Acceptance criteria and measurement uncertainty in temperature mapping

In brief

• The label range of your product (for example 2 to 8 °C) is not your acceptance limit. You have to measure more strictly in order to claim that you stayed within that range.
• Every data logger has an MPE (Maximum Permissible Error): the maximum error the manufacturer guarantees across the calibration period. For a decent logger, this is typically ±0.3 to ±0.5 °C.
• You subtract that MPE from both sides of the label range. That is called a guard band. What remains is your acceptance limit for the mapping study.
• For your alarm limits, you use the same guard band plus an extra margin for the response time of your technical team.
• State this reasoning explicitly in the protocol. It is the first thing an auditor will check.

Why "2 to 8 °C" is not your acceptance limit

Many protocols set "2 to 8 °C" as the acceptance criterion. Further down the same page sits a table of loggers with an accuracy of ±0.5 °C. At first glance this looks fine, but the two contradict each other. A concrete example.

Suppose your highest recorded data point is 7.9 °C. Your logger has an MPE of ±0.5 °C. The true temperature therefore lies somewhere between 7.4 and 8.4 °C. In other words, you do not actually know whether the space stayed within 2 to 8 °C. The measurement leaves it open. That kind of conclusion will not survive an audit.

The fix is not necessarily buying a more expensive logger. The fix is that you decide up front how you deal with that MPE, and make the acceptance limit tighter than the label range. That is what the rest of this page is about.

Three concepts that often get mixed up

Before we start calculating, it is worth keeping three quantities apart. Their names sound related, but they serve completely different purposes.

The rest of this page is about the second row: how do you get from the label range to the acceptance limit? At the end we link that through to the third row.

What exactly is MPE?

MPE stands for Maximum Permissible Error: the largest deviation the manufacturer guarantees your logger will show across the full calibration interval (usually 12 months). It is an umbrella value: everything that can go wrong with the measurement is baked into it. Calibration uncertainty, drift, resolution, linearity: you get one number and the manufacturer guarantees the logger stays within that margin, provided you recalibrate on time.

The MPE lives on your logger's datasheet, sometimes under "accuracy" or "measurement accuracy". For most data loggers it sits somewhere between ±0.1 °C (reference-grade instruments) and ±0.5 °C (standard loggers for GDP work).

One important condition for treating MPE as an umbrella: the logger must have a calibration certificate that is traceable to a recognised reference (think NIST or a comparable national metrology institute), and the calibration must still be valid (typically ≤ 12 months). Only then are you entitled to use the MPE as your guard band. If the calibration is older, or if traceability is missing, the manufacturer's guarantee no longer holds and you will need to build up the contributions individually (see When you need a more detailed calculation).

What is a guard band, in plain terms?

A guard band is nothing more than a safety margin you shave off your limit, on both sides. Think of the speed limit: if you set your cruise control to exactly 130, but your speedometer can be 5 km/h out, you drive 125 to be safe. Those 5 km/h are your guard band.

For a mapping study it looks like this:

Acceptance limit (high)  =  upper label limit  −  MPE
Acceptance limit (low)   =  lower label limit  +  MPE

That is all there is to it. The MPE on your datasheet is your guard band. One subtraction, done.

Worked examples: calculating the acceptance limit

Two typical situations side by side, both with a logger of MPE ±0.5 °C. That is the most common value in day-to-day GDP practice.

Acceptance limit (high)  =  8.0  −  0.5  =  7.5 °C
Acceptance limit (low)   =  2.0  +  0.5  =  2.5 °C

So your acceptance limit is 2.50 to 7.50 °C.

Acceptance limit (high)  =  25.0  −  0.5  =  24.5 °C
Acceptance limit (low)   =  15.0  +  0.5  =  15.5 °C

So your acceptance limit is 15.50 to 24.50 °C.

From mapping to alarm limits for your monitoring

After the mapping, you install fixed monitoring sensors at the warmest and coldest positions you found. For those sensors, you configure alarm limits. These serve a different purpose from the mapping acceptance limit: they must warn you before the product is at risk. So an extra layer comes into play: the time your team needs to respond.

In practice you work with a tiered system. Example for a 2 to 8 °C cold room, MPE ±0.5 °C and an operational response margin of 0.5 °C:

Extra detail: if your fixed sensor is not located at the warmest point from the mapping, you also need to add the temperature offset between that worst-case position and the sensor location. In our example, an offset of 0.5 °C would push the upper action limit down to 7.0 °C.

When you need a more detailed calculation

The MPE approach is elegant and adequate for most routine mappings. Three situations call for splitting out the individual contributions:

• You mix logger models with different MPEs in the same study. The umbrella is no longer a single number.
• Your calibration is older than 12 months, or the logger has no calibration certificate traceable to a recognised reference. The manufacturer's guarantee no longer applies.
• You want to make the acceptance limit slightly wider than the MPE approach allows, and can show with real numbers that the individual contributions together are smaller than the umbrella MPE.

In those cases you build the combined uncertainty u_c from separate contributions and combine them using the root-sum-of-squares method from the GUM (Guide to the Expression of Uncertainty in Measurement). The four main contributions:

• Calibration uncertainty. Taken from the calibration certificate, typically ±0.1 to ±0.3 °C.
• Drift. The slow shift in your logger since the last calibration, roughly 0.05 to 0.1 °C per year.
• Resolution. The smallest step the logger displays, typically 0.1 °C.
• Spatial gradient. The spread between loggers at any given moment. Usually the largest contribution.

A worked example for a 2 to 8 °C cold room then looks like this:

u_c = √(0.100² + 0.058² + 0.029² + 0.173²)
    = 0.21 °C

Guard band at k = 2:
GB  = 2 × 0.21  =  0.42 °C

Acceptance limit = 2.42 – 7.58 °C

In short: always start with the MPE approach. Only bring in the detailed calculation if you truly need it.

What to record in the protocol

Auditors look for the same four elements every time. Make sure all four are there.

1. Which method you apply (MPE subtraction is standard and defensible).
2. Which MPE value you used and where it comes from (reference to datasheet and calibration certificate).
3. The validity of your calibrations (date, laboratory, traceability to a national standard).
4. How you treat borderline cases: data points within 0.1 to 0.2 °C of the limit warrant a separate note, even if formally compliant.

Miss any one of these and the mapping conclusion itself will not stand up in an audit, however carefully you actually measured.

Common mistakes

• Copying the label range one-to-one as the acceptance limit, with no guard band.
• Using an MPE without checking that the calibration is still valid.
• Mixing loggers with different MPEs and forgetting to apply the largest.
• Setting alarm limits equal to the mapping acceptance limit (losing the response-time margin).
• Splitting the guard band asymmetrically without justification from the product file.
• Not stating the method explicitly in the protocol; auditors spot this immediately.