Dairy Establishment Inspection Manual – Chapter 17 - Higher Heat Shorter Time (H.H.S.T.) Processing and Extended Shelf-Life (ESL) Dairy Products
1.17.11 Safety Thermal Limit Recorder (S.T.L.R.)

This page is part of the Guidance Document Repository (GDR).

Looking for related documents?
Search for related documents in the Guidance Document Repository

The function of this device is to:

  1. Automatically record the temperature of the product in the sensing chamber on a chart that also indicates the time of day, and provides a record of the process.
  2. Indicate and record the position of FDD (i.e. forward or divert flow).
  3. Supply a temperature cut out signal input to the thermal limit controller unit.

The evaluation of this task could include the review of documents such as:

  1. plant records
  2. testing/calibration documents
  3. scheduled process
  4. ladder logic

1.17.11.01 General Conditions

The S.T.L.R. must meet the criteria established by the manufacturer of the H.H.S.T. systems (industry to supply). Units must be manufactured for S.T.L.R. usage and any modifications must be performed by, or authorized by the manufacturer.

The S.T.L.R. shall be housed in a case that is moisture-proof under normal operating conditions. The S.T.L.R. must be maintained in good condition, and operated as specified by the manufacturer. Any covers preventing access to public health adjustments, such as the divert set-point, must be maintained in place.

The single probe which senses the temperature of the temperature recording pen shall be installed with a pressure-tight seal against the inside wall of the pipe with no threads exposed to milk or milk products.

The S.T.L.R. must be serviced at least once per year and maintained on a continual basis so that the instrument functions according to specifications. Records of service and maintenance must be available in the plant's files.

All switches on the S.T.L.R. and any controls associated with the operation of the H.H.S.T. unit shall be clearly identified. There shall be no switches or devices that could jeopardize the safety of the product by bypassing or overriding any public health controls.

1.17.11.02 Location

The single probe which senses the temperature for both the temperature recording pen and the cut-out control shall be installed in the sensing chamber, before the indicating thermometer probe. The distance between the 2 probes should not be more than 30 cm (12 inches).

1.17.11.03 Specifications

A circular chart shall make one revolution in not more than 12 hours and shall be graduated for a maximum record of 12 hours. Two charts shall be used if operations extend beyond 12 hours.

The chart positive drive mechanism shall be equipped with a system to prevent slippage or manual rotation (e.g. pin to puncture the chart paper). The chart used shall correspond with the chart number displayed on the identification plate of the S.T.L.R.

The chart graduations shall not exceed 1°C (2°F) within a range of 5.5°C (10°F) of the processing temperature. The chart temperature scale shall not exceed 30°C (55°F) per 25 mm (1 inch) within a range of 11°C (20°F) of the processing temperature.

The S.T.L.R. must have a functioning temperature recording pen.

All units must also have a functioning frequency pen. This pen also called the event or divert pen, records the position of the FDD with a line on the outer edge of the chart. The frequency pen is energized by a position detector in the FDD as the FDD moves into forward flow position. The frequency pen is de-energized during diverted flow and it moves down to indicate a divert condition. Some systems may be designed so that the event pen indicates the critical factors required to enable forward or diverted flow. In such cases, the event pen will be de-energized when at least one of those pre-determined critical factors is not met.

These two pens must track together or follow the same time line. On certain models, a reference arc is used to align these two pens.

If the S.T.L.R. requires a third pen, as with a multiple temperature divert unit, this third pen cannot track with the other two. It must be adjusted to lead or follow the other pens by a specified time factor. This value shall be displayed on the S.T.L.R. unit. This ink used in this set-point recording pen should be differentiated from the other two.

1.17.11.04 Thermal Limit Controller Sequence Logic

Since the FDD is located downstream from the regeneration and cooling sections on a H.H.S.T. systems, forward flowFootnote 1 conditions cannot occur until all product contact surfaces from the holding tube to the FDD have been held at or above the required system pasteurization temperature for the time specified in the scheduled process.

The thermal limit controller unit utilizes a sequence of electrical inputs and timers to ensure the H.H.S.T. processing system is pasteurized or sterilized before allowing the FDD to assume the forward flow position.

For indirect heating systems, forward flow can commence only after all conditions identified in the scheduled process have been met which includes requirements that the sensors at the FDD and at the holding tube have reached the required temperature for the necessary length of time specified for system pasteurization/sterilization as per the scheduled process.

In direct heating systems, forward flow can commence only after the sensors located at the holding tube, the coolest part of the vacuum chamber or other coldest points determined by the process authority, and the FDD have reached the required temperature for the necessary time period specified for system pasteurization or sterilization as per the schedule process.

This assures that all parts of the system have been properly pasteurized or sterilized before allowing the FDD to move into the forward flow position. Once the minimum times and temperatures have been satisfied for system pasteurization or sterilization, the two auxiliary controllers (see Task 1.17.13.01) (at the FDD, and at the vacuum chamber on direct heating systems) will then "drop out” of the control loop, and the primary recorder-controller (S.T.L.R.) at the holding tube outlet (sensing chamber) resumes its function for normal product processing temperature control.

Failure to meet any safe forward flow condition, such as temperature below cut out, improper regenerator pressure differential, improper holding tube pressure, loss of predetermined liquid levels at steam infusion chamber exits or loss of differential pressure across the injector, shall cause the FDD to immediately move into the divert flow position, unimpeded by the thermal limit controller unit.

After a diversion event, the FDD shall not resume forward flow until the system is re-pasteurized or re-sterilized and the thermal limit sequence logic is again satisfied as per the scheduled process.

The settings and adjustments for the thermal limit controller unit must be enclosed and sealed to prevent unauthorized tampering.

1.17.11.05 Calibration/Records

The performance accuracy of the S.T.L.R. and thermal limit controller shall be performed upon installation, verified at least once every six months and whenever a seal has been broken. Records of tests to determine accuracy shall be maintained in the plant's files. Tests which should be performed include the following:

  1. Recorder Temperature Accuracy
  2. Recorder Time Accuracy
  3. Cut In/Cut Out
  4. Thermal Limit Controller Sequence Logic
  5. Recording Thermometer Check against Indicating Thermometer: (Daily) The recording thermometer shall not read higher than the corresponding indicating thermometer. Should the recording temperature differ from that of the indicating, necessary measures are taken to correct the situation

1.17.11.06 Sealed

Access to S.T.L.R. cut in/cut out adjustments shall be sealed. The sealing device should provide an indication of tampering or unauthorized adjustment.

The enclosure for the settings and adjustments for the thermal limit controller sequence logic must be sealed to prevent unauthorized adjustment.

1.17.11.07 Programmable Logic Controllers and Computers

Programmable logic controllers or computers installed on an H.H.S.T. processing system for operational convenience and not public health control must meet certain safeguards and tests. The computer may not control any public health function when the system is in processing mode. When in C.I.P. mode, the computer may control any functions when C.I.P. mode is first selected. Non-public health controls, such as product pumps or valves, may be controlled at any time by the computer. The vendor is responsible for providing a testing protocol to verify that public health safeguards are not under the control of the computer during the production cycle.

Computers for the operation of public health controls on H.H.S.T. processors have additional considerations. Computers are different from hard-wired controls in three major areas. To provide adequate public health protection, the design of computerized public health controls must address these three major differences.

First, unlike conventional hard-wired systems, which provide full-time monitoring of the public health controls, the computer performs its tasks sequentially, and the computer may be in real time contact with the FDD for only one millisecond. During the next 100 milliseconds (or however long it takes the computer to cycle once through its tasks), the FDD remains in forward flow, independent of temperature in the holding tube. Normally, this is not a problem because most computers can cycle through 100 steps in their program many times during one second. The problem occurs when the public health computer is directed away from its tasks by another computer, or the computer program is changed, or a seldom used jump, branch, or go to Instruction diverts the computer away from its public health control tasks.

Second, in a computerized system, the control logic is easily changed because the computer program is easily changed. A few keystrokes at the keyboard will completely change the control logic of the computer program. Conversely, hard-wired systems require tools and a technician to make wiring changes. Once the hard-wired system is properly installed and working, it does not change. The problem can be solved by sealing the I/O access to the computer, but some procedure is needed to ensure that the computer has the correct program installed when it is re-sealed.

Finally, some computer experts have stated that no computer program can be written error-free. They were referring primarily to very large programs, with many conditional jumps and branches, with thousands of lines of program code. For these large systems, the programs actually improve with age (the errors are found and corrected under actual conditions of use). For public health controls, the computer program must and can be made error-free, since the programs required for public health control are relatively brief.

If the design of computerized public health controls does address the above mentioned differences, they can be effectively interfaced with conventional hard-wired operating controls and instrumentation. When computers or programmable logic controllers are used in pasteurizing or sterilizing systems, they must be installed in such a manner that public health controls are not circumvented by the computer or programmable logic controller during the product run operations, except as provided for under Appendix 19-5 - Criteria for the Evaluation of Computerized Public Health Controls.

The vendor is responsible for ensuring that their PLC or computer installation complies with the requirements of Appendix 19-5, through documentation and testing.

The responsible regulatory agency shall evaluate the complete documentation of interconnecting wiring, pneumatic controls, applicable programming logic and ladder logic, and results of the testing procedures. This will help to verify compliance with the criteria in Appendix 19-5.

Date modified: