This is a ready-to-use periodic checklist for the live data path feeding a digital twin. A twin trusts its inputs; a drifting sensor, a misaligned clock, or a silently substituted missing value produces a confident wrong prediction with no flag anywhere in the twin’s own output. This checklist is different from the performance monitoring log: the log compares the twin’s prediction against the actual outcome, while this checklist examines the inputs themselves, independent of whether the prediction happened to be right that day. Run it at the frequency set by the twin’s risk class. Replace every <<FILL: ...>> placeholder with your own specifics. A filled specimen follows.
Checklist control
| Field | Entry |
|---|---|
| Checklist title | Digital Twin Live Data Path and Input Fidelity |
| Document number | <<FILL: CHK-ID, e.g. CHK-TWIN-019>> |
| Twin name / ID | <<FILL>> |
| Review period | <<FILL: from date>> to <<FILL: to date>> |
| Frequency (set by risk class) | <<FILL: e.g. weekly for advisory/closed-loop, monthly for monitoring-only>> |
| Performed by | <<FILL>> |
Checklist
Score each item Pass, Fail, or N/A, and record evidence for every Fail.
| # | Item | Pass / Fail / NA | Evidence / notes |
|---|---|---|---|
| 1 | Every sensor feeding the twin is within its current calibration interval | <<FILL>> | <<FILL>> |
| 2 | Raw signal from each input is physically plausible for the period reviewed (no stuck values, no implausible spikes) | <<FILL>> | <<FILL>> |
| 3 | System clocks for every data source feeding the twin are synchronized within the defined tolerance | <<FILL>> | <<FILL>> |
| 4 | No unexplained latency between a source reading and its arrival at the twin | <<FILL>> | <<FILL>> |
| 5 | The specified handling for missing data (flag, not silent substitution) was followed for any gap in the period | <<FILL>> | <<FILL>> |
| 6 | The specified handling for out-of-range or implausible data was followed for any occurrence in the period | <<FILL>> | <<FILL>> |
| 7 | No input value was silently carried forward or defaulted without a corresponding flag in the twin’s output | <<FILL>> | <<FILL>> |
| 8 | Data lineage from sensor to twin to displayed output is traceable for a sample of predictions this period | <<FILL>> | <<FILL>> |
| 9 | The displayed output was correctly bound to the intended batch or interval for the sample checked | <<FILL>> | <<FILL>> |
| 10 | Any new or changed data source in the period went through the change-control procedure before being trusted | <<FILL>> | <<FILL>> |
| 11 | Audit trail for the data path (configuration, source changes) is enabled, complete, and reviewed for the period | <<FILL>> | <<FILL>> |
| 12 | Access to the data path and the twin’s configuration is limited to the roles authorized for it | <<FILL>> | <<FILL>> |
Scoring and disposition
| Result | Disposition |
|---|---|
| All items Pass or NA | Data path is fit for the twin’s continued GxP use; file the checklist |
| One or more Fail, none affecting the current period’s decisions | Open a corrective action; twin may continue in use with the finding tracked |
| A Fail that could have affected a decision already made | Open a deviation, notify QA the same day, assess whether the discrepancy investigation form is warranted for the affected batch(es) |
References
ALCOA+ data-integrity principles (attributable, legible, contemporaneous, original, accurate, plus complete, consistent, enduring, available). 21 CFR Part 11; EU GMP Annex 11 (Computerised Systems, in-force 2011 version). ICH Q9(R1), Quality Risk Management (for setting the review frequency by risk class).
Confirm the current version of each reference before issue.
Filled specimen
The following shows the checklist completed for the titer soft-sensor twin used in the paired article’s worked example, so you can see the expected detail. The values are illustrative.
| # | Item | Pass / Fail / NA | Evidence / notes |
|---|---|---|---|
| 1 | Sensors within calibration | Pass | Probe cal due 15-Nov-2026, current |
| 2 | Raw signal plausible | Pass | No stuck values or spikes in weekly trend review |
| 3 | Clocks synchronized | Pass | NTP sync log shows all sources within 200ms |
| 4 | No unexplained latency | Pass | Max observed latency 1.2s, within the 5s tolerance |
| 5 | Missing-data handling followed | Fail | One 4-minute gap on 09-Sep-2026 was carried forward without a flag; corrective action opened |
| 6 | Out-of-range handling followed | Pass | No out-of-range occurrences this period |
| 7 | No silent defaulting | Fail | Same event as item 5 |
| 8 | Lineage traceable | Pass | Sample of 3 predictions traced sensor to output successfully |
| 9 | Output bound to correct batch | Pass | Sample of 3 confirmed |
| 10 | New/changed sources went through change control | NA | No source changes this period |
| 11 | Audit trail complete and reviewed | Pass | Reviewed per SOP-QA-014 for this window |
| 12 | Access appropriately limited | Pass | Access list matches the authorized role list |
Disposition: two related Fails (items 5 and 7), same event, one gap silently carried forward instead of flagged. No batch decision was affected, because the gap fell outside the harvest-decision window for the batch in question, confirmed and documented. Corrective action opened against the missing-data handling logic itself, not just the one occurrence, since a logic gap will recur until fixed.
Common inspection findings this checklist prevents
- A twin’s inputs never checked independently of the twin’s own output, so a degrading sensor was invisible until it caused a large enough prediction error to trip the monitoring log.
- Missing or out-of-range data silently defaulted or carried forward with no flag, contrary to the specified handling, and nobody checking whether the specification was actually followed.
- Data lineage assumed but never actually traced, so a questioned prediction could not be reconstructed.
- Access to the data path or the twin’s configuration broader than the roles that need it, with no periodic check.
How to adapt this checklist
- Set the frequency from the twin’s risk class in the intended-use and risk classification record; do not use one fixed cadence for every twin regardless of risk.
- Where item 5 or 7 fails, treat it as a data-path defect to fix, not a one-off exception to note and move past.
- Feed a Fail that could have affected a decision into the discrepancy investigation form for the affected batch, and into the change-control procedure if the fix changes the data path’s configuration.
- Confirm every standard in the references against the current published version before issue.