BRCGS and PLC programs: what the standard does and doesn't say
You will sometimes read that BRCGS Issue 9 “tightened control system requirements”. It didn’t, not in those words. The BRCGS Global Standard for Food Safety doesn’t mention PLCs, HMIs or program backups. Its Issue 9 changes were about food safety culture, validation of the HACCP plan, food defence, the equipment section and unannounced audits.
Automation still meets the standard, though, because on most modern lines the PLC is what carries out the food safety controls. This guide covers where that happens and what to have ready.
This is general guidance from an automation engineering business, not certification advice. Your certification body and auditor decide how the standard applies to your site.
Where the PLC meets the standard
Critical control points. Cook and chill temperatures, metal detection and reject, foreign-body checks and pasteurisation are often monitored, and sometimes enforced, by a PLC. If the logic that rejects a failed pack is wrong, the CCP is wrong.
Changes to the HACCP plan. Issue 9 added explicit requirements to validate the HACCP plan and to verify changes before they are put in place. A program change that alters how a CCP is monitored or enforced is, in effect, a change to how the plan is carried out. It is reasonable to expect it to be controlled the same way.
Equipment. Issue 9 substantially revised the equipment section, covering purchasing, installation and commissioning of new equipment. Commissioning a new machine includes its control program.
Monitoring devices. Instruments that measure CCPs must be calibrated and verified. When the reading passes through a PLC or HMI, scaling and alarm limits in the program are part of that chain.
What an auditor could reasonably ask
None of these questions are in the standard word for word, but they follow from it:
- Which programs control or monitor critical control points?
- How do you know the program running today is the approved one?
- Who changed it last, when, and was the change verified before it went live?
- If the controller failed during production, how would you restore it, and how long would it take?
What to have ready
A list of CCP-related devices. Which PLCs and HMIs touch which control points, on which lines.
A backup of each program, versioned. Stored against the device, with each change kept as a new version, so you can show which version is running and what changed.
A record of who changed what. Every change logged with a name, a date and a reason, and the verification step recorded.
A recovery route. The software, version and cable needed to restore each program, recorded before you need them.
Getting there
Most sites have the backups somewhere: on an engineer’s laptop, a USB stick or a machine builder’s server. The work is in collecting them, checking they match what is running, and keeping them current. A Capture site audit takes the backups and records how to restore each one in a single visit, and Command Centre keeps every version and logs every change from then on.