Cooling Deviation in a Cook-Chill Sous-Vide Line
At 02:15 on a Saturday, the night supervisor in a cook-chill facility producing 2,400 meals a day calls you. A batch of 400 sous-vide beef short-rib portions, each 220 g in 1.8 kg vacuum bags, finished cooking at 18:40 the previous evening at 82°C for 8 hours. The bags were loaded into blast chiller BC-2 at 19:10. The compressor failed at 20:05; the alarm was silenced by a cleaner at 23:30, and no one investigated. The product logger reads 58°C at 23:30 and 41°C at 02:00. The site standard is ≤3°C within 4 hours, i.e. by 23:10. The production manager wants to reheat the bags to 75°C at 10:00 and serve them at a 380-cover banquet, arguing that reheating kills anything. The batch is worth €3,200 and the banquet is sold. Your laboratory can test, but results take 48 hours. The site is BRCGS-certified and also supplies a hospital contract.
1. What is your disposition of the 400 bags, and what is the technical basis? State what you would do in the next two hours.
Read the worked answer
Disposition: do not release, do not reheat and serve. Segregate and condemn the batch.
The batch has failed the site cooling standard by a wide margin. The critical issue is not the final temperature at 02:00 but the time spent in the growth range for spore-forming pathogens, especially Clostridium perfringens. The product was at 58°C at 23:30 and 41°C at 02:00, so it had already spent at least 3.5 hours between 5°C and 60°C, and the projected cooling would extend that to 6–7 hours. Reheating to 75°C destroys vegetative cells but not heat-stable spores or any toxin already formed. C. perfringens can grow from a low inoculum to infective numbers in that window, and the anaerobic vacuum pack is not a barrier at these temperatures.
A 48-hour micro result cannot release the batch either: sampling 400 bags cannot prove absence, and the test would not detect preformed toxin reliably. The hospital contract raises the consequence of error and normally requires notification of a deviation affecting their product.
Next two hours: place the bags in a locked hold area labelled 'DO NOT USE - QA HOLD'; download and preserve the BC-2 logger data; verify the probe calibration; identify every other batch in BC-2 that night; notify the QA manager and site manager; segregate retained samples; start the deviation record; and arrange condemned-waste transfer with a witness.
2. Draft the key entries for the deviation and corrective action record, including root cause and preventive measures.
Read the worked answer
The record should be traceable and not simply say 'human error'.
Event: Batch SR-2408-17, 400 × 220 g short rib, cooked 82°C/8 h, loaded to BC-2 at 19:10. Compressor failure at 20:05. Alarm silenced 23:30. Product 58°C at 23:30, 41°C at 02:00. Standard: ≤3°C by 23:10. Disposition: condemned, 400 bags, value €3,200.
Immediate corrective action: product segregated and condemned; other batches in BC-2 assessed; maintenance called; hospital customer notified under the contract; samples retained for investigation.
Root cause: the compressor failed, but the control failure was that the alarm was silenced by a cleaner who had not been trained to recognise a critical alarm, and there was no out-of-hours escalation to an engineer. The alarm was treated as a nuisance. Contributing causes: no automatic dialler, no alarm acknowledgement log, and no maintenance trigger on compressor condition.
Preventive action: fit an autodialer to the on-call engineer; restrict alarm silencing to trained staff; add a daily alarm-review check; train cleaners on critical alarms and forbid silencing; add compressor preventive maintenance and condition monitoring; recalculate blast-chiller capacity against peak load. Assign owners and due dates, and verify effectiveness by auditing alarm logs for four weeks and running a mock failure.
3. The site proposes adding a second blast chiller and revising the cooling step. Define the validation and monitoring you would require before the change is accepted.
Read the worked answer
Validation must demonstrate the revised cooling process under the worst case the site will actually run, not under a favourable small load.
Validation protocol: use the largest bag, the heaviest load and the highest stacking density permitted by the loading diagram. Place calibrated data loggers at the geometric centre of the slowest-cooling bag and at the load edge; record air temperature as well. Run three consecutive successful batches. Acceptance: every logger reaches ≤3°C within 4 hours, and the time between 60°C and 5°C is within the site's validated limit (commonly ≤2 hours for this product). The come-down from 82°C should also be plotted to show no plateau in the 30–50°C range.
Capacity calculation: document kg per batch, bag thickness, load pattern and chiller duty at design ambient. If the second chiller is used to increase throughput, the validated maximum load must not be exceeded.
Monitoring: continuous logging with alarm setpoints, automatic escalation, daily verification of logger calibration, and QA review of cooling records before release. Revalidation triggers: new bag size, new product, changed loading, chiller repair affecting airflow, or a trend of slower cooling. Include a challenge or at least a scientific justification for the spore-former risk, and record the rationale in the HACCP study.