The cold chain has a floor: the freeze nobody's watching for

PATH's systematic review of the vaccine cold chain found that 14–35% of refrigerators and shipments examined exposed vaccine to freezing, and in studies tracking a full distribution route, 75–100% of shipments hit at least one freeze event (Matthias et al., Vaccine, 2007).

Freezing is close to the default outcome of a system tuned to watch only one side of the range: most monitoring guards the ceiling and stops there. A rule that only fires above a line can't catch what happens below it, so a freeze can run for weeks inside a spotless-looking log and surface only once a shake test or a failed potency assay proves the dose is already dead.

Closing that gap takes three guards: a floor threshold as well as a ceiling, a probe in the product itself, and a rate-of-change watch that catches the drift before the breach.

This is the freezing floor — the three guards that make the lower bound as real a rule as the upper one, and the audit trail that proves it was watched.

Cold chain was built to watch the ceiling

Every temperature-sensitive drug or vaccine ships inside a validated corridor with two edges — a ceiling and a floor. Cold-chain practice has spent decades refining defenses for the first one.

The PATH review's own framing names why: guarding against heat comes "often at the risk of exposure to freezing temperatures" — a pattern the review itself calls largely overlooked. Heat spoils product visibly, so a warm reading reads as an obvious failure. Freezing doesn't announce itself the same way, and a reflex built for one direction leaves the other direction unguarded by default.

"Looks fine, already worthless"

The gap compounds because freeze damage has no visual tell. Frozen-then-thawed insulin can look completely normal after thawing and still be permanently degraded (American Diabetes Association, Safe Storage of Insulin, 2018). For adsorbed vaccines, the only way to confirm freeze damage after the fact is the WHO shake test — accurate, and run only once a freeze is already suspected, well after any chance to prevent it (WHO, How to monitor temperatures in the vaccine supply chain).

Without monitoring that watches the freeze side specifically, the first signal is a failed potency assay or a technician's shake test, arriving days or weeks after the dose died — long after the moment that actually mattered.

The freezing floor: three guards for the blind spot

Guarding the floor means three specific additions a heat-only rule structurally can't cover on its own.

1. A floor threshold as well as a ceiling. A symmetric lower-bound rule fires the moment a reading crosses 0 °C, or the product's own floor — the same way a ceiling rule fires on heat. Most configured monitoring has never had one.
2. A probe in the product, not just the unit's own air sensor. A fridge or a reefer reports its own air; product against the cold wall, the evaporator, or an ice pack can freeze while the unit's average reads fine. Regulators already name this exact placement risk — Canada's own vaccine storage guidance singles out the floor of the fridge, warning that vaccine must never sit in the door shelves or the crisper bins because temperature near those surfaces "is not stable" (Public Health Agency of Canada, Canadian Immunization Guide). The same logic scales to a distribution freezer or a reefer: what matters is the reading at the product, and that's rarely where the standard sensor sits.
3. A rate-of-change watch ahead of the limit. A reading falling fast toward zero is the tell that a unit is failing or a door is open, and it shows up before the absolute limit is breached, while there's still time to save the load.

Why the floor is also an audit finding

In Canada this isn't only an operational risk — it's a Good Manufacturing Practices question. Health Canada's guidance on environmental control of drugs (GUI-0069) requires storage refrigerators and freezers to carry sensors for continuous monitoring wherever temperature is most likely to deviate, and requires transport vehicles and containers to be temperature-mapped and monitored the same way.

Health Canada allows an excursion to be accepted, provided it comes with documented scientific justification. An excursion nobody detected is a different problem: there's no record to justify and no data to investigate.

Unlike the EU, Canada doesn't split this into a separate "Good Distribution Practice" regime. Distributors and wholesalers answer to the same GMP framework as manufacturers (Health Canada, GMP/establishment-licensing enforcement policy), so a gap found at a depot or a courier is a GMP-relevant finding in its own right.

The record an auditor actually wants is mean kinetic temperature (MKT) — an Arrhenius-weighted "effective" temperature that always reads at or above the arithmetic mean — paired with time-out-of-range, the same pairing behind a defensible cold-chain record (ICH Q1A; USP General Chapter <1079.2>). Together they capture the cumulative thermal stress a disposition decision needs; a min/max alone can't.

A quick self-audit for your cold chain

• Does your monitoring have a floor alert, or only a ceiling — would a reading of −0.5 °C fire anything at all?
• Is at least one probe in the product — a carton, a tray, a vial rack — or only on the unit's own air sensor?
• Would a fast rate-of-change toward zero get flagged before the absolute limit is crossed, or only after?
• If an auditor asked for transport temperature mapping tomorrow, the way GUI-0069 expects, could you produce it — or only the storage side?
• Is your exportable record MKT and time-out-of-range, or a daily average that can hide a brief but real excursion?

If any answer is soft, that's where the next silent freeze starts — and every one of these can be fixed well before a lot is lost.

How Navixy does it, without overpromising

None of this depends on one sensor brand — the floor is a discipline you can demand of any monitoring setup, calibrated and placed correctly. To be concrete about the mechanism: Navixy configures the freeze floor as a lower-bound IoT Logic rule running alongside whatever ceiling rule is probably already there, evaluated against a probe placed in the load or the rack rather than only the unit's own return air.

The same flow watches the slope. A rate-of-change rule catches a reading falling fast toward zero — a failing compressor, an open door, a depleted coolant — while there's still time to move the product instead of only logging what happened to it.

IoT Query rolls the continuous series into mean kinetic temperature and time-out-of-range per shipment or storage unit, and exports it through an open API into a quality system — the same defensible-record logic built for produce, adapted here to a GMP audit trail instead of a good-delivery dispute.

Navixy produces the record Health Canada's continuous-monitoring guidance calls for; it does not certify GMP compliance. That determination stays with the manufacturer, distributor, and their quality system — the platform's job is making sure the data those roles need was actually captured, floor included.

Your next step

Don't wait for a shake test to tell you what already happened. Check whether your monitoring has a floor as well as a ceiling: a lower-bound rule, a probe in the product, and a rate-of-change watch on the way down. If the answer is no, that's the gap the next silent freeze will find first.