Cold room and freezer temperature monitoring

At a glance

Item	Typical answer
Problem	Cold rooms and freezers are checked by hand twice a day, so a failed evaporator fan or a door left ajar on Saturday is found on Monday with the stock.
What is connected	Air and product-simulant temperature per room, door contacts, defrost and compressor states from the refrigeration controllers, and power to the plant.
Who uses it	Shift supervisors, the refrigeration technician or contractor, quality assurance and the site manager.
Typical first scope	One site: its chill rooms, its freezer store and the compressor rack that serves them, usually 8 to 20 rooms.
Time to first screen	Typically the same day for battery LoRaWAN sensors, because the Sensor regions solution provides a starting board. Allow three to five weeks before quality relies on it for daily review.

The situation

A food plant, a central kitchen or a distribution depot keeps raw material, work in progress and finished goods in a row of chill rooms at 0 to 4 °C, a few freezers at −18 to −25 °C and perhaps a blast freezer. Each room has a refrigeration controller that runs the evaporator, defrost and fans, and a display on the door. The HACCP plan names these rooms as critical control points, so someone walks the corridor, reads the display and signs a sheet.

The sheet records two moments a day. A door propped open during a delivery, a defrost heater stuck on or an iced-up coil that lets the room creep to 9 °C over six hours never shows on it. When a room does fail out of hours, the first sign is a warm display on the next round, and quality then has to decide whether the stock is safe with no idea how long it was warm. Audits ask for continuous records, and paper logs with gaps and identical handwriting do not satisfy them.

Goals and measures

Agree the measures with quality before buying sensors; they decide probe positions and which controller registers matter.

• Daily minimum and maximum per room, read straight from the daily aggregates. This replaces the twice-daily sheet and is what HACCP review signs off.
• Excursions = alarms of the type temp_high or temp_low per room per month, with excursion duration = resolved time minus opened time, taken from each alarm's timeline.
• Time to acknowledge = acknowledged time minus opened time. A night shift that takes 40 minutes on a freezer alarm needs a different notification design.
• Door openings per day from the increase of an opening counter, where the door sensor reports one; otherwise count door_open alarms.
• Defrosts per day and compressor run fraction = average of the comp_run state (0 or 1) sampled at a fixed polling interval. A run fraction that climbs week by week at the same load usually means a dirty condenser or low refrigerant charge.

Hermetry stores one-minute aggregates (sum, count, minimum, maximum, last) of every key and rolls them up into hours and days, so daily minimum, maximum and counter increase come out of the stored data without extra logic.

Architecture

Two kinds of rooms exist on most sites and the design treats them differently. Older rooms with simple thermostats get battery sensors. Rooms whose refrigeration controllers have an RS485 port get a licensed gateway that reads the controllers directly, which also brings defrost, fan and alarm states that a stand-alone sensor cannot see.

• Retrofit path: a LoRaWAN temperature sensor with an external probe in each room and a LoRaWAN door contact on the door. A LoRaWAN gateway forwards their frames to Hermetry's own network server (EU868, OTAA, class A), and the codec library decodes common temperature, door and leak sensors; a missing model can get its own codec, checked on a test bench.
• Controller path: a licensed gateway running Hermetry Edge on the refrigeration panel reads each room controller and the compressor rack controller over Modbus RTU, and an energy meter on the same line. It sends everything over MQTT with TLS on one outbound connection.
• Uplink: the site network where IT allows an outbound connection on port 8883, otherwise a licensed 4G router with your own SIM. eSIM management from the platform is in development (Hermetry Connect).

Component	Role	Notes
LoRaWAN temperature sensor with probe	Air or product-simulant temperature	Probe on a cable through a gland, sensor body outside the room where possible. Battery chemistry rated for the room temperature.
LoRaWAN door contact	Door open and closed	On change plus a periodic heartbeat.
LoRaWAN gateway	Radio coverage for the cold block	Basics Station connection to Hermetry; its own health is stored as telemetry.
Licensed gateway with Edge	Reads refrigeration controllers and meters	One per plant room or panel. Factory identity, claimed into your organisation.
Refrigeration controllers	Keep controlling rooms, defrost and fans	Read-only from Hermetry.

Licensed devices sign in with an X.509 certificate from the platform's own authority; third-party MQTT devices use an access token or a user name and password, and the profile can insist on TLS. A gateway reading ten room controllers reports each as a child device, so every room has its own readings, alarms and history over the gateway's one connection.

Point list

One chill room read through its controller, plus the shared plant points. Register numbers are placeholders; take them from the controller manual. Intervals are starting values.

Point	Telemetry key	Unit	Source	Interval	Notes
Room air temperature	air_temp_c	°C	Controller regulation probe, input register 30001	60 s	Return-air probe; reacts fast to doors.
Product simulant temperature	product_temp_c	°C	Probe in a glycol bottle, LoRaWAN sensor or controller aux input	5 min	Basis for product-safety alarms.
Evaporator temperature	evap_temp_c	°C	Controller defrost probe, 30002	60 s	Shows defrost end and iced coils.
Setpoint	setpoint_c	°C	Controller holding register 40001	15 min	Read only; reveals unauthorised changes.
Defrost active	defrost_on	bool	Controller status bit	60 s	Used to hold off high alarms.
Controller alarm	ctrl_alarm	code	Controller alarm register	60 s	Map codes to text in the runbook.
Door open	door_open	bool	Door contact, LoRaWAN or controller digital input	on change	Plus a heartbeat every 15 min.
Door openings	door_count	count	Door sensor counter, if it reports one	15 min	Daily openings from the increase.
Room humidity	rh_pct	%	LoRaWAN sensor	10 min	Chill rooms with fresh produce only.
Sensor battery	battery_pct	%	LoRaWAN sensor	with each uplink
Compressor rack suction pressure	suction_bar	bar	Rack controller, Modbus	60 s	Plant-level device.
Compressor running (per stage)	comp1_run, comp2_run	bool	Rack controller	60 s	Run fraction from the average.
Rack active energy	energy_kwh	kWh	Energy meter	15 min	Daily kWh from the increase.
Rack active power	power_kw	kW	Energy meter	60 s
Mains present	mains_ok	bool	Phase monitoring relay on a gateway digital input	on change	Separates a plant trip from a power cut.
Refrigerant leak detector	leak_ppm	ppm	Detector analog output to the gateway	60 s	Where a detector is fitted.
Controller communication	ctrl_comm_ok	bool	Gateway Modbus status	60 s	False when the gateway cannot read the controller.

Declare each key in the profile's Telemetry keys tab with label, unit, decimals and range. Freezers need a range down to −30 °C so gauges scale correctly.

Asset model

Model the cold chain as it is managed, not as the building drawing shows it. In Sites & Assets:

• Site (the plant or depot) with time zone, address, haccp_owner and site_code.
• Area for each cold block, for example Chill block or Freezer store, with product_class (chilled or frozen).
• Room for each cold room or freezer, with room_code, setpoint_c, volume_m3, criticality (A for finished goods, B for raw material, C for packaging) and probe_last_calibrated.
• Machine for the compressor rack and condensers, with refrigerant, charge_kg and contractor.

Place each room's devices on the room asset and the gateway, rack and meter on the plant room. Add a Feeds relation from the rack to each room it serves; when a rack fails, the board can show every room that depends on it. Placement also decides what a site's status and open-alarm counts include and which places' rules may act on a device.

Per-room limits belong on the room's devices as server attributes, for example max_temp_c = 5 and min_temp_c = −1 for a chill room, or max_temp_c = −15 for a freezer. Alarm rules read the attribute, so one rule set serves every room while each room keeps its own limit. Quality can change a limit without touching the rule, and the change is recorded.

Device setup

Profiles

Create one profile per kind of device: Chill room controller, Freezer controller, Compressor rack, LoRaWAN probe sensor and LoRaWAN door contact. A profile carries the transport and login rules, online rule, rate limits, keys, alarm rules and command catalog, so every room of the type behaves the same. Use the Recent message online rule with an expected interval that matches each device's reporting, and an inactivity alarm rule on top of it.

Provisioning and placement

Licensed gateways arrive with a factory identity; the administrator claims each by scanning its code or typing its claim details, then picks the profile and the plant-room asset. LoRaWAN sensors are added by their identity (DevEUI, JoinEUI) or imported in a batch, and join over the air. Label every sensor with its room code before installation: swapped sensors are the most common commissioning error.

Intervals, settings and deadband

On licensed gateways, remote device settings list the model's settings with their current values: serial parameters, Modbus addresses and polling intervals. Set one gateway from its Settings tab, then save it as a baseline and apply it to the other plant rooms with a bulk job that runs in waves and stops if too few gateways take the change. LoRaWAN sensors keep their own configuration; set their uplink interval with the vendor's tool before installation. Five or ten minutes is typical for product temperature, since a glycol-buffered probe changes slowly.

Air temperature is noisy around doors. If the gateway model supports a deadband, set a small one (for example 0.2 °C) with a 15-minute heartbeat; otherwise a deadband block in the profile's root flow can drop small changes before storage. Keep it well below the alarm hysteresis.

Time and buffering

A device that stamps its own readings needs a synchronised clock; readings more than ten minutes in the future are dropped, and a device without a reliable clock should let Hermetry stamp the arrival. Licensed gateways keep readings while the uplink is down, how many depends on the model. Late readings are stored and checked by the alarm rules as a backfill: an excursion that started and ended during the outage appears in the room's history, marked Backfilled, without paging anyone after the fact.

Firmware

Signed gateway firmware rolls out from the profile in waves, one plant room first, with a soak time; a failed gate pauses the rollout.

Dashboards

Install the Sensor regions solution as a starting point: it brings a temperature and humidity sensor profile with per-device limit attributes, a regions board with each region's sensors on its floor plan, a sensor page with its chart and alarms, and an alarm list. Rename regions to cold blocks and adapt it. A typical set:

Board	Audience	Widgets and what they show
Cold chain overview	Supervisors, site manager	Floor plan of the cold block with each room's sensor coloured by alarm state; table of rooms with air and product temperature, door state and last reading; stat cards for open alarms and rooms offline; alarm table of open alarms. Shown on a screen in the dispatch office through a read-only display link.
Room page	Supervisors, technicians	Gauges for air and product temperature with the limits as ranges; state cards for door, defrost and cooling; line chart of air, product and evaporator temperature over 48 hours; alarm list of the room; activity feed. Opened by clicking a room, with the room as a parameter.
HACCP daily review	Quality	Table of rooms with yesterday's minimum and maximum product temperature from day aggregates, the number of excursions and the latest acknowledgement; history table that downloads to Excel for the monthly file.
Refrigeration health	Technician, contractor	Bar chart of daily defrosts and compressor run fraction per stage; line chart of suction pressure and discharge temperature; daily kWh of the rack against the previous period; heatmap of door openings by hour and weekday.

SCADA screens

A drawing of the cold block helps the technician more than the supervisor. Draw one per block layout: rooms laid out as on site, each with its unit cooler, door and probe, and the compressor rack and condenser on the plant side, joined by pipe connections.

• Symbols: cold room, unit cooler, refrigeration compressor rack, refrigeration condenser, blast freezer and climate logger symbols come from the food family of the Food and pharma pack; door symbols from the Building pack. See the SCADA library.
• States: the unit cooler shows cooling, defrost and fault from cooling_on, defrost_on and ctrl_alarm; a door symbol turns amber while door_open is true; each room prints air and product temperature beside its symbol.
• Rules: a colour rule turns a room label red when product temperature passes its limit and makes it blink while the alarm is open; a show and hide rule displays a defrost icon only during defrost.
• Reuse: build the drawing once per block layout and attach it as a view of each site; Match everything proposes a device for every unbound symbol.

Before applying, clear the designer's Problems tab: it lists unbound symbols and rules that can never match.

Rules and alarms

The main design problem in cold rooms is not the threshold but the time. Air temperature spikes each time a door opens and rises during every defrost; product temperature hardly moves. Alarm on product temperature for food safety, on air temperature for equipment faults, and hold the equipment alarms off during defrost.

Alarm	Condition	Delay and hysteresis	Severity	Notified	Escalation
Product temperature high	product_temp_c > attribute max_temp_c	Debounce 2 samples raise, 2 clear; hysteresis 0.5 °C	Major	Shift supervisors, push and in-app	Reminder every 15 min until acknowledged
Product temperature critical	product_temp_c > attribute crit_temp_c	Debounce 2 samples	Critical (second severity of the same rule)	Supervisor and quality, SMS and push	Severity rise notifies again; reminder every 10 min
Air temperature high, not in defrost	all: air_temp_c > attribute air_max_c, defrost_on == false	Debounce 20 min; hysteresis 1 °C	Minor	Technician, e-mail and in-app	Reminder every 60 min
Freezer too warm	air_temp_c > −12 on the Freezer profile	Debounce 30 min	Major	Supervisor and technician, SMS	Reminder every 15 min
Room too cold	product_temp_c < attribute min_temp_c	Debounce 3 samples; hysteresis 0.5 °C	Minor	Supervisor, push	None
Door open too long	door_open == true	Debounce 10 min (20 min in freezers with strip curtains)	Warning	Supervisor, push	Reminder every 10 min
Refrigerant leak	leak_ppm > 500, agree the value with the safety assessment	Debounce 60 s	Critical	Site manager and technician, SMS	Reminder every 10 min
Power lost to plant	mains_ok == false	Debounce 30 s	Critical	Site manager, SMS	Reminder every 10 min
Sensor silent	Inactivity rule, no message for 30 min		Major	Supervisor, push	Reminder every 60 min
Battery low	battery_pct < 20	Debounce 1 sample; hysteresis 2 %	Warning	Facilities, e-mail	None

Excursions that last. Debounce by seconds is measured on the readings' time stamps, so it advances only when samples arrive. For an escalation such as product above limit for 30 minutes, write a rule in the block's Rules card: when product_temp_c is above 5 and stays so for 30 minutes, then raise a Critical alarm excursion_30min and notify the site manager. That wait is a timer that survives restarts and is cancelled as soon as a reading ends the condition.

Lifecycle. An alarm opens when its condition holds through the debounce and clears itself when the condition no longer holds. Only one alarm per room and type is open at a time; repeated trips count as occurrences on it. The person who takes the alarm acknowledges it and can add a note, for example stock moved to room 4 at 02:40, which stays on the alarm's timeline next to the opening, notifications and resolution. Acknowledgements are written to the audit log with the person and time. Each rule can carry a runbook: what to check on the controller, when to move stock and who to call.

Maintenance and cleaning. Mute a room's devices before planned defrost cleaning or a contractor visit. Alarms still open and close and are marked as muted, but nobody is paged; a mute ends by itself and lasts at most 90 days.

Floods. A power cut warms every room at once. Keep mains failure as the one Critical alarm that explains them, and room alarms at Major with their delays. Above 20 alarm notifications a minute, Hermetry collects the rest into a five-minute digest.

Automation and integrations

• Rolling average for door-heavy rooms: in the room profile's root flow, a statistics block computes a 15-minute average of air_temp_c and a save block stores it as air_temp_avg15_c. Alarm on the average in dispatch rooms where doors open every few minutes.
• Excursion record to quality: a flow that receives alarm events can post each excursion_30min alarm to the quality system through an HTTP request, or the signed webhooks alarm.created, alarm.acknowledged and alarm.cleared can feed it directly.
• Reports: history tables download to Excel for the monthly HACCP file. Scheduled or e-mailed reports are not built in today.
• Setpoints: keep setpoint and defrost changes on the controllers. Commands and settings for devices behind a gateway are in development; Hermetry reads the setpoint so unauthorised changes are visible.

If the site uses a licensed router, an engineer can open its web panel from the device page through router remote access, in time-limited, audited sessions, without a fixed IP or VPN.

Roles and access

Who	Role or group	Can
Shift supervisor	User	See all rooms, acknowledge alarms and add notes, use personal boards.
Quality assurance	User + IoT viewer group	Read every room, alarm and history, download tables, verify review notes; no changes.
Refrigeration technician	User + IoT operator group	See devices and write their attributes, such as room limits agreed with quality.
Contractor	User, narrowed by an attribute-based policy	See only the plant and room devices of the sites under contract.
Platform administrator	Admin	Profiles, alarm rules, boards, mutes, firmware, members.

Attribute-based policies can narrow a member down to single devices, so one organisation can hold several sites with access per site. The audit log records sign-ins, role changes, alarm acknowledgements and clearances, mutes, setting changes and firmware actions in a hash chain that Verify checks, and exports as CSV or NDJSON for the auditor.

Sizing and data

As an order of magnitude for three sites with 40 rooms in total, half read through controllers and half through LoRaWAN sensors:

• Controller rooms: 4 gateways reading 20 room controllers, one message per controller per minute, 20 × 1,440 = 28,800 messages a day.
• LoRaWAN rooms: 20 probe sensors every 5 minutes, 20 × 288 = 5,760, plus 20 door contacts with about 100 changes and heartbeats a day, 2,000.
• Plant devices: 3 racks and meters at one message a minute, 4,300.
• Total: roughly 41,000 messages a day, about 1.25 million a month. Commands, alarms and connection events do not count toward the monthly allowance; telemetry and attribute messages do.
• Values: about 10 keys in each controller and plant message and 2 to 3 in each sensor message, roughly 350,000 values a day, around 130 million a year.

The plan's retention class (7, 30, 90, 365 or 1,095 days) sets history length: raw readings are kept for at most 90 days, minute aggregates for up to 31 days, and hourly and daily aggregates for the full class, which serve long-range charts. Food safety files often need two years or more: choose a class whose hourly and daily aggregates cover it, and export monthly tables of the readings into the quality archive within the raw window. Resolved alarms are kept 365 days by default, adjustable in the alarm settings.

Rollout plan

Phase	Weeks	Work	Exit criteria
0. Survey	1	List rooms, controllers and ports; radio survey of the cold block with a test sensor; agree limits and delays with quality.	Signed room list with limits, probe positions and connection path per room.
1. Pilot	2-4	One chill room, one freezer, the rack. Profiles, alarm rules, Sensor regions board adapted, one drawing.	Two weeks of readings without gaps; every alarm forced and acknowledged; probe readings within ±0.5 °C of a reference thermometer.
2. Site	5-7	All rooms of the pilot site; HACCP review board; contractor access.	Quality signs daily review from Hermetry for two weeks in parallel with paper; nuisance alarms under an agreed level, for example one per room per week.
3. Estate	8-14	Remaining sites, one per week; baselines for gateway settings; webhooks to the quality system.	All rooms online; weekend alarm drill passed on each site; paper sheets retired where quality agrees.

Commissioning checklist

1. Every device claimed or joined, on the right profile, placed on the right room asset; room code on the label matches the asset.
2. Each probe compared with a calibrated reference thermometer in the same position; record the offset; correct it in the sensor or the controller, not in the dashboard.
3. Each door opened and closed: door_open changes with the right sense, and the door alarm opens after its delay.
4. A defrost started by hand: defrost_on goes true and the air-temperature alarm stays quiet.
5. Every product alarm forced, for example by warming the simulant bottle: the alarm opens, the right people are notified, acknowledgement with a note works, and the alarm clears.
6. Time stamps checked against the controller display and the site time zone.
7. Gateway uplink unplugged for 30 minutes: the offline alarm opens and the buffered readings fill the gap afterwards.
8. LoRaWAN signal checked with doors shut and the room full of stock, not empty.

Pitfalls

• Probe in the coil's air stream. It reads the evaporator, not the room. Mount it in the return air, and put the product simulant where the stock is.
• Air-temperature alarms with no defrost logic. Every defrost becomes an alarm and staff learn to ignore them. Combine the threshold with defrost_on == false, or alarm on product temperature.
• Testing radio in an empty room. Insulated steel panels and full racks block radio. Survey with the doors shut and stock in place, and use an external antenna or a probe cable through the wall where needed.
• Ordinary batteries in freezers. Capacity falls at −25 °C. Use cells rated for the temperature or keep the sensor body outside.
• Alarms that clear before anyone looks. A short excursion resolves itself overnight and nobody reviews it. Make the morning review include resolved alarms with no acknowledgement.

What Hermetry does not replace

Hermetry monitors and records. Refrigeration control, defrost, high-pressure cut-outs and refrigerant safety stay in the controllers and hard-wired protection. Any person-trapped alarm in a freezer must remain a hard-wired safety device. The HACCP plan, corrective actions and the decision to release or destroy stock stay with quality; Hermetry supplies the readings, alarms and notes they rely on.