Dairy Establishment Inspection Manual – Chapter 11 - HTST Pasteurization Tasks
This page is part of the Guidance Document Repository (GDR).
Looking for related documents?
Search for related documents in the Guidance Document Repository
1.11.01 HTST System Flow Schematic
The dairy industry has adopted many innovations in food engineering to automate the process. Often, when automated systems are used, modifications or additions to pipeline configurations and installation of automated valves are required. Even slight modifications made to the HTST pasteurization system or Clean-In-Place (CIP) system may have an impact on its processing operation and its safety.
This task will evaluate flow schematic of only HTST pasteurizer system, that is to say, from constant level tank to finished product storage tanks.
1.11.01.01 Up-to-date and Accurate
Plant management must have a flow schematic outlining the pasteurization system which is maintained and kept in the plant's file. When equipment and/or pipelines are installed or changed, plant management must ensure that the flow schematic is up-dated. All components of the HTST pasteurizer system (e.g. thermometers, vacuum breaks, recirculation lines, divert lines, leak detect lines, etc.) must be on the flow schematic.
1.11.01.02 No Cross Connections
A cross-connection is a direct connection allowing one material to contaminate another. There needs to be a complete segregation of incompatible products such as raw materials and pasteurized or sterilized food products, cleaning products and food products (including potable water) and waste materials or utility materials and food products, as outlined under task 1.10.01.02. Consideration also needs to be given to preventing inadvertent cross contamination of independent food products (e.g. soy beverages and milk) which may pose allergenic concerns.
For acceptable segregation between raw and pasteurized or sterilized dairy products refer to the specific requirements in Chapters 11, 12, 13, 14 and 17.
For other applications (CIP supply lines and return line circuits used for CIP cleaning and "mini-washes" on tanks, lines, pasteurizers or other equipment that may be washed while connected to product lines containing milk products or potable water and lines for final rinse), this segregation must be accomplished by the use of separate pipelines and vessels for incompatible products and establishing effective physical breaks at connection points by at least one of the following arrangements: physical disconnecting of pipelines, double block and bleed valve arrangements, double seat (mix proof) valves, aseptic barriers, or other equally effective systems. Refer to Appendix 10 for assessment of these applications.
Attention must also be paid to the design of the constant level tank and inlet piping and the flow diversion device (FDD) area and product piping, as these are areas where potential cross-connections could exist if the design or installation is improper. Tasks 1.11.03.04, 1.11.03.05 and 1.11.09.06 provide more details for the evaluation of these tasks.
Plant management must ensure that equipment and/or pipelines are not installed in a manner that will jeopardize the integrity of the pasteurization or CIP systems, resulting in cross-connections or pasteurization problems. Plant management must thoroughly review and approve all proposed installations. "Minor changes" such as pumps or pipelines must also be reviewed and approved. It is recommended that the plant colour code the pipelines to distinguish between finished product, raw product, CIP lines and other utilities. This will help in the identification of product flow and cross-connections.
An "envelope" method may be used to identify cross-connections between raw and pasteurized products. A physical verification by the inspector must be done to verify if the schematic is accurate and to ensure that no cross connections exist. Even if the plant does not have a schematic on file, an assessment for cross connections must be done.
1.11.02 Critical Control Records
The term pasteurization with respect to dairy products means that every particle of milk has been heated at a temperature and for a time sufficient to destroy all pathogenic types of microorganisms present.
The pasteurization records contain all the required processing information and indicate if the products have been adequately pasteurized. To adequately assess this task, all recording charts for all products should be available for review. Select records randomly for a week or month for each product and evaluate.
1.11.02.01 Temperature and Time Requirements
Temperature and time are critical factors required to achieve pasteurization. Failure to achieve pasteurization could result in a microbiological hazard in the dairy products.
Milk Based Products - below 10% milk fat (fluid milk, goat milk, whey):
72°C for 15 seconds
Milk Based Products - 10% milk fat or higher, or added sugar (fluid cream, cream for butter, chocolate milk, flavoured milk, etc.):
75°C for 15 seconds
Frozen Dairy Product Mixes, Egg Nog:
80°C for 25 seconds
83°C for 15 seconds
In order to convert the above temperatures from Celsius to Fahrenheit use the following formula:
°F = (°C x 9/5) + 32
Note: In the event that Provincial regulations differ from the above and are tighter they must be met.
Any equivalent time-temperature process reviewed by Health Canada and found to meet the requirements of the Food and Drug Regulations - B.08.002.2(1) with respect to the reduction of alkaline phosphatase activity may be used.
Any time-temperature process required under provincial regulations is acceptable.
1.11.02.02 Process Control Records
Process control records should be part of the quality assurance program. This information must be recorded in ink to provide a permanent record. Since this information provides a processing record, it will assist the plant in tracking down quality and safety problems and prevent recall of their products. As these records are the only historical record of exact happenings of the pasteurization of each product it is very important that they adequately and accurately reflect the heating process. The process control record must be replaced daily. It is also critical that the operator notes any unusual occurrences, reasons for and time of occurrence. The process control record(s) is the legal record of the pasteurization process. The process control record(s) must be reviewed on a timely basis by a designated person responsible to the plant management.
Process control records for pasteurizers shall provide the following data on every twelve hour record:
- Plant name and address or registration number
- Date, shift and batch number where applicable
- Safety Thermal Limit Recorder identification when more than one is used
- Product type and amount of product processed (may be recorded in production records)
- Identification of CIP cleaning cycles, "mini-wash" cycles (if used)
- Corresponding indicator thermometer reading during processing. This reading must never be lower than the recording thermometer reading
- Record of product cut-in and cut-out indicating thermometer temperatures (cut-in temperature is the temperature at which the divert valve of the flow diversion device starts to move to forward flow position. Cut-out temperature is the temperature at which the flow diversion device moves to divert position) at the beginning of the production and when a new divert temperature is selected. On production runs greater then 12 hours, the cut-in and cut-out is not required to be done again when the chart is changed
- Record of the time during which the flow-diversion device is in the forward flow position. The event pen-arm records this information on the outer edge of the chart
- Operators comments and reasons for all unusual occurrences
- Signature or initials of operator
In addition, for a pasteurizer system equipped with a Meter Based Timing System as a flow control device, flow records shall contain the following information on every 12 hour record:
- Plant name and address or registration number
- Pasteurizer number
- Product processed
- Frequency or event pen information (the duration of any alarm situation)
- Synchronized flow control chart time with STLR chart
- Signature and initials of the operator
- Record of any unusual occurrences
There shall be no evidence of overlapping of recordings on the processing records.
1.11.02.03 Retention of Process Control Records
All pertinent processing records should be retained as part of the quality assurance program. These records will assist the plant and regulatory agencies to determine if the products were adequately pasteurized. The time-frame for retention is as follows:
- A one year period minimum
- As determined by the responsible regulatory agency, or
- Until the finished product has been consumed (if more than one year)
1.11.03 Constant Level Tank (CLT)
The constant level tank (CLT) is a reservoir for supply, at atmospheric pressure, of raw or recirculated product to the pasteurizer to permit continuous operation of the HTST pasteurization system. The constant level tank is located at the start of the pasteurization system. The constant level tank controls the milk level and provides a uniform head pressure to the product leaving the tank.
The constant level tank shall be of such design and capacity that air will not be drawn into the pasteurizer with the product when the flow control device is operating at maximum sealed capacity. Air in the pasteurizer may allow the milk particles to move more rapidly through the system. Appendix 3 illustrates some possible CLT designs.
1.11.03.01 General Conditions
The tank and all components (except cover) shall be constructed of stainless steel and be in good mechanical and sanitary condition. The tank's design features will be assessed under the subsequent tasks.
The tank shall be of such design and capacity that air shall not be drawn in the pasteurizer with the product when operating at the maximum sealed capacity of the flow control device. The constant level tank shall therefore be fabricated so that the raw product will drain to the outlet before the outlet becomes uncovered. One method of complying with this requirement is to have the bottom of the tank pitched to the outlet at a minimum downward slope of at least 2% (0.2 cm per 10 cm) and the top of the outlet pipe lower than the lowest point in the tank (see Appendix 3).
The tank shall be fitted with a removable cover or inspection port with a removable cover of suitable design to maintain atmospheric pressure and to minimize the risk of contamination. The cover shall be pitched to an outside edge to provide drainage. All openings in the cover shall be flanged upwards and covered. Pipelines entering through the cover (excluding directly clamped lines) shall be fitted with a sanitary umbrella deflector that overlaps the edges of the opening and is located as close to the tank cover as practical. The cover shall be used during processing.
1.11.03.04 Overflow (point and diameter)
The overflow point of the constant level tank shall be lower than the lowest product level in the regenerator. A satisfactory overflow point is the rim of the tank (if not tight fitting with cover - refer to Appendix 3) or the top of an overflow outlet below the rim.
The overflow outlet below the rim, if present, must have a diameter at least twice the diameter of the largest raw product inlet pipe connected to the constant level tank.
The leak detect, divert, CIP line/spray ball, water and milk recycle lines must be designed to prevent siphonage of raw milk or cleaning products into pasteurized milk or water lines. This is accomplished by ensuring that the lines terminate and break to atmosphere at least two times the diameter of the largest return line above the maximum overflow point of the constant level tank.
1.11.03.06 Level Control Device
This device is required to control the flow of milk to the constant level tank and therefore provide constant head pressure to the product leaving the tank.
The constant level tank shall be equipped with an automatic device of sanitary design and construction to control the raw product level.
1.11.04 Booster Pump
A raw product booster pump may be installed in a conventional HTST pasteurization system under specific provisions. The booster pump is utilized to supplement the flow control device in moving raw milk from the constant level tank through the regeneration section. It may be used to remove excessive vacuum, and subsequent flashing or vaporization, in the regenerator section (particularly when the CLT is located an unusual distance from the timing pump).
1.11.04.01 General Conditions
A booster pump must be a centrifugal pump of sanitary design. The pump must be clean and in good mechanical condition. Positive displacement pumps, e.g. lobe-rotor pumps, piston pumps, etc., are not acceptable in this type of application as they are not designed to allow the product to drain freely from the regeneration plates back to the CLT and could result in a higher pressure on the raw product side of the regeneration section during shutdown.
The raw product side of the regenerator may be by-passed when the booster pump is not in operation (e.g. during start-up of the system). This by-pass permits the cold product to be drawn directly to the flow control device from the constant level tank. When the required conditions (i.e. flow control device operating, flow diversion device in forward flow and product pressure in the pasteurized regenerator section) meet the requirements, the booster pump will start to operate, feeding raw product to the regenerator. The by-pass line, which may be manually or automatically controlled by a valve, is not normally used when the booster pump is in operation. Entrapment of the product in the by-pass line during periods when the booster pump is in operation shall be precluded by:
- Close-coupled by-pass connections.(i.e. as close as possible; approximately 2.5 times the pipe diameter)
- Design of the manually or automatically controlled valve which will permit a slight movement of product through the by-pass line
- Other equally effective system
The start-up by-pass valve can only control the flow through this by-pass line and shall not interfere with the free draining of the raw regeneration to the constant level tank.
When a booster pump is incorporated into the HTST system, it is located between the constant level tank and the inlet to the raw product side of the regenerator.
A booster pump may only be used in conjunction with a pressure differential controller and shall be inter-wired in such a way that it can only operate when:
- Flow control device is operating
- There is proper pressure differential in the regenerator section i.e. pasteurized product pressure in the regenerator exceeds the raw product side by at least 14 kPa (2 psi)
- Flow diversion device is in the forward flow position
The inter-wiring of the booster pump must be tested upon installation and at least every 6 months thereafter and after any change in the booster pump or switch circuits occurs. Appropriate records must be kept to show proper testing has occurred.
Typically, the regeneration section is that part of a HTST unit where the cold raw product is warmed by hot pasteurized product flowing in a counter current direction on the opposite sides of thin stainless steel plates. The pasteurized product will in turn, be partially cooled.
The basic requirements for the regeneration section are:
- Have a free draining capability
- Be installed and operated in such a way that the proper pressure relationship exists between the raw and pasteurized product in all the modes of operation, i.e. forward flow, diverted flow and shutdown
- No cracks or pinholes
1.11.05.01 General Conditions
Since the physical distance between the various liquids in the pasteurization plates is extremely small, the liquids have the potential to move through the plates and cross-contaminate the product if pin holes exist.
The plates shall be of sanitary design, constructed of stainless steel or other corrosion resistant material, and must be without pin holes. The plates must be clean with no presence of milk remnants, milk-stone, mineral scale build-up, or foreign materials. The plate gaskets must be equipped with leakage grooves, be in good condition and must not be compressed or otherwise show signs of wear. During operation the pasteurizer must not leak at the plate gaskets.
A routine program to monitor the condition of plates (pin holes in plates, gasket condition, cracks, etc.) must be established by plants, taking into consideration the design specifications, operating conditions and hours of operation, wear and the history of the plates and gaskets. The integrity of all food contact heat exchange surfaces must be checked at least once per year by an acceptable method (e.g. dye recirculation, dye check, pressure retention, etc.). However, if the plant has experienced problems with heat exchanger integrity (plate or gasket issues), a more frequent inspection program must be implemented to verify that the problem has been remedied. Appropriate records must be kept to show proper testing has occurred. These records should also document the cause of any failure (e.g. age, compression, metal fatigue, etc.). If pin holes are found in any plate in any section then all plates in the same section should be checked.
1.11.05.02 Shut-down Capability
The unit must be designed with the raw product inlet to the regenerator at the lowest point of the raw regeneration section. Second regenerators of a dual regeneration system may have inlet at the top or bottom. The outlet could also be at the lowest point as long as it is free draining to the balance tank.
The raw product deflector plates shall have a hole drilled to allow for free drainage of the raw product in the regenerator back to the constant level tank in the event of a shut down. Each deflector plate which carries raw product in the regeneration section must have a hole at least 1.59 mm (0.0625 inch) in size at the bottom of the plate. When Provincial regulations are tighter, they must be met. If two deflector plates are back to back, the upstream hole must be large enough to allow for CIP cleaning. When the system is shut down, the raw milk will flow back to the constant level tank. Vent holes may also be drilled in the upper corners of the deflector plates to assist drainage of the raw product. The free drainage of the milk back to the constant level tank will be guaranteed only if there are no valves or pumps that block the flow in the shutdown mode. For dual regeneration systems, there shall also be provision for free drainage from the second stage regenerator during shutdown. This may be accomplished by draining the system from the second stage regenerator inlet or outlet.
In some situations a flow control valve may be located between the booster pump and the inlet to the raw regenerator. In order to keep the raw regenerator free draining, this valve if pneumatically operated must be normally open and if manually operated, it must be modified to prevent full closure.
1.11.05.03 Pressure Differentials
This task will only assess the differential of pressure. Systems without a booster pump must have an appropriate system layout (e.g. system where milk is drawn through the raw regenerator by the positive displacement pump and pushed under pressure through the remainder of the system) to assure the proper pressure differential. The equipment used to monitor and control (PDC's and gauges) will be assessed under Pressure Differential Controllers and Gauges.
As previously discussed, raw milk and pasteurized milk are separated in the regenerator section only by thin metal plates and a system of gaskets. The raw side of the regenerator must, at all times, be under lower pressure, at least 14 kPa or 2 psi than the pasteurized milk. In the event of metal or gasket leakage, pasteurized milk will leak into raw milk passages, and not vice-versa. The maintenance of this pressure relationship must be safeguarded during periods of start-up operation and shutdown. Failure to maintain the required pressure differential in any section of the regenerator shall cause all flow promoting devices upstream of any raw regeneration section to be de-energized or isolated from the system.
In milk-to-heat transfer medium-to-milk type regenerators, the pasteurized milk section must be under greater pressure by at least 14 kPa (2 psi) than the heat transfer medium at all times. The protection is on the pasteurized milk side of the system and is engineered to allow pasteurized product to leak into the heat transfer medium in case of regenerator plate or tubular failures. In this type of system, the heat transfer medium (e.g. hot water) must be from a safe source. Location of the pressure sensors for these controls are:
- At the heat transfer medium inlet on the pasteurized side of the regenerator and
- At the pasteurized product outlet of the regenerator
Failure to maintain the required pressure differential in the pasteurized milk section of the regenerator shall cause all flow promoting devices upstream of any raw regeneration section to be de-energized or isolated from the system and vented to the atmosphere.
1.11.06 Flow Control Device (FCD)
This task governs the uniform rate of flow through the holding tube so that every particle of product is held for the legal minimum period of time. This device is a positive displacement type pump (may be a homogenizer). Other equally effective mechanisms such as a Meter Based Timing System (MBTS) with proper components (pump or flow control valve, relays, alarms and flow recorder) may also be used as a flow control device. Refer to Appendix 4 for more information on this task.
1.11.06.01 General Conditions
The flow control device must be constructed of stainless steel and be in good mechanical and sanitary condition. There must be no back-flow through the flow control device in the event of a system shut-down. The driving mechanism shall be designed so that in the case of wear, belt stretch, etc. the capacity will not increase. The flow control device cannot be excluded from the system during operation of the HTST pasteurizer. The device must be located upstream from the holding tube and normally it is located between the outlet of the raw regeneration section and the inlet of the heater section of the HTST pasteurizer.
The flow control device is the heart of the HTST pasteurizer, and every effort must be exerted to maintain it in proper operating order from both an efficiency and food safety standpoint.
1.11.06.02 Set and Sealed
The maximum operating capacity of the flow control device shall be such to ensure an adequate holding time in accordance with 1.11.08.01 - 1.11.08.06 - Holding.
When separators and/or homogenizers are located within the HTST set up, timing evaluations shall be made with these pieces of equipment operating (with no valve pressure on the homogenizer) and by-passed to determine the fastest flow rate (minimum holding time). When vacuum equipment (as part of flavour control equipment) is located downstream from the flow diversion device, the holding time shall be determined with the timing pump operating at maximum capacity, and the vacuum equipment operating at maximum vacuum.
If maximum speed gives legal holding time, a seal is not necessary, but, if the device is of the variable speed type or single speed (but capable of being altered, belt and pulleys changed), for example a homogenizer, it must be sealed at an established flow rate to prevent operation at a greater capacity than that which gives legal holding time.
Any change in the line resistance of the system after maximum speed of the pump has been set will alter the holding time. Increasing the line resistance by the additions of plates or piping will increase the holding time. This increase in flow resistance in effect reduces the efficiency of the pasteurizer. Decreasing the line resistance by the removal of plates, pipes, or auxiliary units will decrease the holding time. Wear of the drive belts and pump impellers due to normal operation will gradually decrease the rate of flow through the system, thereby increasing the holding time.
The holding time is to be evaluated and re-sealed (if necessary) upon installation and annually thereafter, and in addition, whenever the seal on speed setting is broken, whenever any alteration is made affecting the holding time, the velocity of the flow (such as replacement of pump, motor, belt, driver or driven pulleys, or addition or removal in the number of HTST plates, pipes or auxiliary units) or the capacity of the holding tube or whenever a check of the capacity indicates a speed up. If the establishment's records indicate that the belts on the timing pump were in new condition when the original holding time was evaluated then it would not be necessary for an establishment to re-evaluate the holding time when the belts are being replaced as part of regular maintenance. Records of alteration and re-evaluation of the system must be kept in the plant's file.
1.11.06.03 Fail Safe (Operation) Capability
All flow control devices must be inter-wired with the flow diversion device (FDD) and safety thermal limit recorder (STLR) micro-switches. This fail-safe wiring ensures that the flow control device only operates when the flow diversion device is in the safe forward flow or fully diverted mode. Safe forward flow is a condition where the temperature of the product is above the divert set point, and the flow control device is energized by the STLR or the legal PLC. Fully diverted refers to the FDD valve(s) being properly seated in the divert position so that the microswitch(es) will then energize the FCD. In the case of a dual stem flow diversion device, this applies to both the leak detect and the divert valves.
The operation and proper assembly of the FDD must be evaluated upon installation, at least once every 6 months thereafter and whenever the microswitch is re-set or replaced. Appropriate records must be kept to show proper testing has occurred.
All other flow promoting devices in the system (e.g. booster pump, stuffing pump etc.) are interwired with the flow control device. In the event that the flow control device is de-energized, all flow promoting devices in the system must be stopped or by-passed.
Two factors would prevent the flow control device from operating:
- Malfunction or improper assembly of FDD
- "Inspect" mode selected on FDD panel
If the positive displacement pump is equipped with a by-pass line, it must not be used during processing.
If the homogenizer is used as the flow control device, there must not be a by-pass (recirculation line) around the homogenizer during processing. A by-pass may be present for CIP purposes but dismantled and removed during processing. To ensure that no by-pass is present during processing a proximity switch must be utilized so that the FDD will not operate in forward flow.
A time delay relay may be installed to permit the flow control device (any acceptable type) to continue operating during the normal time it takes for the flow diversion device to move from forward flow to diverted flow. This type of time delay relay is most common when homogenizers are used as flow control device. The time delay shall not be more than one second.
Appendix 4 describes the requirements for the Meter Based Timing System. When a Meter Based Timing System replaces the positive displacement flow control device, it must be evaluated upon installation and at least once every 6 months thereafter, whenever seal on the flow alarm is broken, whenever any alteration is made affecting the holding time, the velocity of the flow or the capacity of the holding tube or whenever a check of the capacity indicates a speed-up. Appropriate records must be kept to show proper testing has occurred.
1.11.07 Heating and Cooling
The heating section of the HTST pasteurizer provides rapid, uniform and controlled heating of the product up to pasteurization temperature. The raw product is usually forced through this section by the flow control device.
1.11.07.01 General Conditions - Heating
The heating plates shall be of sanitary design, constructed of stainless steel or other corrosion resistant material and must be without any pin holes in the plates.
A routine program to monitor the condition of plates (pin holes in plates, gasket condition, cracks, etc.) must be established by plants, taking into consideration the design specifications, operating conditions and hours of operation, wear and the history of the plates and gaskets. The integrity of all food contact heat exchange surfaces must be checked at least once per year by an acceptable method (e.g. dye recirculation, dye check, pressure retention. Helium testing etc.). However, if the plant has experienced problems with heat exchanger integrity (plate or gasket issues), a more frequent inspection program must be implemented to verify that the problem has been remedied. Appropriate records must be kept to show proper testing has occurred. These records should also document the cause of any failure (e.g. age, compression, metal fatigue, etc.). If pin holes are found in any plate in any section then all plates in the same section should be checked.
The surface of the plates on the heating medium side must be free of excessive mineral scale build-up that impedes heating. The medium side and the product side of the heating plates shall be free of gasket pieces and other foreign debris that might accumulate there.
The gaskets of the heating plates must be equipped with leakage grooves, in good condition and must not be compressed or otherwise show signs of wear. During operation the heating section must not leak at the plate gaskets.
1.11.07.02 Heating Medium
Steam used as a heating medium shall be free of harmful substances or extraneous matter. Boiler and water treatment chemicals and other additives used must be dairy safe and approved for dairy plant purposes.
The cooling section of the HTST pasteurizer uses chilled water and/or glycol to provide rapid, uniform and controlled cooling of the pre-cooled pasteurized product coming from the pasteurized regenerator section.
When assessing this task it is important to know that in some installations (e.g. cheese plants), the cooling section is excluded. Since milk for cheese making is usually not cooled, the HTST unit may not have a cooling section. If this is the case tasks 1.11.07.03 - 1.11.07.05 will not apply.
1.11.07.03 General Conditions - Cooling
The cooling plates shall be of sanitary design, constructed of stainless steel or other corrosion resistant material and must be without any pin holes in the plates.
A routine program to monitor the condition of plates (pin holes in plates, gasket condition, cracks, etc.) must be established by plants, taking into consideration the design specifications, operating conditions and hours of operation, wear and the history of the plates and gaskets. The integrity of all food contact heat exchange surfaces must be checked at least once per year by an acceptable method (e.g. dye recirculation, dye check, pressure retention, helium testing etc.). However, if the plant has experienced problems with heat exchanger integrity (plate or gasket issues), a more frequent inspection program must be implemented to verify that the problem has been remedied. Appropriate records must be kept to show proper testing has occurred. These records should also document the cause of any failure (e.g. age, compression, metal fatigue, etc.). If pin holes are found in any plate in any section then all plates in the same section should be checked.
The surface of the plates on the cooling medium side must be free of excessive mineral scale build-up that impedes cooling. The medium side and the product side of the cooling plates shall be free of gasket pieces and other foreign debris that might accumulate there.
The gaskets of the cooling plates must be equipped with leakage grooves, in good condition and must not be compressed or otherwise show signs of wear. During operation the cooling section must not leak at the plate gaskets.
1.11.07.04 Pressure Differentials and Cooling
This task will only assess the actual differential of pressure. The equipment used to monitor (gauges) will be assessed under Pressure Differential Controllers / Gauges.
In the cooling section, the system must be designed to maintain pressure on the pasteurized product side of the plates at least 14 kPa (2 psi) higher than on the cooling medium side of the plates during forward flow. During diverted flow and shutdown conditions, higher pressure must be maintained on the pasteurized product side of the plates than on the medium side of the plates. This reduces the possibility of chemical contamination in the event a pinhole leak develops in the plates. The pressure relationships between the pasteurized product and the cooling medium are monitored and recorded daily. Where an establishment does not have an automatic means to correct the pressure relationship as described above, the pressures must be monitored and recorded a minimum of twice daily.
An automated mechanism is the best way to achieve the correct pressure relationship in the cooling section during forward flow, divert and shutdown conditions so that the pressure on the pasteurized product side is greater than the cooling media side. In systems where there is not an automated mechanism the establishment must have a written program which includes the person responsible, what is to be done, how it is to be done, how often it is done (frequency), records to be kept and results of monitoring, verification procedures (both on-site and record review), and actions taken for deviant situations. The program must specify the parameters of acceptability/unacceptability and define the preventative measures taken to prevent the re-occurrence of deviations. The program must include at a minimum:
- Records of the pressures recorded a minimum of twice a day during production, at beginning and end of run
- Microbial cooling media checks (e.g. coliforms, psychrotrophs) at a frequency of at least once per week
- pH testing of cooling media at a frequency of at least once per week
- Visual cooling media check at least once per week
- Pinhole testing and plate teardowns at a minimum of once every six months
- Plate replacement program
In the event that the written program does not adequately address the risks or there is failure to implement or follow the program then it will be mandatory for the plant to install an automated mechanism.
Where there is an automatic mechanism the cooling medium supply shall be stopped or diverted and the cooling medium side vented to atmosphere in the following cases:
- During forward flow, when the product pressure on the pasteurized product side drops to within 2 psi of the cooling medium side of the plates and
- During diverted flow and shutdown conditions
If a product vacuum breaker is in use, the venting of the cooling medium side shall be at an elevation below that of the product vacuum breaker. The control mechanism to satisfy the above requirement must be demonstrable to the regulatory authority.
1.11.07.05 Cooling Medium
Cooling medium (usually sweet water or water-glycol mixture) must be checked at least monthly for microorganisms (e.g. psychrotrophs, coliforms) Where an establishment does not have an automatic mechanism the cooling media must be checked at least once per week (see task 1.11.07.04).
Records shall document the safety of any cooling water additives and cooling media products used, as well as the microbial testing results.
This is the part of the HTST pasteurizer system in which fully heated milk is held for at least minimum required holding time. This section which consists of a holding tube and sensing chamber is located between the heating section of the HTST and the inlet of the flow diversion device.
1.11.08.01 General Conditions
The holding tube and all connections shall be of sanitary design and construction, and shall be clean and in good mechanical condition.
To attain the minimum holding time it is critical that the design of the holding tube prohibits air from being incorporated into the system. Air in the system will allow individual milk particles to move faster through the holding tubes, thereby reducing the holding time.
No device shall be permitted for short circuiting a portion of the tube, or for the removal of a section of the tube to the point of the inlet of the flow diversion device. No portion of the holding tube between the inlet and the sensing chamber shall be heated. The holding tube shall not be fitted with insulation materials, unless the insulation can be easily removed so as to allow for adequate inspection of the tube for proper slope and to detect any unauthorized changes in length.
1.11.08.02 Slope and Supports
The holding tube is required to have a continuous upward slope (includes elbows) of at least 2% (2 cm per 100 cm) from the lowest point of the holding tube to the flow diversion device. The slope is required to eliminate any air entrapment in the holding tube. To prevent variance in the slope, the holding tube shall be permanent fixed by mechanical supports. The slope of the holding tube is rated under this task and the slope of the sensing chamber is to be evaluated under task 1.11.08.05.
1.11.08.03 Holding Time Provisions
The holding tube will be equipped with necessary fitting(s) (usually a short coupled "tee" fitting) for checking the holding time by means of a salt conductivity test or an acceptable alternate method. The fitting shall be at the beginning of the upward sloping portion of the holding tube (i.e. at the lowest point of the holding tube). The sensing chamber or an alternate fitting(s) upstream of the FDD shall be used as the other fitting.
1.11.08.04 Holding Verification and Records
The holding time is determined in both divert and forward flow (except when magnetic flow meter systems are being used) using the salt conductivity test. The test results determined are converted to the holding time for all products processed by formulation since a pump may not deliver the same amount of product as it does with water. Verification of minimum hold (excluding extended holds) shall be done upon installation and annually thereafter, or whenever the seal on the timing pump is broken, the belts and/or gears are replaced (unless establishment's records indicate that the belts on the timing pump were in new condition when the original holding time was evaluated), whenever a check of the capacity indicates a speed up, or as required. The appropriate records shall be kept on the plant's file, including all supporting calculations.
1.11.08.05 Sensing Chamber
The sensing chamber is that portion of the holding tube which houses both the indicating thermometer and the STLR hot milk temperature sensors and is located at the outlet of the holding tube. The sensing chamber shall maintain a slope of at least 2%. The indicating thermometer sensor and the recorder controller temperature sensor in the sensing chamber shall be in close proximity to one another (eg. off-set cross or split double ferrule) to ensure that the temperature of the milk surrounding the two sensors yields a common result. Pipe diameter can be used as a guide to define close proximity. For example if the pipe is 3 inches in diameter then sensors should be within 3 inches of each other. The centre line of the STLR probe shall not be more than 45 cm (18 inches) from the centre line of the divert valve stem.
1.11.08.06 Extended Hold
Some plants have installed an extension to the holding tube to provide an "extended hold" for some products. The extension to the holding tube may be upstream or downstream from the flow diversion device. If the extended hold is part of the official holding tube (e.g. it is in between the fittings for checking the holding time by salt conductivity test) then the following criteria must be met:
- The extension must have a continuous upward slope of at least 2% (2 cm per 100 cm)
- The holding time without the extension must meet the minimum holding time requirement. For systems with a two speed flow control device and when the extended hold is used to accomplish legal hold at a different flow rate, an arrangement where the extended hold valves are interwired with the flow control device and its usage is recorded by a third pen on the safety thermal limit recorder chart will be acceptable
Due to the contamination potential of the extended holds set up, the following conditions are mandatory:
- The extension must be close coupled, that is to say, as close as possible. The recommended distance is 2.5 times the pipe diameter
- The extended hold line must be adequately cleaned and sanitized during the regular CIP regime
- The extended hold cycle must be either scheduled for the end of the production day or the system must be at least rinsed with water (preferably CIP cleaned) before product is again run on the "short hold" cycle to remove product from the extended hold line that would otherwise sit at ambient temperature until the unit was shut down at the end of the day.
Plants using an extended hold generally have two air operated valves, one at the inlet and one at the outlet of the extended hold line, that are controlled by the microprocessor in the HTST panel through a switch on the panel.
1.11.09 Flow Diversion Device (FDD)
The flow diversion device is designed for controlling the direction of product flow according to the temperature of the product leaving the holding tube. There are two types of flow diversion devices currently used in the dairy industry. The single stem device is an older system incorporating one three-way valve to control movement of milk. It also consists of leak detect ports which permits the escape, to the atmosphere, of product at sub-legal temperature which may have leaked past the first gasket seal on the forward flow portion of the valve and thus preventing sub-legal milk from entering the forward flow line. A more recent unit is the dual stem flow diversion device incorporating two three-way valves in series. This system utilizes additional fail safe systems.
The flow diversion device's valve is actuated by an air-operated diaphragm and a positive action spring. A solenoid (an electronically operated valve) energized by the safety thermal limit recorder, actuates an air valve within the control box which admits air to, and exhausts air from, the diaphragm. When compressed air is admitted to the diaphragm, the spring is depressed, the lower portion of the valve seats itself, the upper portion of the valve is pulled away from its seat, and forward flow results. Any loss of air pressure or electrical power automatically returns the valve to its normal position, which is diverted flow position.
1.11.09.01 General Conditions
The flow diversion device and the return lines shall be constructed of stainless steel and must be clean and in good mechanical condition. Valves, plunger seals and "O"-rings must also be clean and in good mechanical condition. This is necessary to ensure the fail safe divert capability of the FDD Stem length of the valve shall be non-adjustable to insure that proper seating of the valve is not disturbed. (If the stem has a threaded attachment, a locking pin or other equivalent locking mechanisms shall be inserted to prevent any misalignment.) Air to the flow diversion device must be clean and unrestricted.
Two common types of flow diversion devices used are:
- Single stem - one valve system
- Dual stem - two valve system
A single stem flow diversion device is not designed to be cleaned by the CIP method and must be dismantled for hand cleaning at each cleaning cycle. During CIP cleaning of the pasteurizer, the plunger of the single stem flow diversion device should be removed to ensure adequate velocity is achieved on the pasteurized side of the regenerator.
Dual stem flow diversion device must be equipped with a proper control panel where the control functions and relays are installed. This control panel may be part of a universal panel unit. It is important that both types of FDD's shall be free of any device or switches that may override the control functions and jeopardize the safety of pasteurized product. In dual stem diversion devices which have external solenoids, the air lines must not have quick release couplings and should be identified.
Operation and leakage past the valve seats are to be evaluated upon installation and at least once every 6 months thereafter. Appropriate records must be kept to show proper testing has occurred.
1.11.09.02 Divert Line
All flow diversion devices shall have a pipeline that is free draining from the diversion port back to constant level tank. This divert line must be free of any valves which would permit stoppage of the line or excessive back pressure on the flow diversion device. An identifiable and cleanable restrictor is permitted to ensure sufficient holding time when the system is in divert flow.
1.11.09.03 Leak Detect Capabilities
(a) Single Stem Flow Diversion Device
Proper functioning leak detector ports or leak escape ports are required. They permit the escape, to the atmosphere, of product at sub-legal temperature which may have leaked past the first gasket seal on the forward flow portion of the valve. They prevent sub-legal milk from entering the forward flow line. Leakage at this point should warn the operator that the valve "O" rings are faulty. These ports must never be obstructed. These ports (poppets) must be visibly open during divert flow or shut down. The "O" rings should be routinely changed.
(b) Dual Stem Flow Diversion Device
Dual stem flow diversion devices shall have a leak detect line separate from the divert line, that is free draining from the lower port of the leak detect valve back to the constant level tank or other acceptable receptacle. No restrictions are permitted in the leak detect line as this would exert a higher pressure against the seal possibly forcing raw milk out the forward flow port. This line must be equipped, in the vertical position, with a sight glass, preferably of the 360° type. The sight glass must allow for unrestricted visual detection of leakage past the first valve seat. It must be clear with no etching or clouding and must be free draining. The sight glass should be installed at eye level wherever possible.
The flow diversion device must be located at the end of the holding tube after the sensing chamber. It must be at the highest point of the raw product in the holding tube.
1.11.09.05 Fail Safe Divert Capability
In the case of sub-legal temperature, loss of electrical power or air supply, the flow diversion device shall automatically return to the divert position. In all cases the valve response time from forward flow to divert flow must not exceed 1 second.
The flow diversion device shall be inter-wired with the flow control device. The inter-wiring will permit the flow control device and other flow promoters to operate only when the flow diversion device is in the safe forward flow or fully divert position. Safe forward flow is a condition where the temperature of the product is above the divert set point and the flow control device is energized by the safety thermal limit recorder. In the event of the flow diversion device not being in either the safe forward flow or fully divert position, all flow promoting devices in the HTST system (i.e. downstream from the balance tank to the break to the atmosphere) shall automatically stop or be by-passed.
Tests are to be performed upon installation and at least once every 6 months thereafter. Appropriate records must be kept to show proper testing has occurred.
1.11.09.06 Time Delay Relays
Dual stem devices must have the proper time delay relays. This is verified by checking plant's records on tests conducted on HTST equipment and its controls. Time delay relay is a unit which defers a function by a set period of time.
(a) A minimum one second time delay relay is required for dual stem flow diversion devices to flush out any product pocketed between the two valve seats. In HTST systems where a restrictor is required in the divert line to obtain legal hold time in diverted flow, the time delay relay must be a maximum of 3 seconds. The maximum three seconds of delay is not applicable when the timing system is magnetic flow meter based.
(b) A time delay relay is required for the INSPECT mode control switch. When the switch is moved from the PRODUCT to INSPECT position, the flow diversion device must immediately divert and all flow promoters (includes flow control device) must be de-energized or valved out. The flow diversion device must remain in the diverted flow position until all the flow promoting devices have stopped (run down time or are valved out); after which it moves to the forward position but no flow promoting device shall operate. (Quick Test: If feasible, the inspector may request the pasteurizer operator to do an on site demonstration that this works).
(c) A time delay is required for the CIP mode control switch such that all flow promoters (includes flow control device) cannot operate during the CIP operation. When the switch is moved from the PRODUCT to CIP mode, the flow diversion device must immediately divert and all the flow promoters must be de-energized. The flow diversion device remains in diverted position until all flow promoting devices have stopped (run down time). The flow diversion device is then under the control of the CIP controller, OR
(d) A time delay relay is required when it is desired that the flow promoting devices run during CIP operation. This time delay relay must position the flow diversion device in the diverted flow for at least 10 minutes of CIP cycle. Any product pump which may produce pressure on raw regenerator also shall not run during the first 10 minutes of CIP cycle and must be under control of the same time delay relay as the flow diversion device. When establishments do mini-washes they tend to stay on product mode. If mini-washes are done, chemical cross contamination must be prevented through the use of systems outlined in Appendix 10 (refer to task 1.11.01.02).
(e) If the HTST pasteurizer has a Meter Based Timing System as a flow control device then the following two additional controls are required:
- The flow diversion device will divert immediately when the flow deviates from set points (above high set point or below low set point).
- After the safe flow is re-established, there must be at least legal hold time (i.e. 15 seconds for milk or 25 seconds for ice-cream) delay before forward flow. This will flush out unpasteurized product from the holding tube before any forward flow.
Tests are to be performed upon installation and at least every six months thereafter and whenever the seal on the time delay relay is broken. Appropriate records must be kept to show proper testing has occurred.
For HTST pasteurizers using a Meter Based Timing System tests are to be performed upon installation and at least once every six months thereafter, whenever seal on the flow alarm is broken, whenever any alteration is made affecting the holding time, the velocity of the flow or the capacity of the holding time and whenever a check of the capacity indicates a speed-up. Appropriate records must be kept to show proper testing has occurred.
1.11.09.07 Device Sealed
Sealing this unit will prevent any tampering with control switches and time delay relays. All solenoids, time delay relays and critical microswitches must be sealed. In some cases, this can be achieved by sealing the control panel box. However, if the components are not in one box, it will be necessary to seal each component.
1.11.10 Indicating Thermometer (HTST)
The pasteurizing indicating thermometer provides the official processing temperature of the product.
1.11.10.01 General Conditions
This thermometer is required for all HTST pasteurizers. It shall be mercury actuated or resistance temperature devices (RTDs).
Mercury actuated or accepted equivalent thermometers shall be of direct reading type, contained in a corrosion resistant case which permits easy observation of column and scale. The filling above mercury is to be nitrogen or equally suitable gas. The bulb shall be Corning normal or equivalent.
The RTDs type must be fail-safe utilizing two separate RTDs, accurate, reliable, and meet the scale and thermometric response specifications. The criteria in Appendix 13 - Design Requirements for Digital Thermometers shall be used to evaluate RTDs when used as alternatives to mercury actuated direct reading thermometers.
1.11.10.02 Location and Accessibility
The hot product indicating thermometer shall be located in the temperature sensing chamber along with the probe for the STLR If the indicating thermometer is not readily accessible, plant management must provide adequate safe access to it.
The mercury column width shall be magnified to an apparent width of at least 1.6 mm (0.0625 inch). The scale shall have a span of at least 14°C (25°F) including the pasteurization temperature +/- 3°C (5°F), graduated in 0.25°C (0.5°F) divisions with not more than 4 Celsius degrees (8 Fahrenheit degrees) per 25 mm (1 inch) of span. The thermometer shall be protected against damage at 105°C (220°F). Indicating thermometer must be in the same unit of measure as the recording thermometer, either both are Celsius or both are Fahrenheit.
The stem fitting shall be pressure tight against the inside wall of the fitting with no threads exposed to product. The distance from the product contact surface of the ferrule to the sensing area of the bulb shall be at least 76 mm (3 inches).
1.11.10.04 Calibration and Records
Records of tests performed to determine thermometer's calibration shall be maintained in the plant's files. Tests which should be performed upon installation and at least every 6 months include the following:
- Temperature Accuracy: The thermometer shall be accurate to within +/- 0.25°C (0.5°F) throughout the specified scale range.
- Thermometric Response: The time for the temperature to increase by 7°C (12°F) under specified conditions shall not exceed 4 seconds.
If problems are found with either of these two tests, the frequency of calibration should be increased. If the calibration is consistently found to be out of adjustment, the reason for the calibration problems should be immediately identified and rectified. Plant management must investigate the safety of the product produced with out of calibration equipment (e.g. if the indicating thermometer at the outlet of the holding tube is reading higher than the calibration standard, the product may have been under processed).
1.11.11 Safety Thermal Limit Recorder (STLR)
The function of this device is to:
- Automatically record the temperature of the product in the sensing chamber on a chart that also indicates the time of the day and provides a record of the process
- Monitor, control, indicate and record the position of flow diversion device (forward or divert flow)
- Supply the source of power for the flow control device and flow diversion device solenoid during forward flow
1.11.11.01 General Conditions
This unit, more commonly referred to as the RECORDER CONTROLLER, must meet the design requirements of the appropriate agency or, in the absence of that, the 3-A Accepted Practices for the Sanitary Construction, Installation, Testing, and Operation of High Temperature Short-Time Pasteurizers. Any such units must be manufactured for HTST STLR usage and any modifications must be performed by, or authorized by the manufacturer.
The STLR shall be electrically operated and the unit shall be housed in a case that is moisture-proof under normal operating conditions.
The STLR must be maintained and operated as specified by the manufacturer. Any covers preventing access to public health adjustments, such as the divert set-point, must be maintained in place. The cut-in/cut-out signal to the flow diversion device must be independent of the movement of the temperature recording arm. (Quick Test: If feasible, inspector may request pasteurizer operator to move arm up to cut in and down to cut out - should not click in or out of forward/divert).
The single probe which senses the temperature for both the temperature recording pen and the cut-in/cut-out control shall be protected against temperature damage at 105°C (220°F). It shall be installed with a pressure tight seat against the inside wall of the pipe with no threads exposed to milk or milk products. The temperature sensing area of the probe shall be no less than 76 mm (3 inches) from the product contact surface of the ferrule. Flow indicating lights (green for forward and red for divert) must be operational.
The STLR must be serviced at least once per year and maintained on a continual basis so that the instrument functions according to specifications. Records of service and maintenance must be available in the plant's files.
All switches on the STLR. and any controls associated with the operation of the HTST unit shall be clearly identified. There shall be no switches or devices that could jeopardize the safety of the product by by-passing or over riding any public health controls.
1.11.11.02 Diversion Capabilities
The STLR shall have set-points for all the products run. If the unit has only one set-point capability, this value shall be the highest legal set-point temperature for any product processed on the unit.
Normally dual or multiple temperature set-point devices are installed as needed. Any such device shall be supplied or recommended by the manufacturer of the STLR When a multiple temperature device is used, the set-point indicator shall indicate the current set-point in use. A pen attached to the set-point indicator arm, recording the actual set-point shall be provided.
If an HTST unit is used to process pasteurized product, as well as unpasteurized product such as heat treated milk for certain cheeses, a dual temperature divert switch must be used to allow the system to go into forward flow at a sub-legal temperature. A pen attached to the set point indicator arm recording the process temperature (pasteurized or heat treated) is also required. When product is processed in this manner, all pasteurized product must be processed first, followed by the raw product. The entire HTST system, piping and cheese vats etc. must receive a complete wash with sanitizing prior to processing any pasteurized product.
Tests to be performed on diversion capability of all products to be done upon installation and at least every six months thereafter. Appropriate records must be kept to show proper testing has occurred.
1.11.11.03 Cut-in and Cut-out
The cut-in temperature is that temperature, set within the STLR, at which the STLR sends a signal to the flow diversion device allowing it to go into and remain in the forward flow position. The cut-out temperature is the temperature at which this signal is turned off. The adjustment mechanism for this set-point must be inaccessible to the operator once the unit has been sealed.
Cut-in and cut-out temperatures shall be determined and recorded on the chart daily by the operator at the start up and when new set-point is selected. A cut-in and cut-out is required in the following situations:
- When going from one mode to another and back again, e.g. following a mini-wash when on CIP mode
- When there is a change from pasteurized product to heat treated product and
- When the system is shut down and then is re-started. In the case of 1 and 2 this is seen as selecting a new set point and in the case of 3 this is seen as a new start up
The cut-in temperature is the temperature observed on the indicating thermometer, at the instant the flow diversion device begins to move to the forward flow position. The flow diversion valve responds to the signal sent out by the STLR when the STLR senses a product temperature at or above the set-point, and is therefore temperature dependent. For HTST systems equipped with dual stem flow diversion devices, the leak detect valve responds after a preset time delay, and is therefore time dependent. The cut-out temperature is the temperature (during descent) at which the flow diversion device assumes the divert flow position. Normally cut-in temperature shall be higher (at least 0.25°C (0.50°F) than the cut-out temperature.
With recent technology, it is possible to perform automated cut-in/cut-out temperatures using Programmable Logic Controllers (PLC). These systems will be assessed on a case by case basis.
(a) Temperature Recording Pen
The STLR must have a functioning temperature recording pen. There should be an easily accessible adjustment screw on the pen arm enabling the operator to adjust the pen reading to coincide with that of the indicating thermometer.
(b) Frequency (Event or Divert) Pen
All units must also have a functioning frequency pen. This pen, also called the event or divert pen, records the position of the flow diversion device with a line on the outer edge of the chart. The frequency pen is energized by a micro-switch in the flow diversion device as the flow diversion device moves into fully forward position. The frequency pen is de-energized during diverted flow and it moves down to indicate a divert.
These two pens (recording and frequency) must each give a line not over 0.7 mm (0.025 inch) wide and be easily maintained. These two pens must track together or follow the same time line. On certain models, the reference arc is used to align these two pens.
(c) Third Pen
If the STLR requires a third pen, as with a multiple temperature divert unit, this third pen cannot track with the other two. It must be adjusted to lead or follow the other pens by a specified time factor. This value shall be displayed on the STLR unit. The ink used in this set-point recording pen must be of a different colour from that used in the other two.
Tests are to be performed upon installation and at least once every 6 months thereafter. Appropriate records must be kept to show proper testing has occurred.
A circular chart shall make one revolution in not more than 12 hours and shall be graduated for a maximum record of 12 hours. Two charts shall be used if operations extend beyond 12 hours. Strip charts may show a continuous reading over a 24 hour period.
The chart positive drive mechanism shall be equipped with a system to prevent slippage or manual rotation (e.g. pin to puncture the chart paper). The chart used shall correspond with the chart number displayed on the identification plate of the STLR
The chart span shall be not less than 17°C (30°F), including the diversion set-point +/- 7°C (12°F), graduated in temperature scale divisions of 0.5°C (1°F) spaced at least 1.6 mm (.0625 inch) apart at the diversion temperature +/- 0.5°C (1°F). If the ink line is thin enough to distinguish it from the chart line, the temperature scale divisions of 0.5°C (1°F) may be spaced at least 1 mm (0.040 inch) apart. Time scale divisions shall be not more than 15 minutes and be spaced at least 6.3 mm (0.25 inch) apart at the diversion temperature +/- 0.5°C (1°F). Recording thermometer must be in the same unit of measure as the indicating thermometer, either both are Celsius or both are Fahrenheit.
Tests are to be performed upon installation and at least once a year thereafter. Appropriate records must be kept to show proper testing has occurred.
The performance accuracy of the STLR shall be performed upon installation and verified at least once a year. Records of tests performed to determine accuracy shall be maintained in the plant's files to show proper testing has occurred. Tests which should be performed include the following:
- Recorded temperature accuracy: The temperature recorded shall be accurate to within +/- 0.5°C (1°F) at the divert temperature set-point +/- 3°C (5°F).
- Recorder time accuracy: The recorded time of pasteurization shall not exceed the true elapsed time.
- Recording thermometer check against indicating thermometer: The recording thermometer shall not read higher than the corresponding indicating thermometer.
- Thermometric response: The time interval from the instant the recording thermometer reads 7°C (12°F) below the cut-in temperature and the moment of power cut-in shall not be more than 5 seconds.
Testing methods shall comply with the required standards, and must show satisfactory follow-up on out of specification findings. Plant management must investigate the safety of the product produced with out of calibration equipment.
The HTST STLR's (including ones with electrical contact points) shall be sealed. The sealing mechanism will provide a tamper evident restricted access to the diversion set-point adjustment. Appropriate documentation with respect to set-point value and any other pertinent information shall be maintained in the plant's records.
1.11.11.08 Programmable Logic Controllers and Computers
Computers are different from hard wired controls in three major areas. To provide adequate public health protection, the design of computerized public health controls must address these three major differences.
First, unlike conventional hard-wired systems, which provide full time monitoring of the public health controls, the computer performs its tasks sequentially, and the computer may be in real time contact with the flow diversion device for only one millisecond. During the next 100 milliseconds (or however long it takes the computer to cycle one time through its tasks), the flow diversion device remains in forward flow, independent of temperature in the holding tube. Normally, this is not a problem, because most computers can cycle through 100 steps in their program, many times during one second. The problem occurs when the public health computer is directed away from its tasks by another computer, or the computer program is changed, or a seldom used JUMP, BRANCH, or GO TO Instruction diverts the computer away from its public health control tasks.
Second, in a computerized system, the control logic is easily changed because the computer program is easily changed. A few keystrokes at the keyboard will completely change the control logic of the computer program. Conversely, hard wired systems required tools and a technician to make wiring changes. Once the hard wired system was properly installed and working, it was never changed. This problem can be solved by sealing the access to the computer, but some procedure is needed to ensure that the computer has the correct program when the computer is resealed by the regulatory authority.
Finally, some computer experts have stated categorically that no computer program can be written error free. They were referring primarily to very large programs, with many conditional JUMPs/BRANCHs with thousands of lines of program code. For these large systems, the programs actually improve with age (the errors are found and corrected under actual conditions of use). For public health controls, the computer program must and can be made error free, since the programs required for public health control are relatively brief.
If the design of computerized public health controls does address the above mentioned differences, they can be effectively interfaced with conventional hard-wired operating controls and instrumentation. When computers or programmable logic controllers are used in pasteurizing systems, they must be installed in such a manner that no public health controls are controlled by or circumvented by the computer or programmable logic controller during the product run operations except as provided for under Appendix 5 - Criteria for the Evaluation of Computerized Public Health Controls.
A designated person is responsible to plant management for ensuring that their PLC or computer installation complies with the requirements of Appendix 5, through documentation and testing. In the event that the PLC needs to be repaired, a reliable trained third party may connect remotely to the system as long as there is no permanent connection. There would need to be documentation to show the date of entry, purpose of re-programming, who did the repair, who verified the repair, that the seal giving access to the PLC was broken and re-sealing occurred including the seal number.
The responsible regulatory agency shall evaluate the complete documentation of interconnecting wiring, air piping, applicable programming logic and ladder logic, seals and results of the testing procedures which will confirm that no public health controls are circumvented by the computer. This will help to verify compliance with the criteria in Appendix 5.
1.11.12 Pressure differential controllers and gauges
Proper pressure relationships must exist across all media to prevent contamination of the pasteurized product by raw product, heating medium and cooling medium. Pressure relationships under the following conditions must be considered:
- Forward flow
- Divert flow
This task will assess the actual pressure devices used. The appropriate pressure differential is assessed under Regeneration (1.11.05.03) and Cooling (1.11.07.04).
Pressure differential controllers shall be installed in all systems that use a raw product booster pump. In the product regenerator section, the pressure differential controller allows the booster pump to operate only when the proper pressures are established between raw and pasteurized product.
Tests are performed upon installation and at least once every 6 months thereafter. Appropriate records must be kept to show proper testing has occurred.
1.11.12.01 General Conditions
The pressure differential controller must meet the design requirements of the appropriate agency. This includes meeting 3 A acceptable practices for sanitary construction, installation, testing and operation in a HTST system. Pressure gauges may be used to verify the pressure display for the pressure differential controller.
The sensors of pressure differential controllers must be clean and in good mechanical condition. The design should allow easily dismantling of sensors for inspection and the indicating section must be housed in an appropriate control panel.
When the pressure differential controller is used to control a raw product booster pump it shall have its raw product sensor located between the booster pump and the raw product inlet to the regenerator. The pasteurized product sensor shall be installed at or downstream from, the pasteurized product outlet of the regenerator.
If the HTST system has a split regenerator then a separate pressure differential controller must be installed for each section of the regenerator. The pressure sensor location for each section must comply with the foregoing criteria.
Accurate and calibrated gauges should be located at the outlet of the cooling section on the dairy product side and at the inlet of cooling section on the cooling medium side.
The accuracy of pressure display and the differential controller shall be validated at least two times per year and whenever the controller is adjusted or repaired. Pressure gauges, if used, must be checked for accuracy at least every 6 months by the procedure outlined in Test Procedures for Critical Process Equipment and Controls manual by the CFIA.
The pressure differential controller unit must be sealed.
All records pertaining to accuracy and maintenance must be kept on file.
1.11.13 Recording thermometer (Cooling)
This is the instrument which automatically records the temperature of the product (e.g. cooled pasteurized milk) on a chart thereby providing a record of the process. The temperature sensing probe of the safety thermal limit recorder is assessed under the Safety Thermal Limit Recorder (STLR) (1.11.11.01 - 1.11.11.08) and not with this task.
1.11.13.01 General Conditions
The recording thermometer unit shall be clean and in good mechanical condition. It should be moisture-proof under normal operating conditions, and protected against damage at 105°C (220°F). The chart positive drive mechanism shall be equipped with a system to prevent slippage and manual rotation (e.g. pin to puncture chart paper). It must also be equipped to produce a continuous permanent record of all pertinent information (time of day and temperature). Recording thermometer scale must be graduated in units not greater than 1°C (2°F) and shall be accurate to within 0.5°C (1°F). The unit should be serviced at least once a year.
1.11.14 Pasteurized Product Discharge
This section discharges the cooled pasteurized product to a point beyond the HTST pasteurizing system in a method that will maintain higher pressure on the pasteurized side of the regenerator during divert flow or shutdown and also minimizes the risk of contamination. This section is normally located downstream of the cooling section.
By creating a head pressure which opens to the pasteurized side of the regenerator, higher pressure is established on the pasteurized regenerator section. The head pressure is created by piping configuration for the pasteurized product, which must rise without restriction to at least 30 cm (12 inches) above the highest point of raw product in the system. This point may be other than the flow diversion device (e.g. homogenizer stacks).
In order to assess this task it is necessary to first identify the highest potential raw product elevation between constant level tank and flow diversion device.
1.11.14.02 Vacuum Break
At this point (at least 30 cm or 12 inches above the highest potential point of the raw product) a break to atmosphere must be provided via a vacuum breaker or other acceptable device (e.g. piping rises to elevated tanks or cheese vat and is open to atmosphere at all times, i.e. no intervening valves are permitted). The break must be prior to any restrictions such as valves, pumps etc.
1.11.14.03 Vacuum Breaker
(a) Must be in good mechanical and sanitary condition.
(b) The parts of the vacuum breaker that cannot be CIP cleaned shall be dismantled and manually cleaned and sanitized at each cleaning cycle.
(c) The vacuum breaker must be functioning properly. Attention should be paid to the operation of the vacuum breaker. With some units it is difficult to move the plunger or core when the unit is "on the bench". The plunger or core must work freely or be replaced.
(d) Must be installed so that the air intake is not a source of contamination to the system. If the vacuum breaker is a Clean-In-Place (CIP) type, the air intake must not be connected directly to the constant level tank (CLT). However, a CIP vacuum breaker may be permanently connected to the CLT via a return line if this line has an unobstructed air gap of at least twice the pipe diameter (never less than 1 inch) and this air gap is located at least 30 cm or 12 inches above the highest potential point of the raw product. Note: this return line's opening must be covered to prevent contamination of the CLT (e.g. a sanitary umbrella deflector that overlaps the edges of this line's opening). An alternative to this would be a proximity switch on the return line. In this case, the line is disconnected during production at the elevation of the vacuum breaker, i.e. 30 cm or 12 inches above the highest potential point of the raw product.
The homogenizer is a high pressure pump that produces a homogenized product by reducing the size of fat globules as they are forced through a small orifice under high pressure. Since the homogenizer is a positive pump, it can be utilized as a flow control device. If the homogenizer is utilized as a flow control device, its compliance requirements will be rated under the Flow Control Device (1.11.06.01 - 1.11.06.03). If the homogenizer is not the flow controlling device then the conditions described in this task may apply.
1.11.15.01 General Conditions
Homogenizers when operated in conjunction with the HTST pasteurizer, shall be installed so that they will not reduce the holding time below the required minimum.
Filters, homogenization valves, pistons, seat valves, pressure gauges and dead ends must be clean and in good mechanical condition. All product contact surfaces must be stainless steel. All homogenizers should be equipped with appropriate gauges.
1.11.15.02 Recirculation Line
If the homogenizer has a capacity greater than the flow control device then the homogenizer would normally be located downstream from the flow control device. A recirculation line between the inlet (suction line) and the outlet (pressure line) of the homogenizer shall be installed to prevent the homogenizer from "starving". This line shall be unrestricted and shall not contain a shut-off valve, but may contain a check valve allowing flow only from the outlet back to the inlet. The diameter of the recirculation line including the check valve shall be equal or greater than the supply line to the homogenizer.
1.11.15.03 Relief Line
If the homogenizer is of lower capacity than the flow control device, and the flow control device feeds product to the suction side of the homogenizer, it shall be installed upstream from the flow diversion device. A sanitary relief line to the constant level tank shall be provided, from a point between the flow control device discharge and homogenizer inlet. This line is equipped with a relief valve capable of maintaining sufficient back pressure to assure a full supply of product to the homogenizer.
It is only necessary to inter-wire the homogenizer when it is of lesser capacity than the timing device. Since the homogenizer can produce flow through the holding tube when the flow control device is stopped, inter-wiring is required between the homogenizer and flow control device, which causes the homogenizer to operate only when the flow control device is operating. A time delay relay should also be installed so that during normal movement of the flow diversion device (one second or less from forward to divert flow), the homogenizer motor will remain running.
Tests are performed upon installation, at least once every 6 months thereafter and when micro-switch is re-set or replaced. Appropriate records must be kept to show proper testing has occurred.
1.11.16 Separator and Clarifier
Separator/Clarifier is a piece of auxiliary equipment that mechanically separates milk into fat and skim milk by centrifugation. Self cleaning separators also provide a clarifying function by regularly de-sludging the somatic cells, leucocytes and other inedible materials.
The centrifugal force created in the separator may be enough to promote flow, therefore all separators should be considered to be flow promoting devices and because of this certain design criteria need to be met.
1.11.16.01 General Conditions
Milk contact surfaces of the separator must be made of stainless steel. The separator must be clean and in good mechanical condition.
Separators may be located upstream or downstream of the flow diversion device. If the separator is located upstream of flow diversion device then it shall be upstream of any flow control device. Separators may be located between:
- Raw regenerator outlet and the heating section (upstream from the flow diversion device and flow control device)
- Split regeneration sections upstream from flow diversion device and flow control device
- Pasteurized regenerator outlet and the cooling section (downstream from the flow diversion device)
- Prior to the HTST system
- After the HTST system
1.11.16.03 Non-Flow Promoting
Because the separator is considered a flow promoting device it is necessary that it be installed in such a way that it is a non-flow promoting device whenever the flow control device is not operating. One method of complying with this criteria is to properly valve the separator out of the system by fail safe valves. In all cases, a normally closed valve shall be located downstream of both the milk and cream (if a standardizing separator) to block the flow of product whenever the FCD is de-energized.
Tests are performed upon installation, at least once every 6 months thereafter and when micro-switch is re-set or replaced. Appropriate records must be kept to show proper testing has occurred.
1.11.16.04 Vacuum Break
Should a separator-clarifier be located downstream from the flow diversion device it is necessary that a vacuum break be located at the inlet to the separator-clarifier. This is required to eliminate any negative pressure being applied to the pasteurized regenerator and flow diversion device. It is still necessary to valve out the separator in this location.
1.11.17 Flavour Adjusting Equipment
This equipment removes undesirable volatile odours and flavours by subjecting dairy products to a vacuum treatment. The product is passed through a vacuum chamber which acts to remove volatile flavours such as onion, alfalfa, silage, etc. from milk.
1.11.17.01 General Conditions
Flavour control equipment, which includes vacuum and steam-vacuum accessory treatment systems, may be installed and operated in conjunction with HTST pasteurization systems provided that such equipment will not:
- Interfere with the detection of, or stoppage of, the forward flow of unpasteurized product
- Influence the proper pressure relationships within the regenerator
- Reduce the holding time below the required minimum
- Contaminate the product with toxic substances or foreign matter through the use of substandard steam or steam distribution systems
- Adulterate the product with added water
Flavour control equipment may consist of a:
- Single chamber vacuum system, with no direct addition of steam, installed upstream from the heating section
- Single chamber vacuum system, with no direct addition of steam, installed downstream from the flow diversion device
- Single or double chamber vacuum system with direct steam addition, installed downstream from the flow diversion device
When vacuum equipment is located downstream from the flow diversion device, the holding tube shall be tested with the timing pump operating at maximum capacity, and the vacuum equipment operating at maximum vacuum.
1.11.17.02 Properly Valved Out
Steam used in contact with product shall be of culinary quality. When culinary steam is introduced into the product downstream from the flow diversion device, means shall be provided to preclude the addition of steam to the product, unless the flow diversion device is in the forward flow position. Such means shall include the use of an automatic steam control valve with a temperature sensor located downstream from the steam inlet, or by the use of an automatic solenoid shut-off valve installed in the culinary steam line, each wired through the flow diversion device so as to stop the introduction of steam when the flow-diversion device moves into the diverted flow position.
When a water feed line is connected to a direct water-vapour vacuum condenser, supplementary means shall be provided to preclude the back-up and overflow of water and/or condensate from the vacuum condenser into the product vacuum chamber in the event of condensate pump failure, tailpipe failure, or power failure. Such means shall include the use of an automatic safety shut-off valve installed on the water feed line, and a high level sensing device installed in the condenser, which would effectively shut-off the inflowing water, if the water and/or condensate rose above a predetermined level in the condenser. This valve may be actuated by water, air, or electricity and shall be so designed that failure of the primary motivating power will automatically stop the flow of water into the vacuum condenser or vapour line.
Any other combination or modification thereof which are installed and operated in accordance with conditions mentioned above, and with the following detailed provisions, may be utilized.
(a) When vacuum equipment is located downstream from the flow diversion device, means shall be provided to prevent negative pressure between the forward flow port of the flow diversion device and the inlet to the vacuum chamber, during diverted flow or shutdown. An effective vacuum breaker and a normally closed shut-off valve, (installed downstream from the vacuum breaker), shall be installed in the line between the flow diversion device and the inlet to the vacuum chamber directly downstream from the flow diversion device. The effectiveness of such installation shall be evaluated by disconnecting the forward flow piping from the flow diversion device during diverted flow position, and with the vacuum equipment in operation, check such piping for negative pressure.
(b) When vacuum equipment is located downstream from the flow diversion device, means shall be provided to prevent the lowering of the pasteurized milk level in the regenerator during diverted flow or shutdown. An automatic check valve or positive-type shut-off valve and an effective vacuum breaker, (installed downstream from the valve), shall be installed in the line between the outlet from the downstream vacuum chamber and the pasteurized milk inlet to the regenerator. The effectiveness of such installation shall be evaluated by disconnecting the pasteurized milk inlet piping to the regenerator during diverted flow and with the vacuum equipment operating at maximum, check such piping for negative pressure.
1.11.17.03 Steam Ratio Control
When culinary steam is introduced directly into the product, automatic means shall be provided to maintain a proper temperature differential between incoming and outgoing product to preclude product dilution and to assure original product composition. Such means may include:
- An automatic ratio controller which, (a) senses the temperature of the product at the outlet of the flow diversion device (prior to the addition of steam) and either in the vacuum chamber or at its exit (depending upon the most effective point to measure the results of evaporative cooling) and, (b) automatically adjusts the operating vacuum in the vacuum chamber so as to assure the removal, by evaporative cooling, of all water added in the form of steam OR
- Any other system which will automatically preclude adulteration
The optimum temperature differential between the incoming and outgoing product shall be determined for each HTST installation by means of a Mojonnier, or substantially equivalent total solids determination, on both products, and such differential set on the ratio controller.
An air-operated pressure switch, installed in the air control line between the ratio controller and the vacuum regulator, or the automatic means, shall stop the introduction of steam into the product when the operating vacuum in the vacuum chamber is insufficient to prevent product dilution.
1.11.18 Stuffing pump and Flow promoting devices
1.11.18.01 General Conditions
Stuffing pumps which are usually centrifugal pumps must be constructed of stainless steel or a suitable corrosion resistant material and must be clean and in good mechanical condition. Painted exterior surfaces must also be clean and in good condition, free of flaking paint and rust.
All pumps not specifically designed for CIP use must be disassembled for cleaning. This includes removal of impellers and back plates for cleaning.
1.11.18.02 Proper Installation and Operation
When a stuffing pump is used in a HTST pasteurizer system it must be installed and operated in such a way that it will not:
- Interfere with the draining of the system should the system shut down
- Interfere with the detection, or stoppage, of forward flow of unpasteurized milk
- Influence the proper pressure relationship within the regeneration section
- Reduce the holding time below the required minimum
Stuffing pumps are utilized to force-feed certain equipment e.g. homogenizer. The stuffing pump is necessary in large homogenizers where it will enable the product to be under positive pressure at the homogenizer suction intake manifold. When the homogenizer is used as a flow control device, a centrifugal type pump may be installed between the raw product outlet of the regenerator and the inlet manifold of the homogenizer to supply the desired pressure to the homogenizer. Such pumps must meet the same interwiring requirements as the flow control device (it will only operate when the flow diversion device is in safe forward flow or fully diverted mode). These pumps may be installed to be turned on prior to starting the homogenizer.
Any flow promoting devices including stuffing pumps, located between the CLT and the vacuum breaker must be interwired with the FDD so they are not capable of producing flow through the holding tube when FDD is not in safe forward or fully diverted flow position. This includes periods during which the "Inspect" position has been selected for the FDD
Tests are performed upon installation, at least once every 6 months thereafter and when micro-switch is re-set or replaced. Appropriate records must be kept to show proper testing has occurred.
1.11.19 Supplementary Milk Solids and Milk Fat Injection System (In-Line Standardization)
It is a practice in some establishments to increase the solids level of milk used in the cheese making process to improve overall cheese yield. This can be achieved by injecting milk fat and milk solids directly into the CLT or directly injecting milk fat and milk solids into the HTST system prior to pasteurization. The addition of milk solids through a blender into a cheese vat is not assessed under this task. Injection pumps are flow promoting devices and depending on the point of injection must be considered as part of the HTST system.
1.11.19.01 General Conditions
Injection pumps are generally positive displacement type pumps, but can also be centrifugal pumps in conjunction with a MBTS. They must be constructed of stainless steel or a suitable corrosion resistant material and be in good mechanical and sanitary condition.
1.11.19.02 Proper Installation and Operation
When an injection pump is used in a HTST pasteurizer system it must be installed and operated in such a way that it will not:
- Reduce the pasteurization holding time below the required minimum
- Affect compositional requirement of milk to compromise the minimum pasteurization time and temperature requirement as per 1.11.02.02 (a higher solids/milk fat level could require a higher pasteurization temperature)
- Influence the proper pressure differential within the regeneration section
- Interfere with the draining of the system should the system shut down
- Interfere with the detection, or stoppage of forward flow of unpasteurized milk
When the injection occurs directly into the CLT the injection pump(s) must be interwired so that it does not operate when:
- FCD is not in operation
- FDD is in divert mode or the system is in the recycle mode
- FDD is in the inspect mode
When the injection occurs between the CLT and the FCD. The following conditions must be met:
- The combined flow rate of the injection pump(s) must not be greater than the flow rate of the FCD This can be accomplished by using injection pump(s) with a smaller capacity than the FCD
- The injection pump(s) must be set at a predetermined flow rate not greater than the FCD. This will also control the compositional requirement of the milk.
- The salt conductivity test must be done with the injection pump(s) running at maximum sealed speed.
- The injection pump(s) must be interwired so that it does not operate when:
- FCD is not in operation
- FDD is in diverted mode or the system is in the recycle mode
- FDD is in the inspect mode
Another way to operate would be to properly valve the injection line out of the system by using sanitary mix-proof fail safe valves to isolate the injection from the HTST when the system is not running (FCD is de-energized).
- The injection point is between the outlet of the last raw milk regeneration section and the FCD
- A check valve is installed immediately upstream of the injection point, typically after the separator.
- The injection valve(s) is (are) of the fail safe type, spring-to-close and air-to-open, and are of a block and bleed design with a full port open to the atmosphere between the HTST isolation seat and the pump when the solids/milk fat is not being injected. This will eliminate any product flow or static pressure exerted on the raw regeneration section during shut down, regardless of the product level in the supply tank.
- When in CIP mode after the first 10 minute time delay, the operation of the injection pump can be controlled by a different CIP system.
- The piping between the injection pump and the injection point may rise to a height that is higher than the overflow level of the supply tank but is at least 30.5 centimetres (12 inches) lower than the required opening to the atmosphere on the pasteurized side.
- If the system is controlled by computer or PLC, appropriate test procedures shall be provided to evaluate the required inter-wiring and function. All the requirements of task 1.11.11.08 must be met.
Tests to evaluate the required inter-wiring are performed upon installation, at least once every 6 months thereafter and when micro-switch is re-set or replaced. Appropriate records must be kept to show proper testing has occurred.
This task describes two possible methods of injection. It does not preclude other methods that may be reviewed and found acceptable.
- Date modified: