Dairy Establishment Inspection Manual – Chapter 14 - Aseptic Processing and Packaging Systems

This page is part of the Guidance Document Repository (GDR).

Looking for related documents?
Search for related documents in the Guidance Document Repository

Contents

Codex defines aseptic processing and packaging (APPS) as the processing and packaging of a commercially sterile product into sterilized containers followed by hermetically sealing with a sterilized closure in a manner which prevents viable microbiological recontamination of the sterile product. For dairy applications, this process uses temperatures above the boiling point for a very short period of time to sterilize milk products. It must be followed by an aseptic packaging step to give a shelf-stable commercially sterile product as per Food and Drugs Regulations. The processing and filling steps have a number of variables that are controlled by design specification (the scheduled process).

1.14.01 APPS Flow Schematic

The APPS, although similar to a high temperature short time (HTST) pasteurizer, operates at higher temperatures and pressures. It also uses steam seals and other means to ensure a commercially sterile product. Because of the importance of maintaining sterility in the system, and the number of factors involved, any changes made to the processing system must be done with the full involvement of the qualified Process Authority responsible for the scheduled process. Even slight modifications made to the aseptic processing and packaging system may have an impact on its operation and safety.

This task will evaluate the flow schematic of the aseptic processing and packaging system, aseptic storage tank, associated piping/components and aseptic packaging (i.e. from the constant level tank to packaging).

1.14.01.01 Flow Schematic [Process and Instrumentation Diagram (P&ID)]

Plant management must have a flow schematic outlining the APPS system which is maintained and kept in the plant's file. When equipment and/or pipelines are installed or changed, plant management must ensure that the flow schematic is updated. All components of the aseptic processing and packaging system (e.g. constant level tank, feed pump, regeneration system, pressure differential recorder-controller, flow control device, heat exchangers, thermometers, holding tube, Safety Thermal Limit Recorder (STLR), flow diversion device, aseptic barriers, aseptic packaging etc.) must be on the flow schematic.

1.14.01.02 No Cross Connections

A cross connection is a direct connection allowing one material to contaminate another. There needs to be a complete segregation of incompatible products such as raw materials and pasteurized or sterilized food products, cleaning products and food products, and waste materials or utility materials and food products, as outlined under task 1.10.01.02 of Chapter 10. Consideration also needs to be given to preventing inadvertent cross contamination of independent food products (e.g. soy beverages and milk) which may pose allergenic concerns.

Segregation of incompatible products must be accomplished by the use of separate pipelines and vessels for incompatible products, and establishing effective physical breaks at connection points. The installation of segregating valves for the purpose of separating cleaning solutions from food products does not constitute a physical break and is not acceptable, except that a properly designed valve arrangement (raw side) meeting the requirements of or a properly designed aseptic barrier (sterilized side) may be used (e.g. while cleaning the packaging line and/or surge tank while processing product). A properly designed aseptic barrier could, for example include one or more steam blocks, with a temperature sensor alarm to indicate barrier failure due to leaks or loss of steam.

Attention must also be paid to the design of the constant level tank and piping, and the product divert device, as these are areas where potential cross-connections could exist if the design or installation is improper. Tasks 1.4.03.04 and 1.14.09.01 to 1.14.09.05 of Chapter 14 provide more details for the evaluation of these tasks.

A physical verification by the inspector must be done to check the accuracy of the schematic and to ensure that no cross connections exist. Even if the plant does not have a schematic on file, an assessment for cross connections must be completed on the aseptic processing and packaging system.

1.14.02 Scheduled Process

The scheduled process means all the conditions needed to achieve and maintain commercial sterility of equipment (processing and packaging), containers and products.

1.14.02.01 Scheduled Process

The scheduled process is developed and documented by a qualified Process Authority who has scientific knowledge and experience in this field. The documentation required to validate the process covers the scientific basis for selecting certain specifications and requirements, calculations used to derive numerical values for the specifications, a review of applicable regulations and guidelines, and a descriptive commentary on what equipment and controls are being used and why. The combinations of variations encountered in commercial production are to be accounted for in the process, and critical factors that may affect the achievement of commercial sterility need to be specified. To achieve commercial sterility, Health Canada requires that the process be designed to meet a Fo = 3.0 as a minimum. See Appendix 19 - 14 for an explanation of Fo value.

If the process is designed to meet commercial sterility as per the Food and Drug Regulations B.27.001 but does not meet a minimum Fo = 3.0, a submission must be made to Health Canada to request an evaluation of the process to determine its acceptability.

Testing procedures and operator instructions are to be included in the process documentation.

Upon initial commissioning of the processing unit or after significant alterations have been made to the system or scheduled process, incubation trials and analysis must be used to confirm that the process is valid.

Any changes to an aseptic processing and packaging system must be assessed by the qualified authority as to the potential impact they will have on the system, so as to maintain the safety of the product.

1.14.02.02 Operating Instructions

Detailed operating instructions are to be made available to the operator, to ensure that the process is operated according to the design of the scheduled process. These instructions must include procedures for monitoring for critical factors during pre-sterilizing at start-up, and during production, and what to do if the critical factor limits are not met (process deviation procedures).

A process deviation occurs whenever any process is less than the scheduled process or when critical factors are outside of specified limits.

1.14.02.03 Critical Factor Adherence

The critical factors are those factors specified in the scheduled process as being necessary for the achievement of commercial sterility in the product. The inspector must review the scheduled process to see what critical factors were established. If during on-site observation, any of these critical factors are not within the limits documented in the schedule process, this is a process deviation and the product cannot be considered commercially sterile. The affected product must be placed under detention pending a thorough and documented investigation. The results of the investigation must be reviewed by a competent process authority. Prior to the release of any affected product, the process authority must authorize in writing that the results of the investigation scientifically demonstrate that the product is commercially sterile.

The process authority must be able to provide the appropriate evidence obtained through documented sterility trials that the product is commercially sterile. If the scientifically derived evidence to support the out-of-limit critical factor does not exist, the process authority cannot authorize the release of the product until such evidence is obtained. The lack of spoilage in incubated samples is not, by itself, indicative of commercially sterility but rather only indicates that other problems do not exist (e.g. low level container closure failure).

1.14.02.04 Critical Factor Records

The processing records must contain all the required information and indicate if the products were processed within the acceptable limits for the critical factors (no process deviations). Process deviations require detailed documentation in the plant's deviation log book and/or a separate file for follow up by the plant management to determine the cause and corrective action for the deviation and to ensure any compromised product is properly identified and handled to prevent distribution or sale.

Process deviation records must include date and time of the process deviation, amount of product involved, product quarantine and release of affected product, investigation into the cause of the process deviation (e.g. equipment breakdown, power failure, low temperature at outlet of holding tube), the action taken (e.g. line cleared, repairs performed, system re-sterilized) and review by appropriate company personnel.

Recording charts are part of the critical factor records. This information must be recorded in ink to provide a permanent record. Since this information provides a processing record, it will assist the plant in tracking down quality and safety problems and help prevent recall of their products. All production records must be reviewed on a timely basis by a member of plant management. Any operator's notes concerning unusual occurrences must be evaluated by plant management to ensure that a critical process parameter was not violated (i.e. that an unusual occurrence was not in fact a process deviation requiring product quarantine).

  1. All recording charts for aseptic processing and packaging systems shall provide the following data on every chart. (If operations extend beyond 12 hours, a 24-hour chart can be used if it can provide an equivalent level of accuracy and clarity to a 12-hour chart):
    1. Plant name and address or registration number
    2. Date, shift and batch number where applicable
    3. Recorder unit identification when more than one is used
    4. Product type and amount of product processed (may be recorded in production records)
    5. Identification of sterilization cycles (e.g. indicate when water or product being run)
    6. Identification of Clean in place (CIP), mini-wash (if used)
    7. Unusual occurrences and operator comments
    8. Signature or initials of the operators
    9. No overlapping of chart pen markings
  2. For the Safety Thermal Limit Recorder (STLR):
    1. Reading of the official indicating thermometer during processing. This reading must never be lower than the recording thermometer reading
    2. Record of time the flow diversion device (FDD) is in the forward flow position, as indicated by the event pen
    3. Recording thermometer tracing
    4. Set point tracing, when multiple set points are used
    5. All of 1. above
  3. For systems equipped with a Meter Based Timing System (MBTS):
    1. Synchronized time with STLR chart
    2. Record of time the flow alarm is activated, as indicated by an event pen
    3. Flow rate tracing
    4. All of 1. above
  4. For the pressure differential controller-recorder:
    1. Synchronized time with STLR chart; Electronic data collection, storage and reporting of pressure differentials, with or without hard copy printouts, may be acceptable provided the electronically generated records are readily available at the establishment for review by the regulatory agency and meet minimum criteria required for STLR charts
    2. Raw product or media side pressure tracing
    3. Sterilized product side pressure tracing
    4. In lieu of b) and c) above, the pressure differential recording between b) and c)
    5. All of 1. above
  5. For the pressure limit recorder:
    1. Synchronized time with STLR chart; Electronic data collection, storage and reporting of pressure limit in the holding tube, with or without hard copy printouts, may be acceptable provided the electronically generated records are readily available at the establishment for review by the regulatory agency and meet minimum criteria required for STLR charts
    2. Holding tube operation pressure
    3. All of 1. above
  6. For the aseptic surge tank(s):
    1. Record of the tank sterilization cycle (time and temperature); as determined by the process authority in the scheduled process
    2. Record of pressure applied to the sterile surge tank during aseptic filling operations as determined by the process authority in the scheduled process
    3. All of 1. above; Electronic data collection, storage and reporting of the surge tank's sterilization cycle (time and temperature) and pressure during aseptic filling of product, with or without hard copy printouts, may be acceptable provided the electronically generated records are readily available at the establishment for review by the regulatory agency and meet minimum criteria required for STLR charts.
  7. For optional additional temperature recorders/controllers on the system:
    1. Synchronized time with STLR chart
    2. Recording thermometer tracing
    3. All of 1. above; note especially the identification of sterilization cycles
  8. All pertinent processing records should be retained as part of the quality assurance program. These records will assist the plant and regulatory agencies to determine if the products are considered commercially sterile. The time-frame for retention is as follows:
    1. Three years minimum, or the shelf life of the product (if more than 3 years)
    2. As determined by the responsible regulatory agency

1.14.03 Constant Level Tank (CLT)

The constant level tank (CLT) is a reservoir for supply, at atmospheric pressure, of raw product to the sterilizer to permit continuous operation of the aseptic processing and packaging system. The constant level tank is located at the start of the APPS system. The constant level tank controls the milk level and provides a uniform head pressure to the product leaving the tank.

1.14.03.01 General Conditions

The tank shall be constructed of stainless steel and be in good mechanical and sanitary condition. The tank's design features will be assessed under the subsequent tasks.

1.14.03.02 Design

The tank shall be of such design and capacity that air shall not be drawn in the system with the product when operating at the maximum sealed capacity of the flow control device. The constant level tank shall therefore be fabricated so that the raw product will drain to the outlet before the outlet becomes uncovered. One method of complying with this requirement is to have the bottom of the tank pitched to the outlet at a minimum downward slope of at least 2% (0.2 cm per 10 cm) and the top of the outlet pipe lower than the lowest point in the tank (see Appendix 19 - 3).

1.14.03.03 Cover

The tank shall be fitted with a removable cover, or an inspection port with a removable cover, of suitable design to maintain atmospheric pressure and to minimize the risk of contamination. The cover shall be pitched to an outside edge to provide drainage. All openings in the cover shall be flanged upwards and covered. Pipelines entering through the cover (excluding directly clamped lines) shall be fitted with a sanitary umbrella deflector that overlaps the edges of the opening and is located as close to the tank cover as practical. The cover shall be used during processing.

1.14.03.04 Airspace and Overflow

Any product divert lines, recycle lines and water lines coming into the constant level tank (CLT) must be installed in a way that prevents the siphoning of raw milk or cleaning products into finished product or potable water lines (a cross connection). This is accomplished by having an overflow outlet at least twice the diameter of the largest inlet to the constant level tank, and ensuring that the divert, recycle, water lines terminate and break to atmosphere at least two times the diameter of the largest inlet above the maximum overflow point of the CLT

1.14.03.05 Level Control Device

This device is required to control the flow of milk to the constant level tank and therefore provide constant head pressure to the product leaving the tank.

The constant level tank shall be equipped with an automatic device of sanitary design and construction to control the raw product level.

1.14.04 Feed Pump

The feed pump is used to improve flow through the raw regenerator, and to supply the flow control device with milk from the constant level tank to prevent starving, especially if the flow control device is a homogenizer. It also helps to remove negative pressure and subsequent flashing or vaporization in the raw regenerator section. In aseptic processing and packaging systems, the feed pump normally operates in both forward and divert flow, as long as the flow control device is in operation.

1.14.04.01 General Conditions

A feed pump must be of sanitary design. The pump must be clean and in good mechanical condition.

The raw product side of the regenerator may be by-passed at start up. Entrapment of the product in the by-pass line during periods when the feed pump is in operation shall be precluded by:

  1. Close-coupled by-pass connections (i.e. as close as possible: approximately 2.5 times the pipe diameter).
  2. Design of the manually or automatically controlled valve which will permit a slight movement of product through the by-pass line
  3. Other equally effective system

1.14.04.02 Location

The feed pump shall be located between the constant level tank and the inlet to the raw product side of the regenerator.

1.14.04.03 Inter-wiring

Where a feed pump is used a pressure differential controller-recorder is required and shall be inter-wired in such a way that it can only operate when the flow control device is allowed to run; i.e. the FCD has been turned on by the operator or operating system and safety interlocks that may be installed on the aseptic processing and packaging system are not preventing the FCD from operating.

1.14.05 Regeneration

The regenerator section on aseptic systems may either be of milk-to-milk or milk-to-heat transfer medium-to-milk type. The cold raw product is warmed by hot sterilized product flowing in a counter current direction on the opposite sides of thin stainless steel plates or tubes. The sterilized product will in turn, be partially cooled.

The basic requirements for the regeneration section are:

  1. That it is installed and operated in such a way that the proper pressure relationship exists between the raw product or media and sterilized product in forward and divert flow conditions
  2. Proper sanitary design and construction
  3. Clean and in good condition, with no cracks, pinholes or leaks

1.14.05.01 General Conditions

Since the physical distance between the various liquids in the sterilization plates or tubes is extremely small, the liquids have the potential to move through the plates or tubes and cross-contaminate the product if pin holes, cracks or leaks exist.

The plates or tubes shall be of sanitary design, constructed of stainless steel or other corrosion resistant material, and must be without pin holes, cracks or leaks. The plates or tubes must be clean with no presence of milk remnants, milk-stone, mineral scale build-up, or foreign materials. If plates are used, the plate gaskets must be equipped with leakage grooves and must not be compressed or otherwise show signs of wear.

A routine program to monitor the condition of plates and tubes (pin holes, gasket condition, cracks, etc.) must be established by plants, taking into consideration the design specifications, operating conditions and hours of operation, wear and the history of the plates and gaskets. The integrity of all food contact heat exchange surfaces must be checked at least once per year by an acceptable method (e.g. dye recirculation, dye check, pressure retention, Helium Testing etc.). However, if the plant has experienced problems with heat exchanger integrity (plate or gasket issues), a more frequent inspection program must be implemented to verify that the problem has been remedied. Appropriate records must be kept to show proper testing has occurred. These records should also document the cause of any failure (e.g. age, compression, metal fatigue, etc.). If pin holes are found in any plate in any section then all plates in the same section should be checked.

1.14.05.02 Pressure Differentials

This task will only assess the differential pressure. The equipment used to monitor pressure (PDC recorder and gauges) will be assessed under the task Pressure differential recorder controllers (PDC recorder).

As previously discussed, raw milk or media and sterilized milk are separated in the regenerator section only by thin metal plates or tubes and a system of gaskets. In milk-to-milk type regenerators, the raw side of the regenerator must, at all times, be under lower pressure (at least 14 kPa or 2 psi) than the sterilized milk.

In milk-to-heat transfer medium-to-milk type regenerators, the sterilized milk section must be under greater pressure by at least 14 kPa (2 psi) than the heat transfer medium at all times. The protection is on the sterilized milk side of the system and is engineered to allow sterilized product to leak into the heat transfer medium in case of regenerator plate (or tubular) failures. In this type of system, the heat transfer medium (e.g. hot water) must be from a safe source. Locations of the pressure sensors for these controls are a) at the heat transfer medium inlet on the aseptic side of the regenerator and, b) at the sterilized product outlet of the regenerator. Failure to maintain the required pressure differential in the sterilized milk section of the regenerator shall cause the FDD to assume the divert flow position.

1.14.06 Flow Control Device

This task governs the uniform rate of flow through the holding tube so that every particle of product is held for the required period of time, as specified in the scheduled process. This device is a positive displacement type pump or homogenizer. Other equally effective mechanisms such as a Meter Based Timing System (MBTS) with proper components (centrifugal pump, flow control device or variable speed motor, meter head, relays, alarms and flow recorder-controller, etc.) may also be used as a flow control device. Refer to Appendix 19 - 4 for more information on MBTS.

1.14.06.01 General Conditions

The flow control device must be constructed of stainless steel and be in good mechanical and sanitary condition. The driving mechanism shall be designed so that in the case of wear, belt stretch, etc. the capacity will not increase. The flow control device cannot be excluded from the system during operation of the aseptic processing and packaging system. The device must be located upstream from the holding tube and normally it is located between the outlet of the raw regeneration section and the inlet of the heating section of the aseptic processing and packaging system.

1.14.06.02 Set and Sealed

The maximum operating capacity of the flow control device shall be set to ensure an appropriate flow rate to give the proper holding time, in accordance with the calculations done in the scheduled process, as evaluated under task 1.14.08.03 Holding Verification and Records.

When homogenizers are located within the aseptic system, flow rate evaluations shall be made with these pieces of equipment operating (with no valve pressure on the homogenizer) and by-passed to determine the fastest flow rate (minimum holding time). When flow promoters are located downstream from the flow control device, the flow rate shall be determined with the flow control device operating at maximum capacity, and the flow promoters in operation.

If maximum speed gives legal holding time a seal is not necessary. If the device is of the variable speed type or a single speed capable of being altered with different belts and pulleys, it must be sealed at an established flow rate to prevent operation at a greater capacity than that which gives the proper holding time. Alarm settings determining the flow diversion set points on magnetic flowmeter systems must also be sealed.

Any change in the line resistance of the system after maximum speed of the pump has been set, will alter the flow rate and corresponding hold time. Increasing the line resistance by the addition of plates or piping will decrease the flow rate, increasing holding time. This increase in flow resistance in effect reduces the efficiency of the sterilizer. Decreasing the line resistance by the removal of plates, pipes, or auxiliary units will increase the flow rate, decreasing the holding time. Wear of the drive belts and pump impellers due to normal operation will gradually decrease the rate of flow through the system, thereby increasing the holding time.

The flow control device is to be evaluated and sealed (if necessary) upon installation and annually thereafter, and in addition, whenever the seal on speed setting is broken, whenever any alteration is made affecting the holding time, the velocity of the flow (such addition or removal in the number of plates, pipes or auxiliary units) or the capacity of the holding tube or whenever a check of the capacity indicates a speed up. Records of alteration and re-evaluation of the system must be kept in the plant's file.

1.14.06.03 Fail Safe Capability

There must not be a by-pass (recirculation line) around the flow control device during processing. A by-pass may be present for CIP purposes, but must be dismantled and removed during processing. To ensure that no by-pass is present during processing a proximity switch should be utilized so that the FDD will not operate in forward flow.

A Meter Based Timing System must have the appropriate controls and instrumentation in place, as outlined in Appendix 19 - 4. When a Meter Based Timing System replaces the positive displacement flow control device, it must be evaluated upon installation and at least once every 6 months thereafter, whenever seal on the flow alarm is broken, whenever any alteration is made affecting the holding time, the velocity of the flow or the capacity of the holding tube or whenever a check of the capacity indicates a speed-up. Appropriate records must be kept to show proper testing has occurred.

1.14.07 Heating Section

The heating section of the aseptic system provides rapid, uniform and controlled heating of the product up to sterilization temperature. The raw product is usually forced through this section by the flow control device. Heating may be by direct injection or infusion of steam, or indirect heating through tubes, plates, or scraped-surface heat exchangers.

1.14.07.01 General Conditions

For indirect heating, the heating equipment shall be clean and in good condition. It shall be of sanitary design, and constructed of stainless steel or other corrosion resistant material. During operation, the heating section must not leak at gaskets, seals, joints or connections.

With direct heating, it must be noted that the steam injection process is an inherently unstable process. When steam is injected into a fluid, condensation of the steam may not be completed inside the injector unless proper design criteria are satisfied. Lack of complete condensation would cause temperature variations in the holding tube that could lead to some milk particles being processed below the required temperature. Appendix 19 - 15 shows steam injectors from several manufacturers that have been shown to be satisfactory for use in steam injection systems

1.14.07.02 Heating Medium

Steam used as a heating medium shall be free of harmful substances or extraneous matter. Only culinary steam may be used for direct steam injection or infusion (see Appendix 19 - 1).

Steam should be as free as possible from non-condensable gases. Any vapours in the holding tube would displace product, resulting in shorter holding times. A de-aerator installed on the boiler will aid in keeping the holding tube free of non-condensable gases.

Boiler and water treatment chemicals and other additives used must be dairy safe and approved for dairy plant purposes.

1.14.07.03 Pressure Limit Recorder Controllers

For both direct and indirect heating systems, product pressures in the holding tube and across the steam injector must be monitored and controlled to keep the product in a liquid phase and to ensure adequate isolation of the injection chamber.

  1. A pressure limit recorder controller must be in systems that are capable of operating with less than 518 kPa (75 psi) pressure in the holding tube. This instrument is used to monitor product pressure in the holding tube. This instrument has a pressure switch that causes the FDD to move to the divert position if the product pressure falls below a prescribed value, e.g. if the operating temperature is 100°C (212°F), the pressure switch must be set at 69 kPa (10 psi); If the operating temperature is 116°C (240°F), the switch must be set at 140 kPa (20 psi). The pressure switch settings are determined during the set up and testing procedures (See Test 30 in Chapter 18 – Critical Process Test Procedures). Appendix 19 - 16 shows the pressure switch settings for corresponding operating temperatures.
  2. On direct heating systems with steam injection only, a differential pressure limit indicator is needed to ensure adequate isolation (supplementary orifices) of the injection chamber so that product is uniformly heated in the chamber. This instrument must have a differential pressure switch so that the FDD will move to the divert position if the pressure drop across the injectors is below 69 kPa (10 psi).

Records shall indicate the holding tube operational pressures, the pressure switch settings, the results of required tests, and satisfactory follow up on out of specification findings.

1.14.07.04 Controllers/ Settings Sealed

Once the required tests have been completed, the controllers and settings must be sealed to prevent unauthorized adjustments.

1.14.07.05 Ratio Controller (Direct Heating Systems)

A ratio controller is required for systems applying direct heat to product to prevent water adulteration of the product being processed. The ratio controller is interlocked with the vacuum pump and/or steam controller and automatically monitors and controls the amount of vacuum applied and/or the amount of steam injected. This is accomplished by constantly monitoring the product temperatures at the inlet and outlet of the vacuum chamber.

One sensor is located immediately prior to the point of steam injection (incoming product), and the other is located immediately after the product exits the vacuum chamber (outgoing product). The optimum temperature differential between the incoming and outgoing product shall be determined by total solids analysis and such differential set on the ratio controller. The ratio controller automatically controls the pre-heat steam supply or the flash chamber vacuum to prevent water adulteration of the product.

When a water feed line is connected to a vacuum condenser, and the vacuum chamber is not physically separated from the vacuum condenser, satisfactory methods must be installed to prevent adulteration of the product with water in the condenser.

1.14.08 Holding

This is the part of the aseptic processing and packaging system in which heated product is held for the specified time required in the scheduled process. This section is located after the final heating section of the Aseptic system, and may include the sensing chamber at the end. The sensing chamber is that portion which houses both the official indicating thermometer and the STLR hot milk temperature sensors.

1.14.08.01 General Conditions

The holding tube and all connections shall be of sanitary design and construction, and shall be clean and in good mechanical condition.

The holding section shall be located after the FCD with no intervening flow promoters, and after the final heating section, but before the FDD or any cooling section.

No device shall be permitted for short circuiting a portion of the tube or for the removal of a section of the tube such that the holding time is reduced below that specified by the scheduled process. No portion of the holding section between the inlet and the sensing chamber shall be heated.

1.14.08.02 Slope and Support

When the holding section is comprised of a holding tube, it is required to have a continuous upward slope (including elbows) of at least 2% (2 cm per 100 cm). The slope is required to eliminate any air entrapment in the holding tube, which would displace product and reduce the holding time. To prevent variance in the slope, the holding tube shall be permanently fixed by mechanical supports.

1.14.08.03 Holding Verification and Records

The holding time is determined by calculation, and is specified in the scheduled process. The calculations must include the extra condensate volume from steam added, if direct heating from steam is used. Results determined will dictate the length of the holding tube needed to provide the proper holding time, based on the flow rate used.

The actual length of the holding tube installed may be compared to the measurement determined by calculation in the scheduled process. Records shall indicate the measured flow rate of the system under the conditions outlined in Task 1.14.06.02 Set and Sealed. This measured value must be the same or lower than the value used in the calculation for the scheduled process.

Re-calculation of the holding tube length may be necessary if changes are made to the system that could alter the flow rate, or if the process itself is changed in any manner.

Verification of proper holding tube length and flow rate shall be done upon installation, annually, or whenever the seal on the FCD is broken, and after any change is made to the system that could affect the holding time. The appropriate records shall be kept on the plant's file, including all supporting calculations.

Product pressures in the holding tube shall be monitored as per task 1.14.07.03 - Pressure Limit Recorder Controllers.

1.14.09 Flow Diversion Device (FDD)

The FDD is set up to control the direction of product flow according to the establishment of safe conditions within the processing system. It is located after the cooling section and before the filler or aseptic surge tank, and is designed to divert flow away from the filler or aseptic surge tank automatically.

1.14.09.01 General Conditions

The FDD must be of a design that permits sterile operations, and that can positively and effectively prevent potentially unsterilized product from contaminating the fillers or aseptic surge tank(s). Since there are many possible valve designs, numbers and arrangements, acceptance should be determined by the responsible agency.

FDDs must be equipped with a proper control panel where the control functions and relays are installed. This control panel may be part of a universal panel unit. This panel shall be free of any device or switches that may override the control functions and jeopardize the safety of sterilized product. On valves that have external solenoids, the air lines must not have quick release couplings.

Installations on aseptic processing and packaging systems often have complex operating parameters for the FDD that can only be handled by a micro-processor or programmable logic controller (PLC). A PLC or micro-processor control used strictly for FDD function is not required to meet the standards of Task 1.14.11.07 Program Logic Controllers and Computers, but all valve functions must pass the required tests.

The FDD and the return lines shall be constructed of stainless steel and must be clean and in good mechanical condition. Valves, plunger seals and O-rings must also be clean and in good mechanical condition. Stem length of the valves shall be non-adjustable to insure that proper seating of the valves is not disturbed. If the stem has a threaded attachment, a locking pin or other equivalent locking mechanisms shall be used to prevent any misalignment. Air to the FDD must be clean and unrestricted.

1.14.09.02 Return Line

The FDD shall have a pipeline that directs the flow of potentially unsterile product safely away from fillers and /or aseptic surge tanks. Any subsequent valves installed on this line must be configured in all positions to allow free flow from the FDD, without blocking the flow or creating excessive back pressure on the FDD. A flash cooler may be installed on the return line to prevent injury to bystanders during divert events when pre-sterilizing the system.

1.14.09.03 Location

The FDD must be located after the final cooling section and before the fillers or aseptic surge tanks.

1.14.09.04 Fail Safe Divert Capability

The FDD shall automatically assume the divert position (so product will not go to aseptic surge tanks or fillers) under at least one of the following conditions for indirect heating systems:

  1. The product temperature in the sensing chamber drops below the specification in the scheduled process
  2. The differential pressure between sterilized product and unsterilized product or heat transfer media is less than 14 kPa (2 psi) in the regenerator
  3. Adequate product pressure is not maintained in the holding tube to prevent boiling (less than 69 kPa (10 psi) above the boiling pressure of the product in the holding tube)
  4. Loss of electrical power or compressed air to the FDD solenoids
  5. Excessive flow rate is detected for systems utilizing a magnetic flow meter as a flow control device
  6. Pressure in the surge tank drops below the value specified in the scheduled process, in systems where there is only one surge tank or no capability to send product directly to a filler (prevents sterile product from entering unsterile tank). Note: In systems where more than one surge tank exists, product would not need to be diverted but could be directed to the sterile surge tank

The FDD shall automatically assume the divert position (so product will not go to aseptic surge tanks or fillers) under at least one of the following conditions for direct heating systems:

  1. The product temperature in the holding tube drops below the specification in the scheduled process
  2. The differential pressure between sterilized product and unsterilized product or heat transfer media is less than 14 kPa (2 psi) in the regenerator
  3. Adequate product pressure is not maintained in the holding tube to prevent boiling (less than 69 kPa (10 psi) above the boiling pressure of the product in the holding tube)
  4. Loss of electrical power or compressed air to the FDD solenoids
  5. For steam infusion systems, loss of pre-determined parameters (temperature, pressure level, etc. as determined by the qualified authority) at the steam infusion chamber exits
  6. For steam injector systems, improper differential pressures across the steam injectors at the holding tube (a 69 kPa (10 psi) drop across the injector is required)
  7. Excessive flow rate is detected for systems utilizing a magnetic flow meter as a flow control device
  8. Pressure in the surge tank drops below the value specified in the scheduled process, in systems where there is only one surge tank or no capability to send product directly to a filler (prevents sterile product from entering unsterile tank). Note: In systems where more than one surge tank exists, product would not need to be diverted but could be directed to the sterile surge tank

The FDD shall be installed with position detection capabilities to provide an electrical signal to the STLR flow indicating lights and event pen.

After an event causing a flow diversion, all product contact surfaces downstream from the holding tube shall be re-sterilized, as outlined in the scheduled process (see also Task 1.14.11.04 Thermal Limit Controller Sequence Logic). The re-sterilization process must include the fillers and aseptic surge tanks, unless there is a properly designed aseptic barrier to act as a leakage barrier (see Task 1.14.09.05 Leak Detect and Appendix 19 - 10).

Plant records shall indicate the test results for valve operation at the required intervals and must show satisfactory follow-up on out of specification findings.

1.14.09.05 Leak Detect

Aseptic processing and packaging systems where the filler continues to operate from an aseptic surge tank while the FDD is in the divert position, must use a properly designed aseptic barrier to separate sterile product from potentially non-sterile product. (see Appendix 19 - 10).

The aseptic barrier shall be located between the FDD and the blocking valve for the aseptic surge tank.

The barrier(s) may include one or more steam blocks, but must include a resistance thermal device (RTD) or other acceptable temperature sensor at the lowest level of the barrier to detect barrier failure due to steam loss or fluid leakage into the barrier. Barrier failure detected by the temperature sensing device must trigger an alarm system to alert the operator to the alarm condition, immediately initiating a shut down sequence for the processing system as specified in the scheduled process.

After a barrier failure condition, the fillers, aseptic surge tanks and lines, and aseptic processing system must be completely drained of product and all equipment must be re-sterilized before processing and filling may resume. Implicated product should be placed on "hold" until its sterility is assessed. This failure must be noted in the operator's log book and a process deviation report must be completed, which includes the date and time of the process deviation, investigation into the cause of the process deviation and action taken both on product and other corrective measures.

1.14.09.06 Device/Panel Sealed

The FDD control panel and valve position detector cover(s) must be sealed to prevent unauthorized tampering or adjustments. The valve position sensing detectors, valve actuating solenoids and relays shall be sealed. If a PLC or micro-processor is used to control valve functions, access to programming functions shall be sealed.

1.14.10 Indicating Thermometer

The indicating thermometer provides the official processing temperature of the product, which is a critical factor in the scheduled process. This is to prevent situations where aseptic processing may be operated with a defective or damaged unit while waiting for a replacement thermometer.

1.14.10.01 General Conditions

This thermometer is required for all aseptic processing and packaging systems. It must be clean and in good operating condition. The thermometer shall be mercury actuated or an accepted equivalent, or an approved resistance thermal device (RTD).

Mercury actuated or accepted equivalent thermometers shall be direct reading, and contained in a corrosion resistant case which permits easy observation of column and scale. The filling above the mercury is to be nitrogen or equally suitable gas. The bulb shall be Corning normal or equivalent.

The RTD type must be fail-safe, utilizing two separate RTDs. It must meet the scale and thermometric response specifications. The criteria in Appendix 19 - 13 - Design Requirements for Digital Thermometers shall be used to evaluate RTDs when used as alternatives to mercury actuated direct reading thermometers.

1.14.10.02 Location/Accessibility

The official indicating thermometer shall be located in the sensing chamber, along with the probe for the STLR. The indicating thermometer probe should be located after the probe for the STLR. The distance between the 2 probes should not be more than 30 cm (12 inches). The indicating thermometer must be easily and safely accessible by the operator, to allow accurate reading of the processing temperature.

1.14.10.03 Specifications

The scale shall be graduated in 0.5°C (1°F) divisions with not more than 9.4°C (17°F) per 25 mm (1 inch) of graduated scale.

The stem fitting shall be pressure-tight against the inside wall of the fitting, with no threads exposed to product.

1.14.10.04 Calibration/Records

Records of tests performed to determine the thermometer's calibration shall be maintained in the plant's files. Tests must include temperature accuracy and thermometric response, upon installation and at an interval of at least every 6 months. The frequency of testing should be increased if the calibration is consistently found to be out of adjustment. If the calibration is consistently found to be out of adjustment, the reason for the calibration problems should be immediately identified and rectified.

Testing methods shall comply with the required standards, and must show satisfactory follow-up on out of specification findings. Plant management must investigate the safety of the product produced with out of calibration equipment (e.g. if the indicating thermometer at the outlet of the holding tube is reading higher than the calibration standard, the product may have been under processed).

1.14.10.05 Sealed

The access to calibration adjustments must be sealed once the thermometer has been calibrated. The cover or scale plate on mercury in glass (MiG) thermometers should have a seal attached to indicate tampering. The thermometer panel and the RTD sensor housing should be sealed on resistance thermal devices.

1.14.11 Safety Thermal Limit Recorder

The function of this device is to:

  1. Automatically record the temperature of the product in the sensing chamber on a chart that also indicates the time of day, and provides a record of the process
  2. Indicate and record the position of FDD (i.e. forward or divert flow)
  3. Supply a temperature cut out signal input to the thermal limit controller unit

The evaluation of this task could include the review of documents such as:

  1. Plant records
  2. Testing/calibration documents
  3. Scheduled process
  4. Ladder logic

1.14.11.01 General Conditions

The STLR must meet the criteria established by the manufacturer of the APPS systems (industry to supply). Units must be manufactured for STLR usage and any modifications must be performed by, or authorized by the manufacturer.

The STLR shall be housed in a case that is moisture-proof under normal operating conditions. The STLR must be maintained in good condition, and operated as specified by the manufacturer. Any covers preventing access to public health adjustments, such as the divert set-point, must be maintained in place.

The single probe which senses the temperature for both the temperature recording pen and the cut-in /cut-out control shall be installed with a pressure-tight seal against the inside wall of the pipe with no threads exposed to milk or milk products.

The STLR must be serviced at least once per year and maintained on a continual basis so that the instrument functions according to specifications. Records of service and maintenance must be available in the plant's files.

All switches on the STLR and any controls associated with the operation of the aseptic unit shall be clearly identified. There shall be no switches or devices that could jeopardize the safety of the product by by-passing or over riding any public health controls.

1.14.11.02 Location

The single probe which senses the temperature for both the temperature recording pen and the cut-out control shall be installed in the sensing chamber, before the indicating thermometer probe. The distance between the 2 probes should not be more than 30 cm (12 inches).

1.14.11.03 Specifications

A circular chart shall make one revolution in not more than 12 hours and shall be graduated for a maximum record of 12 hours. If operations extend beyond 12 hours, a 24-hour chart can be used if it can provide an equivalent level of accuracy and clarity.

The chart positive drive mechanism shall be equipped with a system to prevent slippage or manual rotation (e.g. pin to puncture the chart paper). The chart used shall correspond with the chart number displayed on the identification plate of the STLR

The chart graduations shall not exceed 1°C (2°F) within a range of 5.5°C (10°F) of the processing temperature. The chart temperature scale shall not exceed 30°C (55°F) per 25 mm (1 inch) within a range of 11°C (20°F) of the processing temperature.

The STLR must have a functioning temperature recording pen.

All units must also have a functioning frequency pen. This pen, also called the event or divert pen, records the position of the FDD with a line on the outer edge of the chart. The frequency pen is energized by a position detector in the FDD as the FDD moves into forward position. The frequency pen is de-energized during diverted flow and it moves down to indicate a divert. Some systems may be designed so that the event pen indicates the critical factors required to enable forward or diverted flow. In such cases, the event pen will be de-energized when at least one of those pre-determined critical factors is not met.

These two pens must track together or follow the same time line. On certain models, a reference arc is used to align these two pens.

If the STLR requires a third pen, as with a multiple temperature divert unit, this third pen cannot track with the other two. It must be adjusted to lead or follow the other pens by a specified time factor. This value shall be displayed on the STLR unit. This ink used in this set-point recording pen should be differentiated from the other two.

1.14.11.04 Thermal Limit Controller Sequence Logic

Since the FDD is located downstream from the cooling section on aseptic systems, forward flow can not occur until all product contact surfaces from the holding tube to the FDD have been held at or above the required system sterilization temperature for the time specified in the scheduled process.

The thermal limit controller unit utilizes a sequence of electrical inputs and timers to ensure the Aseptic processing and packaging system is sterilized before allowing the FDD to assume the forward flow position.

For indirect heating systems, forward flow commences only after sensors at the FDD and at the holding tube have reached the required temperature for the length of time specified for system sterilization as per the scheduled process.

In direct heating systems, forward flow may commence only after the sensors located at the holding tube, the coolest part of the vacuum chamber, and at the FDD have reached the required temperature for the time period specified for system sterilization as per the scheduled process.

This assures that all parts of the system have been properly sterilized before allowing the FDD to move into the forward flow position. Once the minimum times and temperatures have been satisfied for system sterilization, the two auxiliary controllers (see Task 1.14.13.01 (at the FDD, and at the vacuum chamber on direct heating systems) then drop out of the control loop, and the primary recorder-controller (STLR) at the holding tube outlet (sensing chamber) resumes its function for normal product processing temperature control.

Failure to meet any safe forward flow condition, such as temperature below cut out, improper regenerator pressure differential, improper holding tube pressure, loss of predetermined liquid levels at steam infusion chamber exits or loss of differential pressure across the injector, shall cause the FDD to immediately move into the divert flow position, unimpeded by the thermal limit controller unit.

After a diversion event, the FDD shall not resume forward flow until the system is re-sterilized and the thermal limit sequence logic is again satisfied.

The settings and adjustments for the thermal limit controller unit must be enclosed and sealed to prevent unauthorized tampering.

1.14.11.05 Calibration/Records

The performance accuracy of the STLR and thermal limit controller shall be performed upon installation, verified at least once every 6 months and whenever a seal has been broken. Records of tests to determine accuracy shall be maintained in the plant's files. Tests which should be performed include the following:

  1. Recorder temperature accuracy
  2. Recorder time accuracy
  3. Cut in/Cut out
  4. Thermal limit controller sequence logic
  5. Recording thermometer check against indicating thermometer: (Daily) The recording thermometer shall not read higher than the corresponding indicating thermometer. However, should the recording temperature differ from that of the indicating, necessary measures must be taken and documented to correct the situation.

1.14.11.06 Sealed

Access to STLR cut in/cut out adjustments shall be sealed. The sealing device should provide an indication of tampering or unauthorized adjustment.

The enclosure for the settings and adjustments for the thermal limit controller sequence logic must be sealed to prevent unauthorized adjustment.

1.14.11.07 Programmable Logic Controllers and Computers

Programmable logic controllers or computers installed on an aseptic processing and packaging system for operational convenience and not public health control must meet certain safeguards and tests. The computer may not control any public health function when the system is in processing mode. When in CIP mode, the computer may control any functions when CIP mode is first selected. Non-public health controls, such as product pumps or valves, may be controlled at any time by the computer. The vendor is responsible for providing a testing protocol to verify that public health safeguards are not under the control of the computer during the production cycle.

Computers for the operation of public health controls on aseptic processors have additional considerations. Computers are different from hard-wired controls in three major areas. To provide adequate public health protection, the design of computerized public health controls must address these three major differences.

First, unlike conventional hard-wired systems, which provide full-time monitoring of the public health controls, the computer performs its tasks sequentially, and the computer may be in real time contact with the FDD for only one millisecond. During the next 100 milliseconds (or however long it takes the computer to cycle once through its tasks), the FDD remains in forward flow, independent of temperature in the holding tube. Normally, this is not a problem because most computers can cycle through 100 steps in their program many times during one second. The problem occurs when the public health computer is directed away from its tasks by another computer, or the computer program is changed, or a seldom used jump, branch, or go to Instruction diverts the computer away from its public health control tasks.

Second, in a computerized system, the control logic is easily changed because the computer program is easily changed. A few keystrokes at the keyboard will completely change the control logic of the computer program. Conversely, hard-wired systems require tools and a technician to make wiring changes. Once the hard-wired system is properly installed and working, it does not change. The problem can be solved by sealing the I/O access to the computer, but some procedure is needed to ensure that the computer has the correct program installed when it is re-sealed.

Finally, some computer experts have stated that no computer program can be written error-free. They were referring primarily to very large programs, with many conditional jumps and branches, with thousands of lines of program code. For these large systems, the programs actually improve with age (the errors are found and corrected under actual conditions of use). For public health controls, the computer program must and can be made error-free, since the programs required for public health control are relatively brief.

If the design of computerized public health controls does address the above mentioned differences, they can be effectively interfaced with conventional hard-wired operating controls and instrumentation. When computers or programmable logic controllers are used in pasteurizing or sterilizing systems, they must be installed in such a manner that public health controls are not circumvented by the computer or programmable logic controller during the product run operations, except as provided for under Appendix 19 - 5 Criteria for the Evaluation of Computerized Public Health Controls.

The vendor is responsible for ensuring that their PLC or computer installation complies with the requirements of Appendix 19 - 5, through documentation and testing.

The responsible regulatory agency shall evaluate the complete documentation of interconnecting wiring, pneumatic controls, applicable programming logic and ladder logic, and results of the testing procedures. This will help to verify compliance with the criteria in Appendix 19 - 5.

1.14.12 Pressure Differential Recorder Controllers (PDC recorder)

Proper pressure relationships must exist across all media to prevent contamination of the sterilized product by raw product, heating medium and cooling medium. Pressure relationships under the following conditions must be considered:

  1. Forward flow
  2. Divert flow
  3. Shutdown

Proper pressure relationships must exist between raw milk or media and sterilized milk to prevent contamination of the sterilized product. In aseptic processing and packaging systems, failure to maintain a 14 kPa (2 psi) differential between the raw side of the regenerator and the sterilized side will cause the FDD to assume the divert position. The feed pump normally operates in both forward flow and divert flow, as long as the FCD is allowed to run. This is because the sterilized side of the regenerator and cooling section are always full, since the FDD is located after the cooling section. Aseptic systems require a pressure differential recorder to monitor and record pressures to ensure that proper pressure differential has been maintained in the regenerator.

This task will assess the actual pressure devices used. The appropriate pressure differential is assessed under Regeneration (1.14.05.02) and Cooling Section (1.14.14.02).

Tests are performed upon installation and at least once every 6 months thereafter. Appropriate records must be kept to show proper testing has occurred.

1.14.12.01 General Conditions

The sensors of pressure differential controllers must be clean and in good mechanical condition. The design should allow easily dismantling of the sensors for inspection, and the indicating / recording unit must be housed in an appropriate moisture proof enclosure.

The pressure differential recorder controller shall be inter-wired with FDD such that divert occurs when the sterilized product pressure in the regenerator is not exceeding, by 14 kPa (2 psi) or greater, the pressure on the raw side of the regenerator. It is considered acceptable to use a legal PLC to control the pressure differential in lieu of a pressure differential controller as long as the same control conditions are respected such as interwiring with FDD, pressure indicating and recording capabilities, set-point indication. 

In milk-to-heat transfer medium-to-milk type regenerators, in the sterilized milk section the heat transfer medium must be under lower pressure by at least 14 kPa (2 psi) than the sterilized milk at all times.

Pressure gauges may be used to verify the pressure display for the pressure differential recorder controller. Gauges shall be clean and in good condition.

1.14.12.02 Location

Two types of regeneration are used in aseptic systems, product-to-product regenerators, and product-to-water-to-product regeneration systems. The latter system is often preferred for some products, because it allows more even heat transfer and prevents burn-on.

Product-to-product regenerators shall have the raw product sensor between the feed pump and the raw product inlet to the regenerator. The sterilized product sensor shall be installed at, or downstream from, the sterilized product outlet of the regenerator.

Product-to-heat transfer medium-to-product regenerators shall have the raw side pressure sensor in the water loop after the water pump (location of highest media pressure in the loop). The sterilized side pressure sensor shall be in the product line at the sterilized side outlet of the regenerator (location of lowest sterilized product pressure).

1.14.12.03 Specifications

A circular chart shall make one revolution in not more than 12 hours and shall be graduated for a maximum record of 12 hours. If operations extend beyond 12 hours, a 24-hour chart can be used if it can provide an equivalent level of accuracy and clarity.

The chart positive drive mechanism shall be equipped with a system to prevent slippage or manual rotation (e.g. pin to puncture the chart paper). The chart used shall correspond with the chart number displayed on the identification plate of the pressure differential recorder controller.

The pressure recording unit shall have chart scale divisions not to exceed 14 kPa (2 psi) on the working scale of not more than 140 kPa (20 psi) per 25 mm (1 inch). Pens may be used to record the raw side pressure and the sterilized side pressure or the pressure differential.

Electronic data collection, storage and reporting of pressure differentials, with or without hard copy printouts, may be acceptable provided the electronically generated records are readily available at the establishment for review by the regulatory agency and meet minimum criteria required for STLR charts.

1.14.12.04 Calibration / Records

The accuracy of the pressure display and recorder, and the differential controller divert function, shall be validated at least every 6 months, and whenever the controller is adjusted or repaired. Pressure gauges, if used, must be checked for accuracy at least once per year.

Records shall be easily available, and must indicate testing results and satisfactory corrective action. Tests must be completed according to the required methods.

1.14.12.05 Sealed

The pressure differential recorder-controller adjustments/legal panel must be sealed.

1.14.13 Auxiliary Temperature Recorders/Controllers

These instruments may be used in several locations on the aseptic processing and packaging system, to provide a record of start up pre-sterilization and product processing temperature, and to provide temperature signals to the thermal limit controller unit or other processing controls. Two common installation points would be at the final heater outlet (to provide better feed back and control of the heating process), and at the inlet to the FDD (to provide a record and control of the pre-sterilization process).

1.14.13.01 General Conditions

The temperature recorder / controller unit shall be clean and in good mechanical condition. It should be moisture-proof under normal operating conditions. The chart positive drive mechanism shall be equipped with a system to prevent slippage and manual rotation (e.g. pin to puncture chart paper). It must also be equipped to produce a continuous permanent record of all pertinent information (i.e. time of day and temperature). The processor is responsible to indicate on the chart recorder the chart part number to be used. Pens should be operational and easily calibrated. The unit should be serviced at least once a year, and records of the servicing kept in the plant's file.

1.14.14 Cooling Section

This section of the sterilizer uses chilled water and /or glycol to cool the hot product down to packaging and filling temperature. Since the FDD is located downstream from this section, the cooling section may become contaminated with potentially unsterile product during divert, and must be re-sterilized as part of the thermal limit controller sequence logic after a divert event.

Flash coolers are sometimes installed on the divert line to prevent injury to by-standers if a divert event occurs during the re-sterilizing of the holding tube and cooling section, when there is no cooling turned on.

1.14.14.01 General Conditions

The cooling sections must be clean and in good condition. They must be constructed of stainless steel or other corrosion resistant and easily cleanable material. The design should allow easy cleaning, and should not entrap product in crevices, joints, seams or openings. During operation, there should not be any leaks at gaskets, seals, or connections.

A routine program to monitor the condition of plates and tubes (pin holes in plates, gasket condition, cracks, tube clamps, etc.) must be established by plants. The integrity of all food contact heat exchange surfaces must be checked at least once per year by an acceptable method (e.g. dye penetration, permanganate recirculation, pressure retention, Helium testing, etc.). However, if the plant has experienced problems with heat exchanger integrity, a more frequent inspection program must be implemented to verify that the problem has been remedied. Appropriate records must be kept to show proper testing has occurred. These records should also document the age of all the plates and which ones are replaced, the cause of the holes (e.g. age, compression, metal fatigue, etc.). If pin holes are found in any plate then all plates of the same age should be checked.

1.14.14.02 Pressure Differentials

This task will only assess the actual differential of pressure. The equipment used to monitor (gauges) will be assessed under Pressure Differential Controllers.

In the cooling section, the system must be designed to maintain pressure on the sterilized product side of the plates at least 14 kPa (2 psi) higher than on the cooling medium side of the plates during forward flow. During diverted flow conditions, higher pressure must be maintained on the sterilized product side of the plates than on the medium side of the plates. This reduces the possibility of chemical contamination in the event a pinhole leak develops in the plates.

An automated mechanism is the only way to achieve the correct pressure relationship in the cooling section during forward flow, divert and shutdown conditions so that the pressure on the sterilized product side is greater than the cooling media side.

Pressure gauges, if used, must be checked for accuracy upon installation and at least once per year. Gauges shall be clean and in good condition. Pressure differential controller sensors, and pressure gauges, shall be located at the cooling media inlet and at the sterilized product outlet.

1.14.14.03 Cooling Medium

Cooling medium (usually sweet water or water-glycol mixture) must be checked at least monthly for microorganisms (e.g., coliforms, psychrotrophs).

Records shall document the safety of any cooling water additives and cooling media products used, as well the microbial testing results.

1.14.15 Homogenizer

The homogenizer is a high pressure pump that produces a homogenized product by reducing the size of fat globules as they are forced through a small orifice under high pressure. Since the homogenizer is a positive pump, it can be utilized as a flow control device. If the homogenizer is utilized as a flow control device, its compliance requirements are to be rated under the Flow Control Device (1.14.06.01 to 1.14.06.03).

1.14.15.01 General Conditions

Filters, homogenization valves, pistons, seat valves, pressure gauges and dead ends must be clean and in good mechanical condition. All product contact surfaces must be stainless steel or other food grade, non-corrosive material. All homogenizers should be equipped with appropriate gauges.

Homogenizers installed downstream from the holding tube in the aseptic zone shall be of an aseptic design, to prevent contamination of the sterilized product.

1.14.15.02 Homogenizer Larger Than FCD

This homogenizer must be designed and installed so that the flow rate is not affected. The manufacturer must be able to demonstrate that any homogenizer located downstream does not affect the flow rate (e.g. physical break, pressure sensors in holding tube, FCD is a MBTS, etc.) If a homogenizer located downstream from the flow control device has a capacity greater than the flow control device, then the homogenizer must not be a flow promoter.

One way to achieve this is to have a recirculation line between the inlet (suction line) and the outlet (pressure line) of the homogenizer installed to prevent the homogenizer from starving. This line shall be unrestricted and shall not contain a shut-off valve, but may contain a check valve allowing flow only from the outlet back to the inlet. The diameter of the recirculation line including the check valve shall be equal or greater than the supply line to the homogenizer. Other acceptable systems could also achieve this requirement.

The homogenizer must not reduce the holding time, and must not reduce the pressure required in the holding tube to keep the product in the liquid phase.

1.14.16 Aseptic Surge Tank

The aseptic surge tank acts as a sterilized product balance tank for the fillers. This allows both the fillers and the aseptic processor to operate independently at their own flow rate.

The aseptic surge tank is installed downstream from the FDD. If the surge tank is protected by one or more aseptic barriers at the FDD, filling operations may continue from the tank while the Aseptic processor is in divert. Otherwise, the fillers and aseptic surge tank must also be emptied and re-sterilized after a divert event. (See Appendix 19 - 10).

The cleanliness and operation of the aseptic surge tank are important to prevent contamination of the sterilized product. Air over the product in the tank must be sterile.

1.14.16.01 General Conditions

The aseptic surge tank and associated valves, thermometers, etc. must be clean and in good condition. Instrumentation (temperature recording chart) must be installed to record and verify pre-sterilization of the tank before production commences.

1.14.16.02 Sterile Air

As product is withdrawn from the surge tank, negative pressure could develop in the tank, which could cause unsterile air and bacteria to be drawn in through joints, gaskets, etc. For this reason, the sterile air must be pressurized to prevent the development of negative pressure inside the aseptic surge tank.

In general, a processing authority establishes a venting or air purge schedule for the surge tank. Sterile air over-pressure must be maintained on aseptic surge tanks to ensure proper operation (i.e., product flow to the filler).

Sterile air is produced by incineration and/or filtration. Attention must be paid to how the establishment monitors sterile air over-pressure and the method of achieving sterility. If incineration is used, a temperature sensing device monitoring system is generally the easiest means. If a sterile filter is used, the specifications of the filter, filter location and number of filters must be monitored. Filter must be changed at intervals recommended by the manufacturer or process authority for their method of use and documented on the processing records.

A sterile air pressure controller or transmitter shall be used to monitor the sterile air pressure in the tank. Records of tests performed to determine the controller's/transmitter's calibration shall be maintained in the plant's files. Tests must include accuracy, upon installation and at an interval of at least every 6 months. The frequency of testing should be increased if the calibration is consistently found to be out of adjustment. If the calibration is consistently found to be out of adjustment, the reason for the calibration problems should be immediately identified and rectified.

Testing methods shall comply with the required standards. Follow-up on out of specification findings must be satisfactory.

If the sterile air pressure drops below the value specified in the scheduled process, the filler (s) shall cease operation, and the aseptic barrier located at the inlet of the unsterile tank shall be activated to protect the sterile product in the processing system from entering the unsterile tank. Filling operations may not resume until the aseptic surge tank, fillers and valves have been emptied and re-sterilized. If multiple aseptic surge tanks and fillers are used and the sterility of these is maintained, this requirement may not apply.

1.14.17 Stuffing Pump

Stuffing pumps may be used to improve the efficiency of other devices, such as homogenizers.

1.14.17.01 General Conditions

Stuffing pumps are usually centrifugal pumps. They must be constructed of stainless steel or a suitable corrosion resistant material and must be clean and in good mechanical condition. Painted exterior surfaces must also be clean and in good condition, free of flaking paint and rust.

All pumps not specifically designed for CIP use must be disassembled for cleaning. This includes removal of impellers and back plates for cleaning.

All pumps installed in the sterile zone must be of an aseptic design.

1.14.17.02 Proper Installation/Operation

Product stuffing pumps must be inter-wired with the flow control device electrical operating signal. When the flow control device is prevented from operating, either by the operator or operating system and /or by safety interlocks installed on the system, the stuffing pump and other flow-promoting devices must stop. Stuffing pumps may be configured to start prior to starting the homogenizer, but the FCD must be in an allowed to run condition.

When a stuffing pump is used in an aseptic processing and packaging system it must be installed and operated in such a way that it will not influence the proper pressure relationship within the regeneration section, and it must not reduce the holding time below the required minimum.

If the homogenizer is used as a flow control device, a centrifugal type stuffing pump may be installed between the raw product outlet of the regenerator and the inlet manifold of the homogenizer to supply the desired pressure to the homogenizer.

Tests are performed upon installation, at least once every 6 months thereafter and when micro-switch is re-set or replaced. Appropriate records must be kept to show proper testing has occurred.

1.14.18 Aseptic Packaging

Aseptic packaging has been defined as a procedure consisting of sterilization of the packaging material or container, filling with a commercially sterile product in a sterile environment, and producing containers that are tight enough to prevent recontamination i.e. which are hermetically sealed.

UHT of product

next step
Aseptic transfer
next step
sterilization of packaging material, sterile surroundings during packaging
next step
tight containers

Aseptically packaged UHT milk must also give almost complete protection against light and atmospheric oxygen. The package must therefore be of barrier type or similar.

The term aseptic implies the absence of any unwanted organisms from the product, package or other specific areas. The term hermetic is used to indicate suitable mechanical properties to exclude the entry of bacteria into the package or, more specifically, to prevent the passage of microorganisms and gas or vapour into or from the container.

Packaging Conditions

1.14.18.01 Packaging Material

An appropriate program must be established by the processor to ensure that the packaging materials received are in compliance with the requirements identified in the scheduled process. These procedures should include visual examination of the packaging material to identify damage and defects. All packaging material shall be stored in a clean and sanitary manner to minimize the risk of contamination and physically damaging the materials.

1.14.18.02 Sterilant

The aseptic packaging machine must ensure the sterilization of the container and provide a sterile environment for filling. The most commonly used sterilants, depending on the application, are hydrogen peroxide (H2O2) or a combination of H2O2 and peracetic acid. During the sterilization of the packaging material by H2O2 or other sterilants, a residue of these sterilants may be left on the material. Testing of the residue must be performed at an appropriate frequency and must be at or below the level specified by the scheduled process. Sterilants used to sterilize the package shall be dairy safe and approved for dairy plant purposes. If dilution is required, sterilants must be diluted as per manufacturer's recommendation.

Two important factors must be considered when using sterilants, these are (Long-Life Products: Heat-Treated Aseptically Packed - A Guide to Quality. Von Bockelmann et al. 1998):

  1. Microbiological efficiency of the sterilization process
  2. Elimination of chemical residues from the package which can subsequently contaminate the filled product

Depending on the type of packaging equipment, different means of applying the sterilants can be used e.g., spray, vapour, roller system, immersion bath etc. Other systems may be acceptable if the Process Authority proves that these sterilants meet Health Canada's requirements for commercial sterility.

Plastic bottle sterilization: in general, plastic bottles are sterilized using a solution of H2O2 and peracetic acid. The bottles are filled with the solution of chemical sterilant while passing on a conveyor for a pre-determined contact time, then they are inverted to empty the solution followed by a sterile water rinse to eliminate any chemical residual in the package prior to filling. (Refer to Appendix 19 - 12 B for sterile water requirements)

1.14.18.03 Headspace Gas

Some processors use nitrogen gas or other media to create a headspace in the formed package. The nitrogen gas or any other media used must be filtered or treated in other ways to remove or destroy microorganisms.

1.14.18.04 Packaging/Filling Room Air Quality

In order to minimize contamination from other areas of the processing plant, the packaging/filling aseptic zone must be under positive pressure, relative to the rest of the plant. However, the room must be under negative pressure relative to the aseptic zone of the packaging machine. Microbial analysis of air quality should be conducted on a specified time frame adequate enough to substantiate the air quality is acceptable and records of results are kept in the plant's file.

1.14.19 Packaging and Filling Controls

The aseptic packaging stage is the most delicate operation of producing aseptic product, both in terms of control and preventative measures required. The processing plant must have well trained personnel to carry out the operations and to maintain the equipment.

For packaging and filling equipment, the critical controls which attain and maintain commercial sterility within the aseptic zone must be identified. These critical controls include sterile air supply systems and sterile product contact surfaces of the filler and packaging material. The packaging and filling critical controls become the basis of the scheduled process for aseptic packaging.

1.14.19.01 Calibration of Controls

The packaging and filling critical controls must be calibrated on a regular basis. When they function properly they will be fail-safe. If the critical controls are not met, the machine must stop and preclude the packaging of sterile product into non-sterile containers. Records of calibration must be kept indicating the date of testing, method(s) used, and the name of the individual performing the calibrations.

1.14.19.02 Setting of Controls

In order to have a commercially sterile finished product, the identified critical controls must be set and adhere to the specifications identified in the scheduled process during container formation and filling. These critical controls may include but are not limited to, for example:

  1. positive sterile air/inert gas pressure in the filling and sealing area of the machine
  2. hydrogen peroxide concentration and temperature
  3. drying section temperature

Although these systems usually operate in an automatic mode, most, if not all, will be equipped with a capability of manual over-ride of the automatic controls. This manual over-ride must be protected from unauthorized personnel access.

1.14.19.03 Setting Deviation

Acceptable variations from the specified setting of critical controls must be described in the scheduled process and in the operator's packaging and filling production log. In the event of a critical deviation from the setting, the packaging system shall be shut down, non-sterilized product must be segregated and the system must be re-sterilized before resuming operation.

1.14.20 Quality Control

Each processing establishment must have a quality control program of the processes used as well as the products packaged. The tests and frequency of this program may vary with the food product as well as the needs of the regulator and establishment, but must be done in such a manner and at a statistically valid frequency that provides a high level of assurance that the finished product is commercially sterile.

1.14.20.01 Finished Product Testing

Sampling Plan: Statistically valid samples of the production must be taken to assess the safety and quality of the product. The quantity of containers to be taken, the tests to be performed and the standards to be met should be determined for each plan of the sampling program, based upon specifications supplied by the processing authority.

Inspection of heat seals: Appropriate inspections and tests must be conducted by trained personnel before production starts and during production, after jam-ups and as per manufacturer's recommendation. Inspection of seals must be done at intervals of sufficient frequency to ensure consistent and reliable hermetic sealing as per manufacturer's recommendation.

In general, tests can be divided into two main types:

  1. Non-destructive testing: visual inspection of seals for absence of voids, wrinkles, pleats. Other important checks to be performed include seal alignment, overlap, product contamination in seals, de-lamination, etc.
  2. Destructive testing: activation pattern using a polarisation filter, vacuum bubble test, conductivity/electrolytic test, dye penetration test, microbial challenge test, storage and distribution test, burst test, removal torque test, seal security/seal strength tests, etc.

The methods used for these inspections must be those specified by the packaging material supplier.

Incubation: Incubation tests must be done at a statistically valid frequency to verify the "commercial sterility" of the finished product. Samples are generally incubated at a specified temperature for a specific period of time to detect mesophilic growth. Incubated packages are observed for any sign of gas production (puffers), product changes such as odour, pH, oxygen content, viscosity and other indicators of spoilage, such as separation or curdling.

Microbial Evaluation: Microbial analysis for commercial sterility must be conducted on a statistically valid number of containers from each lot (from each filling head) regardless of the absence of signs of non-sterility following incubation.

Microbial growth from unsterile containers must be further investigated and the action taken recorded. Pending the outcome of the investigation, the lot must be detained.

Product Release: All package integrity, incubation testing, processing record review and the investigation of any process deviations must be satisfactory before the product is released for distribution.

1.14.21 Record Keeping

It is important that the scheduled process be properly established, correctly applied, sufficiently supervised and documented to provide assurance that the requirements have been met. Production records must consist of the operator's packaging/filling production log and the operator's on-line record of critical parameter testing. These records must be maintained on file for at least 3 years or the shelf-life of the product if longer than 3 years.

1.14.21.01 Packaging Records

A trained operator is responsible for verifying that all critical controls are recorded and meet specifications. Review of records by the responsible individual should be completed before the product is released.

The operator's packaging/filling production log should contain the following information:

  1. date
  2. batch
  3. packaging machine number
  4. product being filled and packaged
  5. source of product (i.e. from surge tank or sterilizer)
  6. preparations taken to bring equipment into packaging readiness, e.g. inspection/repairs/replacements of valves, gaskets, gauges, warning lamps etc.; cleaning, preheating and sterilization steps; pressure and temperature checks

To ensure product safety and to provide a historical record of the process, the following information should be recorded:

  1. date
  2. hourly filling code
  3. machine number
  4. packaging start time
  5. packaging stop time
  6. machine downtime and reason, corrective action taken to restart
  7. intervals at which teardowns conducted
  8. types of teardowns conducted, classification of defects observed, corrective action taken
  9. hydrogen peroxide concentration
  10. production volume
  11. unusual occurrences
  12. operator's signature
  13. signature of individual responsible for review
Date modified: