Dairy processing: Aseptic processing and packaging systems
Safety thermal limit recorder (STLR)

General conditions

• The safety thermal limit recorder meets the criteria established by the manufacturer of the device
• Units are manufactured for safety thermal limit recorder usage
  • any modifications are performed by, or authorized by the manufacturer
  • it is housed in a case that is moisture-proof under normal operating conditions
• The safety thermal limit recorder is operated as specified by the manufacturer
• Keep in place any covers preventing access to food safety adjustments, such as the divert set-point
• Install the single probe which senses the temperature for both the temperature recording pen and the cut-in /cut-out control with a pressure-tight seal against the inside wall of the pipe, with no threads exposed to milk or milk products
• Clearly identify all switches on the safety thermal limit recorder and any controls associated with the operation of the aseptic unit
  • there are no switches or devices that could jeopardize the safety of the product by by-passing or over riding any food safety controls
• Service the safety thermal limit recorder at least once per year and maintain it on a continual basis so that the instrument functions according to specifications
  • keep records of service and maintenance on file

Location

• Install the single probe which senses the temperature for both the temperature recording pen and the cut-out control in the sensing chamber, before the indicating thermometer probe
  • the distance between the 2 probes should not be more than 30 cm (12 inches)

Specifications

• Use a circular chart that makes one revolution in not more than 12 hours and that is graduated for a maximum record of 12 hours
  • if operations extend beyond 12 hours, use a 24-hour chart that provides an equivalent level of accuracy and clarity
• Ensure the chart positive drive mechanism is equipped with a system to prevent slippage or manual rotation (for example, a pin to puncture the chart paper)
• Use charts that correspond with the chart number displayed on the identification plate of the safety thermal limit recorder
• Ensure the chart graduations do not exceed 1°C (2°F) within a range of 5.5°C (10°F) of the processing temperature
• Ensure the chart temperature scale does not exceed 30°C (55°F) per 25 mm (1 inch) within a range of 11°C (20°F) of the processing temperature

Temperature recording pen:

• Adjust the pen reading to coincide with that of the indicating thermometer

Frequency (Event or Divert) pen:

This pen records the position of the flow diversion device with a line on the outer edge of the chart. Some systems may be designed so that the event pen indicates the critical factors required to enable forward or diverted flow. In such cases, the event pen will indicate when at least one of those pre-determined critical factors is not met.

The frequency pen tracks with the temperature recording pen or follows the same time line. On certain models, a reference arc is used to align these two pens.

Third pen:

If the safety thermal limit recorder requires a third pen, as with a multiple temperature divert unit, the third pen does not track with the other 2.

• Adjust it to lead or follow the other pens by a specified time factor. Display this value on the safety thermal limit recorder unit
• Use a different colour of ink from that used for the other 2 pens

Thermal limit controller sequence logic

Since the flow diversion device is located downstream from the cooling section on aseptic systems, forward flow cannot occur until all product contact surfaces from the holding tube to the flow diversion device have been held at or above the system sterilization temperature for the time specified in the scheduled process.

The thermal limit controller unit uses a sequence of electrical inputs and timers to ensure the APPS is sterilized before allowing the flow diversion device to assume the forward flow position.

Indirect heating systems

Forward flow does not occur until:

• all conditions identified in the scheduled process are met
• the sensors at the flow diversion device and at the holding tube have reached the temperature and time specified for system sterilization in the scheduled process

Direct heating systems

Forward flow does not occur until:

• the sensors in the following locations have reached the temperature and time specified for system sterilization in the scheduled process:
  • at the holding tube
  • at the coolest part of the vacuum chamber or other coldest point points determined by the person that developed the scheduled process
  • at the flow diversion device

This assures that all parts of the system have been properly sterilized before allowing the flow diversion device to move into the forward flow position. Once the minimum times and temperatures have been satisfied for system sterilization, the 2 auxiliary controllers (see Auxiliary temperature recorders/controllers) at the flow diversion device, and at the vacuum chamber on direct heating systems) will then "drop out" of the control loop, and the primary recorder-controller (safety thermal limit recorder) at the holding tube outlet (sensing chamber) resumes its function for normal product processing temperature control.

Failure to meet any safe forward flow condition causes the flow diversion device to immediately move into the divert flow position, unimpeded by the thermal limit controller unit. For example:

• temperature below cut out
• improper regenerator pressure differential
• improper holding tube pressure
• loss of predetermined liquid levels at steam infusion chamber exits
• loss of differential pressure across the injector

After a diversion event, the flow diversion device does not resume forward flow until the system is re-sterilized and the thermal limit sequence logic is again satisfied.

• Enclose and seal the settings and adjustments for the thermal limit controller unit to prevent unauthorized tampering

Calibration

• Test the performance accuracy of the safety thermal limit recorder and thermal limit controller upon installation, at least once every 6 months and whenever a seal has been broken
• Keep records of tests to determine accuracy on file

Perform the following tests:

• recorder temperature accuracy
• recorder time accuracy
• cut in/cut out
• thermal limit controller sequence logic
• recording thermometer check against indicating thermometer (daily)
  • check that the recording thermometer is not higher than the corresponding indicating thermometer
  • take the necessary corrective measures if the recording temperature differs from that of the indicating thermometer
• use the methods in Critical process test procedures - Thermometers to test the accuracy of thermometers
  • follow-up on out of specification findings
  • investigate the safety of the product produced with out of calibration equipment

Sealed

• Seal the access to safety thermal limit recorder cut in/cut out adjustments
  • the sealing device should provide an indication of tampering or unauthorized adjustment
• Seal the enclosure for the settings and adjustments for the thermal limit controller sequence logic to prevent unauthorized adjustment

Programmable logic controllers and computers

Control of non-food safety functions

Programmable logic controllers or computers installed on APPS for operational convenience (that is, no impact on food safety) should meet the following criteria:

• the computer does not control any food safety function when the system is in processing mode
• when in CIP mode, the computer may control any functions when CIP mode is first selected
• the computer may control non-food safety controls, such as product pumps or valves, at any time
• the vendor provides a testing protocol to verify that food safety safeguards are not under the control of the computer during the production cycle

Control of food safety functions

Computers for the operation of food safety controls on APPS have additional considerations. Computers are different from hard wired controls in 3 major areas. The design of computerized food safety controls needs to address these 3 major areas to provide adequate public health protection.

1. Unlike conventional hard-wired systems, which provide full time monitoring of the food safety controls, the computer performs its tasks sequentially, and the computer may be in real time contact with the flow diversion device for only 1 millisecond. During the next 100 milliseconds (or however long it takes the computer to cycle once through its tasks), the flow diversion device remains in forward flow, independent of temperature in the holding tube. Normally, this is not a problem because most computers can cycle through 100 steps in their program many times during 1 second. The problem occurs when the computer is directed away from its tasks by another computer, or the computer program is changed, or a seldom used Jump, Branch, or Go-to-instruction diverts the computer away from its food safety control tasks.
   • install the computer or PLC in such a manner that food safety controls are not circumvented by the computer or PLC during the product run operations, except as provided for under Appendix D: Criteria for the evaluation of computerized food safety controls
   • the vendor ensures that their PLC or computer installation complies with the criteria in Appendix D: Criteria for the evaluation of computerized food safety controls through documentation and testing
   • keep documentation of interconnecting wiring, pneumatic controls, applicable programming logic and ladder logic, and results of the testing procedures as verification that the system meets the criteria in Appendix D: Criteria for the evaluation of computerized food safety controls
2. In a computerized system, the control logic is easily changed because the computer program is easily changed. A few keystrokes at the keyboard will completely change the control logic of the computer program.
   • seal the access to the computer's programming function
     • ensure that the computer has the correct program installed when it is re-sealed
3. Complicated computer programs have a greater potential to contain errors.
   • keep the computer program simple and of limited scope for food safety controls to help ensure that it is error free