• ByRouging Solutions Editorial Team  ·  14 August 2026

WFI System Cleaning Protocol: Step-by-Step for Pharma Plants

A WFI system cleaning protocol has to do three separate jobs: routine sanitization, periodic chemical cleaning, and restoring the passive layer on the steel underneath. Most written protocols handle the first two and treat the third as optional. That gap is where water for injection loops quietly get into trouble.

The order matters as much as the chemistry. Clean before you passivate, because a passivating solution cannot form a chromium oxide film on a surface still covered in soil or rouge.

What Does a WFI System Cleaning Protocol Cover?

Three activities that plants often blur into one line in an SOP.

Routine sanitization keeps the microbial count down between production runs. It is frequent, usually thermal, and it does not remove much soil.

Periodic chemical cleaning takes off what sanitization leaves behind. That means organic film, process residue, and the iron oxide deposits engineers call rouge.

Passivation rebuilds the chromium oxide layer. That layer is what makes 316L stainless steel resist corrosion. Skip it and a freshly cleaned surface is more reactive than the one you started with, because cleaning strips the old film along with the soil.

Rolling all three into one line is the most common fault we see in WFI protocols. Each needs its own frequency, its own chemistry and its own pass mark.

If rouge is new to you, our guide to identifying rouge contamination on stainless steel covers the three classes and how they look on a loop.

Why Isn't Hot Water Circulation Enough?

Because it inactivates biofilm without removing it. The European Medicines Agency is blunt about it.

A hot water flush is fine as far as it goes. The EMA accepts it as a way "to minimise the planktonic contaminants and biofilm existing within a system." Then comes the sting. It is "known not to be fully effective in the removal of biofilm mass," and "use of chemical sanitising agents should be considered as part of an effective control strategy" (EMA Q&A on WFI by non-distillation methods).

The same document says why. Biofilms "protect flora contained within against the action of shear forces and disinfection chemicals," and incomplete removal "leads to a rapid regrowth and proliferation."

That is the argument for periodic chemical cleaning. Heat buys you time; it does not reset the surface.

WHO guidance points the same way. Systems held above 70 degrees C are "generally less susceptible to microbiological contamination," and controls "may include using chemical and/or thermal sanitization procedures as appropriate" (WHO TRS 1033, Annex 3). Either way, the times, temperatures and frequency must be defined and proven effective.

How Much Does Loop Design Affect Cleaning?

More than the chemistry does. A well-built loop cleans easily. A badly built one never fully cleans, whatever you pump through it.

WHO Annex 3 sets out what good looks like, and each point has a cleaning consequence:

Measure your dead legs before you write the protocol, because they set what any cleaning program can realistically achieve. WHO asks for those areas to be "measured and calculated," which is worth doing once and keeping on file. An inspector asking about dead legs wants a drawing and a number, and a team that has both can argue from evidence. If a branch cannot be drained or reached at velocity, no cleaning schedule will fix it, and the honest answer is a modification. A stronger chemical will not make up for it.

What Is the WFI System Cleaning Sequence?

Ten steps, in this order. Skip or reorder the middle ones and you get a system that passes on paper and fails on swabs.

1. Review the history first. Pull the last twelve months of conductivity, TOC and microbial trends, plus any deviation records. Counts that creep up between cycles usually mean biofilm, and that changes the plan.
2. Set acceptance criteria before you start. Decide what result ends the job. Deciding afterwards is how a clean gets signed off on optimism.
3. Isolate and drain the loop fully. Check that the low points actually drain.
4. Pre-rinse to carry away loose material, so the chemistry works on the surface and not on the debris.
5. Alkaline clean to lift organic film, process residue and biofilm mass.
6. Rinse to neutral and confirm it with a conductivity reading. A stopwatch is not evidence.
7. Derouge if rouge is present. This is a separate acid step with its own contact time. Trying to derouge and passivate in one pass usually does neither well.
8. Passivate to rebuild the chromium oxide layer, following a documented procedure.
9. Final rinse to specification. Send the first water off a restarted loop to drain, the same way the first portion is discarded when a system begins to function.
10. Verify and document before the loop goes back into service.

Steps 7 and 8 are the ones most often left out. They also decide whether you are back doing this in six months.

Where Does Passivation Fit In?

At the end, and a regulator says so in as many words. WHO Annex 3 states that "passivation should be considered for stainless steel systems," and it names when. After initial installation, and after any major change. It applies especially to surfaces never electropolished. The work must follow "a documented procedure defining the solution to be used, its concentration, the temperature and contact time."

Read that last part closely, because it is your audit trail. The procedure has to define four things:

• The solution
• Its concentration
• The temperature
• The contact time

An SOP that says "passivate as required" satisfies none of them. The EMA takes the same line on water systems. Its guidance notes that "preferred passivation chemistry methods can also be considered in the control strategy" for water systems.

Citric acid suits WFI work. It is choosy about what it strips, and easier on the plant than nitric acid. Our post on citric acid versus nitric acid passivation works through the trade-offs. For loops that cannot be dismantled, on-site passivation is the practical route.

How Do You Know the Clean Actually Worked?

Four checks, each answering a different question. No single test tells you the loop is clean.

Conductivity tells you the rinse is complete. Total organic carbon tells you the organic load is gone. Microbial counts tell you whether biofilm survived. A free iron check, such as a ferroxyl test on accessible surfaces, tells you whether the passive layer actually formed.

None of this is optional. The Ph. Eur. approach expects "in-process monitoring of the electrical conductivity, and regular monitoring of total organic carbon and microbial contamination." That wording is carried in the EMA's water guideline (EMA/CHMP/CVMP/QWP/496873/2018), in effect since 1 February 2021.

Then there is the paperwork. US GMP requires written cleaning procedures, and it sets a bar for how much detail they carry. They must give "a description in sufficient detail of the methods, equipment, and materials used in cleaning and maintenance operations" (21 CFR 211.67). An inspector should be able to redo the job from your protocol alone.

An Illustrative Example

The following scenario is fictional. It is an illustrative example, not a specific project.

A formulation plant in the Baddi belt notices microbial counts climbing in the last third of its WFI loop, always in the weeks after a shutdown. Sanitization is running to schedule and the counts still drift up.

Two things turn up. A sample valve branch is longer than the loop diameter allows, so it never sees full flow. And the return leg shows a light reddish film consistent with Class I rouge.

A stronger sanitizer is not the fix. What works is a chemical clean, a derouge, a passivation pass with the four parameters written down, and a change to the sample point so the branch drains. The counts settle only once the design fault is corrected. No chemical alone was ever going to solve that part.

How Often Should the Full Sequence Run?

There is no standard interval. Any supplier who quotes one without seeing your data is guessing. WHO ties sanitization frequency to risk management and to the data you gathered when the system was qualified. The same logic applies to chemical cleaning.

In practice, three things end up setting the interval:

1. Your own trend data. Rising counts or TOC between cycles is the signal.
2. System events. After a major modification, weld repair or long shutdown, treat the loop as new.
3. Audit timing. Plants working towards a USFDA or WHO-GMP inspection generally want a documented clean and passivation well before the window opens.

If your trends are flat and your microbial counts sit steady between cycles, you are probably on the right interval already.

Our inspection and monitoring work usually starts by reading a plant's own trend data, because that is what tells you whether the problem is chemistry, schedule or design. Talk to our team if you want a second opinion on a loop that keeps drifting.

Frequently Asked Questions