enforcement discretion over some clauses, but it changed nothing about the predicate rules. This is why “is this machine Part 11 compliant” is not a question a machine builder can answer alone. A machine has capabilities. Compliance is those capabilities plus your procedures plus the validation record.
What does 21 CFR Part 11 require from a PLC or HMI?
Access control and authority checks
Clauses 11.10(d) and 11.10(g) require access limited to authorised individuals, and checks that only those individuals can sign, alter a record or perform the operation at hand. The most common finding on a plant floor is one shared HMI login called OPERATOR with the password taped above the panel.
The fix is per-person accounts mapped to roles, with the role deciding which screens are reachable — recipe editing, calibration, alarm bypass and maintenance mode each sit at a different authority level. On Allen-Bradley that is normally FactoryTalk security tied to the HMI application; on Siemens, WinCC user administration. Where the customer runs a domain, accounts come from there, so a leaver is removed once rather than machine by machine.
Audit trails
Clause 11.10(e) is specific: secure, computer-generated, time-stamped audit trails that independently record the date and time of operator entries and actions creating, modifying or deleting electronic records. Changes must not obscure what was there before, and the trail has to be retained at least as long as the record and be available for review and copying.
A PLC tag change on its own is not an audit trail. A usable entry needs the previous value, the new value, the user, a timestamp in a defined timezone convention, and a reason where the record is a regulated one. It has to be written somewhere the operator cannot reach — a database on a server, not a CSV on the HMI memory card. An audit trail an administrator can silently trim is not an audit trail.
Electronic signatures at the operator station
Clause 11.50 requires each signed record to show the printed name of the signer, the date and time, and the meaning of the signature — review, approval, responsibility or authorship. Clause 11.70 requires the signature to be linked to its record so it cannot be cut out or copied onto another. Clause 11.200 requires at least two distinct identification components for non-biometric signatures: all components for the first signing in a continuous session, and at least one component executable only by the signer for the rest of that session.
On the floor, a badge tap alone does not qualify. Badge plus PIN does. Typical signature points are line clearance before a batch starts, recipe change approval, in-process check acceptance, deviation acknowledgement, and release. Note that the 11.100(c) certification letter to the FDA declaring electronic signatures legally binding is the manufacturer’s obligation, not the equipment supplier’s.
Time synchronisation
This is the dull requirement that quietly fails audits. Real-time clocks in PLCs, HMIs and industrial PCs drift independently, and two devices on one machine can differ by minutes after a year in service — which makes a merged audit trail indefensible when the sequence of events is the whole question. Sync everything that touches a regulated record to one time source, store timestamps in UTC, display local time, record the convention in the validation documents, and log clock adjustments as audit trail events in their own right.
Records, copies and retention
Clauses 11.10(b) and 11.10(c) require accurate and complete copies in human-readable and electronic form, protected and retrievable for the whole retention period. If the only way to view a batch record is a proprietary screen on the machine, you cannot hand an inspector a copy. Export a fixed-layout document for review and a structured form such as CSV or XML for analysis, hold both on a backed-up server, and test a restore before you need one.
A 21 CFR Part 11 checklist for production equipment
| Clause | What it asks for | What it means on the machine |
|---|---|---|
| 11.10(a) | Validated system, able to discern invalid or altered records | Specification, test protocols and traceability for the machine application software; IQ/OQ/PQ execution |
| 11.10(b) | Accurate and complete copies, human-readable and electronic | Batch or unit record exportable as a fixed-layout document plus CSV/XML |
| 11.10(c) | Protection and ready retrieval through retention | Records on a backed-up server, not on the HMI; tested restore procedure |
| 11.10(d) | Access limited to authorised individuals | Per-person HMI accounts, no shared logins, domain integration where available |
| 11.10(e) | Secure, computer-generated, time-stamped audit trail | Old value, new value, user, UTC timestamp, reason; write-protected store |
| 11.10(f) | Operational checks enforcing permitted sequencing | Machine will not start a batch until line clearance is signed; interlocked step order |
| 11.10(g) | Authority checks for signing, altering, operating | Role-based screen and function access on the HMI |
| 11.10(h) | Device checks on validity of the data source | Camera, reader and instrument identity and calibration status verified before data is accepted |
| 11.10(k) | Controls over systems documentation | Versioned PLC program, drawings and change history under revision control |
| 11.50 | Signature manifestation | Name, date, time and meaning printed on the record, not just a tick box |
| 11.70 | Signature-to-record linking | Signature stored with the record it signs, not as a separate table anyone can edit |
| 11.200 | Two signature components | Badge plus PIN, or user ID plus password; single-component reuse only within a continuous session |
What is an electronic device history record, and how does it reach the equipment?
An electronic device history record proves that a unit or batch was manufactured according to the specified process, kept electronically instead of on a paper traveller. Electronic device history record software replaces the clipboard that follows the job around the floor. The pharmaceutical equivalent is the electronic batch record: a different predicate rule, the same build — work order structure, operator entries, machine data, checks, signatures, release.
Motionwell delivered such a system for a medical device OEM as a standalone order rather than as part of a machine purchase, and it is going in site by site. That sequencing is deliberate: every site has a different mix of machine generations and validation repeats per site anyway, so each quality team qualifies what it actually has instead of waiting for the slowest plant.
The three data paths into the record
Data reaches the record three ways, and each needs a different design decision.
Operator entries come from the station: lot numbers of incoming components, visual check results, deviations. These need the authority checks and signature rules above.
Machine-generated parameters come from the PLC — servo torque curves, insertion force traces, measured fill volumes, test results, cycle timestamps. Projects P23005 and P25026, the GMP filling and sealing machines, log torque curves per container. P22068, a 12-station rotary syringe assembly machine on a 15-second cycle, logs force-monitored insertion and vision results per unit. That data is worth far more inside a batch record than in a folder of CSV files nobody opens.
Instrument and reader data comes from the measurement and identification devices: Cognex DataMan readers and Domino coders on serialised packaging lines, Keyence measurement systems, SICK leak-test fixtures. Clause 11.10(h) applies here — the record should carry which device produced the reading and whether it was in calibration at the time.
How the interface is built
The usual transport is OPC UA from the controller, or a direct driver against PLC tags where the controller predates it. The machine publishes a completed-unit or completed-batch event carrying its parameters, and the EDHR stamps it against the work order and serial number.
One design rule matters more than the protocol choice: the machine must not stop when the EDHR is down. Buffer locally with enough depth to cover a server reboot or a network change window, forward when the link returns, and alarm if the buffer fills. A line that halts because an IT patch window ran long gets unplugged from the record system within a month, and then you have neither automation nor compliance.
How does ALCOA+ data integrity apply to machine data?
ALCOA+ is the shorthand regulators use for data integrity expectations, and it maps onto equipment design cleanly.
| Attribute | What it means at the machine |
|---|---|
| Attributable | Every entry carries a named user; no shared accounts, no anonymous overrides |
| Legible | Records readable without the original vendor software; exports in open formats |
| Contemporaneous | Written at the moment of the action, which is why clock sync is not optional |
| Original | The first capture is preserved; derived summaries never replace the raw parameter |
| Accurate | Instruments in calibration, device checks before data is accepted |
| Complete | Failed cycles, rejects and reworks are in the record, not only the passing units |
| Consistent | One timezone convention and one sequence across every controller on the line |
| Enduring | Server storage with backup, not an SD card in a panel |
| Available | Retrievable for the retention period by someone who is not the machine builder |
The one that catches machines most often is Complete. A rejection handler that diverts a bad part and increments a counter has thrown away the interesting half of the data. Every reject on a Motionwell line is logged with serial number, reason and the inspection image behind the decision — the pattern used on the vision-inspected filling lines.
How does EU GMP Annex 11 differ from 21 CFR Part 11?
Annex 11 of EU GMP covers computerised systems and overlaps heavily with Part 11, but it reads as a risk-based lifecycle rather than a list of controls. It is explicit about things Part 11 leaves to guidance: supplier assessment and the right to audit the supplier, data migration when systems are replaced, periodic evaluation, business continuity, and qualification of the IT infrastructure. It sits alongside EU GMP Chapter 4 rather than replacing it, and it has been under revision — check the current published text before writing a validation plan against it.
If you ship to both markets, design to the stricter reading of each requirement rather than maintaining two configurations. The extra cost at design time is small next to re-qualifying a running line.
Can an existing machine be retrofitted for Part 11?
Control-system retrofit is Motionwell’s largest project line in 2026: replacing obsolete PLCs, servo drives and VFDs on legacy machines, mostly onto Allen-Bradley CompactLogix and ControlLogix controllers, Kinetix servo drives and PowerFlex 755 VFDs. Much of that work has a compliance driver rather than a mechanical one — the machine still runs fine, but its controller cannot hold a user account.
There are three routes, and the decision usually takes an afternoon on site.
Replace the controller. The new PLC and HMI carry user accounts, audit trails and signatures natively. Choose this when the controller is out of vendor support, spares are scarce, or the machine needs new functions anyway.
Keep the controller, add a data layer. An industrial PC reads tags from the existing PLC, holds the audit trail, presents signature prompts and forwards records. Choose this when the machine is sound, the controller is still supported, and the risk of touching a validated control program outweighs the benefit.
Leave the machine alone. The record lives in the EDHR and the operator signs at a station beside the machine. Choose this when the operator, not the machine, generates the regulated data.
Three questions decide it: does the controller support named users, does the vendor still support its firmware, and is the record machine-generated or human-generated. The retrofit approach is set out in the custom machine design guide, and the regulated production context in the medical device automation and pharmaceutical packaging pages.
What does IQ/OQ/PQ have to do with Part 11?
Clause 11.10(a) requires validation, and IQ/OQ/PQ is how that gets discharged for equipment. Under GAMP 5, application software written for one specific machine sits in the custom category: it needs a specification, testing traceable back to it, and a documented change history — not just a passing factory acceptance test.
Installation qualification verifies that what arrived is what was specified: controller and firmware versions, network configuration, time source, account structure, record storage location. Operational qualification tests the functions across their range, and the useful tests are the negative ones — a wrong password, an action from an unauthorised role, power removed halfway through writing a record, a clock adjustment, a cable pulled while the buffer fills. Performance qualification runs product.
Motionwell prepares IQ and OQ protocols and supports PQ execution with the customer’s quality team, the same practice used on the GMP filling projects and cleanroom test equipment builds. Factory acceptance testing happens at the Woodlands Link facility before shipment, site acceptance testing in your cleanroom afterwards.
What drives the cost of a Part 11 compliance project?
Not the software licence, most of the time. The drivers are:
- Number of record types. One batch record structure is a project. Fourteen product families with different check sequences is a different project.
- Number of signature points. Each one is a screen, a procedure, a training item and a test case.
- Controller generation across the fleet. One modern platform costs a fraction of a mixed fleet spanning three vendors and twenty years.
- Validation scope. Who writes the protocols, and how many negative test cases the risk assessment demands.
- Number of sites. Validation repeats per site even when the software does not.
- Network and IT constraints. Whether OT and IT are already bridged, or the project has to build that path first.
A paperless-manufacturing suite licensed per site and a scoped EDHR built against four machines are both legitimate answers, and not the same class of purchase. What decides between them is how many record types and sites you have, not how the demo looked.
Frequently Asked Questions
What is 21 CFR Part 11 in simple terms?
It is the FDA rule that lets an electronic record and an electronic signature stand in for paper and ink on records the FDA already requires you to keep. The system holding those records has to be validated, has to limit access to named users, has to keep a secure computer-generated time-stamped audit trail, and has to produce accurate and complete copies for inspection. Part 11 never applies by itself. It applies because a predicate rule requires the record.
Does 21 CFR Part 11 apply to PLC and HMI data?
It applies to whatever part of that data forms a record a predicate rule requires. A servo torque curve logged as evidence that a cap was applied correctly is such a record. A live trend on the HMI that nobody keeps is not. In practice the split is decided during validation, and the machine is designed so that the regulated portion is written to protected storage with its audit trail, while everything else stays as ordinary process data.
What is the difference between an electronic batch record and an electronic device history record?
They solve the same problem for different predicate rules. An electronic batch record is the pharmaceutical term, tied to 21 CFR 211.188 batch production and control records. An electronic device history record is the medical device term for the record proving each unit or batch was built according to the specified process. Both replace paper travellers, both collect operator entries and machine data, and both fall under Part 11 once they are kept electronically.