Metal Detector Bypass and a Wire Fragment Complaint
A bakery produces 250 g packs of a soft, high-moisture bread on a line with an in-line metal detector (aperture 300 × 150 mm) located after the slicer and bagger, before case packing. The detector's documented test pieces are 2.0 mm Fe, 2.5 mm non-ferrous and 3.0 mm stainless steel, and it is challenged at start-up, every 4 hours and at the end of the run. A customer complaint reports a 4 mm stainless-steel wire fragment, 18 mm long, in a sealed bag; a second fragment is reported in a different pack from the same lot. The investigation finds that the slicer's blade guard has a broken stainless wire from a missing retaining clip, and the maintenance log shows the guard was welded 3 weeks earlier without a post-repair inspection. The metal detector's reject confirmation log shows the last three rejects were not physically verified, and the detector had been bypassed for 45 minutes during a jam on the same day the affected lot was produced. Lot size was 8,000 packs; 6,200 are in the warehouse and 1,800 shipped to two customers.
1. Would the metal detector have detected the 4 mm stainless fragment? What does the answer tell you about where the control failed?
Read the worked answer
Detection capability A 4 mm stainless wire is above the 3.0 mm stainless test piece, so a functioning detector in its validated set-up should have produced a reject. Detection is not purely about size: a long, thin wire presents a small cross-section to the field and its signal depends heavily on orientation and on the product effect of soft, moist bread. So the correct verification is a challenge with the actual wire type and the actual product, in several orientations - not an assumption from the test-piece size.
Where the control failed The wire entered upstream of the detector at the slicer guard after the unverified weld repair. That makes the detector the only barrier, and it was not operating as a CCP:
- The 45-minute bypass during the jam is a direct window for an undetected fragment, and bypass should never be permitted without product diversion and a documented risk decision.
- Reject confirmation was not physically verified for the last three rejects, so the plant cannot demonstrate that any reject actually left the line; a stuck diverter or a full reject bin would silently pass product.
- The guard repair was a maintenance activity without foreign-material control, and the missing retaining clip suggests the wire may have been loose for up to 3 weeks, not just on one day.
Conclusion The primary failure is procedural and maintenance-related, with detector performance secondary. The investigation should not stop at 'the detector should have caught it' - it should ask why the bypass, the unverified rejects and the uncontrolled repair were all possible.
2. Define the scope of the hold/withdrawal and the decision criteria for release, recall or destruction.
Read the worked answer
Scope
- Start with the 8,000 packs of the affected lot: hold the 6,200 warehouse packs and initiate withdrawal of the 1,800 shipped packs from both customers. The second complaint confirms the problem is not a single pack.
- Expand backward to the 3-week period since the guard was welded, because the missing clip means the wire may have been deteriorating throughout. Review production, maintenance and detector logs for that period, including every bypass and every unverified reject.
- Include any lot produced during the 45-minute bypass on the affected day, and any lot where reject confirmation was not performed.
Decision criteria
- If fragments are found in retained samples or in warehouse product → recall the implicated lots.
- If product has already reached consumers and the failure window is credible → recall rather than withdrawal, in consultation with the competent authority and customers.
- If no fragments are found, that is not proof of absence: absence of evidence in a small sample does not clear a lot. Consider 100% inspection (X-ray or vision) of retained warehouse stock, or destruction if inspection cannot be validated for this fragment type.
- Release of any held stock requires a documented risk assessment, a validated inspection step and sign-off at a senior level; it should not be a commercial decision.
Communication Notify both customers and the authority per the recall plan, keep the complaint samples and photographs, and record the traceability exercise.
3. What corrective and preventive actions close this event, and how do you verify that the metal-detection CCP is back in control?
Read the worked answer
Maintenance and foreign-material controls
- Repair the guard with a retained, captive clip design so the wire cannot detach; inspect and document every post-repair check.
- A maintenance permit for work on or near product-contact zones: inventory of tools, wire, clips and fasteners before and after the job; post-weld inspection and cleaning; sign-off by a second person.
- Add the slicer guard to the preventive maintenance schedule with a defined inspection interval.
Metal detector controls
- Automatic reject with a confirmation sensor (bin full, diverter stroke) and a locked reject bin; no manual acknowledgement.
- Any bypass alarms, requires supervisor authorization with a documented risk assessment, and diverts product produced during the bypass to re-inspection or hold.
- Test-piece challenge at start-up, every 4 hours and at the end of the run, with the result recorded and reviewed by a second person.
- Challenge the detector with the actual 4 mm stainless wire, in several orientations, in the real product - this is the validation that the CCP can detect the hazard it is credited with.
Verification
- Review 30 days of reject and bypass logs for anomalies.
- Audit the new reject-confirmation function by simulating a reject and confirming the pack leaves the line.
- Trend complaint and reject data, train operators and maintenance staff, and record the event in management review.
- Consider X-ray as an additional control if the wire-type foreign material is a recurring risk.