The 11 °C walk-in and the dead thermometer
Tuesday, 06:40. You are the senior chef on duty in a 140-cover hotel restaurant. Walk-in cooler 2 displays 11 °C; the last written log entry is 22:00 at 3 °C. The alarm is set at 8 °C but its probe is encased in ice and no alarm sounded. The night porter recalls the delivery door standing open around 02:00 for 'maybe twenty minutes, maybe more'. Inside: 8 kg of cooked, blast-chilled chicken breast (cooked 18:00 Monday); 12 L beef stock; 5 kg raw pork loin in cryovac; 20 L milk; 6 vacuum-packed salmon portions; 30 portioned cheesecakes. Your probe thermometer reads 'Lo' on a flat battery, and the calibration record on the wall is four months old. Service starts at 11:30 with 140 covers, and at 15:00 there is a wedding tasting for twelve.
1. Walk through the cooler item by item: what do you keep, what do you discard, and why? Which records must exist by the end of the shift?
Read the worked answer
First, do not trust the dial. 11 °C is the air temperature at an iced sensor, so it may be wrong in either direction. Get a working probe (borrow the bar or pastry unit) and calibrate it at the ice point - 0 °C in an ice slurry - before you rely on a single reading.
The decision rule is time above 5 °C, not the number on the display. Nobody can establish that time: the last entry is 22:00, the door stood open around 02:00, and there is no overnight check. Unverified time means you cannot invoke any two-hour/four-hour rule, so the default is discard.
- Cooked chicken 8 kg - discard. Ready-to-eat, high moisture, no kill step left, potentially 8–9 hours unmonitored.
- Beef stock 12 L - discard. Same logic; it is a ready-to-eat liquid.
- Milk 20 L, cheesecake 30 portions - discard. Dairy, ready-to-eat, Listeria and staphylococcal enterotoxin risk is not removed by anything you do later.
- Raw pork loin and vacuum-packed salmon - quarantine, then discard. It is tempting to keep raw meat 'because it gets cooked', but reheating does not remove pre-formed toxin, and vacuum packing selects for anaerobic organisms. Without evidence the product stayed at or below 5 °C, you cannot sign it off.
Records: a corrective action report with time discovered, readings (air and product), every item with weight and batch code, photographs of labels and the display, disposal method and witness, notification to the head chef and GM, plus a maintenance request for the probe and alarm. Then re-plan the menu, because 8 kg of cooked chicken cannot be replaced by 06:40 - tell the front-of-house manager before 09:00 so the tasting menu changes rather than the standard drops.
2. The F&B manager says: 'Stick it all in cooler 1 and turn the dial, the guests won't know.' How do you respond, and what do you do before you respond?
Read the worked answer
Before arguing, secure the scene and the evidence. Photograph the display and the iced probe, tag cooler 2 'DO NOT USE - breakdown', move unaffected stock in from cooler 1 only in the other direction (nothing goes into another cooler from the failed one), and call the refrigeration engineer. Say nothing about the stock yet; you have about ten minutes to make the facts indisputable.
Then decline, briefly and without a lecture. 'I can't move that stock and re-set the dial - if anyone gets ill we've destroyed the record that shows what actually happened. I'll log it as a breakdown now.' The key point to make to the manager is that this is a stock-loss and insurance claim, not a chef's error - the claim needs the log, so logging it protects them too. That reframes the conversation from 'who is to blame' to 'what does the paperwork require'.
If pressed: ask for the instruction in writing or by email; note the time and exact words in your own diary the same day; escalate to the head chef and the GM. Serve nothing from that cooler to the twelve-cover tasting, and brief whoever is running it so nobody 'rescues' a tray.
What you must not do: turn the dial, wait, re-check and then declare it fine. That converts a breakdown into a cover-up, and every temperature you take afterwards is contaminated by the earlier alteration.
3. Setting aside the compressor, what actually failed here, and what three controls would stop it recurring?
Read the worked answer
Three failures, not one. (1) The alarm probe iced over, so the alarm was defeated while showing 'armed' - a control that fails silently is worse than none. (2) A delivery procedure allowed a door to stand open in the middle of the night with no check. (3) Monitoring stopped at 22:00 with no overnight verification, and the only thermometer on the section was dead with a calibration record four months old.
Controls that address the cause, not the symptom:
- Probe the alarm and test it weekly, with the test logged. In practice an iced evaporator also means a defrost-cycle or door-seal problem, so add the cooler to a planned maintenance schedule rather than waiting for it to fail.
- Close the loop on deliveries: a signed delivery procedure with a named person responsible for confirming the door is shut, a self-closing door or door alarm, and a 15-minute-interval data logger so the overnight period is recorded rather than assumed.
- A calibrated thermometer on every section, checked at ice point weekly with the result written down, plus a one-page breakdown procedure posted on the cooler door (engineer's number, who to call, where the spare stock is).
Finally, make sure there is a stock-loss route so nobody has a financial reason to hide the next failure - the incentive to conceal is what turns a fridge fault into a food-poisoning outbreak.