Cold chain: the controllers attached to the refrigeration units

A refrigerated warehouse is a plant that happens to sit inside a logistics business. Its process is temperature, its product is somebody else’s product, and the controllers that hold the temperature are as much a control system as the PLCs on a filling line. They are usually treated as part of the refrigeration contract rather than as part of the network, and that is where this note starts.

What is attached to the refrigeration

Each cold room, blast freezer and dock has a refrigeration controller: a small device in a cabinet that reads temperature and pressure, runs the compressors and the defrost cycle, and holds the setpoint. Larger plants add a pack controller over several compressors and a supervisory unit in the plant room that collects all of them. On the yard, each reefer unit carries its own controller and a temperature logger, often with a cellular modem, so the shipper can see the box wherever it is.

Around these sit the warehouse automation, conveyors, sorters and automated storage, each with its own controllers, and the warehouse management system that tells them what to move. In the cold chain all of this tends to meet at a gateway: a device or a service that collects readings from the refrigeration, the loggers and the automation and sends them to the monitoring platform the customer logs into. That gateway is the most interesting point on the site, and the logistics and cold chain page explains why it is the place to listen.

Reachable by design

Monitoring is not a mistake. A customer who has paid for a cold chain is entitled to see the temperature of their goods, and a contractor who maintains the plant needs to see the compressors. So the controllers are built to be reached: a Modbus register map on the plant network, an MQTT client publishing to a broker, a web page on the logger, a cloud agent on the supervisory unit. The telemetry exists because someone needs it.

The difficulty is that a reading and a setpoint sit in the same register map, on the same port, behind the same credentials or no credentials at all. Modbus has no notion of who is asking. A broker that accepts a published temperature from a logger will, unless it has been configured not to, accept a published command for the same unit from anyone who can reach it. The path that carries the reading out is the path that carries the setpoint in, because it was never two paths.

The path that carries a reading out can carry a setpoint in, because it was never two paths.

The same is true of the contractor’s route. Vendor remote access into the refrigeration plant is usually a modem or a VPN box fitted at installation, held by the contractor rather than the site, and reaching the supervisory unit with full write rights, since the contractor needs to change setpoints and defrost schedules as part of the job. It is a plant asset, and it rarely appears on the plant’s list.

Why this is a product question first

In most plants the worst case of a control-system failure is lost time. In a cold store it is lost product, and the loss is quiet. A setpoint moved a few degrees, a defrost cycle started at the wrong time, an alarm threshold raised so that nothing fires: none of these stop the plant. The compressors keep running, the doors keep opening, and the loggers keep logging a number that is now wrong for the goods inside.

The industry page puts the gap between a shipment and a write-off in hours, and that is the right frame. A temperature excursion is a product-loss event with a security cause, and it should be ranked that way: by what the goods in that room are worth and how long they can tolerate the excursion, not by how clever the path was. It is also a question of evidence. If the loggers can be written to, the record that proves the chain was kept is a record that could have been edited.

The UAE pattern

Three things about cold-chain sites in the UAE make this sharper. The first is heat: refrigeration runs hard all year, so there is no slack in the plant, and an excursion that a cooler climate might ride out for a while arrives faster here. The second is free-zone warehousing: sites are leased, fitted out quickly and often fitted out by whoever could do it in the time, so the refrigeration contractor’s network, the automation integrator’s network and the office network are commonly one network, because that was the fastest way to make the building work.

The third is that monitoring is usually a cloud service reached over cellular. That is convenient and it is often the right design, but it means there is a route from the public internet to the refrigeration that does not pass through the site’s firewall at all, because it goes out through a modem in a cabinet. The site’s IT team may not know the modem is there. The refrigeration contractor may not think of it as a network device.

What good looks like

Good does not mean switching the monitoring off. The customer still sees their temperature, the contractor still sees the compressors, and the loggers still log. What changes is the direction of the paths.

Readings go out through a path that only goes out. The monitoring gateway reads the controllers and publishes upward, and nothing on the monitoring side can reach back to a register or a setpoint. Where a broker is used, it accepts writes only from named, authenticated clients, and only to the topics those clients own; an anonymous client can neither subscribe to everything nor publish to anything. The web page on a logger is reachable from the plant network and not from the office or the internet.

Setpoints change through a different path, one that is brokered, time-boxed and logged. The contractor connects through a jump point the site controls, for a session someone on site has approved, and the session is recorded. The modem that gave the contractor a permanent private route is either removed or put behind that jump point. The zones and conduits of ISA/IEC 62443-3-2 fit this cleanly: the refrigeration is a zone, the monitoring is a conduit out of it, and the contractor’s access is a second conduit with its own rules.

ISA/IEC 62443-3-2 · zones, conduits and risk assessment

The first step is simply to know what is there. A passive capture at the gateway and at the plant-room switch shows which controllers report where, which paths reach them from outside, and which monitoring services could write as well as read, without sending a packet to a controller that is holding a room below freezing. That is where our method starts on a site like this: listen first, put the refrigeration on the same asset list as the automation, and rank each path by what the goods behind it are worth.

Sources · ISA/IEC 62443-3-2 (zones and conduits); NIST SP 800-82 Rev. 3, section 5 (network architecture).