Temperature monitoring for medicine fridges, freezers and stores

At a glance

Item	Typical answer
Problem	Medicine fridges and stores are spread over many small sites, read by hand once or twice a day, and excursions are found too late to save the stock or to explain them.
What is connected	A probe in each fridge and freezer, ambient sensors in storerooms, door contacts and a power-fail signal, sent over LoRaWAN, Wi-Fi or cellular.
Who uses it	Pharmacists and nurses in charge of a site, the regional or chief pharmacist, the quality or responsible person, and facilities.
Typical first scope	Five to ten sites of one region with their fridges, plus the regional store.
Time to first screen	Typically within a day of the first sensor joining. Plan four to six weeks for a pilot that the responsible person is prepared to rely on.

The situation

A pharmacy chain, a hospital trust or a public health service stores vaccines and temperature-sensitive medicines in hundreds of pharmaceutical fridges at +2 to +8 °C, a smaller number of freezers at −25 to −15 °C, sometimes ultra-low freezers, and ambient stores held at 15 to 25 °C. Many fridges have a min/max thermometer that someone reads and resets each morning. Some have a stand-alone data logger that is downloaded once a month, if anyone remembers.

The failure modes are familiar: a door not fully closed after a busy session, a fridge unplugged by a cleaner, a thermostat drifting cold until the vaccines freeze, a summer weekend that pushes a storeroom past 25 °C. A min/max reading on Monday tells the pharmacist that something happened, not when or for how long, so the decision to quarantine or discard stock is made on incomplete evidence. Each lost fridge load costs money and, for vaccines, appointments.

This blueprint gives every storage unit a continuous record, alarms that reach a named person on and off duty, a structured way to handle each excursion, and a single view for the region and the quality function.

Goals and measures

• Coverage = storage units with a working sensor ÷ storage units that hold medicines. The first target is 100 % of vaccine fridges.
• Time in range per unit per month. Practical form: hours in the month minus the summed duration of temperature alarms (opened to resolved, read from the alarm list) ÷ hours in the month.
• Excursions per unit per month, split into short ones (resolved within the agreed tolerance, for example 30 minutes) and long ones that need a stock assessment.
• Time to acknowledge = acknowledged time minus opened time. Track it separately for working hours and nights.
• Daily minimum and maximum per unit, from the day aggregates, which replace the daily min/max entry.
• Data completeness = readings received ÷ readings expected for the unit's interval, so a silent sensor is not mistaken for a stable fridge.

Agree the limits and the tolerance with the responsible person in writing before the pilot. Typical starting values: fridges 2 to 8 °C, freezers −25 to −15 °C, ambient 15 to 25 °C, with the label conditions of the stored products taking precedence.

Architecture

Sites differ, so the design offers three ways in, chosen per site. All three arrive in Hermetry as devices with the same profile keys, so boards and rules do not care which path a fridge uses.

• LoRaWAN for sites with several units: battery temperature sensors with an external probe, door contacts, and one LoRaWAN gateway per site connected to Hermetry's own network server (EU868, class A, OTAA). The codec library decodes common temperature and door sensors.
• Direct MQTT or HTTPS for single-fridge sites: a Wi-Fi or cellular probe logger that publishes its readings with TLS on its own credentials.
• Licensed gateway for stores and hospital pharmacies with a building network or a monitored ultra-low freezer: a licensed gateway running Hermetry Edge reads freezer controllers or sensor modules over Modbus RTU or Modbus TCP and contacts on its digital inputs, and sends everything over one outbound MQTT connection with TLS.

Component	Role	Notes
Probe in glycol or a product-simulant bottle	Temperature that the medicine sees	One per fridge, placed among the stock, not against the back wall or in the door.
LoRaWAN temperature sensor	Sends probe and battery values	Sensor body outside the fridge, probe cable through the door seal or a port.
Door contact	Door open and closed	LoRaWAN or a gateway digital input.
Power-fail signal	Mains to the fridge circuit	A relay contact on a gateway input, or a sensor that reports external power.
LoRaWAN gateway	Site coverage	Mains with a small UPS, so the radio survives short power cuts.
Licensed gateway or 4G router	Uplink and Modbus reading	Your own SIM and operator; eSIM management from the platform is in development (Hermetry Connect).

Licensed devices prove their identity with an X.509 certificate from the platform's own authority. Third-party loggers use an access token or a user name and password; secrets are stored hashed, shown once and can be rotated or revoked. The device profile can require TLS and restrict the networks a device may connect from, which suits loggers on a hospital network with fixed egress addresses.

Point list

Per storage unit, plus site points. Names are a suggestion; use them unchanged on every site.

Point	Telemetry key	Unit	Source	Interval	Notes
Probe temperature	probe_temp_c	°C	Buffered probe, LoRaWAN or logger	5 min	Basis for every limit alarm.
Air temperature	air_temp_c	°C	Internal sensor of the same device	5 min	Diagnostic only; reacts to every door opening.
Door open	door_open	bool	Door contact	on change	Plus a heartbeat every 15 min.
Door openings	door_count	count	Door sensor counter, where reported	15 min	Openings per day from the increase.
Fridge power present	power_ok	bool	Relay contact or sensor external-power flag	on change
Sensor battery	battery_pct	%	Sensor	with each uplink
Freezer cabinet temperature	cabinet_temp_c	°C	Freezer controller, Modbus input register 30001	60 s	Ultra-low and laboratory freezers.
Freezer setpoint	setpoint_c	°C	Freezer controller, holding register 40001	15 min	Read only.
Freezer controller alarm	ctrl_alarm	code	Freezer controller alarm register	60 s
Room temperature	room_temp_c	°C	Ambient LoRaWAN sensor	10 min	One per mapped zone of a store.
Room humidity	room_rh_pct	%	Ambient LoRaWAN sensor	10 min	Where label conditions limit humidity.
Store door	store_door_open	bool	Door contact	on change
Site mains	mains_ok	bool	Phase monitoring relay, gateway input	on change	Separates a site power cut from one fridge unplugged.
Gateway link quality	link_ok	bool	Gateway status	5 min	Tells a radio problem from a fridge problem.

Declare each key in the profile with unit, decimals and range, for example −30 to +30 °C for probes, so gauges and charts scale the same on every site. Record each sensor's calibration date and certificate number as server attributes such as cal_due and cal_cert; an attributes card on the unit page shows them beside the readings.

Asset model

• Region (a free kind) with regional_pharmacist and region_code.
• Site (pharmacy, clinic, ward or store) with address, location, time zone, site_code, opening_hours and responsible_person.
• Room where a store or a dispensary has several rooms, with storage_class (ambient, cold) and mapping_report.
• Unit (Machine kind, or a free kind called Storage unit) for each fridge and freezer, with unit_type, model, serial, capacity_l and contents (vaccines, insulin, general).

Place each sensor on its unit asset and site devices such as the LoRaWAN gateway or the power relay on the site. The tree then drives the site table, each site's alarm count and status, and the rules each place may run. It also makes access easy to express: a site's pharmacist is given the site's devices, the regional pharmacist the region's.

Put limits on the device as server attributes, for example low_c = 2 and high_c = 8 for a fridge or high_c = −15 for a freezer. Rules then read the attribute, and an insulin fridge and an ambient cabinet share the same rule set. Limits can also be written from another system through the API, which helps when a central product catalogue sets them.

Device setup

Profiles

Make one profile per device kind: Medicine fridge probe (LoRaWAN), Medicine fridge logger (MQTT), Freezer controller (via gateway), Ambient store sensor and Site gateway. Each holds keys, units, alarm rules, online rule and rate limits for every device of the kind. Use the Recent message online rule with an expected interval that matches the sensor, so the device list shows a silent sensor as offline, and add an inactivity alarm rule.

Provisioning

Licensed gateways are claimed into the organisation by scanning their code; nobody types credentials on site. LoRaWAN sensors are registered by their identity and join over the air; for a rollout of hundreds, import them in a batch from the supplier's list together with the site and unit they are destined for. Third-party loggers that register themselves through a profile's provisioning key wait in quarantine until an administrator checks them and activates them.

Intervals and settings

Five minutes is a sound interval for buffered probes; one minute adds little because the probe lags the air by design. For licensed gateways, remote device settings show the model's settings, including polling intervals and serial parameters; set one, save it as a baseline and apply it to every store gateway with a bulk job in waves. Third-party sensors keep their own configuration tools.

Clocks, gaps and late data

Readings with the device's own time stamp need a synchronised clock; anything more than ten minutes ahead is dropped. Devices without a reliable clock should omit the time stamp. Licensed gateways buffer readings while their uplink is down; some third-party sensors and loggers can also resend stored readings, check the model before relying on it. When late readings arrive, Hermetry stores them and evaluates alarm rules on them as a backfill: an excursion during the outage appears in the history, marked Backfilled, so the record is complete without a late page.

Firmware

Gateway firmware is signed and assigned to the profile, then rolled out in waves with a soak time between them. Units on mobile data wait for a download unless metered downloads are allowed.

Dashboards

Board	Audience	Widgets and what they show
Region overview	Regional pharmacist, quality	Map of sites coloured by status; site table with units, open alarms, unacknowledged alarms and last reading; stat cards for units out of range and sensors offline; alarm table of open alarms across the region.
Site page	Pharmacist in charge	One state card per unit (in range, alarm, offline); gauges for each probe with the limits as ranges; line chart of probe temperatures over 7 days; door and power states; alarm list of the site with acknowledge from the alarm page.
Unit record	Pharmacist, quality	Attributes card with model, serial, contents and calibration due date; line chart of probe and air temperature; daily minimum and maximum table from day aggregates, downloadable to Excel; alarms of the unit with their timelines.
Excursion review	Quality	Alarm table filtered to temperature alarm types and the last 30 days, with opened, acknowledged and resolved times and occurrences; key filters for units still out of range.
Fleet health	Facilities, IT	Device table with connection state, battery and last seen; progress cards of sensor batteries; LoRaWAN gateway health.

Entity parameters let one site page serve every site, opened from the region overview by drill-down, and let the unit record follow any unit. A read-only display link can show the site page on a screen in a hospital pharmacy without anyone signing in; it expires after the chosen period and can be revoked per screen.

SCADA screens

Most medicine storage needs no process drawing; boards cover it. Two cases benefit from one:

• Central stores and hospital pharmacies: a floor plan drawing of the store with each fridge, freezer and room sensor in place. Ultra-low freezer, stability chamber and incubator symbols come from the pharma family of the Food and pharma pack; door symbols from the Building pack. Colour rules turn a unit red when its probe passes its limit and blink while the alarm is open.
• Multi-room sites: attach the drawing as a site view and let Match everything propose a device for each symbol. A 3D view made from the drawing keeps the bindings and can tint rooms by the worst status of their devices, if the devices report a status key.

See the SCADA library for the packs. Keep drawings for sites where location matters; a pharmacy with two fridges is better served by its site page.

Rules and alarms

Alarm on the buffered probe, never on the air sensor, and give each unit its limits through attributes. Two severities on one rule let a near miss and a real excursion follow the same alarm.

Alarm	Condition	Delay and hysteresis	Severity	Notified	Escalation
Temperature high	probe_temp_c > attribute high_c (Major); > attribute high_crit_c (Critical)	Debounce 2 samples raise, 2 clear; hysteresis 0.3 °C	Major / Critical	Site staff by push and in-app; Critical also SMS to the pharmacist in charge	Reminder every 15 min until acknowledged; rise to Critical notifies again
Temperature low	probe_temp_c < attribute low_c	Debounce 2 samples; hysteresis 0.3 °C	Major	Site staff, push and SMS	Reminder every 15 min
Freezing risk	probe_temp_c < 0.5 on the fridge profile	Debounce 1 sample	Critical	Pharmacist in charge, SMS	Reminder every 10 min
Excursion longer than tolerance	Rules card: probe above high_c and stays so for 30 min	Timer in the rule	Critical	Regional pharmacist and quality, SMS and e-mail	Reminder every 30 min
Door left open	door_open == true	Debounce 5 min	Warning	Site staff, push	Reminder every 5 min
Fridge power lost	power_ok == false	Debounce 60 s	Major	Site staff and facilities, push and SMS	Reminder every 15 min
Ambient store out of range	room_temp_c > 25 or < 15, from attributes	Debounce 20 min; hysteresis 0.5 °C	Minor	Store lead, e-mail and in-app	Reminder every 60 min
Sensor silent	Inactivity rule, 30 min		Major	Site staff, push; facilities by e-mail	Reminder every 60 min
Battery low	battery_pct < 20	Hysteresis 2 %	Warning	Facilities, e-mail	None

Out-of-hours routing. Alarm rule recipients are users, roles or plain e-mail addresses, and a rule sends on its chosen channels whatever the hour. Per-person preferences and quiet hours can hold back non-critical notifications; Critical ones are delivered regardless by default. For a different message out of hours, add a Rules card rule: when the temperature alarm is raised, only if the time is outside opening hours, then notify the regional on-duty pharmacist. There are no on-call rotations for IoT alarms; keep the on-duty list as a group or role and update its members.

Handling an excursion. The person who takes the alarm acknowledges it and writes what they did as a note, for example: door found ajar, closed 21:14, stock quarantined pending assessment. Notes, notifications, severity changes and resolution stay on the alarm's timeline, and acknowledging or resolving is also written to the audit log under the person's name. Each rule carries a runbook: check the door and power, move stock to the backup fridge, quarantine, call the regional pharmacist. The alarm clears itself when the probe returns within limits plus the hysteresis.

Review of short excursions. An excursion that clears before anyone acknowledges it still stays in the alarm list as resolved without an acknowledgement. Make the morning check include those, so every excursion gets a reviewed note.

Maintenance. Mute a unit while it is defrosted, cleaned or moved; alarms still record, marked as muted, but nobody is paged. A mute ends by itself and never lasts longer than 90 days.

Floods. A regional power cut can raise power and temperature alarms at dozens of sites within minutes. Keep site mains at Major and unit temperatures on their own delays. Beyond 20 alarm notifications a minute, the rest are bundled into a five-minute digest.

Automation and integrations

• Quality system: the signed webhooks alarm.created, alarm.acknowledged and alarm.cleared carry each excursion to a deviation or CAPA system, which opens the record and links back to the alarm.
• Pharmacy or stock system: a flow can post a Critical excursion to an HTTP endpoint of the stock system to block the affected unit's stock from dispensing until released; the release stays a human decision in that system.
• Limits from the product catalogue: a central system writes low_c and high_c as server attributes through the REST API with an API key limited to that permission and an expiry date.
• Monthly records: the unit record's daily table and the readings history download to Excel for the site file. Scheduled or e-mailed reports are not built in today. If quality wants mean kinetic temperature, compute it from the exported hourly data in a tool that quality has validated.
• Commands: none in this design. Fridges and freezers keep their own controls.

Roles and access

Who	Role or group	Can
Site staff	User, narrowed by a policy to their site	See their site's units and alarms, acknowledge and add notes.
Pharmacist in charge	User, narrowed to their site	As site staff; reviews short excursions.
Regional pharmacist	User + IoT viewer group, narrowed to the region	See every site of the region, history and alarm timelines.
Quality or responsible person	User + IoT viewer group	Read all records, export tables, read the alarm history.
Facilities	User + IoT operator group	See devices, batteries and gateways; write limit attributes only when quality has approved them.
Platform administrator	Admin	Profiles, alarm rules, boards, mutes, members, firmware; reads and exports the audit log.

Attribute-based policies narrow access down to single devices, so a pharmacist sees only the units of their own site. A health service that runs several legally separate organisations can give each its own organisation, isolated by row-level security, with one account holding memberships in several. Single sign-on through SAML or OIDC, two-factor authentication and passkeys are available for the members.

The audit log records sign-ins, role changes, alarm acknowledgements and clearances, mutes, attribute and setting changes in a hash chain that Verify checks; it exports as CSV or NDJSON. These records support an inspection, but Hermetry is not validated for any regulated use out of the box: if your procedures need a validated computerised system, the validation, the procedures around it and the decision what counts as the official record are the customer's responsibility.

Sizing and data

As an order of magnitude for 200 sites with 600 fridges and freezers and 60 ambient sensors:

• Probes: 600 × 288 readings a day at a 5-minute interval = 172,800 messages a day.
• Ambient sensors: 60 × 144 at 10 minutes = 8,640.
• Door contacts and power: allow 50 changes and heartbeats per unit a day, 600 × 50 = 30,000.
• Total: about 211,000 messages a day, roughly 6.4 million a month. Commands, alarms and connection events do not count against the monthly allowance.
• Values: two to three per message, about 550,000 a day and 200 million a year.

The plan's retention class, from 7 days up to 1,095 days, sets history length: raw readings are kept for at most 90 days, minute aggregates for up to 31 days, and hourly and daily aggregates for the full class, which long-range charts use. Storage records in medicine supply are often kept for several years; pick the class whose aggregates cover them and archive monthly exports of the readings within the raw window. Resolved alarms are kept 365 days by default and the setting can be raised. The plan warns at 80 % and 100 % of the monthly allowance and never stops devices for exceeding it.

Rollout plan

Phase	Weeks	Work	Exit criteria
0. Prepare	1-2	Inventory of units per site; limits and tolerance agreed with the responsible person; sensor model chosen and its accuracy and calibration checked.	Signed inventory, limits and excursion procedure.
1. Pilot	3-8	Five to ten sites and the regional store; profiles, alarm rules, boards, webhook to the quality system.	Four weeks of complete data; every alarm type forced and handled; sensor readings within the agreed tolerance of a calibrated reference; staff trained.
2. Region	9-12	All sites of the region; batch import of sensors; policies per site.	Coverage 100 % of vaccine fridges; nuisance alarms under one per unit a month; time to acknowledge within the procedure.
3. Network	13-26	Remaining regions, two to four a month.	Min/max sheets retired where the procedure allows; quarterly review of excursions and silent sensors in place.

Commissioning checklist

1. Sensor joined, on the right profile, placed on the right unit asset; unit serial in the attributes matches the label.
2. Probe placed among the stock in its buffer, cable not pinching the door seal; the door closes fully.
3. Reading compared with a calibrated reference thermometer at the fridge setpoint; difference within the agreed tolerance; calibration due date recorded.
4. Limit attributes present on the device; a device without a limit attribute is not checked for that limit.
5. Door opened for longer than the delay: alarm opens, staff notified, acknowledgement with a note works.
6. Fridge unplugged briefly: power alarm opens; plugged in again: alarm clears.
7. Probe warmed in the hand above the high limit: Major then Critical, reminders arrive until acknowledged.
8. Sensor or gateway disconnected for 40 minutes: silent-sensor alarm opens; data returns after reconnection where the device buffers.
9. Out-of-hours notification tested once at night with the real on-duty person.

Pitfalls

• Probe in air. It alarms at every door opening. Use a buffered probe and alarm on it.
• Missing limit attributes. A rule that reads high_c skips devices that do not have it. Check the attributes in the device table before go-live.
• Sensors that move. Units are swapped and sensors travel with them. Update the placement and the unit record at the same time.
• Everyone notified about everything. Staff mute the app. Send site alarms to the site, and only long or Critical excursions to the region.
• Unreviewed short excursions. They clear by themselves at night. Make reviewing resolved, unacknowledged alarms part of the morning routine.
• Calibration forgotten. A drifting sensor produces a perfect-looking record. Keep the due date on the device and review it quarterly.

What Hermetry does not replace

Hermetry monitors, alerts and records. The fridges and freezers keep their own controls and alarms. Decisions to quarantine, use or destroy stock, the excursion procedure, calibration of the sensors and any validation of the system remain with your responsible person and quality function. Hermetry does not claim compliance with any regulation for medicine storage; it supplies the readings, alarm timelines, notes and audit records that your procedures can use.