A Detector That Failed Three Checks and Kept Running

The last trustworthy verification of the critical limit is the 06:00 check, and even that is undermined by the learn-mode window.

Boundaries:

• Start: 06:00. Not 07:00. A failed check at 07:00 tells you the detector was not performing at 07:00; it does not tell you it was performing at 06:30. The last evidence of function is the 06:00 pass, so the exposure begins there.
• Include the learn-mode interval, 06:30 to 06:50. During learn mode rejects are suppressed, so even a correctly functioning detector would not have removed contaminated product. That window is as exposed as the failed-check period.
• End: when the fault was repaired and the detector re-verified, not 09:40 when the wire was found. Require a full verification after the cable repair: all three test materials, multiple passes, and passes at the centre and near the edges of the aperture. End the window at the completion of that verification.

Volume: roughly 8,000 per hour over about 3.7 to 4 hours, so 29,000 to 32,000 packets, all of which is in the plant or in the warehouse.

Disposition: metal is a physical hazard that can still be detected after packing, so the preferred action is to re-run 100% of the held packets through a verified detector, at a sensitivity equal to or better than the critical limit, with reject confirmation. That is a genuine control, not a sample. If re-running is impractical for some portion, hold it for investigation and consider destruction. Any product already shipped from the window must be traced and a withdrawal considered; the screen wire finding makes this a real event, not a hypothetical.

The re-test practice is the core error. A failed challenge means the critical limit may not have been met for all product since the last successful check. Re-running the test piece tells you about the detector at that instant and nothing about the hour of production behind it. Passing on the second attempt is also weak evidence: an intermittent fault, a loose cable, or a marginal test piece will produce exactly that pattern. Continuing production converts a detected control failure into an undetected one.

The monitoring design has three weaknesses.

1. Hourly checks at 8,000 packets per hour leave a 8,000-packet blind spot by design; that is acceptable only if the response to a failure is to treat the whole interval as affected, which the plan did not require.
2. "Product learn" mode on a live line is inappropriate. Reject suppression during changeover means the CCP is off while product is moving. Changeover should be done with the line stopped, or with product physically segregated and diverted, and learn mode should be time-limited and recorded.
3. There is no requirement to verify reject mechanism function, only detection. A detector that signals but whose reject arm is stuck still fails.

What the plan should require: on a failed check, stop the line or divert product immediately; hold all product back to the last successful check; correct the fault; re-verify with the full test set at multiple positions and confirm the reject device physically removed each piece; record all of it; release only after verification. Also require a more frequent check after changeover and after any maintenance on the detector.

Corrective action record, in sequence: the nonconformity (three failed checks, the learn-mode window, the loose cable, the wire found at 09:40); the containment decision and the product window with its justification; the disposition for each lot including re-run results and reject counts; root cause (cable, plus the decision to continue after a failed check, plus the learn-mode practice); the repair; the post-repair verification with test-piece results at defined positions; verification of effectiveness, such as a period of increased check frequency and a review of reject records; and reassessment of the plan to add the failure-response requirement and the learn-mode restriction.

Warehouse product: freeze it from release, re-run through the verified detector, and release on the re-run record. Where re-run is impossible, hold for investigation; do not release on the basis that most of the window had a detector that was only marginally degraded. The failure mode was an intermittent loose cable, and intermittency cannot be bounded by argument.

Shipped product: trace forward using the packing records for the window. Because a wire was actually found, treat this as a potential consumer hazard. Decide on withdrawal or recall using the quantity shipped, the distribution channel, and whether the wire is traceable to the same screen. Notify the relevant authority as required, and record the decision and its rationale either way. The verification piece that matters most here: a review showing that hold, re-run, and release decisions were all made and signed before product left the site.