Faults and Troubleshooting

What a fault is. A fault is a departure from the expected product, process or control condition. It may be sensory, structural, chemical, microbiological, packaging-related or documentary. A pale surface, soft centre, swollen pack or unexpected weight-loss curve is an observation, not yet a diagnosis. The investigation must state what was expected, what was found, how it was measured, where it occurred and which product may share the condition. Some faults are primarily commercial or aesthetic; others signal loss of a food-safety control. The same symptom can therefore have different significance in different products.

The first decision is control, not explanation. When the safety significance is uncertain, identify and hold the potentially affected product before trying to improve appearance or restart production. Define the earliest and latest credible boundaries using lot identity, time, equipment, chamber position, raw-material batch, formulation, packaging run and distribution status. Preserve samples, photographs, monitoring data and equipment condition. Cleaning, reheating, reworking or discarding everything immediately may destroy evidence and can make the true scope impossible to establish. Containment is provisional: it protects the decision while evidence is collected; it does not itself prove that the held product is unsafe or safe.

Separate symptom, mechanism and cause

The symptom is what is observed. The mechanism is the physical, chemical or biological route that can produce it. The cause is the specific condition that allowed that mechanism in this event. Case hardening, for example, describes a moisture-distribution defect; possible mechanisms include excessive surface evaporation or restricted internal transfer; actual causes may include chamber conditions, airflow, product geometry, loading, formulation or earlier surface treatment. Naming a familiar mechanism does not establish the cause. Each proposed cause must be tested against batch history, measurements, spatial pattern, timing and comparison product.

Classify the event before choosing the remedy

Classify whether the event concerns food safety, legal or specification compliance, process capability, shelf life, quality, authenticity, worker safety, or several of these together. This controls who must decide, what evidence is needed and whether the response can remain internal. A cosmetic trimming defect may permit controlled rework; loss of a validated lethality, stabilization, fermentation or drying control requires formal hazard evaluation and defensible disposition. A product can be microbiologically acceptable yet non-compliant with composition, identity or protected-product rules. Conversely, meeting a finished-product appearance standard does not prove that a missed safety control was recovered.

Build a fact pattern

Use a common investigation record: product and lot; formulation version; raw-material and ingredient lots; start and finish times; operator and equipment identity; actual process values; instrument status; sampling location; photographs with scale; package and storage history; and comparison with unaffected product. Record actual observations rather than replacing them with pass or fail. A single average can hide a gradient, a local cold spot or a small but important tail of underprocessed units. Preserve original data and record later corrections transparently. The record must distinguish measured fact, reported recollection, calculation, assumption and hypothesis.

Use the product map and process timeline

Map the defect by position and reconstruct when each relevant condition could have arisen. Compare centre and surface, top and bottom racks, inlet and return sides, first and last units, package heads, equipment lanes and storage locations. Then align these patterns with raw-material receipt, preparation, curing, fermentation, drying, smoking, cooking, cooling, packaging and distribution. Spatial and temporal clustering often discriminates between formulation-wide causes and local equipment or handling effects. The absence of a pattern is also evidence, but only if the sampling design could reasonably have detected one.

Generate and test competing explanations

List plausible causes across raw material, formulation, method, environment, equipment, measurement and human execution. Tools such as Five Whys, fishbone diagrams and fault trees help organise questions; they do not prove answers. Rank hypotheses by severity, plausibility and discriminating evidence. Test one mechanism at a time where practical, using retained records, instrument checks, product examination, laboratory analysis or a controlled trial. Seek evidence that could disprove the preferred explanation. If several variables changed together, the result may show recovery without revealing which change mattered.

Decide product disposition independently

Product disposition and root-cause correction are connected but separate decisions. Release, rework, diversion, relabelling, extended hold or destruction must be supported for the actual lot and legal route. A rework step must have defined limits, traceability and evidence that it controls the relevant hazard or defect without creating another. Blending defective product into a later batch can spread uncertainty and obscure identity. Destruction may be the correct product decision but still leaves the process cause unresolved. Conversely, repairing equipment prevents recurrence but does not automatically make product made before the repair acceptable.

Correct, prevent and verify

A correction deals with the immediate condition, such as stopping the line, restoring a setpoint or segregating product. Corrective action removes or controls the cause. Preventive action extends justified learning to comparable products, equipment or sites. Each action needs an owner, due date, controlled change, expected result and evidence of effectiveness. Verification should match the failure mechanism: repeated acceptable monitoring, targeted sampling, calibration confirmation, maintenance evidence, audit observation or trend reduction. One acceptable batch may show short-term recovery but rarely proves sustained control when the fault is intermittent.

Escalation and reassessment

Escalate when the event involves a safety-critical limit, distributed product, suspected pathogen or toxin, recurring unexplained failure, unreliable records, deliberate substitution, serious equipment damage or a change that may invalidate the supporting process. Reassess the hazard analysis or control plan when the event reveals an unrecognised hazard, an ineffective control or a material process change. Regulatory notification, customer communication, recall or specialist laboratory work depend on jurisdiction and event scope. The Codex article cannot replace those legal decisions; it establishes the questions and evidence that must be controlled.

Learning across the Codex

Symptom-specific D10 pages explain mechanisms and discriminating checks, but they operate within this common response system. Their proposed remedies are not automatic release instructions. Link each event to the relevant science, ingredient, equipment and process-control articles so the investigation uses the complete product system. Trend recurring faults using stable categories and retain rejected hypotheses where they may prevent repeated speculation. The objective is not to eliminate every natural variation. It is to recognise unacceptable variation early, protect product, understand controllable causes and demonstrate that the response worked.

Measurement limits and decision rules

A result has meaning only with its sampling position, method, instrument performance and decision rule. Measurements close to a limit need particular care because resolution, calibration status, product heterogeneity and method uncertainty can change the classification. Do not average a failing unit into compliance unless the governing process and decision rule explicitly use that statistic. A laboratory result may identify an analyte accurately while still failing to represent the complete lot. Record what the result proves, what it does not prove and how it changes containment or disposition.

Faults involving distributed product

If affected product may have left control, reconstruct customers, quantities, dates, transport conditions and remaining stock while the technical investigation continues. Do not delay distribution tracing until the root cause is certain. The event team should distinguish internal hold, market withdrawal, recall and regulatory notification according to the applicable jurisdiction. New evidence can widen or narrow the distribution scope, but every change needs a recorded basis. Communication should describe the known hazard or defect without presenting an untested causal theory as established fact.

Human action and system conditions

An operator action may be the immediate event without being the complete cause. Examine instruction clarity, training, workload, alarm design, access, supervision, maintenance, handover and whether the expected action was physically practical. Repeating training is justified when knowledge or execution was causal, but it is not a substitute for correcting an ambiguous procedure, inaccessible control or unreliable system. Preserve a fair account of what information was available at the time. Effective investigations improve the system instead of merely assigning fault to the last person in the chain.

Closure and governance

Define who may release product, approve process changes, accept residual uncertainty and close the event. Independence matters where the same person is under pressure to restore output and judge whether the evidence is sufficient. Closure should confirm quantity reconciliation, disposition, causal conclusion, completed changes, document updates, effectiveness evidence and any wider reassessment. Open actions need interim controls and due-date review. A recurring event should link back to the earlier investigation so the organisation can test whether the former cause was wrong, the action was weak or the control later degraded.

What good troubleshooting produces

A complete troubleshooting outcome is more than a repaired batch. It produces a defined event, protected scope, defensible disposition, tested causal conclusion, controlled change and evidence that recurrence is less likely and more detectable. It also leaves the normal process clearer: expected conditions, warning signs, escalation rules and records are improved for the next operator. Where the investigation cannot reach that standard, the open uncertainty must remain visible and be managed through conservative product control, additional evidence or formal reassessment rather than being hidden in an administrative closure. That distinction is fundamental.