Retort Temperature Excursion on a Low-Acid Canned Soup Run
A still retort at a vegetable-soup cannery runs 12-ounce (307×409) cans of a low-acid product (pH 6.3, aw 0.985) under a scheduled process of 121.1 °C for 32 minutes after a 6-minute come-up, established by heat-penetration studies with Fo ≥ 8 minutes at the cold spot. On the 14:00 run, a boiler feedwater fault tripped the burner; the retort chart shows temperature falling to 115.6 °C for 5.5 minutes before steam was restored and the operator resumed the count, completing 32 minutes at 121.1 °C. The retort operator did not stop the clock and did not notify the supervisor until the shift ended. Three hundred and eighty cases were palletized and are still in the warehouse; 40 cases from the same run had already shipped to a distributor two days earlier. The retort's mercury-in-glass thermometer and the chart recorder agree within 0.5 °C, and the vent and bleeders were verified open at start-up.
1. What is your disposition of the 380 warehouse cases and the 40 shipped cases, and what must happen before any release decision?
Read the worked answer
Treat the run as a scheduled-process deviation and presume the product is not commercially sterile until a process authority says otherwise.
Immediate actions
- Place the 380 cases on documented hold; do not sample-and-release them on the basis of end-of-run incubation, which cannot prove the cold spot reached lethality.
- Open a traceability check on the 40 shipped cases the same day. A hold/withdrawal notice costs little; a late recall costs enormously. Notify the distributor and the process authority in parallel.
- Verify can integrity (double seams, pressure effects) since the retort lost steam pressure.
Why release is not defensible as-is The excursion is not trivial. Using z = 10 °C, 5.5 minutes at 115.6 °C is equivalent to only about 1.6 minutes at 121.1 °C, so the run is roughly 4 minutes short in equivalent terms - and the cold spot lags the retort chart, so the true deficit is likely larger. The operator restarted the clock without cold-spot data, so the record does not demonstrate the scheduled process was delivered.
Realistic options
- Reprocess the entire lot to a validated process, with the process authority's approval.
- Divert to a product with a validated downstream lethality step.
- Destroy. Release without a written process-authority evaluation is not an option for a low-acid canned food.
2. The plant manager proposes adding 6 minutes at 121.1 °C to make up for the drop. Evaluate that proposal and state what the process authority would need to approve any corrective process.
Read the worked answer
The proposal confuses retort time with accumulated lethality.
The arithmetic Lethality is logarithmic in temperature: at 115.6 °C the lethal rate is 10^((115.6−121.1)/10) ≈ 0.28 of the rate at 121.1 °C. The 5.5 minutes lost is therefore worth only about 1.6 minutes at 121.1 °C - a deficit near 4 minutes, not 5.5. Adding 6 minutes would over-deliver in equivalent terms but still would not make the run equivalent to the validated process, because:
- The cold-spot temperature during and after the drop is unknown without penetration data; the retort chart is not the cold spot.
- The drop changes come-up, heating lag and cooling assumptions embedded in the original validation.
- Corrective processes must themselves be established and validated for that product, container and fill weight; they cannot be extrapolated from the scheduled process.
What the process authority needs
- The actual time–temperature chart and the operator's log.
- Heat-penetration data (fh, j, cold-spot location, fill weight, container dimensions).
- Product formulation, pH, aw, and the spore-load assumptions behind the original Fo.
- The retort's temperature-distribution study and the venting/bleeder verification.
- A proposed corrective process, validated, with the resulting scheduled process and any quality impact.
A 'make-up time' decision can only be made from cold-spot data, not from the retort chart.
3. What deviation records, corrective actions and verification should this event generate in the food safety management system?
Read the worked answer
Records
- A deviation record referencing the retort, batch codes, the chart trace, the thermometer readings and the process authority's evaluation letter.
- Product disposition records for all 420 cases (380 held, 40 withdrawn) with traceability to the distributor.
- Retention of retort records for the required period, with the deviation flagged so a future auditor can find it.
Corrective actions at the process level
- Interlock or alarm so that a temperature drop below the scheduled minimum stops the process clock and alarms; the operator should not be able to 'resume the count' by judgement alone.
- Boiler reliability: feedwater treatment, low-water cutoff testing, maintenance schedule and spare capacity or a controlled shutdown procedure.
- Operator training and competency assessment on deviations, with an explicit stop-and-escalate rule and shift handover checklist.
- Supervisor review of charts during the shift, not after it.
Verification
- Audit the new alarm/interlock by simulated failure (challenge it, don't just read the manual).
- Review 30 days of retort charts for any unlogged excursions.
- Confirm thermometer and recorder calibration status.
- Run a traceability/withdrawal exercise to show the 40-case response would work.
- Report the event through management review and trend deviation frequency.
The test of the CAPA is whether a second operator, on a second shift, would stop the process and escalate next time.