Grade "A" Pasteurized Milk Ordinance (2003 Revision)

Appendix H. Pasteurization Equipment and Procedures

(Table of Contents)

I. HTST PASTEURIZATION

OPERATION OF HTST SYSTEMS

HTST pasteurization is important to the dairy industry because of the operating efficiencies that it affords. Properly operated, these units allow a high volume of production in a minimum of processing space.

The ability of HTST pasteurizers to assure a safe, finished milk or milk product hinges on the reliability of the time-temperature-pressure relationships that must prevail whenever the system is in operation. It is important that the milk plant operator understand the HTST process in order to maintain proper surveillance over the equipment. The basic flow pattern is described below:

1. Cold raw milk or milk product, in a constant-level supply tank, is drawn into the regenerator section of the HTST pasteurizer.

   NOTE: Some operators prefer to bypass the regenerator when starting. Under this system, cold milk is drawn directly through the timing pump, step 3, and into the heater section. The remaining steps are performed without exception. This bypass arrangement facilitates and speeds up the starting operation. After forward-flow is established at the FDD, the bypass, which may be manually or automatically controlled, is not used and the raw milk or milk product flows through the regenerator. A second start-up technique involves the use of sanitizing solution at 77°C (170°F). This is passed through the complete unit and followed immediately by milk or milk product. Dilution of the first milk or milk product does occur; however, care must be taken to prevent this from being packaged.

2. In the regenerator section, the cold raw milk or milk product is warmed by hot pasteurized milk or milk product flowing in a counter current direction on the opposite sides of thin stainless steel surfaces.
3. The raw milk or milk product, still under suction, passes through a positive-displacement-timing pump that delivers it under pressure through the rest of the HTST pasteurization system.
4. The raw milk or milk product is pumped through the heater section, where hot water or steam on opposite sides of thin stainless steel surfaces heats the milk or milk product to a temperature of at 72°C (161°F).
5. The milk or milk product, at pasteurization temperature, and under pressure, flows through the holding tube where it is held for at least fifteen (15) seconds. The maximum velocity of the milk or milk product through the holding tube is governed by the speed of the timing pump, the diameter and length of the holding tube and surface friction.
6. After passing the sensing bulbs of the indicating thermometer and recorder/controller, the milk or milk product passes into the FDD, which automatically assumes a forward-flow position, if the milk or milk product passes the recorder/controller bulb at the preset cut-in temperature, i.e., 72°C (161°F).
7. Improperly heated milk or milk product flows through the diverted-flow line back to the constant-level tank.
8. Properly heated milk or milk product flows through the forward-flow line to the pasteurized milk or milk product regenerator section where it serves to warm the cold raw milk or milk product and, in turn, is cooled.
9. The warm milk or milk product passes through the cooling section, where coolant, on the sides of thin stainless steel surfaces opposite the pasteurized milk or milk product, reduces its temperature to 4.4°C (40°F) and below.
10. The cold pasteurized milk or milk product then passes to a storage tank or vat to await packaging.

HTST PASTEURIZERS EMPLOYING MILK OR MILK PRODUCT-TO-MILK OR MILK PRODUCT REGENERATORS WITH BOTH SIDES CLOSED TO THE ATMOSPHERE

Item 16p(D), of Section 7 establishes standards for regenerators. These standards insure that the raw milk or milk product will always be under less pressure than pasteurized milk or milk product in order to prevent contamination of the pasteurized milk or milk product in the event flaws should develop in the metal or joints separating it from the raw milk or milk product. An explanation of regenerator specifications is given below.

During normal operation, i.e., while the timing pump is operating, raw milk or milk product will be drawn through the regenerator at sub-atmospheric pressure. The pasteurized milk or milk product in the milk or milk product-to-milk or milk product regenerator will be above atmospheric pressure. The required pressure differential will be assured when there is no flow-promoting device downstream from the pasteurized milk or milk product side of the regenerator to draw the pasteurized milk or milk product through the regenerator, and the pasteurized milk or milk product downstream from the regenerator rises to at least 30.5 centimeters (12 inches) elevation above the highest raw milk or milk product level downstream from the constant-level tank, and is open to the atmosphere at this or a higher elevation, as required in Item 16p(D)2.

During a shutdown, i.e., when the timing pump stops, the raw milk or milk product in the regenerator will be retained under suction, except this suction may be gradually relieved by possible entrance of air drawn through the regenerator plate gaskets from the higher outside atmospheric pressure. With a free draining regenerator, as required under Item 16p(D)7, the raw milk or milk product level in the regenerator may drop slowly, depending on the tightness of the gaskets, ultimately falling below the level of the plates to the milk or milk product level in the constant-level tank. However, under these conditions, as long as any raw milk or milk product remains in the regenerator, it will be at sub-atmospheric pressure.

During shutdown, the pasteurized milk or milk product in the regenerator is maintained at atmospheric pressure or above by meeting the elevation requirement of Item 16p(D)2. Pressure greater than atmospheric is maintained when the level of pasteurized milk or milk product is at or above the required elevation and loss of pressure, due to suction, is prevented by prohibiting a downstream pump.

Any backflow of milk or milk product through the FDD would lower the pasteurized milk or milk product level, during pump shutdowns, thus tending to reduce the pressure on the pasteurized milk or milk product side of the regenerator. A FDD cannot be relied upon to prevent backflow in such instances, because during the first few minutes following a pump shutdown, the milk or milk product is still at a sufficiently high temperature to keep the FDD in the forward-flow position. Compliance with the provisions of Item 16p(D)2 and 3; however, will insure a proper pressure differential in the regenerator.

At the beginning of a run, from the time raw milk or milk product or water is drawn through the regenerator, until the pasteurized milk or milk product or water has risen to the elevation specified in Item 16p(D)2, the pasteurized milk or milk product side of the regenerator is at atmospheric pressure or higher. Even if the timing pump should stop during this period, the pressure on the pasteurized milk or milk product side of the regenerator will be greater than the sub-atmospheric pressure on the raw milk or milk product side. This will be assured by compliance with Item 16p(D)2 and 3, as long as any raw milk or milk product remains in the regenerator.

When a raw milk or milk product booster pump is incorporated into the HTST system, Item 16p(D)5 requires, in part, that automatic means shall be provided to assure, at all times, the required pressure differential between raw and pasteurized milk or milk product in the regenerator, before the booster pump can operate.

THE USE OF SEPARATORS WITHIN HTST SYSTEMS

Separators in HTST pasteurization systems must be installed and operated in such a manner that they will not adversely effect the regenerator pressures, create a negative pressure on the FDD during operation or cause milk or milk product flow through the holding tube during times when such flow would compromise a required public health safe guard.

1. A separator may be located between the outlet of a raw regenerator and the timing pump or between raw regenerator sections if the separator is automatically valved out of the system, and separator stuffing pump(s) are de-energized, when:
   1. The timing pump is not in operation; or
   2. A dual stem FDD is in the inspect position; or
   3. In a system with a dual stem FDD, in which the separator is located between sections of a raw regenerator, during the first ten (10) minutes of a required ten (10) minute time delay in CIP mode and during any period of diverted-flow; or
   4. The pressures in any raw regenerator sections, located after the separator, are out of compliance with the pressure requirements of this Ordinance.
   NOTE: The second section of a split raw regenerator must freely drain back to the constant-level tank or to the floor in the event of a shut down.
2. A separator may not be located between the timing pump and the FDD.
3. A separator may be located on the pasteurized side of the FDD if:
   1. A properly installed atmospheric break is located between the FDD and the inlet of the separator;
   2. All milk or milk product rises to at least 30.5 centimeters (12 inches) higher than the highest raw milk or milk product in the system and is open to the atmosphere at some point between the outlet of the separator and the inlet of any pasteurized side regenerator;
   3. All milk or milk product rises to at least 30.5 centimeters (12 inches) higher than the highest raw milk or milk product in the system and is open to the atmosphere at some point between the outlet of any pasteurized side regenerator and the inlet of a separator; and
   4. The separator is automatically valved out of the system, and the separator stuffing pump is de-energized:
      1. (1) When a dual stem FDD is in the first ten (10) minutes of a required ten (10) minute delay in CIP mode;
      2. (2) When the FDD is diverted in product or inspect mode;
      3. (3) When the timing pump is not in operation; and
      4. (4) When the temperature is below the required pasteurization temperature and the FDD is not in the fully diverted-position.
4. The following criteria applies to installations where a separator must be valved out:
   1. A valve must be located to isolate the product supply line from the separator;
   2. A valve must be located to prevent all flow exiting the separator from being returned to the pasteurization system downstream of the separator; and
   3. The valves are required to move in order to accomplish the two (2) criteria listed above and must move to the valved-out position, and any separator stuffing pumps must be de-energized, upon loss of air or power.

THE USE OF LIQUID INGREDIENT INJECTION WITHIN HTST SYSTEMS

Milk or milk product flavoring slurries, condensed milk or milk products, and cream or skim for standardization and similar ingredients may be injected at a point after the last regenerator and before the timing pump, if all of the following conditions are met:

1. The slurry injection valve(s) is (are) closed and the slurry pump is de-energized:
   1. When the FDD is in inspect mode;
   2. When the timing pump is not in operation; and
   3. When the temperature is below the required pasteurization temperature and the FDD is not in the fully diverted position.
2. The slurry injection valve(s) is (are) of the fail-safe type, spring-to-close and air-to-open, and are "block-and-bleed" design with a full port open to the atmosphere between the HTST isolation seat and the slurry pump when slurry is not being injected.
3. The slurry piping between the slurry pump and the injection point may rise to a height that is higher than the overflow level of the slurry supply tank(s) but is at least 30.5 centimeters (12 inches) lower than the required opening to the atmosphere on the pasteurized side.
4. The slurry supply tank has an overflow that is at least twice the diameter of the largest inlet pipe, or all inlet pipes are disconnected and the openings capped during operation of the slurry pump.
5. There is a check-valve in the flow stream of the milk or milk product line from the last regenerator, typically after the separator, upstream of the injection point valve.
6. If the slurry contains milk and/or milk products, tanks used to blend and hold such slurry shall be completely emptied and cleaned after each four (4) hours of operation or less, unless it shall be stored at a temperature of 7°C (45°F) or less, or at a temperature of 66°C (150°F) or more and be maintained there until the time of injection.
7. If computers or programmable controllers are used to provide any of these required functions, they shall meet the applicable portion of Appendix H., V.
8. Appropriate test procedures shall be provided to evaluate the required inter-wiring and function.

NOTE:

1. This Section describes one (1) method that has been reviewed and accepted for this purpose. It does not preclude other methods that may be reviewed and found acceptable.
2. In order to help assure compliance with Section 2-Adulteration of this Ordinance, a Regulatory Agency may require that the milk plant close the slurry valve and de-energize the slurry pump during times when the system is recycling milk or milk product, such as in recycle mode, diverted-flow, or the first ten (10) minutes of the CIP cycle. If a computer is used to accomplish this, it does not need to meet Appendix H., V.-Criteria for the Evaluation of Computerized Systems for Grade "A" Public Health Controls of this Ordinance.

PRESSURE RELIEF VALVES, LOCATED WITHIN HTST, HHST AND ASEPTIC PROCESSING SYSTEMS

1. Between the Timing Pump and the Beginning of the Holding Tube: Placement of a pressure relief valve between the timing pump and the beginning of the holding tube is acceptable provided:
   1. The pressure relief valve is a fail-safe/spring-to-close valve with a spring pressure greater than the highest normal operating pressure of the system when operating in "Product" mode; or a fail-safe/spring-to-close valve with overriding air pressure.
   2. Provisions are made for cleaning the valve whenever the system is cleaned. Except as provided above, if pressurized air is used to overcome the pressure relief valve spring, the flow of this air must be enabled only in "CIP" mode, after the minimum required ten (10) minute time delay relay has expired. If a computer controls the air, that computer must comply with the requirements of Appendix H. V.-Criteria for the Evaluation of Computerized Systems for Grade "A" Public Health Controls of this Ordinance.
   3. The pressure relief valve vent opening is such that any leakage is readily visible. This may be accomplished by opening the valve vent directly to the floor or by providing sanitary piping from the valve vent to the constant-level tank. If the later option is utilized, the piping shall be properly sloped to assure drainage to the constant-level tank and provide a means of leak detection, such as by a properly located and installed sight-glass.
   4. The pasteurizer shall not be timed if the valve is leaking.
   5. If the valve is leaking during operation, the system is considered in violation of Item 16p(D) of this Ordinance, unless the loss of the pasteurized side regenerator pressure, during a shutdown in forward-flow, is otherwise effectively prevented.

      For Example: In a magnetic flow meter based timing system there is a fail-safe, spring-to-close valve or check-valve that must also be located between the timing pump and the holding tube. This item is satisfied if the pressure relief valve is located prior to this fail-safe valve or check-valve.

2. Downstream from the Holding Tube in HTST Systems: The pressures in the pasteurized side of the regenerator must be protected from falling within 6.9 kPa (1 psi) of the pressures in the raw side of the regenerator at all times, including during shut down. A relief valve and line on the pasteurized side of the FDD can meet this criterion if:
   1. After the relief valve and before the entrance to the pasteurized side of a regenerator, all milk or milk product rises at least 30.5 centimeters (12 inches) higher than the highest raw milk or milk product in the system, and is open to the atmosphere at that point; or
   2. After exiting the pasteurized regenerator, and before the pressure relief valve, all milk or milk product must rise at least 30.5 centimeters (12 inches) higher than the highest raw milk or milk product in the system, and be open to the atmosphere at that point; or
   3. The pressure relief valve is spring-loaded and plumbed so that it cannot be opened or forced open in any mode, "Product", "CIP" or "Inspect", without the assistance of pressure from the liquid flowing through the system. In this case, a leaking pressure relief valve can cause an unacceptable loss of pressure in the pasteurized side of the regenerator during a shut down and is considered a violation of Item 16p(D) of this Ordinance.

MAGNETIC FLOW METER BASED TIMING SYSTEMS FOR HTST PASTEURIZERS

Recent developments in the design of HTST pasteurizing systems have introduced the use of magnetic flow meter based timing systems to be used as replacements for positive-displacement timing pumps with a fixed or sealed speed below the required holding time. These systems are of two (2) basic types:

1. Those employing a constant speed centrifugal pump and a control valve, or
2. Those employing an A-C variable frequency control for the centrifugal pump. In this case the timing pump may be a centrifugal or a positive-displacement type.

Item 16p(B)2(f) of Section 7 provides for their use, provided they meet the following specifications for design, installation and use.

COMPONENTS: Magnetic flow meter based timing systems shall consist of the following components:

1. A sanitary magnetic flow meter which has been reviewed by FDA or one (1) which is equally accurate, reliable and will produce six (6) consecutive measurements of holding time within 0.5 seconds of each other.
2. Suitable converters for conversion of electric and/or air signals to the proper mode for the operation of the system.
3. A suitable flow recorder capable of recording flow at the flow alarm set point and also at least 19 liters (5 gallons) per minute higher than the flow alarm setting. The flow recorder shall have an event pen that shall indicate the status of the flow alarm with respect to flow rate.
4. A flow alarm, with an adjustable set point, shall be installed within the system which will automatically cause the FDD to be moved to the divert position whenever excessive flow rate causes the milk or milk product holding time to be less than the legal holding time for the pasteurization process being used. The flow alarm shall be tested by the Regulatory Agency in accordance with the procedures of Appendix I, Test 11, 2.A and B at the frequency specified. The flow alarm adjustment shall be sealed.
5. A loss-of-signal alarm shall be installed with the system, which will automatically cause the FDD to be moved to the divert position whenever there is a loss-of-signal from the meter. The loss-of-signal provision shall be tested by the Regulatory Agency in accordance with Appendix I, Test 11, 2.C at the frequency specified. The loss-of-signal provision shall be sealed.
6. When the legal flow rate has been reestablished, following an excessive flow rate, a time delay must be instituted, which will prevent the FDD from assuming the forward-flow position until at least a fifteen (15) seconds, for milk or milk product, or twenty-five (25) seconds for eggnog and similar products, of continuous legal flow has been re-established. The time delay must be tested by the Regulatory Agency and if it is of the adjustable type shall be sealed.
7. When a constant speed centrifugal pump is used, a sanitary, spring-to-close and air-to-open, control valve shall be used to control the rate of flow of milk or milk product through the HTST system.
8. When an A-C variable frequency control is used on the timing pump, the control valve is not needed as the flow rate of the milk or milk product through the system is controlled by feeding the signal from the magnetic flow meter to a controller, which in turn varies the A-C frequency to the pump motor, thus controlling the flow rate of milk or milk product through the system. With these A-C variable frequency control systems, a sanitary product check-valve is needed, in the sanitary milk or milk product pipeline to prevent a positive pressure in the raw milk or milk product side of the regenerator whenever a power failure, shutdown or flow-diversion occurs.
9. When a regenerator is used with large systems, it will be necessary to bypass the regenerator during start-up and when the FDD is in the diverted-flow position. Care should be taken in the design of such bypass systems to assure that a dead-end does not exist. A dead-end could allow milk or milk product to remain at ambient temperature for long periods of time and allow bacterial growth in the milk or milk product. Caution should also be observed with such bypass systems and any valves used in them so that raw milk or milk product will not be trapped, under pressure in the raw regenerator plates, and not have free drainage back to the constant-level tank when shutdown occurs.
10. Most systems will utilize a dual stem FDD and will be using the timing pump during the mechanical cleaning cycle. All public health controls, required of such systems, must be applicable. When switching to the "CIP" position, the FDD must move to the divert position and must remain in the diverted-flow position for at least ten (10) minutes, regardless of temperature, and the booster pump cannot run during this ten (10) minute time delay.
11. All systems shall be designed, installed and operated so that all applicable tests required by Section 7, Item 16p(E) can be performed by the Regulatory Agency, at the frequency specified. (Refer to Appendix I.) Where adjustment or changes can be made to these devices or controls, appropriate seals shall be applied by the Regulatory Agency after testing, so that changes cannot be made without detection.
12. Except for those requirements directly related to the physical presence of the timing pump, all other requirements of the most recent edition of this Ordinance are applicable.

PLACEMENT OF COMPONENTS: Individual components in the magnetic flow meter based timing systems shall comply with the following placement conditions:

1. The timing pump shall be located downstream from the raw milk or milk product regenerator section, if a regenerator is used.
2. The magnetic flow meter shall be placed downstream from the timing pump. There shall be no intervening flow-promoting components between the timing pump and the meter.
3. The control valve, used with the constant speed timing pump, shall be located downstream of the magnetic flow meter.
4. The timing pump, the magnetic flow meter, the control valve, when used with the constant speed timing pump system, and the sanitary product check-valve, when used with the A-C variable frequency control system, shall all be located upstream from the start of the holding tube.
5. All flow-promoting devices, which are upstream of the FDD, such as the timing pump, constant speed or A-C variable frequency control type, booster pump, stuffer pump, separator and clarifier shall be properly interwired with the FDD so that they may run and produce flow through the system at sub-legal temperatures, only when the FDD is in the fully diverted position and when in "Product" run mode. Separators or clarifiers that continue to run, after they are de-energized must be automatically valved-out of the system, with fail-safe valves, so they are incapable of producing flow.
6. There shall be no product entering or leaving the system, i.e., cream or skim milk from a separator or other product components, between the timing pump and the FDD.
7. The magnetic flow meter shall be so installed that the milk or milk product has contact with both electrodes at all times when there is flow through the system. This is most easily accomplished by mounting the flow tube of the magnetic flow meter in a vertical position with the direction of flow from the bottom to the top. However, horizontal mounting is acceptable when other precautions are taken to assure that both electrodes are in contact with the product. They should not be mounted on a high horizontal line that may be only partially full and thereby trap air.
8. The magnetic flow meter shall be piped in such a manner that at least ten (10) pipe diameters of straight pipe exists, upstream and downstream from the center of the meter, before any elbow or change of direction takes place.

 

Figure 26. Milk-to-Milk Regeneration - Homogenizer Upstream from Holding Tube

 

Figure 27. Milk-to-Milk Regeneration - Booster Pump

 

Figure 28. Milk-to-Milk Regeneration - Homogenizer and Vacuum Chambers Downstream from Flow-Diversion Device

 

Figure 29. HTST System with a Magnetic Flow Meter Using a Constant Speed Centrifugal Pump and a Control Valve

 

Figure 30. HTST System with a Magnetic Flow Meter Using an A-C Variable Speed Centrifugal Pump

 

Figure 31. Controls for Steam Injection Pasteurizer

 

II. AIR FOR DRYING EQUIPMENT AND AIR UNDER PRESSURE - DIRECT CONTACT WITH MILK AND MILK PRODUCTS AND MILK PRODUCT - CONTACT SURFACES

AIR FOR DRYING EQUIPMENT

Filter Media: Intake air filter media shall consist of fiberglass, cotton flannel, wool flannel, spun metal, activated carbon, activated alumina, non-woven fabric, absorbent cotton fiber, electrostatic, or other suitable materials which, under conditions of intended use, are non-toxic and non-shedding and which do not release toxic volatiles or other contaminants to the air, or volatiles which impart any flavor or odor to the milk or milk product. Chemical bonding materials contained in the media shall be non-toxic, non-volatile and insoluble under all conditions of use. Disposable media are not intended to be cleaned and re-used.

Filter Performance: The air supply system and/or ducting shall be such that the air supply is caused to pass through suitable air filters, properly installed, before coming in contact with milk product-contact surfaces of the drying system. Supply air filters for air, which will be heated before it comes in contact with the milk or milk product, shall be of a design, selected to operate at a face velocity, and installed in a manner which will allow the filter manufacturer's rating to be 90 percent (90%)or higher, when tested in accordance with the American Society of Heating, Refrigerating and Air-Conditioning Engineers (ASHRAE) Synthetic Dust Arrestance test.⁽¹⁾

Supply air filters for air, which will not be heated before it comes in contact with the milk or milk product, shall be of a design, selected to operate at a face velocity, and installed in a manner which will allow the filter manufacturer's rating to be 85 percent (85%)or higher when tested in accordance with the ASHRAE Atmospheric Dust Spot Method⁽¹⁾

AIR UNDER PRESSURE - MILK PRODUCT - CONTACT SURFACES

MATERIAL

Filter Media: Air intake and pipeline filters shall consist of fiberglass, cotton flannel, wool flannel, spun metal, electrostatic material or other equally acceptable filtering media, which are non-shedding and which do not release to the air, toxic volatiles or volatiles which may impart any flavor or odor to the milk or milk product.

Disposable media filters shall consist of cotton flannel, wool flannel, spun metal, non-woven fabric, USP absorbent cotton fiber or suitable inorganic materials, which under conditions of use, are non-toxic and non-shedding. Chemical bonding material, contained in the media, shall be non-toxic, nonvolatile and insoluble under all conditions of use. Disposable media shall not be cleaned and reused.

Filter Performance: The efficiency of intake filters shall be at least fifty percent (50%) as measured by the National Institute of Standards and Technology's "Dust Spot Method"⁽²⁾ using atmospheric dust as the test aerosol.

The efficiency of either air pipeline filters or disposable filters shall be at least fifty percent (50%) as measured by the DOP (dioctyl 1-phthalate fog)⁽³⁾ test.

Piping: Air distribution piping, fittings and gaskets between the terminal filter and any milk product-contact surface, shall be sanitary milk piping, except, where the compressing equipment is of the fan or blower type. When the air is used for such operations, as removing containers from mandrels, other non-toxic materials may be used.

FABRICATION AND INSTALLATION

Air Supply Equipment: The compressing equipment shall be designed to preclude contamination of the air with lubricant vapors and fumes. Oil-free air may be produced by one (1) of the following methods or their equivalent:

1. Use of a carbon ring piston compressor;
2. Use of oil-lubricated compressor with effective provision for removal of any oil vapor by cooling the compressed air; or
3. Water-lubricated or non-lubricated blowers.

The air supply shall be taken from a clean space or from relatively clean outer air and shall pass through a filter upstream from the compressing equipment. This filter shall be located and constructed so that it is easily accessible for examination and the filter media are easily removable for cleaning or replacing. The filter shall be protected from weather, drainage, water, product spillage and physical damage.

Moisture Removal Equipment: If it is necessary to cool the compressed air, an after-cooler shall be installed between the compressor and the air storage tank for the purpose of removing moisture from the compressed air.

Filters and Moisture Traps: Filters shall be constructed so as to assure effective passage of air through the filter media only.

The air under pressure shall pass through an oil-free filter and moisture trap for removal of solids and liquids. The filter and trap shall be located in the air pipeline, downstream from the compressing equipment and from the air tank, if one is used. Air pipeline filters and moisture traps, downstream from compressing equipment, shall not be required where the compressing equipment is of the fan or blower type.

A disposable media filter shall be located in the sanitary air pipelines upstream from and as close as possible to each point of application or ultimate use of the air.

Air Piping: The air piping from the compressing equipment to the filter and moisture trap shall be readily drainable.

A milk or milk product check-valve of sanitary design shall be installed in the air piping, downstream from the disposable media filter, to prevent backflow of milk or milk product into the air pipeline, except that a check-valve shall not be required if the air piping enters the milk or milk product zone from a point higher than the milk or milk product overflow level, which is open to the atmosphere.

For milk dryers, the air supply system and/or ducting shall be such that the air supply is caused to pass through suitable air filters, properly installed, before coming in contact with milk or milk product-contact surfaces of the drying system.

The requirements of this Section do not apply when the compressing equipment is of the fan or blower type. (Refer to Figures 32-36, which depict various air supply systems.)

NOTE: For additional details, refer to the 3-A Accepted Practices for Supplying Air Under Pressure in Contact with Milk, Milk Products and Product-Contact Surfaces.

 

Figure 32. Individual Compression-Type Air Supply

 

Figure 33. Central Compression-Type Air Supply

 

Figure 34. Individual Blower-Type Air Supply

 

Figure 35. Individual Fan-Type Air Supply

 

Figure 36. Rotating Mandrel Assembly

 

III. CULINARY STEAM - MILK AND MILK PRODUCTS

The following methods and procedures will provide steam of culinary quality for use in the processing of milk and milk products.

SOURCE OF BOILER FEED WATER

Potable water or water supplies, acceptable to the Regulatory Agency, will be used.

FEED WATER TREATMENT

Feed water may be treated, if necessary, for proper boiler care and operation. Boiler feed water treatment and control shall be under the supervision of trained personnel or a firm specializing in industrial water conditioning. Such personnel shall be informed that the steam is to be used for culinary purposes. Pretreatment of feed waters for boilers or steam generating systems to reduce water hardness, before entering the boiler or steam generator by ion exchange or other acceptable procedures, is preferable to the addition of conditioning compounds to boiler waters. Only compounds complying with 21 CFR 173.310 may be used to prevent corrosion and scale in boilers, or to facilitate sludge removal.

Greater amounts shall not be used of the boiler water treatment compounds than the minimum necessary for controlling boiler scale or other boiler water treatment purposes. No greater amount of steam shall be used for the treatment and/or pasteurization of milk and milk products than necessary.

It should be noted that tannin, which is also frequently added to boiler water to facilitate sludge removal during boiler blow-down, has been reported to give rise to odor problems, and should be used with caution.

Boiler compounds containing cyclohexylmine, morpholine, octadecylamine, diethylamino-ethanol, trisodium nitrilotriacetae, and hydrazine shall not be permitted for use in steam in contact with milk and milk products.

BOILER OPERATION

A supply of clean, dry saturated steam is necessary for proper equipment operation. Boilers and steam generation equipment shall be operated in such a manner as to prevent foaming, priming, carryover and excessive entrainment of boiler water into the steam. Carryover of boiler water additives can result in the production of milk or milk product off-flavors. Manufacturers' instructions regarding recommended water level and blow-down should be consulted and rigorously followed. The blow-down of the boiler should be carefully watched, so that an over-concentration of the boiler water solids and foaming is avoided. It is recommended that periodic analyses be made of condensate samples. Such samples should be taken from the line between the final steam separating equipment and the point of the introduction of steam into the milk or milk product.

PIPING ASSEMBLIES

Refer to Figure 37 for suggested piping assemblies for steam infusion or injection. Other assemblies that will assure a clean, dry saturated steam are acceptable.

Figure 37. Culinary Steam Piping Assembly for Steam Infusion or Injection

 

Figure 38. Culinary Steam Piping Assembly for Airspace Heating or Defoaming

 

IV. THERMOMETER SPECIFICATIONS

INDICATING THERMOMETERS FOR BATCH PASTEURIZERS

Type:

1. Mercury-Actuated; Direct-Reading:
   1. Contained in a corrosion-resistant case, which protects against breakage and permits easy observation of the column and scale.
   2. Filling above mercury - nitrogen or other suitable gas.
   3. The mercury column shall be magnified to an apparent width of not less than 1.6 millimeters (0.0625 of an inch).
2. Digital:
   1. No more than 0.2°C (0.5°F) drift over three (3) months use on a batch pasteurizer compared to a certified temperature source.
   2. Self-diagnostic circuitry, which provides constant monitoring of all sensing, input and conditioning circuits. The diagnostic circuitry should be capable of detecting "open" circuits, "short" circuits, poor connections and faulty components. Upon detection of failure of any component, the device shall blank or become unreadable.
   3. The electromagnetic compatibility of this device for this use shall be documented and available to the Regulatory Agency. The device must be tested to determine the effects of electrostatic discharge, power fluctuation, conductive emission and susceptibility, and radiative emission and susceptibility. The device must comply with the requirements for performance level characteristics of industrial devices. Vendors shall develop protocols for these tests with FDA concurrence.
   4. The effect of exposure to specific environmental conditions shall be documented. The device must be tested to determine the effects of low and high temperatures, thermal shock, humidity, physical shock and salt fog. Vendors shall develop protocols for these tests with FDA concurrence.
   5. Both the probe and the display case shall be constructed so that they may be sealed by the Regulatory Agency.
   6. Calibration of the device shall be protected against unauthorized changes.
   7. The device shall be protected against unauthorized component or sensing element replacement. Replacement of any component or sensing element shall be regarded as a replacement of the indicating thermometer and subject to Regulatory Agency inspection and all application tests under Appendix I. of this Ordinance.
   8. The sensing element shall be encased in appropriate material constructed in such a way that the final assembly meets the conditions of Item 11p of this Ordinance.
   9. The device must be tested from the sensing probe through the final output.

Scale: Shall have a span of not less than fourteen (14) Celsius degrees (twenty-five (25) Fahrenheit degrees), including the pasteurization temperature, ± 2.5°C (± 5°F); graduated in 0.5°C (1°F) divisions, with not more than nine (9) Celsius degrees (sixteen (16) Fahrenheit degrees) per 2.54 centimeters (1 inch) of span; and protected against damage at 105°C (220°F). Provided, that on batch pasteurizers used solely for thirty (30) minute pasteurization of milk and milk products at temperatures above 71°C (160°F), indicating thermometers with 1°C (2°F) scale graduations, with not more than six (6) Celsius degrees (twenty-eight (28) Fahrenheit degrees) per 2.54 centimeters (1 inch) of scale, may be used.

Accuracy: Within ± 0.2°C (± 0.5°F), through the specified scale span. Provided, that on batch pasteurizers used solely for thirty (30) minute pasteurization of milk and milk products at temperatures above 71°C (160°F), indicating thermometers shall be accurate to within ±.5°C (± 1°F). (Refer to Appendix I., Test 1)

Submerged Stem Fitting: A pressure-tight seat against the inside wall of the holder; no threads exposed to milk or milk products; and the location of this seat to conform to the 3-A Sanitary Standard for a wall-type fitting or other equivalent sanitary fitting.

Bulb: Corning normal or equally suitable thermometric glass.

INDICATING THERMOMETERS LOCATED ON PASTEURIZATION PIPELINES

Type:

1. Mercury-Actuated; Direct-Reading:
   1. Contained in a corrosion-resistant case, which protects against breakage and permits easy observation of the column and scale.
   2. Filling above mercury - nitrogen or other suitable gas.
   3. The mercury column shall be magnified to an apparent width of not less than 1.6 millimeters (0.0625 of an inch).
2. Digital:
   1. No more than 0.2°C (0.5°F) drift over three (3) months use on a HTST system compared to a certified temperature source.
   2. Self-diagnostic circuitry, which provides constant monitoring of all sensing, input and conditioning circuits. The diagnostic circuitry should be capable of detecting "open" circuits, "short" circuits, poor connections and faulty components. Upon detection of failure of any component, the device shall blank or become unreadable.
   3. The electromagnetic compatibility of this device for this use shall be documented and available to the Regulatory Agency. The device must be tested to determine the effects of electrostatic discharge, power fluctuation, conductive emission and susceptibility, and radiative emission and susceptibility. The device must comply with the requirements for performance level characteristics of industrial devices. Vendors shall develop protocols for these tests with FDA concurrence.
   4. The effect of exposure to specific environmental conditions shall be documented. The device must be tested to determine the effects of low and high temperatures, thermal shock, humidity, physical shock and salt fog. Vendors shall develop protocols for these tests with FDA concurrence.
   5. Both the probe and the display case shall be constructed so that they may be sealed by the Regulatory Agency.
   6. Calibration of the device shall be protected against unauthorized changes.
   7. The device shall be protected against unauthorized component or sensing element replacement. Replacement of any component or sensing element shall be regarded as a replacement of the indicating thermometer and subject to Regulatory Agency inspection and all applicable tests under Appendix I. of this Ordinance.
   8. The sensing element shall be encased in appropriate material constructed in such a way that the final assembly meets the conditions of Item 11p of this Ordinance.
   9. The device must be tested from the sensing probe through the final output.

Scale: Shall have a span of not less than fourteen (14) Celsius degrees (twenty-five (25) Fahrenheit degrees), including the pasteurization temperature, ± 2.5°C (± 5°F); and protected against damage at 105°C (220°F), and in the case of thermometers used on HHST systems protected against damage at 149°C (300°F). Mercury actuated thermometers shall be graduated in 0.2°C (0.5°F) divisions with not more than four (4) Celsius degrees (eight (8) Fahrenheit degrees) per 2.54 centimeters (1 inch) of scale. The digital thermometer readout shall display in units no greater than of 0.05°C (0.1°F).

Accuracy: Within ± 0.2°C (± 0.5°F), throughout the specified scale span. (Refer to Appendix I., Test 1)

Stem Fittings: A pressure-tight seat against the inside wall of the fittings; no threads exposed to milk or milk products. The probe is to be designed so that the sensitive area is discernible from the remainder of the stem. The overall probe length to be such that the sensitive area is positioned in the milk or milk product flow path when properly installed.

Thermometric Response: When the thermometer is at room temperature and then is immersed in a well-stirred water bath 11°C (19°F) or less above the pasteurization temperature, the time required for the reading to increase from water bath temperature, minus 11°C (19°F), to water bath temperature, minus 4°C (7°F), shall not exceed four (4) seconds. The digital thermometer displays shall change at a rate that can be noted by the operator or Regulatory Agency during the thermometric lag test. (Refer to Appendix I., Test 7)

Bulb: Corning normal, or equally suitable thermometric glass.

AIRSPACE INDICATING THERMOMETER FOR BATCH PASTEURIZERS

Type:

1. Mercury-Actuated; Direct-Reading:
   1. Contained in a corrosion-resistant case, which protects against breakage and permits easy observation of the column and scale.
   2. The bottom of the bulb chamber shall not be less than 51 millimeters (2 inches) and not more than 89 millimeters (3.5 inches), below the underside of the cover.
   3. Filling above mercury - nitrogen or other suitable gas.
   4. The mercury column shall be magnified to an apparent width of not less than 1.6 millimeters (0.0625 of an inch).
2. Digital:
   1. No more than 0.2°C (0.5°F) drift over three (3) months use on a batch pasteurizer compared to a certified temperature source.
   2. Self-diagnostic circuitry, which provides constant monitoring of all sensing, input and conditioning circuits. The diagnostic circuitry should be capable of detecting "open" circuits, "short" circuits, poor connections and faulty components. Upon detection of failure of any component, the device shall blank or become unreadable.
   3. The electromagnetic compatibility of this device for this use shall be documented and available to the Regulatory Agency. The device must be tested to determine the effects of electrostatic discharge, power fluctuation, conductive emission and susceptibility, and radiative emission and susceptibility. The device must comply with the requirements for performance level characteristics of industrial devices. Vendors shall develop protocols for these tests with FDA concurrence.
   4. The effect of exposure to specific environmental conditions shall be documented. The device must be tested to determine the effects of low and high temperatures, thermal shock, humidity, physical shock and salt fog. Vendors shall develop protocols for these tests with FDA concurrence.
   5. Both the probe and the display case shall be constructed so that they may be sealed by the Regulatory Agency.
   6. Calibration of the device shall be protected against unauthorized changes.
   7. The device shall be protected against unauthorized component or sensing element replacement. Replacement of any component or sensing element shall be regarded as a replacement of the indicating thermometer and subject to Regulatory Agency inspection and all application tests under Appendix I of this Ordinance.
   8. The sensing element shall be encased in appropriate material constructed in such a way that the final assembly meets the conditions of Item 11p of this Ordinance.
   9. The device must be tested from the sensing probe through the final output.
   10. The bottom of the bulb chamber is not less than 51 millimeters (2 inches) and not more than 89 millimeters (3.5 inches), below the underside of the cover.

Scale: Shall have a span of not less than fourteen (14) Celsius degrees (twenty-five (25) Fahrenheit degrees), including the pasteurization temperature of 66°C (150°F), ± 2.5°C (± 5°F); graduated in not more than 1°C (2°F) divisions, with not more than nine (9) Celsius degrees (sixteen (16) Fahrenheit degrees) per 2.54 centimeters (1inch) of scale; and protected against damage at (105°C) 220°F.

Accuracy: Within ± 0.5°C (± 1°F), throughout the specified scale span. (Refer to Appendix I., Test 1)

Stem Fittings: A pressure-tight seat or other suitable sanitary fitting with no threads exposed.

RECORDING THERMOMETERS FOR BATCH PASTEURIZERS

1. UTILIZING TEMPERATURES LESS THAN 71°C (160°F)

Case: Moisture proof under normal operating conditions in milk plants.

Scale: Shall have a span of not less than eleven (11) Celsius degrees (twenty (20) Fahrenheit degrees), including pasteurization temperature, ± 2.5°C (± 5°F); and graduated in temperature-scale divisions of 0.5°C (1°F), spaced not less than 1.6 millimeter (0.0625 of an inch) apart between 60°C (140°F) and 69°C (155°F). Provided, that temperature-scale divisions of 0.5°C (1°F), spaced not less than 1millimeter (0.040 inch) apart, are permitted when the ink line is thin enough to be easily distinguished from the printed line; graduated in time-scale divisions of not more than ten (10) minutes; and having a chord of straight-line length of not less than 6.3 millimeters (0.25 inches), between 63°C (145°F) and 66°C (150°F).

Temperature Accuracy: Within ± 0.5°C (± 1° F), between 60°C (140°F) and 69°C (155°F). (Refer to Appendix I., Test 2)

Time Accuracy: The recorded elapsed time, as indicated by the chart rotation, shall not exceed the true elapsed time, as compared to an accurate watch, over a period of at least thirty (30) minutes at pasteurization temperature. Recorders for batch pasteurizers may be equipped with spring operated or electrically operated clocks. (Refer to Appendix I., Test 3)

Pen-Arm Setting Device: Easily accessible and simple to adjust.

Temperature Sensing Device: Protected against damage at a temperature of 105°C (220°F).

Submerged Stem Fitting: A pressure-tight seat against the inside wall of the holder; no threads exposed to milk or milk products; and the distance from the underside of the ferrule to the sensitive portion of the bulb to be not less than 76 millimeters (3 inches).

Chart Speed: A circular chart shall make one (1) revolution in not more than twelve (12) hours. Two (2) charts shall be used if operations extend beyond twelve (12) hours in one day. Circular charts shall be graduated for a maximum record of twelve (12) hours. Strip-charts may show a continuous recording over a twenty-four (24) hour period.

Chart Support Drive: The rotating chart support drive shall be provided with a pin to puncture the chart in a manner to prevent its fraudulent rotation.

 

2. UTILIZING TEMPERATURES GREATER THAN 71°C (160°F)

Batch pasteurizers used solely for thirty (30) minute pasteurization of milk and milk products at temperature above 71°C (160°F) may use recording thermometers with the following options:

Scale: Graduated in temperature scale divisions of 1°C (2°F), spaced not less than 1 millimeter (.040 inch) apart between 65°C (150°F) and 77°C (170°F); graduated in time-scale divisions of not more than fifteen (15) minutes; and having a chord of straight-line length of not less than 6.3 millimeters (0.25 inch) between 71°C (160°F) and 77°C (170°F).

Temperature Accuracy: Within ± 1°C (± 2° F), between 71°C (160°F) and 77°C (170°F).

Chart Speed: A circular chart shall make one (1) revolution in not more than twenty-four (24) hours and shall be graduated for a maximum record of twenty-four (24) hours.

RECORDER/CONTROLLERS FOR CONTINUOUS PASTEURIZERS

Case: Moisture proof under normal operating conditions in milk plants.

Chart Scale: Shall have a span of not less than seventeen (17) Celsius degrees (thirty (30) Fahrenheit degrees), including the temperature at which diversion is set, ± 7°C (± 12°F); graduated in temperature scale divisions of 0.5°C (1°F), spaced not less than 1.6 millimeter (0.0625 inch) apart at the diversion temperature, ± 0.5°C (± 1°F). Provided, that temperature-scale divisions of 0.5°C (1°F), spaced not less than 1 millimeter (0.040 inch) apart, are permitted when the ink line is thin enough to be easily distinguished from the printed line; graduated in time-scale divisions of not more than fifteen (15) minutes; and having an equivalent fifteen (15) minute chord or straight-line length of not less than 6.3 millimeters (0.25 inch) at the diversion temperature, ± 0.5°C (± 1°F).

Temperature Accuracy: Within ± 0.5°C (± 1°F), at the temperature,± 3°C (± 5°F), at which the controller is set to divert. (Refer to Appendix I., Test 2)

Power Operated: All recorder/controllers for continuous pasteurization shall be electrically operated.

Pen-Arm Device: Easily accessible and simple to adjust.

Pen and Chart Paper: Pen designed to give a line not over .07 millimeter (0.025 inch) wide and easy to maintain.

Temperature Sensing Device: Bulb, tube, spring or thermistor, protected against damage at a temperature of 105°C (220°F). Provided, that the recorder/controller temperature sensing devices, used on HHST systems, shall be protected against damage at temperatures of 149°C (300°F).

Stem Fitting: Pressure-tight seat against the inside wall of the pipe; no threads exposed to milk or milk products; and the distance from the underside of the ferrule to the sensitive portion of the bulb is to be not less than 76 millimeters (3 inches).

Chart Speed: A circular chart shall make one (1) revolution in not more than twelve (12) hours. Two (2) charts shall be used if operations extend beyond twelve (12) hours in one (1) day. Circular charts shall be graduated for a maximum record of twelve (12) hours. Strip-charts may show a continuous recording over a twenty-four (24) hour period.

Frequency Pen: The recorder/controller shall be provided with an additional pen-arm located on the outer edge of the chart, for recording the time at which the FDD is in the forward or diverted-flow position. The chart time line shall correspond with the reference arc, and the recording pen shall rest upon the time line matching the reference arc.

Controller: Actuated by the same sensor as the recorder pen, however the cut-in and cut-out response shall be independent of pen-arm movement.

Controller Adjustment: A mechanism for the adjustment of the response temperature. It shall be designed so that the temperature setting cannot be altered or the controller manipulated without detection.

Thermometric Response: With the recorder/controller bulb at room temperature and then immersed in sufficiently agitated water or oil bath at 4°C (7°F) above the cut-in point, the interval between the moment when the recording thermometer reads 7°C (12°F) below the cut-in temperature and the moment of power cut-in shall be not more than five (5) seconds. (Refer to Appendix I., Test 8)

Chart Support Drive: The rotating chart support drive shall be provided with a pin to puncture the chart in a manner to prevent its fraudulent rotation.

INDICATING THERMOMETERS USED IN STORAGE TANKS

Scale Range: Shall have a span not less than twenty-eight (28) Celsius degrees (fifty (50) Fahrenheit degrees), including normal storage temperatures, ± 3°C (± 5°F), with an extension of scale on either side permitted, and graduated in not more than 1°C (2°F) divisions.

Temperature Scale Division: Spaced not less than 1.6 millimeters (0.0625 inch) apart between 2°C (35°F) and 13°C (55°F).

Accuracy: Within ± 1°C (± 2°F) throughout the specified scale range.

Stem Fitting: A pressure-tight seat or other suitable sanitary fittings with no threads exposed.

RECORDING THERMOMETERS USED IN STORAGE TANKS

Case: Moisture proof under operating conditions in milk plants.

Scale: Shall have a scale span of not less than twenty-eight (28) Celsius degrees (fifty (50) Fahrenheit degrees) including normal storage temperature, ± 3°C (± 5°F), graduated in not more than 1°C (2°F) divisions. Lines spaced not less than 1 millimeter (0.040 inch) apart, are permitted when the ink line is thin enough to be easily distinguished from the printed line. They shall be graduated in time scale divisions of not more than one (1) hour, having a chord of straight-line length of not less than 3.2 millimeters (0.125 inch) at 5°C (40°F). These charts must be capable of recording temperatures up to 83°C (180°F). Span specifications do not apply to extensions beyond 38°C (100°F).

Temperature Accuracy: Within ± 1°C (± 2°F), between the specified range limits.

Pen-Arm Setting Device: Easily accessible and simple to adjust.

Pen and Chart Paper: Designed to make a line not over .635 millimeters (0.025 inch) wide when in proper adjustment and easy to maintain.

Temperature Sensor: Protected against damage at 100°C (212°F).

Stem Fittings: A pressure-tight seat or other suitable sanitary fitting with no threads exposed.

Chart Speed: The circular chart shall make one (1) revolution in not more than seven (7) days and shall be graduated for a maximum record of seven (7) days. Strip chart shall move not less than 2.54 centimeters (1 inch) per hour and may be used continuously for one (1) calendar month.

RECORDING THERMOMETERS ON MECHANICAL CLEANING SYSTEMS

Location: Temperature sensor is in the return solution line downstream from the process.

Case: Moisture proof under operation conditions.

Scale: Shall have a range from 16°C (60°F) to 83°C (180°F), with extensions of scale on either side permissible and graduated in time-scale divisions of not more than fifteen (15) minutes. The chart is to be graduated in temperature divisions of not more than 1°C (2°F), spaced not less than 1.6 millimeters (0.0625 inch) apart, above 44°C (110°F). Provided, that temperature-scale divisions of 1°C (2°F), spaced not less than 1 millimeter (0.040 inch) apart, are permitted when the ink line is thin enough to be easily distinguished from the printed line.

Temperature Accuracy: Within ± 1°C (± 2°F), above 44°C (110°F).

Pen-Arm Setting Device: Easily accessible and simple to adjust.

Pen and Chart Paper: Designed to make a line not over .635 millimeters (0.025 inch) wide and easy to maintain.

Temperature Sensor: Protected against damage at 100°C (212°F).

Stem Fitting: A pressure-tight seat against the inside wall of the pipe with no threads exposed to solution.

Chart Speed: Circular charts shall make one (1) revolution in not more than twenty-four (24) hours. Strip charts shall not move less than 25 millimeters (1 inch) per hour. More than one (1) record of the cleaning operation shall not overlap on the same section of the chart for either circular- or strip-type charts.

INDICATING THERMOMETERS USED IN REFRIGERATED ROOMS WHERE MILK AND MILK PRODUCTS ARE STORED

Scale Range: Shall have a span not less than twenty-eight (28) Celsius degrees (fifty (50) Fahrenheit degrees), including normal storage temperatures, ± 3°C (± 5°F), with extensions of scale on either side permitted if graduated in not more than 1°C (2°F) divisions.

Temperature Scale Divisions: Spaced not less than 1.6 millimeters (0.0625 inches) apart between 0°C (32°F) and 13°C (55°F).

Accuracy: Within ± 1°C (± 2°F), throughout the specified scale ranges.

SPECIFICATIONS FOR RECORDING pH METER FOR USE ON AUTOMATED MECHANICAL CLEANING SYSTEMS FOR EVAPORATORS

Location: pH sensor shall be located in the return line downstream from processing equipment and all lines included in the mechanical cleaning circuit.

Case: Moistureproof under operating conditions.

Scale: It shall have a range of pH value from two (2) to twelve (12), with extensions of scale on either side permissible, and graduated in time scale divisions of not more than fifteen (15) minutes. The chart is to be graduated in pH divisions of not more than 0.5 pH values and spaced not less than 1.6mm (0.0625 of an inch) apart.

pH Accuracy: Within 0.5, plus or minus pH values.

Pen-Arm Setting Device: Easily accessible; simple to adjust.

Pen and Chart Paper: Designed to mark a line not over 0.635mm (0.025 of an inch) wide; easy to maintain.

pH Sensor: Protected against damage at 83°C (180°F).

Chart Speed: Circular charts shall make one (1) revolution in not more than twenty-four(24) hours. Strip charts shall not move slower than 25mm (1 inch) per hour. More than one (1)record of the cleaning operation shall not overlap on the same section of the chart for either circular or strip-type charts.

V. CRITERIA FOR THE EVALUATION OF COMPUTERIZED SYSTEMS FOR GRADE 'A' PUBLIC HEALTH CONTROLS

BACKGROUND

Computers are different from hard-wired controls in three (3) major categories. To provide adequate public health protection, the design of computerized public health controls must address these three (3) major differences.

First, unlike conventional hard-wired systems, which provide full-time monitoring of the public health controls, the computer performs its tasks sequentially, and the computer may be in real time contact with the FDD for only one (1) millisecond. During the next one hundred (100) milliseconds, or however long it takes the computer to cycle one (1) time through its tasks, the FDD remains in forward-flow, independent of temperature in the holding tube. Normally, this is not a problem, because most computers can cycle through one hundred (100) steps in their program, many times during one (1) second. The problem occurs when the public health computer is directed away from its tasks by another computer; or the computer program is changed; or a seldom used JUMP, BRANCH, or GOTO Instruction diverts the computer away from its public health control tasks.

Second, in a computerized system, the control logic is easily changed because the computer program is easily changed. A few keystrokes at the keyboard will completely change the control logic of the computer program. Conversely, hard-wired systems require tools and a technician to make wiring changes. Once the hard-wired system was properly installed and working, it was never changed. Sealing the access to the computer can solve the problem addressed above. A procedure is needed to ensure that the computer has the correct program when the Regulatory Agency reseals the computer.

Finally, some computer experts have stated categorically that no computer program can be written error-free. They were referring primarily to very large programs, with many conditional jumps and branches, with thousands of lines of program code. For these large systems, the programs actually improve with age. The errors are found and corrected under actual conditions of use. For public health controls, the computer program must and can be made error-free, since the programs required for public health control are relatively brief.

GLOSSARY

Address: A numerical label on each memory location of the computer. The computer uses this address when communicating with the input or output.

Computer: A very large number of on-off switches arranged in a manner to sequentially perform logical and numerical functions.

Default Mode: The pre-described position of some memory locations during start-up and standby operations.

EAPROM: An Electrically Alterable, Programmable, Read-Only Memory. Individual memory locations may be altered without erasing the remaining memory.

EEPROM: An Electrically Erasable Programmable, Read-Only Memory. The entire memory is erased with one (1) electrical signal.

EPROM: An Erasable, Programmable, Read-Only Memory. The entire memory is erased by exposure to ultra-violet light.

Fail Safe: Design considerations that cause the instrument or system to move to the safe position upon failure of electricity, air, or other support systems.

Field Alterable: A device having a specific design or function that is readily changed by the user and/or the maintenance personnel.

Force Off: A programmable computer instruction that places any input or output in the "off" state, independently of any other program instructions.

Force On: A programmable computer instruction that places any input or output in the "on" state, independently of any other program instructions.

Input: Electrical signals applied to the computer and used by the computer to make logical decisions on whether or not to activate one or more outputs. Input consists of data from temperature and pressure instruments, liquid level controls, micro-switches, and operator-controlled panel switches.

Input/Output Terminals: An electrical panel that provides for the connection of all inputs and outputs to the computer. The input/output address labels are found on this panel. Indicator lights showing the status, on or off, of all inputs and outputs may be available on this panel.

Last State Switch: A manually operated switch or software setting that instructs the computer to place all outputs in the "on", "off", or "last state" position during a start-up. The "last state" position instructs the computer to place the outputs in whatever state, on or off, occurred during the last loss of power.

Operator Override Switch: A manually operated switch that permits the operator to place any input or output in the "on" or "off" position, independently of any program instructions.

Output: Electrical signals from the computer that turn on or off valves, motors, lights, horns, and other devices being controlled by the computer. Outputs may also consist of messages and data to the operator.

Programmable Controller: A computer, with only limited mathematical ability, that is used to control industrial machines, instruments and processes. Most computers used on HTST pasteurizers will be programmable controllers.

RAM: Random Access Memory is memory used by the computer to run programs; store data; read input and control outputs. The computer may either read data from the memory or write data into the memory.

ROM: Read-Only Memory is memory used by the computer to run its own internal unchangeable programs. The computer may only read from the memory. It cannot write into the memory or alter the memory in any way.

Standby Status: The computer is turned on, running, and waiting for instructions to start processing input data. A manually operated switch usually accomplishes this instruction.

Status Printing: Some computers are programmed to interrupt printing of the chart record and print the status of key set points and conditions such as: cold milk temperature, holding tube temperature, diversion temperature setting and chart speed.

CRITERIA

The following listed criteria shall be complied with for all computers or programmable controllers when applied to HTST, HHST and Aseptic pasteurization systems used for Grade 'A' milk and milk products. In addition, all systems shall conform to all other existing requirements of this Ordinance.

1. A computer or programmable controller used for the public health control of pasteurizers must be a system dedicated only to the public health control of that individual pasteurizer. The public health computer shall not have any other assignments involving the routine operation of the milk plant.
2. The public health computer and its outputs shall not be under the command or control of any other computer system. It shall not have an address to be addressable by any other computer system. A host computer cannot override its commands or place it on standby status. All addresses of the public health computer must be ready to process data at any time.
3. A separate public health computer must be used on each pasteurizing system.
4. The status of the inputs and outputs of the public health computer may be provided as inputs- only to other computer systems. The wiring connections must be provided with isolation protection such as relays, diodes, or optical-coupling devices to prevent the public health outputs from being driven by the other computer system. Digital outputs from another computer may be connected to an input of the public health computer in order to request the operation of a device controlled by the public health computer.
5. Upon loss of power to the computer, all public health controls must assume the fail-safe position. Most computers can be placed in standby status by either a program instruction or manual switches. When the computer is in standby status, all public health controls must assume the fail-safe position. Some computers have internal diagnostic checks that are performed automatically during start-up. During this time, the computer places all outputs in default mode. In this default mode, all public health controls must be in the fail-safe position.
6. Some computers or programmable controllers have Input/Output buses with "last state switches" that permit the operator to decide what state the output bus will take on power-up, after a shutdown, or loss of power. The choices are "on", "off", or "last state" occurring when the computer lost power. These "last state switches" must be placed in the fail-safe position.
7. The computer performs its tasks sequentially, and for most of real time the computer outputs are locked in the ON or OFF position, while waiting for the computer to come back through the cycle. Consequently, the computer program must be written so that the computer monitors all inputs and updates all outputs on a precise schedule, at least once every second. Most computers will be capable of performing this function many times in one (1) second.
8. Programs must be stored in some form of read-only memory and be available when the computer is turned on. Tapes or disks are not acceptable.
9. The computer program access must be sealed. Any telephone modem accesses must also be sealed. If the Input/Output terminals contain "last state switches", the Input/Output terminals must be sealed. The vendor must supply the Regulatory Agency with procedures and instructions to confirm that the program currently in use by the computer is the correct program. The Regulatory Agency will use this test procedure to confirm that the correct program is in use, during a start-up, and whenever the seal is broken.
10. If the computer contains FORCE-ON, FORCE-OFF functions, the computer must provide indicator lights showing the status of the FORCE-ON, FORCE-OFF function. The vendor's instructions must remind the Regulatory Agency that all FORCE-ON, FORCE-OFF functions must be cleared before the computer is sealed.
11. The Input/Output terminals of the public health computer shall contain no operator override switches.
12. Computerized systems that provide for printing the recording chart by the computer must ensure that proper calibration is maintained. During chart printing, the computer must not be diverted from its public health tasks for more than one (1) second. Upon returning to public health control tasks, the computer shall complete at least one (1) full cycle of its public health tasks before returning to chart printing.
13. When printing a chart, some systems provide status reports on the chart paper of selected Input/Output conditions. This is usually done by interrupting the printing of the chart and printing the Input/Output conditions. Such interrupts, for status printing, are permitted only when a continuous record is recorded on the chart. When an interrupt is started, the time of the start of the interrupt will be printed on the chart, at the beginning of the interrupt and at the end of the interrupt. The time interval during which the computer is diverted from its public health control tasks for status printing shall not exceed one (1) second. Upon returning to public health control tasks, the computer shall complete at least one (1) full cycle of its public health control tasks before returning to status printing.
14. When the computer prints the temperature trace of temperature in the holding tube, at specific intervals, rather than a continuously changing line, temperature readings shall be printed not less than once every five (5) seconds, except that during the thermometric lag test, the temperature shall be printed or indicated fast enough that the Regulatory Agency can place the temperature sensor in a bath at a temperature 4°C (7°F) above the diversion setting and accurately determine the point in time when the temperature rises to a point 7°C (12°F) below the diversion point setting so that the Regulatory Agency can start the timing of the thermometric lag test.
15. When the computer prints the event pen position, the position of the FDD, either forward or divert at specific intervals, rather than continuously, all changes of position shall be recognized by the computer and printed on the chart. In addition, the event pen position and temperature in the holding tube must be printed on the chart in a manner that the temperature in the holding tube can be determined at the moment of a change of position of the FDD.
16. The vendor shall provide a built-in program for test procedures or a protocol shall be provided so that all applicable public health tests, within Appendix I. of this Ordinance, can be performed by the Regulatory Agency for each instrument, i.e.:
    1. Recording Thermometers: Temperature accuracy; time accuracy; check against indicating thermometer and thermometric response.
    2. FDD: Valve seat leakage; operation of valve stem(s); device assembly; manual diversion; response time and time delay intervals if used.
    3. Booster Pumps: Proper wiring and proper pressure control settings.
    4. Flow-Promoting Devices Capable of Generating Flow Through the Holding Tube: Holding time in the holding tube and proper wiring interlocks.
17. Computers require high quality; clean, well-regulated power supplies to operate reliably and safely. Spurious voltage spikes can cause unwanted changes in computer RAM. Some mechanical and electrical components also deteriorate with age. One (1) solution is to have two (2) permanent programs in the computer; one (1) in RAM and one (1) in ROM. Through a self-diagnostic test, these two (2) programs could be compared routinely. If there were differences in the programs, the computer would go into default mode. Another solution would be to download the program from ROM to RAM at every start-up. A third solution would be to have the computer read the program directly from unchangeable ROM. However, this approach is practical only in large volume applications such as microwave ovens. For most small volume applications, the ROM's are field alterable, such as EPROMS, EEPROMS and EAPROMS. EPROMS, EEPROMS, and EAPROMS cannot be relied upon to maintain a permanent record. Something is needed to ensure that the proper program is in computer memory when the Regulatory Agency seals the computer.
18. Computer programs used for Public Health Controls on pasteurizers must conform to the attached logic diagrams. Minor modifications to these diagrams are permissible to accommodate or delete items that are unique to a specific pasteurization system. For example, on magnetic flow meter based timing systems, the flush cycle on the detect stem of the FDD and the ten (10) minute delay for the booster pump and the FDD will permit the timing pump to run during CIP operations. The vendor must provide a protocol in the user's manual so that the installer, user, and/or Regulatory Agency can demonstrate that the program performs as designed under actual production conditions.
19. The logic diagrams for the FDD and the booster pump show a programmed mechanical cleaning cycle operation as part of the computerized system. Some milk plant operators may wish to use another computer for mechanical cleaning operations, so that milk plant personnel, may change mechanical cleaning programs. When using this method, the connections between the FDD, booster pump, and milk plant computer, must be provided with solenoid relays or similar devices for the FDD and booster pump outputs. This prevents them from being operated by the milk plant computer, except when the mode switch of the FDD is in the "CIP" position.

DIAGRAM LEGEND

t = Time
T = Temperature
MS = Microswitch
FDV = Flow Divert Valve
FDD = Flow-Diversion Device

Figure 39. Logic Diagram: Flow-Diversion Device, Divert Valve Stem

 

Figure 40. Logic Diagram: Flow-Diversion Device, Leak Detect Valve Stem

 

Figure 41. Logic Diagram: Safety Thermal Limit Recorder-Controller

 

 

Figure 42. Logic Diagram: Timing Pump

 

Figure 43. Logic Diagram: Booster Pump

 

VI. CRITERIA FOR STEAM-BLOCK TYPE FDD SYSTEMS

1. Steam-Block Type FDD Systems shall have two (2) steam-block zones between the pasteurizer and the surge tank(s)/filler(s). There shall be a continuous visible bleed of steam or condensate to the drain from each steam-block zone.
2. The steam-block zones shall be temperature monitored and shall alarm when temperature falls below 121°C (250°F).
3. The Primary Divert Valve and other critical valves shall be position detectable and fail-safe and be alarmed to provide protection when needed.
4. The Steam-Block Type FDD System shall not move to the forward-flow position until all conditions required of the HHST pasteurizing system are met and shall divert under the same conditions as a standard FDD.
5. When the Steam-Block Type FDD System is in a divert condition, a loss of temperature alarm in a steam-block zone shall cause a full port opening to drain in that steam-block zone.
6. Computer controls shall meet the requirements of this Appendix.
   

STEAM-BLOCK STYLE FDD SYSTEM - FUNCTIONAL DIAGRAM

FROM PASTEURIZER	PRIMARY DIVERT VALVE	TO PASTEURIZER
	STEAM BLOCK ZONE A
	STEAM BLOCK ZONE B
	SURGE TANK(S)/FILLER(S)

 

VII. MILK AND MILK PRODUCTS HACCP CCP MODELS FOR PASTEURIZATION EQUIPMENT

Milk plants regulated under the NCIMS HACCP Program, shall manage pasteurization under the HACCP Plan as a CCP. Following are examples of acceptable models (HACCP Plan Summary Tables) that may be used. Other HACCP Plan Summary Tables that appropriately manage pasteurization as a CCP may also be used.

MILK AND MILK PRODUCT CONTINUOUS - FLOW (HTST AND HHST) PASTEURIZATION - CCP MODEL HACCP PLAN SUMMARY

(Refer to the Example below)

The essential elements of HTST and HHST pasteurization are:

1. Time;
2. Temperature; and
3. Pressure.

Each of these elements shall be addressed under the HACCP Plan:

1. In continuous-flow pasteurizers with sealed timing pumps, the minimum holding time at pasteurization temperature shall be addressed in the HACCP Plan as a CCP verification. Continuous-flow pasteurizers with magnetic flow meter based timing systems, timed at minimum pasteurization temperature, shall be addressed as a CL.
2. Temperature shall always be addressed in the HACCP Plan as a CL.
3. Pressures in the regenerator of continuous-flow pasteurizers, and in the case of HHST pasteurizers as required in the holding tubes, across steam injectors, and within infusion chambers shall be addressed in the HACCP Plan and managed as CCP verification(s).

MILK AND MILK PRODUCT VAT (BATCH) PASTEURIZATION - CCP MODEL HACCP PLAN SUMMARY

(Refer to the Example below)

The essential elements of vat (batch) pasteurization are:

1. Time; and
2. Temperature.

Both of these elements shall be addressed under the HACCP Plan as a CL.

 

---

MILK AND MILK PRODUCT CONTINUOUS-FLOW (HTST AND HHST) PASTEURIZATION - CCP MODEL HACCP PLAN SUMMARY

Critical Control Point (CCP)	Hazard(s)	Critical Limits	Monitoring				Corrective Action(s)*	CCP Verification	Records
			What	How	Frequency	Who
Milk and Milk Products Pasteurization (HTST and HHST)	Biological-Vegetative Pathogens (non-spore formers)	Every particle of milk or milk product is heated, in a properly designed, calibrated and operated pasteurizer to one of the temperature and time combinations specified in the current Grade "A" PMO Note: Assuring that the minimum holding times are met in systems which use a sealed timing pump would be as CCP verification during required equipment calibration	Temperature at the exit of the holding tube	Temp. Recorder Chart	Continuous during Operation	Pasteurizer Operator	Manually divert flow of product Isolate the affected product Evaluate and determine disposition of the product (reprocess or disposal)  Document action	Record Review: Pasteurizer charts verified Equipment Function Checks: Operator performs required daily tests and record on the temperature charts Authorized plant person (supervised by regulatory when required) conducts checks listed in the Milk Plant Equipment Test Report (FDA Form 2359b) Seals: Verify required regulatory seals daily	Pasteurizer Charts    Corrective Action Records   CCP Verification - Records, including equipment testing records
			Residence time in the holding tube in continuous-flow pasteurizers with magnetic flow meter based timing systems	Flow Recorder Chart	Continuous during Operation	Pasteurizer Operator

* A properly operating HTST or HHST pasteurization system will divert raw product to the constant-level tank when predetermined set points are not met.

Product Description: _______________________________      Method of Storage and Distribution:  _________________________

Intended Use and Consumer: ____________________________

Signature: ______________________________________Date: __________________

---

 

MILK AND MILK PRODUCT VAT (BATCH) PASTEURIZATION - CCP MODEL HACCP PLAN SUMMARY

Critical Control Point (CCP)	Hazard(s)	Critical Limits	Monitoring				Corrective Action(s)	CCP Verification	Records
			What	How	Frequency	Who
Milk and Milk Products Pasteurization (Vat)	Biological-Vegetative Pathogens (non-spore formers)	Every particle of milk or milk product is heated, in a properly designed, calibrated and operated pasteurizer to one of the temperature and time combinations specified in the current Grade "A" PMO.	Time and temperatures (in a vat that is continuously agitated to assure that there is no more than 1°F (0.5°C) difference between the warmest and the coldest product in the vat during processing) including minimum required time, product temperature and air space temperatures	Temp. Recorder Chart	Continuous during Operation	Pasteurizer Operator	During Pasteurization: Continue pasteurization until the time/ temperature criteria have been met. If the time/ temperature criteria cannot be met in two hours, an evaluation needs to be made as to the disposition of the product. After Pasteurization (i.e., during the record review): If the product is found not to have met the critical time/temperature, place all affected finished product on hold, and evaluate to determine product distribution, i.e., reprocess or destroy	Record Review: Pasteurizer charts verified Equipment Function Checks: Operator performs required observation of indicating and airspace thermometers for each batch (air space checked at both the beginning and the end of the holding time) and recorded on the chart Authorized plant person (supervised by regulatory when required) conducts checks listed in the Milk Plant Equipment Test Report (FDA Form 2359b) Seals: Verify required regulatory seals daily if applicable	Pasteurizer Charts   Corrective Action Records   CCP Verification Records, including equipment testing records

Product Description: _______________________________      Method of Storage and Distribution:  _________________________

Intended Use and Consumer: ____________________________

Signature: ______________________________________Date: __________________

 

---

⁽¹⁾ The method of making these tests will be found in the following reference: Method of Testing Air Cleaning Devices, ASHRAE Standard 52. Available from The American Society of Heating, Refrigerating and Air-Conditioning Engineers.

⁽²⁾ Dill, R.S., A Test Method for Air Filters. Transactions of the American Society of Heating and Ventilation Engineers. 44:379, 1938.

⁽³⁾ DOP-Smoke Penetration and Air Resistance of Filters. Military Standard No. 282. Section 102.9.l. Naval supply Depot. 5801 Tabor Avenue, Philadelphia, Pennsylvania 19120.