A cannery in Chile is launching a chunky bean and pumpkin stew in the same 400 g can and retort it already uses for a thin vegetable broth. The production manager wants to reuse the broth’s process time, because the can is the same. The quality manager refuses. The broth heats by convection; the thick stew heats by conduction, so its slowest-heating point will lag far behind. Before the first pallet ships, someone must prove with data that every can receives enough heat to destroy Clostridium botulinum spores. That proof is thermal process validation.
In short
- Thermal process validation is documented evidence that a scheduled process, run within its critical limits, delivers the target lethality at the cold spot of the slowest-heating container.
- Fβ is the equivalent number of minutes at 121.1 Β°C with z = 10 Β°C. A 12D botulinum cook is 12 Γ 0.21 = 2.52 min, so a minimum Fβ of about 3 min is applied; commercial processes usually go higher to control spoilage spores.
- Temperature distribution studies find the slowest-heating zone of the loaded retort. Heat penetration studies measure how the product’s cold spot heats under worst-case critical factors.
- The General Method converts cold-spot readings to lethal rates, L = 10^((T β 121.1)/10), and integrates them over time with the trapezoid or Simpson’s rule.
- After a deviation, hold the product, keep every record and let a competent process authority evaluate it.
What is thermal process validation?
Thermal process validation is the set of studies and calculations showing that a heat process, operated within defined limits, consistently delivers enough lethality, meaning microbial kill, to make a food safe and commercially sterile. Commercial sterility means the absence of microorganisms able to grow in the food under normal non-refrigerated storage.
The Codex Guidelines for the Validation of Food Safety Control Measures (CXG 69-2008) separate three ideas: validation proves, before production, that a control measure can work; monitoring checks, batch by batch, that it is applied; verification confirms periodically that the system works. A retort chart is monitoring; a heat penetration study is validation.
Low-acid foods, with a pH above 4.6 and a water activity above 0.85, can support toxin production by C. botulinum if spores survive in a sealed container. Their validated heat treatment is the scheduled process, which the Codex Code of Hygienic Practice for Low and Acidified Low Acid Canned Foods (CXC 23-1979) expects competent people with expert knowledge and suitable facilities to establish, a role usually called the process authority. Some regulators also require scheduled processes to be filed, so check your national legislation.
What Fβ value does a low-acid canned food need?
The safety minimum is a 12D botulinum cook, Fβ = 12 Γ 0.21 = 2.52 min, applied in practice as a minimum Fβ of about 3 min. The D value is the time at a stated temperature needed to kill 90 % of a population, one log cycle. The z value is the temperature change that alters D tenfold. For proteolytic C. botulinum spores, Dβββ.β β 0.21 min and z = 10 Β°C. Fβ expresses a process as equivalent minutes at 121.1 Β°C, and each minute at product temperature T counts as a fraction of a minute, the lethal rate:
L = 10^((T β 121.1)/10)
| Product temperature (Β°C) | Lethal rate L | Minutes needed for Fβ = 3 min |
|---|---|---|
| 110.0 | 0.078 | about 39 |
| 115.0 | 0.245 | about 12.2 |
| 118.0 | 0.490 | about 6.1 |
| 121.1 | 1.000 | 3.0 |
A 12D process would reduce 10ΒΉΒ² spores to one survivor, so if every can held one spore, one can in 10ΒΉΒ² might contain a survivor. Commercial processes commonly reach Fβ values of about 5 to 15 min, because mesophilic spoilage spore-formers such as Clostridium sporogenes are more heat resistant than C. botulinum. Products sold into hot climates may need far more to control thermophiles such as Geobacillus stearothermophilus, which are not a safety hazard but spoil cans stored above about 40 Β°C.
How do temperature distribution and heat penetration studies differ?
A temperature distribution study qualifies the retort: it maps the heating medium throughout a fully loaded vessel to find the slowest-heating zone. A heat penetration study characterises the product: it measures how the cold spot inside test containers heats and cools when they sit in that slowest zone.
| Aspect | Temperature distribution study | Heat penetration study |
|---|---|---|
| Sensor position | Heating medium: corners, basket centres, near inlets and drains | Inside containers, tip at the product cold spot |
| Main output | Vent and come-up schedule, slowest zone, load pattern, water flow | Heating and cooling curves, Fβ at worst-case conditions |
| Repeat when | Retort, piping, baskets or utilities change | Recipe, fill, container or process change |
The cold spot is the point in the product that receives the least heat. In conduction-heating products such as pΓ’tΓ©s and thick purΓ©es, heat moves inwards through product that cannot circulate, so the cold spot sits near the geometric centre. In convection-heating products such as brines, the liquid circulates and the cold spot usually lies on the vertical axis below the centre. Broken-heating products, such as starch-thickened sauces, switch mode partway through and must be studied experimentally.
A critical factor is any variable that, if it changes, can reduce lethality below the scheduled value. Heat penetration tests use the least favourable plausible value of each: lowest initial temperature, highest fill weight and solids, smallest headspace, highest viscosity or starch level, largest particles and, in agitating retorts, the slowest rotation. Use several instrumented containers and replicate runs, because heating varies from can to can, and calibrate every sensor against a reference thermometer before and after the study.
Air is the classic retort hazard. In a saturated steam retort, a pocket containing about 10 % air at the same total pressure sits at roughly 117.8 Β°C instead of 121.1 Β°C, a lethal rate of only about 0.47. That is why steam retorts are controlled on temperature, not pressure alone, and why venting schedules are validated.
How do you calculate Fβ with the General Method?
The General Method calculates Fβ by converting each measured cold-spot temperature to a lethal rate and integrating the lethal rates over time. It assumes nothing about the shape of the heating curve, so it works for any product and is the usual way to evaluate heat penetration data and deviations.
Fβ = β« 10^((T β 121.1)/10) dt
With readings at a constant interval Ξt, the integral is approximated numerically. Simpson’s rule needs an even number of intervals.
Trapezoid: Fβ β Ξt Γ (Lβ/2 + Lβ + Lβ + β¦ + Lβββ + Lβ/2)
Simpson: Fβ β (Ξt/3) Γ (Lβ + 4Lβ + 2Lβ + 4Lβ + β¦ + 4Lβββ + Lβ)
| Time (min) | Cold-spot temperature (Β°C) | Lethal rate L |
|---|---|---|
| 0 | 100.0 | 0.008 |
| 2 | 106.0 | 0.031 |
| 4 | 111.0 | 0.098 |
| 6 | 114.5 | 0.219 |
| 8 | 117.0 | 0.389 |
| 10 | 118.5 | 0.550 |
| 12 (cooling water on) | 119.0 | 0.617 |
| 14 | 119.2 | 0.646 |
| 16 | 116.0 | 0.309 |
| 18 | 109.0 | 0.062 |
| 20 | 101.0 | 0.010 |
Worked example
A thermocouple at the cold spot of a 400 g can of bean stew, in the slowest retort zone, is read every 2 min from the moment it passes 100 Β°C (table above). Cooling water goes on at 12 min, yet the cold spot keeps rising briefly, as is typical of conduction heating.
Trapezoid rule: the interior lethal rates (2 to 18 min) sum to 0.031 + 0.098 + 0.219 + 0.389 + 0.550 + 0.617 + 0.646 + 0.309 + 0.062 = 2.921. The end readings add (0.008 + 0.010)/2 = 0.009. Fβ β 2 min Γ 2.930 = 5.86 min.
Simpson’s rule: readings at 2, 6, 10, 14 and 18 min (weight 4) sum to 1.508; readings at 4, 8, 12 and 16 min (weight 2) sum to 1.413. Fβ β (2/3) Γ (0.008 + 4 Γ 1.508 + 2 Γ 1.413 + 0.010) = (2/3) Γ 8.876 = 5.92 min.
The rules agree within about 1 %. About 2.7 min, nearly half the total, accrues after the cooling water goes on. This can clears the 3 min botulinum minimum comfortably; whether the process meets the company’s spoilage target depends on the slowest of all the test containers.
Ball’s formula method instead fits the heating curve with two parameters, so process times can be recalculated for a new initial or retort temperature without new trials, provided the curve is regular. The Food Technology for Industry Professionals course works through both approaches with heat penetration data.
How is the scheduled process set and kept under control?
The scheduled process is set from the slowest-heating container in the heat penetration data, at worst-case critical factors, with a safety margin. A process that delivers Fβ = 6 min in an average can but 4 min in the slowest one is a 4 min process. In production, the plant monitors and records what the study assumed:
- retort temperature on a calibrated reference temperature indicator, checked against the recorder;
- process time, counted from the end of the validated vent and come-up;
- initial temperature, fill weight, headspace and every other critical factor;
- closure integrity, with seams or seals inspected visually and by teardown at set frequencies;
- cooling water treatment, because containers can draw in water through a faulty seam as they cool.
Incubating samples, for example at 30 to 37 Β°C and at 55 Β°C, is useful verification, but a small sample cannot prove the absence of rare survivors; release depends on records showing the scheduled process reached every batch. Revalidate whenever heat transfer could change. The Chilean stew needs its own heat penetration study.
How should a thermal process deviation be handled?
A process deviation is any failure to deliver the scheduled process or keep a critical factor within limits, such as a retort temperature drop, a short hold or an overweight fill. The affected product stays on hold until a competent process authority has evaluated it and documented a decision.
- Identify and segregate all affected product, bracketing the time window with a margin.
- Keep charts, logger files, times, temperatures and a note of actions taken.
- Apply a corrective schedule only if one was validated in advance for that deviation. Never improvise.
- The process authority recalculates lethality at the cold spot, usually with the General Method, allowing for the lag between retort and product temperature.
- Decide disposition (release, validated reprocessing, diversion or destruction) and record the reasoning.
- Find and fix the root cause, such as a boiler trip or sticking valve, and verify the fix.
Never average a deviation away: if the record shows a period below the scheduled temperature, some product received less than the scheduled process. Spoilage investigations follow the same logic. Mixed flora, including non-spore-formers, points to leakage through seams after processing; heat-resistant spore-formers alone point to under-processing or thermophiles. Deviation evaluation for aseptic and particulate processes is covered in more depth in Advanced Food Technology.
Frequently asked questions
What is the difference between validation and verification of a thermal process?
Validation is the evidence, gathered before routine production, that the scheduled process can deliver the target lethality, from temperature distribution and heat penetration studies. Verification is the ongoing confirmation that the validated process is delivered and still works: record review, instrument calibration, seam checks and incubation of samples. Monitoring records critical factors such as retort temperature and time for every batch. All three are needed.
Why is Fβ calculated at 121.1 Β°C?
121.1 Β°C equals 250 Β°F, the reference temperature used in early canning research and kept by convention. The heat resistance of proteolytic Clostridium botulinum spores is expressed against it, with D of about 0.21 min and z = 10 Β°C. Expressing every process at one reference temperature lets you compare different retorts and sterilisers on one scale.
Can wireless data loggers replace thermocouples in heat penetration tests?
Often, yes. Wireless loggers record cold-spot temperatures inside sealed containers without wires through the retort wall. In small containers their size can disturb heat transfer, and the sensor tip must sit at the true cold spot. Check calibration against a reference thermometer before and after each run, and confirm the software uses 121.1 Β°C and z = 10 Β°C.
Who can act as a process authority?
A process authority is a person or organisation with expert knowledge of thermal processing and access to suitable facilities to establish scheduled processes and evaluate deviations, whether in-house or external. Codex hygiene codes for low-acid canned and aseptically processed foods call for this competence, and some regulators formally recognise process authorities.
What should operators do the moment a retort temperature drops?
Record the time and temperature, alert the supervisor and identify the batch. If a validated deviation schedule exists for that situation, such as a defined hold extension once temperature recovers, apply it exactly. If not, complete the cycle without improvising, hold the product and send all charts and logger files to the process authority. Nothing is released before a documented evaluation.
Next step. The Food Technology for Industry Professionals course teaches D, z and Fβ calculations, temperature distribution and heat penetration studies, the General Method and a night-shift retort deviation you recalculate yourself. It finishes with a proctored final assessment and an ASC certificate, and you can see all eleven food science and technology courses.
Sources. Codex Alimentarius Commission, Code of Hygienic Practice for Low and Acidified Low Acid Canned Foods (CXC 23-1979) and Guidelines for the Validation of Food Safety Control Measures (CXG 69-2008), available from the Codex Alimentarius website. R. Paul Singh, Dennis R. Heldman and Ferruh Erdogdu, Introduction to Food Engineering, 6th edn (Academic Press, 2024). P. J. Fellows, Food Processing Technology: Principles and Practice, 5th edn (Woodhead Publishing, 2022). S. D. Holdsworth and R. Simpson, Thermal Processing of Packaged Foods, 3rd edn (Springer, 2016).
This article is general guidance and is not a substitute for the applicable Codex texts, national legislation or the advice of a qualified process authority.