Cold-Chain Datalogger: Multi-Point T/H, PLP & Readout
← Back to: IoT & Edge Computing
A cold-chain datalogger is only valuable when its numbers are trustworthy and auditable: multi-point T/RH sensing must reflect the real product temperature, survive condensation and low-temperature power limits, and preserve the last minutes with PLP and append-only logs. The design focus is evidence-driven—prove placement, power integrity, and data integrity so excursions can be verified, not just recorded.
What is a Cold-Chain Datalogger (and boundary)
A cold-chain datalogger is defined by an engineering closed-loop: multi-point temperature/humidity sensing, device-level timestamping, durable logging, and a verifiable readout path. The focus here is the datalogger itself—not gateway/cloud workflows or network-wide time synchronization algorithms.
A cold-chain datalogger records multi-point temperature and humidity with timestamps, stores data safely through power events, and supports readout via NFC/BLE/cellular so excursions can be verified later. Core outputs are temperature profiles, excursion events, and audit-friendly summaries. This page covers device-level sensing and logging integrity—not cloud analytics or time-sync systems.
Boundary (what this page does / does not cover)
- Covers: multi-point T/H measurement meaning, placement/thermal coupling, timestamp & log integrity, excursion representation, and device-level readout constraints.
- Does not cover: gateway aggregation, cloud dashboards/data lakes, protocol-stack tutorials, or PTP/TSN/GNSS timing system design.
Minimum closed-loop (the only definition that matters in the field)
- Sense: multi-point T/H values that represent the actual monitored object (not wall/air mixing artifacts).
- Timestamp: each record aligned to a monotonic timeline (with explicit flags for resets or time discontinuities).
- Log: append-only records with sequence counters and integrity checks (e.g., CRC) so gaps and corruption are detectable.
- Readout/uplink: NFC/BLE/cellular access that preserves record counts, time range, and gap visibility.
- Verify: excursions and summaries reproducible from raw records (audit fields make “trust” measurable).
“Multi-point” is a system constraint, not a sensor count. It implies probe identity and placement discipline, cable/contact risk, thermal coupling uncertainty, and installation repeatability. A trustworthy logger therefore requires traceable probe metadata (ID, position, calibration version) alongside raw measurements.
Core outputs (what must be extractable without interpretation)
- Temperature profile: time series per probe plus a clear sampling policy (interval or event-boosted cadence).
- Excursion events: start/end time, peak deviation, duration, and threshold definition used.
- Summary statistics: min/max/avg plus time-above-threshold and count of discontinuities.
- Audit fields: record sequence, integrity check (CRC), reset counter, and calibration/version tags.
Practical rule: a curve without audit fields is not evidence—only a picture.
Use cases & constraints that drive the design
Cold-chain environments push measurement credibility harder than raw sensor specs. Each scenario changes the dominant error sources (placement/thermal coupling, condensation, low-temperature power limits, vibration/contact noise) and therefore changes which evidence should be checked first.
How scenarios translate into engineering knobs
- Cold room (long dwell): drift, condensation/icing cycles, and installation repeatability dominate; credibility comes from calibration traceability and stable placement.
- Refrigerated truck: door shocks + vibration + power transients dominate; credibility comes from continuity evidence (reset counters, gap checks) and burst-current margin.
- Insulated box (passive shipment): thermal inertia is high; credibility comes from probe placement proving “object temperature” rather than wall temperature.
- Pharma shipment (audit pressure): excursions must be reproducible; credibility comes from append-only logs, sequence/CRC visibility, and explicit policy/version tags.
Common pitfall: wrong probe placement. A probe mounted on a cold metal wall measures a local thermal bridge, not product temperature. Evidence-driven validation uses multi-point response timing to the same door event: wall-adjacent probes react faster and with larger swings than properly coupled product probes.
| Scenario | Environmental constraints | What is being measured? | Design knobs pushed to extremes | First evidence to check (field) |
|---|---|---|---|---|
| Cold room long dwell, stable setpoint |
condensation/icing cycles; long-term drift; cable aging | product temperature vs air mixing near evaporator | calibration strategy; placement discipline; drift flags; periodic sanity checks | probe metadata completeness (ID/position/version); comparison vs reference point; humidity drift signs after condensation |
| Refrigerated truck door shocks & vibration |
vibration; intermittent contact; rapid transients; power dips | temperature distribution across zones and doors | event-boost sampling; reset behavior; burst-power headroom; continuity reporting | VBAT sag during radio burst; reset counter increments; record gaps/repeats by sequence; multi-point coherence on door events |
| Insulated box passive shipment |
high thermal inertia; limited access; near-field readout | payload core temperature vs wall temperature | placement/thermal coupling; sampling interval; NFC/BLE readout completeness | response-time differences across probes; installation notes; readout shows total record count + time range + gap visibility |
| Pharma shipment audit & traceability |
strict excursion definitions; evidence retention; dispute resolution | excursions with reproducible thresholds and policy | append-only logging; PLP; immutable policy/version tags; summary reproducibility | excursion fields (start/end/peak/duration); threshold policy version; shutdown markers; CRC/SEQ continuity over power events |
Sampling policy (interval vs event-boost) as an engineering trade
- Fixed interval: predictable statistics, but storage and average current scale linearly with sampling rate.
- Event-boost: captures doors and excursions efficiently, but depends on thresholds, debounce rules, and pre/post windows.
- Recommended pattern: low-rate baseline logging + event-boost bursts, with explicit policy/version tags so summaries remain reproducible.
Evidence requirement: event records should carry threshold version, event window length, and “why captured” flags—otherwise event-based logs become ambiguous.
System architecture & power domains (device hardware baseline)
A cold-chain datalogger is best understood as a set of functional domains connected by explicit power rails and evidence-preserving data paths. This architecture baseline makes later decisions measurable: what stays always-on, what can be duty-cycled, and what must be protected during brownouts and burst loads.
Architecture at a glance (what the system must always provide)
- Multi-point sensing path: probes → interface (I²C/1-Wire/analog) → MUX/AFE/ADC → time-stamped records.
- Wake & control path: door/vibration/threshold events select when to sample, store, and read out.
- Evidence path: append-only logs with SEQ/CRC/FLAGS keep gaps and corruption detectable.
- Readout path: NFC (near-field), BLE (near-range), Cellular (remote) constrained by burst current and low-temperature battery derating.
- Power policy: always-on vs duty-cycled vs burst domains, with staged brownout behavior to protect logs first.
Two practical power rules: (1) burst radios must never collapse the always-on time/log integrity domain; (2) during a power event, the system should protect evidence (log consistency) before attempting communication retries.
| Domain | Primary responsibility | Typical power behavior | Key “evidence hooks” to keep |
|---|---|---|---|
| Sensor | convert product/air/zone conditions into measurable T/H signals | duty-cycled or always-on depending on probe type | probe ID + placement + cable metadata; sensor status/CRC (if available) |
| Acquisition | MUX/AFE/ADC convert multi-point inputs into comparable digital records | duty-cycled; short active windows | settling/ghosting flags; reference/excitation health; noise markers |
| Control | sampling schedule, event logic, timestamping, and state transitions | always-on “minimal” + duty-cycled compute | reset counter; policy version; monotonic time continuity checks |
| Storage | append-only logging with recoverable indexing | duty-cycled writes; protected by PLP window | SEQ/CRC; shutdown marker; last-good pointer; gap statistics |
| Comms | NFC/BLE/Cell readout under burst and low-temp constraints | burst domain (highest peak current) | readout includes total records/time range; retry counters; burst/brownout correlation |
| Power | battery derating, DC/DC + LDO rails, brownout staging | always-on supervision + staged domain gating | VBAT min; brownout events; rail PG/UV flags; PLP status |
Multi-point T/H sensing front-end (accuracy starts here)
Multi-point accuracy is defined by an error chain: sensor route selection, cabling topology, front-end excitation/reference integrity, multiplexer settling, EMI susceptibility, and thermal coupling at installation. The goal is not only low error, but stable behavior under condensation, vibration, and long cable runs.
Route selection (choose by dominant error sources, not convenience)
- Digital T/H probes (I²C/1-Wire): integration simplifies analog design, but long-term drift and condensation effects can dominate. Bus robustness and probe status visibility become critical.
- NTC/RTD + AFE/ADC: flexible multi-point scaling and better physics control, but accuracy depends on excitation current, reference stability, cable resistance, MUX leakage, and settling time.
- Decision hint: if long cables and harsh EMI are expected, the primary task is controlling common-mode injection and contact noise; if audit traceability dominates, metadata and reproducible error bounds matter more than interface choice.
| Topology | Best fit | Dominant risk | First evidence to validate |
|---|---|---|---|
| Star | easy isolation of a bad probe/branch; clear maintenance | connector/contact issues; cable bundle routing; common-mode loops | branch-specific anomalies correlate with movement/door events; per-branch continuity counters |
| Bus | reduced wiring; scalable when bus is robust | bus contention / line stuck; noise couples to all nodes simultaneously | simultaneous multi-probe anomalies; retry counts rise together; bus-level error flags |
| Daisy-chain | minimum harnessing; fixed installation | far-end derates first (voltage drop, reflections, cumulative leakage) | error rate increases with distance index; tail nodes show earlier dropouts |
AFE essentials (map each countermeasure to an error term)
- Cable resistance & lead effects: use controlled excitation (current source), ratiometric measurement, or 4-wire RTD where appropriate; validate by changing lead resistance and observing predictable deltas.
- MUX settling / ghosting: allow settling time, discard initial samples, and avoid sampling immediately after large step changes; validate with a fixed reference input while scanning channels rapidly.
- EMI injection: limit bandwidth, add input filtering appropriate to the sensor route, and ensure the measurement window is not coincident with radio bursts; validate by comparing noise metrics with TX disabled vs enabled.
- Self-heating: minimize excitation duty-cycle and current where physics allows; validate by increasing sampling cadence and checking for slow upward drift.
Thermal coupling defines the measured truth. A probe bonded to a metal wall measures a local thermal bridge; a probe coupled to the payload core measures product temperature. Multi-point validation uses response timing: wall-adjacent probes react faster and with larger swings during the same door event.
Probe metadata checklist (minimum evidence per probe)
- Probe ID (unique) and location label (standardized naming)
- Cable length/type and connector notes (contact risk & noise coupling)
- Calibration coefficients + version (and replacement event marker)
- Mounting method (tape/clip/adhesive/insulation pad) and coupling notes
- Condensation exposure (if relevant) and mitigation notes
Practical rule: if probe metadata is missing, long-term comparisons and audit disputes become undecidable.
Calibration, drift, and “trustworthy numbers”
Cold-chain disputes rarely fail because data is missing; they fail because numbers cannot be defended. “Trustworthy” measurements require traceability (what calibration was active), repeatability (within a bounded error budget), and explainability (anomalies can be tied to evidence such as probe changes, condensation, or installation).
1-point vs 2-point calibration (use a rule, not a preference)
- 2-point calibration is required when the operating range spans a wide window (e.g., low-temp zone + ambient), or when low-end behavior is non-linear and must be bounded.
- 1-point calibration can be acceptable when the range is narrow and the dominant term is offset (not gain), and the acceptance criteria is trend/threshold with a conservative margin.
- Practical pairing: choose one anchor near the cold-chain low end and one near a stable reference region; record both reference conditions and the active range.
Rule-of-thumb: when “low-end accuracy” decides excursions, a 2-point anchor is usually cheaper than arguing later.
Trustworthy numbers = traceable + repeatable + explainable. Traceable: calibration version/time/method is known. Repeatable: error remains within an explicit budget. Explainable: anomalies map to evidence (probe swap, condensation exposure, cable change, installation coupling).
| Error term | Where it comes from | How to bound it | Evidence to keep | Typical mitigation |
|---|---|---|---|---|
| Sensor intrinsic | initial accuracy, hysteresis, repeatability | spec + incoming check at two anchors | sensor lot/probe ID; incoming test record | probe binning; consistent reference conditions |
| AFE/ADC chain | reference drift, quantization noise, INL, MUX settling | noise metric + settling scan test + reference health | settling/ghosting flags; noise stats; reference monitor | discard samples after MUX switch; ratiometric option |
| Cable & connector | lead resistance, contact intermittency, common-mode injection | distance-indexed correlation + continuity counters | cable length/type; connector notes; retry/dropout counters | topology choice; shielding/grounding discipline (device-side) |
| Installation coupling | wall vs payload coupling; thermal bridges; airflow mixing | event response timing comparison across probes | mount method; location label; coupling notes | standardized placement; controlled attachment method |
| Time-dependent drift | aging, contamination, condensation cycles | drift envelope per interval + re-check cadence | cal version history; exposure markers; replacement events | planned recalibration; probe replacement thresholds |
| Worst-case combine | systematic offsets + environmental effects | conservative worst-case envelope (audit-friendly) | budget sheet version; acceptance thresholds | margining excursion thresholds by budget |
Drift & aging patterns (recognize by shape, not guesses)
- Humidity contamination: high-RH readings slowly bias and recover more slowly; hysteresis grows after repeated exposure.
- Condensation cycles: step-like bias after events, followed by long-tail recovery; correlated with door openings or temperature transitions.
- Channel-local drift: one probe diverges from others → suspect probe, cable, or mounting; global drift across probes → suspect reference/AFE or calibration governance.
Calibration record governance (keep history defensible)
- Append-only calibration log: do not overwrite coefficients; add a new record with version + timestamp + method + probe scope.
- Active version pointer: store which calibration version is active; every pointer change is also logged as an event.
- Probe replacement marker: any probe swap adds a structured event so “before vs after” comparisons remain valid.
Goal: a third party can reconstruct which coefficients were applied to any record segment.
ULP power budgeting under low temperature
Low-temperature failures are usually peak-driven: battery internal resistance rises, burst loads deepen voltage sag, and a “low average current” device can still reset during radio activity. A robust design uses a state-based power ledger, staged brownout behavior, and evidence capture around burst events.
Build a power ledger as a state machine (not a single average number)
- S0 Sleep: RTC + wake detect only (dominant time share).
- S1 Wake/Stabilize: rails up, reference settles, probe interface ready.
- S2 Sample: AFE/ADC window + MUX scan (short but repeatable).
- S3 Write: storage transaction window (protect with brownout policy).
- S4 Readout: NFC/BLE/Cellular bursts (highest peak risk).
- S5 Recovery: brownout markers + safe shutdown or resume logic.
Ledger fields to keep: state durations, peak current drivers, VBAT_min per burst, and brownout counters.
Low-temp battery behavior (what becomes observable)
- Capacity drops: runtime estimates become optimistic.
- Internal resistance rises: the same burst current causes a larger ΔV sag.
- Transient resets appear: radio TX or write peaks pull VBAT below UVLO even when the average looks safe.
Policy priority: preserve log integrity first. If a burst event threatens power stability, defer or downshift readout, complete evidence writes, and record VBAT_min + brownout markers to keep the failure explainable.
Mitigation strategies (save energy and protect against peak sag)
- Batching: sample in short windows and write in controlled transactions to reduce wake frequency (but keep the loss window bounded).
- Readout grading: local logging always; BLE for routine collection; cellular only when excursions require remote reporting.
- Burst-aware scheduling: avoid sampling/precision measurements during TX windows; prioritize stable measurement windows.
- Staged brownout: disable burst domains first, then duty-cycled domains, while keeping always-on timekeeping intact.
Evidence capture: radio-burst voltage sag (what to measure)
- Measurement points: VBAT at battery terminals, and VBAT at the PMIC input (if accessible).
- Trigger: TX enable (preferred) or VBAT falling edge crossing a threshold.
- Metrics: sag depth (ΔV), sag duration, recovery time, and whether UVLO/brownout markers align with burst timestamps.
Recommended log fields: VBAT_min, burst_start/end markers, retry counters, brownout_count, and last-good write pointer.
PLP (Power-Loss Protection): don’t lose the last minutes
The most valuable cold-chain evidence is often the final minutes around excursions, handling, or handoff. PLP is a system behavior: detect power loss early, win a hold-up window, commit logs atomically, and leave verifiable shutdown evidence so the last records remain defensible after recovery.
What PLP must preserve (success criteria)
- Last-minute raw records: keep the pre/post window around excursions and handling events.
- Consistency metadata: sequence, timestamp, CRC, and index/pointer updates must remain coherent.
- Verifiable shutdown evidence: distinguish a controlled shutdown path from an interrupted write.
A “device that reboots” can still be a PLP success if the recovered log is provably consistent.
Power-loss detection (high-level signals)
- VBAT dV/dt: falling slope detection to enter PLP mode before rails collapse.
- PG/UV flags: deterministic entry point for staged shutdown behavior.
- Comparator threshold: fast trigger for “commit now” decisions.
Detection should trigger immediate load shedding; otherwise the hold-up energy is consumed by peak domains.
PLP priority: protect log integrity first. Disable peak domains, finish an atomic commit, then write a shutdown marker and a last-good pointer so recovery is explainable.
Win the hold-up window (staged load shedding)
- Step 1 — block peak domains: stop radio bursts and nonessential loads immediately.
- Step 2 — keep only what commits: MCU + storage (and critical rails) remain powered until commit finishes.
- Step 3 — leave a proof trail: shutdown marker + sequence counter + CRC + last-good pointer.
Hold-up energy is finite; ordering matters more than “bigger capacitance”.
Shutdown evidence pack (defensible after recovery)
- Shutdown marker: proves entry into the PLP path and distinguishes controlled shutdown from abrupt loss.
- Sequence counter: exposes gaps and supports “continuity” checks during audits.
- CRC per record: validates record payload integrity after brownout events.
- Last-good pointer: points to the last committed record to accelerate recovery and avoid ambiguity.
Storage & logging pipeline (endurance + integrity)
A cold-chain datalogger must write for long periods, survive interruptions, and still produce records that can be verified. Storage selection, append-only structure, integrity fields, and a deterministic recovery flow together define whether the data is auditable.
Choose storage by constraints (not by habit)
- FRAM: high endurance and low write energy; excellent for frequent small writes and power-fail resilience.
- Flash: higher capacity and cost efficiency; requires block management and wear leveling to remain reliable over time.
- Design implication: frequent sampling favors predictable small commits; large capacity favors structured segments and controlled updates.
Append-only logging is the simplest way to make power-fail recovery deterministic: scan forward, verify CRC + sequence continuity, stop at the last committed record, and resume without ambiguity.
Log structure: append-only + segments + index
- Segments: split the log into fixed-size regions (SEG0/SEG1/…) so rolling windows and erase/write policies are predictable.
- Index records: periodic checkpoints that map time/sequence ranges to segment offsets for fast export.
- Rolling window: retain raw records for a bounded horizon while keeping excursion summaries longer for audits.
| Field | Purpose | Audit value | Recovery use |
|---|---|---|---|
| timestamp | places samples on a timeline | supports excursion timing evidence | helps rebuild indexes and summaries |
| seq | monotonic continuity indicator | reveals gaps or resets | finds last continuous record quickly |
| CRC | payload integrity check | proves record validity after events | stops scan at the last valid commit |
| probe_id | maps record to a physical probe | supports traceability across probes | enables per-probe recovery/summaries |
| flags | marks excursions or special events | connects records to handling windows | accelerates summary generation |
Power-fail recovery workflow (deterministic)
- Step 1: scan the most recent segment forward and validate CRC while checking seq continuity.
- Step 2: use the last-good pointer (if present) to accelerate positioning and reduce ambiguity.
- Step 3: discard incomplete tails (uncommitted data) and resume appending from the last committed record.
- Step 4: write a recovery marker so the event is explainable in exported evidence.
Export formats: raw + excursion summary + statistics
- Raw records: the source of truth for verification and re-computation.
- Excursion summary: start/end, peak, duration, and pre/post window indicators.
- Statistics: min/max/avg and time above threshold for audit-friendly reporting.
Summaries should be derivable from raw records; otherwise audits become “trust the summary”.
Readout & backhaul: NFC / BLE / cellular (engineering boundaries)
Treat readout as an energy-and-reliability problem. The goal is defensible evidence delivery with bounded power cost: choose a local method for routine inspection and reserve high-cost backhaul for exceptions that require timely proof.
Channel positioning (what each method is best at)
- NFC: tap-to-read for on-site inspection; minimal interaction time and low power cost.
- BLE: near-range batch discovery via advertising; connect only to selected devices for reliable pull.
- Cellular: remote evidence delivery; best reserved for excursion/arrival/time-based triggers with strict retry discipline.
These methods complement each other as a tiered strategy rather than a single “best” link.
NFC readout: low-power, local, and time-bounded
- Practical boundary: short, near-field sessions for a quick pull of summaries and recent windows.
- Reliability lever: export summary first (excursions + stats) and fetch raw windows only when needed.
- Field failure patterns: alignment distance, metal/water proximity, or sessions that run too long.
A faster “first proof” pull reduces retries and keeps energy usage predictable.
BLE readout: advertising for discovery, connection for reliable transfer
- Advertising (broadcast): low power and scalable discovery for many devices; collisions and misses are expected in dense sweeps.
- Connection: reliable transfer for a smaller subset; higher session time and energy cost.
- Warehouse sweep strategy (high-level): discover in batches, then connect only to devices that flag exceptions or require raw pull.
Batch discovery + selective connection keeps the sweep explainable under occlusion and RF variability.
Cellular is the expensive link. It should be gated by triggers and validated by evidence: capture peak-current impact, retries, upload latency, and failure reason codes to explain what happened.
Cellular backhaul: triggers + peak current + retry evidence
- Trigger policy: excursion / arrival / periodic—each implies a different allowed energy cost.
- Peak-current reality: radio bursts can cause VBAT dips; keep “store first, send later” behavior for robustness.
- Retry discipline: bounded retries with backoff; stop chasing the network when it risks log integrity.
- Store-and-forward: preserve records locally and attempt uplink again when a safer condition is met.
| Evidence field | What it proves | Why it matters | Typical failure explanation |
|---|---|---|---|
| RSSI (or link level) | signal condition during readout | supports “RF variability” claims | low RSSI correlates with slow scans or missed discovery |
| retry_cnt | how many attempts were needed | quantifies reliability cost | high retries indicate marginal coverage or occlusion |
| upload_latency | time-to-deliver evidence | ties to battery burn | long latency often follows repeated registration or network delay |
| peak_I / VBAT_min | electrical stress during bursts | connects comms to resets/PLP risk | VBAT droop explains brownout or aborted transfers |
| failure_code | failure category (timeout / no service / rejected) | makes outcomes explainable | reason codes separate coverage issues from server rejection |
Mechanical, condensation, and EMC reality
In cold-chain deployments, water vapor, condensation cycles, corrosion, ESD, and cable handling often dominate failure rates. The design goal is to keep measurements meaningful and electronics survivable under dew-point events and repeated handling.
Condensation mechanism (why dew forms)
- Dew point: condensation occurs when local surface temperature falls below the air’s dew point.
- Thermal gradient: door-open and handling events create fast temperature/humidity swings.
- Outcome: repeated wet/dry cycles accelerate corrosion and can shift sensor readings over time.
The key is not “never condense,” but “condense without drifting, shorting, or corrupting evidence.”
Thermal bridge & placement error (meaningful temperature)
- Thermal bridge: metal contact paths can pull a probe toward a cold source temperature rather than payload temperature.
- Air mixing: placing probes in turbulent flow can bias toward mixed-air temperature rather than goods temperature.
- Field verification: compare two placements (A/B) and check response differences during door-open events.
Protection is system-level. IP rating alone does not guarantee stability under condensation cycles. Treat venting, coatings, connectors, and cable entry as a combined reliability design.
Environmental protection elements (engineering-level)
- IP strategy: sealing blocks splashes but can trap moisture; condensation can still occur internally.
- Vent membrane: balances pressure while limiting liquid ingress; reduces stress on seals and connectors.
- Conformal coating: helps against moisture films and corrosion, with clear boundaries around connectors and contacts.
- Connector choice: corrosion resistance, sealing method, and insertion-cycle reality matter more than catalog claims.
Cable entry, ESD, and EMC reality (principles + verification points)
- Cable entry: cables are both antenna and discharge path; handle transients at the entry point.
- ESD events: repeated handling and plug/unplug cycles are common triggers for resets and intermittent faults.
- Verification points: check for reset counters, error spikes during plug/unplug, and drift after condensation cycles.
- Principles only: use TVS and common-mode suppression as needed, then validate with field-like events.
This chapter stays at “principle + verification”; full compliance procedures belong in a dedicated EMC page.
H2-11 · Validation & Field Debug Playbook (Symptom → Evidence → Fix)
The “real value” of a cold-chain datalogger is an auditable evidence chain: every field symptom must map to measurable data (electrical, thermal, comms, storage), with an executable isolation path and corrective actions.
0) First, put “evidence fields” into firmware and the data format (otherwise the field will always be guessing)
Minimum auditable fields recommended per record (or per summary window). They add little energy cost, but drastically shorten debug time:
- Time & sequence: RTC timestamp + sequence counter (monotonic), to detect missing segments and reboots.
- Power fingerprint: VBAT_min (minimum voltage in the sampling window), reset reason, UVLO/PG status bits.
- Sampling quality: per-channel sensor status (open/short/CRC fail/out-of-range), sampling duration, filter/config version.
- Storage integrity: per-record CRC, page/segment CRC, last-good pointer, shutdown marker (whether shutdown was graceful).
- Comms evidence: NFC/BLE/Cellular RSSI, retry counts, time-to-report, failure reason codes, and peak-current window markers.
Typical implementation parts (reference MPNs): RTC RV-3028-C7; FRAM FM24CL64B-GTR; Flash W25Q64JV; voltage supervisor/reset TPS3839.
A) Temperature curve shows “sawtooth / jumps / occasional spikes”
Classify the pattern first (different shapes point to different links):
- Single-point spikes (1–2 samples): more like EMI injection, intermittent contact, or insufficient ADC/MUX settling.
- Periodic sawtooth (regular jitter): more like sampling sync / filter configuration, mains coupling, or probe thermal-coupling “breathing”.
- Cross-channel correlation (multiple channels jump at the same time): suspect ground bounce / reference disturbance / power transient first.
Must-capture evidence (one run is enough to classify):
- Log raw samples and post-filter outputs together (if spikes appear only after filtering, it’s often algorithm/config).
- Correlate VBAT_min at the same timestamps with “radio burst / storage write” events.
- Channel switching timing: the delay from MUX switch to ADC sample (does it meet settling requirements?).
Isolation path (start with the fastest eliminations):
- Swap probe/cable first: if spikes disappear after swapping, connectors/cable/shielding/mechanical stress is the top suspect.
- Lock to one channel (no switching): spikes still exist → sensor/supply/EMI; only during switching → MUX/ADC settling.
- Lower sample rate / widen sample window: if the symptom weakens, settling/filter design mismatch is likely.
Reference MPNs (turn “suspects” into concrete part choices):
- Digital T/H probes: Sensirion SHT35 / SHT41 (to compare whether the digital path is more stable).
- High-accuracy temperature reference: TI TMP117 (for cross-checking drift/jumps).
- Analog muxing: TI TMUX1208 / ADI ADG708 (to validate the switching/settling chain).
- RTD front-end: Maxim MAX31865; low-noise ADC: TI ADS122C04 (to build a baseline “error/noise chain”).
- Cable/interface ESD: TI TPD2E001; Nexperia PESD5V0S1UL (to validate ESD/transients as the spike source).
B) Random reboot at low temperature / data shows “missing segments”
A common low-temp power trap in cold-chain: battery impedance rises → radio burst / storage-write peak current pulls down VBAT → UVLO/reset triggers → gaps appear.
Must-capture evidence (don’t conclude without waveforms):
- Scope waveforms: capture VBAT and the main system rail (e.g., 3V3) together; trigger on 3V3 dropping below threshold.
- Event markers: did Cellular TX / BLE burst / Flash write happen right before the reboot?
- Reset reason: BOR/WDT/external reset pin; combine with VBAT_min to classify quickly.
Isolation path:
- Reduce peaks first: batch comms/writes to reduce burst frequency; if reboots drop sharply, peak current is confirmed.
- Then staged load-shedding: at low voltage, turn off high-power domains first (buzzer/backlight/high-power RF) while keeping RTC/storage; observe whether gaps shorten.
- Finally set thresholds: tune UVLO/reset thresholds and delays; verify whether threshold chatter is causing resets.
Reference MPNs (common handles in the power chain):
- Ultra-low-power buck: TI TPS62740 (compare low-temp droop across DC/DC choices).
- Supervisor/reset: TI TPS3839 (to nail down “reset evidence”).
- Power mux/path: TI TPS2113A (to validate path switching / droop issues).
- eFuse/current limit & reverse blocking: TI TPS25942A (turn inrush/short/reverse current into loggable events).
- Fuel gauge (SOC fingerprint): ADI/Maxim MAX17048 (helps judge low-temp capacity loss & impedance rise).
C) Humidity reads consistently high / obvious drift (especially after repeated condensation)
Working hypothesis first: sensor contamination or a condensation film + enclosure diffusion path changes, turning offset into a chronic issue.
Must-capture evidence:
- A/B reference: place one “reference probe” in the same enclosure (even temporary) to see whether drift follows the device or the environment.
- Dew-point correlation: log T and RH together and compute whether you cross the dew-point region (more crossings → higher drift risk).
- Recoverability: after warm/dry, does the offset recover? Recovery suggests condensation film/contamination; no recovery suggests aging drift.
Isolation path:
- Check “enclosure diffusion” first: vent membrane, gaskets, and apertures change response time and bias.
- Then check sensor self-heating: too high sampling duty cycle warms the sensor and shows up as RH bias (more obvious in the same environment).
- Finally check calibration validity: was the calibration coefficient version overwritten? Is there an append-only calibration log?
Reference MPNs (to build comparison groups and swap-validate):
- T/H probes: Sensirion SHT35 / SHT41 (compare condensation sensitivity and drift across generations).
- Nanopower comparator (dew-point/condensation threshold or power-fail detect): TI TLV3691.
D) After power loss, “last few minutes” are missing / file is corrupted
Define “power-loss evidence” clearly: what’s missing is not just “data”, but whether the last commit was atomic and the recovery path is verifiable.
Must-capture evidence:
- Power-cut injection: cut power reproducibly at the highest write-rate moment (same moment, same load, same temperature).
- Shutdown markers: do you have shutdown marker, last-good pointer, segment CRCs, and automatic recovery to the last consistent point?
- Energy window: measure whether “power-fail detect → commit complete” fits inside the available window (is PLP actually working?).
Isolation path:
- Move writes to append-only first: forbid in-place overwrites of metadata; recovery just scans for the last consistent segment.
- Then implement a two-phase commit: write record segment → verify → update index/pointer (pointer update must be verifiable).
- Finally validate PLP: power-fail threshold, staged shutdown, and storage write timing must align.
Reference MPNs (typical PLP/storage implementations):
- FRAM (low energy, high endurance, great for logs): Infineon FM24CL64B-GTR.
- Serial NOR Flash (capacity, needs wear strategy): Winbond W25Q64JV.
- Supercap (energy window): Panasonic EEC-F5R5H105 (example ~1F/5.5V class).
- Power-fail detect/comparator: TI TLV3691; power mux/path: TI TPS2113A.
Validation Plan: thermal cycling + door-open shock + power-cut injection + cable disturbance + ESD point discharge
Each test must produce auditable records (log fields + waveforms/stats) and clear pass criteria, so results are hard—not “we tested a lot but learned little”.
| Test | Purpose | Evidence to capture | Pass criteria (example) |
|---|---|---|---|
| Thermal cycling -30↔+25°C |
Validate low-temp supply stability, drift, and reset boundaries | VBAT/3V3 waveforms; reset reason; VBAT_min; error vs temperature curve | No unexpected resets; error within budget; gaps are explainable and reproducible |
| Door-open shock temperature step |
Validate “false excursions” caused by probe placement and thermal coupling | Multi-point response differences; pre/post excursion windows; install position/cable-length tags | Can distinguish “mixed-air temp/enclosure temp” vs “product temp”; event windows are correct |
| Power-loss injection random cut timing |
Validate PLP energy window and atomic commit/recovery | Power-fail detect timestamp; commit duration; shutdown marker; last-good pointer | Last consistent segment is recoverable; no structural corruption; loss length is provably bounded |
| Cable disturbance plug/bend/stress |
Validate spikes/false alarms caused by intermittent contact or injected noise | Spike statistics; channel status bits; ESD/surge event counters (if available) | Spikes are flagged invalid or filtered; no false excursion is triggered |
| ESD point discharge interfaces/enclosure |
Validate ESD coupling paths into sensing/storage/reset | Error counters before/after; reset reason; CRC fail rate; triggered waveform captures | No unexplained resets; data integrity is provable; anomalies are clearly marked |
| Radio stress BLE/Cell burst |
Validate peak current and retry strategy impact on power and continuity | Peak-current window markers; RSSI; retry counts; time-to-send; VBAT_min | No resets at boundary RSSI; retries are bounded; failures are explainable |
Edge-side comms reference MPNs (only to ground the “energy/reliability evidence chain”, not a protocol deep dive): NFC dynamic tag NT3H2211W0FT1 / ST25DV64K-IER6T3; BLE SoC nRF52832-QFAA; LTE-M/NB-IoT module BG95-M3.
Reference MPN Map (quickly map “symptom chains” to swappable parts)
| Block | Example MPNs | Use in debug |
|---|---|---|
| RTC / timebase | RV-3028-C7 | Verify timestamp continuity; check for time jumps after power loss; attribute gaps with timebase evidence |
| Non-volatile log | FM24CL64B-GTR (FRAM) · W25Q64JV (SPI NOR) | Compare “integrity after power loss”; validate append-only + CRC + last-good pointer |
| Power (ULP buck) | TPS62740 | Compare low-temp droop; correlate VBAT_min with resets during bursts |
| Supervisor / reset | TPS3839 | Make “threshold and delay” explainable evidence; reduce false resets from threshold chatter |
| Power path / mux | TPS2113A · eFuse TPS25942A | Validate path switching / reverse current / surge; turn power anomalies into loggable events |
| Fuel gauge | MAX17048 | Help judge SOC/impedance worsening; explain risk windows under low-temp capacity loss |
| PLP energy store | EEC-F5R5H105 (supercap example) | Quantify the energy window from power-fail detect to commit completion; compare commit strategies |
| ESD protection | TPD2E001 · PESD5V0S1UL | Validate ESD injection paths; reduce spikes/CRC failures and reset probability |
| Comparator (nanopower) | TLV3691 | Use for power-fail detect / threshold events; make PLP trigger points controllable |
| Connectivity parts | NFC NT3H2211W0FT1 / ST25DV64K-IER6T3 · BLE nRF52832-QFAA · Cellular BG95-M3 | Make “report failures” explainable: RSSI/retries/time/peak current → power/strategy isolation |
Diagram: a standardized “evidence pipeline” for field debug (Symptom → Evidence → Root Cause → Fix)
This diagram standardizes the field debug workflow: turn symptoms into measurable evidence, map evidence to hardware/firmware links, then verify fixes with reproducible tests.
Request a Quote
H2-12 · FAQs (Cold-Chain Datalogger)
Evidence-first answers for probe placement, multi-point sensing integrity, low-temperature power behavior, PLP (power-loss protection), and audit-ready logging—without drifting into gateway/cloud or protocol-stack details.
FAQs ×12 (answers included)
1
Why do identical probes read consistently low/high after mounting in the box? What 3 “thermal-coupling evidences” should be verified first?
- Placement evidence: distance to evaporator/airflow/door seam (photo + location tag).
- Thermal-bridge evidence: metal contact, adhesive type, strap pressure, insulation pad presence.
- Step-response evidence: door-open transient shape across multiple points (real product temperature lags).
2
Only the farthest channel occasionally spikes—check cable or AFE filtering first? Which two nodes should be measured?
- Node A: the probe-side connector (or at the end of the long cable) to catch injected transients and contact bounce.
- Node B: the AFE/MUX input (or ADC input) to see whether the spike is created by settling, charge injection, or filtering.
3
At low temperature the device doesn’t freeze, but the data shows “time gaps.” Is it more likely an RTC issue or power-loss recovery?
- RTC evidence: timestamp rollback/jumps after wake or restart; RTC power domain retention.
- Log evidence: sequence counter gaps, CRC-fail boundary, last-good pointer rollback after reboot.
- Shutdown evidence: missing shutdown marker indicates an unplanned power-loss path.
4
Why does humidity drift after several cold-room in/out cycles? How to tell contamination from condensation effects?
- Reversibility test: warm + dry soak—does RH offset recover (condensation film) or persist (contamination/aging)?
- Dew-point linkage: count dew-crossing events (T & RH) and track offset vs crossings.
- Enclosure diffusion: vent membrane, seal design, and internal moisture traps change response time and bias.
5
Changing sampling from 1 minute to 10 seconds—why can battery life drop by more than 6×? What is most often missed in the power ledger?
6
Battery shows ~30% remaining, but the unit resets during upload. What is the most common root-cause chain?
- VBAT waveform during BLE/Cellular burst (capture VBAT_min).
- Reset reason flags (BOR/UVLO/WDT) correlated with burst markers.
- Retry count + time-to-send: weak RF conditions amplify peak events.
7
PLP uses a supercap, but the last records still disappear. Is it insufficient energy or wrong write strategy?
- Energy/window issue: power-loss is detected too late, or high-load domains are not shed fast enough, so commit cannot finish.
- Atomicity issue: data pages write, but index/last-good pointer is not updated atomically, so recovery rolls back.
8
How to choose FRAM vs Flash to avoid “slower over time” or integrity degradation? What 2 key metrics matter most?
- Endurance: write cycles / guaranteed lifetime under your write pattern.
- Write energy: write current × time (and whether writes are page-erase coupled).
9
NFC readout is reliable, but BLE walk-by inspection drops packets. Should broadcast strategy or antenna/shielding change first? What evidence matters?
- RSSI distribution: not only average—look at worst-case and variability along the walk path.
- Collision/scan evidence: packet loss vs inspector density (scan window vs advertising interval).
- Retry/energy evidence: retransmits, airtime, and peak-current markers.
10
A short temperature spike—real door-open event or EMI/contact noise? How to distinguish?
- Multi-point correlation: real door events affect multiple probes with explainable delay and magnitude patterns.
- Electrical correlation: noise spikes often align with channel switching, storage writes, or RF bursts; verify with VBAT_min and event markers.
- Reproducibility: gentle cable disturbance reproducing the spike strongly indicates contact/EMI injection.
11
Calibration was performed, but field accuracy is still poor. Is it usually the wrong calibration points or changed installation?
- Point coverage: does calibration cover the operating extremes (often requires 2-point: low-temp + ambient)?
- Install delta: compare “free-air” vs “mounted” offset; large delta indicates thermal-bridge/placement effects.
- Traceability: calibration version + timestamp should be append-only (never overwritten) for audit.
12
How to build an “auditable” record chain so readers trust data is not altered or lost? What 3 field types are the minimum?
- Continuity: a monotonic sequence counter to detect gaps and reboots.
- Integrity: per-record (and/or per-segment) CRC to detect corruption or tampering.
- Recovery anchors: a shutdown marker plus last-good pointer (or equivalent) to prove where replay should stop.
