Cleanroom differential pressure, temperature and humidity monitoring

At a glance

Item	Typical answer
Problem	Pressure cascades and room climate are shown on local gauges and a BMS that production does not watch, and nuisance alarms from door traffic hide the real losses of cascade.
What is connected	Differential pressure across each room boundary, room temperature and humidity, airlock door contacts, particle counter outputs where fitted, and air handling unit states.
Who uses it	Production supervisors, the QA reviewer, the HVAC or facilities engineer and validation.
Typical first scope	One suite of 8 to 20 rooms served by one or two air handling units.
Time to first screen	Typically one to two weeks after the transmitters are wired, longer if the cascade drawing is built first. Qualification work, if your procedures require it, sets the real timeline.

The situation

A sterile manufacturing suite, a hospital aseptic unit, a cell therapy facility or a semiconductor fab holds its rooms in a pressure cascade: the cleanest room highest, each step down typically 10 to 15 Pa, with airlocks between grades. Temperature and humidity are held in a band for product, people and static control. Magnehelic gauges at the doors show the cascade locally, and the building management system controls the air handling units.

What goes wrong is rarely dramatic. A filter loads up over weeks and the supply falls until one room drops below its neighbour for a few minutes each time a door opens. A door closer weakens and an airlock stands open long enough to equalise two grades. Humidity climbs on a wet summer afternoon. The BMS alarms on all of it, including every normal door opening, so operators learn to silence it and nobody can say afterwards whether a cascade loss during a filling run was two seconds or two minutes.

The aim: a continuous record of every boundary and room, alarms that separate door transients from real loss of cascade, a named person who takes each alarm and writes what happened, and records that QA can review per batch period.

Goals and measures

• Cascade compliance per boundary = time with differential pressure above its alert limit ÷ time in operation. Read it from the alarm list: operating time minus the summed duration of cascade alarms, divided by operating time.
• Excursions per batch period, split into alert-level and action-level, with duration from each alarm's opened and resolved times.
• Door-held events = airlock door alarms per week. A rising count points at a closer, a habit or a layout problem.
• Climate stability = daily minimum and maximum of temperature and humidity per room, from the day aggregates.
• Time to acknowledge for action-level alarms during production hours.
• AHU health trend = supply fan speed or filter differential pressure week by week; a steady climb at the same airflow shows filter loading before the cascade suffers.

The alert and action limits per room come from your cleanroom design and qualification. The values below are placeholders for the structure; agree the real ones with QA and validation.

Architecture

Cleanroom signals are best wired, not radio: differential pressure changes in seconds, and transmitters sit in walls where cables already run. A licensed gateway running Hermetry Edge in the technical area reads them and sends everything over one outbound MQTT connection with TLS. Nothing in the suite accepts connections from outside.

• Differential pressure transmitters (for example ±50 Pa or ±100 Pa range) on each boundary, reference side to the lower-grade room, wired 4-20 mA into a Modbus RTU analog input module, or with a Modbus RTU output of their own on the gateway's RS485 line.
• Temperature and humidity transmitters per room, on the same RS485 line or the same input modules.
• Door contacts on airlock and room doors, into the gateway's digital inputs or a Modbus digital input module.
• Particle counters with a Modbus TCP output, where the counter offers one, read on the plant network. Counter data stays in its own system of record if that is how your procedures define it.
• AHU states (fan running, fan speed, filter pressure) from the HVAC controller if it offers Modbus TCP or RTU; otherwise from spare contacts and analog outputs.

Component	Role	Notes
Licensed gateway with Edge	Reads the suite's transmitters and modules	One per suite or technical area. Factory identity; claimed into the organisation.
Modbus analog and digital input modules	Bring 4-20 mA signals and contacts onto RS485	Generic remote I/O; addresses set before installation.
Pressure, temperature and humidity transmitters	Process values	Calibrated instruments with certificates; ranges suited to the cascade.
Particle counter outputs	Counts per size channel	Optional; Modbus TCP where available.
HVAC controller	AHU states and filter pressure	Read-only from Hermetry.
Hermetry	Storage, alarms, records, boards, drawings	EU, US or Türkiye region, or on your own servers, which many regulated sites prefer.

The gateway signs in with an X.509 certificate from the platform's own authority, and the device profile requires TLS. Each room can be a child device of the gateway, so it has its own readings, alarm rules and history while the gateway keeps the one connection. Profiles can also restrict the networks a device may connect from, which matches a plant network with a fixed egress address.

Point list

For one room with two boundaries and an airlock, plus the AHU. Registers are placeholders from a typical input module map.

Point	Telemetry key	Unit	Source	Interval	Notes
Differential pressure to corridor	dp_corridor_pa	Pa	4-20 mA transmitter via input module, register 30001	10 s	Positive when the room is higher.
Differential pressure to airlock	dp_airlock_pa	Pa	Transmitter, 30002	10 s
Room temperature	temp_c	°C	Transmitter, 30003	60 s
Room relative humidity	rh_pct	%	Transmitter, 30004	60 s
Room door open	door_open	bool	Door contact, module DI1	on change	Plus a heartbeat every 5 min.
Airlock inner door open	al_inner_open	bool	Door contact, DI2	on change
Airlock outer door open	al_outer_open	bool	Door contact, DI3	on change
Room in operation	in_operation	bool	Selector or production signal, DI4	on change	Separates operating and at-rest states.
Particles 0.5 µm	pc_05_m3	count/m³	Particle counter, Modbus TCP	60 s	Optional.
Particles 5 µm	pc_50_m3	count/m³	Particle counter, Modbus TCP	60 s	Optional.
Supply fan running	ahu_fan_run	bool	HVAC controller or contact	on change	AHU device.
Supply fan speed	ahu_fan_pct	%	HVAC controller	60 s
Final filter differential pressure	ahu_filter_pa	Pa	Filter transmitter	5 min	Filter loading trend.
Supply air temperature	ahu_supply_c	°C	HVAC controller	60 s
Supply air humidity	ahu_supply_rh	%	HVAC controller	60 s
AHU fault	ahu_fault	bool	HVAC controller	on change
Module communication	io_comm_ok	bool	Gateway Modbus status	60 s	False when a module stops answering.

Declare each key in the profile with unit, decimals and a range that matches the transmitter, for example −50 to +50 Pa. Gauges take their scale from it, and a reading outside the declared range is easy to spot as an instrument fault.

Asset model

• Site with time zone and site_code.
• Building and Floor where the plant has several.
• Area for each suite, with ahu and grade_scheme.
• Room for each room and airlock, with room_code, grade (for example B, C or D, or an ISO class), design_dp_pa, alert_dp_pa, action_dp_pa, temp_band and rh_band.
• Machine for each AHU, with filter_installed and design_airflow_m3h.

Place each room's child device on its room asset and the AHU device on the AHU asset. Add Feeds relations from the AHU to the rooms it supplies; a supply fan trip then points straight at the rooms that will lose cascade. Place and status roll up the tree, so the suite takes the worst status of its rooms.

Write the alert and action limits as server attributes on each room device (for example dp_alert_pa = 10, dp_action_pa = 5). Alarm rules compare with the attribute, so one profile covers every room while each boundary keeps its qualified limit. Attribute changes are written to the audit log, which suits change control.

Device setup

Profiles and provisioning

Create profiles for Cleanroom room, Airlock, AHU and Suite gateway. Claim the gateway by scanning its code or typing its claim details, pick its profile and place it. Hermetry creates each child device the first time the gateway reports it, with the profile named by the type the gateway sends, so set the type per room kind in the gateway configuration; then place each child on its room asset. Use the Recent message online rule with an expected interval of about a minute and an inactivity alarm rule per profile.

Settings and polling

On the licensed gateway, remote device settings show its Modbus addresses, serial parameters and polling intervals. Configure the first suite, save a baseline and apply it to the next suites with a bulk job that runs in waves and stops when too few gateways apply it. A dry run shows what would change before anything is sent.

Poll differential pressure every 5 to 10 seconds and send it every 10 seconds; temperature and humidity every minute are enough. If the gateway model supports report by exception with a deadband, use a small one for pressure (for example 0.5 Pa) with a heartbeat; the change happens at the gateway and does not cost messages. Do not smooth pressure heavily before storage: a long average hides the door transients that the alarm logic needs to see as transients.

Time and continuity

Synchronise the gateway clock before it stamps readings; records more than ten minutes ahead are dropped. Licensed gateways keep readings when the uplink fails and send them afterwards, with a capacity that depends on the model; size it for your longest expected network outage. Late readings are stored and evaluated by the alarm rules as a backfill, so a cascade loss during an outage is in the history, marked Backfilled, without a late page.

Firmware

Gateway firmware is signed and rolled out from the profile in waves. In a regulated suite, treat a firmware wave as a change: roll it out to a non-production suite first, let it soak, and continue only after the change is approved.

Dashboards

Board	Audience	Widgets and what they show
Suite overview	Production supervisors	The cascade drawing (below) as a SCADA card; table of rooms with pressure to each neighbour, temperature, humidity and status; stat cards for open action-level alarms and rooms offline; alarm table of open alarms with acknowledge from the alarm page. Also on a wall screen in the corridor through a read-only display link.
Room page	Supervisors, QA	Gauges for each differential pressure with alert and action bands; state cards for doors and operation; line chart of pressure, temperature and humidity over 24 hours; alarm list with timelines. Opened from the overview with the room as a parameter.
Batch period review	QA	Line chart and history table for a chosen time window (the window is in the address, so a review link can be shared); alarm table of the period with acknowledgements and notes; downloads to Excel for the batch file.
HVAC health	HVAC engineer	Supply fan speed and filter differential pressure per AHU over 90 days; supply air temperature and humidity; heatmap of cascade alarms by hour and weekday to find door habits.

One room page serves every room through an entity parameter. Board viewers see only the data their own permissions allow, so the same overview can be shared with production and QA.

SCADA screens

The cascade drawing is the screen people look at most. Draw the suite as a floor plan: rooms as areas labelled with grade and code, each boundary marked with its differential pressure and an arrow for the intended airflow, airlocks with both doors.

• Symbols: room pressure monitor, fan filter unit, particle counter, airlock door interlock, pass box, air shower, laminar-flow hood and glove-box isolator from the pharma family of the Food and pharma pack; air handling unit, VAV box, louvre damper and duct pieces from the HVAC family of the Building pack. See the SCADA library.
• States and rules: each pressure label turns amber below its alert limit and red below its action limit; a door symbol shows open and closed; the airlock interlock symbol blinks when both doors are open; the AHU shows running and fault.
• Second readings: room symbols print temperature and humidity under the code.
• Reuse and 3D: attach the drawing as a view of the suite asset; Match everything proposes the device for each symbol. A 3D view built from the drawing keeps the bindings and can tint each room by the worst status of its devices, if they report a status key, which a flow can derive and store.

The designer's Problems tab lists unbound symbols and rules that can never match; clear it before the drawing goes on the wall screen.

Rules and alarms

Every door opening briefly collapses the pressure across it. The rules below hold off cascade alarms while the related door is open and catch the door itself if it stays open. A rule over several keys evaluates on each key's latest value, so the door state from one message and the pressure from another combine correctly.

Alarm	Condition	Delay and hysteresis	Severity	Notified	Escalation
Cascade low, room to corridor	all: dp_corridor_pa < attribute dp_alert_pa, door_open == false (Warning); with dp_action_pa (Major)	Debounce 30 s raise, 30 s clear; hysteresis 1 Pa	Warning / Major	Supervisors in the suite, push and in-app; Major also SMS to the shift lead	Severity rise notifies again; reminder every 10 min
Cascade reversed	dp_corridor_pa < 0 with doors closed	Debounce 20 s	Critical	Shift lead and QA on duty, SMS and push	Reminder every 5 min
Airlock both doors open	all: al_inner_open == true, al_outer_open == true	Debounce 10 s	Major	Suite supervisors, push	Reminder every 5 min
Door held open	door_open == true	Debounce 60 s (longer for material doors)	Warning	Suite supervisors, in-app	None
Temperature out of band	temp_c > attribute temp_high_c or < attribute temp_low_c	Debounce 5 min; hysteresis 0.3 °C	Minor	Supervisors and HVAC, e-mail and in-app	Reminder every 30 min
Humidity out of band	rh_pct > attribute rh_high_pct or < rh_low_pct	Debounce 10 min; hysteresis 2 %	Minor	Supervisors and HVAC, e-mail	Reminder every 30 min
Particle alert	pc_05_m3 > attribute pc05_alert with in_operation == true	Debounce 2 samples	Major	Supervisors and QA, push	Reminder every 10 min
AHU stopped	ahu_fan_run == false or ahu_fault == true	Debounce 20 s	Critical	HVAC engineer, shift lead, SMS	Reminder every 5 min
Filter loading	ahu_filter_pa > attribute filter_change_pa	Debounce 1 h	Info	HVAC engineer, e-mail	None
Room device silent	Inactivity rule, 3 min		Major	HVAC engineer and shift lead, push	Reminder every 15 min

Door held, cascade lost. Because the cascade rule skips periods with the door open, the door-held alarm is what catches a door wedged open. Keep both, and give the door alarm a delay shorter than any time your procedures allow a boundary to be open. Where a room has several doors, combine their contacts with any in the condition.

Acknowledgement and notes. An alarm opens after its debounce and clears itself when the condition no longer holds with the hysteresis applied. The person responsible acknowledges it and adds notes on the alarm's timeline, for example the batch, what was found and the assessment. Acknowledgements and clearances are written to the audit log with the person's name and time; a Critical alarm resolved by hand is logged separately. Hermetry does not hold an alarm open until someone acknowledges it: a short excursion can clear by itself. Your review should therefore include every resolved alarm without an acknowledgement in the period.

Maintenance and qualification work. Mute a room's devices during filter changes, smoke studies or requalification. Alarms are still recorded, marked as muted, and nobody is paged; the mute ends by itself, at most after 90 days, and each mute is audited.

Avoiding floods. An AHU trip drops every room it feeds. Keep the AHU alarm Critical and the rooms' cascade alarms at Warning and Major with their delays; dampening on a chattering boundary holds an alarm that flips too often. Above 20 alarm notifications a minute, Hermetry sends a five-minute digest instead of individual messages.

Automation and integrations

• Production state: if no contact for in_operation exists, the batch or MES system can write it as a shared or server attribute through the REST API, for example at the start and end of each batch.
• Deviation records: the signed webhooks alarm.created, alarm.acknowledged and alarm.cleared send every action-level alarm to the quality system; a flow can filter by severity and post only Major and Critical through an HTTP request.
• BMS stays in charge: the HVAC controller keeps controlling fans and dampers. No commands are sent from Hermetry in this design.
• Batch records: the batch period review downloads to Excel. Scheduled or e-mailed reports are not built in today.

Roles and access

Who	Role or group	Can
Production operator	User	See the suite, acknowledge alarms, add notes.
Shift lead	User	As operator; receives Major and Critical by SMS.
QA reviewer	User + IoT viewer group	Read all records, alarm timelines and history; download tables; no changes.
HVAC engineer	User + IoT operator group	See devices, write limit attributes after change approval.
System administrator	Admin	Profiles, alarm rules, drawings, boards, mutes, firmware; reads and exports the audit log.
System owner	Owner	Members and roles, sign-in policy, firmware signing keys.

Changes to alarm rules are versioned and each change is an audit entry; profile changes, attribute writes, mutes, acknowledgements and sign-ins are audited too. The audit log is a hash chain that Verify checks for tampering, and exports as CSV or NDJSON. Sign-in can require two-factor authentication or passkeys, or run through your SAML or OIDC identity provider. The AI firewall watches sign-ins, API calls and device traffic, blocks abuse and records why.

These are the records an inspector may ask about. Hermetry is not validated for GMP use and does not claim compliance with electronic-record regulations. If your procedures require a validated system, the validation, the procedures and the decision which record is official are the customer's responsibility; on-premises installation keeps the system inside your own validated infrastructure.

Sizing and data

As an order of magnitude for two suites with 30 rooms and 3 AHUs:

• Room devices: 30 messages every 10 seconds, 30 × 8,640 = 259,200 messages a day, each carrying pressure, and once a minute temperature and humidity.
• Doors: allow 300 changes and heartbeats per room a day in production, 9,000.
• AHUs: 3 × 1,440 = 4,320.
• Total: about 272,000 messages a day, roughly 8.3 million a month. Commands, alarms and connection events are not counted.
• Rate limits apply to each child and to the gateway as a whole: 30 rooms at 6 messages a minute is 180 a minute on one gateway, inside the default of 300. A larger suite should use a second gateway or a raised limit on the gateway profile.

Pressure at 10 seconds is the largest share. If the gateway reports by exception, the count falls a lot during stable operation. The plan's retention class (7 to 1,095 days) sets history length: raw readings are kept for at most 90 days (7 to 90 depending on the class), minute aggregates for up to 31 days, and hourly and daily aggregates for the full class, which keep long trends cheap. If batch records need the 10-second values, export the batch period within the raw window and include the exported data in the batch file.

Rollout plan

Phase	Weeks	Work	Exit criteria
0. Design	1-3	Room list, boundaries, limits and delays from the cleanroom design; transmitter and module selection; point list and drawing sketch approved.	Signed design and point list; decision whether Hermetry is a supplementary or the primary record.
1. Install	4-6	Transmitters, modules and gateway in one suite; profiles, alarm rules, drawing.	Every signal matches a reference within tolerance; every alarm forced and acknowledged.
2. Parallel run	7-12	Run beside the existing BMS and gauges; tune delays on real door traffic.	Nuisance alarms under an agreed level, for example two a room a week; all excursions also visible in the BMS are present in Hermetry.
3. Suite by suite	13+	Further suites with the baseline; webhooks to quality; wall screens.	Each suite passes the same checks; qualification, if required by your procedures, completed by your team.

Commissioning checklist

1. Gateway claimed, certificate active, profile requires TLS; each child device on the right room asset.
2. Each pressure transmitter checked at zero and at one point against a reference manometer; sign convention correct (positive means the room is higher).
3. Temperature and humidity checked against a calibrated reference; calibration certificates linked in the room attributes.
4. Each door opened and closed; the state follows within one polling interval.
5. Door opened during a cascade test: no cascade alarm; door held: door alarm after its delay.
6. Supply fan stopped in a controlled test: AHU alarm Critical, cascade alarms follow at their delays, digest behaviour understood.
7. Limit attributes present on every room device; a missing attribute leaves that comparison false.
8. Gateway uplink unplugged for 15 minutes; on return, buffered readings fill the gap and backfilled alarms are marked.
9. Clock checked against the plant time reference; time zone of the site correct.
10. Audit log shows the test acknowledgements under the testers' names.

Pitfalls

• Alarming on every door transient. Operators stop reading alarms. Combine cascade rules with door states and delays.
• Ignoring the door-held case. With door-aware cascade rules, only the door alarm catches a wedged door.
• Reference tubes in the wrong room. A transmitter that reads the neighbour's neighbour shows a stable but wrong cascade. Trace every tube during commissioning.
• Over-smoothing. A 5-minute average before storage hides a real 3-minute loss. Store the raw 10-second value.
• Limits only in the drawing. A colour rule is not an alarm. Put limits on attributes used by alarm rules, and let the drawing follow.
• Treating Hermetry as the BMS. It supervises; fans, dampers and interlocks stay in their controllers.

What Hermetry does not replace

Hermetry monitors, records and alerts. Air handling control, door interlocks and any safety functions stay in the HVAC controller, the interlock hardware and hard-wired circuits. Particle monitoring may remain in its own validated system. Batch release, deviation assessment and qualification remain with QA. Hermetry does not claim GMP validation or regulatory compliance; it provides readings, alarm timelines, notes and audit records for your procedures to use.