Dairy processing: Aseptic processing and packaging systems

Introduction

The following provides recommended practices for aseptic processing and packaging of dairy products.

Aseptic processing and packaging is the filling of a commercially sterile product into a commercially sterile container followed by hermetic sealing in a commercially sterile atmosphere. For dairy applications, this process uses temperatures above the boiling point for a very short period of time to sterilize milk products. It is followed by the aseptic packaging step to give a shelf-stable commercially sterile product. The processing and filling steps have a number of variables that are controlled by design specification (the scheduled process).

Record keeping

In a Preventive control plan (PCP), it is important to maintain and keep records of activities which demonstrate that the PCP is implemented and working effectively. Records can be in either a hard copy or electronic format. Refer to Record keeping for your preventive control plan for additional information.

Aseptic processing and packaging system (APPS) flow schematic

The aseptic processing and packaging system (APPS), although similar to a high temperature short time (HTST) pasteurizer, operates at even higher temperatures and pressures. It also uses steam seals and other means to ensure a commercially sterile product.

• Notify the person responsible for the scheduled process (for example, a process authority) whenever changes are made to the processing system
  • even slight modifications to the APPS may have an impact on its operation and safety

Up-to-date and accurate

• Maintain on file a flow schematic outlining the APPS system and its related components (for example, constant level tank, feed pump, regeneration system, pressure differential recorder-controller, flow control device, heat exchangers, thermometers, holding tube, safety thermal limit recorder, flow diversion device, aseptic barriers, aseptic packaging)
• Update the flow schematic whenever equipment and/or pipelines are installed or changed

No cross connections

A cross connection is a direct connection allowing one material to contaminate another.

• Segregate incompatible products such as raw materials and pasteurized or sterilized food products, cleaning products and food products, and waste materials or utility materials and food products
• Prevent inadvertent cross contamination of independent food products (for example, soy beverages and milk) which may pose allergenic concerns

To segregate incompatible products:

• use separate pipelines and vessels for incompatible products
• establish effective physical breaks at connection points between incompatible products

The installation of segregating valves for the purpose of separating cleaning solutions from food products does not constitute a physical break, except that a properly designed valve arrangement (raw side) and a properly designed aseptic barrier (sterilized side) may be used (for example, while cleaning the packaging line and/or surge tank while processing product).

• A properly designed aseptic barrier could, for example, include one or more steam blocks with a temperature sensor alarm to indicate barrier failure due to leaks or loss of steam

The design of the constant level tank and piping, and the product divert device are areas where potential cross-connections could exist if the design or installation is improper. Refer to the Constant level tank and Flow diversion device sections for more details.

Refer to Preventing cross-contamination and Appendix G: Preventing cross connections for more information on preventing cross connections in dairy establishments.

Scheduled process

• Use a qualified person who has scientific knowledge and experience in this field (for example, a process authority) to develop, validate and document the scheduled process
  • account for the combinations of variations encountered in commercial production in the process
• Include in the scheduled process documentation:
  • the scientific basis for selecting certain specifications and requirements, calculations used to derive numerical values for the specifications, a review of applicable regulations and guidelines, and a descriptive commentary on what equipment and controls are being used and why
  • any critical factors that may affect the achievement of commercial sterility
  • testing procedures and operator instructions
• Achieve commercial sterility by designing the process to meet a F_o = 3.0 as a minimum (see Appendix K: F_o value for an explanation of F_o value)
  • if the process is designed to meet commercial sterility as per the Safe Food for Canadians Regulations (SFCR) but does not meet a minimum F_o = 3.0, other time and temperature parameters may be used provided the process has been validated to provide an equivalent level of safety
• Use incubation trials and analysis to confirm that the process is valid:
  • upon initial commissioning of the processing unit
  • after significant alterations have been made to the system or scheduled process
• Have the person responsible for the scheduled process assess any changes to an APPS for potential impacts on the safety of the product

Operating instructions

• Provide detailed operating instructions to the APPS operator to ensure that the process is operated according to the design of the scheduled process
  • include procedures for monitoring critical factors during pre-sterilizing at start-up, during production, and what to do if the critical factor limits are not met (process deviation procedures)

Critical factor adherence

Critical factors are those factors specified in the scheduled process as being necessary for the achievement of commercial sterility in the product. If any of these critical factors are not within the limits documented in the scheduled process, it is a process deviation and the product cannot be considered commercially sterile.

• Place the affected product on hold pending a thorough and documented investigation
• Have a competent person review the results of the investigation
  • this person obtains the appropriate evidence through documented sterility trials that the product is commercially sterile
    • the lack of spoilage in incubated samples is not, by itself, indicative of commercial sterility but rather only indicates that other problems do not exist (for example, low level container closure failure)
  • if this person authorizes in writing that the results of the investigation scientifically demonstrate that the product is commercially sterile, the affected product can be released

Critical factor records

Processing records are part of the preventive control plan. They indicate whether the products were processed within the acceptable limits for the critical factors (no process deviations). Detailed documentation of process deviations permit follow up to determine the cause and corrective action for the deviation and to ensure any compromised product is properly identified and handled to prevent distribution or sale.

Recording charts are part of the critical factor records. These records can be in either a hard copy or electronic format but are to provide a permanent record. Refer to Record keeping for your preventive control plan for additional guidance on best practices for recording information.

• Review all production records on a timely basis
  • evaluate all operator notes on unusual occurrences to ensure that a critical process parameter was not violated (that is, that an unusual occurrence was not in fact a process deviation requiring product quarantine)

1. Recording charts for aseptic processing and packaging systems provide the following data on every chart. (If operations extend beyond 12 hours, use a 24-hour chart if it can provide an equivalent level of accuracy and clarity to a 12-hour chart):

• plant name and address or licence number
• date, shift and batch number where applicable
• recorder unit identification when more than one is used
• product type and amount of product processed (may be recorded in production records)
• identification of sterilization cycles (for example, indicate when water or product being run)
• identification of Clean in place (CIP) mini-wash (if used)
• unusual occurrences and operator comments
• signature or initials of the operators
• chart pen markings (Note: they should not overlap)

2. For the Safety Thermal Limit Recorder (STLR):

• reading of the official indicating thermometer during processing
  • ensure this reading is not lower than the recording thermometer reading
• record of time the flow diversion device is in the forward flow position, as indicated by the event pen
• recording thermometer tracing
• set point tracing, when multiple set points are used
• all of number 1 above

3. For systems equipped with a Meter Based Timing System (MBTS):

• synchronized time with safety thermal limit recorder chart
• record of time the flow alarm is activated, as indicated by an event pen
• flow rate tracing
• all of number 1 above

4. For the pressure differential controller-recorder:

• synchronized time with safety thermal limit recorder chart
• raw product or media side pressure tracing
• sterilized product side pressure tracing
• in lieu of raw product or media side pressure tracing and sterilized product side pressure tracing, the pressure differential recording between them
• all of number 1 above

5. For the pressure limit recorder:

• synchronized time with safety thermal limit recorder chart
• holding tube operation pressure
• all of number 1 above

6. For the aseptic surge tank(s):

• record of the tank sterilization cycle (time and temperature) as determined in the scheduled process
• record of the pressure applied to the sterile surge tank during aseptic filling operations as determined in the scheduled process
• all of number 1 above

7. For optional additional temperature recorders/controllers on the system:

• synchronized time with safety thermal limit recorder chart
• recording thermometer tracing
• all of number 1 above; note especially the identification of sterilization cycles

8. Process deviation records include:

• date and time of the process deviation
• amount of product involved
• product quarantine and release of affected product
• investigation into the cause of the process deviation (for example, equipment breakdown, power failure, low temperature at outlet of holding tube)
• action taken (for example, line cleared, repairs performed, system re-sterilized)
• review by competent personnel

Retain all pertinent processing records as part of the preventive control plan. These records will assist in determining if the products are considered commercially sterile.

Constant level tank (CLT)

The constant level tank is a reservoir for a supply, at atmospheric pressure, of raw product to the sterilizer to permit continuous operation of the APPS. It is located at the start of the APPS system. It controls the milk level and provides a uniform head pressure to the product leaving the tank.

General conditions

• Is constructed of stainless steel
• Is in good mechanical and sanitary condition

Design

• Ensure the design and capacity of the tank does not permit air to be drawn into the system with the product when operating at the maximum sealed capacity of the flow control device
• Ensure the raw product will drain to the outlet before the outlet becomes uncovered
  • for example, the bottom of the tank is pitched to the outlet at a minimum downward slope of at least 2% (0.2 cm per 10 cm) and the top of the outlet pipe is lower than the lowest point in the tank (see Appendix B: Constant level tank design)

Cover

• Ensure the tank has a removable cover, or an inspection port with a removable cover, of suitable design to maintain atmospheric pressure and to minimize the risk of contamination
  • have the cover pitched to an outside edge to provide drainage
  • ensure all openings in the cover are flanged upwards and covered
  • fit any pipelines entering through the cover (excluding directly clamped lines) with a sanitary umbrella deflector that overlaps the edges of the opening and is located as close to the tank cover as practical
• Ensure the cover is used during processing

Airspace and overflow

• Install any product divert lines, recycle lines and water lines coming into the constant level tank in a way that prevents the siphoning of raw milk or cleaning products into finished product or potable water lines (a cross connection). For example:
  • the overflow outlet is at least 2 times the diameter of the largest inlet to the constant level tank
  • the divert, recycle, CIP and water lines terminate and break to atmosphere at least 2 times the diameter of the largest inlet above the maximum overflow point of the constant level tank

Level control device

The level control device controls the flow of milk to the constant level tank and therefore provides constant head pressure to the product leaving the tank

• Equip the constant level tank with an automatic device of sanitary design and construction to control the raw product level

Feed pump

The feed pump is used to improve flow through the raw regenerator, and to supply the flow control device with milk from the constant level tank to prevent starving, especially if the flow control device is a homogenizer. It also helps to remove negative pressure and subsequent flashing or vaporization in the raw regenerator section. In an APPS, the feed pump normally operates in both forward and divert flow, as long as the flow control device is in operation.

General conditions

• Has a sanitary design
• Is in clean and good mechanical condition

The raw product side of the regenerator may be by-passed at start up.

• Preclude the entrapment of the product in the by-pass line during periods when the feed pump is in operation. For example:
  • use close-coupled by-pass connections (as close as possible: approximately 2.5 times the pipe diameter)
  • design the manually or automatically controlled valve to permit a slight movement of product through the by-pass line

Location

• Locate the feed pump between the constant level tank and the inlet to the raw product side of the regenerator

Inter-wiring

• Use a feed pump in conjunction with a pressure differential controller-recorder
• Inter-wire the feed pump in such a way that it can only operate when the flow control device is "allowed to run", that is, the flow control device has been turned on by the operator or operating system and safety interlocks that may be installed on the APPS are not preventing the flow control device from operating
• Test the inter-wiring of the feed pump upon installation and at least every 6 months thereafter and after any change in the feed pump or switch circuits occurs
  • keep records to show testing has occurred

Regeneration section

The regenerator section on aseptic systems may either be of "milk-to-milk" type or "milk-to-heat transfer medium-to-milk" type. The cold raw product is warmed by hot sterilized product flowing in a counter current direction on the opposite sides of thin stainless steel plates or tubes. The sterilized product will in turn, be partially cooled.

General conditions

Since the physical distance between the various liquids in the sterilization plates or tubes is extremely small, the liquids have the potential to move through the plates or tubes and cross-contaminate the product if pin holes, cracks or leaks exist.

• The plates or tubes are of sanitary design, constructed of stainless steel or other corrosion resistant material, and are without pin holes, cracks or leaks
• The plates or tubes are clean with no presence of milk remnants, milk-stone, mineral scale build-up, or foreign materials
• If plates are used, the plate gaskets are equipped with leakage grooves and are not compressed or otherwise showing signs of wear
• Establish a routine program to monitor the condition of plates and tubes (for example, pin holes, gasket condition, cracks), taking into consideration the design specifications, operating conditions and hours of operation, wear and the history of the plates and gaskets
• Check the integrity of all food contact heat exchange surfaces at least once per year (for example, dye recirculation, dye check, pressure retention, helium testing)
  • if there are problems with heat exchanger integrity (plate or gasket issues), implement a more frequent inspection program to verify that the problem has been remedied
  • if pin holes are found in any plate in any section, check all plates in the same section
  • document the cause of any failure (for example, age, compression, metal fatigue)
• Keep records to show testing has occurred

Pressure differentials

• Maintain the pressure on the sterilized side of the regenerator at least 14 kPa (2 psi) higher than on the raw or heat transfer medium side of the regenerator during the following conditions:
  • forward flow
  • divert flow
  • shutdown

This protects the sterilized milk side of the system since sterilized product will leak into the raw milk (or heat transfer medium) in the case of regenerator plate (or tubular) failures.

• In "milk-to-heat transfer medium-to-milk" type regenerators:
  • use a safe source for the heat transfer medium (for example, potable hot water)
  • locate the pressure sensors for these controls:
    • at the heat transfer medium inlet on the aseptic side of the regenerator
    • at the sterilized product outlet of the regenerator

Failure to maintain the required pressure differential in the sterilized milk section of the regenerator causes the flow diversion device to assume the divert flow position.

Flow control device (FCD)

The flow control device governs the uniform rate of flow through the holding tube so that every particle of product is held for the required period of time, as specified in the scheduled process. This device is a positive displacement type pump or homogenizer. Other equally effective mechanisms such as a meter based timing system with proper components (for example, centrifugal pump, flow control device or variable speed motor, meter head, relays, alarms and flow recorder-controller) may also be used as a flow control device. Refer to Appendix C: Meter based timing system for more information on meter based timing systems.

General conditions

• Is constructed of stainless steel and is in good mechanical and sanitary condition
• The driving mechanism is designed so that in the case of wear, belt stretch, the capacity will not increase
• The flow control device cannot be excluded from the system during operation of the APPS
• Is located upstream from the holding tube, normally between the outlet of the raw regeneration section and the inlet of the heating section of the APPS

Set and sealed

• Set the maximum operating capacity of the flow control device to ensure an appropriate flow rate to give the proper holding time, in accordance with the calculations done in the scheduled process (refer to Holding verification)

When homogenizers are located within the aseptic system:

• Make the flow rate evaluations with these pieces of equipment operating (with no valve pressure on the homogenizer) and by-passed to determine the fastest flow rate (minimum holding time)

When flow promoters are located downstream from the flow control device:

• Determine the flow rate with the flow control device operating at maximum capacity and the flow promoters in operation

If the device is of the variable speed type or a single speed capable of being altered with different belts and pulleys:

• Seal the flow control device at an established flow rate to prevent operation at a greater capacity than that which gives the proper holding time
  • on meter based timing systems, seal the access to the alarm settings for flow diversion set points
  • a seal is not necessary if maximum speed gives legal holding time

Any change in the line resistance of the system after maximum speed of the pump has been set, will alter the flow rate and corresponding hold time. Increasing the line resistance by the addition of plates or piping will decrease the flow rate, increasing holding time. This increase in flow resistance in effect reduces the efficiency of the sterilizer. Decreasing the line resistance by the removal of plates, pipes, or auxiliary units will increase the flow rate, decreasing the holding time. Wear of the drive belts and pump impellers due to normal operation will gradually decrease the rate of flow through the system, thereby increasing the holding time.

• Evaluate and seal (if necessary) the flow control device upon installation and annually thereafter; and in addition, whenever the seal on speed setting is broken, whenever any alteration is made affecting the holding time, the velocity of the flow (such addition or removal in the number of plates, pipes or auxiliary units) or the capacity of the holding tube or whenever a check of the capacity indicates a speed up
• Keep records of alteration and re-evaluation of the system on file

Fail safe capability

• Ensure there is no by-pass (recirculation line) around the flow control device during processing
  • use a proximity switch so that the flow diversion device will not operate in forward flow
  • a by-pass may be present for CIP purposes as long as it is dismantled and removed during processing

When a meter based timing system replaces the positive displacement flow control device:

• Ensure it has the appropriate controls and instrumentation in place, as outlined in Appendix C: Meter based timing system
• Evaluate it upon:
  • installation and at least once every 6 months thereafter
  • when the seal on the flow alarm is broken
  • when any alteration is made affecting the holding time, the velocity of the flow or the capacity of the holding tube
  • when a check of the capacity indicates a speed-up
• Keep records to show testing has occurred

Heating section

The heating section of the APPS provides rapid, uniform and controlled heating of the product up to sterilization temperature. The raw product is usually forced through this section by the flow control device. Heating may be by direct injection or infusion of steam, or indirect heating through tubes, plates, or scraped-surface heat exchangers.

General conditions

• Has a sanitary design
• Is in clean and in good condition
• Is constructed of stainless steel or other corrosion resistant material

Indirect heating:

• Ensure there are no leaks at gaskets, seals, joints or connections during operation

Direct heating:

With direct heating, the steam injection process is an inherently unstable process. When steam is injected into a fluid, condensation of the steam may not be completed inside the injector, causing temperature variations in the holding tube that could lead to some milk particles being processed below the required temperature.

• Use a direct steam injector that is designed to provide complete condensing of the steam inside the injector
  • see Appendix L: Examples of steam injectors for examples of some suitable steam injectors for use in steam injection systems

Heating medium:

Steam used as a heating medium is free of harmful substances or extraneous matter.

• Use boiler and water treatment chemicals and other additives that are safe and suitable for use in dairy processing
• Use culinary steam for direct steam injection or infusion (see preventive controls for Culinary steam)

Any vapours in the holding tube can displace product, resulting in shorter holding times.

• Ensure steam is as free as possible from non-condensable gases
  • a de-aerator installed on the boiler helps to keep the holding tube free of non-condensable gases

Pressure limit recorder controllers

For both direct and indirect heating systems, product pressures in the holding tube and across the steam injector are monitored and controlled to keep the product in a liquid phase and to ensure adequate isolation of the injection chamber.

For systems that are capable of operating with less than 518 kPa (75 psi) pressure in the holding tube:

• use a pressure limit recorder controller to monitor product pressure in the holding tube
  • this instrument has a pressure switch that causes the flow diversion device to move to the divert position if the product pressure falls below a prescribed value, for example, if the operating temperature is 100°C (212°F), the pressure switch is set at 69 kPa (10 psi); If the operating temperature is 116°C (240°F), the switch is set at 140 kPa (20 psi)
• determine the pressure switch settings during the set up and testing procedures (see Test 30 in Critical process test procedures)
• Appendix N: Vacuum breakers shows the pressure switch settings for corresponding operating temperatures

For direct heating systems with steam injection only:

• Use a differential pressure limit indicator to ensure adequate isolation (supplementary orifices) of the injection chamber so that product is uniformly heated in the chamber
  • ensure it has a differential pressure switch so that the flow diversion device will move to the divert position if the pressure drop across the injectors is below 69 kPa (10 psi)
• Keep records of the holding tube operational pressures, the pressure switch settings, the results of tests
  • follow up on out-of-specification findings

Controllers and settings sealed

• Seal the controllers and settings once all tests have been completed to prevent unauthorized adjustments

Ratio controller (direct heating systems)

• Use a ratio controller for systems applying direct heat to the product to prevent water adulteration of the product being processed
• Locate one sensor immediately prior to the point of steam injection (incoming product), and the other immediately after the product exits the vacuum chamber (outgoing product)
• Determine the optimum temperature differential between the incoming and outgoing product by total solids analysis
  • set this differential on the ratio controller
• Use the ratio controller to automatically control the pre-heat steam supply or the flash chamber vacuum to prevent water adulteration of the product
  • the ratio controller is interlocked with the vacuum pump and/or steam controller and automatically monitors and controls the amount of vacuum applied and/or the amount of steam injected
• Make adjustments to the system when a water feed line is connected to a vacuum condenser, and the vacuum chamber is not physically separated from the vacuum condenser, to prevent the back up and overflow of water from the vacuum condenser into the vacuum chamber
  • this prevents adulteration of the product with water

Holding section

This is the part of the APPS in which heated product is held for the specified time required in the scheduled process. This section is located after the final heating section of the APPS, and may include the sensing chamber at the end. The sensing chamber is that portion which houses both the official indicating thermometer and the safety thermal limit recorder hot milk temperature sensors.

General conditions

Holding tube and all connections:

• have a sanitary design and construction
• are clean and in good mechanical condition
• the holding section is located:
  • after the flow control device with no intervening flow promoters
  • after the final heating section
  • before the flow diversion device or any cooling section
• do not install any devices for short circuiting a portion of the tube or for removing a section of the tube
  • such devices could reduce the holding time below that specified by the scheduled process
• do not heat any portion of the holding section between the inlet and the sensing chamber

Slope and support

A slope eliminates any air entrapment in the holding tube, which could displace product and reduce the holding time.

• Position the holding tube so that it has a continuous upward slope (including elbows) of at least 2% (2 cm per 100 cm)
  • prevent variance in the slope by using mechanical supports to permanently fix the holding tube in place

Holding verification

The holding time is determined by calculation, and is specified in the scheduled process. If direct heating from steam is used, the extra condensate volume from the added steam is included in these calculations.

The calculated holding time is used to determine the minimum length of the holding tube needed to provide the proper holding time, based on the flow rate used.

• Calculate the proper holding tube length upon installation, and re-calculate it after any change is made to the system that could alter the flow rate and affect the holding time
  • ensure the actual length of the holding tube is no less the calculated length
• Check the flow rate annually, whenever the seal is broken on the flow control device, and after any change is made to the system that could affect the holding time
  • measure the flow rate of the system under the conditions outlined in the Set and sealed section
  • verify that the measured flow rate is the same or lower than the value used in the calculation for the scheduled process
• Keep records of the above on file, including all supporting calculations

Flow diversion device (FDD)

The flow diversion device controls the direction of product flow according to the establishment of safe conditions within the processing system. It is located after the cooling section and before the filler or aseptic surge tank, and is designed to divert flow away from the filler or aseptic surge tank automatically.

General conditions

• The flow diversion device design permits sterile operations and prevents potentially unsterilized product from contaminating the fillers or aseptic surge tank(s)
• The flow diversion device and the return lines are constructed of stainless steel and are clean and in good mechanical condition
• The valves, plunger seals and O-rings are clean and in good mechanical condition
• Stem length of the valves is non-adjustable (this ensures that proper seating of the valves is not disturbed)
  • if the stem has a threaded attachment, use a locking pin or other equivalent locking mechanism to prevent any misalignment
• The air to the flow diversion device is clean and unrestricted
• The flow diversion device is equipped with a proper control panel where the control functions and relays are installed
  • the control panel may be part of a universal panel unit
  • it is free of any device or switches that could override the control functions and jeopardize the safety of sterilized product
  • on valves that have external solenoids, the air lines do not have quick release couplings

Installations on APPS often have operating parameters for the flow diversion device that are so complex they can only be handled by a micro-processor or programmable logic controller (PLC).

• A PLC or micro-processor control used strictly for flow diversion device function does not need to meet the criteria in Programmable logic controllers but ensure all valve functions meet the test standards

Return line

• The flow diversion device has a pipeline that directs the flow of potentially unsterile product safely away from fillers and /or aseptic surge tanks
  • any subsequent valves installed on this line are configured in all positions to allow free flow from the flow diversion device, without blocking the flow or creating excessive back pressure on the flow diversion device
• Install a flash cooler on the return line to prevent injury to bystanders during divert events when pre-sterilizing the system

Location

• The flow diversion device is located after the final cooling section and before the fillers or aseptic surge tanks
  • this is necessary since diverting hot product right after the holding tube could result in flashing in the divert line

Fail safe divert capability

Indirect heating systems:

• Ensure the flow diversion device automatically assumes the divert position (so product will not go to aseptic surge tanks or fillers) under at least one of the following conditions:
  • product temperature in the sensing chamber drops below the specification in the scheduled process
  • differential pressure between sterilized product and unsterilized product or heat transfer media is less than 14 kPa (2 psi) in the regenerator
  • adequate product pressure is not maintained in the holding tube to prevent boiling (less than 69 kPa (10 psi) above the boiling pressure of the product in the holding tube)
  • loss of electrical power or compressed air to the flow diversion device solenoids
  • excessive flow rate is detected for systems utilizing a magnetic flow meter as a flow control device
  • pressure in the surge tank drops below the value specified in the scheduled process, in systems where there is only one surge tank or no capability to send product directly to a filler (prevents sterile product from entering unsterile tank). Note: In systems where more than one surge tank exists, product would not need to be diverted but could be directed to the sterile surge tank.

Direct heating systems:

• Ensure the flow diversion device automatically assumes the divert position (so product will not go to aseptic surge tanks or fillers) under at least one of the following conditions:
  • product temperature in the holding tube drops below the specification in the scheduled process
  • differential pressure between sterilized product and unsterilized product or heat transfer media is less than 14 kPa (2 psi) in the regenerator
  • adequate product pressure is not maintained in the holding tube to prevent boiling (less than 69 kPa (10 psi) above the boiling pressure of the product in the holding tube)
  • loss of electrical power or compressed air to the flow diversion device solenoids
  • for steam infusion systems, loss of pre-determined parameters (for example, temperature, pressure level, as specified in the scheduled process) at the steam infusion chamber exits
  • for steam injector systems, improper differential pressures across the steam injectors at the holding tube (less than a 69 kPa (10 psi) drop across the injector)
  • excessive flow rate is detected for systems utilizing a magnetic flow meter as a flow control device
  • pressure in the surge tank drops below the value specified in the scheduled process, in systems where there is only one surge tank or no capability to send product directly to a filler (prevents sterile product from entering unsterile tank). Note: In systems where more than one surge tank exists, product would not need to be diverted but could be directed to the sterile surge tank.
• Install the flow diversion device with position detection capabilities to provide an electrical signal to the safety thermal limit recorder flow indicating lights and event pen
• Re-sterilize all product contact surfaces downstream from the holding tube after an event causing a flow diversion, as outlined in the scheduled process (see also the section on Thermal limit controller sequence logic)
  • the re-sterilization process includes the fillers and aseptic surge tanks, unless there is an aseptic barrier to act as a leakage barrier (see section Leak detect and Appendix G: Preventing cross connections)
• Test the operation of the valves using the procedures in Critical process test procedures - Flow diversion device.
  • keep records to show testing has occurred
  • follow-up on out-of-specification findings

Leak detect

In APPS where the filler continues to operate from an aseptic surge tank while the flow diversion device is in the divert position:

• use an aseptic barrier to separate sterile product from potentially non-sterile product (see Appendix G: Preventing cross connections)
• locate this aseptic barrier between the flow diversion device and the blocking valve for the aseptic surge tank
  • the barrier(s) may include one or more steam blocks
• include a resistance thermal device or other suitable temperature sensor at the lowest level of the barrier to detect barrier failure due to steam loss or fluid leakage into the barrier
• if barrier failure is detected by the temperature sensing device, ensure an alarm system is triggered to alert the operator to the alarm condition, immediately initiating a "shut down sequence" for the processing system as specified in the scheduled process

After a barrier failure condition:

• drain the fillers, aseptic surge tanks and lines, and aseptic processing system of product completely
• re-sterilize all equipment before processing and filling resumes
  • implicated product should be placed on hold until its sterility is assessed
  • note this failure in the operator's log book and complete a process deviation report, including the date and time of the process deviation, investigation into the cause of the process deviation and action taken both on product and other corrective measures

Sealed

• Seal the flow diversion device control panel and valve position detector cover(s) to prevent unauthorized tampering or adjustments
• Seal the valve position sensing detectors, valve actuating solenoids and relays
• Seal the access to programming functions when a PLC or micro-processor is used to control valve functions

Indicating thermometer

The indicating thermometer provides the official processing temperature of the product, which is a critical factor in the scheduled process.

General conditions

• Is clean and in good operating condition
• Is mercury actuated or equivalent, or a resistance temperature detector (RTD) of sufficient accuracy and precision
• Mercury actuated or equivalent thermometers:
  • have direct reading
  • are contained in a corrosion resistant case which protects against breakage and permits easy observation of the column and scale
  • have filling above the mercury that is nitrogen or an equally suitable gas
  • have a bulb that is Corning normal or equally suitable thermometric glass
• RTD type thermometers:
  • are fail-safe using two separate RTDs
  • are accurate and reliable
  • meet the scale and thermometric response specifications (see Appendix J: Design criteria for digital thermometers for use in critical processes)

Location and accessibility

• The indicating thermometer is located in the sensing chamber, along with the probe for the safety thermal limit recorder
  • ensure the indicating thermometer probe is located after the probe for the safety thermal limit recorder
  • verify the distance between the 2 probes is not be more than 30 cm (12 inches)
• Ensure that the indicating thermometer is easily and safely accessible by the operator to allow accurate reading of the processing temperature

Specifications

• Scale graduations are in 0.5°C (1°F) divisions with not more than 9.4°C (17°F) per 25 mm (1 inch) of graduated scale
• Ensure the stem fitting is pressure-tight against the inside wall of the fitting, with no threads exposed to product

Calibration

• Test the indicating thermometer for temperature accuracy and thermometric response upon installation and at an interval of at least every 6 months
  • refer to Critical process test procedures - Thermometers
  • follow-up on out of specification findings
• Investigate the safety of any product produced with out of calibration equipment
  • for example, if the indicating thermometer at the outlet of the holding tube is reading higher than the calibration standard, the product may have been under processed
• Increase the frequency of testing if the calibration is consistently found to be out of adjustment
  • if the calibration is consistently found to be out of adjustment, immediately identify and rectify the reason for the calibration problems
• Keep records of tests performed to determine the thermometer's calibration

Sealed

• Seal the access to calibration adjustments once the thermometer has been calibrated
  • attach the seal to the cover or scale plate on mercury in glass (MiG) thermometers
  • seal the thermometer panel and the RTD sensor housing on resistance thermal devices

Safety thermal limit recorder (STLR)

The function of this device is to:

• automatically record the temperature of the product in the sensing chamber on a chart that also indicates the time of day, and provides a record of the process
• indicate and record the position of the flow diversion device (forward or divert flow)
• supply a temperature cut out signal input to the thermal limit controller unit

General conditions

• The safety thermal limit recorder meets the criteria established by the manufacturer of the device
• Units are manufactured for safety thermal limit recorder usage
  • any modifications are performed by, or authorized by the manufacturer
  • it is housed in a case that is moisture-proof under normal operating conditions
• The safety thermal limit recorder is operated as specified by the manufacturer
• Keep in place any covers preventing access to food safety adjustments, such as the divert set-point
• Install the single probe which senses the temperature for both the temperature recording pen and the cut-in /cut-out control with a pressure-tight seal against the inside wall of the pipe, with no threads exposed to milk or milk products
• Clearly identify all switches on the safety thermal limit recorder and any controls associated with the operation of the aseptic unit
  • there are no switches or devices that could jeopardize the safety of the product by by-passing or over riding any food safety controls
• Service the safety thermal limit recorder at least once per year and maintain it on a continual basis so that the instrument functions according to specifications
  • keep records of service and maintenance on file

Location

• Install the single probe which senses the temperature for both the temperature recording pen and the cut-out control in the sensing chamber, before the indicating thermometer probe
  • the distance between the 2 probes should not be more than 30 cm (12 inches)

Specifications

• Use a circular chart that makes one revolution in not more than 12 hours and that is graduated for a maximum record of 12 hours
  • if operations extend beyond 12 hours, use a 24-hour chart that provides an equivalent level of accuracy and clarity
• Ensure the chart positive drive mechanism is equipped with a system to prevent slippage or manual rotation (for example, a pin to puncture the chart paper)
• Use charts that correspond with the chart number displayed on the identification plate of the safety thermal limit recorder
• Ensure the chart graduations do not exceed 1°C (2°F) within a range of 5.5°C (10°F) of the processing temperature
• Ensure the chart temperature scale does not exceed 30°C (55°F) per 25 mm (1 inch) within a range of 11°C (20°F) of the processing temperature

Temperature recording pen:

• Adjust the pen reading to coincide with that of the indicating thermometer

Frequency (Event or Divert) pen:

This pen records the position of the flow diversion device with a line on the outer edge of the chart. Some systems may be designed so that the event pen indicates the critical factors required to enable forward or diverted flow. In such cases, the event pen will indicate when at least one of those pre-determined critical factors is not met.

The frequency pen tracks with the temperature recording pen or follows the same time line. On certain models, a reference arc is used to align these two pens.

Third pen:

If the safety thermal limit recorder requires a third pen, as with a multiple temperature divert unit, the third pen does not track with the other 2.

• Adjust it to lead or follow the other pens by a specified time factor. Display this value on the safety thermal limit recorder unit
• Use a different colour of ink from that used for the other 2 pens

Thermal limit controller sequence logic

Since the flow diversion device is located downstream from the cooling section on aseptic systems, forward flow cannot occur until all product contact surfaces from the holding tube to the flow diversion device have been held at or above the system sterilization temperature for the time specified in the scheduled process.

The thermal limit controller unit uses a sequence of electrical inputs and timers to ensure the APPS is sterilized before allowing the flow diversion device to assume the forward flow position.

Indirect heating systems

Forward flow does not occur until:

• all conditions identified in the scheduled process are met
• the sensors at the flow diversion device and at the holding tube have reached the temperature and time specified for system sterilization in the scheduled process

Direct heating systems

Forward flow does not occur until:

• the sensors in the following locations have reached the temperature and time specified for system sterilization in the scheduled process:
  • at the holding tube
  • at the coolest part of the vacuum chamber or other coldest point points determined by the person that developed the scheduled process
  • at the flow diversion device

This assures that all parts of the system have been properly sterilized before allowing the flow diversion device to move into the forward flow position. Once the minimum times and temperatures have been satisfied for system sterilization, the 2 auxiliary controllers (see Auxiliary temperature recorders/controllers) at the flow diversion device, and at the vacuum chamber on direct heating systems) will then "drop out" of the control loop, and the primary recorder-controller (safety thermal limit recorder) at the holding tube outlet (sensing chamber) resumes its function for normal product processing temperature control.

Failure to meet any safe forward flow condition causes the flow diversion device to immediately move into the divert flow position, unimpeded by the thermal limit controller unit. For example:

• temperature below cut out
• improper regenerator pressure differential
• improper holding tube pressure
• loss of predetermined liquid levels at steam infusion chamber exits
• loss of differential pressure across the injector

After a diversion event, the flow diversion device does not resume forward flow until the system is re-sterilized and the thermal limit sequence logic is again satisfied.

• Enclose and seal the settings and adjustments for the thermal limit controller unit to prevent unauthorized tampering

Calibration

• Test the performance accuracy of the safety thermal limit recorder and thermal limit controller upon installation, at least once every 6 months and whenever a seal has been broken
• Keep records of tests to determine accuracy on file

Perform the following tests:

• recorder temperature accuracy
• recorder time accuracy
• cut in/cut out
• thermal limit controller sequence logic
• recording thermometer check against indicating thermometer (daily)
  • check that the recording thermometer is not higher than the corresponding indicating thermometer
  • take the necessary corrective measures if the recording temperature differs from that of the indicating thermometer
• use the methods in Critical process test procedures - Thermometers to test the accuracy of thermometers
  • follow-up on out of specification findings
  • investigate the safety of the product produced with out of calibration equipment

Sealed

• Seal the access to safety thermal limit recorder cut in/cut out adjustments
  • the sealing device should provide an indication of tampering or unauthorized adjustment
• Seal the enclosure for the settings and adjustments for the thermal limit controller sequence logic to prevent unauthorized adjustment

Programmable logic controllers and computers

Control of non-food safety functions

Programmable logic controllers or computers installed on APPS for operational convenience (that is, no impact on food safety) should meet the following criteria:

• the computer does not control any food safety function when the system is in processing mode
• when in CIP mode, the computer may control any functions when CIP mode is first selected
• the computer may control non-food safety controls, such as product pumps or valves, at any time
• the vendor provides a testing protocol to verify that food safety safeguards are not under the control of the computer during the production cycle

Control of food safety functions

Computers for the operation of food safety controls on APPS have additional considerations. Computers are different from hard wired controls in 3 major areas. The design of computerized food safety controls needs to address these 3 major areas to provide adequate public health protection.

1. Unlike conventional hard-wired systems, which provide full time monitoring of the food safety controls, the computer performs its tasks sequentially, and the computer may be in real time contact with the flow diversion device for only 1 millisecond. During the next 100 milliseconds (or however long it takes the computer to cycle once through its tasks), the flow diversion device remains in forward flow, independent of temperature in the holding tube. Normally, this is not a problem because most computers can cycle through 100 steps in their program many times during 1 second. The problem occurs when the computer is directed away from its tasks by another computer, or the computer program is changed, or a seldom used Jump, Branch, or Go-to-instruction diverts the computer away from its food safety control tasks.
   • install the computer or PLC in such a manner that food safety controls are not circumvented by the computer or PLC during the product run operations, except as provided for under Appendix D: Criteria for the evaluation of computerized food safety controls
   • the vendor ensures that their PLC or computer installation complies with the criteria in Appendix D: Criteria for the evaluation of computerized food safety controls through documentation and testing
   • keep documentation of interconnecting wiring, pneumatic controls, applicable programming logic and ladder logic, and results of the testing procedures as verification that the system meets the criteria in Appendix D: Criteria for the evaluation of computerized food safety controls
2. In a computerized system, the control logic is easily changed because the computer program is easily changed. A few keystrokes at the keyboard will completely change the control logic of the computer program.
   • seal the access to the computer's programming function
     • ensure that the computer has the correct program installed when it is re-sealed
3. Complicated computer programs have a greater potential to contain errors.
   • keep the computer program simple and of limited scope for food safety controls to help ensure that it is error free

Pressure differential recorder controllers

This section covers the actual pressure devices used to maintain proper pressure relationships. As explained in the Regeneration section and Cooling section, proper pressure relationships need to exist across all media to prevent contamination of the sterilized product by raw product, heating medium and cooling medium. These pressure relationships are maintained under forward flow, divert flow and shutdown.

• APPS have a pressure differential recorder to monitor and record pressures
  • this ensures that proper pressure differential has been maintained in the regenerator

General conditions

• Sensors are clean and in good mechanical condition
  • the design should allow easily dismantling of the sensors for inspection
• The indicating and recording unit is housed in an appropriate moisture proof enclosure
• Inter-wire the pressure differential recorder controller with the flow diversion device such that divert occurs when the sterilized product pressure in the regenerator does not exceed the pressure on the raw side of the regenerator by at least 14 kPa (2 psi)
  • in "milk-to-heat transfer medium-to-milk" type regenerators, the divert occurs when the sterilized product pressure does not exceed the heat transfer medium pressure by at least 14 kPa (2 psi)

A PLC can be used to control the pressure differential in lieu of a pressure differential controller as long as the same control conditions are respected such as inter-wiring with flow diversion device, pressure indicating and recording capabilities, and set-point indication.

Pressure gauges may be used to verify the pressure display for the pressure differential recorder controller.

• Pressure gauges are clean and in good condition

Location

2 types of regeneration are used in APPS:

1. product-to-product regenerators
2. product-to-water-to-product regeneration systems

The product-to-water-to-product regeneration system is often preferred for some products because it allows more even heat transfer and prevents burn-on.

Product-to-product regenerators:

• install the raw product sensor between the feed pump and the raw product inlet to the regenerator
• install the sterilized product sensor at, or downstream from, the sterilized product outlet of the regenerator

Product-to-heat transfer medium-to-product regenerators:

• install the raw side pressure sensor in the water loop after the water pump (location of highest media pressure in the loop)
• install the sterilized side pressure sensor in the product line at the sterilized side outlet of the regenerator (location of lowest sterilized product pressure)

Specifications

• Use a circular chart that makes one revolution in not more than 12 hours and that is graduated for a maximum record of 12 hours
  • if operations extend beyond 12 hours, use a 24-hour chart that provides an equivalent level of accuracy and clarity
• Ensure the chart positive drive mechanism is equipped with a system to prevent slippage or manual rotation (for example, a pin to puncture the chart paper)
• Use charts that correspond with the chart number displayed on the identification plate of the pressure differential recorder controller
• Ensure chart scale divisions do not exceed 14 kPa (2 psi) on the working scale of not more than 140 kPa (20 psi) per 25 mm (1 inch)
• Pens record the raw side pressure and the sterilized side pressure or the pressure differential
  • electronic data collection, storage and reporting of pressure differentials, with or without hard copy printouts, can be used provided the electronically generated records meet the minimum criteria for safety thermal limit recorder charts

Calibration

• Test the accuracy of the pressure display and recorder, and the differential controller divert function, at least every 6 months and whenever the controller is adjusted or repaired
• Check pressure gauges, if used, for accuracy upon installation, at least every 6 months and whenever gauges are adjusted or repaired
• Use the testing methods in Critical process test procedures – Pressure differential.
  • keep records of testing results and any corrective actions

Sealed

• Seal the pressure differential recorder-controller adjustments/legal panel

Auxiliary temperature recorders and controllers

These instruments may be used in several locations on the APPS, to provide a record of start-up pre-sterilization and product processing temperature, and to provide temperature signals to the thermal limit controller unit or other processing controls. 2 common installation points are at the final heater outlet (to provide better feedback and control of the heating process), and at the inlet to the flow diversion device (to provide a record and control of the pre-sterilization process).

General conditions

• Are clean and in good mechanical condition
  • pens are operational and easily calibrated
• Are moisture-proof under normal operating conditions
• The chart positive drive mechanism is equipped with a system to prevent slippage and manual rotation (for example, a pin to puncture chart paper)
• Produce a continuous permanent record of all pertinent information (time of day and temperature)
• Use the chart part number indicated on the chart recorder
• Service the unit at least once a year
  • keep records of the servicing on file

Cooling section

This section of the sterilizer uses chilled water and /or glycol to cool the hot product down to packaging and filling temperature. Since the flow diversion device is located downstream from this section, the cooling section may become contaminated with potentially unsterile product during divert, and will need to be re-sterilized as part of the thermal limit controller sequence logic after a divert event.

Flash coolers are sometimes installed on the divert line to prevent injury to by-standers if a divert event occurs during the re-sterilizing of the holding tube and cooling section, when there is no cooling turned on.

General conditions

• Is clean and in good condition
  • during operation, there are no leaks at gaskets, seals, or connections
• Is constructed of stainless steel or other corrosion resistant and easily cleanable material
• Has a design that allows easy cleaning, and does not entrap product in crevices, joints, seams or openings
• Establish a routine program to monitor the condition of plates and tubes (for example, pin holes in plates, gasket condition, cracks, tube clamps)
  • if pin holes are found in any plate, check all plates of the same age
• Check the integrity of all food contact heat exchange surfaces at least once per year (for example by dye penetration, permanganate recirculation, pressure retention, Helium testing, etc.)
  • if there are problems with heat exchanger integrity, implement a more frequent inspection program to verify that the problem has been remedied
• Keep records to show testing has occurred
  • also document the age of all the plates and which ones are replaced, the cause of the holes (for example, age, compression, metal fatigue)

Pressure differentials

• Maintain pressure on the sterilized product side of the plates at least 14 kPa (2 psi) higher than on the cooling medium side of the plates during the following conditions:
  • forward flow
  • diverted flow conditions
  • shutdown

This reduces the possibility of chemical contamination in the event a pinhole leak develops in the plates.

• Use an automated mechanism to achieve the correct pressure relationship
• Use pressure gauges that are clean and in good condition
  • check gauges for accuracy upon installation and at least once per year
• Locate pressure differential controller sensors and pressure gauges at the cooling media inlet and at the sterilized product outlet

Cooling medium

• Check cooling medium (usually sweet water or water-glycol mixture) at least monthly for microorganisms (for example, coliforms, psychrotrophs)
  • keep records of the microbial testing results
• Use cooling water additives and cooling media products that are safe for use in dairy processing
  • keep documents that demonstrate their safety

Homogenizer

The homogenizer is a high pressure pump that produces a homogenized product by reducing the size of fat globules as they are forced through a small orifice under high pressure. Since the homogenizer is a positive pump, it can be utilized as a flow control device.

If the homogenizer is utilized as a flow control device, refer to the Flow control device (FCD) section.

General conditions

• Has filters, homogenization valves, pistons, seat valves, pressure gauges and dead ends that are clean and in good mechanical condition
• The product contact surfaces are stainless steel or other food grade, non-corrosive material
• The homogenizers are equipped with appropriate gauges
• The homogenizers are installed downstream from the holding tube in the aseptic zone are of an aseptic design, to prevent contamination of the sterilized product

Homogenizer larger than flow control device

• Homogenizers larger than the flow control device are designed and installed so that the flow rate is not affected
• Homogenizers located downstream do not affect the flow rate (for example physical break, pressure sensors in holding tube, flow control device is a meter based timing system)

If a homogenizer located downstream from the flow control device has a capacity greater than the flow control device:

• the homogenizer is not a flow promoter. For example:
  • install a recirculation line between the inlet (suction line) and the outlet (pressure line) of the homogenizer to prevent the homogenizer from "starving"
    • this line is unrestricted and does not contain a shut-off valve, but may contain a check valve allowing flow only from the outlet back to the inlet
    • the diameter of the recirculation line including the check valve is equal or greater than the supply line to the homogenizer
• the homogenizer does not reduce the holding time and does not reduce the pressure required in the holding tube to keep the product in the liquid phase

Aseptic surge tank

The aseptic surge tank acts as a sterilized product balance tank for the fillers. This allows both the fillers and the aseptic processor to operate independently at different flow rates.

• Install the aseptic surge tank downstream from the flow diversion device
• Protect the surge tank by one or more aseptic barriers at the flow diversion device
  • filling operations can continue from the tank while the Aseptic processor is in divert
• If there are no aseptic barriers to protect the surge tank, empty and re-sterilize the fillers and aseptic surge tank after a divert event (refer to Appendix G: Preventing cross connections)

The cleanliness and operation of the aseptic surge tank are important to prevent contamination of the sterilized product.

• Use sterile air over the product in the tank

General conditions

• The aseptic surge tank and associated valves, thermometers (as examples) are clean and in good condition
• Instrumentation (temperature recording chart) are installed to record and verify pre-sterilization of the tank before production commences

Sterile air

As product is withdrawn from the surge tank, negative pressure could develop in the tank, which could cause unsterile air and bacteria to be drawn in through joints, gaskets (as examples).

• Pressurize the sterile air to prevent the development of negative pressure inside the aseptic surge tank

Sterile air is produced by incineration and/or filtration.

• Incineration:
  • install a temperature sensing device monitoring system
• Sterile filter:
  • monitor the specifications of the filter, filter location and number of filters
  • change the filter at intervals recommended by the manufacturer or the person responsible for the scheduled process (for example a process authority), and document this on the processing records
• Maintain sterile air over-pressure on aseptic surge tanks to ensure proper operation (that is, product flow to the filler)
  • in general, the person responsible for the scheduled process establishes a venting or air purge schedule for the surge tank
• Use a sterile air pressure controller or transmitter to monitor the sterile air pressure in the tank
  • if the sterile air pressure drops below the value specified in the scheduled process, the filler(s) ceases operation, and the aseptic barrier located at the inlet of the unsterile tank is activated to protect the sterile product in the processing system from entering the unsterile tank
  • do not resume filling operations until the aseptic surge tank, fillers and valves have been emptied and re-sterilized - unless multiple aseptic surge tanks and fillers are used and the sterility of these is maintained
• Test the accuracy of the controller/transmitter upon installation and at an interval of at least every 6 months
  • use the testing methods in Critical process test procedures – Pressure differential
• Increase the frequency of testing if the calibration is consistently found to be out of adjustment
  • if the calibration is consistently found to be out of adjustment, immediately identify and rectify the reason for the calibration problems

Stuffing pump

Stuffing pumps may be used to improve the efficiency of other devices, such as homogenizers.

General conditions

• Are usually centrifugal pumps
• Are constructed of stainless steel or a suitable corrosion resistant material
• Are clean and in good mechanical condition
• The painted exterior surfaces are free of flaking paint and rust
• All pumps installed in the sterile zone are of an aseptic design
• Disassemble before cleaning any pumps not specifically designed for CIP use
  • remove impellers and back plates for cleaning as well.

Installation/operation

• Inter-wire product stuffing pumps with the flow control device electrical operating signal so that the pump shuts off when the flow control device is not allowed to run
  • stuffing pumps may be configured to start prior to starting the homogenizer provided the flow control device is in an "allowed to run" condition
• Install and operate the stuffing pump in a way that it will not:
  • influence the proper pressure relationship within the regeneration section
  • reduce the holding time below the required minimum

If the homogenizer is used as a flow control device, a centrifugal type stuffing pump may be installed between the raw product outlet of the regenerator and the inlet manifold of the homogenizer to supply the desired pressure to the homogenizer.

• Perform tests upon installation, at least once every 6 months thereafter and when the micro-switch is re-set or replaced
  • keep records to show testing has occurred

Aseptic packaging

Aseptic packaging is a procedure consisting of sterilization of the packaging material or container, filling with a commercially sterile product in a sterile environment, and producing containers that are tight enough to prevent recontamination (hermetically sealed).

Aseptically packaged ultra-high temperature (UHT) milk should also give almost complete protection against light and atmospheric oxygen. The package should therefore be of barrier type or similar.

The term 'aseptic' implies the absence of any unwanted organisms from the product, package or other specific areas. The term 'hermetic' is used to indicate suitable mechanical properties to exclude the entry of bacteria into the package or, more specifically, to prevent the passage of microorganisms and gas or vapour into or from the container.

Packaging material

• Establish a program to ensure that the packaging materials received meet the criteria identified in the scheduled process
  • include visual examination of the packaging material to identify damage and defects
• Store all packaging material in a clean and sanitary manner to minimize the risk of contamination and physically damaging the materials

Sterilant

The aseptic packaging machine ensures the sterilization of the container and provides a sterile environment for filling. The most commonly used sterilants, depending on the application, are hydrogen peroxide (H₂O₂) or a combination of H₂O₂ and peracetic acid.

• Use sterilants to sterilize the package that are safe and suitable for use in dairy processing facilities
• Follow the manufacturer's recommendation if dilution of the sterilant is required

During the sterilization of the packaging material by H₂O₂ or other sterilants, a residue of these sterilants may be left on the material and can subsequently contaminate the filled product.

• Rinse the treated aseptic packages with water to remove sterilant residues when necessary
  • ensure the rinse water is sufficiently sterile (that is, commercially sterile) so that it does not result in loss of asepsis throughout the entire shelf-life of the product
• Perform residue testing at an appropriate frequency to ensure sterilant residues are at or below the level specified by the scheduled process

Depending on the type of packaging equipment, different means of applying the sterilants are used, for example, spray, vapour, roller system, immersion bath.

• Have the person responsible for the scheduled process (for example, a process authority) validate that the sterilant can achieve commercial sterility

Headspace gas

Nitrogen gas or other media may be used to create a headspace in the formed package.

• Filter or treat headspace gas to remove or destroy microorganisms

Packaging/filling room air quality

In order to minimize airborne contamination from other areas of the processing plant:

• maintain the packaging/filling aseptic zone under positive pressure relative to the rest of the facility
• maintain the packaging/filling room under negative pressure relative to the aseptic zone of the packaging machine
• conduct microbial analysis of air quality at a frequency that is sufficient to substantiate the air quality is appropriate
  • keep records of results on file

Packaging and filling controls

The aseptic packaging stage is the most delicate operation of producing aseptic product, both in terms of control and preventive measures required.

• Ensure personnel involved in aseptic packaging have the competencies and qualifications necessary to carry out their duties
• Identify the critical controls for packaging and filling equipment which attain and maintain commercial sterility within the aseptic zone
  • these critical controls include sterile air supply systems and sterile product contact surfaces of the filler and packaging material
  • critical controls are specified in the scheduled process for aseptic packaging

Calibration of controls

• Calibrate the packaging and filling critical controls on a regular basis
  • keep records of calibration including the date of testing, method(s) used, and the name of the person performing the calibration

Setting of controls

In order to have a commercially sterile finished product, set the identified critical controls and adhere to the specifications identified in the scheduled process during container formation and filling.

• Critical controls may include:
  • positive sterile air/inert gas pressure in the filling and sealing area of the machine
  • hydrogen peroxide concentration and temperature
  • drying section temperature

If the critical controls are not met, the equipment stops and precludes the packaging of sterile product into non-sterile containers.

Although these systems usually operate in an automatic mode, most, if not all, will be equipped with a capability of manual over-ride of the automatic controls.

• Protect the manual over-ride from unauthorized personnel access

Setting deviation

Acceptable variations from the specified setting of critical controls are described in the scheduled process.

• Describe the acceptable variations in the operator's packaging and filling production log
  • in the event of a critical deviation from the setting, shut down the packaging system, segregate non-sterilized product and re-sterilize the system before resuming operation

Quality control

Testing and frequency in a quality control program may vary with the food product, but will be done in manner that provides a high level of assurance that the finished product is commercially sterile.

Finished product testing

Sampling Plan

• Take statistically valid samples of the production to assess the safety and quality of the product
• Determine the quantity of containers to be taken, the tests to be performed and the standards to be met for each plan of the sampling program, based upon specifications supplied by the person responsible for the scheduled process (for example, a process authority)

Inspection of heat seals

In general, tests can be divided into 2 main types:

1. Non-destructive testing: visual inspection of seals for absence of voids, wrinkles, pleats. Other important checks to be performed include seal alignment, overlap, product contamination in seals, de-lamination.
2. Destructive testing: activation pattern using a polarisation filter, vacuum bubble test, conductivity/electrolytic test, dye penetration test, microbial challenge test, storage and distribution test, burst test, removal torque test, seal security/seal strength tests.

• Inspect heat seals at intervals of sufficient frequency to ensure consistent and reliable hermetic sealing as per manufacturer's recommendation. For example:
  • before production starts and during production
  • after jam-ups
  • as per package manufacturer's recommendation
• Use methods for these inspections that are specified by the packaging material supplier

Incubation

• Conduct incubation tests at a statistically valid frequency to verify the commercial sterility of the finished product
  • incubate samples at a specified temperature for a specific period of time to detect mesophilic growth
  • observe incubated packages for any sign of gas production (puffers), product changes such as odour, pH, oxygen content, viscosity and other indicators of spoilage, such as separation or curdling

Microbial evaluation

• Conduct microbial analysis for commercial sterility on a statistically valid number of containers from each lot (from each filling head) regardless of the absence of signs of non-sterility following incubation
• Investigate any instances of microbial growth from unsterile containers
  • pending the outcome of the investigation, detain the lot
  • record any actions taken

Product release

• Ensure all package integrity, incubation testing, processing record review and the investigation of any process deviations are satisfactory before the product is released for distribution.

Packaging records

It is important that the scheduled process be properly established, correctly applied, sufficiently supervised and documented to provide assurance that the requirements have been met.

• Include in your production records a packaging/filling production log and an on-line record of critical parameter testing
• Keep these records on file for at least 3 years
• Verify that all critical controls are recorded and meet specifications
  • this review should be completed before the product is released
• Ensure packaging/filling production log contains the following information:
  • date
  • batch
  • packaging machine number
  • product being filled and packaged
  • source of product (from surge tank or sterilizer)
  • preparations taken to bring equipment into packaging readiness, for example, inspection/repairs/replacements of valves, gaskets, gauges, warning lamps; cleaning, preheating and sterilization steps; pressure and temperature checks
• Ensure product safety and provide a historical record of the process, by recording the following information:
  • date
  • hourly filling code
  • machine number
  • packaging start time
  • packaging stop time
  • machine downtime and reason, corrective action taken to restart
  • intervals at which teardowns conducted
  • types of teardowns conducted, classification of defects observed, corrective action taken
  • sterilant concentration
  • production volume
  • unusual occurrences
  • operator's signature
  • signature of individual responsible for review