Manufacturing science

Signal detection in GMP: how control charts with run rules catch a shift or a drift before it becomes a deviation

By QLogix · Published 15 October 2026 · 10 min read

The short answer

A result inside specification can still be the first point of a shift that ends in an out-of-specification batch three lots later. Control charts with alert limits at two sigma, action limits at three and Nelson's run rules see the shift while every result still passes. When the chart, the AI's reading of each signal and QA's disposition sit on one audited record, trending stops being an annual review exercise and becomes continued process verification.

The alert limit: a single result between two and three standard deviations from the centre line is a warning, not a deviation.: 2 σ
Nelson's run rules: shifts, trends, alternation, stratification and mixtures that no single-point limit sees.: 8
Signature per signal: QA's disposition, investigate, monitor or not a signal, with the reason on record.: 1

Key takeaways

FDA's process validation guidance (2011) makes trending a continuing obligation under stage 3, continued process verification, and 21 CFR 211.180(e) and EU GMP Chapter 1 require the periodic review of data for trends; ICH Q10 names process performance and product quality monitoring as a pillar of the quality system. None of them say which chart or which rules: that is the firm's decision, and the records show it was applied.
The individuals and moving range chart with sigma estimated from the average moving range, alert limits at two sigma and action limits at three, as in ASTM E2587, fits most batch and laboratory parameters: one result per lot, no rational subgroup, a specification to compare with.
Nelson's eight rules (or the four Western Electric rules) detect what single-point limits miss: nine points on one side of the centre line is a shift, six rising or falling is a drift, fifteen inside one sigma means the limits are too wide or the data is mixed. Each rule names the pattern, which is what the investigation starts from.
A signal is not a deviation. It is a question for QA: investigate, monitor or not a signal, each with a reason and a signature. Kept on one audited record with the chart, the AI's interpretation and the linked investigation, the dispositions are the trending history an inspector asks for at the annual product review.

What do the regulations ask for in trending?

For drugs, 21 CFR 211.180(e) requires written procedures for the evaluation, at least annually, of the quality standards of each drug product, with a review of a representative number of batches and of complaints, recalls, returns and investigations, to determine the need for changes in specifications or manufacturing or control procedures. EU GMP Chapter 1 asks the same of the product quality review, with an explicit review of critical in-process controls and finished product results, and 'a review of all batches that failed to meet established specification(s) and their investigation'. ICH Q10 goes further: a process performance and product quality monitoring system that provides assurance of continued capability, identifies areas for continual improvement and feeds the management review.

FDA's 2011 guidance on process validation turned trending into a daily matter. Stage 3, continued process verification, asks the firm to collect and analyze product and process data during routine production, with statistical methods appropriate to the data, to detect undesired process variability and to set the frequency of sampling and monitoring from an understanding of the process. The data are meant to be evaluated by trained personnel against the process's demonstrated variability, not against the specification alone.

What none of these say is which chart, which limits or which rules. A specification limit tells you whether the lot can be released; it tells you nothing about whether the process that made it is the same process that was validated. The chart and the rules are the firm's decision, written into a procedure, and the record of every signal and its disposition is the evidence that the decision was applied.

What the regulations and guidance ask, and what the signal record shows

Expectation	Where it comes from	What the signal detection record shows
Periodic review of batch and laboratory results for trends	21 CFR 211.180(e); EU GMP Chapter 1 (product quality review)	The parameter's chart with its limits, every signal since the last review and QA's disposition of each
Ongoing monitoring of process performance against its demonstrated variability	FDA process validation guidance, stage 3; ICH Q10 section 3.2.1	Alert and action limits from the process's own history, run rules on every new result, capability against specification
Statistical methods appropriate to the data, applied by trained people	FDA process validation guidance, stage 3	The method named on the record: I-MR chart, sigma from the moving range or the standard deviation, Nelson or Western Electric rules
A decision on each trend and the action taken	ICH Q10; ICH Q9(R1) risk-based decisions	Investigate, monitor or not a signal, with the reason, the signature and the investigation linked
Data integrity of the trend record	FDA data integrity guidance	Results as recorded or received through an interface, a hash-chained audit trail, signatures with password re-entry

A reading of 21 CFR 211.180(e), EU GMP Chapter 1, ICH Q10 and FDA's process validation guidance, stage 3. The wording of each expectation is ours; the sources are listed at the end.

The chart: centre line, sigma, alert and action limits

Most GMP parameters arrive one value per lot or one value per day: an assay, a fill weight, a bioburden count, a tablet hardness, a chromatographic resolution. There is no rational subgroup to average, so the individuals and moving range chart is the right tool, and it is the one ASTM E2587 and the usual pharmaceutical trending procedures describe. The centre line is the mean of the points the limits rest on: all points, the first N as a baseline, or a historical mean and sigma the firm approved. Sigma is estimated from the average moving range divided by d2 (1.128), the within-process estimate that is not inflated by a shift already present in the data; the sample standard deviation is available when the procedure asks for it.

Two sets of limits sit on the chart. The alert limits at two sigma catch the single result that is unusual but not alarming: in a stable process one result in twenty lands there by chance, so one alert is a note, two in three is a rule. The action limits at three sigma catch the result that a stable process produces about three times in a thousand: that is a special cause until shown otherwise. The specification limits sit on the same chart, usually well outside the action limits, so the reader sees the distance between what the process does and what the product needs. The moving range chart beside it, with its upper limit at D4 times the average moving range, catches the jump between two consecutive results that the individuals chart would miss.

Capability turns that distance into a number. Cp and Cpk use the within-process sigma from the moving range and say what the process could do while in control; Pp and Ppk use the overall standard deviation and say what it has done. A Cpk of 1.33 means the nearer specification limit is four sigma from the centre; a Ppk well below Cpk means the process is capable but not stable, which is exactly the case run rules exist for.

Twenty lots of an assay: in specification throughout, shifted from lot eleven

Illustrative results, not a measurement. The specification is 95 to 105 percent of label claim. Every lot passes. The alert limit catches lot 13; the run rule catches the shift at lot 17, nine points above the centre line; without the chart the shift would have been found at the annual review.

The run rules: what a shift, a drift and a mixture look like

Single-point limits see the result that is far out. The patterns that precede an out-of-specification result are made of results that are each unremarkable, and the run rules are the agreed definitions of those patterns. Lloyd Nelson's eight tests of 1984 are the default in QLogix; the four Western Electric rules, with a run of eight rather than nine, are the alternative for a procedure that cites them.

Rule 2, nine consecutive points on one side of the centre line, is a shift of the mean: a new raw material lot, a changed setting, a different operator or instrument. Rule 3, six points steadily rising or falling, is a drift: wear, fouling, a reference standard degrading. Rule 4, fourteen points alternating up and down, is over-adjustment or two alternating sources. Rules 5 and 6, two of three beyond two sigma and four of five beyond one sigma on the same side, are smaller shifts seen early. Rule 7, fifteen points inside one sigma, is stratification: either the limits are too wide or mixed data is hiding the variation. Rule 8, eight points beyond one sigma on either side, is a mixture: two populations on one chart, two tanks, two presses, two analysts.

Each rule names the pattern, and the name is where the investigation begins. A shift sends the investigator to what changed at the first point of the run; a drift to what wears; a mixture to what is being charted together that should be charted apart. The chart also says what is not a signal: a result that passes every rule is noise, and recording that conclusion with a reason is part of the trending record.

Nelson's eight rules, the pattern each names and the question each raises

Rule	Pattern	What it usually means	First question for the investigation
1	One point beyond three sigma	A special cause on that lot	What was different about this lot, instrument or analyst?
2	Nine points on one side of the centre line	A shift of the mean	What changed at the first point of the run?
3	Six points steadily rising or falling	A drift	What wears, fouls or degrades at this rate?
4	Fourteen points alternating up and down	Over-adjustment, or two alternating sources	Is the process being corrected after every result? Are two sources alternating?
5	Two of three beyond two sigma, same side	A small shift, seen early	Same as rule 2, with less data
6	Four of five beyond one sigma, same side	A small shift, seen early	Same as rule 2, with less data
7	Fifteen points within one sigma	Limits too wide, or mixed data hiding variation	Are the limits from the right period? Is this one process or several?
8	Eight points beyond one sigma, either side	A mixture of two populations	What is being charted together that should be apart?

The default rule set on a QLogix signal detection record; the Western Electric set replaces rules 1, 2, 5 and 6 with their four tests. Every rule is evaluated on every new result.

From a result to a dispositioned signal: the record

A chart that lives in a spreadsheet is reviewed when someone opens it. A signal detection record is reviewed when a result arrives. The record holds one parameter: its source (the LIMS, a batch record, a monitoring system, a pasted or uploaded data set), its specification, its baseline and sigma method, its rule set and every result with its date and lot. Results come in as they are recorded, by hand, by file, or through the LIMS interface and the REST API, and each new result is judged against the limits and the rules at once.

When a rule fires, the AI reads the signal in the context of the parameter: the kind (limit, outlier, shift, trend, variation), the severity and the confidence, what in the data supports it, what changed at the first point of the run as far as the linked records say, and what to check first. It writes an interpretation and a recommended disposition. It does not decide. QA records the disposition, investigate, monitor or not a signal, with a reason, and signs; an investigation opened from the signal is linked both ways, so the chart shows the investigation and the investigation shows the chart. The process state on the record (in control, shifted, trending, unstable, out of specification, insufficient data) follows from the open signals.

The review cycle closes the record for a period: the reviewer and the approver sign that the parameter was trended, every signal was dispositioned and the process state is as stated. That signed record, one per parameter per period, is the trending evidence for the product quality review, and the dashboard shows which parameters have open signals now.

What happens to 1,000 results on a trended parameter

Results recordedby hand, by file or through the LIMS interface1000
Judged against limits and rules at oncealert, action, specification, Nelson's eight, moving range1000
Rule firedmostly single alerts and short runs38
Interpreted by the AIkind, severity, confidence, what to check38
Dispositioned by QAnone left open at the period review38
Monitorwatched for the next results21
Investigatean investigation opened and linked9
Not a signalwith the reason on record8

An illustrative model of one year on a mid-volume product, not a measurement. Each stage is a count of results. Almost everything is noise; the point of the record is that the few signals are each read, dispositioned and signed, and that the dispositions are kept with the chart.

Setting it up without fooling yourself

The limits are only as good as the period they come from. A baseline that includes a shift gives limits wide enough to hide the next one; a baseline of ten points gives limits that move with every result. Twenty to thirty points from a period the firm believes was in control, or a historical mean and sigma approved in the procedure, are the usual starting points, and the record says which was used and when the limits were last recalculated.

Mixed data is the second trap. Two presses, two filling lines, two analytical columns or two suppliers charted together produce a wide, calm-looking chart that fires rule 8 or rule 7 and hides a shift on one of them. One parameter per stream is the rule, and a stream that must be charted together should be charted together on purpose, with that choice recorded.

The third is the response. A rule that fires and is dispositioned 'monitor' forty times in a row is not being monitored. The record makes that visible: the dispositions are on the chart, the open signals are counted on the dashboard, and the alert rules say when a signal has waited too long for a decision.

Which chart and which rules, by the kind of data

Choice

	One result per lot, specification exists	Several results per lot or per day	Counts (particles, colonies, defects)	A measured drift over time (stability)
Chart	I-MR chart	X-bar and R, or I-MR on the lot mean	I-MR on counts, or c or u charts	Regression against time, not a control chart
Sigma	Moving range / d2	Range or standard deviation within subgroup	Moving range; square root for Poisson counts	Residual standard error
Rules	Nelson's eight	Nelson's eight or Western Electric	Rules 1 to 3; others fire often on counts	Slope and intercept confidence, not run rules
Capability	Cp, Cpk, Pp, Ppk against specification	Cp, Cpk, Pp, Ppk	Rarely meaningful	Shelf-life projection

What the data is

A guide, not a rule. The chart type and the rule set are the firm's decision in its trending procedure; the record names which was used.

What changes for QA

The annual product review stops being the first time anyone looks. Each parameter has a chart that has been watched all year, every signal on it has a disposition and a signature, and the review is a reading of decisions already made rather than a search for trends in a spreadsheet assembled in the last week of the quarter.

Out-of-specification results fall, because the shift that produces them is seen with results still in specification, and the deviation is opened on a trend rather than on a failed lot. The investigations that are opened are better framed: the rule names the pattern, the AI names what changed at the first point of the run, and the investigator starts from a question instead of from a result.

The figure is an illustrative model of where the hours go, not a measurement. The point is where they move: out of assembling charts and arguing about whether something is a trend, into the dispositions and the investigations that are the actual work.

Where the trending hours go across a product's year

Assembling charts: spreadsheetsexports, formulas, screenshots120 h
Assembling charts: recordsresults arrive, charts update8 h
Deciding what is a signal: spreadsheetsargued at the review60 h
Deciding what is a signal: recordsdispositioned as they fire30 h
Investigating real signals: boththe work that should take the time90 h
Writing the product quality review: spreadsheetscharts rebuilt, trends re-argued40 h
Writing the product quality review: recordssigned dispositions read back12 h

An illustrative model of one product with twelve trended parameters, not a measurement. Hours per year by activity, spreadsheet trending first, signal detection records second.

Common questions

Is a result beyond the alert limit a deviation?

No. A single result between two and three sigma happens about one time in twenty in a stable process. It is a signal for QA to disposition: monitor, investigate or not a signal, with the reason. A result beyond the action limit at three sigma, or outside specification, is a special cause until shown otherwise and usually opens an investigation.

Which run rules should a pharmaceutical trending procedure use?

Nelson's eight tests or the four Western Electric rules are both accepted; what matters is that the procedure names the set, the record shows it was applied to every result, and the dispositions are kept. Nelson's rules are the default in QLogix because they name more patterns (drift, alternation, stratification, mixture) and each name points the investigation somewhere.

How many points are needed before the limits mean anything?

Twenty to thirty points from a period believed to be in control is the usual baseline for an individuals chart; fewer gives limits that move with every result. A historical mean and sigma approved in the procedure are an alternative when the history is long and stable. The record says which was used and when the limits were last recalculated.

Does the AI decide whether a signal is real?

No. The AI reads each signal that the rules raise, states the kind, severity and confidence, what in the data supports it and what to check first, and recommends a disposition. QA records the disposition with a reason and signs; an investigation opened from a signal is linked to it. The AI's reading stays on the record with the tool and time it was made.

How does this relate to continued process verification?

Continued process verification, stage 3 of FDA's process validation guidance, asks for ongoing collection and statistical evaluation of product and process data to detect undesired variability. A signal detection record per critical parameter, with results judged as they arrive and every signal dispositioned and signed, is that evaluation as a continuous record rather than a periodic report.

Sources

This article is general information for quality and regulatory professionals. It is not regulatory or legal advice. Check the source documents for their current status before acting on them.