The cold chain has a floor: the freeze nobody's watching for

It's a Tuesday afternoon at a regional immunization depot in Manitoba, and the walk-in freezer has read −18 °C all week without a single alarm. Nothing in the log looks unusual — until a routine shake test on one flagged lot comes back positive: frozen, then thawed, weeks ago. Every dose in that lot is now waste, and the freezer's own continuous record never once flagged it.

Nobody overrode a protocol, and nobody ignored an alarm — there wasn't one to ignore. Most cold-chain monitoring is built to catch heat, not the freeze that actually happened here — and freezing is a pervasive, systematically overlooked failure with no visible tell. A rule that only fires above a ceiling is structurally blind to the failure below it.

This post is about that floor: why it's a pervasive, overlooked failure in temperature-sensitive medicine, why it stays invisible until it's forensic, and the three guards that close the gap before a lot is lost, not after.

Cold chain was built to watch the ceiling

Every temperature-sensitive drug or vaccine ships inside a validated corridor with two edges, not one — a ceiling and a floor. Cold-chain practice has spent decades tuned to guard only the first.

PATH's systematic review of vaccine freeze exposure found that 14–35% of the refrigerators and shipments it examined exposed vaccine to freezing, and in studies that tracked every distribution segment, 75–100% of shipments hit at least one freeze event (Matthias et al., Vaccine, 2007). The review's own framing is blunt about why: practice guards against heat "often at the risk of exposure to freezing temperatures" — a problem it calls largely overlooked.

The instinct isn't irrational. Heat visibly spoils things, so a warm reading is easy to picture as a failure. Freezing doesn't announce itself the same way, and the reflex that protects against one direction leaves the other direction unguarded by default.

"Looks fine, already worthless"

The gap compounds because freeze damage has no visual tell. Frozen-then-thawed insulin can look completely normal after thawing and still be permanently degraded (American Diabetes Association, Safe Storage of Insulin, 2018). For adsorbed vaccines, the only way to confirm freeze damage after the fact is the WHO shake test — accurate, but run after a freeze is already suspected, not a way to prevent one (WHO, How to monitor temperatures in the vaccine supply chain).

That's the operational trap. Without monitoring that watches the freeze side specifically, the first signal is a failed potency assay or a technician's shake test — found lots or weeks after the dose was already dead, not in the moment it happened.

The freezing floor: three guards for the blind spot

Guarding the floor isn't one more alarm bolted onto the existing setup. It's three specific things a heat-only rule structurally can't do.

1. A floor threshold, not just a ceiling. A symmetric lower-bound rule fires the moment a reading crosses 0 °C, or the product's own floor — the same way a ceiling rule fires on heat. Most configured monitoring has never had one.
2. A probe in the product, not just the unit's own air sensor. A fridge or a reefer reports its own air; product against the cold wall, the evaporator, or an ice pack can freeze while the unit's average reads fine. Regulators already name this exact placement risk — Canada's own vaccine storage guidance singles out the floor of the fridge, warning that vaccine must never sit in the door shelves or the crisper bins because temperature near those surfaces "is not stable" (Public Health Agency of Canada, Canadian Immunization Guide). The same logic scales to a distribution freezer or a reefer: the unit's sensor sits in the unit, not in the product.
3. A rate-of-change watch, not just a limit. A reading falling fast toward zero is the tell that a unit is failing or a door is open, and it shows up before the absolute limit is breached — while it's still a save, not a loss.

Why the floor is also an audit finding

In Canada this isn't only an operational risk — it's a Good Manufacturing Practices question. Health Canada's guidance on environmental control of drugs (GUI-0069) requires storage refrigerators and freezers to carry sensors for continuous monitoring wherever temperature is most likely to deviate, and requires transport vehicles and containers to be temperature-mapped and monitored the same way.

An excursion isn't automatically disqualifying — Health Canada allows one to be accepted with documented scientific justification. But an excursion nobody detected is a different problem: there's no record to justify and no data to investigate.

Unlike the EU, Canada doesn't split this into a separate "Good Distribution Practice" regime. Distributors and wholesalers answer to the same GMP framework as manufacturers (Health Canada, GMP/establishment-licensing enforcement policy), so a gap found at a depot or a courier is a GMP-relevant finding, not a lesser distribution-only lapse.

The record an auditor actually wants isn't a daily average, either. Mean kinetic temperature (MKT) — an Arrhenius-weighted "effective" temperature that always reads at or above the arithmetic mean — paired with time-out-of-range shows cumulative thermal stress, the same pairing behind a defensible cold-chain record (ICH Q1A; USP General Chapter <1079.2>). A report that hands over only a min/max isn't speaking the language the disposition decision needs.

A quick self-audit for your cold chain

• Does your monitoring have a floor alert, or only a ceiling — would a reading of −0.5 °C fire anything at all?
• Is at least one probe in the product — a carton, a tray, a vial rack — or only on the unit's own air sensor?
• Would a fast rate-of-change toward zero get flagged before the absolute limit is crossed, or only after?
• If an auditor asked for transport temperature mapping tomorrow, the way GUI-0069 expects, could you produce it — or only the storage side?
• Is your exportable record MKT and time-out-of-range, or a daily average that can hide a brief but real excursion?

If any answer is soft, that's where the next silent freeze is coming from — and every one of these is fixable before a lot is lost, not after.

How Navixy does it, without overpromising

None of this depends on one sensor brand — the floor is a discipline you can demand of any monitoring setup, calibrated and placed correctly. To be concrete about the mechanism: Navixy configures the freeze floor as a lower-bound IoT Logic rule running alongside whatever ceiling rule is probably already there, evaluated against a probe placed in the load or the rack rather than only the unit's own return air.

The same flow watches the slope. A rate-of-change rule catches a reading falling fast toward zero — a failing compressor, an open door, a depleted coolant — while there's still time to move the product, not just log what happened to it.

IoT Query rolls the continuous series into mean kinetic temperature and time-out-of-range per shipment or storage unit, and exports it through an open API into a quality system — the same defensible-record logic built for produce, adapted here to a GMP audit trail instead of a good-delivery dispute.

Navixy produces the record Health Canada's continuous-monitoring guidance calls for; it does not certify GMP compliance. That determination stays with the manufacturer, distributor, and their quality system — the platform's job is making sure the data those roles need was actually captured, floor included.

Your next step

Don't wait for a shake test to tell you what already happened. Check whether your monitoring has a floor as well as a ceiling: a lower-bound rule, a probe in the product, and a rate-of-change watch on the way down. If the answer is no, that's the gap the next silent freeze will find first.