Language selection


Dairy processing: Higher heat shorter time (HHST) pasteurization systems and extended shelf life (ESL)

On this page


The following provides recommended practices for performing higher heat shorter time (HHST) processing to extend the shelf life of dairy products.

HHST treatment of fluid milk and milk products is the application of heat to a continuously flowing product using high temperatures, generally above 100°C, for such time to extend the shelf-life of the product under refrigerated conditions. This type of heat process can be used to produce dairy products with extended shelf life, generally referred to as "ESL".

ESL means the ability to extend the shelf-life of a product beyond its traditional life by reducing the major sources of re-infection and maintaining the quality of the product all the way to the consumer (Dairy processing handbook, 2015).

ESL products are not considered to be commercially sterile products and, as such, must be cooled immediately after pasteurization to a temperature of 4°C or less and stored continuously under refrigeration at a temperature of 4°C or less.

Record keeping

In a Preventive control plan (PCP), it is important to maintain and keep records of activities which demonstrate that the PCP is implemented and working effectively. Records can be in either a hard copy or electronic format. Refer to Record keeping for your preventive control plan for additional information.


For the purposes of this document, the following definitions apply.

Forward flow
means the normal flow conditions of pasteurized product towards pasteurized or sterile surge tanks and/or fillers
Scheduled extended shelf life (ESL) process
means all the conditions pertaining to the processing and packaging equipment, containers and products needed to achieve and maintain the required extended shelf-life under refrigerated storage conditions

Higher heat shorter time (HHST) flow schematic

The HHST system, although similar to a high temperature short time (HTST) pasteurizer, operates at higher temperatures (above 100°C) and pressures. It also uses a pasteurization or sterilization cycle to pasteurize or sterilize the entire system prior to commencing production.

A flow schematic, or process and instrumentation diagram (PID), is a valuable tool for assessing the impact of any changes to the HHST system. Even slight modifications made to the HHST system may have an impact on its operation and safety.

Up-to-date and accurate

No cross connections

A cross connection is a direct connection allowing one material to contaminate another.

For other applications (Clean-in-place (CIP) supply lines and return line circuits used for CIP cleaning and "mini-washes" on tanks, lines, pasteurizers or other equipment that may be washed while connected to product lines containing milk products or potable water and lines for final rinse):

The design of the constant level tank and piping, and the flow diversion device, are areas where potential cross-connections could exist if the design or installation is improper. Refer to the Constant level tank and Flow diversion device (FDD) sections for more details.

Refer to Preventing cross-contamination and Appendix G: Preventing cross connections for more information on preventing cross connections in dairy establishments.

Scheduled extended shelf life (ESL) process

To achieve the required pasteurization of ESL products in HHST systems, the generally accepted best practice is to design the scheduled ESL process to provide a thermal destruction of the target microorganism equivalent to that achieved by a process with a minimum lethality value F0=0.1.

Note: F0 is associated with commercially sterile products targeting a 12 log reduction in Clostridium botulinum spores; nevertheless, F0 was chosen in this case because it is the preferred method used by process authorities for calculating process kill, as opposed to the use of pasteurization value (P), which is more complex as it deals with varying reference temperatures and z-values.

Scheduled ESL process

Operating instructions

A process deviation occurs whenever any process is less than the scheduled ESL process or when critical factors are outside of specified limits.

Critical factor adherence

The critical factors are those factors specified in the scheduled ESL process as being necessary for the achievement of pasteurization of the ESL product. If any of these critical factors are not within the limits documented in the scheduled ESL process, this constitutes a process deviation and the product cannot be considered pasteurized ESL until process deviation procedures are completed.

Critical factor records

Processing records are part of the preventive control plan. They indicate whether the products were processed within the acceptable limits for the critical factors (no process deviations). Detailed documentation of process deviations permit follow up to determine the cause and corrective action for the deviation and to ensure any compromised product is properly identified and handled to prevent distribution or sale.

Process control records are part of the critical factors records.

  1. Ensure process control records for HHST systems provide the following data on every chart (use a 12-hour chart for the processing operation):
    • establishment name and address or licence number
    • date, shift and batch number where applicable
    • recorder unit identification when more than 1 is used
    • product type and amount of product processed (may be recorded in production records)
    • identification of sterilization/pasteurization cycles (for example, indicate when water or product is being run)
    • identification of CIP, "mini-wash" (if used)
    • unusual occurrences and operator comments (including time of occurrence)
    • signature or initials of the operators
    • chart pen markings (note: they should not overlap)
  2. Safety thermal limit recorder (STLR):
    • take a reading of the official indicating thermometer during processing
      • ensure this reading is not lower than the recording thermometer reading
    • record the time the flow diversion device is in the forward flow position, as indicated by the event pen
    • provide the recording thermometer tracing
    • provide the set point tracing, when multiple set points are used
    • all of 1 above
  3. Systems equipped with a meter based timing system (MBTS):
    • record the synchronized time with safety thermal limit recorder chart
    • record the time the flow alarm is activated, as indicated by an event pen
    • provide the flow rate tracing
    • all of 1 above
  4. Pressure differential controller-recorder (PDC-recorder):
    • record the synchronized time with safety thermal limit recorder chart
    • provide the raw product or media side pressure tracing
    • provide the sterilized product side pressure tracing
    • in lieu of raw product or media side pressure tracing and sterilized product side pressure tracing, take the pressure differential recording between them
    • all of 1 above
  5. Pressure limit recorder:
    • record the synchronized time with safety thermal limit recorder chart
    • record the holding tube operation pressure
    • all of 1 above
  6. Optional additional temperature recorders and controllers on the system:
    • record the synchronized time with safety thermal limit recorder chart
    • provide the recording thermometer tracing
    • all of 1 above; note especially the identification of pasteurization/sterilization cycles
  7. Include in the process deviation records:
    • date and time of the process deviation
    • amount of product involved
    • product quarantine and release of affected product
    • investigation into the cause of the process deviation (for example, equipment breakdown, power failure, low temperature at outlet of holding tube)
    • action taken (for example, line cleared, repairs performed, system re-pasteurized/re-sterilized)
    • review by competent personnel

Retain all pertinent processing records as part of the preventive control plan. These records will assist in determining if these products were adequately pasteurized to meet the extended shelf-life.

HHST Pasteurization System Criteria

HHST pasteurization systems should meet the criteria in the 3A "Accepted Practices for Sanitary Construction, Installation, Testing, and Operation of high temperature short time and higher heat shorter time pasteurization systems" (Number 603-07).

Constant level tank (CLT)

The constant level tank is a reservoir for a supply, at atmospheric pressure, of raw product to the pasteurizer to permit continuous operation of the HHST system. It is located at the start of the HHST system. It controls the milk level and provides a uniform head pressure to the product leaving the tank.

Air in the pasteurizer may allow the milk particles to move more rapidly through the system and therefore not receive the heat treatment for the required time. Appendix B: Constant level tank design some example constant level tank designs.

General conditions


Ensure the design and capacity of the tank does not permit air to be drawn into the pasteurizer with the product when operating at the maximum sealed capacity of the flow control device.


Airspace and overflow

Level control device

Feed pump

The feed pump is used to improve flow through the raw regenerator, and to supply the flow control device with milk from the constant level tank to prevent starving, especially if the flow control device is a homogenizer. It also helps to remove negative pressure and subsequent "flashing" or vaporization in the raw regenerator section. In HHST systems, the feed pump normally operates in both forward and diverted flow, as long as the flow control device is in operation.

General conditions

The raw product side of the regenerator may be by-passed at start up.



Regeneration section

The regenerator section on HHST systems may either be of a milk-to-milk type or milk-to-heat transfer medium-to-milk. The cold raw product is warmed by hot pasteurized product flowing on the opposite sides of thin stainless steel plates or tubes. The pasteurized product will in turn, be partially cooled.

General conditions

Since the physical distance between the various liquids in the pasteurization/sterilization plates or tubes is extremely small, the liquids have the potential to move through the plates or tubes and cross-contaminate the product if pin holes, cracks or leaks exist.

Pressure differentials

Failure to maintain the required pressure differential in the pasteurized milk section of the regenerator causes the flow diversion device to assume the divert flow position.

Flow control device (FCD)

The flow control device governs the uniform rate of flow through the holding tube so that every particle of product is held for the required period of time, as specified in the scheduled ESL process. This device is a positive displacement type pump or homogenizer. Other equally effective mechanisms such as a meter based timing system with proper components (for example, centrifugal pump, flow control device or variable speed motor, meter head, relays, alarms and flow recorder-controller) may also be used as a flow control device. Refer to Appendix C: Meter based timing system for more information on meter based timing systems.

General conditions

Set and sealed

Any change in the line resistance of the system after maximum speed of the pump has been set will alter the flow rate and corresponding hold time. Increasing the line resistance by the addition of plates or piping will decrease the flow rate, increasing holding time. This increase in flow resistance in effect reduces the efficiency of the pasteurizer. Decreasing the line resistance by the removal of plates, pipes, or auxiliary units will increase the flow rate, decreasing the holding time. Wear of the drive belts and pump impellers due to normal operation will gradually decrease the rate of flow through the system, thereby increasing the holding time.

Fail safe capability

When a meter based timing system replaces the positive displacement flow control device:

Heating section

The heating section of the HHST system provides rapid, uniform and controlled heating of the product up to sterilization temperature. The raw product is usually forced through this section by the flow control device. Heating may be by direct injection or infusion of steam, or indirect heating through tubes, plates, scraped-surface heat exchangers or other accepted systems.

General conditions

Indirect heating

Direct heating

With direct heating, the steam injection process is an inherently unstable process. When steam is injected into a fluid, condensation of the steam may not be completed inside the injector, causing temperature variations in the holding tube that could lead to some milk particles being processed below the required temperature.

Heating medium

Any vapours in the holding tube can displace product, resulting in shorter holding times. Steam should be as free as possible from non-condensable gases.

Pressure limit recorder controllers

For both direct and indirect heating systems, product pressures in the holding tube and across the steam injector are monitored and controlled to keep the product in a liquid phase and to ensure adequate isolation of the injection chamber.

For HHST systems that are capable of operating with less than 518 kPa (75 psi) pressure in the holding tube:


Ratio controller (direct heating systems)

Use a ratio controller for systems applying direct heat to the product to prevent water adulteration of the product being processed.

Holding section

This is the part of the HHST processing system in which heated product is held for the specified time required in the scheduled ESL process. This section is located after the final heating section of the HHST processing system, and may include the sensing chamber at the end. The sensing chamber is that portion which houses both the official indicating thermometer and the safety thermal limit recorder hot milk temperature sensors.

General conditions

Slope and support

A slope eliminates any air entrapment in the holding tube, which could displace product and reduce the holding time.

Holding verification

The calculated holding time is used to determine the minimum length of the holding tube, based on the flow rate used.

Flow diversion device (FDD)

The flow diversion device controls the direction of product flow according to the establishment of safe conditions within the processing system. It is located downstream from the regenerator section, and is designed to automatically divert flow away from the surge tank or filler.

General conditions

When pasteurizing ESL products, use 1 of the following flow diversion device designs:

  1. Dual-stem type flow diversion device: incorporates 2 3-way valves in series.
    • separate the leak detect line from the divert line and ensure it is free draining from the lower port of the leak detect valve back to the constant level tank (or other appropriate receptacle)
  2. Steam-block type flow diversion device system: incorporates a divert valve and 1 or more steam-block valves.
    • ensure the divert valve is fail-safe, position detectable and equipped with means to provide an alarm and protection when required
    • ensure the steam block valve has a continuous supply of steam and a continuous visible bleed of steam or condensate to the drain
    • equip the steam block valve with an interlocked resistance thermal device (RTD) located at the lowest level of the barrier to detect any fluid leakage into the barrier
      • if leakage is detected, an alarm or other appropriate system alerts the operator to the steam barrier failure
      • in the event of steam barrier failure, follow the actions indicated in the scheduled ESL process deviation procedure
    • use a steam barrier when the system is not equipped with a dual-stem type flow diversion device incorporating 2 3-way valves
    • equip dual stem flow diversion devices with a control panel where the control functions and relays are installed
      • this control panel can be part of a universal panel unit
      • ensure the panel is free of any devices or switches that could override the control functions and jeopardize the safety of pasteurized product
      • on valves that have external solenoids, ensure the air lines do not have quick release couplings

Installations on HHST processing systems often have operating parameters for the flow diversion device that are so complex they can only be handled by a micro-processor or programmable logic controller (PLC).

Return line

A flash cooler may be installed on the return line to prevent injury to bystanders during divert events when pasteurizing/sterilizing the system.


Locate the flow diversion device downstream from the regeneration and before the surge tanks or fillers.

Fail safe divert capability

Indirect heating systems

Direct heating systems

After an event causing a flow diversion, hold all product contact surfaces between the holding tube and the flow diversion device at or above the required pasteurization or sterilization temperature continuously and simultaneously for at least the required pasteurization or sterilization time, as outlined in the scheduled ESL process (see also the sub-section Thermal limit controller sequence logic).

Leak detect

In HHST systems where the filler continues to operate from a surge tank while the flow diversion device is in the divert position, and the flow diversion device is a steam-block type:


Indicating thermometer

The indicating thermometer provides the official processing temperature of the product, which is a critical factor in the scheduled ESL process.

General conditions

Location and accessibility




Safety thermal limit recorder (STLR)

The function of this device is to:

General conditions



Temperature recording pen

Frequency (Event or Divert) pen

This pen records the position of the flow diversion device with a line on the outer edge of the chart. Some systems may be designed so that the event pen indicates the critical factors required to enable forward or diverted flow. In such cases, the event pen will indicate when at least one of those pre-determined critical factors is not met.

Third pen

If the safety thermal limit recorder requires a third pen, as with a multiple temperature divert unit:

Thermal limit controller sequence logic

Since the flow diversion device is located downstream from the regeneration and cooling sections on a HHST systems, forward flow conditions cannot occur until all product contact surfaces from the holding tube to the flow diversion device have been held at or above the required system pasteurization temperature for the time specified in the scheduled process.

The thermal limit controller unit uses a sequence of electrical inputs and timers to ensure the HHST processing system is pasteurized or sterilized before allowing the flow diversion device to assume the forward flow position.

Indirect heating systems

Direct heating systems

This assures that all parts of the system have been properly pasteurized or sterilized before allowing the flow diversion device to move into the forward flow position. Once the minimum times and temperatures have been satisfied for system pasteurization or sterilization, the 2 auxiliary controllers (see Auxiliary temperature recorders and controllers (at the flow diversion device, and at the vacuum chamber on direct heating systems) will then "drop out" of the control loop, and the primary recorder-controller (safety thermal limit recorder) at the holding tube outlet (sensing chamber) resumes its function for normal product processing temperature control.



Programmable logic controllers (PLC) and computers

Control of non-food safety functions

Programmable logic controllers (PLC) or computers installed on an HHST processing system for operational convenience (in other words, have no impact on food safety) meet the following criteria.

Control of food safety functions

Computers for the operation of food safety controls on HHST processors have additional considerations. Computers are different from hard-wired controls in 3 major areas. The design of computerized food safety controls needs to address these areas to provide adequate public health protection.

Pressure differential recorder controllers (PDC-recorder)

This section covers the actual pressure devices used to maintain proper pressure relationships. As explained in the Regeneration section and the Cooling section, proper pressure relationships must exist across all media to prevent contamination of the pasteurized product by raw product, heating medium and cooling medium. These pressure relationships must be maintained under forward flow, divert flow and shutdown.

General conditions

A PLC can be used to control the pressure differential in lieu of a pressure differential controller as long as the same control conditions are respected such as inter-wiring with flow diversion device, pressure indicating and recording capabilities, and set-point indication.

Pressure gauges may be used to verify the pressure display for the pressure differential recorder controller.


2 types of regeneration are used in HHST systems, product-to-product regenerators, and product-to-heat transfer medium-to-product regeneration systems. The latter system is often preferred for some products, because it allows more even heat transfer and prevents burn-on.

Product-to-product regenerators:

Product-to-heat transfer medium-to-product regenerators:




Auxiliary temperature recorders and controllers

These instruments may be used in several locations on the HHST processing system, to provide a record of start-up pasteurization/sterilization and product processing temperature, and to provide temperature signals to the thermal limit controller unit or other processing controls.

General conditions

Cooling section

This section of the pasteurizer uses chilled water and/or glycol to cool the hot product down to packaging and filling temperature. Since the flow diversion device is located downstream from this section, the cooling section may become contaminated with potentially unpasteurized product during divert, and must be re-pasteurized/re-sterilized as part of the thermal limit controller sequence logic after a divert event.

Flash coolers are sometimes installed on the divert line to prevent injury to bystanders if a divert event occurs during the pasteurizing of the holding tube and cooling section, when there is no cooling turned on.

General conditions

Pressure differentials

An automated mechanism is an effective means of achieving the correct pressure relationship in the cooling section during forward flow, divert and shutdown conditions so that the pressure on the pasteurized product side is greater than the cooling media side.

Cooling medium

Heating, pre-heating and chilled water media can be a potential source of contamination to the pasteurized product.


The homogenizer is a high pressure pump that produces a homogenized product by reducing the size of fat globules as they are forced through a small orifice under high pressure. Since the homogenizer is a positive pump, it can be utilized as a flow control device.

If the homogenizer is utilized as a flow control device, refer to the Flow control device section.

General conditions

Homogenizer larger than flow control device

If a homogenizer located downstream from the flow control device has a capacity greater than the flow control device, the homogenizer is not a flow promoter. For example:

Surge tank

The surge tank acts as a pasteurized product balance tank for the fillers. This allows both the fillers and the HHST processing system to operate independently.

General conditions

Stuffing pump

Stuffing pumps may be used to improve the efficiency of other devices, such as homogenizers.

General conditions


If the homogenizer is used as a flow control device, a centrifugal type stuffing pump may be installed between the raw product outlet of the regenerator and the inlet manifold of the homogenizer to supply the desired pressure to the homogenizer.


Packaging conditions

Packaging records

Date modified: