A stop is an event, not a diagnosis
When a filler, press or thermal skid stops, the rest of the line does not stop at the same instant. Product may continue to arrive, a tank level may rise, a pump may be requested to stop, and an operator may intervene locally. A single alarm message rarely explains which of those events came first. Treating the stop as a diagnosis turns a sequence problem into a guess about one machine.
Start with a common time axis. Record the requested state, the actual state and the reason visible at each boundary: receiving, preparation, recovery, buffering, treatment and filling. Add planned cleaning, material changes and manual actions. If the records come from different clocks or different shift notes, align them before drawing conclusions. A useful stop record shows what was possible, what was requested and what actually happened.
UNIDO's small-scale processing guidance frames production as a sequence of preparation, extraction, preservation and quality-assurance steps. That general sequence is a reminder that a downstream stop can change the condition of material still held upstream. It does not define a particular controller, interlock or allowable holding time.
Map upstream accumulation before adding volume
Identify every place where product can accumulate between the stopped machine and the upstream source. A hopper, a buffer tank, a drain pan and a pump suction are different kinds of accumulation with different consequences. Estimate the usable volume and the time it buys under the actual feed rate. Then compare that time with the observed stop duration rather than with a nominal tank size.
A full buffer is not proof that upstream is producing too much. It may mean the downstream route is unavailable, a transfer pump has stopped, a valve is in the wrong position or the product is deliberately held. Record the destination status at the same time as the level. A level trend without the outlet condition is incomplete evidence.
Adding storage can move a problem rather than remove it. More volume may extend residence time, change temperature, complicate cleaning or create a new high-level constraint. Define the product condition allowed during the hold and who releases it afterwards. The appropriate question is not “how large is the tank?” but “which short mismatch is this volume intended to cover, and what happens beyond it?”
Locate overflow, isolation and hold points
Walk the line and mark the physical points that determine where product can go during a stop: overflow connections, drain valves, isolation valves, sample points and return routes. Check whether each point is manual or actuated, whether its position is indicated, and whether the indicated position is the same as the actual position. A drawing that shows a route does not prove that the route is available.
Separate product, cleaning and waste paths in the walkdown. A shared line that is acceptable in one configuration may be unacceptable in another. If a valve change is needed to isolate a stopped section, state who is authorized to make it and what confirmation is required before production resumes. Do not infer a safe sequence from a screen graphic or from the existence of a valve.
The hold point also needs a product decision. Is the material to be held, returned, reworked, downgraded or discarded? Who makes that decision, and what evidence do they need? FDA's juice HACCP guidance describes monitoring, corrective actions, verification and records as parts of a food-safety system. That framework supports a disciplined disposition record; it does not turn every line stop into a food-safety event or supply a universal hold time.
Review restart permission, not just restart sequence
A request to run, a permission to run and feedback that a machine is running are different facts. Write them separately for each boundary. Note the origin, owner and validity of each signal, and what happens when the information is missing or stale. A machine that is mechanically ready may still be unable to accept product because its downstream receiver is unavailable.
Define the restart path for normal operation, after a local fault and after a cleaning changeover. Include manual modes and local control, but do not assume that the line control system owns protective functions. Existing machine protections and validated process conditions remain the responsibility of their designers and the site. A functional description can coordinate them; it cannot replace the engineering assessment behind them.
Record who authorizes a restart and what must be true before product is admitted. If the answer differs by product, package or cleaning state, write the variants down. The most expensive restart is often the one that begins with an unstated assumption about which route is ready.
Exercise the boundary, then write the response
Use a planned trial to exercise a short stop and restart with the actual product and destinations. Observe the level, route, pump and receiving-machine states on one timeline. Repeat with a longer stop only within the product and hygiene limits agreed by the responsible specialists. The purpose is to learn where the line is sensitive, not to prove that every interruption is harmless.
Turn the observations into a stop-response table: event, expected state, information source, immediate action, product disposition, restart authority and record. Keep unresolved items visible. A table that says “PLC handles it” without naming the field device, function and owner is not an interface definition.
A stop is useful because it reveals the line as a set of connected decisions. The evidence may show that a transfer route, a buffer limit, a restart permission or a product-hold rule needs attention. It rarely proves a single cause on its own, and it never replaces the project-specific validation of the changed system.