A Nine-Minute Dip on the Egg Pasteurizer

The critical limit was not met. The temperature fell to 58.6°C against a limit of 60.0°C, for roughly nine minutes. Both limits are absolute: the product in the holding tube during that window did not receive the scheduled process, and liquid whole egg is a high-risk material for Salmonella with no downstream lethality.

Affected product window, built conservatively:

• Correct the clock first. The chart is 9 minutes slow, so the excursion on the plant clock is 02:19 to 02:28, not 02:10 to 02:19.
• Do not bound the start at the visible dip. Recorder response lag and the time for under-temperature product to travel from the holding tube to the filler mean product before and after the visible dip is suspect. Get the transit time from the hold tube to the filler, and add it at both ends. If the transit time is, say, 3 minutes, the window becomes roughly 02:16 to 02:31 on the plant clock.
• Then bracket back to the last confirmed pass. With hourly monitoring, the last documented satisfactory check may be 02:00. Conservative practice is to hold everything from that last confirmed pass through the confirmed recovery plus transit time, unless the chart is reliable enough to show the temperature was stable in between. Given a three-year-old response-time challenge, the chart's reliability is exactly what is in question, so bracket generously.

The judgment: the affected window is an argument, not a reading. Justify the extra margin with the two documented uncertainties (clock offset, response lag) and with the monitoring interval. Do not assume the failure started at the moment the pen moved.

Both are design failures, and together they mean the CCP was not actually under control.

Alarm at 57.0°C against a limit of 60.0°C. The alarm can only announce a condition that is already a violation. Its purpose should be to give the operator time to act before the limit is breached, which means it must sit at or just above the critical limit, for example 60.5°C, so that a deviation is prevented rather than reported. As configured, it is an indicator of failure, not a control.

Manual override on the diversion valve. Flow diversion is the control measure. An automatic, interlocked valve that removes out-of-limit product from the flow is the whole reason the CCP works. Holding it in manual override because the actuator is sticky disables the control, which is a change to the HACCP plan made without assessment. Any override must be treated as a planned deviation: risk assessment, alternative control (typically stopping the line), time limit, authorization, and record. A week of override is not a deviation, it is the new process.

What must change. Repair or replace the actuator; remove the ability to run in override without a documented, authorized deviation; reset the alarm setpoint with justification; add a challenge or verification of the alarm and diversion together at a defined frequency; and require the operator to respond to a falling pen by stopping or diverting, not by watching. Also schedule the response-time verification annually or at whatever interval the plan states, and update it now.

Disposition. Hold all product in the bracketed window, plus any product in the plant from the last confirmed pass. Options, in order of preference:

1. Repasteurize the liquid product if it is still in the plant and rework is validated for this product (including the effect of a second heat treatment on function and on the validated schedule). This is the cleanest route.
2. Divert to a restricted outlet only if a downstream validated lethality step exists in the customer's process and that has been agreed in writing.
3. Destroy if neither applies.

Do not release on end-product testing alone; the sampling cannot demonstrate that every unit received the scheduled process. If any product from the window has shipped, start a trace and consider withdrawal or recall, with the food safety authority notified as required.

Corrective action record should contain: the lot and volume affected with the time window and its justification; the disposition decision and rationale; the root causes (sticky actuator, manual override, alarm setpoint, unverified recorder response, monitoring interval); the immediate actions (repair, restore automatic diversion, reset alarm, re-verify recorder response by challenge); product not released until the diversion valve and alarm are proven to work together; verification that the actions were effective; reassessment of the hazard analysis and the plan; and the review signature. Also correct the clock or document the offset on the chart so future records are not ambiguous.