Any comprehensive food production process relies on control programs to ensure food safety and quality. Major interruptions to these processes and programs may cause large economic losses to the producer as well as risks to consumers. Depending on the location of the facility and the type of food processed, control programs go by names such as prerequisite programs (PRPs), Standard Operating Procedures, Critical Control Points (CCPs), preventive controls (PCs), quality control points and Good Manufacturing Practices. Most, if not all, of these programs depend on the infrastructure of the facility for proper implementation, so any compromise to the normal design and functional state of the facility will probably jeopardize one or more of these control programs. Loss of system control probably will impact the safety or quality of any food items in process or stored on-site.

While we should use good design and management systems to lessen the frequency or severity of these perturbations to our control programs, there will be some excursions outside of our control. A process deviation occurs whenever the actual process or a critical factor is less than what is required by the process schedule, for instance, when any operating parameter of a thermal processing system is not met. Causes of deviations may include severe weather or lack of delivery of critical ingredients, power or potable water. The actual list of elements disruptive to our control programs is probably quite lengthy. We believe that planning for these disruptions with appropriate responses and actions is the best way to minimize the impact of a disruption. But if the potential inventory of calamities is quite lengthy, the planning process we encourage likewise becomes extremely burdensome. One way to deal with this apparent stalemate is to take a page out of the Hazard Analysis and Critical Control Points process—brainstorm to come up with a list of possible interruptions to your operation and then evaluate each one based on the likelihood of occurrence and its severity.

Because the list of potential interruptions to the myriad food production processes is extensive, we can neither generate this list nor discuss how to adequately plan and react to all the possibilities in a single article. Instead, we will provide some examples of disruptions that we have experienced in the meat and poultry processing industry and a framework for development of your own road map. Before we proceed, we advise the following caution: Never jeopardize employee safety when planning for or responding to a facility emergency. There will undoubtedly be some circumstances when the facility is unsafe for normal worker activity, such as structural building issues or lack of light. Employees need to be equipped with appropriate safety gear before they enter areas within the plant to do monitoring, remediation or other activities. In some cases, food items in process or finished product stored on-site will have to be sacrificed to protect employees.

Case 1. Loss of Potable Water
While perhaps taken for granted in most developed countries, potable water is a critical resource for almost all food processors, and the means with which it can become compromised are numerous. Let’s consider the case where facility water is provided by a municipality or other third-party supplier. Some causes of water contamination or loss of potability include failure to properly disinfect at the treatment facility, failure to maintain integrity at an intermediate storage vessel, heavy rains and subsequent flooding, or a break in the water delivery system. Contamination may also occur within a food plant by a break in the internal water supply system, siphoning of nonpotable water into the supply system, inappropriate use or overuse of chemicals in boiler water, etc. An assessment of how long the potability of water is lost is important, because any product not in a finished state prior to that time may be in jeopardy. This should become apparent if you consider the myriad ways that water is used in food facilities, from the obvious use as an ingredient or rinsing agent to the less obvious but equally important use as a solvent for hand and equipment washing. Because pinpointing the exact time that water may have become contaminated is difficult, some finished product may have to be held for evaluation and disposition. In any case, each facility should have, in writing, a clear procedure for dealing with water contamination issues that engineering, maintenance, operations and food safety or quality have developed, because eventually you will need it.

If your facility is prenotified of a compromise in either the treatment of water supplied or a disruption in the delivery system, there are some things you can do to prevent major loss of products and plant downtime. The plant must recognize the disruptive character of a loss of potable water and accept it—often the best first reaction to this notification is to cease all production and water use before the disruption actually occurs and continue the shutdown conservatively until well after the system has been restored to normal. If there is a shut-off valve where the supply enters the facility, turn it off completely before the service interruption (if not, see the situation described next). After you have been notified of an acceptable return of potability, identify the water line that you can drain closest to where the supply enters your facility and let it run for at least 10 minutes to flush out any stagnant or untreated water. We recommend collecting a sample of this water at the end of the flushing period and testing it to compare with U.S. Environmental Protection Agency (EPA) or other microbiological regulatory requirements for potable water (for EPA, this equals nondetectability for total coliforms in 100 mL and a recommendation of less than 500 heterotrophic plate counts per mL[1]). This testing will take at least 48 hours to complete, so if you start production before these results are issued, product should be placed on hold. You must consult with a processing authority on product disposition if either result is unacceptable.

If your facility is operating when it has become known there is or has been a potential loss of potable water, plant personnel must make a reasonable but conservative effort to estimate when contamination could have started and what product or ingredients in the facility may have been impacted. These materials must be quarantined until a processing authority or other knowledgeable person can judge their suitability for use. This will include any work in progress. Production should immediately cease, and the management team should get together and determine a course of action. The exception to stopping all production would be situations where there is a heat step or similar process underway that requires a water shower or rinse after completion. This process can continue to completion, but all said rinsed or exposed product must also be put on hold. Discussions also need to begin immediately with the water supplier if the failure occurs outside your facility, because your facility will remain idle until potability is restored and customers are expecting product.

If the water supply has become compromised, it is critical that you assume all supply lines in your facility have become contaminated and require some type of decontamination. While you are waiting for restoration of a safe supply of water, plant engineering or maintenance should inventory all sources of water throughout the plant, as they will all have to be flushed at some point. These sources may or may not be obvious—handwashing sinks, drinking fountains, shower lines in cook systems and coolant water are some that might get missed. When you have been assured that potable water is now available at your water supply’s main entrance into the facility, you will need to disinfect all internal plumbing. Because virtually all municipal water entering our plants in the U.S. is treated at the supplier with chlorine, we add excess chlorine (shocking) to water entering the facility after a disruption to disinfect internal piping. Our objective is to add up to 100 ppm free chlorine and circulate that through all piping in the facility. We require a 3-hour residence time to complete the disinfection process, and we make sure all plumbing gets filled with this shock solution. Other disinfectants, such as chloramines or chlorine dioxide, can be substituted for chlorine or sodium hypochlorite. This is not a simple process, and engineering or maintenance will have to determine how to access the main water supply and add chlorine into it while all the pipes are flushed. Once the shock treatment has had sufficient time to disinfect the system, all water lines must be flushed until the free chlorine falls to less than 4 ppm. This may take some time, so prepare accordingly and stock up on test kits. It is also a prudent practice to test water for microbiological contamination, as described above, for heterotrophic plate count and presence of coliforms. If you are willing to take the business risk and can hold all finished product, you may start production while awaiting test completion.

Case 2. Interruption in the Cooking Process
We have witnessed many instances where cooking processes have been temporarily halted, often caused by a loss of steam in a facility, a general or localized electrical power outage or a mechanical breakdown of the cooking device. In addition to potentially affecting quality attributes of food being processed, this stoppage may lead to serious food safety concerns. Not only is there the obvious failure to meet a CCP or PC because product does not reach a critical limit (CL), but there may also be an opportunity for pathogen or spoilage organism growth while the food remains at sublethal temperatures. Of particular concern in the meat and poultry industry is enterotoxin production by growth of Staphylococcus aureus and growth of the spore-forming bacterium Clostridium perfringens. Both organisms will grow in the general range of 10–46 °C (50–115 °F), with C. perfringens able to tolerate slightly higher temperatures. The staphylococcal enterotoxin is heat stable, so subsequent heat treatments at normal temperatures will not destroy it and it will remain a hazard. C. perfringens, if given enough time to grow and sporulate, will form heat-resistant spores that are unaffected by most cooking temperatures below retort. The rapid growth of spoilage organisms during this warm period will lead to detrimental product characteristics, even if the organisms are eliminated by an eventual heat kill step.

First, let’s deal with cooking processes that are relatively short in duration, as these systems tend to be simpler by design, which facilitates product disposition. If product moves via a conveyor quickly through a heating zone or is a fluid pumped through a heat exchanger, and the heat source is lost in either case, product that continues to move through these systems is undercooked and will contaminate any surfaces it contacts downstream. The system needs to be shut down at this point, including all conveyors and pumps, and all product must be removed from the processing equipment. If partially cooked product can be captured and rapidly chilled to less than or equal to 4 °C (40 °F), it can be put back through the cooking system once sanitary conditions have been restored and the heat delivery mechanism is functioning properly. If the product cannot be easily captured and chilled, volumes will be relatively small and it is safer and more economical to just discard it. In the case where the pumps and conveyors are also without power, all material within the ineffective heat zone will probably have to be discarded once it is safe to remove it from the equipment. In all cases, wherever undercooked product comes in contact with handling equipment on the fully cooked side, all of that equipment will have to be cleaned and sanitized. After all associated equipment has been sanitized and power or function has been restored to the heat section, you can go through a normal start-up process, although initial temperature monitoring to check on CL compliance should be more frequent to ensure the system is back to standard conditions.

For longer cooking processes, whether in a continuous manner or in a static batch, the process is probably complicated by the economic value of affected product and an inability to easily remove it from the cooking device. If product can be easily retrieved and has not been heated above roughly 18 °C (65 °F), it is acceptable to quickly chill as mentioned previously, assuming you can do this on the raw side. Once power is restored, the product can be placed back in the oven and cooking resumed. We have many large-batch cookhouses where quickly moving product out to a raw-side cooler during a cooking failure is impractical. To help facilitate a response to loss of cooking system function at the plant level, we have developed a decision tree, shown in Figure 1, which we have given to smokehouse operators to follow. This decision matrix is based primarily on the possibility of pathogen growth when product fails to reach lethal temperatures in an appropriate time interval. We have used computer modeling to predict worst-case scenarios for growth of both S. aureus (and its enterotoxin) and C. perfringens. We recommend using either the U.S. Department of Agriculture’s Pathogen Modeling Program (PMP)[2] or ComBase’s Predictive Models.[3] As is evident in our decision tree, it is imperative that time and temperature parameters are observed and recorded so that appropriate Hazard Analyses can be completed. If temperatures remain above 52 °C (we use a conservative figure of 54 °C), neither pathogen will grow and will probably lose viability, so there is no risk to product safety even though it has not yet reached the CL. If product temperatures are below 52 °C during the downtime, then growth of either pathogen to hazardous levels may occur given sufficient time.

We need to make some well-founded assumptions at this point, because we normally lack adequate information concerning initial levels of pathogens and their growth responses to changing and unknown temperatures. We have conducted many internal studies measuring the prevalence of S. aureus and C. perfringens in our raw meat and poultry materials and have never measured either organism at higher than 5 × 102 CFU/g. For either organism to apparently cause illness, required levels in foods are about 1 × 105 CFU/g.[4,5] To help our operators make conservative decisions until the information can be reviewed by a processing authority, we use the time it takes for S. aureus or C. perfringens to increase by 2 logs at the maximum growth temperature, plus a reasonable lag period. The models cited predict this is at least 2.5 hours. This means that product that is exposed to suboptimal cooking temperatures for 2.5 hours or less is safe to then continue cooking, as insufficient time has elapsed for enterotoxin formation or generation of high enough numbers of C. perfringens spores to cause illness. If the interruption to the cooking process lasts longer than 2.5 hours, then product must be put on hold after cooking and chilling are completed for a process authority to review the data and, when necessary, conduct end-product testing for staphylococcal enterotoxin or C. perfringens counts to determine product disposition. Consideration should also be given to organoleptic deterioration of product through either spoilage organism growth or excessive heat effects.

Case 3. Loss of Refrigeration
No matter what type of food product is being produced in a facility, refrigeration is a significant component of the food safety and quality process. Depending on the situation, interruption of refrigeration caused by a power outage or breakdown of the cooling system may occur, affecting a single department/area or the entire processing plant. Although backup generators with the capacity to operate critical equipment such as refrigeration and freezer units, pumps and safety lighting are lifesavers, in most cases, these function strictly as a short-term substitute. An interruption in refrigeration may lead to the growth of spoilage organisms, pathogens and toxins in products that normally are under temperature control. For instance, inadequate cold storage or cooling can allow spores of Clostridium botulinum and C. perfringens to germinate, resulting in vegetative cells multiplying to hazardous levels. Both organisms will grow in the range of 10–46 °C (50–115 °F) and produce heat-resistant spores. S. aureus is another pathogen of concern that produces a toxin when growth is not controlled by adequate refrigeration. Rapid growth of spoilage organisms during this inadequate cooling period will lead to detrimental product quality and sensory issues.

We have facilities that produce both fully cooked items and some that have no kill step in their processes. In either case, their incoming ingredients are often temperature sensitive and must be kept below 7 °C (45 °F) during storage and processing to prevent outgrowth of pathogens and spoilage organisms. If loss of refrigeration is limited to a single room or area, we first assess how long the area, and more importantly the product, will remain below 7 °C if left undisturbed. If refrigerated items are in large totes or vats, or stacked on pallets, they will hold temperature for a long period if the room temperature itself does not climb appreciably. Constant monitoring of surface temperatures is necessary. If you are unsure how long the loss of refrigeration will last, it is usually a simple matter to move these materials to another area that still has adequate refrigeration. This process should be monitored closely to prevent contamination of raw materials and documented. If no other refrigerated areas are available to use as a substitute holding area, we will bring refrigerated trailers on-site and use them as temporary storage coolers. Again, this must be carefully monitored, and we set up a frequent check of trailer temperatures to ensure the trailers are operating properly. Any food processing facility should have a list of vendors that can supply trailers in an emergency because time will be of the essence. Another option we have pursued is to bring in dry ice (not wet ice) and add to combos or vats to maintain low product temperatures. You can follow any of these suggestions if you lose refrigeration in any finished-product coolers as well, whether the items are fully cooked or not.

The situation we just described is rather straightforward and the remediation measures can be completed quickly. It might be another matter entirely if you lose refrigeration to an entire facility or to a critical area that impedes processes upstream or downstream. For instance, if your process requires rapid chilling through use of chilled showers or blast cells after a cook step, and the function of either is lost, the effects on product safety and quality must be carefully assessed. From a product safety perspective, the main concern would be any spores that have survived the cooking process and are routinely controlled by rapid chilling. In the absence of rapid chilling, extensive product testing for any spore-forming organisms associated with your product will be necessary before release. There are also quality issues to consider, either through growth of spoilage organisms that survived the lethality step or excessive heat leading to loss of organoleptic or nutritional characteristics. If refrigeration to the entire facility is lost for short periods, some of the methods to deal with product mentioned in the previous paragraph may help. When we lose cooling for more than one day, we prioritize dealing with finished product on-site and getting it to either refrigerated trailers or an outside cold-storage facility. Once that is handled, plant personnel will have to manage work in process. Typically, any food items requiring refrigeration will be a total loss after one day without refrigeration and should be removed from the facility. Prior to startup after refrigeration is restored, it is usually necessary to completely clean and sanitize holding coolers and chilled shower systems as they often rely on cold temperatures to delay less than daily or weekly cleaning. And don’t forget about incoming raw ingredients that need refrigeration. These shipments should be canceled or delayed as best as possible.

Conclusions
Planning for major disruptions in plant processes is critical to minimize financial costs to the facility and to protect consumers. These disruptions will happen; when they do, the frenzied activity that results without proper planning is not the best situation for making decisions that are wide reaching. We are not suggesting that you spend a lot of time planning for a catastrophe, but instead focus on disruptions that are likely to hit major programs and utilities. This planning begins with an analysis of all programs like PRPs that form the foundation for your food safety and quality plans. First, ask what hazards these programs help control and in their absence, or if they lose effectiveness, what the likely outcome is. Can you identify backup plans before needed, or even better, can you design the system to be more robust so it is less likely to fail? Once you have a list of programs that are at risk, and you understand the consequences of losing that function, it is time to write a procedure that should mitigate most, if not all, of the harm this interruption will cause. It is equally important to assign responsibilities to individuals so it is clear to everyone what their role will be. There is another reward for the plants that undertake this risk analysis procedure: If you address this task in depth, you will find a deeper level of understanding of your process and will make improvements to it even without ever going through a disruption.

Finally, every response to a facility emergency should ultimately lead to a postmortem review of the incident. This postmortem should include the following:

1.    Discovery of the system interruption: Was it timely?

2.    Documentation of the events: Were all needed records maintained?

3.    If a plan was in place prior to the event, was it followed?

4.    Was product handled properly and conditions restored promptly?

5.    Was there a way to prevent the disruption?

6.    Is it likely that future disruptions will be similar to this one?

7.    Were customers notified in a timely manner and market impacts minimized?

8.    If your plant is one of many in a company, have you shared learnings from this experience?   

Hayriye Cetin-Karaca, Ph.D., is a food microbiologist in the food safety and quality department of Smithfield Foods.

Gene W. Bartholomew, Ph.D., is the senior corporate director of food safety with Smithfield Foods.

References
1. www.epa.gov/dwreginfo/drinking-water-regulatory-information.
2. pmp.errc.ars.usda.gov/PMPOnline.aspx.
3. www.combase.cc/index.php/en/.
4. Mor-Mur, M and J Yuste. 2010. “Emerging Bacterial Pathogens in Meat and Poultry: An Overview.” Food Bioprocess Technol 3:24.
5. Schelin, J et al. 2011. “The Formation of Staphylococcus aureus Enterotoxin in Food Environments and Advances in Risk Assessment.” Virulence 2(6):580–592.