Design storage behaviour during actual work
A cold room may hold a stable temperature with closed doors yet reveal vulnerable positions during picking. A warehouse may have enough refrigeration capacity but poor air distribution. Pharmaceutical storage design must control the behaviour of the space actually used during operations, variable loading and credible failures, rather than merely demonstrate that a setpoint can be reached.
[GUIDEGXP] The design output is a verifiable operating envelope: which positions can be used, which loads can enter, how access is managed, which events are covered and when activity must stop. This article concerns rooms, warehouses and storage equipment. Building-service interfaces are relevant; cleanroom classification and process refrigeration remain separate disciplines.
Define physical and functional boundaries
Start with the URS and show products, racks, supply air, return air, doors, external walls and services on one diagram. Identify permitted storage space and excluded areas. Separate what the installation directly controls from conditions that depend on the building, the operator or upstream equipment.
Describe design ambient conditions and plausible variations: seasons, solar gain, adjacent rooms, building shutdowns and loading-bay openings. An internal room is not automatically protected from every external influence. Host-room conditioning can become a critical dependency when that room receives rejected heat from multiple appliances, particularly during simultaneous high demand.
Establish the thermal duty. Holding conditioned goods and cooling incoming goods have different requirements. If the store is not designed to lower an arrival temperature, receiving controls should prevent that duty being introduced informally. Increased incoming mass may require review even when the number of pallets remains unchanged.
Build the heat balance around realistic scenarios
[GEP] Consider transmission through the envelope, infiltration through openings, incoming material, people, lighting, motors, fans and defrost. Some contributions are continuous; others are intermittent and concentrated. Adding nominal loads without considering their timing can overestimate one condition and underestimate another, especially during receiving or recovery after a shutdown.
Distinguish available refrigeration capacity from the conditions under which it is quoted. Compressor, evaporator and condenser performance depend on the operating point. Useful capacity during a failure may differ from the remaining nominal capacity if airflow or control logic changes. Sizing therefore requires consistency between components and actual site conditions.
Provide a justified margin without letting excess capacity create unstable control or excessively cold jets near products. Average room temperature may be correct while a particular position is overcooled. The design must protect both sides of the approved range and make any necessary loading or positioning restrictions verifiable in operation.
Design air paths, not just airflow rates
Follow air from supply to return. Identify short circuits, sheltered spaces behind racks, narrow passages, obstructions and weakly circulated zones. A high total airflow does not guarantee useful distribution. Return-air location can make control appear stable while a corner of occupied storage behaves differently and remains poorly represented by the controller.
Package geometry matters as much as the rack itself. Dense cartons, wrapping film, open containers and overhanging pallets create different resistance. Required clearances must come from design, manufacturer evidence and verification rather than a generic copied number. Set rules that are easy to follow: marked limits, stops, excluded positions or illustrated configurations.
Where computational flow modelling is used, document geometry, boundary conditions, load representation and limitations. Modelling can guide design and test-point selection; it does not automatically replace verification of the installed system. If doors or actual loading are not represented, conclusions should remain limited to the assumptions used in the model.
Use loading as a design variable
A high load can obstruct circulation and slow heat transfer to the centre of packages. A light load may offer less inertia during an opening or cooling loss. An uneven arrangement can move vulnerable locations. There is no single “worst case” that automatically represents every physical mechanism relevant to product protection.
[QRM] Select cases that answer specific questions: uniformity at maximum occupied space, small-container response, influence of newly received goods and performance during intensive picking. Configurations must be reproducible and recognisable. “Full” is insufficient if packaging type and distribution change the airflow path or the thermal mass actually present.
Define the loading process as well. Simultaneous receipt may be more demanding than introducing the same mass gradually. The protocol should retain the sequence, initial conditions and relevant operation durations. A change to delivery scheduling may therefore need assessment during operation, even if nominal capacity and installed equipment remain unchanged.
Treat doors and workflows as part of control
A door introduces air and moisture exchange, and may interrupt fans or control sequences. Its effect depends on geometry, environmental difference, frequency, duration and traffic. One prolonged opening does not necessarily represent repeated short openings. Select challenges by observing the actual work expected, including queues and the need to move equipment through the opening.
Reduce searching before imposing time limits on operators. External document preparation, clear locations, organised picking and dedicated zones can reduce exposure. An anteroom, rapid door or separate picking area should be compared against safety, ergonomics, maintenance and additional transfers. Every barrier also introduces a possible failure mode that must remain manageable.
Define what happens when a door remains open, a position switch fails or a closure device malfunctions. A door alarm detects an operational cause but does not replace thermal monitoring. The procedure should explain restoration and which products or positions require assessment, including cases where an apparent door closure did not restore the seal.
Manage moisture, condensation and defrost
Infiltration may form frost on heat exchangers and progressively degrade airflow. Performance can therefore deteriorate without a distinct equipment failure. Assess access frequency, moisture load, drainage and cleaning. Maintenance should recognise early signs such as accumulation, cycle changes and departures from normal behaviour, rather than waiting for a final temperature alarm.
Defrost introduces heat and temporarily changes distribution. Establish how it starts, how it ends and what happens if it does not complete correctly. Assess overlap with loading and door openings. In multiple systems, simultaneous and staggered sequences should not be assumed equivalent. Their effect needs to be understood in the selected configuration.
Condensation may affect floors, labels and surfaces during transfers. Where relevant, include water management and packaging integrity. Do not assign the same humidity limits to every store: relevance follows the product, package, operation and approved conditions. A thermal assessment can remain incomplete when moisture changes the way the package can be handled.
Demonstrate redundancy through dependencies
Two circuits may share a panel, controller, condenser service, network or room. A shared component can remove the apparent benefit of duplication. Draw the functional chain and identify which failures leave the required performance available. Also define behaviour during maintenance, when part of the protection is already intentionally unavailable.
Consider a generator together with transfer, startup, fuel, competing loads and monitoring. A battery that preserves records does not necessarily power refrigeration. Measurement continuity and cooling continuity are different functions. Tests should demonstrate their interaction without unnecessarily placing commercial product at risk, using a justified and controlled challenge method.
Alternative capacity needs availability, compatibility and a workable transfer. A distant room may be qualified but unreachable within useful time or inaccessible outside working hours. Consider people, containers, route and batch identification. The interface with building services and HVAC must assign clear responsibility for common environmental and utility conditions.
Define recovery and holdover through a precise question
“Fast recovery” is meaningless without the initiating event, load, ambient condition, measurement point and final criterion. Distinguish return of air temperature, stabilisation of the whole volume and product behaviour. A probe near supply air can recover before distant positions; a product mass may respond much more slowly than the surrounding air.
For power loss, define starting conditions and permitted actions during the trial. Opening to inspect stock may change the observed holdover. If the emergency plan requires transfer, the test should support the time needed to initiate it, rather than simply produce an impressive duration with a door that stays permanently closed.
Recovery time is not medicine tolerance. The environment may return to compliant conditions after an event that still requires product assessment. Connect monitoring, operating decisions and excursion management without turning technical restoration into automatic permission to distribute the affected stock. The two decisions need distinct owners and evidence.
Turn design questions into a test matrix
| Question | Scenario to represent | Useful evidence |
|---|---|---|
| Is the volume usable? | Defined loads and ambient conditions | Spatial distribution and excluded zones |
| Is picking sustainable? | Actual access sequence | Trends, times and vulnerable positions |
| Do arrivals disturb existing stock? | Receipt under known conditions | Response near and far from the load |
| Does backup cover the failure? | Loss of the identified function | Residual performance and alarm chain |
| Is return to use controlled? | Restart and recovery | Stabilisation criteria and authorisation |
Temperature mapping should answer these questions with justified locations and duration. Sensor quantity cannot substitute for risk coverage. Use design information to locate vulnerable areas, then update understanding where measurements reveal unexpected behaviour. Do not remove an unfavourable point merely to obtain a passing report.
Make restrictions visible and enforceable
A qualified drawing is ineffective if staff cannot recognise its boundaries. Transfer restrictions to floor markings, rack identifiers, loading diagrams and receiving rules. Decide how temporary obstructions are handled and who can approve a new configuration. A restriction that depends on every operator remembering an undocumented clearance is less reliable than a visible physical arrangement.
When a limitation reduces available capacity, update planning information as well as procedures. Otherwise the inventory system may continue allocating positions that Engineering has excluded. Reconcile the physical layout, stock records and operating instructions before release. This prevents scheduling pressure from repeatedly pushing the process outside the conditions that were demonstrated.
Plan startup and transfer into routine operation
Initial filling needs its own plan. A room stabilised while empty may be disturbed by rapid transfer of the entire stock, even when later full-load operation is adequate. Define the sequence, incoming goods' condition, intermediate checks and criteria for stopping entry. Where staged loading is required, that condition belongs in operating instructions and relocation planning.
During failure trials use a controlled approach that protects people and product. Identify the test owner, starting state, restoration means and stop criteria. Do not disable safety functions without competent assessment and control of return to the intended configuration. The need to verify a failure does not justify unmanaged effects on the rest of the site.
At handover collect controller configurations, defrost logic, probe identities and updated drawings. Compare them with the arrangements used during testing. A change made to optimise commissioning may alter later behaviour if it is undocumented. Staff should know which settings they may adjust and which require formal evaluation before modification.
Finally define indicators of drift: progressively longer recovery, increasing door events, growing differences between locations and greater refrigeration duty. These signals alone do not establish product impact, but may trigger investigation before control is lost. Compare them with loading, ambient conditions and maintenance to distinguish new operational demand from equipment deterioration. Record the baseline so future reviewers understand which behaviour was originally demonstrated.
Hypothetical example: adding a rack
A hypothetical store adds a rack to increase capacity without changing refrigeration. The new footprint narrows the path to return air. The central display remains stable, but the zone behind the rack recovers slowly during picking. The team recognises that the geometry change has altered a condition underlying the previous qualification.
It compares relocation, position restrictions and modified distribution. The selected solution is tested with representative load and access, updating drawings, markings, monitoring and instructions. The example does not justify a standard clearance. It shows why added capacity must remain linked to airflow and thermal evidence rather than being accepted from floor-space measurements alone.
Release and change-management checklist
- Usable volume and restrictions are visible at the workplace.
- Starting loads, configurations and operating sequences are documented.
- Doors, defrost and maintenance appear in relevant scenarios.
- Common dependencies and degraded modes are understood.
- Recovery and holdover have verifiable definitions.
- Monitoring and response cover relevant positions and failures.
- Changes to racks, packs, access or utilities trigger assessment.
- Evidence supports the conditions actually authorised for use.
Common mistakes and the final design decision
Red flags include sizing by volume alone, maximum load without geometry, delayed alarms used to hide insufficient performance, redundancy without shared-failure analysis and recovery assessed only at the controller. Another mistake is preserving a qualified layout on paper while the real store gradually introduces different containers, racks or workflows.
[GUIDEGXP] A design is ready when normal use, disturbances and failure response can be described in verifiable terms. Connect each restriction to a physical reason and a practical control. During the lifecycle, use trends, interventions and deviations to check whether assumptions remain valid. Review and requalification intervals follow risk and evidence rather than a universal calendar rule.
Sources and classification
Primary technical sources: WHO Design and procurement of storage facilities and Qualification of temperature-controlled storage areas, supplements 2 and 7, May 2015, to TRS 961 Annex 9, 2011. [GUIDANCE] International documents requiring contextual application; checked on 21 September 2026. [GEP], [QRM] and [GUIDEGXP] identify engineering practice, specific risk decisions and original editorial tools, not universal regulatory thresholds.
