Dairy Establishment Inspection Manual – Chapter 17 - Higher Heat Shorter Time (H.H.S.T.) Processing and Extended Shelf-Life (ESL) Dairy Products

This page is part of the Guidance Document Repository (GDR).

Looking for related documents?
Search for related documents in the Guidance Document Repository

Higher Heat Shorter Time (H.H.S.T.) treatment of fluid milk and milk products is the application of heat to a continuously flowing product using high temperatures, generally above 100°C, for such time to extend the shelf-life of the product under refrigerated conditions. This type of heat process can be used to produce dairy products with Extended Shelf-life generally referred to as "ESL".

ESL means the ability to extend the shelf-life of a product beyond its traditional life by reducing the major sources of re-infection and maintaining the quality of the product all the way to the consumer (Dairy Processing Handbook, 2003).

ESL products are not considered to be commercially sterile products and, as such, must be cooled immediately after pasteurization to a temperature of 4°C or less and stored continuously under refrigeration at a temperature of 4°C or less.

1.17.01 H.H.S.T. Flow Schematic

The H.H.S.T. system, although similar to an H.T.S.T. pasteurizer, operates at higher temperatures (above 100°C) and pressures. It also uses a pasteurization or sterilization cycle to pasteurize or sterilize the entire system prior to commencing production.

The number of factors involved and any changes made to the processing system must be done with the full involvement of the process authority responsible for the scheduled process. Even slight modifications made to the H.H.S.T. system may have an impact on its operation and safety.

This task will evaluate the flow schematic of the H.H.S.T. processing system from the constant level tank to the finished product storage tank.

1.17.01.01 Flow Schematic [Process and Instrumentation Diagram (P&ID)]

Plant management must have a flow schematic, outlining the H.H.S.T. system and its related components, which is maintained and kept in the plant's file. When equipment and/or pipelines are installed or changed, plant management must ensure that the flow schematic is updated. All components of the H.H.S.T. must be on the flow schematic (P&ID).

1.17.01.02 No Cross Connections

A cross-connection is a direct connection allowing one material to contaminate another. There needs to be a complete segregation of incompatible products such as raw materials and pasteurized food products, cleaning products and food products (including potable water) and waste materials or utility materials and food products, as outlined under task 1.10.01.02. Consideration also needs to be given to preventing inadvertent cross contamination of independent food products (e.g. soy beverages and milk) which may pose allergenic concerns.

For other applications (C.I.P. supply lines and return line circuits used for C.I.P. cleaning and Amini-washes on tanks, lines, pasteurizers or other equipment that may be washed while connected to product lines containing milk products or potable water and lines for final rinse), this segregation must be accomplished by the use of separate pipelines and vessels for incompatible products and establishing effective physical breaks at connection points by at least one of the following arrangements: physical disconnecting of pipelines, double block and bleed valve arrangements, double seat (mix proof) valves, aseptic barriers, or other equally effective systems. Refer to Appendix 19-10 for assessment of these applications.

Attention must also be paid to the design of the constant level tank and piping, and the Flow Diversion Device (FDD), as these are areas where potential cross-connections could exist if the design or installation is improper. The following sections namely, 1.17.03.03 and 1.17.09.01 to 1.17.09.05 provide more details for the evaluation of these tasks.

A physical verification by the inspector must be done to check the accuracy of the schematic/P&ID and to ensure that no cross connections exist. Even if the plant does not have a schematic on file, an assessment for cross connections must be completed on the H.H.S.T. system.

1.17.02 Scheduled Process

The scheduled process means all the conditions pertaining to the processing and packaging equipment, containers and products needed to achieve and maintain the required extended shelf-life under refrigerated storage conditions.

To achieve the required pasteurization of ESL products in HHST systems, the scheduled process must be designed to provide a thermal destruction of the target microorganism equivalent to that achieved by a process with a minimum lethality value F0=0.1.

(Note: It is recognized that F0 is associated with commercially sterile products targeting a 12 log reduction in Clostridium botulinum spores, it was, nevertheless, chosen in this case because it is the preferred method used by process authorities for calculating process kill as opposed to the use of pasteurization value (P), which is more complex as it deals with varying reference temperatures and z-values.)

1.17.02.01 Scheduled Process

The scheduled process is developed and documented by a process authority that has scientific knowledge and experience in this field. The documentation required to validate the process covers the scientific basis for selecting certain specifications and requirements, calculations used to derive numerical values for the specifications, a review of applicable regulations and guidelines, and a descriptive commentary on what equipment and controls are being used and why. The numerous variations encountered in commercial production are to be accounted for in the process. Critical factors that may affect the achievement of pasteurization of the ESL product need to be included in the scheduled process.

Testing procedures and operator instructions are to be included in the process documentation.

Upon initial commissioning of the processing unit or after significant alterations have been made to the system or scheduled process, appropriate testing and shelf life studies (see Task 1.10.07.03) must be used to confirm that the process is valid.

Any changes to an H.H.S.T. system must be assessed by the process authority as to the potential impact they will have on the system, so as to maintain the safety of the product.

1.17.02.02 Operating Instructions

Detailed operating instructions are to be made available to the operator, to ensure that the process is operated according to the design of the scheduled process. These instructions must include procedures for monitoring critical factors during system pasteurization or sterilization at start-up, and during production, and what to do if the critical factor limits are not met (process deviation procedures).

A process deviation occurs whenever any process is less than the scheduled process or when critical factors are outside of specified limits.

1.17.02.03 Critical Factor Adherence

The critical factors are those factors specified in the scheduled process as being necessary for the achievement of pasteurization of the ESL product. The inspector must review the scheduled process to see what critical factors were established. If during on-site observations, any of these critical factors are not within the limits documented in the scheduled process, this constitutes a process deviation and the product cannot be considered pasteurized ESL until process deviation procedures are completed.

1.17.02.04 Critical Factor Records

The processing records must contain all the required information and indicate if the products were processed within the acceptable limits for the critical factors (no process deviations). Process deviations require detailed documentation in the plant's process control records and/or a separate file for follow up by the plant management to determine the cause and corrective action for the deviation and to ensure any compromised product is properly identified and handled to prevent distribution or sale.

Process deviation records must include date and time of the process deviation, amount of product involved, product quarantine and release of affected product, investigation into the cause of the process deviation (e.g. equipment breakdown, power failure, low temperature at outlet of holding tube), the action taken (e.g. line cleared, repairs performed, system re-pasteurized/re-sterilized) and review by appropriate company personnel.

Process control records are part of the critical factors records. This information must be recorded in ink to provide a permanent record. Since this information provides a processing record, it will assist the plant in tracking down quality and safety problems and help prevent recall of their products. All production records must be reviewed on a timely basis by a member of plant management. Any operator's notes concerning unusual occurrences must be evaluated by plant management to ensure that a critical process parameter was not violated (i.e. that an unusual occurrence was not in fact a process deviation requiring product quarantine).

1. All process control records for H.H.S.T. systems shall provide the following data on every chart (only the processing operation requires a 12 hour chart):

  1. Plant name and address or registration number;
  2. Date, shift and batch number where applicable;
  3. Recorder unit identification when more than one is used;
  4. Product type and amount of product processed (may be recorded in production records);
  5. Identification of sterilization/pasteurization cycles (e.g. indicate when water or product being run);
  6. Identification of C.I.P., Amini-wash (if used)
  7. Unusual occurrences and operator comments;
  8. Signature or initials of the operators;
  9. No overlapping of chart pen markings;

For the S.T.L.R.:

  1. Reading of the official indicating thermometer during processing. This reading must never be lower than the recording thermometer reading;
  2. Record of time the Flow Diversion Device (FDD) is in the forward flow position, as indicated by the event pen;
  3. Recording thermometer tracing;
  4. Set point tracing, when multiple set points are used,
  5. All of (1) above

For systems equipped with a Meter Based Timing System (MBTS);

  1. Synchronized time with S.T.L.R. chart;
  2. Record of time the flow alarm is activated, as indicated by an event pen;
  3. Flow rate tracing;
  4. All of (1) above

For the pressure differential controller-recorder:

  1. Synchronized time with S.T.L.R. chart; Electronic data collection, storage and reporting of pressure differentials, with or without hard copy printouts, may be acceptable provided the electronically generated records are readily available at the establishment for review by the regulatory agency and meet minimum criteria required for S.T.L.R. charts.
  2. Raw product or media side pressure tracing;
  3. Sterilized product side pressure tracing;
  4. In lieu of (b) and (c) above, the pressure differential recording between (b) and (c)
  5. All of (1) above

For the pressure limit recorder:

  1. Synchronized time with S.T.L.R. chart; Electronic data collection, storage and reporting of pressure limit in the holding tube, with or without hard copy printouts, may be acceptable provided the electronically generated records are readily available at the establishment for review by the regulatory agency and meet minimum criteria required for S.T.L.R. charts.
  2. Holding tube operation pressure;
  3. All of (1) above

For optional additional temperature recorders/controllers on the system:

  1. Synchronized time with S.T.L.R. chart:
  2. Recording thermometer tracing;
  3. All of (1) above; note especially the identification of pasteurization/sterilization cycles;

All pertinent processing records should be retained as part of the quality assurance program. These records will assist the plant and regulatory agencies to determine if these products were adequately pasteurized to meet the extended shelf-life. The time-frame for retention is as follows:

  1. A one year period minimum;
  2. As determined by the responsible regulatory agency; or
  3. Until the finished product has been consumed (if more than one year).

1.17.03 Constant Level Tank (C.L.T.)

The constant level tank (C.L.T.) is a reservoir for supply, at atmospheric pressure, of raw product to the pasteurizer to permit continuous operation of the H.H.S.T. system. The constant level tank is located at the start of the H.H.S.T. system. The constant level tank controls the milk level and provides a uniform head pressure to the product leaving the tank.

1.17.03.01 General Conditions

The tank shall be constructed of stainless steel and be in good mechanical and sanitary condition. The tank's design features will be assessed under the subsequent tasks.

1.17.03.02 Design

The tank shall be of such design and capacity that air shall not be drawn in the pasteurizer with the product when operating at the maximum sealed capacity of the flow control device. The constant level tank shall therefore be fabricated so that the raw product will drain to the outlet before the outlet becomes uncovered. One method of complying with this requirement is to have the bottom of the tank pitched to the outlet at a minimum downward slope of at least 2% (0.2 cm per 10 cm) and the top of the outlet pipe lower than the lowest point in the tank (see Appendix 19-3).

1.17.03.03 Cover

The tank shall be fitted with a removable cover, or an inspection port with a removable cover, of suitable design to maintain atmospheric pressure and to minimize the risk of contamination. The cover shall be pitched to an outside edge to provide drainage. All openings in the cover shall be flanged upwards and covered. Pipelines entering through the cover (excluding directly clamped lines) shall be fitted with a sanitary umbrella deflector that overlaps the edges of the opening and is located as close to the tank cover as practical. The cover shall be used during processing.

1.17.03.04 Airspace and Overflow

Any product divert lines, recycle lines and water lines coming into the constant level tank (C.L.T.) must be installed in a way that prevents the siphoning of raw milk or cleaning products into finished product or potable water lines (a cross connection). This is accomplished by having an overflow outlet at least twice the diameter of the largest inlet to the constant level tank, and ensuring that the divert, recycle, water lines terminate and break to atmosphere at least two times the diameter of the largest inlet above the maximum overflow point of the C.L.T.

1.17.03.05 Level Control Device

This device is required to control the flow of milk to the C.L.T. and therefore provide constant head pressure to the product leaving the tank.

The constant level tank shall be equipped with an automatic device of sanitary design and construction to control the raw product level.

1.17.04 Feed Pump

The feed pump is used to improve flow through the raw regenerator, and to supply the flow control device with milk from the constant level tank to prevent starving, especially if the flow control device is a homogenizer. It also helps to remove negative pressure and subsequent "flashing" or vaporization in the raw regenerator section. In H.H.S.T. systems, the feed pump normally operates in both forward and diverted flow, as long as the flow control device is in operation.

1.17.04.01 General Conditions

A feed pump must be of sanitary design. The pump must be clean and in good mechanical condition.

The raw product side of the regenerator may be by-passed at start up. Entrapment of the product in the by-pass line during periods when the feed pump is in operation shall be precluded by:

  1. Close-coupled by-pass connections. (i.e. as close as possible: approximately 2.5 times the pipe diameter).
  2. Design of the manually or automatically controlled valve which will permit a slight movement of product through the by-pass line.
  3. Other equally effective system.

1.17.04.02 Location

The feed pump shall be located between the constant level tank and the inlet to the raw product side of the regenerator.

1.17.04.03 Inter-wiring

Where a feed pump is used, a pressure differential controller-recorder is required and shall be inter-wired in such a way that it can only operate when the flow control device is allowed to run i.e. the F.C.D. has been turned on by the operator or operating system and safety interlocks that may be installed on the H.H.S.T. system are not preventing the F.C.D. from operating.

1.17.05 Regeneration

The regenerator section on H.H.S.T. systems may either be of a milk-to-milk type or milk-to-heat transfer medium-to-milk. The cold raw product is warmed by hot pasteurized product flowing on the opposite sides of thin stainless steel plates or tubes. The pasteurized product will in turn, be partially cooled.

The basic requirements for the regeneration section are:

  1. That it is installed and operated in such a way that the proper pressure relationship exists between the raw product or media and pasteurized product in all the modes of operation, i.e. forward and diverted flow conditions.
  2. Proper sanitary design and construction.
  3. Clean and in good condition, with no cracks, pinholes or leaks.

1.17.05.01 General Conditions

Since the physical distance between the various liquids in the pasteurization/sterilization plates or tubes is extremely small, the liquids have the potential to move through the plates or tubes and cross-contaminate the product if pin holes, cracks or leaks exist.

The plates or tubes shall be of sanitary design, constructed of stainless steel or other corrosion resistant material, and must be without pin holes, cracks or leaks. The plates or tubes must be clean with no presence of milk remnants, milk-stone, mineral scale build-up, or foreign materials. If plates are used, the plate gaskets must be equipped with leakage grooves and must not be compressed or otherwise show signs of wear.

A routine program to monitor the condition of plates and tubes (pin holes in plates, gasket condition, cracks, etc.) must be established by plants, taking into consideration the design specifications, operating conditions and hours of operation, wear and the history of the plates and gaskets. The integrity of all food contact heat exchange surfaces must be checked at least once per year by an acceptable method (e.g. dye recirculation, dye check, pressure retention, Helium Testing etc). However, if the plant has experienced problems with heat exchanger integrity (plate or gasket issues), a more frequent inspection program must be implemented to verify that the problem has been remedied. Appropriate records must be kept to show proper testing has occurred. These records should also document the cause of any failure (e.g. age, compression, metal fatigue, etc.). If pin holes are found in any plate in any section then all plates in the same section should be checked.

1.17.05.02 Pressure Differentials

This task will only assess the differential pressure. The equipment used to monitor pressure (P.D.C.-recorder and gauges) will be assessed under the task Pressure Differential Recorder Controllers (P.D.C.-recorder).

As previously discussed, raw milk or media and pasteurized milk are separated in the regenerator section only by thin metal plates or tubes and a system of gaskets. In milk-to-milk type regenerators, the raw side of the regenerator must, at all times, be under lower pressure (at least 14 kPa or 2 psi) than the pasteurized milk.

In milk-to-heat transfer medium-to-milk type regenerators, the pasteurized milk section must be under greater pressure by at least 14 kPa (2 psi) than the heat transfer medium at all times. The protection is on the pasteurized milk side of the system and is engineered to allow pasteurized product to leak into the heat transfer medium in case of regenerator plate (or tubular) failures. In this type of system, the heat transfer medium (e.g. hot water) must be from a safe source. The location of the pressure sensors for these controls is: a) at the heat transfer medium inlet on the pasteurized side of the regenerator and, b) at the pasteurized product outlet of the regenerator. Failure to maintain the required pressure differential in the pasteurized milk section of the regenerator shall cause the FDD to assume the divert flow position.

1.17.06 Flow Control Device (F.C.D.)

This task governs the uniform rate of flow through the holding tube so that every particle of product is held for the required period of time, as specified in the scheduled process. This device is a positive displacement type pump or homogenizer. Other equally effective mechanisms such as a Meter Based Timing System (MBTS) with proper components (centrifugal pump, flow control device or variable speed motor, meter head, relays, alarms and flow recorder-controller, etc.) may also be used as a flow control device. Refer to Appendix 19-4 for more information on MBTS.

1.17.06.01 General Conditions

The flow control device must be constructed of stainless steel and be in good mechanical and sanitary condition. The driving mechanism shall be designed so that in the case of wear, belt stretch, etc. the capacity will not increase. The flow control device cannot be excluded from the system during operation of the H.H.S.T. processing system. The device must be located upstream from the holding tube and normally it is located between the outlet of the raw regeneration section and the inlet of the heating section of the processing system.

1.17.06.02 Set and Sealed

The maximum operating capacity of the flow control device shall be set to ensure an appropriate flow rate to give the proper holding time, in accordance with the calculations done in the scheduled process, as evaluated under task 1.17.08.03 Holding Verification and Records.

When homogenizers are located within the H.H.S.T. system, flow rate evaluations shall be made with these pieces of equipment operating (with no valve pressure on the homogenizer) and by-passed to determine the fastest flow rate (minimum holding time). When flow promoters are located downstream from the flow control device, the flow rate shall be determined with the flow control device operating at maximum capacity, and the flow promoters in operation.

If maximum speed gives legal holding time a seal is not necessary. If the device is of the variable speed type or a single speed capable of being altered with different belts and pulleys, it must be sealed at an established flow rate to prevent operation at a greater capacity than that which gives the proper holding time. Alarm settings determining the flow diversion set points on magnetic flow meter systems must also be sealed.

Any change in the line resistance of the system after maximum speed of the pump has been set, will alter the flow rate and corresponding hold time. Increasing the line resistance by the addition of plates or piping will decrease the flow rate, increasing holding time. This increase in flow resistance in effect reduces the efficiency of the pasteurizer. Decreasing the line resistance by the removal of plates, pipes, or auxiliary units will increase the flow rate, decreasing the holding time. Wear of the drive belts and pump impellers due to normal operation will gradually decrease the rate of flow through the system, thereby increasing the holding time.

The flow control device is to be evaluated and sealed (if necessary) upon installation and annually thereafter, and in addition, whenever the seal on speed setting is broken, whenever any alteration is made affecting the holding time, the velocity of the flow (such addition or removal in the number of plates, pipes or auxiliary units) or the capacity of the holding tube or whenever a check of the capacity indicates a speed up. Records of alteration and re-evaluation of the system must be kept in the plant's file.

1.17.06.03 Fail Safe Capability

There must not be a by-pass (recirculation line) around the flow control device during processing. A by-pass may be present for C.I.P. purposes, but must be dismantled and removed during processing. To ensure that no by-pass is present during processing a proximity switch should be utilized so that the F.D.D. will not operate in forward flow. A Meter Based Timing System must have the appropriate controls and instrumentation in place, as outlined in Appendix 19-4. When a Meter Based Timing System replaces the positive displacement flow control device, it must be evaluated upon installation and at least once every 6 months thereafter, whenever seal on the flow alarm is broken, whenever any alteration is made affecting the holding time, the velocity of the flow or the capacity of the holding tube or whenever a check of the capacity indicates a speed-up. Appropriate records must be kept to show proper testing has occurred.

1.17.07 Heating Section

The heating section of the H.H.S.T. system provides rapid, uniform and controlled heating of the product up to sterilization temperature. The raw product is usually forced through this section by the flow control device. Heating may be by direct injection or infusion of steam, or indirect heating through tubes, plates, scraped-surface heat exchangers or other accepted systems.

1.17.07.01 General Conditions

For indirect heating, the heating equipment shall be clean and in good condition. It shall be of sanitary design, and constructed of stainless steel or other corrosion resistant material. During operation, the heating section must not leak at gaskets, seals, joints or connections.

With direct heating, it must be noted that the steam injection process is an inherently unstable process. When steam is injected into a fluid, condensation of the steam may not be completed inside the injector unless proper design criteria are satisfied. Lack of complete condensation would cause temperature variations in the holding tube that could lead to some milk particles being processed below the required temperature. Appendix 19-15 shows steam injectors from several manufacturers that have been shown to be satisfactory for use in steam injection systems.

1.17.07.02 Heating Medium

Steam used as a heating medium shall be free of harmful substances or extraneous matter. Only culinary steam may be used for direct steam injection or infusion (see Appendix 19-1).

Steam should be as free as possible from non-condensable gases. Any vapours in the holding tube would displace product, resulting in shorter holding times. A de-aerator installed on the boiler will aid in keeping the holding tube free of non-condensable gases.

Boiler and water treatment chemicals and other additives used must be dairy safe and approved for dairy plant purposes.

1.17.07.03 Pressure Limit Recorder Controllers

For both direct and indirect heating systems, product pressures in the holding tube and across the steam injector must be monitored and controlled to keep the product in a liquid phase and to ensure adequate isolation of the injection chamber.

A) A pressure limit recorder controller must be used for H.H.S.T. systems that are capable of operating with less than 518 kPa (75 psi) pressure in the holding tube to monitor the product pressure in the holding tube. This instrument has a pressure switch that causes the FDD to move to the divert position if the product pressure falls below a prescribed value. The pressure switch settings are determined during the set up and testing procedures (See Test 30 CFIA's Test Procedures for Critical Processes Equipment and Controls). Appendix 19-16 shows the pressure switch settings for corresponding operating temperatures.

B) On direct heating systems with steam injection only, a differential pressure limit indicator is needed to ensure adequate isolation (supplementary orifices) of the injection chamber so that product is uniformly heated in the chamber. This instrument must have a differential pressure switch so that the FDD will move to the divert position if the pressure drop across the injectors is below 69 kPa (10 psi).

Records shall indicate the holding tube operational pressures, the pressure switch settings, the results of required tests, and satisfactory follow up on out-of-specification findings.

1.17.07.04 Controllers/ Settings Sealed

Once the required tests have been completed, the controllers and settings must be sealed to prevent unauthorized adjustments.

1.17.07.05 Ratio Controller (Direct Heating Systems)

A ratio controller is required for systems applying direct heat to product to prevent water adulteration of the product being processed. The ratio controller is interlocked with the vacuum pump and/or steam controller and automatically monitors and controls the amount of vacuum applied and/or the amount of steam injected. This is accomplished by constantly monitoring the product temperatures at the inlet of the steam injection and outlet of the vacuum chamber.

One sensor is located immediately prior to the point of steam injection (incoming product), and the other is located immediately after the product exits the vacuum chamber (outgoing product). The optimum temperature differential between the incoming and outgoing product shall be determined by total solids analysis and such differential set on the ratio controller. The ratio controller automatically controls the pre-heat steam supply or the flash chamber vacuum to prevent water adulteration of the product.

When a water feed line is connected to a vacuum condenser, and the vacuum chamber is not physically separated from the vacuum condenser, satisfactory methods must be installed to prevent adulteration of the product with water in the condenser.

1.17.08 Holding

This is the part of the H.H.S.T. processing system in which heated product is held for the specified time required in the scheduled process. This section is located after the final heating section of the H.H.S.T. processing system, and may include the sensing chamber at the end. The sensing chamber is that portion which houses both the official indicating thermometer and the S.T.L.R. hot milk temperature sensors.

1.17.08.01 General Conditions

The holding tube and all connections shall be of sanitary design and construction, and shall be clean and in good mechanical condition.

The holding section shall be located after the F.C.D. with no intervening flow promoters, and after the final heating section, but before the FDD or any cooling section.

No device shall be permitted for short circuiting a portion of the tube or for the removal of a section of the tube such that the holding time is reduced below that specified by the scheduled process. No portion of the holding section between the inlet and the sensing chamber shall be heated.

1.17.08.02 Slope and Support

When the holding section is comprised of a holding tube, it is required to have a continuous upward slope (including elbows) of at least 2% (2 cm per 100 cm). The slope is required to eliminate any air entrapment in the holding tube, which would displace product and reduce the holding time. To prevent variance in the slope, the holding tube shall be permanently fixed by mechanical supports.

1.17.08.03 Holding Verification and Records

The holding time is determined by calculation, and is specified in the scheduled process. The calculations must include the extra condensate volume from steam added, if direct heating from steam is used. Results determined will dictate the length of the holding tube needed to provide the proper holding time, based on the flow rate used.

The actual length of the holding tube installed may be compared to the measurement determined by calculation in the scheduled process. Records shall indicate the measured flow rate of the system under the conditions outlined in Task 1.17.06.02 Set and Sealed. This measured value must be the same or lower than the value used in the calculation for the scheduled process.

Re-calculation of the holding tube length may be necessary if changes are made to the system that could alter the flow rate, or if the process itself is changed in any manner.

Verification of proper holding tube length and flow rate shall be done upon installation, annually, or whenever the seal on the F.C.D. is broken, and after any change is made to the system that could affect the holding time. The appropriate records shall be kept on the plant's file, including all supporting calculations.

Product pressures in the holding tube shall be monitored as per task 1.17.07.03 - Pressure Limit Recorder Controllers.

1.17.09 Flow Diversion Device (FDD)

The FDD is set up to control the direction of product flow according to the establishment of safe conditions within the processing system. It is located downstream from the regenerator section, and is designed to automatically divert flow away from the surge tank or filler.

1.17.09.01 General Conditions

The FDD must be of a design that can positively and effectively prevent potentially unpasteurized product from contaminating the fillers or surge tank(s).

All FDDs used in continuous H.H.S.T. processing systems used to pasteurize ESL products stored under refrigerated conditions must have one of the following acceptable designs:

  1. Dual-stem type FDD incorporating two three-way valves in series. These dual stem flow diversion devices shall have a leak detect line separate from the divert line, that is free draining from the lower port of the leak detect valve back to the constant level tank or other acceptable receptacles;
    or
  2. Steam-block type FDD system. This is comprised of a divert valve and one or more steam-block valves:
    1. The divert valve shall be fail-safe, position detectable and equipped with means to provide an alarm and protection when required
    2. The steam block valve shall have continuous supply of steam and a continuous visible bleed of steam or condensate to the drain
    3. The steam block valve shall be equipped with an interlocked resistance thermal device (RTD) located at the lowest level of the barrier to detect any fluid leakage into the barrier. If the leakage is detected by the temperature sensing device, an alarm or other appropriate system must alert the operator to the steam barrier failure. Appropriate action as indicated by the scheduled process deviation procedure must be followed.

A steam barrier is not mandatory, however if an establishment does not have a dual-stem type FDD incorporating two three-way valves then they must have a steam barrier.

Dual Stem FDDs must be equipped with a proper control panel where the control functions and relays are installed. This control panel may be part of a universal panel unit. This panel shall be free of any device or switches that may override the control functions and jeopardize the safety of pasteurized product. On valves that have external solenoids, the air lines must not have quick release couplings.

Installations on H.H.S.T. processing systems often have complex operating parameters for the FDD that can only be handled by a micro-processor or programmable logic controller PLC). A PLC or micro-processor control used strictly for FDD function is not required to meet the standards of Task 1.17.11.07 - Program Logic Controllers and Computers, but all valve functions must pass the required tests.

The FDD and the return lines shall be constructed of stainless steel and must be clean and in good mechanical condition. Valves, plunger seals and "O"-rings must also be clean and in good mechanical condition. Stem length of the valves shall be non-adjustable to insure that proper seating of the valves is not disturbed. If the stem has a threaded attachment, a locking pin or other equivalent locking mechanisms shall be used to prevent any misalignment. Air to the FDD must be clean and unrestricted.

1.17.09.02 Return Line

The FDD shall have a pipeline that directs the flow of potentially unpasteurized product safely away from surge tanks and /or fillers. Any subsequent valves installed on this line must be configured in all positions to allow free flow from the FDD, without blocking the flow or creating excessive back pressure on the FDD. A flash cooler may be installed on the return line to prevent injury to bystanders during divert events when pasteurizing/sterilizing the system.

1.17.09.03 Location

The FDD must be located downstream from the regeneration and before the surge tanks or fillers.

1.17.09.04 Fail Safe Divert Capability

The FDD shall automatically assume the divert position (so product will not go to the surge tanks or fillers) under at least one of the following conditions for indirect heating systems:

  1. The product temperature in the sensing chamber drops below the specification in the scheduled process;
  2. The differential pressure between pasteurized product and unpasteurized product or heat transfer media is less than 14 kPa (2 psi) in the regenerator;
  3. Adequate product pressure is not maintained in the holding tube to prevent boiling (less than 69 kPa (10 psi) above the boiling pressure of the product in the holding tube);
  4. Loss of electrical power or compressed air to the FDD solenoids;
  5. Excessive flow rate is detected for systems utilizing a magnetic flow meter as a flow control device;

The FDD shall automatically assume the divert position (so product will not go to the surge tanks or fillers) under at least one of the following conditions for direct heating systems:

  1. The product temperature in the holding tube drops below the specification in the scheduled process;
  2. The differential pressure between pasteurized product and unpasteurized product or heat transfer media is less than 14 kPa (2 psi) in the regenerator;
  3. Adequate product pressure is not maintained in the holding tube to prevent boiling (less than 69 kPa (10 psi) above the boiling pressure of the product in the holding tube);
  4. Loss of electrical power or compressed air to the FDD solenoids;
  5. For steam infusion systems, loss of pre-determined parameters (temperature, pressure level, etc. as determined by the process authority) at the steam infusion chamber exits;
  6. For steam injector systems, improper differential pressures across the steam injectors at the holding tube (a 69 kPa (10 psi) drop across the injector is required);
  7. Excessive flow rate is detected for systems utilizing a magnetic flow meter as a flow control device.

The FDD shall be installed with position detection capabilities to provide an electrical signal to the S.T.L.R. or legal panel.

After an event causing a flow diversion, all product contact surfaces between the holding tube and the FDD shall be held at or above the required pasteurization or sterilization temperature continuously and simultaneously for at least the required pasteurization or sterilization time, as outlined in the scheduled process (see also Task 1.17.11.04 - Thermal Limit Controller Sequence Logic). During CIP and pasteurization cycles of the H.H.S.T. processing system, a properly designed valve system must be used in accordance with Appendix 19 - 10 to prevent cross-contamination of pasteurized finished product in surge tanks with chemical cleaning solutions.

Plant records shall indicate the test results for valve operation at the required intervals and must show satisfactory follow-up on out-of-specification findings.

1.17.09.05 Leak Detect

H.H.S.T. systems where the filler continues to operate from a surge tank while the FDD is in the divert position, and the FDD is a steam-block type, must use a properly designed aseptic barrier system to separate pasteurized product from potentially under processed product. This segregating valve system shall be located between the FDD and the surge tank. An aseptic barrier system is not mandatory for systems that use a dual-stem type FDD valve assembly.

The barrier(s) may include one or more steam blocks, but must include a resistance thermal device (RTD) or other acceptable temperature sensor at the lowest level of the barrier to detect barrier failure due to steam loss or fluid leakage into the barrier. Barrier failure detected by the temperature sensing device must trigger an alarm system to alert the operator to the alarm condition, immediately initiating a shut down sequence for the processing system as specified in the scheduled process.

After a barrier failure condition, the fillers, surge tanks and lines, and H.H.S.T. system must be completely drained of product and all equipment must be re-pasteurized or re-sterilized before processing and filling may resume. Implicated product should be placed on hold until its pasteurized condition is assessed. This failure must be noted in the operator's log book and a process deviation report must be completed, which includes the date and time of the process deviation, investigation into the cause of the process deviation and action taken both on product and other corrective measures.

1.17.09.06 Device Sealed

The FDD legal panel and valve position detector cover(s) must be sealed to prevent unauthorized tampering or adjustments. The valve position sensing detectors, valve actuating solenoids and relays shall be sealed. If a PLC or micro-processor is used to control valve functions, access to programming functions shall be sealed.

1.17.10 Indicating Thermometer

The indicating thermometer provides the official processing temperature of the product, which is a critical factor in the scheduled process. This is to prevent situations where H.H.S.T. processing may be operated with a defective or damaged unit while waiting for a replacement thermometer.

1.17.10.01 General Conditions

This thermometer is required for all H.H.S.T. processing systems. It must be clean and in good operating condition. The thermometer shall be mercury actuated or an accepted equivalent, or an approved resistance thermal device (RTD).

Mercury actuated or accepted equivalent thermometers shall be direct reading, and contained in a corrosion resistant case which permits easy observation of column and scale. The filling above the mercury is to be nitrogen or equally suitable gas. The bulb shall be Corning normal or equivalent.

The RTD type must be fail-safe, utilizing two separate RTDs. It must meet the scale and thermometric response specifications. The criteria in Appendix 19-13 - Design Requirements for Digital Thermometers shall be used to evaluate RTDs when used as alternatives to mercury actuated direct reading thermometers.

1.17.10.02 Location/Accessibility

The official indicating thermometer shall be located in the sensing chamber, along with the probe for the S.T.L.R. The indicating thermometer probe should be located after the probe for the S.T.L.R. The distance between the 2 probes should not be more than 30 cm (12 inches). The indicating thermometer must be easily and safely accessible by the operator, to allow accurate reading of the processing temperature.

1.17.10.03 Specifications

The scale shall be graduated in 0.5°C (1°F) divisions with not more than 9.4°C (17°F) per 25 mm (1 inch) of graduated scale.

The stem fitting shall be pressure-tight against the inside wall of the fitting, with no threads exposed to product.

1.17.10.04 Calibration/Records

Records of tests performed to determine the thermometer's calibration shall be maintained in the plant's files. Tests must include temperature accuracy and thermometric response, upon installation and at an interval of at least every 6 months. The frequency of testing should be increased if the calibration is consistently found to be out of adjustment. If the calibration is consistently found to be out of adjustment, the reason for the calibration problems should be immediately identified and rectified

Testing methods shall comply with the required standards, and must show satisfactory follow-up on out of specification findings. Plant management must investigate the safety of the product produced with out of calibration equipment (e.g. if the indicating thermometer at the outlet of the holding tube is reading higher than the calibration standard, the product may have been under processed).

1.7.10.05 Sealed

The access to calibration adjustments must be sealed once the thermometer has been calibrated. The cover or scale plate on mercury in glass (MIG) thermometers should have a seal attached to indicate tampering. The thermometer panel and the RTD sensor housing should be sealed on resistance thermal devices.

1.17.11 Safety Thermal Limit Recorder (S.T.L.R.)

The function of this device is to:

  1. Automatically record the temperature of the product in the sensing chamber on a chart that also indicates the time of day, and provides a record of the process.
  2. Indicate and record the position of FDD (i.e. forward or divert flow).
  3. Supply a temperature cut out signal input to the thermal limit controller unit.

The evaluation of this task could include the review of documents such as:

  1. plant records
  2. testing/calibration documents
  3. scheduled process
  4. ladder logic

1.17.11.01 General Conditions

The S.T.L.R. must meet the criteria established by the manufacturer of the H.H.S.T. systems (industry to supply). Units must be manufactured for S.T.L.R. usage and any modifications must be performed by, or authorized by the manufacturer.

The S.T.L.R. shall be housed in a case that is moisture-proof under normal operating conditions. The S.T.L.R. must be maintained in good condition, and operated as specified by the manufacturer. Any covers preventing access to public health adjustments, such as the divert set-point, must be maintained in place.

The single probe which senses the temperature of the temperature recording pen shall be installed with a pressure-tight seal against the inside wall of the pipe with no threads exposed to milk or milk products.

The S.T.L.R. must be serviced at least once per year and maintained on a continual basis so that the instrument functions according to specifications. Records of service and maintenance must be available in the plant's files.

All switches on the S.T.L.R. and any controls associated with the operation of the H.H.S.T. unit shall be clearly identified. There shall be no switches or devices that could jeopardize the safety of the product by bypassing or overriding any public health controls.

1.17.11.02 Location

The single probe which senses the temperature for both the temperature recording pen and the cut-out control shall be installed in the sensing chamber, before the indicating thermometer probe. The distance between the 2 probes should not be more than 30 cm (12 inches).

1.17.11.03 Specifications

A circular chart shall make one revolution in not more than 12 hours and shall be graduated for a maximum record of 12 hours. Two charts shall be used if operations extend beyond 12 hours.

The chart positive drive mechanism shall be equipped with a system to prevent slippage or manual rotation (e.g. pin to puncture the chart paper). The chart used shall correspond with the chart number displayed on the identification plate of the S.T.L.R.

The chart graduations shall not exceed 1°C (2°F) within a range of 5.5°C (10°F) of the processing temperature. The chart temperature scale shall not exceed 30°C (55°F) per 25 mm (1 inch) within a range of 11°C (20°F) of the processing temperature.

The S.T.L.R. must have a functioning temperature recording pen.

All units must also have a functioning frequency pen. This pen also called the event or divert pen, records the position of the FDD with a line on the outer edge of the chart. The frequency pen is energized by a position detector in the FDD as the FDD moves into forward flow position. The frequency pen is de-energized during diverted flow and it moves down to indicate a divert condition. Some systems may be designed so that the event pen indicates the critical factors required to enable forward or diverted flow. In such cases, the event pen will be de-energized when at least one of those pre-determined critical factors is not met.

These two pens must track together or follow the same time line. On certain models, a reference arc is used to align these two pens.

If the S.T.L.R. requires a third pen, as with a multiple temperature divert unit, this third pen cannot track with the other two. It must be adjusted to lead or follow the other pens by a specified time factor. This value shall be displayed on the S.T.L.R. unit. This ink used in this set-point recording pen should be differentiated from the other two.

1.17.11.04 Thermal Limit Controller Sequence Logic

Since the FDD is located downstream from the regeneration and cooling sections on a H.H.S.T. systems, forward flowFootnote 1 conditions cannot occur until all product contact surfaces from the holding tube to the FDD have been held at or above the required system pasteurization temperature for the time specified in the scheduled process.

The thermal limit controller unit utilizes a sequence of electrical inputs and timers to ensure the H.H.S.T. processing system is pasteurized or sterilized before allowing the FDD to assume the forward flow position.

For indirect heating systems, forward flow can commence only after all conditions identified in the scheduled process have been met which includes requirements that the sensors at the FDD and at the holding tube have reached the required temperature for the necessary length of time specified for system pasteurization/sterilization as per the scheduled process.

In direct heating systems, forward flow can commence only after the sensors located at the holding tube, the coolest part of the vacuum chamber or other coldest points determined by the process authority, and the FDD have reached the required temperature for the necessary time period specified for system pasteurization or sterilization as per the schedule process.

This assures that all parts of the system have been properly pasteurized or sterilized before allowing the FDD to move into the forward flow position. Once the minimum times and temperatures have been satisfied for system pasteurization or sterilization, the two auxiliary controllers (see Task 1.17.13.01) (at the FDD, and at the vacuum chamber on direct heating systems) will then "drop out” of the control loop, and the primary recorder-controller (S.T.L.R.) at the holding tube outlet (sensing chamber) resumes its function for normal product processing temperature control.

Failure to meet any safe forward flow condition, such as temperature below cut out, improper regenerator pressure differential, improper holding tube pressure, loss of predetermined liquid levels at steam infusion chamber exits or loss of differential pressure across the injector, shall cause the FDD to immediately move into the divert flow position, unimpeded by the thermal limit controller unit.

After a diversion event, the FDD shall not resume forward flow until the system is re-pasteurized or re-sterilized and the thermal limit sequence logic is again satisfied as per the scheduled process.

The settings and adjustments for the thermal limit controller unit must be enclosed and sealed to prevent unauthorized tampering.

1.17.11.05 Calibration/Records

The performance accuracy of the S.T.L.R. and thermal limit controller shall be performed upon installation, verified at least once every six months and whenever a seal has been broken. Records of tests to determine accuracy shall be maintained in the plant's files. Tests which should be performed include the following:

  1. Recorder Temperature Accuracy
  2. Recorder Time Accuracy
  3. Cut In/Cut Out
  4. Thermal Limit Controller Sequence Logic
  5. Recording Thermometer Check against Indicating Thermometer: (Daily) The recording thermometer shall not read higher than the corresponding indicating thermometer. Should the recording temperature differ from that of the indicating, necessary measures are taken to correct the situation

1.17.11.06 Sealed

Access to S.T.L.R. cut in/cut out adjustments shall be sealed. The sealing device should provide an indication of tampering or unauthorized adjustment.

The enclosure for the settings and adjustments for the thermal limit controller sequence logic must be sealed to prevent unauthorized adjustment.

1.17.11.07 Programmable Logic Controllers and Computers

Programmable logic controllers or computers installed on an H.H.S.T. processing system for operational convenience and not public health control must meet certain safeguards and tests. The computer may not control any public health function when the system is in processing mode. When in C.I.P. mode, the computer may control any functions when C.I.P. mode is first selected. Non-public health controls, such as product pumps or valves, may be controlled at any time by the computer. The vendor is responsible for providing a testing protocol to verify that public health safeguards are not under the control of the computer during the production cycle.

Computers for the operation of public health controls on H.H.S.T. processors have additional considerations. Computers are different from hard-wired controls in three major areas. To provide adequate public health protection, the design of computerized public health controls must address these three major differences.

First, unlike conventional hard-wired systems, which provide full-time monitoring of the public health controls, the computer performs its tasks sequentially, and the computer may be in real time contact with the FDD for only one millisecond. During the next 100 milliseconds (or however long it takes the computer to cycle once through its tasks), the FDD remains in forward flow, independent of temperature in the holding tube. Normally, this is not a problem because most computers can cycle through 100 steps in their program many times during one second. The problem occurs when the public health computer is directed away from its tasks by another computer, or the computer program is changed, or a seldom used jump, branch, or go to Instruction diverts the computer away from its public health control tasks.

Second, in a computerized system, the control logic is easily changed because the computer program is easily changed. A few keystrokes at the keyboard will completely change the control logic of the computer program. Conversely, hard-wired systems require tools and a technician to make wiring changes. Once the hard-wired system is properly installed and working, it does not change. The problem can be solved by sealing the I/O access to the computer, but some procedure is needed to ensure that the computer has the correct program installed when it is re-sealed.

Finally, some computer experts have stated that no computer program can be written error-free. They were referring primarily to very large programs, with many conditional jumps and branches, with thousands of lines of program code. For these large systems, the programs actually improve with age (the errors are found and corrected under actual conditions of use). For public health controls, the computer program must and can be made error-free, since the programs required for public health control are relatively brief.

If the design of computerized public health controls does address the above mentioned differences, they can be effectively interfaced with conventional hard-wired operating controls and instrumentation. When computers or programmable logic controllers are used in pasteurizing or sterilizing systems, they must be installed in such a manner that public health controls are not circumvented by the computer or programmable logic controller during the product run operations, except as provided for under Appendix 19-5 - Criteria for the Evaluation of Computerized Public Health Controls.

The vendor is responsible for ensuring that their PLC or computer installation complies with the requirements of Appendix 19-5, through documentation and testing.

The responsible regulatory agency shall evaluate the complete documentation of interconnecting wiring, pneumatic controls, applicable programming logic and ladder logic, and results of the testing procedures. This will help to verify compliance with the criteria in Appendix 19-5.

1.17.12 Pressure Differential Recorder Controllers (P.D.C.-recorder)

Proper pressure relationships must exist across all media to prevent contamination of the pasteurized product by raw product, heating medium and cooling medium. Pressure relationships under the following conditions must be considered:

  1. Forward flow
  2. Divert flow
  3. Shutdown

In H.H.S.T. processing systems, failure to maintain a 14 kPa (2 psi) differential between the raw side of the regenerator and the pasteurized side will cause the FDD to assume the divert position. The feed pump operates in both forward flow and diverted flow, as long as the F.C.D. is allowed to run. This is because the pasteurized side of the regenerator and cooling section are always full, since the FDD is located after the cooling section. H.H.S.T. systems require a pressure differential recorder to monitor and record pressures to ensure that proper pressure differential has been maintained in the regenerator.

This task will assess the actual pressure devices used. The appropriate pressure differential is assessed under Regeneration (1.17.05.02) and Cooling Section (1.17.14.02).

Tests are performed upon installation and at least once every 6 months thereafter. Appropriate records must be kept to show proper testing has occurred.

1.17.12.01 General Conditions

The sensors of pressure differential controllers must be clean and in good mechanical condition. The design should allow easy dismantling of the sensors for inspection, and the indicating / recording unit must be housed in an appropriate moisture proof enclosure.

The pressure differential recorder controller shall be inter-wired with FDD such that divert occurs when the pasteurized product pressure in the regenerator is not exceeding, by 14 kPa (2 psi) or greater, the pressure on the raw side of the regenerator. It is considered acceptable to use a legal PLC to control the pressure differential in lieu of a pressure differential controller as long as the same control conditions are respected such as interwiring with FDD, pressure indicating and recording capabilities, set-point indication.

In milk-to-heat transfer medium-to-milk type regenerators, in the pasteurized milk section the heat transfer medium must be under lower pressure by at least 14 kPa (2 psi) than the pasteurized product side at all times.

Pressure gauges may be used to verify the pressure display for the pressure differential recorder controller. Gauges shall be clean and in good condition.

1.17.12.02 Location

Two types of regeneration are used in H.H.S.T. systems, product-to-product regenerators, and product-to-heat transfer medium-to-product regeneration systems. The latter system is often preferred for some products, because it allows more even heat transfer and prevents burn-on.

Product-to-product regenerators shall have the raw product sensor between the feed pump and the raw product inlet to the regenerator. The pasteurized product sensor shall be installed at, or downstream from, the pasteurized product outlet of the regenerator.

Product-to-heat transfer medium-to-product regenerators shall have the raw side pressure sensor in the water loop after the water pump (location of highest media pressure in the loop). The pasteurized side pressure sensor shall be in the product line at the pasteurized side outlet of the regenerator (location of lowest pasteurized product pressure).

1.17.12.03 Specifications

A circular chart shall make one revolution in not more than 12 hours and shall be graduated for a maximum record of 12 hours. Two charts shall be used if operations extend beyond.

The chart positive drive mechanism shall be equipped with a system to prevent slippage or manual rotation (e.g. pin to puncture the chart paper). The chart used shall correspond with the chart number displayed on the identification plate of the pressure differential recorder controller.

The pressure recording unit shall have chart scale divisions not to exceed 14 kPa (2 psi) on the working scale of not more than 140 kPa (20 psi) per 25 mm (1 inch). Pens may be used to record the raw side pressure and the pasteurized side pressure or the pressure differential.

Electronic data collection, storage and reporting of pressure differentials, with or without hard copy printouts, may be acceptable provided the electronically generated records are readily available at the establishment for review by the regulatory agency and meet minimum criteria required for S.T.L.R. charts.

1.17.12.04 Calibration / Records

The accuracy of the pressure display and recorder, and the differential controller divert function, shall be validated at least every six months, and whenever the controller is adjusted or repaired. Pressure gauges, if used, must be checked for accuracy at least once per year.

Records shall be easily available, and must indicate testing results and satisfactory corrective action. Tests must be completed according to the required methods.

1.17.12.05 Sealed

The pressure differential recorder controller/legal panel adjustments must be sealed.

1.17.13 Auxiliary Temperature Recorders/Controllers

These instruments may be used in several locations on the H.H.S.T. processing system, to provide a record of start up pasteurization/sterilization and product processing temperature, and to provide temperature signals to the thermal limit controller unit or other processing controls.

1.17.13.01 General Conditions

The temperature recorder/controller unit shall be clean and in good mechanical condition. It should be moisture-proof under normal operating conditions. The chart positive drive mechanism shall be equipped with a system to prevent slippage and manual rotation (e.g. pin to puncture chart paper). It must also be equipped to produce a continuous permanent record of all pertinent information (i.e. time of day and temperature). The processor is responsible to indicate on the chart recorder the chart part number to be used. Pens should be operational and easily calibrated. The unit should be serviced at least once a year, and records of the servicing kept in the plant's file.

1.17.14 Cooling Section

This section of the pasteurizer uses chilled water and/or glycol to cool the hot product down to packaging and filling temperature. Since the FDD is located downstream from this section, the cooling section may become contaminated with potentially unpasteurized product during divert, and must be re-pasteurized/re-sterilized as part of the thermal limit controller sequence logic after a divert event.

Flash coolers are sometimes installed on the divert line to prevent injury to bystanders if a divert event occurs during the pasteurizing of the holding tube and cooling section, when there is no cooling turned on.

1.17.14.01 General Conditions

The cooling sections must be clean and in good condition. They must be constructed of stainless steel or other corrosion resistant and easily cleanable material. The design should allow easy cleaning, and should not entrap product in crevices, joints, seams or openings. During operation, there should not be any leaks at gaskets, seals, or connections.

A routine program to monitor the condition of plates and tubes (pin holes in plates, gasket condition, cracks, etc.) must be established by plants, taking into consideration the design specifications, operating conditions and hours of operation, wear and the history of the plates and gaskets. The integrity of all food contact heat exchange surfaces must be checked at least once per year by an acceptable method (e.g. dye recirculation, dye check, pressure retention, Helium Testing etc). However, if the plant has experienced problems with heat exchanger integrity (plate or gasket issues), a more frequent inspection program must be implemented to verify that the problem has been remedied. Appropriate records must be kept to show proper testing has occurred. These records should also document the cause of any failure (e.g. age, compression, metal fatigue, etc.). If pin holes are found in any plate in any section then all plates in the same section should be checked.

1.17.14.02 Pressure Differentials

This task will only assess the actual differential of pressure. The equipment used to monitor (gauges) will be assessed under Pressure Differential Controllers/Gauges.

In the cooling section, the system must be designed to maintain pressure on the pasteurized product side of the plates at least 14 kPa (2 psi) higher than on the cooling medium side of the plates during forward flow. During diverted flow and shutdown conditions, higher pressure must be maintained on the pasteurized product side of the plates than on the medium side of the plates. This reduces the possibility of chemical contamination in the event a pinhole leak develops in the plates. Where an establishment does not have an automatic means to correct the pressure relationship as described above, the pressures must be monitored and recorded a minimum of twice daily.

An automated mechanism is the best way to achieve the correct pressure relationship in the cooling section during forward flow, divert and shutdown conditions so that the pressure on the pasteurized product side is greater than the cooling media side. In systems where there is not an automated mechanism the establishment must have a written program which includes the person responsible, what is to be done, how it is to be done, how often it is done (frequency), records to be kept and results of monitoring, verification procedures (both on-site and record review), and actions taken for deviant situations. The program must specify the parameters of acceptability/unacceptability and define the preventative measures taken to prevent the re-occurrence of deviations. The program must include at a minimum:

  1. records of the pressures recorded a minimum of twice a day during production, at beginning and end of run;
  2. microbiological cooling media checks (e.g., Coliforms, Psychrotrophs) at a frequency of at least once per week;
  3. pH testing of cooling media at a frequency of at least once per week;
  4. visual cooling media check at least once per week;
  5. pinhole testing and plate teardowns at a minimum of once every six months; and
  6. plate replacement program.

In the event that the written program does not adequately address the risks or there is failure to implement or follow the program then it will be mandatory for the plant to install an automated mechanism.

Pressure gauges, if used, must be checked for accuracy upon installation and at least once per year. Gauges shall be clean and in good condition. Pressure differential controller sensors, or pressure gauges, shall be located at the cooling media inlet and at the pasteurized product outlet.

1.17.14.03 Cooling Medium

Heating, pre-heating and chilled water media can be a potential source of contamination to the pasteurized product. Chilled water media must be checked at least monthly for microorganisms (e.g. psychrotrophs, coliforms).

Records shall document the safety of any cooling water additives and cooling media products used, as well the microbial testing results.

1.17.15 Homogenizer

The homogenizer is a high pressure pump that produces a homogenized product by reducing the size of fat globules as they are forced through a small orifice under high pressure. Since the homogenizer is a positive pump, it can be utilized as a flow control device. If the homogenizer is utilized as a flow control device, its compliance requirements are to be rated under the Flow Control Device (1.17.06.01 - 1.17.06.03).

1.17.15.01 General Conditions

Filters, homogenization valves, pistons, seat valves, pressure gauges and dead ends must be clean and in good mechanical condition. All product contact surfaces must be stainless steel or other food grade, non-corrosive material. All homogenizers should be equipped with appropriate gauges.

1.17.15.02 Homogenizer Larger Than F.C.D.

This homogenizer must be designed and installed so that the flow rate is not affected. The manufacturer must be able to demonstrate that any homogenizer located downstream does not affect the flow rate (e.g. physical break, pressure sensors in holding tube, F.C.D. is a MBTS, etc.) If a homogenizer located downstream from the flow control device has a capacity greater than the flow control device, then the homogenizer must not be a flow promoter.

One way to achieve this is to have a recirculation line between the inlet (suction line) and the outlet (pressure line) of the homogenizer installed to prevent the homogenizer from "starving". This line shall be unrestricted and shall not contain a shut-off valve, but may contain a check valve allowing flow only from the outlet back to the inlet. The diameter of the recirculation line including the check valve shall be equal or greater than the supply line to the homogenizer.

Other acceptable systems could also achieve this requirement.

The homogenizer must not reduce the holding time, and must not reduce the pressure required in the holding tube to keep the product in the liquid phase.

1.17.16 Surge Tank

The surge tank acts as a pasteurized product balance tank for the fillers. This allows both the fillers and the H.H.S.T. processing system to operate independently.

The surge tank is installed downstream from the FDD. If the surge tank is protected by one or more steam barriers (or other acceptable systems) at the FDD, filling operations may continue from the tank while the H.H.S.T. processing system is in divert. Otherwise, the fillers and surge tanks must also be emptied and re-sanitized after a divert event. (Refer to Appendix 19 - 10).

1.17.16.01 General Conditions

The surge tank and associated valves, thermometers, etc. must be clean and in good condition.

1.17.17 Stuffing Pump

Stuffing pumps may be used to improve the efficiency of other devices, such as homogenizers.

1.17.17.01 General Conditions

Stuffing pumps must be constructed of stainless steel or a suitable corrosion resistant material and must be clean and in good mechanical condition. Painted exterior surfaces must also be clean and in good condition, free of flaking paint and rust.

All pumps not specifically designed for C.I.P. use must be disassembled for cleaning. This includes removal of impellers and back plates for cleaning.

1.17.17.02 Proper Installation/Operation

Product stuffing pumps must be inter-wired with the flow control device electrical operating signal. When the flow control device is prevented from operating, either by the operator or operating system and /or by safety interlocks installed on the system, the stuffing pump and other flow-promoting devices must stop. Stuffing pumps may be configured to start prior to starting the homogenizer, but the F.C.D. must be in an allowed to run condition.

When a stuffing pump is used in an H.H.S.T. processing system it must be installed and operated in such a way that it will not influence the proper pressure relationship within the regeneration section, and it must not reduce the holding time below the required minimum.

If the homogenizer is used as a flow control device, a centrifugal type stuffing pump may be installed between the raw product outlet of the regenerator and the inlet manifold of the homogenizer to supply the desired pressure to the homogenizer.

Tests are performed upon installation, at least once every 6 months thereafter and when micro-switch is re-set or replaced. Appropriate records must be kept to show proper testing has occurred.

1.17.18 Packaging

1.17.18.01 Packaging Conditions

The processor has a program in place to ensure that packaging materials are received and stored in an acceptable manner (refer to Task 1.10.02.01 Transportation and Storage Program). All packaging materials are received and stored in a clean and sanitary manner to minimize the risk of contamination and physical damage to the materials. The handling and loading of the packaging materials from the time they are received into the processing area and when they are in use does not pose a contamination risk (refer to Task 1.10.04.04 Handling of Materials).

All ESL pasteurized products must be stored continuously under refrigeration at a temperature of 4°C or less.

1.17.19 Record Keeping

It is important that the scheduled process be properly established, correctly applied, sufficiently supervised and documented to provide assurance that the requirements have been met. Production records must consist of the operator's packaging/filling production log and the operator's on-line record of critical parameter testing. These records must be maintained on file for at least 1 year or the shelf-life of the product.

1.17.19.01 Packaging Records

A trained operator is responsible for verifying that all critical controls are recorded and meet specifications. Review of records by the responsible individual should be completed before the product is released.

The operator's packaging/filling production log should contain the following information:

  1. date
  2. batch
  3. packaging machine number
  4. product being filled and packaged
  5. source of product (i.e. from surge tank or sterilizer)
  6. preparations taken to bring equipment into packaging readiness, e.g. inspection/repairs/replacements of valves, gaskets, gauges, warning lamps etc.; cleaning, preheating and sterilization steps; pressure and temperature checks.

To ensure product safety and to provide a historical record of the process, the following information should be recorded:

  1. date
  2. hourly filling code
  3. machine number
  4. packaging start time
  5. packaging stop time
  6. machine downtime and reason, corrective action taken to restart
  7. intervals at which teardowns conducted
  8. types of teardowns conducted (i.e. longitudinal seal quality, transversal seal quality), classification of defects observed, corrective action taken
  9. if used, hydrogen peroxide concentration
  10. production volume
  11. unusual occurrences
  12. operator's signature
  13. signature of individual responsible for review
Date modified: