Tamper-Evident Cold Chain Monitoring for Vaccine Transport
A tamper-evident temperature logger and verification portal for vaccine and medicine shipments, built for health departments, NGOs and pharmacy distributors. The device logs through areas with no signal, signs every record, and flags excursions using WHO-style cumulative rules. An IoT and security final year project.
Advanced
Needs a team, real planning, and a supervisor who knows the area.2 semesters · 2 to 3 students
7 to ship
3 optional extrasSuggested stack
What you should ship
- Logger recording temperature at a fixed interval with a real-time clock and local storage for at least 30 days
- Excursion detection using cumulative time above and below thresholds, following WHO PQS style alarm rules, not single readings
- Each record signed on the device and hash-chained to the previous one, so edits, deletions and reordering are detectable
- Store-and-forward upload over an intermittent link, reconstructing a gap-free record once connectivity returns
- Verification tool and web portal that validate a shipment's full record and report any break in the chain or missing interval
- Shipment workflow: assign a logger, start, hand over, receive, with an accept or reject decision recorded at each point
- Battery life measured over a realistic multi-week run, with the sampling and radio schedule that achieved it
If you have time left
- Lid-open or tamper switch events included in the signed record
- Estimated remaining stability from accumulated heat exposure, using vaccine vial monitor style categories
- Bluetooth read-out to a phone at the receiving clinic when there is no network at all
The problem with invisible temperature damage
Vaccines and many medicines lose potency if they get too warm, and some are destroyed by freezing. The damage is invisible. A carrier box travels from a district store to a rural clinic, perhaps through load-shedding, a hot vehicle and an overnight stop, and the nurse at the other end cannot tell whether the contents are still good.
Current practice in many places relies on an indicator card or a vial monitor that shows something happened, but not when, for how long, or who was holding the box. And a temperature record is only useful if it cannot be edited, while the person with the strongest reason to edit it is whoever was responsible for the shipment.
What already exists and the gap
- WHO PQS E006 devices: WHO prequalifies temperature monitoring devices, including 30-day temperature recorders with fixed alarm rules (for example a high alarm after sustained time at or above +8 °C, and a freeze alarm around -0.5 °C). Vendors such as LogTag and ELPRO sell compliant loggers.
- Remote temperature monitoring devices add cellular or Wi-Fi reporting for fridges in stores and clinics.
- Nexleaf ColdTrace monitors vaccine fridges and, with ColdTrace Transport, vaccine delivery trips, piloted with Tanzania's Ministry of Health.
These are mature for fixed fridges. The gap for a student project is transport through no-signal areas combined with an independently verifiable record: a cheap logger whose data carries its own proof of integrity, and a portal where the receiving clinic, the distributor and an auditor all see the same verified history.
What you build
- Logger: microcontroller, calibrated probe, real-time clock, flash storage, battery, and a radio used sparingly.
- Firmware: sample on a fixed schedule, sign and chain each record, evaluate excursion rules, upload when a link is available.
- Backend and portal: receives records, verifies signatures and the chain, and shows each shipment's timeline with excursions and custody events.
- Roles: dispatcher (assigns logger and starts the shipment), driver (hands over), receiver (accepts or rejects), and auditor (read-only).
The technically interesting part
Integrity from the device outwards. Give each logger a private key generated on the device, register the public key with the server, and sign every record. Include the hash of the previous record in each new one, so deleting or reordering records breaks the chain. The verifier must work without trusting the server: anyone with the public key and the export can check it. Discuss what this does not protect against, such as someone moving the probe out of the box, and how you would detect that.
Cumulative excursion logic. Rules are about sustained exposure, not a single hot reading. Implement them as a small state machine over time and read the actual WHO PQS alarm criteria before coding; cite them in your report.
Power and gaps. The logger must last a full journey and weeks of storage. Sampling interval, sleep, and when to use the radio are the design trade-offs; measure real runtime.
How to evaluate it
- Accuracy: compare the probe against a reference thermometer in an ice bath and at room temperature; report error.
- Integrity: a test suite that edits, deletes, duplicates and reorders records in an export, and shows the verifier catching every case.
- Excursion logic: replay synthetic temperature traces with known expected alarms and show all pass.
- Connectivity: run a shipment with the radio blocked for most of the route and show a complete record after reconnection.
- Battery: measured runtime at your chosen sampling interval.
- Field trial: at least 3 real trips in a cool box, with timelines in the report.
Suggested plan
- Weeks 1 to 3: read WHO PQS material on temperature monitoring, choose parts, log temperature to flash.
- Weeks 4 to 7: signing, hash chain, verifier as a standalone tool with tests.
- Weeks 8 to 11: excursion state machine, store-and-forward upload.
- Weeks 12 to 16: backend, portal, custody workflow.
- Second semester: power optimisation, field trips, accuracy tests, write-up.
Path to a product
The first customers are pharmacy distributors and NGO immunisation programmes that move cool boxes to remote clinics and have to prove the chain was intact. Sell loggers per unit plus a per-shipment or monthly platform fee for the portal and verified exports. Insulin, blood samples and some food exports have the same problem, which widens the market. A realistic route is a pilot with one distributor before chasing any formal prequalification.
Scope warning
One sensor per container. Do not build a fleet tracking system, route planning, or an inventory module. Do not put records on a blockchain: a signed hash chain gives the same tamper evidence without the cost. Do not claim WHO compliance; say which rules you followed.
Learn what you need on Sefism
- Backend roadmap : for the ingestion API, verification service and database.
- System design cheat sheet : idempotent uploads and out-of-order data from devices.
- PostgreSQL Documentation : storing and querying long time-series per shipment.
- OWASP ASVS : a checklist for the portal's authentication and access control.
- The Python Standard Library : hashlib and friends for the verifier.
Get help with this idea
This idea is strong when the integrity story is precise and the field trial is real. Tauseef can help you decide the threat model, trim the scope and plan an evaluation that convinces examiners. If you are new here, create a free account first.
Ideas and guidance, not finished projects
These are project ideas and scoping guidance, published free for students to use as a starting point. I do not build, write, or sell final-year projects, and I do not complete coursework for anyone. Take an idea, make it yours, and build it.
Not sure this one fits you?
I help students pick an idea that matches their skills and their deadline, then scope it down until it is finishable. Guidance only, never done for you.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
Follow along
New writing, resources and project ideas land here first.