Dairy Establishment Inspection Manual – Chapter 14 - Aseptic Processing and Packaging Systems
1.14.11 Safety Thermal Limit Recorder

This page is part of the Guidance Document Repository (GDR).

Looking for related documents?
Search for related documents in the Guidance Document Repository

The function of this device is to:

  1. Automatically record the temperature of the product in the sensing chamber on a chart that also indicates the time of day, and provides a record of the process
  2. Indicate and record the position of FDD (i.e. forward or divert flow)
  3. Supply a temperature cut out signal input to the thermal limit controller unit

The evaluation of this task could include the review of documents such as:

  1. Plant records
  2. Testing/calibration documents
  3. Scheduled process
  4. Ladder logic

1.14.11.01 General Conditions

The STLR must meet the criteria established by the manufacturer of the APPS systems (industry to supply). Units must be manufactured for STLR usage and any modifications must be performed by, or authorized by the manufacturer.

The STLR shall be housed in a case that is moisture-proof under normal operating conditions. The STLR must be maintained in good condition, and operated as specified by the manufacturer. Any covers preventing access to public health adjustments, such as the divert set-point, must be maintained in place.

The single probe which senses the temperature for both the temperature recording pen and the cut-in /cut-out control shall be installed with a pressure-tight seal against the inside wall of the pipe with no threads exposed to milk or milk products.

The STLR must be serviced at least once per year and maintained on a continual basis so that the instrument functions according to specifications. Records of service and maintenance must be available in the plant's files.

All switches on the STLR and any controls associated with the operation of the aseptic unit shall be clearly identified. There shall be no switches or devices that could jeopardize the safety of the product by by-passing or over riding any public health controls.

1.14.11.02 Location

The single probe which senses the temperature for both the temperature recording pen and the cut-out control shall be installed in the sensing chamber, before the indicating thermometer probe. The distance between the 2 probes should not be more than 30 cm (12 inches).

1.14.11.03 Specifications

A circular chart shall make one revolution in not more than 12 hours and shall be graduated for a maximum record of 12 hours. If operations extend beyond 12 hours, a 24-hour chart can be used if it can provide an equivalent level of accuracy and clarity.

The chart positive drive mechanism shall be equipped with a system to prevent slippage or manual rotation (e.g. pin to puncture the chart paper). The chart used shall correspond with the chart number displayed on the identification plate of the STLR

The chart graduations shall not exceed 1°C (2°F) within a range of 5.5°C (10°F) of the processing temperature. The chart temperature scale shall not exceed 30°C (55°F) per 25 mm (1 inch) within a range of 11°C (20°F) of the processing temperature.

The STLR must have a functioning temperature recording pen.

All units must also have a functioning frequency pen. This pen, also called the event or divert pen, records the position of the FDD with a line on the outer edge of the chart. The frequency pen is energized by a position detector in the FDD as the FDD moves into forward position. The frequency pen is de-energized during diverted flow and it moves down to indicate a divert. Some systems may be designed so that the event pen indicates the critical factors required to enable forward or diverted flow. In such cases, the event pen will be de-energized when at least one of those pre-determined critical factors is not met.

These two pens must track together or follow the same time line. On certain models, a reference arc is used to align these two pens.

If the STLR requires a third pen, as with a multiple temperature divert unit, this third pen cannot track with the other two. It must be adjusted to lead or follow the other pens by a specified time factor. This value shall be displayed on the STLR unit. This ink used in this set-point recording pen should be differentiated from the other two.

1.14.11.04 Thermal Limit Controller Sequence Logic

Since the FDD is located downstream from the cooling section on aseptic systems, forward flow can not occur until all product contact surfaces from the holding tube to the FDD have been held at or above the required system sterilization temperature for the time specified in the scheduled process.

The thermal limit controller unit utilizes a sequence of electrical inputs and timers to ensure the Aseptic processing and packaging system is sterilized before allowing the FDD to assume the forward flow position.

For indirect heating systems, forward flow commences only after sensors at the FDD and at the holding tube have reached the required temperature for the length of time specified for system sterilization as per the scheduled process.

In direct heating systems, forward flow may commence only after the sensors located at the holding tube, the coolest part of the vacuum chamber, and at the FDD have reached the required temperature for the time period specified for system sterilization as per the scheduled process.

This assures that all parts of the system have been properly sterilized before allowing the FDD to move into the forward flow position. Once the minimum times and temperatures have been satisfied for system sterilization, the two auxiliary controllers (see Task 1.14.13.01 (at the FDD, and at the vacuum chamber on direct heating systems) then drop out of the control loop, and the primary recorder-controller (STLR) at the holding tube outlet (sensing chamber) resumes its function for normal product processing temperature control.

Failure to meet any safe forward flow condition, such as temperature below cut out, improper regenerator pressure differential, improper holding tube pressure, loss of predetermined liquid levels at steam infusion chamber exits or loss of differential pressure across the injector, shall cause the FDD to immediately move into the divert flow position, unimpeded by the thermal limit controller unit.

After a diversion event, the FDD shall not resume forward flow until the system is re-sterilized and the thermal limit sequence logic is again satisfied.

The settings and adjustments for the thermal limit controller unit must be enclosed and sealed to prevent unauthorized tampering.

1.14.11.05 Calibration/Records

The performance accuracy of the STLR and thermal limit controller shall be performed upon installation, verified at least once every 6 months and whenever a seal has been broken. Records of tests to determine accuracy shall be maintained in the plant's files. Tests which should be performed include the following:

  1. Recorder temperature accuracy
  2. Recorder time accuracy
  3. Cut in/Cut out
  4. Thermal limit controller sequence logic
  5. Recording thermometer check against indicating thermometer: (Daily) The recording thermometer shall not read higher than the corresponding indicating thermometer. However, should the recording temperature differ from that of the indicating, necessary measures must be taken and documented to correct the situation.

1.14.11.06 Sealed

Access to STLR cut in/cut out adjustments shall be sealed. The sealing device should provide an indication of tampering or unauthorized adjustment.

The enclosure for the settings and adjustments for the thermal limit controller sequence logic must be sealed to prevent unauthorized adjustment.

1.14.11.07 Programmable Logic Controllers and Computers

Programmable logic controllers or computers installed on an aseptic processing and packaging system for operational convenience and not public health control must meet certain safeguards and tests. The computer may not control any public health function when the system is in processing mode. When in CIP mode, the computer may control any functions when CIP mode is first selected. Non-public health controls, such as product pumps or valves, may be controlled at any time by the computer. The vendor is responsible for providing a testing protocol to verify that public health safeguards are not under the control of the computer during the production cycle.

Computers for the operation of public health controls on aseptic processors have additional considerations. Computers are different from hard-wired controls in three major areas. To provide adequate public health protection, the design of computerized public health controls must address these three major differences.

First, unlike conventional hard-wired systems, which provide full-time monitoring of the public health controls, the computer performs its tasks sequentially, and the computer may be in real time contact with the FDD for only one millisecond. During the next 100 milliseconds (or however long it takes the computer to cycle once through its tasks), the FDD remains in forward flow, independent of temperature in the holding tube. Normally, this is not a problem because most computers can cycle through 100 steps in their program many times during one second. The problem occurs when the public health computer is directed away from its tasks by another computer, or the computer program is changed, or a seldom used jump, branch, or go to Instruction diverts the computer away from its public health control tasks.

Second, in a computerized system, the control logic is easily changed because the computer program is easily changed. A few keystrokes at the keyboard will completely change the control logic of the computer program. Conversely, hard-wired systems require tools and a technician to make wiring changes. Once the hard-wired system is properly installed and working, it does not change. The problem can be solved by sealing the I/O access to the computer, but some procedure is needed to ensure that the computer has the correct program installed when it is re-sealed.

Finally, some computer experts have stated that no computer program can be written error-free. They were referring primarily to very large programs, with many conditional jumps and branches, with thousands of lines of program code. For these large systems, the programs actually improve with age (the errors are found and corrected under actual conditions of use). For public health controls, the computer program must and can be made error-free, since the programs required for public health control are relatively brief.

If the design of computerized public health controls does address the above mentioned differences, they can be effectively interfaced with conventional hard-wired operating controls and instrumentation. When computers or programmable logic controllers are used in pasteurizing or sterilizing systems, they must be installed in such a manner that public health controls are not circumvented by the computer or programmable logic controller during the product run operations, except as provided for under Appendix 19 - 5 Criteria for the Evaluation of Computerized Public Health Controls.

The vendor is responsible for ensuring that their PLC or computer installation complies with the requirements of Appendix 19 - 5, through documentation and testing.

The responsible regulatory agency shall evaluate the complete documentation of interconnecting wiring, pneumatic controls, applicable programming logic and ladder logic, and results of the testing procedures. This will help to verify compliance with the criteria in Appendix 19 - 5.

Date modified: