Two-Stage Cooling Failure in a Hospital Kitchen
A hospital central kitchen produces 400 portions of beef and vegetable stew daily. The HACCP plan requires two-stage cooling: from 57 °C to 21 °C within 2 hours, then to 5 °C or below within a further 4 hours, with the core temperature of every batch logged. On Friday the 60 L steam kettle was filled to the 55 L mark at 11:20 and cooking finished at 13:05. The batch was decanted into two 25 L stock pots at 13:30 and placed in the walk-in at 4 °C. At 15:30 the cook recorded 34 °C and 33 °C. He moved the pots to the blast chiller, which brought them to 8 °C at 18:50. The log shows no reading between 15:30 and 18:50 because the probe printer was out of paper. The stew is on Saturday lunch for 180 patients, 40 of them on neutropenic diets. The head chef says it will be reheated to boiling, so it is safe.
1. Decide whether the batch may be served, and justify the decision with time-temperature reasoning and the pathogens of concern.
Read the worked answer
The batch must not be served, and the reheating argument does not rescue it.
Apply the site's own two-stage criterion. Stage one required 57 °C to 21 °C within 2 hours. Cooking finished at 13:05, the pots went into the walk-in at 13:30, and at 15:30 the cores were 34 °C and 33 °C - still above 30 °C two hours after decanting. Stage one failed by a wide margin. Stage two required 21 °C down to 5 °C within four further hours; the batch was still at 8 °C at 18:50 and never recorded at or below 5 °C. Total time in the 5-57 °C band was roughly five and a half hours, including about two hours between 30 °C and 55 °C, the fastest growth window.
The organisms of concern in a cooked, cooled, anaerobically handled stew are Clostridium perfringens and Bacillus cereus, both with generation times of 15-20 minutes near optimum. Reheating to boiling kills vegetative cells but not the heat-stable emetic toxin of B. cereus (cereulide), and it does not remove the C. perfringens risk, since a large dose of cells can survive as spores and sporulate in the gut. Boiling also does not sterilise a 25 L pot - reaching 100 °C at the core takes far longer than assumed.
The missing log makes matters worse: unverified is treated as failed.
2. State the corrective action on the batch and redesign the cooling step so the failure cannot repeat.
Read the worked answer
Corrective action on the batch: segregate it, label it not for service, and discard it. Record the reason and the time-temperature data, notify the food safety manager, and do not recook it, blend it into a fresh batch, or divert it to staff.
Redesign of cooling:
- Never cool in 25 L stock pots. Decant into shallow gastronorm pans at about 5 cm depth, roughly 5 kg per pan, and load the blast chiller immediately rather than the walk-in.
- Size the blast chiller for the load: 55 L in 5 cm pans is about 11 pans; confirm the rated capacity covers that per cycle and pre-chill before loading.
- If the blast chiller is already full, use a sanitised ice paddle or an ice-water bath; a paddle in a 20 L pot roughly halves cooling time.
- Probe every pan, not every batch, and record at fixed intervals - start, 1 h, 2 h, 4 h, 6 h - with a calibrated probe. The printer is not the control; a written record plus a calibrated handheld probe is.
- Set a hard rule: if 21 °C is not reached at 2 hours, the pans move to a hold-or-discard decision made by a supervisor, not quietly left in the walk-in.
3. Address the record gap and the neutropenic patients, and note what the menu consequence reveals about the process design.
Read the worked answer
Record gap: the missing log is itself a nonconformity. Treat the batch as unverified, document the gap, the cause (printer out of paper) and the corrective action - spare paper plus a backup thermometer on the line, with a named person responsible for the log each shift. A HACCP record that can silently disappear is a system failure, not a paperwork slip.
Neutropenic diets: these patients are immunocompromised and usually on a low-microbial diet, so the acceptable risk is far lower than on a general ward. Even a batch that had passed the cooling criteria but had a broken verification record should not go to that group. The batch is discarded anyway, but the rule should be written into the plan.
Menu consequence: 180 portions must be replaced. The fallback must not repeat the risk - a fresh batch cooked and blast-chilled under supervision is acceptable; reheating the failed batch, or serving a cold alternative pulled from the walk-in without checking its own records, is not. The incident also exposes a design mismatch: a 55 L kettle cannot be cooled safely by the equipment and staffing currently available at that hour, so either batch size or blast-chiller capacity has to change.