Turning soft CIP requirements into verifiable ones on a dairy pasteurizer

Each weak statement contains a measurable intent; extract it and attach a verification method.

Replacement statements

1. "Final rinse conductivity shall remain at or below 30 microsiemens/cm, measured at the rinse-line conductivity sensor, for the entire rinse duration." Verifiable by test: challenge with a spiked rinse and record the conductivity trend.
2. "If conductivity exceeds 30 microsiemens/cm at any point during final rinse, the sequence shall transition to a defined excursion state, extend rinse by a configured time, and generate an electronic deviation record containing timestamp, peak value and batch ID." Verifiable by fault injection at FAT.
3. "Rinse shall terminate on a measured condition, not on elapsed time alone, with a configurable maximum duration and an alarm if the maximum is reached." Note the skid currently lacks the flow meter this would ideally use; either add one or state explicitly that conductivity is the sole terminating variable and record that as a design limitation.
4. "The skid shall be isolatable within 15 minutes without breaking the raw-milk changeover." Verifiable by timed demonstration at SAT.

Conflict. Operations' 30% water recovery requires diverting final rinse to the balance tank; QA's position that final rinse goes to drain is based on the assumption that recovered water carries cleaning-chemical residue. The two cannot both hold for the same stream unless a segregation and monitoring design is added, which does not exist today.

Do not let this be settled by whoever is loudest in the review. Resolve it as a design decision with an owner.

Resolution. Segregate the stream: recover only the portion of final rinse that has passed the conductivity criterion and is confirmed by a diverter valve with positive feedback, and send the first portion of every final rinse to drain. That satisfies QA's underlying concern (no unverified water enters the balance tank) while allowing most of the volume to be recovered. Because the skid has no rinse flow meter, add one at detailed design - the recovery volume claim cannot be verified or reported without it, and the payback for the sustainability target is unprovable otherwise. If the capital is refused, the honest position is to drop the 30% target from the project scope rather than install an unverifiable diverter.

Ownership. Name a single owner for the recovery decision (typically QA, with Operations as consulted). Record it in the requirements traceability matrix.

Verification methods.

• Conductivity limit: FAT fault injection plus SAT with the real rinse cycle, three consecutive cycles.
• Excursion handling and deviation record: FAT test of the transition, with the record inspected for content.
• Termination on measured condition: SAT with a deliberately slow rinse to confirm maximum-duration alarm.
• 15-minute isolation: timed SAT demonstration, witnessed by Maintenance.
• Recovery segregation: challenge the diverter - force a conductivity failure and confirm the valve routes to drain.

Every requirement in the revised specification should carry an ID, a verification method, and a link to the FAT or SAT script that proves it. Any requirement without a script is not a requirement; it is a wish.

Treat it as a change to an approved requirement, not a conversation.

Technical position. 'Always worked' is not evidence unless the historical conductivity records exist. Ask for them. If the plant has six months of rinse records showing the value stays well below 30 microsiemens/cm, the fixed-time approach may be defensible as a validated parameter - but it must then be a validated parameter with a documented basis, and the excursion logic still has to exist because the current recipe has no response to an out-of-limit reading. Fixed time and no excursion handling are two separate defects; QA is only conceding one.

Process. Raise a formal change request against the requirement, with impact on the FAT script, the water-recovery business case, and the validation documentation. If QA insists, get it approved through the site's management-of-change route with QA's signature, not an email.

What to record. In the traceability matrix, mark the requirement as 'changed' with the change request number, the technical justification (or the absence of one), and the residual risk: a fixed-time rinse will not detect a cleaning-chemical carryover caused by a dosing fault. Note that the excursion-handling requirement is retained independently.

What not to do. Do not quietly configure the recipe to the old behaviour to keep the schedule. A CAP's signature on a design document asserts the design meets the stated requirement; if the requirement has changed, the record must show it changed before the design followed.