Walk-in Failure Overnight: What Can Be Saved?
At 06:10 on a Saturday, the sous chef finds the walk-in cooler at 16°C. The compressor failed overnight and the alarm was muted. Inside are 18 L of beef stock in two 20 L pots at 14°C, 40 cooked chicken breasts stacked in two 10 cm deep hotel pans at 11°C, 10 L of cream-based mushroom soup at 13°C, and 25 kg of raw beef tenderloin at 9°C. The stock was made yesterday at 18:00 and placed in the walk-in at 19:30. The chicken was cooked at 17:00 and panned at 17:40. The soup was made at 15:00 and put in at 15:45. Service starts at 11:30, and the chef wants to know what can be saved. The kitchen has a blast chiller, a working reach-in, probe thermometers, and an infrared thermometer.
1. State the disposition of each of the four items and justify it with time-temperature reasoning.
Read the worked answer
Use the danger zone (5–63°C) and the two-stage cooling standard: 63→21°C within 2 hours, then 21→5°C within 4 hours. Any cooked food that has spent more than 4 hours above 5°C should be discarded.
- Beef stock: in the cooler from 19:30 to 06:10 = 10 h 40 min at 14–16°C. Far beyond 4 hours; discard. The pot size also explains slow cooling.
- Chicken: panned at 17:40, so about 12 h 30 min above 5°C at 11–16°C. Discard. Stacked 10 cm pans would not have cooled safely even in a working cooler.
- Mushroom soup: in the cooler from 15:45, about 14 h 25 min at 13–16°C. Discard; cream and starch make it a high-risk medium.
- Raw tenderloin: at 9°C, above 5°C for an unknown but almost certainly >4 h period. Whole-muscle beef is lower risk than cooked food, but the time is not verified. Discard unless the actual time above 5°C can be documented as under 4 hours; if so, cook immediately to a safe core temperature and use the same day.
The safe answer is that none of the cooked items can be saved. The decision must be recorded, not made informally.
2. If the tenderloin could be verified as having been above 5°C for less than 4 hours, what corrective action and records would you require before service?
Read the worked answer
Verification must be evidence-based, not a verbal assurance. I would require the cooler data logger or a written time check showing when the product crossed 5°C, plus a probe reading at receipt this morning. If the total is under 4 hours, move the tenderloin immediately to the working reach-in at ≤4°C or cook it now; do not return it to raw sale later.
Records should include product name, weight, lot or delivery date, time placed in the cooler, time the failure was discovered, product temperature at discovery, calculated time above 5°C, decision, corrective action, and the initials of the person authorizing it. The cooked product should be labeled with cooking time, core temperature, and use-by date.
I would also check for cross-contamination: drip from the tenderloin onto ready-to-eat items, and whether the same probe was used without sanitizing. If any cooked item contacted raw juices, it is discarded regardless of its own temperature history.
3. Identify the root cause and three control changes to prevent recurrence.
Read the worked answer
The immediate root cause is not only compressor failure; it is that the alarm was muted and no one detected the rise before 06:10. A muted alarm removes the only barrier between a mechanical fault and a full loss.
Control changes:
- Alarm management: the alarm must be audible and also send a phone or messaging alert to the duty manager. Muting should require a supervisor code and a recorded reason. Test the alarm weekly.
- Temperature monitoring: log the walk-in at least every 4 hours during operation and overnight via a data logger. Set the alarm threshold at 5°C, not 8°C, so there is time to act.
- Cooling and loading: cool stock in shallow pans or with a blast chiller, and never put 20 L pots into the walk-in. Reduce loading so airflow is not blocked, and keep a written contingency plan for moving product to a backup unit.
The corrective action should also include a review of the previous 24 hours of logger data, because other batches may have been affected before the visible failure.