Skip to content
allanninal.dev/build
Collaborate

Part 2 of 7 · Cold chain monitor series ~5 min read

How a reading becomes a record

Recording temperature is the part everyone assumes is trivial, and the decisions made here determine whether the record is any use in an investigation six months later.

Key takeaways

  • Sample every few minutes. Hourly readings cannot tell a door opening from a failure.
  • Timestamp at the sensor and record the arrival time separately.
  • A missing reading is written as a gap record, not left as an absence.
  • The store is append-only; corrections are new records with a reason.
  • Keep readings at full resolution for the period an inspector might ask about.

How often

How sampling interval determines the blind period between temperature readingsA stacked bar chart with four bars measured in minutes. Two series: the reading itself in green, and minutes you cannot see per reading in red. Every sixty minutes leaves fifty-nine minutes blind. Every fifteen minutes leaves fourteen. Every five minutes leaves four. Every two minutes leaves one. A note says a ten-minute breach rule needs sampling well under ten minutes to be enforceable.020406080~60Every 60 min~15Every 15 min~5Every 5 min~2Every 2 minThe reading, minutesMinutes you cannot see, per readingA ten-minute breach rule needs sampling well under ten minutes to be enforceable.
Fig 1. Four sampling intervals and what each leaves invisible. A breach rule measured in minutes cannot be applied to readings taken in hours.

Five minutes is a reasonable default for most chilled and frozen storage. It is frequent enough to make a ten-minute breach rule meaningful, infrequent enough that battery life and data volume stay sensible, and it captures door openings as the short events they are rather than as mysterious single spikes.

Transport is a different case and usually wants longer intervals for battery reasons, with the trade-off stated explicitly rather than absorbed: at fifteen-minute sampling, a ten-minute breach rule cannot be enforced and the rule should change to match.

Two timestamps

The sensor’s own clock says when the reading was taken; the arrival time says when it reached the system. They differ, sometimes by hours when a device has been out of range and buffers its readings, and conflating them produces a record that says a freezer was fine at a time when nobody actually knew.

Both are stored. The chart is drawn on sensor time, because that is when the temperature was what it was. The alarm logic runs on arrival time, because you cannot alarm on something you have not received.

Gaps are records

How a temperature reading, or its absence, becomes a recordA vertical chain of five steps entered by a box labelled A reading is due, every five minutes. Step one asks whether it arrived within the grace period; if not it exits to Write a gap record, marking it missing rather than absent. Step two asks whether the value is plausible, within the sensor's range; if not it exits to Write it, flagged, and never discards a reading. Step three appends it with both timestamps. Step four asks whether gaps are accumulating, three in a row; if so it exits to Treat as a breach, failing closed. Step five records it as normal and carries on. A note says a discarded implausible reading is a decision nobody can review later.AWS ACCOUNTA reading is dueevery 5 minutesDid it arrive?within the grace periodWrite a gap recordmissing, not absentnoPlausible value?within the sensor's rangeWrite it, flaggednever discard a readingnoAppend itboth timestampsGaps accumulating?3 in a rowTreat as a breachfail closedyesNormalcarry onA discarded implausible reading is a decision nobody can review later.
Fig 2. How each expected reading is handled, including the ones that do not arrive. Writing gaps explicitly is what makes the record answerable.
  • Compute
  • Database
  • App integration
  • Machine learning
  • Security & identity
  • Management

Never discard

An implausible reading — minus two hundred degrees, or a value the sensor cannot physically produce — is stored with a flag rather than dropped. It is evidence about the sensor, and a series of them is the clearest possible sign that a device is failing.

Systems that filter these out silently produce clean-looking charts from equipment that is disintegrating, which is exactly backwards.

Append-only

Why temperature records are corrected by addition rather than editingA horizontal row of five boxes. A reading: written once. Wrong, due to a calibration error. Never edited, not once. A correction record, with a reason and a name. Both visible on the chart and in the export. A note says a temperature record that can be edited is a temperature record nobody has to believe.WHY NOTHING IS EVER EDITEDA readingwritten onceWrong?a calibration errorNever editednot onceA correction recordwith a reason and a nameBoth visibleon the chart and the exportA temperature record that can be edited is a temperature record nobody has to believe.
Fig 3. How corrections work. The original and the correction both survive, which is what makes the record usable as evidence.
  • Database
  • Security & identity
  • Analytics

This matters most in the situation it is designed for: an investigation where the question is what the temperature was and who knew. A store where records can be updated invites the question of whether they were, and there is no way to answer it after the fact.

How long to keep it

At full resolution for at least as long as the goods have shelf life, and in practice for a year or two, because the question usually arrives long after the event. The data is tiny — a few readings per unit per hour — and the storage cost of keeping everything is negligible next to the cost of not having it once.

Next: telling a spike from a failure.

All posts