• Decrease font size
  • Return font size to normal
  • Increase font size
U.S. Department of Health and Human Services

Food

  • Print
  • Share
  • E-mail

PMO 2007: Appendix H - Pasteurization Equipment and Procedures and Other Equipment

Grade "A" Pasteurized Milk Ordinance (2007 Revision)

Return to table of contents


I. HTST PASTEURIZATION

OPERATION OF HTST SYSTEMS

HTST pasteurization is important to the dairy industry because of the operating efficiencies that it affords. Properly operated, these units allow a high volume of production in a minimum of processing space.

The ability of HTST pasteurizers to assure a safe, finished milk or milk product hinges on the reliability of the time-temperature-pressure relationships that must prevail whenever the system is in operation. It is important that the milk plant operator understand the HTST process in order to maintain proper surveillance over the equipment. The basic flow pattern is described below:

  1. Cold raw milk or milk product, in a constant-level supply tank, is drawn into the regenerator section of the HTST pasteurizer.

    NOTE: Some operators prefer to bypass the regenerator when starting. Under this system, cold milk is drawn directly through the timing pump, step 3, and into the heater section. The remaining steps are performed without exception. This bypass arrangement facilitates and speeds up the starting operation. After forward-flow is established at the FDD, the bypass, which may be manually or automatically controlled, is not used and the raw milk or milk product flows through the regenerator. A second start-up technique involves the use of sanitizing solution at 77°C (170°F). This is passed through the complete unit and followed immediately by milk or milk product. Dilution of the first milk or milk product does occur; however, care must be taken to prevent this from being packaged.

  2. In the regenerator section, the cold raw milk or milk product is warmed by hot pasteurized milk or milk product flowing in a counter current direction on the opposite sides of thin stainless steel surfaces.
  3. The raw milk or milk product, still under suction, passes through a positive-displacement-timing pump that delivers it under pressure through the rest of the HTST pasteurization system.
  4. The raw milk or milk product is pumped through the heater section, where hot water or steam on opposite sides of thin stainless steel surfaces heats the milk or milk product to a temperature of at 72°C (161°F).
  5. The milk or milk product, at pasteurization temperature, and under pressure, flows through the holding tube where it is held for at least fifteen (15) seconds. The maximum velocity of the milk or milk product through the holding tube is governed by the speed of the timing pump, the diameter and length of the holding tube and surface friction.
  6. After passing the sensing bulbs of the indicating thermometer and recorder/controller, the milk or milk product passes into the FDD, which automatically assumes a forward-flow position, if the milk or milk product passes the recorder/controller bulb at the preset cut-in temperature, i.e., 72°C (161°F).
  7. Improperly heated milk or milk product flows through the diverted-flow line back to the constant-level tank.
  8. Properly heated milk or milk product flows through the forward-flow line to the pasteurized milk or milk product regenerator section where it serves to warm the cold raw milk or milk product and, in turn, is cooled.
  9. The warm milk or milk product passes through the cooling section, where coolant, on the sides of thin stainless steel surfaces opposite the pasteurized milk or milk product, reduces its temperature to 4.4°C (40°F) and below.
  10. The cold pasteurized milk or milk product then passes to a storage tank or vat to await packaging.
     

HTST PASTEURIZERS EMPLOYING MILK OR MILK PRODUCT-TO-MILK OR MILK PRODUCT REGENERATORS WITH BOTH SIDES CLOSED TO THE ATMOSPHERE

Item 16p(D), of Section 7 establishes standards for regenerators. These standards insure that the raw milk or milk product will always be under less pressure than pasteurized milk or milk product in order to prevent contamination of the pasteurized milk or milk product in the event flaws should develop in the metal or joints separating it from the raw milk or milk product. An explanation of regenerator specifications is given below.

During normal operation, i.e., while the timing pump is operating, raw milk or milk product will be drawn through the regenerator at sub-atmospheric pressure. The pasteurized milk or milk product in the milk or milk product-to-milk or milk product regenerator will be above atmospheric pressure. The required pressure differential will be assured when there is no flow-promoting device downstream from the pasteurized milk or milk product side of the regenerator to draw the pasteurized milk or milk product through the regenerator, and the pasteurized milk or milk product downstream from the regenerator rises to at least 30.5 centimeters (12 inches) elevation above the highest raw milk or milk product level downstream from the constant-level tank, and is open to the atmosphere at this or a higher elevation, as required in Item 16p(D) Administrative Procedures #2.

During a shutdown, i.e., when the timing pump stops, the raw milk or milk product in the regenerator will be retained under suction, except this suction may be gradually relieved by possible entrance of air drawn through the regenerator plate gaskets from the higher outside atmospheric pressure. With a free draining regenerator, as required under Item 16p(D) Administrative Procedures #8, the raw milk or milk product level in the regenerator may drop slowly, depending on the tightness of the gaskets, ultimately falling below the level of the plates to the milk or milk product level in the constant-level tank. However, under these conditions, as long as any raw milk or milk product remains in the regenerator, it will be at sub-atmospheric pressure.

During shutdown, the pasteurized milk or milk product in the regenerator is maintained at atmospheric pressure or above by meeting the elevation requirement of Item 16p(D) Administrative Procedures #2. Pressure greater than atmospheric is maintained when the level of pasteurized milk or milk product is at or above the required elevation and loss of pressure, due to suction, is prevented by prohibiting a downstream pump.

Any backflow of milk or milk product through the FDD would lower the pasteurized milk or milk product level, during pump shutdowns, thus tending to reduce the pressure on the pasteurized milk or milk product side of the regenerator. A FDD cannot be relied upon to prevent backflow in such instances, because during the first few minutes following a pump shutdown, the milk or milk product is still at a sufficiently high temperature to keep the FDD in the forward-flow position. Compliance with the provisions of Item 16p(D) Administrative Procedures #2 and #3; however, will insure a proper pressure differential in the regenerator.

At the beginning of a run, from the time raw milk or milk product or water is drawn through the regenerator, until the pasteurized milk or milk product or water has risen to the elevation specified in Item 16p(D) Administrative Procedures #2, the pasteurized milk or milk product side of the regenerator is at atmospheric pressure or higher. Even if the timing pump should stop during this period, the pressure on the pasteurized milk or milk product side of the regenerator will be greater than the sub-atmospheric pressure on the raw milk or milk product side. This will be assured by compliance with Item 16p(D) Administrative Procedures #2 and #3, as long as any raw milk or milk product remains in the regenerator.

When a raw milk or milk product booster pump is incorporated into the HTST system, Item 16p(D) Administrative Procedures #5 requires, in part, that automatic means shall be provided to assure, at all times, the required pressure differential between raw and pasteurized milk or milk product in the regenerator, before the booster pump can operate.

THE USE OF SEPARATORS WITHIN HTST SYSTEMS

Separators in HTST pasteurization systems must be installed and operated in such a manner that they will not adversely effect the regenerator pressures, create a negative pressure on the FDD during operation or cause milk or milk product flow through the holding tube during times when such flow would compromise a required public health safe guard.

  1. A separator may be located between the outlet of a raw regenerator and the timing pump or between raw regenerator sections if the separator is automatically valved out of the system, and separator stuffing pump(s) are de-energized, when:
    1. The timing pump is not in operation; or
    2. A dual stem FDD is in the inspect position; or
    3. In a system with a dual stem FDD, in which the separator is located between sections of a raw regenerator, during the first ten (10) minutes of a required ten (10) minute time delay in CIP mode and during any period of diverted-flow; or
    4. The pressures in any raw regenerator sections, located after the separator, are out of compliance with the pressure requirements of this Ordinance.
    NOTE: The second section of a split raw regenerator must automatically drain freely drain back to the constant-level tank or to the floor in the event of a shut down.
  2. A separator may not be located between the timing pump and the FDD.
  3. A separator may be located on the pasteurized side of the FDD if:
    1. A properly installed atmospheric break is located between the FDD and the inlet of the separator;
    2. All milk or milk product rises to at least 30.5 centimeters (12 inches) higher than the highest raw milk or milk product in the system and is open to the atmosphere at some point between the outlet of the separator and the inlet of any pasteurized side regenerator;
    3. All milk or milk product rises to at least 30.5 centimeters (12 inches) higher than the highest raw milk or milk product in the system and is open to the atmosphere at some point between the outlet of any pasteurized side regenerator and the inlet of a separator; and
    4. The separator is automatically valved out of the system, and the separator stuffing pump is de-energized:
      1. (1) When a dual stem FDD is in the first ten (10) minutes of a required ten (10) minute delay in CIP mode;
      2. (2) When the FDD is diverted in product or inspect mode;
      3. (3) When the timing pump is not in operation; and
      4. (4) When the temperature is below the required pasteurization temperature and the FDD is not in the fully diverted-position.
  4. The following criteria applies to installations where a separator must be valved out:
    1. A valve must be located to isolate the product supply line from the separator;
    2. A valve must be located to prevent all flow exiting the separator from being returned to the pasteurization system downstream of the separator; and
    3. The valves are required to move in order to accomplish the two (2) criteria listed above and must move to the valved-out position, and any separator stuffing pumps must be de-energized, upon loss of air or power.
  5. The following criteria applies to installations where a separator is located on the raw side of a HTST system and a cream or skim balance tank(s) is not being utilized for the collection of either the cream or skim that exits the HTST system:
    1. A fail-safe (spring-to-close upon loss of air or power), block-and-bleed valve or valve arrangement must be installed on the cream or skim line downstream from the separator and prior to any pump(s) or cream or skim storage tank(s), and shall be at least 30.5 centimeters (12 inches) below the required opening to the atmosphere on the pasteurized side of the HTST regenerator. This fail-safe valve or valve arrangement shall be closed whenever the separator is required to be automatically valved out of the system and the separator stuffer pump is de-energized.
    2. If a computer or programmable controller is used to provide any of these required functions, it shall comply with the applicable Section(s) of Appendix H., VI.
    3. If not installed in compliance with a. and b. above, the height of the cream or skim storage tank must be considered when determining the highest raw product in the HTST system.

Back to top

THE USE OF LIQUID INGREDIENT INJECTION WITHIN HTST SYSTEMS

Milk or milk product flavoring slurries, condensed milk or milk products, and cream or skim for standardization and similar ingredients may be injected at a point after the last regenerator and before the timing pump, if all of the following conditions are met:

  1. The slurry injection valve(s) is (are) closed and the slurry pump is de-energized:
    1. When the FDD is in inspect mode;
    2. When the timing pump is not in operation; and
    3. When the temperature is below the required pasteurization temperature and the FDD is not in the fully diverted position.
  2. The slurry injection valve(s) is (are) of the fail-safe type, spring-to-close and air-to-open, and are "block-and-bleed" design with a full port open to the atmosphere between the HTST isolation seat and the slurry pump when slurry is not being injected.
  3. The slurry piping between the slurry pump and the injection point may rise to a height that is higher than the overflow level of the slurry supply tank(s) but is at least 30.5 centimeters (12 inches) lower than the required opening to the atmosphere on the pasteurized side.
  4. The slurry supply tank has an overflow that is at least twice the diameter of the largest inlet pipe, or all inlet pipes are disconnected and the openings capped during operation of the slurry pump.
  5. There is a check-valve in the flow stream of the milk or milk product line from the last regenerator, typically after the separator, upstream of the injection point valve.
  6. If the slurry contains milk and/or milk products, tanks used to blend and hold such slurry shall be completely emptied and cleaned after each four (4) hours of operation or less, unless it shall be stored at a temperature of 7°C (45°F) or less, or at a temperature of 66°C (150°F) or more and be maintained there until the time of injection.
  7. If computers or programmable controllers are used to provide any of these required functions, they shall meet the applicable portion of Appendix H., VI.
  8. Appropriate test procedures shall be provided to evaluate the required inter-wiring and function.

NOTE:

  1. This Section describes one (1) method that has been reviewed and accepted for this purpose. It does not preclude other methods that may be reviewed and found acceptable.
  2. In order to help assure compliance with Section 2-Adulteration of this Ordinance, a Regulatory Agency may require that the milk plant close the slurry valve and de-energize the slurry pump during times when the system is recycling milk or milk product, such as in recycle mode, diverted-flow, or the first ten (10) minutes of the CIP cycle. If a computer is used to accomplish this, it does not need to meet Appendix H., VI of this Ordinance.
     

PRESSURE RELIEF VALVES, LOCATED WITHIN HTST, HHST AND ASEPTIC PROCESSING SYSTEMS

  1. Between the Timing Pump and the Beginning of the Holding Tube: Placement of a pressure relief valve between the timing pump and the beginning of the holding tube is acceptable provided:
    1. Provisions are made for the cleaning of the valve vent and any return piping to the constant-level tank whenever the system is cleaned.
    2. The pasteurizer shall not be timed if the valve is leaking. Leakage may be determined by observation at the pressure relief valve vent opening to the floor or at the opening of the return piping from the pressure relief valve vent into the constant-level tank.
    3. The system is designed and operated so that loss of pressure from the pasteurized side of the regenerator cannot occur if the system flow-promoting devices stop while the FDD is in the forward-flow position. A system not protected against this potential pressure loss is considered a violation of Item 16p(D) of this Ordinance.

      For Example: In a magnetic flow meter based timing system there is a fail-safe, spring-to-close valve or check-valve that must also be located between the timing pump and the holding tube. Item 16p(D) of this Ordinance is satisfied if the pressure relief valve is located prior to this fail-safe valve or check-valve.

  2. Downstream from the Holding Tube in HTST Systems: The pressures in the pasteurized side of the regenerator must be protected from falling within 6.9 kPa (1 psi) of the pressures in the raw side of the regenerator at all times, including during shut down. A relief valve and line on the pasteurized side of the FDD can meet this criterion if:
    1. After the relief valve and before the entrance to the pasteurized side of a regenerator, all milk or milk product rises at least 30.5 centimeters (12 inches) higher than the highest raw milk or milk product in the system, and is open to the atmosphere at that point; or
    2. After exiting the pasteurized regenerator, and before the pressure relief valve, all milk or milk product must rise at least 30.5 centimeters (12 inches) higher than the highest raw milk or milk product in the system, and be open to the atmosphere at that point; or
    3. The pressure relief valve is spring-loaded and plumbed so that it cannot be opened or forced open in any mode, "Product", "CIP" or "Inspect", without the assistance of pressure from the liquid flowing through the system. In this case, a leaking pressure relief valve can cause an unacceptable loss of pressure in the pasteurized side of the regenerator during a shut down and is considered a violation of Item 16p(D) of this Ordinance. Any leakage from this pressure relief valve must be readily visible. This may be accomplished by opening the pressure relief valve vent directly to the floor or by providing sanitary piping from the pressure relief valve vent to the constant-level tank. If the later option is utilized, the piping shall be properly sloped to assure drainage to the constant-level tank and shall be provided with a properly located and installed sight-glass.
       

MAGNETIC FLOW METER BASED TIMING SYSTEMS FOR HTST PASTEURIZERS

Many HTST pasteurizing system use magnetic flow meter based timing systems. The flow through these systems is developed by a combination of flow promoting devices including booster and stuffer pumps, separators and clarifiers, homogenizers and positive displacement pumps.

Item 16p(B)2(f) of Section 7 provides for their use, provided they meet the following specifications for design, installation and use.

COMPONENTS: Magnetic flow meter based timing systems shall consist of the following components:

  1. A sanitary magnetic flow meter which has been reviewed by FDA or one (1) which is equally accurate, reliable and will produce six (6) consecutive measurements of holding time within 0.5 seconds of each other.
  2. Suitable converters for conversion of electric and/or air signals to the proper mode for the operation of the system.
  3. A suitable flow recorder capable of recording flow at the flow alarm set point and also at least 19 liters (5 gallons) per minute higher than the flow alarm setting. The flow recorder shall have an event pen that shall indicate the status of the flow alarm with respect to flow rate.
  4. A flow alarm, with an adjustable set point, shall be installed within the system which will automatically cause the FDD to be moved to the divert position whenever excessive flow rate causes the milk or milk product holding time to be less than the legal holding time for the pasteurization process being used. The flow alarm shall be tested by the Regulatory Agency in accordance with the procedures of Appendix I, Test 11, 2.A and B at the frequency specified. The flow alarm adjustment shall be sealed.
  5. A loss-of-signal alarm shall be installed with the system, which will automatically cause the FDD to be moved to the divert position whenever there is a loss-of-signal from the meter. The loss-of-signal provision shall be tested by the Regulatory Agency in accordance with Appendix I, Test 11, 2.C at the frequency specified. The loss-of-signal provision shall be sealed.
  6. When the legal flow rate has been reestablished, following an excessive flow rate, a time delay must be instituted, which will prevent the FDD from assuming the forward-flow position until at least a fifteen (15) seconds, for milk or milk product, or twenty-five (25) seconds for eggnog and similar products, of continuous legal flow has been re-established. The time delay must be tested by the Regulatory Agency and if it is of the adjustable type shall be sealed.
  7. A sanitary check valve or normally closed automatically controlled sanitary valve shall be installed with the magnetic flow meter to prevent a positive pressure in the raw milk or milk product side of the regenerator whenever a power failure, shutdown or flow-diversion occurs.
  8. When a regenerator is used with large systems, it will be necessary to bypass the regenerator during start-up and when the FDD is in the diverted-flow position. Care should be taken in the design of such bypass systems to assure that a dead-end does not exist. A dead-end could allow milk or milk product to remain at ambient temperature for long periods of time and allow bacterial growth in the milk or milk product. Caution should also be observed with such bypass systems and any valves used in them so that raw milk or milk product will not be trapped, under pressure in the raw regenerator plates, and not have free drainage back to the constant-level tank when shutdown occurs.
  9. Most systems will utilize a dual stem FDD and will be using the timing pump during the CIP cleaning cycle. All public health controls, required of such systems, must be applicable. When switching to the "CIP" position, the FDD must move to the divert position and must remain in the diverted-flow position for at least ten (10) minutes, regardless of temperature, and the booster pump cannot run during this ten (10) minute time delay.
  10. All systems shall be designed, installed and operated so that all applicable tests required by Section 7, Item 16p(E) can be performed by the Regulatory Agency, at the frequency specified. (Refer to Appendix I.) Where adjustment or changes can be made to these devices or controls, appropriate seals shall be applied by the Regulatory Agency after testing, so that changes cannot be made without detection.
  11. Except for those requirements directly related to the physical presence of the timing pump, all other requirements of the most recent edition of this Ordinance are applicable.

Back to top

PLACEMENT OF COMPONENTS: Individual components in the magnetic flow meter based timing systems shall comply with the following placement conditions:

  1. The timing pump shall be located downstream from the raw milk or milk product regenerator section, if a regenerator is used.
  2. The magnetic flow meter shall be placed before the holding tube and after any bypassed regenerator(s). There shall be no intervening flow-promoting components between the meter and the holding tube.
  3. The control valve, used with the constant speed flow promoting device, may be located downstream of the magnetic flow meter.
  4. The magnetic flow meter, the sanitary check valve or normally closed control valve, shall all be located upstream from the start of the holding tube.
  5. All flow-promoting devices, which are upstream of the FDD, such as booster and stuffer pumps, separators and clarifiers, homogenizers and positive displacement pumps shall be properly interwired with the FDD so that they may run and produce flow through the system at sub-legal temperatures, only when the FDD is in the fully diverted position and when in "Product" run mode. Separators or clarifiers that continue to run, after they are de-energized must be automatically valved-out of the system, with fail-safe valves, so they are incapable of producing flow.
  6. There shall be no product entering or leaving the system, i.e., cream or skim milk from a separator or other product components, between the magnetic flow meter and the FDD.
  7. The magnetic flow meter shall be so installed that the milk or milk product has contact with both electrodes at all times when there is flow through the system. This is most easily accomplished by mounting the flow tube of the magnetic flow meter in a vertical position with the direction of flow from the bottom to the top. However, horizontal mounting is acceptable when other precautions are taken to assure that both electrodes are in contact with the product. They should not be mounted on a high horizontal line that may be only partially full and thereby trap air.
  8. The magnetic flow meter shall be piped in such a manner that at least ten (10) pipe diameters of straight pipe exists, upstream and downstream from the center of the meter, before any elbow or change of direction takes place.

   31. Milk-to-Milk Regeneration - Homogenizer Upstream from Holding Tube. See description linked from image
31. Milk-to-Milk Regeneration - Homogenizer Upstream from Holding Tube

  Figure 32. Milk-to-Milk Regeneration - Booster Pump. Link to description.
Figure 32. Milk-to-Milk Regeneration - Booster Pump

  Figure 33. Milk-to-Milk Regeneration - Homogenizer and Vacuum Chambers Downstream from Flow-Diversion Device. Link to description.
Figure 33. Milk-to-Milk Regeneration - Homogenizer and Vacuum Chambers Downstream from Flow-Diversion Device

  Figure 34. HTST System with a Magnetic Flow Meter Using a Constant Speed Centrifugal Pump and a Control Valve. Link to description.
Figure 34. HTST System with a Magnetic Flow Meter Using a Constant Speed Centrifugal Pump and a Control Valve

  Figure 35. HTST System with a Magnetic Flow Meter Using an A-C Variable Speed Centrifugal Pump. Link to description.
Figure 35. HTST System with a Magnetic Flow Meter Using an A-C Variable Speed Centrifugal Pump

  Figure 36. Controls for Steam Injection Pastuerizer. Link to description.
Figure 36. Controls for Steam Injection Pasteurizer

II. AIR FOR DRYING EQUIPMENT AND AIR UNDER PRESSURE - DIRECT CONTACT WITH MILK AND MILK PRODUCTS AND MILK PRODUCT - CONTACT SURFACES

AIR FOR DRYING EQUIPMENT

Filter Media: Intake air filter media shall consist of fiberglass with a downstream backing dense enough to prevent fiberglass break off from passing through, cotton flannel, wool flannel, spun metal, activated carbon, activated alumina, non-woven fabric, absorbent cotton fiber, electrostatic, or other suitable materials which, under conditions of intended use, are non-toxic and non-shedding and which do not release toxic volatiles or other contaminants to the air, or volatiles which impart any flavor or odor to the milk or milk product. Chemical bonding materials contained in the media shall be non-toxic, non-volatile and insoluble under all conditions of use. Disposable media are not intended to be cleaned and re-used. Electronic air cleaners using electrostatic precipitation principles to collect particulate matter may be used in spray drying systems only as a pre-filter.

Filter Performance: The air supply system and/or ducting shall be such that the air supply is caused to pass through suitable air filters, properly installed, before coming in contact with milk product-contact surfaces of the drying system. Supply air filters for air, which will be heated before it comes in contact with the milk or milk product, shall be of a design, selected to operate at a face velocity, and installed in a manner which will allow the filter manufacturer's rating to be 90 percent (90%)or higher, when tested in accordance with the American Society of Heating, Refrigerating and Air-Conditioning Engineers (ASHRAE) Synthetic Dust Arrestance test.(1)

Supply air filters for air, which will not be heated before it comes in contact with the milk or milk product, shall be of a design, selected to operate at a face velocity, and installed in a manner which will allow the filter manufacturer's rating to be 85 percent (85%)or higher when tested in accordance with the ASHRAE Atmospheric Dust Spot Method.(1)

AIR UNDER PRESSURE - MILK PRODUCT - CONTACT SURFACES

Filter Media: Air intake and pipeline filters shall consist of fiberglass with a downstream backing dense enough to prevent fiberglass break off from passing through, cotton flannel, wool flannel, spun metal, electrostatic material or other equally acceptable filtering media, which are non-shedding and which do not release to the air, toxic volatiles or volatiles which may impart any flavor or odor to the milk or milk product.

Filter Performance: Intake air filter efficiency shall be at least 98% SAE J726 (2), June 1987 (3) using Air Cleaner (AC) coarse test dust. Final filter efficiency shall be at least 99% as measured by the Dioctylphthalate Fog Method (DOP) test (with a mean particle diameter of 0.3 microns).(4) When commercially sterile air is required, the final filter efficiency shall be at least 99.99% as measured by the DOP test.

Back to top

FABRICATION AND INSTALLATION

Air Supply Equipment: The compressing equipment shall be designed to preclude contamination of the air with lubricant vapors and fumes. Oil-free air may be produced by one (1) of the following methods or their equivalent:

  1. Use of a carbon ring piston compressor;
  2. Use of oil-lubricated compressor with effective provision for removal of any oil vapor by cooling the compressed air; or
  3. Water-lubricated or non-lubricated blowers.

The air supply shall be taken from a clean space or from relatively clean outer air and shall pass through a filter upstream from the compressing equipment. This filter shall be located and constructed so that it is easily accessible for examination and the filter media are easily removable for cleaning or replacing. The filter shall be protected from weather, drainage, water, product spillage and physical damage.

Moisture Removal Equipment: Air under pressure systems in excess of one (1) bar, i.e., 103.5 kPa (15psi), shall be provided with methods of moisture removal. The removal of moisture may be achieved by condensation and coalescing filtration or absorption, or equivalent, to prevent free water in the system. If it is necessary to cool the compressed air, an after-cooler shall be installed between the compressor and the air storage tank for the purpose of removing moisture from the compressed air.

Filters and Moisture Traps: Filters shall be constructed so as to assure effective passage of air through the filter media only. The coalescing filter and associated traps shall be located in the air pipeline downstream from the compressing equipment, and from the air tank, if one is used. The filter shall be readily accessible for examination, cleaning, and for replacing the filter media. The moisture trap shall be equipped with a petcock or other means for draining accumulated water. (Refer to Figures 37, 38 and 41)

When coalescing filters are used, a means shall be provided to measure the differential pressure across the filter. The differential pressure device is required to indicate the need for filter media replacement.

All coalescing filter housings shall be provided with a means of removing the condensed liquid from the filtration device. This can be accomplished by an automatic or manual drain installed on the base of the filter housing.

The final filter media shall be disposable. The filter media shall be located in the air line upstream from, and as close as possible to, the point of application (Refer to Figures 37, 38 and 41) except that a final filter shall not be required where the compressing equipment is of a fan or blower type and operating at a pressure of less than one (1) bar, i.e., 103.5 kPa (15psi). (Refer to Figures 39 and 40)

Electronic air cleaners utilizing electrostatic precipitation principles to collect particulate matter may be used.

Disposable filter media shall not be cleaned and reused.

Air Piping: The air piping from the compressing equipment to the filter and moisture trap shall be readily drainable.

A milk or milk product check-valve of sanitary design shall be installed in the air piping, downstream from the disposable media filter, to prevent backflow of milk or milk product into the air pipeline, except that a check-valve shall not be required if the air piping enters the milk or milk product zone from a point higher than the milk or milk product overflow level, which is open to the atmosphere, or is for dry product applications, or for other dry application where liquids are not present.

When a check-valve is not required, plastic or rubber or rubber-like tubing and suitable compatible fittings and connections made of plastic or stainless steel may be used between the final filter and the point of application.

Air distribution piping and fittings after the final filter shall be of corrosion-resistant materials.
Air distribution piping, fittings and gaskets between the discharge of the sanitary check-valve to the processing equipment shall be sanitary piping that conforms to the requirements of Item 10p of Section 7 of this Ordinance, except that:

  1. When air under pressure is directed at product-contact surfaces of containers, closures and supplementary fitments, the air passage from the final filter to the point of application shall be made of a non-toxic, relatively nonabsorbent material. In this application, check-valves are not required. The final filter shall be located as close as practical to the point of application. (Refer to Figure 41)

When used for air agitation, tubing used to introduce air into the product and/or product zone shall be sanitary piping that conforms to the requirements of Item 10p of Section 7 of this Ordinance. There shall be no threads on product-contact surfaces. When drilled or perforated pipe is used, internal drilling burrs shall be removed and the orifices shall be chamfered on the outer surface of the pipe. If the volume of the air from the compressing equipment is in excess of that required for satisfactory agitation, suitable means shall be employed to eliminate the excess volume.

NOTE: For additional details, refer to the 3-A Accepted Practices for Supplying Air Under Pressure in Contact with Milk, Milk Products and Product-Contact Surfaces 604- and 3-A Accepted Practices for Spray Drying Systems 607-.

  Figure 37. Individual Compression-Type Air Supply. Link to description.

  1. Compressing Equipment
  2. Drain Valve
  3. After-cooler (When Used)
  4. Pressure Gauge (Optional)
  5. Dryer (When Used)
  6. Air Pipe Line Coalescing Filter and Moisture Trap
  1. Final Filter
  2. Product Contact Valve (Where Required)
  3. Sanitary Piping Downstream From This Point
  4. To Point of Application
  5. Intake Air Filter

Figure 37. Individual Compression-Type Air Supply

  Figure 38. Central Compression-Type Air Supply. Link to description.

  1. Compressing Equipment
  2. Intake Air Filter
  3. After-cooler
  4. Sanitary Relief Valve
  5. Air Pipe Line Coalescing Filter and Moisture Trap
  6. Pressure Gauge (Optional)
  7. Dryer (When Used)
  8. Sanitary Piping Downstream From This Point
  9. Product Check-Valve (Where Required)
  1. Final Filter
  2. To Point of Application
  3. Drain Valve
  4. Moisture Leg or Trap
  5. Air Storage Tank
  6. Air Gap
  7. Trap and Drain Valve
  8. Condensate Pipe

Figure 38. Central Compression-Type Air Supply

  Figure 39. Individual Blower-Type Air Supply. Link to description.

  1. Blower or Fan, 34.5-103.5 kPa (5-15 psi)
  2. Air Line or Duct
  3. Pressure Gauge (When Used)
  1. To Point of Application
  2. Final Filter (When Used)
  3. Intake Air Filter

Figure 39. Individual Blower-Type Air Supply

  Figure 40. Individual Fan-Type Air Supply. Link to description.

  1. Blower or Fan, Below 34.5 kPa (5 psi)
  2. Intake Air Filter
  3. To Point of Application

Figure 40. Individual Fan-Type Air Supply

  Figure 41. Rotating Mandrel Assembly. Link to description.

  1. Compressing Equipment
  2. After-cooler (When Used)
  3. Pressure Gauge (When Used)
  4. Air Pipeline Coalescing Filter and Moisture Trap
  5. Drain Valve
  1. Dryer (When Used)
  2. Final Filter
  3. Intake Air Filter
  4. Fixed Air Passage
  5. Rotating Mandrel Assembly

Figure 41. Rotating Mandrel Assembly

Back to top

III. CULINARY STEAM - MILK AND MILK PRODUCTS

The following methods and procedures will provide steam of culinary quality for use in the processing of milk and milk products.

SOURCE OF BOILER FEED WATER

Potable water or water supplies, acceptable to the Regulatory Agency, will be used.

FEED WATER TREATMENT

Feed water may be treated, if necessary, for proper boiler care and operation. Boiler feed water treatment and control shall be under the supervision of trained personnel or a firm specializing in industrial water conditioning. Such personnel shall be informed that the steam is to be used for culinary purposes. Pretreatment of feed waters for boilers or steam generating systems to reduce water hardness, before entering the boiler or steam generator by ion exchange or other acceptable procedures, is preferable to the addition of conditioning compounds to boiler waters. Only compounds complying with 21 CFR 173.310 may be used to prevent corrosion and scale in boilers, or to facilitate sludge removal.

Greater amounts shall not be used of the boiler water treatment compounds than the minimum necessary for controlling boiler scale or other boiler water treatment purposes. No greater amount of steam shall be used for the treatment and/or pasteurization of milk and milk products than necessary.

It should be noted that tannin, which is also frequently added to boiler water to facilitate sludge removal during boiler blow-down, has been reported to give rise to odor problems, and should be used with caution.

Boiler compounds containing cyclohexylmine, morpholine, octadecylamine, diethylamino-ethanol, trisodium nitrilotriacetae, and hydrazine shall not be permitted for use in steam in contact with milk and milk products.

BOILER OPERATION

A supply of clean, dry saturated steam is necessary for proper equipment operation. Boilers and steam generation equipment shall be operated in such a manner as to prevent foaming, priming, carryover and excessive entrainment of boiler water into the steam. Carryover of boiler water additives can result in the production of milk or milk product off-flavors. Manufacturers' instructions regarding recommended water level and blow-down should be consulted and rigorously followed. The blow-down of the boiler should be carefully watched, so that an over-concentration of the boiler water solids and foaming is avoided. It is recommended that periodic analyses be made of condensate samples. Such samples should be taken from the line between the final steam separating equipment and the point of the introduction of steam into the milk or milk product.

PIPING ASSEMBLIES

Refer to Figure 42 and 43 for suggested piping assemblies for steam infusion or injection. Other assemblies that will assure a clean, dry saturated steam are acceptable.

  Figure 42. Culinary Steam Piping Assembly for Steam Infusion or Injection. Link to description.

  1. Steam Main
  2. Stop Valve
  3. Strainer
  4. * Entrainment Separator
  5. *Condensate Trap
  6. Pressure Gauge
  7. Steam Pressure Regulating (Reducing) Valve
  8. Steam Throttling Valve (Automatic or Manual) or Orifice
  1. * Differential Pressure Measuring Device
  2. * Filtering Device
  3. * Stainless Steel From This Point
  4. * Sanitary Piping and Fittings From This Point
  5. * Spring-loaded Sanitary Check-Valve
  6. * Sanitary Piping To Process Equipment
  7. * Sampling Means
*Required Equipment

Figure 42. Culinary Steam Piping Assembly for Steam for Steam Infusion or Injection

  Figure 43. Culinary Steam Piping Assembly for Airspace Heating or Defoaming. Link to description.
Figure 43. Culinary Steam Piping Assembly for Steam Infusion or Injection (Optional Configuration)
 

  Culinary Steam Piping Assembly for Airspace Heating or Defoaming.

  1. Steam Main
  2. Strainer
  3. Entrainment Strainer
  4. * Steam Trap
  5. * Filtering Device vat
    1. a. * Stainless Steel From This Point
  1. * Control Needle Valve
  2. * Steam Gauge
  3. * Cap With Drain Hole
  4. * Cap With Orifice
  5. * Sanitary Piping From This Point (Sanitary piping
    should rise prior to entering the pasteurizer.)
*Required Equipment

Figure 44. Culinary Steam Piping Assembly for Airspace Heating or Defoaming.

Back to top

IV. THERMOMETER SPECIFICATIONS

INDICATING THERMOMETERS FOR BATCH PASTEURIZERS

Type:

  1. Mercury-Actuated; Direct-Reading:
    1. Contained in a corrosion-resistant case, which protects against breakage and permits easy observation of the column and scale.
    2. Filling above mercury - nitrogen or other suitable gas.
    3. The mercury column shall be magnified to an apparent width of not less than 1.6 millimeters (0.0625 of an inch).
  2. Digital: Stand Alone
    1. No more than 0.2°C (0.5°F) drift over three (3) months use on a batch pasteurizer compared to a certified temperature source.
    2. Self-diagnostic circuitry, which provides constant monitoring of all sensing, input and conditioning circuits. The diagnostic circuitry should be capable of detecting "open" circuits, "short" circuits, poor connections and faulty components. Upon detection of failure of any component, the device shall blank or become unreadable.
    3. The electromagnetic compatibility of this device for this use shall be documented and available to the Regulatory Agency. The device must be tested to determine the effects of electrostatic discharge, power fluctuation, conductive emission and susceptibility, and radiative emission and susceptibility. The device must comply with the requirements for performance level characteristics of industrial devices. Vendors shall develop protocols for these tests with FDA concurrence.
    4. The effect of exposure to specific environmental conditions shall be documented. The device must be tested to determine the effects of low and high temperatures, thermal shock, humidity, physical shock and salt fog. Vendors shall develop protocols for these tests with FDA concurrence.
    5. Both the probe and the display case shall be constructed so that they may be sealed by the Regulatory Agency.
    6. Calibration of the device shall be protected against unauthorized changes.
    7. The device shall be protected against unauthorized component or sensing element replacement. Replacement of any component or sensing element shall be regarded as a replacement of the indicating thermometer and subject to Regulatory Agency inspection and all application tests under Appendix I. of this Ordinance.
    8. The sensing element shall be encased in appropriate material constructed in such a way that the final assembly meets the conditions of Item 11p of this Ordinance.
    9. The device must be tested from the sensing probe through the final output.
  3. Digital: Combination:
    1. No more than 0.2°C (0.5°F) drift over three (3) months use on a batch pasteurizer compared to a certified temperature source.
    2. Self-diagnostic circuitry, which provides constant monitoring of all sensing, input and conditioning circuits. The diagnostic circuitry should be capable of detecting "open" circuits, "short" circuits, poor connections and faulty components. Upon detection of failure of any component, the temperature sensors output signal and indicating display shall go visibly out of range.
    3. The electromagnetic compatibility of this device for this use shall be documented and available to the Regulatory Agency. The device must be tested to determine the effects of electrostatic discharge, power fluctuation, conductive emission and susceptibility, and radiative emission and susceptibility. The device must comply with the requirements for performance level characteristics of industrial devices. Vendors shall develop protocols for these tests with FDA concurrence.
    4. The effect of exposure to specific environmental conditions shall be documented. The device must be tested to determine the effects of low and high temperatures, thermal shock, humidity, physical shock and salt fog. Vendors shall develop protocols for these tests with FDA concurrence.
    5. Both the probe and the display case shall be constructed so that they may be sealed by the Regulatory Agency.
    6. Calibration of the device shall be protected against unauthorized changes.
    7. The device shall be protected against unauthorized component or sensing element replacement. Replacement of any component or sensing element shall be regarded as a replacement of the indicating thermometer and subject to Regulatory Agency inspection and all application tests under Appendix I . of this Ordinance.
    8. The sensing element shall be encased in appropriate material constructed in such a way that the final assembly meets the conditions of Item 11p of this Ordinance.
    9. The device must be tested from the sensing probe through the final output.

Scale: Shall have a span of not less than fourteen (14) Celsius degrees (twenty-five (25) Fahrenheit degrees), including the pasteurization temperature, ± 2.5°C (± 5°F); graduated in 0.5°C (1°F) divisions, with not more than nine (9) Celsius degrees (sixteen (16) Fahrenheit degrees) per 2.54 centimeters (1 inch) of span; and protected against damage at 105°C (220°F). Provided, that on batch pasteurizers used solely for thirty (30) minute pasteurization of milk and milk products at temperatures above 71°C (160°F), indicating thermometers with 1°C (2°F) scale graduations, with not more than six (6) Celsius degrees (twenty-eight (28) Fahrenheit degrees) per 2.54 centimeters (1 inch) of scale, may be used.

Accuracy: Within ± 0.2°C (± 0.5°F), through the specified scale span. Provided, that on batch pasteurizers used solely for thirty (30) minute pasteurization of milk and milk products at temperatures above 71°C (160°F), indicating thermometers shall be accurate to within ±.5°C (± 1°F). (Refer to Appendix I., Test 1)

Submerged Stem Fitting: A pressure-tight seat against the inside wall of the holder; no threads exposed to milk or milk products; and the location of this seat to conform to the 3-A Sanitary Standard for a wall-type fitting or other equivalent sanitary fitting.

Bulb: Corning normal or equally suitable thermometric glass.

INDICATING THERMOMETERS LOCATED ON PASTEURIZATION PIPELINES

Type:

  1. Mercury-Actuated; Direct-Reading:
    1. Contained in a corrosion-resistant case, which protects against breakage and permits easy observation of the column and scale.
    2. Filling above mercury - nitrogen or other suitable gas.
    3. The mercury column shall be magnified to an apparent width of not less than 1.6 millimeters (0.0625 of an inch).
  2. Digital:
    1. No more than 0.2°C (0.5°F) drift over three (3) months use on a HTST system compared to a certified temperature source.
    2. Self-diagnostic circuitry, which provides constant monitoring of all sensing, input and conditioning circuits. The diagnostic circuitry should be capable of detecting "open" circuits, "short" circuits, poor connections and faulty components. Upon detection of failure of any component, the device shall blank or become unreadable.
    3. The electromagnetic compatibility of this device for this use shall be documented and available to the Regulatory Agency. The device must be tested to determine the effects of electrostatic discharge, power fluctuation, conductive emission and susceptibility, and radiative emission and susceptibility. The device must comply with the requirements for performance level characteristics of industrial devices. Vendors shall develop protocols for these tests with FDA concurrence.
    4. The effect of exposure to specific environmental conditions shall be documented. The device must be tested to determine the effects of low and high temperatures, thermal shock, humidity, physical shock and salt fog. Vendors shall develop protocols for these tests with FDA concurrence.
    5. Both the probe and the display case shall be constructed so that they may be sealed by the Regulatory Agency.
    6. Calibration of the device shall be protected against unauthorized changes.
    7. The device shall be protected against unauthorized component or sensing element replacement. Replacement of any component or sensing element shall be regarded as a replacement of the indicating thermometer and subject to Regulatory Agency inspection and all applicable tests under Appendix I. of this Ordinance.
    8. The sensing element shall be encased in appropriate material constructed in such a way that the final assembly meets the conditions of Item 11p of this Ordinance.
    9. The device must be tested from the sensing probe through the final output.

Scale: Shall have a span of not less than fourteen (14) Celsius degrees (twenty-five (25) Fahrenheit degrees), including the pasteurization temperature, ± 2.5°C (± 5°F); and protected against damage at 105°C (220°F), and in the case of thermometers used on HHST systems protected against damage at 149°C (300°F). Mercury actuated thermometers shall be graduated in 0.2°C (0.5°F) divisions with not more than four (4) Celsius degrees (eight (8) Fahrenheit degrees) per 2.54 centimeters (1 inch) of scale. The digital thermometer readout shall display in units no greater than of 0.05°C (0.1°F).

Accuracy: Within ± 0.2°C (± 0.5°F), throughout the specified scale span. (Refer to Appendix I., Test 1)

Stem Fittings: A pressure-tight seat against the inside wall of the fittings; no threads exposed to milk or milk products. The probe is to be designed so that the sensitive area is discernible from the remainder of the stem. The overall probe length to be such that the sensitive area is positioned in the milk or milk product flow path when properly installed.

Thermometric Response: When the thermometer is at room temperature and then is immersed in a well-stirred water bath 11°C (19°F) or less above the pasteurization temperature, the time required for the reading to increase from water bath temperature, minus 11°C (19°F), to water bath temperature, minus 4°C (7°F), shall not exceed four (4) seconds. The digital thermometer displays shall change at a rate that can be noted by the operator or Regulatory Agency during the thermometric lag test. (Refer to Appendix I (Test 7)

Bulb: Corning normal, or equally suitable thermometric glass.

Back to top

AIRSPACE INDICATING THERMOMETER FOR BATCH PASTEURIZERS

Type:

  1. Mercury-Actuated; Direct-Reading:
    1. Contained in a corrosion-resistant case, which protects against breakage and permits easy observation of the column and scale.
    2. The bottom of the bulb chamber shall not be less than 51 millimeters (2 inches) and not more than 89 millimeters (3.5 inches), below the underside of the cover.
    3. Filling above mercury - nitrogen or other suitable gas.
    4. The mercury column shall be magnified to an apparent width of not less than 1.6 millimeters (0.0625 of an inch).
  2. Digital: Stand Alone:
    1. No more than 0.2°C (0.5°F) drift over three (3) months use on a batch pasteurizer compared to a certified temperature source.
    2. Self-diagnostic circuitry, which provides constant monitoring of all sensing, input and conditioning circuits. The diagnostic circuitry should be capable of detecting "open" circuits, "short" circuits, poor connections and faulty components. Upon detection of failure of any component, the device shall blank or become unreadable.
    3. The electromagnetic compatibility of this device for this use shall be documented and available to the Regulatory Agency. The device must be tested to determine the effects of electrostatic discharge, power fluctuation, conductive emission and susceptibility, and radiative emission and susceptibility. The device must comply with the requirements for performance level characteristics of industrial devices. Vendors shall develop protocols for these tests with FDA concurrence.
    4. The effect of exposure to specific environmental conditions shall be documented. The device must be tested to determine the effects of low and high temperatures, thermal shock, humidity, physical shock and salt fog. Vendors shall develop protocols for these tests with FDA concurrence.
    5. Both the probe and the display case shall be constructed so that they may be sealed by the Regulatory Agency.
    6. Calibration of the device shall be protected against unauthorized changes.
    7. The device shall be protected against unauthorized component or sensing element replacement. Replacement of any component or sensing element shall be regarded as a replacement of the indicating thermometer and subject to Regulatory Agency inspection and all application tests under Appendix I of this Ordinance.
    8. The sensing element shall be encased in appropriate material constructed in such a way that the final assembly meets the conditions of Item 11p of this Ordinance.
    9. The device must be tested from the sensing probe through the final output.
    10. The bottom of the bulb chamber is not less than 51 millimeters (2 inches) and not more than 89 millimeters (3.5 inches), below the underside of the cover.

Scale: Shall have a span of not less than fourteen (14) Celsius degrees (twenty-five (25) Fahrenheit degrees), including the pasteurization temperature of 66°C (150°F), ± 2.5°C (± 5°F); graduated in not more than 1°C (2°F) divisions, with not more than nine (9) Celsius degrees (sixteen (16) Fahrenheit degrees) per 2.54 centimeters (1inch) of scale; and protected against damage at (105°C) 220°F.

Accuracy: Within ± 0.5°C (± 1°F), throughout the specified scale span. (Refer to Appendix I., Test 1)

Stem Fittings: A pressure-tight seat or other suitable sanitary fitting with no threads exposed.

TEMPERATURE-RECORDING DEVICES FOR BATCH PASTEURIZERS

1. UTILIZING TEMPERATURES LESS THAN 71°C (160°F)

Case: Moisture proof under normal operating conditions in milk plants.

Scale: Shall have a span of not less than eleven (11) Celsius degrees (twenty (20) Fahrenheit degrees), including pasteurization temperature, ± 2.5°C (± 5°F); and graduated in temperature-scale divisions of 0.5°C (1°F), spaced not less than 1.6 millimeter (0.0625 of an inch) apart between 60°C (140°F) and 69°C (155°F). Provided, that temperature-scale divisions of 0.5°C (1°F), spaced not less than 1millimeter (0.040 inch) apart, are permitted when the ink line is thin enough to be easily distinguished from the printed line; graduated in time-scale divisions of not more than ten (10) minutes; and having a chord of straight-line length of not less than 6.3 millimeters (0.25 inches), between 63°C (145°F) and 66°C (150°F).

Temperature Accuracy: Within ± 0.5°C (± 1° F), between 60°C (140°F) and 69°C (155°F). (Refer to Appendix I., Test 2)

Time Accuracy: The recorded elapsed time, as indicated by the chart rotation, shall not exceed the true elapsed time, as compared to an accurate watch, over a period of at least thirty (30) minutes at pasteurization temperature. Temperature-recording devices for batch pasteurizers may be equipped with spring operated or electrically operated clocks. (Refer to Appendix I, Test 3)

Pen-Arm Setting Device: Easily accessible and simple to adjust.

Temperature Sensing Device: Protected against damage at a temperature of 105°C (220°F).

Submerged Stem Fitting: A pressure-tight seat against the inside wall of the holder; no threads exposed to milk or milk products; and the distance from the underside of the ferrule to the sensitive portion of the bulb to be not less than 76 millimeters (3 inches).

Chart Speed: A circular chart shall make one (1) revolution in not more than twelve (12) hours. Two (2) charts shall be used if operations extend beyond twelve (12) hours in one day. Circular charts shall be graduated for a maximum record of twelve (12) hours. Strip-charts may show a continuous recording over a twenty-four (24) hour period.

Chart Support Drive: The rotating chart support drive shall be provided with a pin to puncture the chart in a manner to prevent its fraudulent rotation.

2. UTILIZING TEMPERATURES GREATER THAN 71°C (160°F)

Batch pasteurizers used solely for thirty (30) minute pasteurization of milk and milk products at temperature above 71°C (160°F) may use temperature-recording devices with the following options:

Scale: Graduated in temperature scale divisions of 1°C (2°F), spaced not less than 1 millimeter (.040 inch) apart between 65°C (150°F) and 77°C (170°F); graduated in time-scale divisions of not more than fifteen (15) minutes; and having a chord of straight-line length of not less than 6.3 millimeters (0.25 inch) between 71°C (160°F) and 77°C (170°F).

Temperature Accuracy: Within ± 1°C (± 2° F), between 71°C (160°F) and 77°C (170°F).

Chart Speed: A circular chart shall make one (1) revolution in not more than twenty-four (24) hours and shall be graduated for a maximum record of twenty-four (24) hours.

Back to top

RECORDER/CONTROLLERS FOR CONTINUOUS PASTEURIZERS

Case: Moisture proof under normal operating conditions in milk plants.

Chart Scale: Shall have a span of not less than seventeen (17) Celsius degrees (thirty (30) Fahrenheit degrees), including the temperature at which diversion is set, ± 7°C (± 12°F); graduated in temperature scale divisions of 0.5°C (1°F), spaced not less than 1.6 millimeter (0.0625 inch) apart at the diversion temperature, ± 0.5°C (± 1°F). Provided, that temperature-scale divisions of 0.5°C (1°F), spaced not less than 1 millimeter (0.040 inch) apart, are permitted when the ink line is thin enough to be easily distinguished from the printed line; graduated in time-scale divisions of not more than fifteen (15) minutes; and having an equivalent fifteen (15) minute chord or straight-line length of not less than 6.3 millimeters (0.25 inch) at the diversion temperature, ± 0.5°C (± 1°F).

Temperature Accuracy: Within ± 0.5°C (± 1°F), at the temperature,± 3°C (± 5°F), at which the controller is set to divert. (Refer to Appendix I., Test 2).

Power Operated: All recorder/controllers for continuous pasteurization shall be electrically operated.

Pen-Arm Device: Easily accessible and simple to adjust.

Pen and Chart Paper: Pen designed to give a line not over .07 millimeter (0.025 inch) wide and easy to maintain.

Temperature Sensing Device: Bulb, tube, spring or thermistor, protected against damage at a temperature of 105°C (220°F). Provided, that the recorder/controller temperature sensing devices, used on HHST systems, shall be protected against damage at temperatures of 149°C (300°F).

Stem Fitting: Pressure-tight seat against the inside wall of the pipe; no threads exposed to milk or milk products; and the distance from the underside of the ferrule to the sensitive portion of the bulb is to be not less than 76 millimeters (3 inches).

Chart Speed: A circular chart shall make one (1) revolution in not more than twelve (12) hours. Two (2) charts shall be used if operations extend beyond twelve (12) hours in one (1) day. Circular charts shall be graduated for a maximum record of twelve (12) hours. Strip-charts may show a continuous recording over a twenty-four (24) hour period.

Frequency Pen: The recorder/controller shall be provided with an additional pen-arm located on the outer edge of the chart, for recording the time at which the FDD is in the forward or diverted-flow position. The chart time line shall correspond with the reference arc, and the recording pen shall rest upon the time line matching the reference arc.

Controller: Actuated by the same sensor as the recorder pen, however the cut-in and cut-out response shall be independent of pen-arm movement.

Controller Adjustment: A mechanism for the adjustment of the response temperature. It shall be designed so that the temperature setting cannot be altered or the controller manipulated without detection.

Thermometric Response: With the recorder/controller bulb at room temperature and then immersed in sufficiently agitated water or oil bath at 4°C (7°F) above the cut-in point, the interval between the moment when the recording thermometer reads 7°C (12°F) below the cut-in temperature and the moment of power cut-in shall be not more than five (5) seconds. (Refer to Appendix I., Test 8).

Chart Support Drive: The rotating chart support drive shall be provided with a pin to puncture the chart in a manner to prevent its fraudulent rotation.

INDICATING THERMOMETERS USED IN STORAGE TANKS

Scale Range: Shall have a span not less than twenty-eight (28) Celsius degrees (fifty (50) Fahrenheit degrees), including normal storage temperatures, ± 3°C (± 5°F), with an extension of scale on either side permitted, and graduated in not more than 1°C (2°F) divisions.

Temperature Scale Division: Spaced not less than 1.6 millimeters (0.0625 inch) apart between 2°C (35°F) and 13°C (55°F).

Accuracy: Within ± 1°C (± 2°F) throughout the specified scale range.

Stem Fitting: A pressure-tight seat or other suitable sanitary fittings with no threads exposed.

TEMPERATURE-RECORDING DEVICES USED IN STORAGE TANKS

Case: Moisture proof under operating conditions in milk plants.

Scale: Shall have a scale span of not less than twenty-eight (28) Celsius degrees (fifty (50) Fahrenheit degrees) including normal storage temperature, ± 3°C (± 5°F), graduated in not more than 1°C (2°F) divisions. Lines spaced not less than 1 millimeter (0.040 inch) apart, are permitted when the ink line is thin enough to be easily distinguished from the printed line. They shall be graduated in time scale divisions of not more than one (1) hour, having a chord of straight-line length of not less than 3.2 millimeters (0.125 inch) at 5°C (40°F). These charts must be capable of recording temperatures up to 83°C (180°F). Span specifications do not apply to extensions beyond 38°C (100°F).

Temperature Accuracy: Within ± 1°C (± 2°F), between the specified range limits.

Pen-Arm Setting Device: Easily accessible and simple to adjust.

Pen and Chart Paper: Designed to make a line not over .635 millimeters (0.025 inch) wide when in proper adjustment and easy to maintain.

Temperature Sensor: Protected against damage at 100°C (212°F).

Stem Fittings: A pressure-tight seat or other suitable sanitary fitting with no threads exposed.

Chart Speed: The circular chart shall make one (1) revolution in not more than seven (7) days and shall be graduated for a maximum record of seven (7) days. Strip chart shall move not less than 2.54 centimeters (1 inch) per hour and may be used continuously for one (1) calendar month.

TEMPERATURE-RECORDING DEVICES ON CLEANING SYSTEMS

Location: Temperature sensor is in the return solution line downstream from the process.

Case: Moisture proof under operation conditions.

Scale: Shall have a range from 16°C (60°F) to 83°C (180°F), with extensions of scale on either side permissible and graduated in time-scale divisions of not more than fifteen (15) minutes. The chart is to be graduated in temperature divisions of not more than 1°C (2°F), spaced not less than 1.6 millimeters (0.0625 inch) apart, above 44°C (110°F). Provided, that temperature-scale divisions of 1°C (2°F), spaced not less than 1 millimeter (0.040 inch) apart, are permitted when the ink line is thin enough to be easily distinguished from the printed line.

Temperature Accuracy: Within ± 1°C (± 2°F), above 44°C (110°F).

Pen-Arm Setting Device: Easily accessible and simple to adjust.

Pen and Chart Paper: Designed to make a line not over .635 millimeters (0.025 inch) wide and easy to maintain.

Temperature Sensor: Protected against damage at 100°C (212°F).

Stem Fitting: A pressure-tight seat against the inside wall of the pipe with no threads exposed to solution.

Chart Speed: Circular charts shall make one (1) revolution in not more than twenty-four (24) hours. Strip charts shall not move less than 25 millimeters (1 inch) per hour. More than one (1) record of the cleaning operation shall not overlap on the same section of the chart for either circular- or strip-type charts.

INDICATING THERMOMETERS USED IN REFRIGERATED ROOMS WHERE MILK AND MILK PRODUCTS ARE STORED

Scale Range: Shall have a span not less than twenty-eight (28) Celsius degrees (fifty (50) Fahrenheit degrees), including normal storage temperatures, ± 3°C (± 5°F), with extensions of scale on either side permitted if graduated in not more than 1°C (2°F) divisions.

Temperature Scale Divisions: Spaced not less than 1.6 millimeters (0.0625 inches) apart between 0°C (32°F) and 13°C (55°F).

Accuracy: Within ± 1°C (± 2°F), throughout the specified scale ranges.

SPECIFICATIONS FOR RECORDING pH METER FOR USE ON AUTOMATED CIP CLEANING SYSTEMS FOR EVAPORATORS

Location: pH sensor shall be located in the return line downstream from processing equipment and all lines included in the CIP cleaning circuit.

Case: Moisture proof under operating conditions.

Scale: It shall have a range of pH value from two (2) to twelve (12), with extensions of scale on either side permissible, and graduated in time scale divisions of not more than fifteen (15) minutes. The chart is to be graduated in pH divisions of not more than 0.5 pH values and spaced not less than 1.6mm (0.0625 of an inch) apart.

pH Accuracy: Within 0.5, plus or minus pH values.

Pen-Arm Setting Device: Easily accessible; simple to adjust.

Pen and Chart Paper: Designed to mark a line not over 0.635mm (0.025 of an inch) wide; easy to maintain.

pH Sensor: Protected against damage at 83°C (180°F).

Chart Speed: Circular charts shall make one (1) revolution in not more than twenty-four(24) hours. Strip charts shall not move slower than 25mm (1 inch) per hour. More than one (1)record of the cleaning operation shall not overlap on the same section of the chart for either circular or strip-type charts.

Back to top

 V. CRITERIA FOR THE EVALUATION OF ELECTRONIC DATA COLLECTION, STORAGE AND REPORTING

BACKGROUND

Electronically collecting data, storing data and reporting information with computers can be a beneficial replacement for circular chart recorders and/or hand-written records. This method of presenting PMO required information should essentially replace and duplicate the purpose and functionality of their manual or chart recorder counterparts. These would include CIP records, pasteurization records, raw and heat-treated product storage tank's temperature and cleaning requirements and temperature monitors for membrane filtration. This criteria for the evaluation addresses the difference between manual records or chart recorders and electronic or computer record keeping. These differences are identified in the criteria below that address the verification of system reliability, security and dependability and what information is available and accurate for assuring public health safety and inspection.

Following are some of the differences between manual records and chart recorders as compared to electronically collecting data, storing data and reporting information using computers:

  1. Manual Records and Chart Recorders are Visual in Nature: Milk plant employees and regulatory personnel can see and physically hold the records and place them in files for safe keeping. Whereas, computerized data collection systems are not so, they need to have methods in place to assure that the information is reliably placed and safe.
  2. Manual Records and Chart Recorders are Physical in Nature: Milk plant employees and regulatory personnel can physically record on and actually sign the records and; therefore, become responsible for the required public health activity. Also, the quality assurance manager is typically responsible for the integrity of the stored records. Whereas, computerized data collection and reporting systems need to collect the identity of the person performing the function and they also need to have someone at each milk plant responsible for the integrity of the stored records.
  3. Manual records and chart recorders are typically hard wired directly to dedicated instrumentation. Very little complexity exists between the sensor, such as a temperature or flow sensor, and the final recording device. This allows routine maintenance and compliance monitoring and inspection of manual records and chart recorders to be relatively simple. Whereas, the computerized data collection, storage, and reporting systems need to have documented procedures in place to assure that system changes, upgrades, and normal operating procedures do not compromise the integrity of the public health safety information and reports.
     

CRITERIA

The following criteria are to be used for the evaluation of electronic collection, storage and recording or reporting of any information required within Items 12p and 16p(E). of Section 7 of this Ordinance.

NOTE: These criteria do not address computer instrumentation or the electronic control of pasteurization for public health safety.

All computer-generated records and reports shall contain the information required in this Ordinance that is applicable. The computerized data collection, storage, and reporting system must have an assigned and identified representative from the milk plant that is responsible for the system. This person's name must be available to the Regulatory Agency and FDA.

  1. Any computer required to make a public health safety report, including data collection computers, data storage computers, or report servers shall be powered with an Uninterruptible Power Supply (UPS) capable of maintaining power to the computerized data collection, storage and reporting system for twenty (20) minutes.
  2. A written user's guide of the computerized data collection, storage and reporting system shall be provided and will explain the system's architecture, the software used and the sensors or instruments monitored. This overview may be presented in text or in a graphical representation. A copy of this overview shall be maintained at the discretion of the Regulatory Agency. This document shall bear the name of the identified representative from the milk plant assigned to administrate this procedure and be available for review at the milk plant by the Regulatory Agency and FDA. This documentation shall explain:
    1. System's architecture, the software used and the sensors or instruments monitored;
    2. Reporting interface of the computerized data collection, storage and reporting system;
    3. Backup procedure for ensuring the safe storage of the public health safety data of all reports;
    4. Procedure for any changes or maintenance to the instrumentation, sensors, hardware or computers. This procedure will explain how the plant will ensure that when a physical change occurs the information affected has been checked for accuracy; and
    5. Listing and explanation of the reports available on the system, instructions on how to access the reports and examples of each report with a description of their content.
  3. A written record shall be maintained by the milk plant identifying any changes or updates to the computerized data collection, storage and reporting system, software, drivers, networking or servers in order to assure the collection, storage or reporting of any data needed for compliance has not been compromised. This document shall bear the name of the representative from the milk plant assigned to administer this procedure and be available for review at the milk plant by the Regulatory Agency and FDA.
  4. In the case of CIP and raw and heat-treated storage tank records, data shall be stored at a rate to provide a reasonable account of the process being recorded. This shall never exceed a maximum of fifteen (15) minutes between data records. The data for the reporting system shall be backed up at least once every twenty-four (24) hours. Alternatively, the final reports may be stored and backed up at least once every twenty-four (24) hours.
  5. In the case of pasteurization and aseptic processing records, data shall be stored no less than every five (5) seconds for each required variable. Any event required to be recorded in manual reporting, such as a divert condition; will be recorded no matter how short the duration. Provisions will be made to allow operators to report additional events electronically, such as a record of unusual occurrences. The data for the reporting system shall be backed up at least once every twenty-four (24) hours. Alternatively, the final reports may be stored and backed up at least once every twenty-four (24) hours.
  6. Upon the initial installation, computer generated reports shall be verified visually for accuracy for seven (7) consecutive days and be found to be accurate and error free in actual service in the milk plant where installed. These seven (7) days of reports will be printed out and shall bear the signature of both the vendor of the system and the identified representative from the milk plant, or they will be accompanied by a cover letter signed by the vendor and the identified representative from the milk plant. If the milk plant develops the computerized data collection, storage and reporting system, the programmer and the identified representative from the milk plant shall be two (2) different individuals. This seven (7) day report verification period shall only be required at initial installation and one (1) time only whenever a chart recorder and/or hand-written record is being replaced by electronic data collection, storage and reporting. These seven (7) days of reports shall be kept on file at the milk plant and a copy shall be provided to the Regulatory Agency when requested.
  7. Whenever changes, updates or observed anomalies that affect the reliability or accuracy of the reporting system occur following the initial installation of the system, these changes, updates or observed anomalies shall be evaluated and investigated and if corrections are warranted shall be addressed. The records of each evaluation and corrections made shall bear the signature of the vendor or the identified representative from the milk plant. The records shall be maintained and be available for Regulatory Agency when requested.
  8. The electronic computerized data collection, storage, and reporting system shall provide for any signatures or initials required by this Ordinance. Acceptable operator signatures or initials, captured electronically, may be any combination of alpha and/or numeric characters that identify the individual performing the test or operation. Input of this signature or initials may be done by any means, including, but not limited to, a biometric reader, a card or radio frequency device, or by simple direct entry that provides a unique identifier directly associated with a specific person. Input of this signature or initials must occur each time it is required by this Ordinance. A login must occur whenever an operator changes and at a minimum frequency of once every twenty-four (24) hours.
  9. The data supporting electronic reports shall be stored in a database or data archival system in a Write Once, Read Many (WORM).
  10. The system shall provide an anomalies report indicating any system or communication failure that could have affected the validity of the required reports. This anomalies report must be automatically attached to any report that may have been affected by the system anomaly. A separate error log or system log will not suffice for meeting this requirement, since any anomaly requires an evaluation and investigation to correlate the anomaly.

    NOTE: While electronic and computerized systems can furnish a wide range of process validation and anomaly reporting, these criteria only require appended reporting of data loss that affects the reports that are required to comply with this Appendix and Items 12p and 16p(E) or other required reporting contained in this Ordinance.

  11. When a report is viewed on a computer screen, this format is exempt from the graduated temperature divisions, temperature-scale divisions and line spacing requirements of this Appendix.
  12. Printed reports shall present data in a form that is compatible with the applicable requirements of this Ordinance.

Back to top

 VI. CRITERIA FOR THE EVALUATION OF COMPUTERIZED SYSTEMS FOR GRADE "A" PUBLIC HEALTH CONTROLS

BACKGROUND

Computer systems are commonly used to manage the functions of public health control devices (valves, pumps, etc.) that operate milk pasteurization systems. These computer systems may be programmed for monitoring and controlling the instrumentation of HTST and HHST pasteurizers. They may also control the operational state of devices such as the flow diversion devices (FDDs), booster pumps, etc. While this technology can furnish numerous advantages throughout the manufacturing process, the public health computer system should essentially just replace its hard-wired counterpart. These computer systems are evaluated similar to hard-wired systems and all of the required public health controls must meet the established PMO criteria. Computers are different from hard-wired controls in three (3) major categories. To provide adequate public health protection, the design of computerized public health controls must address these three (3) major differences.

First, unlike conventional hard-wired systems, which provide full-time monitoring of the public health controls, the computer performs its tasks sequentially, and the computer may be in real time contact with the FDD for only one (1) millisecond. During the next one hundred (100) milliseconds, or however long it takes the computer to cycle one (1) time through its tasks, the FDD remains in forward-flow, independent of temperature in the holding tube. Normally, this is not a problem, because most computers can cycle through one hundred (100) steps in their program, many times during one (1) second. The problem occurs when the public health computer is directed away from its tasks by another computer; or the computer program is changed; or a seldom used JUMP, BRANCH, or GOTO Instruction diverts the computer away from its tasks.

Second, in a computerized system, the control logic is easily changed because the computer program is easily changed. A few keystrokes at the keyboard will completely change the control logic of the computer program. Sealing the access to the public health computer's programming function can solve the problem addressed above. A procedure is needed to ensure that the public health computer has the correct program when the Regulatory Agency reseals the public health computer.

Finally, for public health controls, the public health computer program must and can be made error-free, since the programs required for public health control are relatively brief. This is accomplished by attempting to keep the public health computer program simple and of limited control scope.

GLOSSARY

Address: A numerical label on each memory location of the computer. The computer uses this address when communicating with the input or output.

Computer: A very large number of on-off switches arranged in a manner to sequentially perform logical and numerical functions.

Default Mode: The pre-described position of some memory locations during start-up and standby operations of the computer.

EAPROM: An Electrically Alterable, Programmable, Read-Only Memory. Individual memory locations may be altered without erasing the remaining memory.

EEPROM: An Electrically Erasable Programmable, Read-Only Memory. The entire memory is erased with one (1) electrical signal.

EPROM: An Erasable, Programmable, Read-Only Memory. The entire memory is erased by exposure to ultra-violet light.

Fail Safe: Design considerations that cause the instrument or system to move to the safe position upon failure of electricity, air, or other support systems.

Field Alterable: A device having a specific design or function that is readily changed by the user and/or the maintenance personnel.

FDD: The common acronym used for flow‑diversion valves or devices on pasteurization systems.

Force Off: A programmable computer instruction that places any input or output in the "off" state, independently of any other program instructions.

Force On: A programmable computer instruction that places any input or output in the "on" state, independently of any other program instructions.

Human Machine Interface: Often referred to as operator interface, this computer station allows personnel monitoring and control of the computer system normally by use of a touch screen or keyboard.;

Input: Electrical signals applied to the computer and used by the computer to make logical decisions on whether or not to activate one or more outputs. Input consists of data from temperature and pressure instruments, liquid level controls, micro-switches, and operator-controlled panel switches.

Input/Output Terminals: The electrical panel that provides for the connection of all inputs and outputs to the computer. The input/output address labels are found on this panel. Indicator lights showing the status, "on" or "off", of all inputs and outputs may be available on this panel. This terminal is typically located on the computer and is commonly know as a "bus".

Ladder Logic Diagram: A programming language typically used for industrial computers commonly used and applied to milk pasteurization systems

Last State Switch: A manually operated switch or software setting that instructs the computer to place all outputs in the "on", "off", or "last state" position during a start-up. The "last state" condition instructs the computer to place the outputs in whatever state, on or off, occurred during the last loss of power.

Operator Override Switch: A manually operated switch that permits the operator to place any input or output in the "on" or "off" position, independently of any program instructions.

Output: Electrical signals from the computer that turn on or off valves, motors, lights, horns, and other devices being controlled by the computer. Outputs may also consist of messages and data to the operator.

Programmable Logic Controller (PLC): Also known as PLC's this is a computer, commonly used to control industrial machines, instruments and processes.

RAM: Random Access Memory is memory used by the computer to run programs; store data; read input and control outputs. The computer may either read data from the memory or write data into the memory.

ROM: Read-Only Memory is memory used by the computer to run its own internal unchangeable programs. The computer may only read from the memory. It cannot write into the memory or alter the memory in any way.

RTD: Resistance Temperature Detector

Standby Status: The computer is turned on, running, and waiting for instructions to start processing input data. A manually operated switch usually accomplishes this instruction.

Status Printing: Some computers are programmed to interrupt printing of the chart record and print the status of key set points and conditions such as: cold milk temperature, holding tube temperature, diversion temperature setting and chart speed.

WORM: Write Once, Read Many is a data storage technology that allows information to be written to a device a single time and prevents the device from erasing the data.

Back to top

CRITERIA

The following listed criteria shall be complied with for all computers when applied to HTST and HHST pasteurization systems used for Grade "A" milk and milk products. In addition, all systems shall conform to all other existing requirements of this Ordinance.

  1. A computer or a PLC used for the public health control of a pasteurizer must be dedicated only to the public health control of that individual pasteurizer. The public health computer shall have no other assignments involving the routine operation of the milk plant. Computer functions peripheral to the public health controls, such as CIP valve cycling, may be acceptable, provided it does not compromise the public health functionality of the public health computer or pasteurization system and all PMO requirements and safeguards are not compromised.
  2. The public health computer and its outputs shall not be under the command or control of any other computer system or Human Machine Interface. It shall not have an address that is addressable by any other computer system. A host computer cannot override its commands or place it on standby status. All addresses of the public health computer must be ready to process data at any time.
  3. A separate public health computer must be used on each HTST and HHST system. Only the public health computer may provide control over the public health devices and functions of the HTST and HHST system. Any other computer or Human Machine Interface may request a function of a device (valve, pump, etc.) within the HTST or HHST system through a hard-wired input, however this request would be granted or denied by the logic in the public health computer depending on the current status of the computer program and public health (PMO) requirements.
  4. The status of the inputs and outputs of the public health computer may be provided as inputs only to other computer systems and all public health outputs or devices shall be controlled by direct hard-wiring from the output terminal bus of the computer to the device. This includes solenoids and motors located within the HTST or HHST system. The wiring connections must be provided with isolation protection such as relays, diodes, or optical-coupling devices to prevent the public health outputs from being driven by the other computer system. Digital outputs from another computer may be connected to an input of the public health computer in order to request the operation of a device controlled by the public health computer.
  5. Upon loss of power to the public health computer all public health controls must assume the fail-safe position. Most computers can be placed in standby status by either a program instruction or manual switches. When the public health computer is in standby status, all public health controls must assume the fail-safe position. Some computers have internal diagnostic checks that are performed automatically during start-up. During this time, the public health computer places all outputs in default mode. In this default mode, all public health controls must be in the fail-safe position. The status of outputs or inputs of the public health computer may provide status to another computer for informational purposes. This shall only be accomplished through a hard-wired output (separate from any control output) from the public health computer to an input on another computer system. No other communication from the public health computer is allowed.
  6. Some computers and/or programmable controllers (PLC's) have Input/Output terminals (buses) with "last state switches" that permit the designer to decide what state the output bus will take on power-up, after a shutdown, or loss of power. The choices are "on", "off", or "last state" occurring when the computer lost power. These "last state switches" must be placed in the "fail-safe" or "off" position. Upon loss of power to the computer, all public health controls must assume the fail-safe position. Most computers can be placed in standby status by either a program instruction or manual switches. The public health computer shall have its manual switch in the position that maintains all outputs in the "off" state during any operations except normal program execution.
  7. A computer performs its tasks sequentially, and for most of real time the computer outputs are locked in the "ON" or "OFF" position, while waiting for the computer to come back through the cycle. Consequently, the public health computer program must be written so that it monitors all inputs and updates all outputs on a precise schedule, at least once every second. Most computers will be capable of performing this function many times in one (1) second. Program instructions may not exist within the public health computer program that are capable of altering the scan order of the logic, or distract focus from this order. These would include "JUMP" or "GOTO" type instructions
  8. The computer program used to control the required public health functions of HTST or HHST pasteurizers must be stored in some form of read-only memory (ROM) and be available when the public health computer is turned on. The use of tapes or disks are not acceptable.
  9. The public health computer program access must be sealed. Any telephone modem accesses must also be sealed. If the Input/Output terminals contain "last state switches", the Input/Output terminals must be sealed. The vendor must supply the Regulatory Agency with test procedures and instructions to verify that the program currently in use by the public health computer is the correct program. Typically this is made available by providing a copy of the program that controls the public health computer of the HTST or HHST pasteurizer. The Regulatory Agency will use this test procedure to confirm that the correct program is in use during a start-up, normal operation, and whenever the seal is broken. Challenging the system during normal operation could involve challenging the inter-wiring requirements through the CIP computer. One (1) method could include attempting access to the booster pump through the CIP computer. With the FDD mode selector in "PROCESS" or "PRODUCT" position, attempt to access the booster pump using the CIP computer. Public health controls in pasteurizers that may be compromised by such a challenge, must be altered or re-programmed so this compromise is prevented and the access to this computer program must be sealed by the Regulatory Authority. Similar challenges may be performed on other required public health functions that are computer controlled.
  10. If the public health computer contains FORCE-ON, FORCE-OFF functions, the public health computer must provide indicator lights showing the status of the FORCE-ON, FORCE-OFF function. The vendor's instructions must remind the Regulatory Agency that all FORCE-ON, FORCE-OFF functions must be cleared before the public health computer is sealed by the Regulatory Agency.
  11. The Input/Output terminals of the public health computer shall contain no operator override switches that are accessible without compromising a regulatory seal.
  12. Computerized systems that provide for printing the pasteurizer recording chart by the public health computer must ensure that the required calibration is maintained. During chart printing, the public health computer must not be diverted from its tasks for more than one (1) second. Upon returning to public health control tasks, the public health computer shall complete at least one (1) full cycle of its public health tasks before returning to chart printing.
  13. When printing a chart, some systems may provide status reports on the chart paper of selected Input/Output conditions. This is usually done by interrupting the printing of the chart and printing the Input/Output conditions. Such interruptions for status printing are permitted only when a continuous record is recorded on the chart. When an interruption is initiated the time of the start of the interruption will be printed on the chart, at the beginning of the interruption and at the end of the interruption. The time interval during which the public health computer is diverted from its public health tasks for status printing shall not exceed one (1) second. Upon returning to public health tasks, the public health computer shall complete at least one (1) full cycle of its public health tasks before returning to status printing.
  14. When the public health computer prints the holding tube temperature trace at specific intervals, rather than a continuously changing line, temperature readings shall be printed not less than once every five (5) seconds. In addition, during the recorder/controller thermometric response test, the temperature shall be printed or indicated at a time rate sufficient to allow the Regulatory Agency official to measure the 7°C (12°F) rise in temperature as described in TEST 8. RECORDER/CONTROLLER-THERMOMETRIC RESPONSE.
  15. When the public health computer prints the event pen position, the position of the FDD, either forward or divert at specific intervals, rather than continuously, all changes of position shall be recognized by the public health computer and printed on the chart. In addition, the event pen position and temperature in the holding tube must be printed on the chart in a manner that the temperature in the holding tube can be determined at the moment of a change in position of the FDD.
  16. The vendor shall provide a built-in program for test procedures or a protocol shall be provided so that all applicable public health tests, contained within Appendix I. of this Ordinance, can be performed by the Regulatory Agency for each instrument, i.e.:
    1. Recording Thermometers: Temperature accuracy; time accuracy; check against indicating thermometer and thermometric response.
    2. FDD: Valve seat leakage; operation of valve stem(s); device assembly; manual diversion; response time and time delay intervals if used.
    3. Booster Pumps: Proper wiring and proper pressure control settings.
    4. Flow-Promoting Devices Capable of Generating Flow Through the Holding Tube: Are installed with proper wiring interlocks.
  17. Computers require high quality; clean, well-regulated power supplies to operate reliably and safely. Spurious voltage spikes can cause unwanted changes in public health computer RAM. To assure the public health computer will execute its functions error free the following items parameters must be considered:
    1. A "clean" power source that is relatively free of spikes, interference and other irregularities shall be supplied to the public health computer.
    2. The correct program should be confirmed at the time of sealing. (Refer to the criteria cited within #9 of this Section).
    3. The output bus "last state" switch should be in the "off" or "fail-safe" position which will stop all functions of the HTST or HHST pasteurizer in case of a spurious program error.
    4. All public health computer outputs shall not have any operator override switches and must be wired in a manner that only allows the public health PLC complete control.

      Some mechanical and electrical components also deteriorate with age. One (1) solution is to have two (2) permanent programs in the public health computer; one (1) in RAM and one (1) in ROM. Through a self-diagnostic test, these two (2) programs could be compared routinely. If there were differences in the programs, the public health computer would go into default mode. Another solution would be to download the program from ROM to RAM at every start-up. A third solution could be to have the public health computer read the program directly from unchangeable ROM. However, this approach is practical only in large volume (home appliances, etc.) applications. For most small volume applications, the ROM's are field alterable, such as EPROMS, EEPROMS and EAPROMS. These types of computer programs cannot be relied upon to maintain a permanent record. It is necessary that the installer or designer for the public health PLC ensure that the proper program is in the public health computer memory before the Regulatory Agency seals the computer
  18. Computer programs used for public health controls on pasteurizers must conform to the attached logic diagrams. Minor modifications to these diagrams are permissible to accommodate or delete items that are unique to a specific pasteurization system. For example on meter based timing systems when the FDD selector switch is placed in the CIP position:
    1. A minimum ten (10) minute time delay is required for the FDD to remain in diverted flow; and
    2. During this time delay the booster pump must shut down and remain off for ten (10) minutes and then the Programmed CIP Operation is allowed to fully perform all the cleaning functions for the HTST or HHST system, including allowing the timing pump, the separator, and the booster/stuffer pump to run during cleaning operations and the FDD to pulse or cycle.
  19. The ladder logic diagrams for the FDD and the booster pump show a programmed CIP cleaning cycle operation as part of the computerized system. Some milk plant operators may wish to use another computer for CIP cleaning operations, so that milk plant personnel, may change CIP cleaning programs. When using this method, the connections between the FDD, booster pump, and milk plant computer, must be provided with solenoid relays or similar devices for the FDD and booster pump outputs. This prevents them from being operated by the milk plant computer, except when the mode switch of the FDD is in the "CIP" position and all applicable requirements have been satisfied..
  20. The vendor shall provide to the Regulatory Agency a protocol and documentation as follows:
    1. Wiring diagrams of those controllers, instruments, and devices pertaining to the public health computer.
    2. The computer ladder logic printout and/or storage device (programmed ROM chip, etc.) identical to the public health computer that controls the pasteurizer. This is usually in the form of ladder line logic for each component of the pasteurization system(s) and may include programming for CIP and other functions.
    3. A user manual including testing procedures and instructions as required in Criteria #9 of this Section.

Back to top

DIAGRAM LEGEND

t = Time
T = Temperature
MS = Microswitch
FDV = Flow Divert Valve
FDD = Flow-Diversion Device
LOSA = Loss of Signal/Low Flow Alarm
HFA = High Flow Alarm
STLR = Safety Thermal Limit Recorder-Controller

 

Figure 45. Logic Diagram: HTST Flow-Diversion Device, Divert Valve Stem

Figure 45. Logic Diagram: HTST Flow-Diversion Device, Divert Valve Stem

 

Figure 46. Logic Diagram: HTST Flow-Diversion Device, Leak Detect Valve Stem

Figure 46. Logic Diagram: HTST Flow-Diversion Device, Leak Detect Valve Stem

 

Figure 47. Logic Diagram: HTST Safety Thermal Limit Recorder-Controller

Figure 47. Logic Diagram: HTST Safety Thermal Limit Recorder-Controller

 

Figure 48. Logic Diagram: HTST Timing Pump

*This diamond (condition) is not necessary, if the 10 min. time relay is not
used for a condtion of these flow promoters to operate during CIP.

Figure 48. Logic Diagram: HTST Timing Pump

Figure 49. Logic Diagram: HTST Booster Pump

*This diamond (condition) is not necessary, if the 10 min. time relay is not
used for a condtion of these flow promoters to operate during CIP.

Figure 49. Logic Diagram: HTST Booster Pump

Back to top

VII. CRITERIA FOR STEAM-BLOCK TYPE FDD SYSTEMS

  1. Steam-Block Type FDD Systems shall have two (2) steam-block zones between the pasteurizer and the surge tank(s)/filler(s). There shall be a continuous visible bleed of steam or condensate to the drain from each steam-block zone.
  2. The steam-block zones shall be temperature monitored and shall alarm when temperature falls below 121°C (250°F).
  3. The Primary Divert Valve and other critical valves shall be position detectable and fail-safe and be alarmed to provide protection when needed.
  4. The Steam-Block Type FDD System shall not move to the forward-flow position until all conditions required of the HHST pasteurizing system are met and shall divert under the same conditions as a standard FDD.
  5. When the Steam-Block Type FDD System is in a divert condition, a loss of temperature alarm in a steam-block zone shall cause a full port opening to drain in that steam-block zone.
  6. Should both steam block zones fail when the Steam Block Type FDD is in diverted flow, the resulting compromised milk or milk product shall not be distributed for sale.
  7. Computer controls shall meet the requirements of this Appendix.
     

STEAM-BLOCK STYLE FDD SYSTEM - FUNCTIONAL DIAGRAM

 

STEAM-BLOCK STYLE FDD SYSTEM - FUNCTIONAL DIAGRAM

 

 

VIII. MILK AND MILK PRODUCTS HACCP CCP MODELS FOR PASTEURIZATION EQUIPMENT

Milk plants regulated under the NCIMS HACCP Program, shall manage pasteurization under the HACCP Plan as a CCP. Following are examples of acceptable models (HACCP Plan Summary Tables) that may be used. Other HACCP Plan Summary Tables that appropriately manage pasteurization as a CCP may also be used.

MILK AND MILK PRODUCT CONTINUOUS - FLOW (HTST AND HHST) PASTEURIZATION - CCP MODEL HACCP PLAN SUMMARY

(Refer to the Example below)

The essential elements of HTST and HHST pasteurization are:

  1. Time;
  2. Temperature; and
  3. Pressure.

Each of these elements shall be addressed under the HACCP Plan:

  1. In continuous-flow pasteurizers with sealed timing pumps, the minimum holding time at pasteurization temperature shall be addressed in the HACCP Plan as a CCP verification. Continuous-flow pasteurizers with magnetic flow meter based timing systems, timed at minimum pasteurization temperature, shall be addressed as a CL.
  2. Temperature shall always be addressed in the HACCP Plan as a CL.
  3. Pressures in the regenerator of continuous-flow pasteurizers, and in the case of HHST pasteurizers as required in the holding tubes, across steam injectors, and within infusion chambers shall be addressed in the HACCP Plan and managed as CCP verification(s).
     

MILK AND MILK PRODUCT VAT (BATCH) PASTEURIZATION - CCP MODEL HACCP PLAN SUMMARY

(Refer to the Example below)

The essential elements of vat (batch) pasteurization are:

  1. Time; and
  2. Temperature.

Both of these elements shall be addressed under the HACCP Plan as a CL.


 

MILK AND MILK PRODUCT CONTINUOUS-FLOW (HTST AND HHST) PASTEURIZATION - CCP MODEL HACCP PLAN SUMMARY
Critical Control Point (CCP)Hazard(s)Critical LimitsMonitoringCorrective Action(s)*CCP VerificationRecords
WhatHowFrequencyWho
Milk and Milk Products Pasteurization (HTST and HHST)Biological-Vegetative Pathogens (non-spore formers)

Every particle of milk or milk product is heated, in a properly designed, calibrated and operated pasteurizer to one of the temperature and time combinations specified in the current Grade "A" PMO

Note: Assuring that the minimum holding times are met in systems which use a sealed timing pump would be as CCP verification during required equipment calibration

Temperature at the exit of the holding tubeTemp. Recorder ChartContinuous during OperationPasteurizer OperatorManually divert flow of product

Isolate the affected product

Evaluate and determine disposition of the product (reprocess or disposal)

Document action
Record Review:
Pasteurizer charts verified

Equipment Function Checks:
Operator performs required daily tests and record on the temperature charts

Authorized plant person (supervised by regulatory when required) conducts checks listed in the Milk Plant Equipment Test Report (FDA Form 2359b)

 

Seals:
Verify required regulatory seals daily

Pasteurizer Charts

Corrective Action Records

CCP Verification - Records, including equipment testing records
Residence time in the holding tube in continuous-flow pasteurizers with magnetic flow meter based timing systemsFlow Recorder ChartContinuous during OperationPasteurizer Operator

* A properly operating HTST or HHST pasteurization system will divert raw product to the constant-level tank when predetermined set points are not met.

Product Description: _______________________________      Method of Storage and Distribution:  _________________________

Intended Use and Consumer: ____________________________


Signature: ______________________________________Date: __________________


 

MILK AND MILK PRODUCT VAT (BATCH) PASTEURIZATION - CCP MODEL HACCP PLAN SUMMARY
Critical Control Point (CCP)Hazard(s)Critical LimitsMonitoringCorrective Action(s)CCP VerificationRecords
WhatHowFrequencyWho
Milk and Milk Products Pasteurization (Vat)Biological-Vegetative Pathogens (non-spore formers)Every particle of milk or milk product is heated, in a properly designed, calibrated and operated pasteurizer to one of the temperature and time combinations specified in the current Grade "A" PMO.Time and temperatures (in a vat that is continuously agitated to assure that there is no more than 1°F (0.5°C) difference between the warmest and the coldest product in the vat during processing) including minimum required time, product temperature and air space temperaturesTemp. Recorder ChartContinuous during OperationPasteurizer OperatorDuring Pasteurization: Continue pasteurization until the time/ temperature criteria have been met. If the time/ temperature criteria cannot be met in two hours, an evaluation needs to be made as to the disposition of the product.

After Pasteurization
(i.e., during the record review):
If the product is found not to have met the critical time/temperature, place all affected finished product on hold, and evaluate to determine product distribution, i.e., reprocess or destroy
Record Review: Pasteurizer charts verified

Equipment Function Checks:
Operator performs required observation of indicating and airspace thermometers for each batch (air space checked at both the beginning and the end of the holding time) and recorded on the chart

Authorized plant person (supervised by regulatory when required) conducts checks listed in the Milk Plant Equipment Test Report (FDA Form 2359b)

Seals:
Verify required regulatory seals daily if applicable

 

Pasteurizer Charts

Corrective Action Records

CCP Verification Records, including equipment testing records

Product Description: _______________________________      Method of Storage and Distribution:  _________________________

Intended Use and Consumer: ____________________________


Signature: ______________________________________Date: __________________


  1. (1) The method of making these tests will be found in the following reference: Method of Testing Air Cleaning Devices, ASHRAE Standard 52. Available from The American Society of Heating, Refrigerating and Air-Conditioning Engineers.
  2. (2) Dill, R.S., A Test Method for Air Filters. Transactions of the American Society of Heating and Ventilation Engineers. 44:379, 1938.
  3. (3) DOP-Smoke Penetration and Air Resistance of Filters. Military Standard No. 282. Section 102.9.l. Naval supply Depot. 5801 Tabor Avenue, Philadelphia, Pennsylvania 19120.
  4. (4) MIL-STD-282-Military Standard 282: Method 102.9.1: Dicoctyphthalate Fog Method (DOP).

 

Back to top