Dairy processing: Higher heat shorter time (HHST) pasteurization systems and extended shelf life (ESL)

On this page

Introduction

The following provides recommended practices for performing higher heat shorter time (HHST) processing to extend the shelf life of dairy products.

HHST treatment of fluid milk and milk products is the application of heat to a continuously flowing product using high temperatures, generally above 100°C, for such time to extend the shelf-life of the product under refrigerated conditions. This type of heat process can be used to produce dairy products with extended shelf life, generally referred to as "ESL".

ESL means the ability to extend the shelf-life of a product beyond its traditional life by reducing the major sources of re-infection and maintaining the quality of the product all the way to the consumer (Dairy processing handbook, 2015).

ESL products are not considered to be commercially sterile products and, as such, must be cooled immediately after pasteurization to a temperature of 4°C or less and stored continuously under refrigeration at a temperature of 4°C or less.

Record keeping

In a Preventive control plan (PCP), it is important to maintain and keep records of activities which demonstrate that the PCP is implemented and working effectively. Records can be in either a hard copy or electronic format. Refer to Record keeping for your preventive control plan for additional information.

Definitions

For the purposes of this document, the following definitions apply.

Forward flow
means the normal flow conditions of pasteurized product towards pasteurized or sterile surge tanks and/or fillers
Scheduled extended shelf life (ESL) process
means all the conditions pertaining to the processing and packaging equipment, containers and products needed to achieve and maintain the required extended shelf-life under refrigerated storage conditions

Higher heat shorter time (HHST) flow schematic

The HHST system, although similar to a high temperature short time (HTST) pasteurizer, operates at higher temperatures (above 100°C) and pressures. It also uses a pasteurization or sterilization cycle to pasteurize or sterilize the entire system prior to commencing production.

A flow schematic, or process and instrumentation diagram (PID), is a valuable tool for assessing the impact of any changes to the HHST system. Even slight modifications made to the HHST system may have an impact on its operation and safety.

  • Involve the person responsible for the scheduled ESL process when making any change to the processing system.

Up-to-date and accurate

  • maintain on file a flow schematic that outlines the HHST system and its related components
    • update the flow schematic whenever equipment and/or pipelines are installed or changed

No cross connections

A cross connection is a direct connection allowing one material to contaminate another.

  • completely segregate incompatible products such as raw materials and pasteurized food products, cleaning products and food products (including potable water) and waste materials or utility materials and food products
  • prevent inadvertent cross contamination of independent food products (for example, soy beverages and milk) which may pose allergenic concerns

For other applications (Clean-in-place (CIP) supply lines and return line circuits used for CIP cleaning and "mini-washes" on tanks, lines, pasteurizers or other equipment that may be washed while connected to product lines containing milk products or potable water and lines for final rinse):

  • use separate pipelines and vessels for incompatible products
  • establish effective physical breaks at connection points, for example:
    • physical disconnection of pipelines
    • double block and bleed valve arrangements
    • double seat (mix proof) valves
    • aseptic barriers

The design of the constant level tank and piping, and the flow diversion device, are areas where potential cross-connections could exist if the design or installation is improper. Refer to the Constant level tank and Flow diversion device (FDD) sections for more details.

Refer to Preventing cross-contamination and Appendix G: Preventing cross connections for more information on preventing cross connections in dairy establishments.

Scheduled extended shelf life (ESL) process

To achieve the required pasteurization of ESL products in HHST systems, the generally accepted best practice is to design the scheduled ESL process to provide a thermal destruction of the target microorganism equivalent to that achieved by a process with a minimum lethality value F0=0.1.

Note: F0 is associated with commercially sterile products targeting a 12 log reduction in Clostridium botulinum spores; nevertheless, F0 was chosen in this case because it is the preferred method used by process authorities for calculating process kill, as opposed to the use of pasteurization value (P), which is more complex as it deals with varying reference temperatures and z-values.

Scheduled ESL process

  • use a qualified person who has scientific knowledge and experience in thermal processing to develop, validate and document the scheduled ESL process
    • account for any variations encountered in commercial production in the process
  • include in the process documentation, such as:
    • the scientific basis for selecting certain specifications and requirements, calculations used to derive numerical values for the specifications, a review of applicable regulations and guidelines, and a descriptive commentary on what equipment and controls are being used and why
    • critical factors that may affect the achievement of pasteurization of the ESL product
    • test procedures and operator instructions
  • use appropriate testing and shelf life studies to confirm that the process is valid
    • perform these tests upon initial commissioning of the processing unit
    • perform tests again after significant alterations have been made to the system or scheduled ESL process
  • have the person responsible for the scheduled ESL process assess any changes to an HHST system for potential impacts on the system and the safety of the product

Operating instructions

  • provide detailed operating instructions to the pasteurizer operator to ensure that the process is operated according to the design of the scheduled ESL process
    • include procedures for monitoring critical factors during system pasteurization or sterilization at start-up, and during production, and what to do if the critical factor limits are not met (process deviation procedures)

A process deviation occurs whenever any process is less than the scheduled ESL process or when critical factors are outside of specified limits.

Critical factor adherence

The critical factors are those factors specified in the scheduled ESL process as being necessary for the achievement of pasteurization of the ESL product. If any of these critical factors are not within the limits documented in the scheduled ESL process, this constitutes a process deviation and the product cannot be considered pasteurized ESL until process deviation procedures are completed.

Critical factor records

Processing records are part of the preventive control plan. They indicate whether the products were processed within the acceptable limits for the critical factors (no process deviations). Detailed documentation of process deviations permit follow up to determine the cause and corrective action for the deviation and to ensure any compromised product is properly identified and handled to prevent distribution or sale.

Process control records are part of the critical factors records.

  • record information either in a hard copy or electronic format which will provide a permanent record
  • review all production records on a timely basis
    • evaluate any operator notes concerning unusual occurrences to ensure that a critical process parameter was not violated (in other words, that an unusual occurrence was not in fact a process deviation requiring product quarantine)
  1. Ensure process control records for HHST systems provide the following data on every chart (use a 12-hour chart for the processing operation):
    • establishment name and address or licence number
    • date, shift and batch number where applicable
    • recorder unit identification when more than 1 is used
    • product type and amount of product processed (may be recorded in production records)
    • identification of sterilization/pasteurization cycles (for example, indicate when water or product is being run)
    • identification of CIP, "mini-wash" (if used)
    • unusual occurrences and operator comments (including time of occurrence)
    • signature or initials of the operators
    • chart pen markings (note: they should not overlap)
  2. Safety thermal limit recorder (STLR):
    • take a reading of the official indicating thermometer during processing
      • ensure this reading is not lower than the recording thermometer reading
    • record the time the flow diversion device is in the forward flow position, as indicated by the event pen
    • provide the recording thermometer tracing
    • provide the set point tracing, when multiple set points are used
    • all of 1 above
  3. Systems equipped with a meter based timing system (MBTS):
    • record the synchronized time with safety thermal limit recorder chart
    • record the time the flow alarm is activated, as indicated by an event pen
    • provide the flow rate tracing
    • all of 1 above
  4. Pressure differential controller-recorder (PDC-recorder):
    • record the synchronized time with safety thermal limit recorder chart
    • provide the raw product or media side pressure tracing
    • provide the sterilized product side pressure tracing
    • in lieu of raw product or media side pressure tracing and sterilized product side pressure tracing, take the pressure differential recording between them
    • all of 1 above
  5. Pressure limit recorder:
    • record the synchronized time with safety thermal limit recorder chart
    • record the holding tube operation pressure
    • all of 1 above
  6. Optional additional temperature recorders and controllers on the system:
    • record the synchronized time with safety thermal limit recorder chart
    • provide the recording thermometer tracing
    • all of 1 above; note especially the identification of pasteurization/sterilization cycles
  7. Include in the process deviation records:
    • date and time of the process deviation
    • amount of product involved
    • product quarantine and release of affected product
    • investigation into the cause of the process deviation (for example, equipment breakdown, power failure, low temperature at outlet of holding tube)
    • action taken (for example, line cleared, repairs performed, system re-pasteurized/re-sterilized)
    • review by competent personnel

Retain all pertinent processing records as part of the preventive control plan. These records will assist in determining if these products were adequately pasteurized to meet the extended shelf-life.

HHST Pasteurization System Criteria

HHST pasteurization systems should meet the criteria in the 3A "Accepted Practices for Sanitary Construction, Installation, Testing, and Operation of high temperature short time and higher heat shorter time pasteurization systems" (Number 603-07).

Constant level tank (CLT)

The constant level tank is a reservoir for a supply, at atmospheric pressure, of raw product to the pasteurizer to permit continuous operation of the HHST system. It is located at the start of the HHST system. It controls the milk level and provides a uniform head pressure to the product leaving the tank.

Air in the pasteurizer may allow the milk particles to move more rapidly through the system and therefore not receive the heat treatment for the required time. Appendix B: Constant level tank design some example constant level tank designs.

General conditions

  • ensure it is constructed of stainless steel
  • ensure it is in good mechanical and sanitary condition

Design

Ensure the design and capacity of the tank does not permit air to be drawn into the pasteurizer with the product when operating at the maximum sealed capacity of the flow control device.

  • ensure raw product will drain to the outlet before the outlet becomes uncovered
    • for example, pitch the bottom of the tank to the outlet at a minimum downward slope of 2 % (0.2 cm per 10 cm) and ensure the top of the outlet pipe is lower than the lowest point in the tank (see Appendix B: Constant level tank design)

Cover

  • ensure the tank has a removable cover, or an inspection port with a removable cover, of suitable design to maintain atmospheric pressure and to minimize the risk of contamination
    • pitch the cover to an outside edge to provide drainage
    • flange all openings in the cover upwards and keep covered
    • fit any pipelines entering through the cover (excluding directly clamped lines) with a sanitary umbrella deflector that overlaps the edges of the opening and locate as close to the tank cover as practical
  • use the cover during processing

Airspace and overflow

  • install any product divert lines, recycle lines and water lines coming into the constant level tank in a way that prevents the siphoning of raw milk or cleaning products into finished product or potable water lines (a cross connection). For example:
    • use an overflow outlet that is at least twice the diameter of the largest inlet to the constant level tank
    • ensure the divert, recycle, CIP and water lines terminate and break to atmosphere at least 2 times the diameter of the largest inlet above the maximum overflow point of the constant level tank

Level control device

  • the level control device controls the flow of milk to the constant level tank and therefore provides constant head pressure to the product leaving the tank
  • equip the constant level tank with an automatic device of sanitary design and construction to control the raw product level

Feed pump

The feed pump is used to improve flow through the raw regenerator, and to supply the flow control device with milk from the constant level tank to prevent starving, especially if the flow control device is a homogenizer. It also helps to remove negative pressure and subsequent "flashing" or vaporization in the raw regenerator section. In HHST systems, the feed pump normally operates in both forward and diverted flow, as long as the flow control device is in operation.

General conditions

  • ensure it is of sanitary design
  • ensure it is clean and in good mechanical condition

The raw product side of the regenerator may be by-passed at start up.

  • preclude the entrapment of the product in the by-pass line during periods when the feed pump is in operation. For example:
    • use close-coupled by-pass connections (as close as possible; approximately 2.5 times the pipe diameter)
    • design the manually or automatically controlled valve to permit a slight movement of product through the by-pass line

Location

  • locate the feed pump between the constant level tank and the inlet to the raw product side of the regenerator

Inter-wiring

  • use a feed pump in conjunction with a pressure differential controller-recorder
  • inter-wire it in such a way that it can only operate when the flow control device is "allowed to run"; in other words, the flow control device is turned on by the operator or operating system and safety interlocks that may be installed on the HHST system are not preventing the flow control device from operating
  • test the inter-wiring of the feed pump upon installation and at least every 6 months thereafter and after any change in the feed pump or switch circuits occurs
    • keep records to show testing has occurred

Regeneration section

The regenerator section on HHST systems may either be of a milk-to-milk type or milk-to-heat transfer medium-to-milk. The cold raw product is warmed by hot pasteurized product flowing on the opposite sides of thin stainless steel plates or tubes. The pasteurized product will in turn, be partially cooled.

General conditions

Since the physical distance between the various liquids in the pasteurization/sterilization plates or tubes is extremely small, the liquids have the potential to move through the plates or tubes and cross-contaminate the product if pin holes, cracks or leaks exist.

  • ensure the plates or tubes are of sanitary design, constructed of stainless steel or other corrosion resistant material, and are without pin holes, cracks or leaks
  • ensure the plates or tubes are clean with no presence of milk remnants, milk-stone, mineral scale build-up, or foreign materials
  • if plates are used, equip the plate gaskets with leakage grooves and are not compressed or otherwise showing signs of wear
  • establish a routine program to monitor the condition of plates and tubes (for example, pin holes in plates, gasket condition, cracks), taking into consideration the design specifications, operating conditions and hours of operation, wear and the history of the plates and gaskets
  • check the integrity of all food contact heat exchange surfaces at least once per year (for example, dye recirculation, dye check, pressure retention, helium testing)
    • if there are problems with heat exchanger integrity (plate or gasket issues), implement a more frequent inspection program to verify that the problem has been remedied
    • if pin holes are found in any plate in any section, check all plates in the same section
    • document the cause of any failure (for example, age, compression, metal fatigue)
  • keep records to show testing has occurred

Pressure differentials

  • maintain the pressure on the pasteurized side of the regenerator at least 14 kPa (2 psi) higher than on the raw or heat transfer medium side of the regenerator during forward flow, divert flow and shutdown
    • this protects the pasteurized milk side of the system since pasteurized product will leak into the raw milk (or heat transfer medium) in the case of regenerator plate (or tubular) failures
  • in milk-to-heat transfer medium-to-milk type regenerators:
    • use a safe source for the heat transfer medium (for example, potable hot water)
    • locate the pressure sensors for these controls at the:
      • heat transfer medium inlet on the pasteurized side of the regenerator and,
      • pasteurized product outlet of the regenerator

Failure to maintain the required pressure differential in the pasteurized milk section of the regenerator causes the flow diversion device to assume the divert flow position.

Flow control device (FCD)

The flow control device governs the uniform rate of flow through the holding tube so that every particle of product is held for the required period of time, as specified in the scheduled ESL process. This device is a positive displacement type pump or homogenizer. Other equally effective mechanisms such as a meter based timing system with proper components (for example, centrifugal pump, flow control device or variable speed motor, meter head, relays, alarms and flow recorder-controller) may also be used as a flow control device. Refer to Appendix C: Meter based timing system for more information on meter based timing systems.

General conditions

  • ensure the flow control device is constructed of stainless steel and is in good mechanical and sanitary condition
  • design the driving mechanism so that in the case of wear, belt stretch, the capacity will not increase
  • do not exclude the flow control device from the system during operation of the HHST processing system
  • locate upstream from the holding tube, normally between the outlet of the raw regeneration section and the inlet of the heating section of the HHST processing system

Set and sealed

  • set the maximum operating capacity of the flow control device to ensure an appropriate flow rate to give the proper holding time, in accordance with the calculations done in the scheduled ESL process (refer to Holding verification)
  • when homogenizers are located within the HHST system, make the flow rate evaluations with these pieces of equipment operating (with no valve pressure on the homogenizer) and by-passed to determine the fastest flow rate (minimum holding time)
  • when flow promoters are located downstream from the flow control device, determine the flow rate with the flow control device operating at maximum capacity and the flow promoters in operation
  • if the device is of the variable speed type or a single speed capable of being altered with different belts and pulleys, seal the flow control device at an established flow rate to prevent operation at a greater capacity than that which gives the proper holding time
    • on meter based timing systems, seal the access to the alarm settings for flow diversion set points
    • if maximum speed gives legal holding time, a seal is not necessary

Any change in the line resistance of the system after maximum speed of the pump has been set will alter the flow rate and corresponding hold time. Increasing the line resistance by the addition of plates or piping will decrease the flow rate, increasing holding time. This increase in flow resistance in effect reduces the efficiency of the pasteurizer. Decreasing the line resistance by the removal of plates, pipes, or auxiliary units will increase the flow rate, decreasing the holding time. Wear of the drive belts and pump impellers due to normal operation will gradually decrease the rate of flow through the system, thereby increasing the holding time.

  • evaluate and seal (if necessary) the flow control device upon installation and annually thereafter, and in addition, whenever the seal on speed setting is broken, whenever any alteration is made affecting the holding time, the velocity of the flow (such addition or removal in the number of plates, pipes or auxiliary units) or the capacity of the holding tube or whenever a check of the capacity indicates a speed up
  • keep records of alteration and re-evaluation of the system on file

Fail safe capability

  • ensure there is no by-pass (recirculation line) around the flow control device during processing
    • use a proximity switch so that the flow diversion device will not operate in forward flow
  • a by-pass may be present for CIP purposes as long as it is dismantled and removed during processing

When a meter based timing system replaces the positive displacement flow control device:

  • ensure it has the appropriate controls and instrumentation in place as outlined in Appendix C: Meter based timing system
  • evaluate it upon installation and at least once every 6 months thereafter, whenever the seal on the flow alarm is broken, whenever any alteration is made affecting the holding time, the velocity of the flow or the capacity of the holding tube or whenever a check of the capacity indicates a speed-up
    • keep records to show testing has occurred

Heating section

The heating section of the HHST system provides rapid, uniform and controlled heating of the product up to sterilization temperature. The raw product is usually forced through this section by the flow control device. Heating may be by direct injection or infusion of steam, or indirect heating through tubes, plates, scraped-surface heat exchangers or other accepted systems.

General conditions

  • ensure it is clean and in good condition
  • ensure it is of sanitary design
  • ensure it is constructed of stainless steel or other corrosion resistant material

Indirect heating

  • verify there are no leaks at gaskets, seals, joints or connections during operation

Direct heating

With direct heating, the steam injection process is an inherently unstable process. When steam is injected into a fluid, condensation of the steam may not be completed inside the injector, causing temperature variations in the holding tube that could lead to some milk particles being processed below the required temperature.

  • use a direct steam injector that is designed to provide complete condensing of the steam inside the injector

Heating medium

  • ensure the steam used as a heating medium is free of harmful substances or extraneous matter
    • use boiler and water treatment chemicals and other additives that are safe and suitable for use in dairy processing
    • use culinary steam for direct steam injection or infusion (see Culinary steam)

Any vapours in the holding tube can displace product, resulting in shorter holding times. Steam should be as free as possible from non-condensable gases.

  • install a de-aerator on the boiler to help keep the holding tube free of non-condensable gases

Pressure limit recorder controllers

For both direct and indirect heating systems, product pressures in the holding tube and across the steam injector are monitored and controlled to keep the product in a liquid phase and to ensure adequate isolation of the injection chamber.

For HHST systems that are capable of operating with less than 518 kPa (75 psi) pressure in the holding tube:

  • use a pressure limit recorder controller to monitor the product pressure in the holding tube
    • this instrument has a pressure switch that causes the flow diversion device to move to the divert position if the product pressure falls below a prescribed value
  • determine the pressure switch settings during the set up and testing procedures
  • for direct heating systems with steam injection only:
    • use a differential pressure limit indicator to ensure adequate isolation (supplementary orifices) of the injection chamber so that product is uniformly heated in the chamber
      • ensure it has a differential pressure switch that will cause the flow diversion device to move to the divert position if the pressure drop across the injectors is below 69 kPa (10 psi)
  • keep records of the holding tube operational pressures, the pressure switch settings, and the test results
    • follow up on out-of-specification findings

Sealed

  • once all tests have been completed, seal the controllers and settings to prevent unauthorized adjustments

Ratio controller (direct heating systems)

Use a ratio controller for systems applying direct heat to the product to prevent water adulteration of the product being processed.

  • locate 1 sensor immediately prior to the point of steam injection (incoming product), and the other immediately after the product exits the vacuum chamber (outgoing product)
  • determine the optimum temperature differential between the incoming and outgoing product by total solids analysis
    • set this differential on the ratio controller
  • use the ratio controller to automatically control the pre-heat steam supply or the flash chamber vacuum to prevent water adulteration of the product
    • the ratio controller is interlocked with the vacuum pump and/or steam controller and automatically monitors and controls the amount of vacuum applied and/or the amount of steam injected
  • when a water feed line is connected to a vacuum condenser and the vacuum chamber is not physically separated from the vacuum condenser, make adjustments to the system to prevent the back up and overflow of water from the vacuum condenser into the vacuum chamber
    • this prevents adulteration of the product with water

Holding section

This is the part of the HHST processing system in which heated product is held for the specified time required in the scheduled ESL process. This section is located after the final heating section of the HHST processing system, and may include the sensing chamber at the end. The sensing chamber is that portion which houses both the official indicating thermometer and the safety thermal limit recorder hot milk temperature sensors.

General conditions

  • ensure holding tube and all connections:
    • are of sanitary design and construction
    • are clean and in good mechanical condition
  • locate the holding section after the flow control device with no intervening flow promoters, and after the final heating section, but before the flow diversion device or any cooling section
  • do not install any devices for short circuiting a portion of the tube or for removing a section of the tube
    • such devices could reduce the holding time below that specified by the scheduled ESL process
  • do not heat any portion of the holding section between the inlet and the sensing chamber

Slope and support

A slope eliminates any air entrapment in the holding tube, which could displace product and reduce the holding time.

  • when the holding section is comprised of a holding tube, position the holding tube so that it has a continuous upward slope (including elbows) of at least 2% (2 cm per 100 cm)
    • to prevent variance in the slope, use mechanical supports to permanently fix the holding tube in place

Holding verification

  • determine the holding time by calculation, as specified in the scheduled ESL process
    • include in these calculations the extra condensate volume from steam added, if direct heating from steam is used

The calculated holding time is used to determine the minimum length of the holding tube, based on the flow rate used.

  • calculate the proper holding tube length upon installation
    • re-calculate it after any change is made to the system that could alter the flow rate and affect the holding time
    • ensure the actual length of the holding tube is no less the calculated length
  • check the flow rate annually, whenever the seal on the flow control device is broken, and after any change is made to the system that could affect the holding time
    • measure the flow rate of the system under the conditions outlined in the Set and sealed
    • verify that the measured flow rate is the same or lower than the value used in the calculation for the scheduled ESL process
  • keep records of the above on file, including all supporting calculations

Flow diversion device (FDD)

The flow diversion device controls the direction of product flow according to the establishment of safe conditions within the processing system. It is located downstream from the regenerator section, and is designed to automatically divert flow away from the surge tank or filler.

General conditions

  • ensure the flow diversion device design prevents potentially unpasteurized product from contaminating the fillers or surge tank(s)
  • ensure the flow diversion device and the return lines are constructed of stainless steel and are clean and in good mechanical condition
  • ensure the valves, plunger seals and "O"-rings are clean and in good mechanical condition
  • ensure the stem length of the valves is non-adjustable (this ensures that proper seating of the valves is not disturbed)
    • if the stem has a threaded attachment, use a locking pin or other equivalent locking mechanism to prevent any misalignment
  • ensure air to the flow diversion device is clean and unrestricted

When pasteurizing ESL products, use 1 of the following flow diversion device designs:

  1. Dual-stem type flow diversion device: incorporates 2 3-way valves in series.
    • separate the leak detect line from the divert line and ensure it is free draining from the lower port of the leak detect valve back to the constant level tank (or other appropriate receptacle)
  2. Steam-block type flow diversion device system: incorporates a divert valve and 1 or more steam-block valves.
    • ensure the divert valve is fail-safe, position detectable and equipped with means to provide an alarm and protection when required
    • ensure the steam block valve has a continuous supply of steam and a continuous visible bleed of steam or condensate to the drain
    • equip the steam block valve with an interlocked resistance thermal device (RTD) located at the lowest level of the barrier to detect any fluid leakage into the barrier
      • if leakage is detected, an alarm or other appropriate system alerts the operator to the steam barrier failure
      • in the event of steam barrier failure, follow the actions indicated in the scheduled ESL process deviation procedure
    • use a steam barrier when the system is not equipped with a dual-stem type flow diversion device incorporating 2 3-way valves
    • equip dual stem flow diversion devices with a control panel where the control functions and relays are installed
      • this control panel can be part of a universal panel unit
      • ensure the panel is free of any devices or switches that could override the control functions and jeopardize the safety of pasteurized product
      • on valves that have external solenoids, ensure the air lines do not have quick release couplings

Installations on HHST processing systems often have operating parameters for the flow diversion device that are so complex they can only be handled by a micro-processor or programmable logic controller (PLC).

  • a PLC or micro-processor control used strictly for flow diversion device function does not need to meet the criteria in the Programmable logic controllers and computers, but ensure all valve functions still meet the test standards

Return line

  • ensure the flow diversion device has a pipeline that directs the flow of potentially unpasteurized product safely away from surge tanks and /or fillers
    • configure any subsequent valves installed on this line in all positions to allow free flow from the flow diversion device, without blocking the flow or creating excessive back pressure on the flow diversion device

A flash cooler may be installed on the return line to prevent injury to bystanders during divert events when pasteurizing/sterilizing the system.

Location

Locate the flow diversion device downstream from the regeneration and before the surge tanks or fillers.

  • this is necessary since diverting hot product right after the holding tube could result in flashing in the divert line

Fail safe divert capability

Indirect heating systems

  • ensure the flow diversion device automatically diverts product away from the surge tanks or fillers under at least 1 of the following conditions:
    • the product temperature in the sensing chamber drops below the specification in the scheduled ESL process
    • when the differential pressure between pasteurized product and unpasteurized product or heat transfer media is less than 14 kPa (2 psi) in the regenerator
    • when adequate product pressure is not maintained in the holding tube to prevent boiling (less than 69 kPa (10 psi) above the boiling pressure of the product in the holding tube)
    • when there is loss of electrical power or compressed air to the flow diversion device solenoids
    • when excessive flow rate is detected for systems using a magnetic flow meter as a flow control device

Direct heating systems

  • ensure the flow diversion device automatically diverts product away from the surge tanks or fillers under at least 1 of the following conditions:
    • when the product temperature in the holding tube drops below the specification in the scheduled ESL process
    • when the differential pressure between pasteurized product and unpasteurized product or heat transfer media is less than 14 kPa (2 psi) in the regenerator
    • when adequate product pressure is not maintained in the holding tube to prevent boiling (less than 69 kPa (10 psi) above the boiling pressure of the product in the holding tube)
    • when there is loss of electrical power or compressed air to the flow diversion device solenoids
    • for steam infusion systems, when there is loss of pre-determined parameters (for example, temperature, pressure level, as specified in the scheduled ESL process) at the steam infusion chamber exits
    • for steam injector systems, when there is improper differential pressures across the steam injectors at the holding tube (less than a 69 kPa (10 psi) drop across the injector)
    • when excessive flow rate is detected for systems utilizing a magnetic flow meter as a flow control device
  • install the flow diversion device with position detection capabilities to provide an electrical signal to the safety thermal limit recorder or legal panel

After an event causing a flow diversion, hold all product contact surfaces between the holding tube and the flow diversion device at or above the required pasteurization or sterilization temperature continuously and simultaneously for at least the required pasteurization or sterilization time, as outlined in the scheduled ESL process (see also the sub-section Thermal limit controller sequence logic).

Leak detect

In HHST systems where the filler continues to operate from a surge tank while the flow diversion device is in the divert position, and the flow diversion device is a steam-block type:

  • use an aseptic barrier system to separate pasteurized product from potentially under processed product (this is not necessary for systems that use a dual-stem type flow diversion device valve assembly)
  • locate this segregating valve system between the flow diversion device and the surge tank
    • the barrier(s) may include 1 or more steam blocks
  • include a resistance thermal device (RTD) or other suitable temperature sensor at the lowest level of the barrier to detect barrier failure due to steam loss or fluid leakage into the barrier
  • if barrier failure is detected by the temperature sensing device, ensure an alarm system is triggered to alert the operator to the alarm condition, immediately initiating a "shut down sequence" for the processing system as specified in the scheduled ESL process
  • after a barrier failure condition, completely drain the fillers, surge tanks and lines, and HHST system of product. Re-pasteurize or re-sterilize all equipment before processing and filling resumes.
    • place implicated product on hold until its pasteurized condition is assessed
    • note this failure in the operator's log book and complete a process deviation report, including the date and time of the process deviation, investigation into the cause of the process deviation and action taken both on product and other corrective measures

Sealed

  • seal the flow diversion device legal panel and valve position detector cover(s) to prevent unauthorized tampering or adjustments
  • seal the valve position sensing detectors, valve actuating solenoids and relays
  • if a PLC or micro-processor is used to control valve functions, seal the access to programming functions

Indicating thermometer

The indicating thermometer provides the official processing temperature of the product, which is a critical factor in the scheduled ESL process.

General conditions

  • ensure it is clean and in good operating condition
  • ensure it is mercury actuated or equivalent, or a resistance temperature detector (RTD) of sufficient accuracy and precision
  • mercury actuated or equivalent thermometers:
    • have direct reading
    • are contained in a corrosion resistant case which protects against breakage and permits easy observation of the column and scale
    • have nitrogen filling above the mercury or an equally suitable gas
    • have a Corning normal bulb or equally suitable thermometric glass
  • Resistance Thermal Device (RTD) type thermometers:

Location and accessibility

  • locate the indicating thermometer in the sensing chamber, along with the probe for the safety thermal limit recorder
    • locate after the probe for the safety thermal limit recorder
    • ensure the distance between the 2 probes is not more than 30 cm (12 inches)
  • ensure that the indicating thermometer is easily and safely accessible by the operator, to allow accurate reading of the processing temperature

Specifications

  • graduate scale in 0.5°C (1°F) divisions with not more than 9.4°C (17°F) per 25 mm (1 inch) of graduated scale
  • ensure the stem fitting is pressure-tight against the inside wall of the fitting, with no threads exposed to product

Calibration

  • test the indicating thermometer for temperature accuracy and thermometric response upon installation and at an interval of at least every 6 months
  • investigate the safety of the product produced with out of calibration equipment
    • for example, if the indicating thermometer at the outlet of the holding tube is reading higher than the calibration standard, the product may be under processed
  • increase the frequency of testing if the calibration is consistently found to be out of adjustment
    • if the calibration is consistently found to be out of adjustment, immediately identify and rectify the reason for the calibration problems
  • keep records of tests performed to determine the thermometer's calibration

Sealed

  • seal the access to calibration adjustments once the thermometer has been calibrated
    • attach the seal to the cover or scale plate on mercury in glass (MIG) thermometers
    • seal the thermometer panel and the RTD sensor housing on resistance thermal devices

Safety thermal limit recorder (STLR)

The function of this device is to:

  • automatically record the temperature of the product in the sensing chamber on a chart that also indicates the time of day, and provides a record of the process
  • indicate and record the position of the flow diversion device (forward or divert flow)
  • supply a temperature cut out signal input to the thermal limit controller unit

General conditions

  • ensure the safety thermal limit recorder meets the criteria established by the manufacturer of the device
  • ensure units are manufactured for safety thermal limit recorder usage
    • have any modifications performed by, or authorized by, the manufacturer
    • house in a case that is moisture-proof under normal operating conditions
  • operate the safety thermal limit recorder as specified by the manufacturer
  • keep in place any covers preventing access to food safety adjustments, such as the divert set-point
  • install the single probe which senses the temperature of the temperature recording pen with a pressure-tight seal against the inside wall of the pipe, with no threads exposed to milk or milk products
  • clearly identify all switches on the safety thermal limit recorder and any controls associated with the operation of the HHST unit
    • ensure there are no switches or devices that could jeopardize the safety of the product by bypassing or overriding any food safety controls
  • service the safety thermal limit recorder at least once per year and maintain it on a continual basis so that the instrument functions according to specifications
    • keep records of service and maintenance on file

Location

  • install the single probe which senses the temperature for both the temperature recording pen and the cut-out control in the sensing chamber, before the indicating thermometer probe
    • ensure the distance between the 2 probes is not more than 30 cm (12 inches)

Specifications

  • use a circular chart that makes one revolution in not more than 12 hours and that is graduated for a maximum record of 12 hours
    • use 2 charts if operations extend beyond 12 hours
  • equip the chart positive drive mechanism with a system to prevent slippage or manual rotation (for example, a pin to puncture the chart paper)
  • use charts that correspond with the chart number displayed on the identification plate of the safety thermal limit recorder
  • ensure chart graduations do not exceed 1ºC (2ºF) within a range of 5.5ºC (10ºF) of the processing temperature
  • ensure the chart temperature scale does not exceed 30ºC (55ºF) per 25 mm (1 inch) within a range of 11ºC (20ºF) of the processing temperature

Temperature recording pen

  • adjust the pen reading to coincide with that of the indicating thermometer

Frequency (Event or Divert) pen

This pen records the position of the flow diversion device with a line on the outer edge of the chart. Some systems may be designed so that the event pen indicates the critical factors required to enable forward or diverted flow. In such cases, the event pen will indicate when at least one of those pre-determined critical factors is not met.

  • ensure the frequency pen tracks with the temperature recording pen or follows the same time line
    • on certain models, a reference arc is used to align these 2 pens

Third pen

If the safety thermal limit recorder requires a third pen, as with a multiple temperature divert unit:

  • ensure this third pen does not track with the other 2
  • adjust it to lead or follow the other pens by a specified time factor. Display this value on the safety thermal limit recorder unit.
  • use a different colour of ink from that used for the other 2 pens

Thermal limit controller sequence logic

Since the flow diversion device is located downstream from the regeneration and cooling sections on a HHST systems, forward flow conditions cannot occur until all product contact surfaces from the holding tube to the flow diversion device have been held at or above the required system pasteurization temperature for the time specified in the scheduled process.

The thermal limit controller unit uses a sequence of electrical inputs and timers to ensure the HHST processing system is pasteurized or sterilized before allowing the flow diversion device to assume the forward flow position.

Indirect heating systems

  • do not allow forward flow to occur until:
    • all conditions identified in the scheduled ESL process are met
    • the sensors at the flow diversion device and at the holding tube have reached the temperature and time specified for system pasteurization/sterilization in the scheduled ESL process

Direct heating systems

  • do not allow forward flow to occur until the sensors in the following locations have reached the temperature and time specified for system pasteurization or sterilization in the scheduled ESL process:
    • at the holding tube
    • at the coolest part of the vacuum chamber or other coldest points determined by the person that developed the scheduled ESL process
    • at the flow diversion device

This assures that all parts of the system have been properly pasteurized or sterilized before allowing the flow diversion device to move into the forward flow position. Once the minimum times and temperatures have been satisfied for system pasteurization or sterilization, the 2 auxiliary controllers (see Auxiliary temperature recorders and controllers (at the flow diversion device, and at the vacuum chamber on direct heating systems) will then "drop out" of the control loop, and the primary recorder-controller (safety thermal limit recorder) at the holding tube outlet (sensing chamber) resumes its function for normal product processing temperature control.

  • failure to meet any safe forward flow conditions (such as temperature below cut out, improper regenerator pressure differential, improper holding tube pressure, loss of predetermined liquid levels at steam infusion chamber exits or loss of differential pressure across the injector) will cause the flow diversion device to immediately move into the divert flow position, unimpeded by the thermal limit controller unit
    • after a diversion event, do not resume forward flow until the system is re-pasteurized or re-sterilized and the thermal limit sequence logic is again satisfied as per the scheduled ESL process
  • enclose and seal the settings and adjustments for the thermal limit controller unit to prevent unauthorized tampering

Calibration

  • test the performance accuracy of the safety thermal limit recorder and thermal limit controller upon installation, at least once every 6 months and whenever a seal has been broken
  • keep records of tests to determine accuracy on file
  • perform the following tests:
    • recorder temperature accuracy
    • recorder time accuracy
    • cut in/cut out
    • thermal limit controller sequence logic
    • recording thermometer check against indicating thermometer (ensure the recording thermometer does not read higher than the corresponding indicating thermometer)
      • perform this test daily
      • should the recording temperature differ from that of the indicating, take the necessary measures to correct the situation
  • use the methods in Critical process test procedures – Thermometers to test the accuracy of thermometers
    • follow-up on out of specification findings
    • investigate the safety of the product produced with out of calibration equipment

Sealed

  • seal the access to safety thermal limit recorder cut in/cut out adjustments
    • the sealing device should provide an indication of tampering or unauthorized adjustment
  • seal the enclosure for the settings and adjustments for the thermal limit controller sequence logic to prevent unauthorized adjustment

Programmable logic controllers (PLC) and computers

Control of non-food safety functions

Programmable logic controllers (PLC) or computers installed on an HHST processing system for operational convenience (in other words, have no impact on food safety) meet the following criteria.

  • ensure the computer does not control any food safety function when the system is in processing mode
  • when in CIP mode, the computer may control any functions when CIP mode is first selected
  • non-food safety controls, such as product pumps or valves, may be controlled at any time by the computer
  • the vendor provides a testing protocol to verify that food safety safeguards are not under the control of the computer during the production cycle

Control of food safety functions

Computers for the operation of food safety controls on HHST processors have additional considerations. Computers are different from hard-wired controls in 3 major areas. The design of computerized food safety controls needs to address these areas to provide adequate public health protection.

  • Unlike conventional hard-wired systems, which provide full‑time monitoring of the food safety controls, the computer performs its tasks sequentially, and the computer may be in real time contact with the flow diversion device for only 1 millisecond. During the next 100 milliseconds (or however long it takes the computer to cycle once through its tasks), the flow diversion device remains in forward flow, independent of temperature in the holding tube. Normally, this is not a problem because most computers can cycle through 100 steps in their program many times during 1 second. The problem occurs when the computer is directed away from its tasks by another computer, or the computer program is changed, or a seldom used Jump, Branch, or Go To Instruction diverts the computer away from its food safety control tasks.
  • In a computerized system, the control logic is easily changed because the computer program is easily changed. A few keystrokes at the keyboard will completely change the control logic of the computer program.
    • seal the access to the computer's programming function
      • ensure that the computer has the correct program installed when it is re-sealed
  • Complicated computer programs have a greater potential to contain errors.
    • for food safety controls, keep the computer program simple and of limited scope to help ensure that it is error‑free

Pressure differential recorder controllers (PDC-recorder)

This section covers the actual pressure devices used to maintain proper pressure relationships. As explained in the Regeneration section and the Cooling section, proper pressure relationships must exist across all media to prevent contamination of the pasteurized product by raw product, heating medium and cooling medium. These pressure relationships must be maintained under forward flow, divert flow and shutdown.

  • HHST systems have a pressure differential recorder to monitor and record pressures
    • this ensures that proper pressure differential has been maintained

General conditions

  • ensure sensors are clean and in good mechanical condition
  • design to allow easy dismantling of the sensors for inspection
  • house the indicating and recording unit is housed in an appropriate moisture proof enclosure
  • inter-wire the pressure differential recorder controller with the flow diversion device such that divert occurs when the pasteurized product pressure in the regenerator does not exceed the pressure on the raw side of the regenerator by at least 14 kPa (2 psi)
    • for milk-to-heat transfer medium-to-milk type regenerators, the divert occurs when the pasteurized product pressure does not exceed the heat transfer medium pressure by at least 14 kPa (2 psi)

A PLC can be used to control the pressure differential in lieu of a pressure differential controller as long as the same control conditions are respected such as inter-wiring with flow diversion device, pressure indicating and recording capabilities, and set-point indication.

Pressure gauges may be used to verify the pressure display for the pressure differential recorder controller.

  • ensure pressure gauges, if used, are clean and in good condition

Location

2 types of regeneration are used in HHST systems, product-to-product regenerators, and product-to-heat transfer medium-to-product regeneration systems. The latter system is often preferred for some products, because it allows more even heat transfer and prevents burn-on.

Product-to-product regenerators:

  • install the raw product sensor between the feed pump and the raw product inlet to the regenerator
  • install the pasteurized product sensor at, or downstream from, the pasteurized product outlet of the regenerator

Product-to-heat transfer medium-to-product regenerators:

  • install the raw side pressure sensor in the water loop after the water pump (location of highest media pressure in the loop)
  • install the pasteurized side pressure sensor in the product line at the pasteurized side outlet of the regenerator (location of lowest pasteurized product pressure)

Specifications

  • use a circular chart that makes 1 revolution in not more than 12 hours and that is graduated for a maximum record of 12 hours
    • use 2 charts if operations extend beyond12 hours
  • equip the chart positive drive mechanism with a system to prevent slippage or manual rotation (for example, a pin to puncture the chart paper)
  • use charts that correspond with the chart number displayed on the identification plate of the pressure differential recorder controller
  • ensure chart scale divisions do not exceed 14 kPa (2 psi) on a working scale of not more than 140 kPa (20 psi) per 25 mm (1 inch)
  • have the pens record the raw side pressure and the pasteurized side pressure or the pressure differential
    • electronic data collection, storage and reporting of pressure differentials can be used as an alternative to circular charts provided they meet the criteria for safety thermal limit recorder charts

Calibration

  • test the accuracy of the pressure display and recorder, and the differential controller divert function, upon installation, at least every 6 months and whenever the controller is adjusted or repaired
  • check pressure gauges, if used, for accuracy upon installation, at least every 6 months and whenever gauges are adjusted or repaired
  • use the testing methods in Critical process test procedures – Pressure differential
    • keep records of testing results and any corrective actions

Sealed

  • seal the pressure differential recorder controller adjustments/legal panel

Auxiliary temperature recorders and controllers

These instruments may be used in several locations on the HHST processing system, to provide a record of start-up pasteurization/sterilization and product processing temperature, and to provide temperature signals to the thermal limit controller unit or other processing controls.

General conditions

  • ensure they are clean and in good mechanical condition
  • ensure pens are operational and easily calibrated
  • ensure they are moisture-proof under normal operating conditions
  • equip the chart positive drive mechanism with a system to prevent slippage and manual rotation (for example, pin to puncture chart paper)
  • produce a continuous permanent record of all pertinent information (time of day and temperature)
  • use the chart part number indicated on the charter recorder
  • service the unit at least once a year
    • keep records of the servicing on file

Cooling section

This section of the pasteurizer uses chilled water and/or glycol to cool the hot product down to packaging and filling temperature. Since the flow diversion device is located downstream from this section, the cooling section may become contaminated with potentially unpasteurized product during divert, and must be re-pasteurized/re-sterilized as part of the thermal limit controller sequence logic after a divert event.

Flash coolers are sometimes installed on the divert line to prevent injury to bystanders if a divert event occurs during the pasteurizing of the holding tube and cooling section, when there is no cooling turned on.

General conditions

  • ensure it is clean and in good condition
    • during operation, ensue there are no leaks exist at gaskets, seals, or connections
  • ensure it is constructed of stainless steel or other corrosion resistant and easily cleanable material
  • design to allow for easy cleaning and to not entrap product in crevices, joints, seams or openings
  • establish a routine program to monitor the condition of plates and tubes (for example, pin holes in plates, gasket condition, cracks), taking into consideration the design specifications, operating conditions and hours of operation, wear and the history of the plates and gaskets
    • if pin holes are found in any plate in any section, check all plates in the same section
  • check the integrity of all food contact heat exchange surfaces at least once per year (for example, dye recirculation, dye check, pressure retention, Helium Testing)
    • if problems with heat exchanger integrity (plate or gasket issues) have occurred, implement a more frequent inspection program to verify that the problem has been remedied
  • keep records to show testing has occurred
    • document the cause of any failure (for example, age, compression, metal fatigue)

Pressure differentials

  • maintain the pressure on the pasteurized product side of the plates at least 14 kPa (2 psi) higher than on the cooling medium side of the plates during the forward flow, divert flow and shutdown
    • this reduces the possibility of chemical contamination in the event a pinhole leak develops in the plates
  • where there is no automatic means to correct the pressure relationship as described above, monitor and record the pressures a minimum of twice daily

An automated mechanism is an effective means of achieving the correct pressure relationship in the cooling section during forward flow, divert and shutdown conditions so that the pressure on the pasteurized product side is greater than the cooling media side.

  • when there is no automated mechanism, have documented control measures to ensure the correct pressure relationship is maintained
  • record the pressures a minimum of twice a day during production, at beginning and end of run
  • check the cooling media for microbial contamination (for example, coliforms, psychrotrophs) at a frequency of at least once per week
  • test the pH of cooling media at a frequency of at least once per week
  • visually check cooling media check at least once per week
  • perform pinhole tests and plate teardowns at a minimum of once every 6 months
  • provide parameters of acceptability/unacceptability
  • provide preventive measures to be taken to prevent the re-occurrence of deviations
  • schedule plate replacements
  • ensure pressure gauges, if used, are clean and in good condition
    • check gauges for accuracy upon installation and at least once per year
  • locate pressure differential controller sensors, or pressure gauges, at the cooling media inlet and at the pasteurized product outlet

Cooling medium

Heating, pre-heating and chilled water media can be a potential source of contamination to the pasteurized product.

  • check chilled water media at least monthly for microorganisms (for example, psychrotrophs, coliforms)
    • keep records of microbial test results
  • use cooling water additives and cooling media products that are safe for use in dairy processing
    • keep documents that demonstrate their safety

Homogenizer

The homogenizer is a high pressure pump that produces a homogenized product by reducing the size of fat globules as they are forced through a small orifice under high pressure. Since the homogenizer is a positive pump, it can be utilized as a flow control device.

If the homogenizer is utilized as a flow control device, refer to the Flow control device section.

General conditions

  • ensure filters, homogenization valves, pistons, seat valves, pressure gauges and dead ends are clean and in good mechanical condition
  • ensure product contact surfaces are made of stainless steel or other food grade, non-corrosive material
  • equip homogenizers with appropriate gauges

Homogenizer larger than flow control device

  • design and install homogenizers larger than the flow control device so that the flow rate is not affected
  • ensure homogenizers located downstream do not affect the flow rate (for example, physical break, pressure sensors in holding tube, flow control device is a meter based timing system)

If a homogenizer located downstream from the flow control device has a capacity greater than the flow control device, the homogenizer is not a flow promoter. For example:

  • install a recirculation line between the inlet (suction line) and the outlet (pressure line) of the homogenizer to prevent the homogenizer from "starving"
    • ensure this line is unrestricted and does not contain a shut-off valve
      • it may contain a check valve allowing flow only from the outlet back to the inlet
  • ensure the diameter of the recirculation line including the check valve is equal or greater than the supply line to the homogenizer
  • ensure the homogenizer does not reduce the holding time, and does not reduce the pressure required in the holding tube to keep the product in the liquid phase

Surge tank

The surge tank acts as a pasteurized product balance tank for the fillers. This allows both the fillers and the HHST processing system to operate independently.

  • install the surge tank downstream from the flow diversion device
  • protect the surge tank by installing 1 or more steam barriers (or other systems that provide an equivalent level of protection) at the flow diversion device
    • filling operations can continue from the tank while the HHST processing system is in divert
  • if there is no steam barrier to protect the surge tank, empty and re-sanitize the fillers and surge tanks after a divert event (refer to Appendix G: Preventing cross connections)

General conditions

  • ensure, for example, the surge tank and associated valves, thermometers, are clean and in good condition

Stuffing pump

Stuffing pumps may be used to improve the efficiency of other devices, such as homogenizers.

General conditions

  • ensure is it constructed of stainless steel or a suitable corrosion resistant material
  • ensure is it clean and in good mechanical condition
  • ensure all painted exterior surfaces are free of flaking paint and rust
  • disassemble any pumps not specifically designed for CIP use for cleaning
    • remove impellers and back plates for cleaning as well

Installation/operation

  • inter-wire the product stuffing pump with the flow control device so that it shuts off when the flow control device is not allowed to run
    • stuffing pumps may be configured to start prior to starting the homogenizer provided the flow control device is in an "allowed to run" condition.
  • install and operate the stuffing pump in a way that it will not:
    • influence the proper pressure relationship within the regeneration section
    • reduce the holding time below the required minimum

If the homogenizer is used as a flow control device, a centrifugal type stuffing pump may be installed between the raw product outlet of the regenerator and the inlet manifold of the homogenizer to supply the desired pressure to the homogenizer.

  • perform tests upon installation, at least once every 6 months thereafter and when the micro-switch is re-set or replaced
    • keep records to show testing has occurred

Packaging

Packaging conditions

  • have documented control measures to ensure that packaging materials are received and stored in an acceptable manner (refer to Transportation and storage)
    • receive and store packaging materials in a clean and sanitary manner to minimize the risk of contamination and physical damage to the materials
    • in processing areas, handle packaging materials in a way that does not pose a contamination risk
  • store ESL pasteurized products continuously under refrigeration at a temperature of 4°C or less

Packaging records

  • as part of the production records, keep a packaging/filling production log and an on-line record of critical parameter testing for the pasteurization operation
  • verify that all critical controls are recorded and meet specifications
    • review records of critical controls before the product is released
  • include the following in the operator's packaging/filling production log records:
    • date
    • batch
    • packaging machine number
    • product being filled and packaged
    • source of product (for example, from surge tank or sterilizer)
    • preparations taken to bring equipment into packaging readiness (for example, inspection/repairs/replacements of valves, gaskets, gauges, warning lamps ), cleaning, preheating and sterilization steps; pressure and temperature checks
  • record the following information to ensure product safety and to provide a historical record of the process:
    • date
    • hourly filling code
    • machine number
    • packaging start time
    • packaging stop time
    • machine downtime and reason, corrective action taken to restart
    • intervals at which teardowns conducted
    • types of teardowns conducted (for example, longitudinal seal quality, transversal seal quality), classification of defects observed, corrective action taken
    • if used, hydrogen peroxide concentration
    • production volume
    • unusual occurrences
    • operator's signature
    • signature of individual responsible for review
Date modified: