How long can every critical asset survive a power cut?
Estates are asked to know which loads are protected, prove the backup works and show the record. Tempa answers with one number per asset — Verified Survivable Hours — from the same sensors that keep the compliance record.
Ageing estates, circuits of unknown protection, tests without evidence.
The estate is older than its drawings
The NHS maintenance backlog stands at £15.9bn, with £3.5bn of it high-risk. Estates-failure incidents cost 14,596 clinical hours in a year. Which fridge sits on which circuit, and what feeds that circuit, is often a question for the one person who remembers.
Backup is tested, but not evidenced
HTM 06-01 grades clinical risk and expects generators kept in operational readiness; the EPRR core standards want a business impact analysis and an annual board statement. A monthly generator run noted on a clipboard proves the engine started, not that the fridges stayed cold.
Cold assets with an unknown runway
Vaccines are lost to cold-chain failure every year — £6.4m at list price in 2025, 64 % of incidents cold-chain failures — and the Green Book asks for back-up arrangements. Nobody can say, cabinet by cabinet, how many minutes a cut would allow.
Cuts last longer than a fridge can wait
Storm Arwen left about 4,000 customers off for more than a week; Storm Éowyn took six days in Scotland. After North Hyde, networks admitted they do not know which customers are critical.
Verified Survivable Hours.
For each asset: the time until it leaves its safe band if cooling stopped now, from a thermal model fitted to its own history, plus the autonomy of the backup on its circuit — but only backup whose last test passed inside its interval. Unverified backup counts for nothing, and is flagged. The same number sets the outage runway and bounds how much flexibility can safely be sold.
Prep fridge (left) · Riverside Kitchen
simulated estate, example- Now
- 2.6 °C against a 5 °C limit
- Thermal model
- τ 138 min, fitted, confidence 36 %
- Time to excursion
- 15 min
- Backup on its circuit
- none registered
- Verified Survivable Hours
- 0.25 h
Walk-in fridge · Riverside Kitchen
simulated estate, example- Now
- 4.9 °C, already above its 4 °C limit
- Time to excursion
- 0 min — it is in excursion now
- Backup on its circuit
- Refrigeration UPS, 3 kW, last self-test passed, 45 min of runtime reported
- Verified Survivable Hours
- 0.75 h — all of it from the verified UPS
Both examples are read from the simulated estate in the live demo; the thermal models there are fitted from simulated warming episodes. Nothing on this page is a customer result.
If the power went now.
Assets ranked by time left and value at risk, each with its circuit and backup state, and a plain action list. Live on the demo estate below, simulated sensors throughout.
A register that knows when the last test was, and whether it counted.
UPS and generator register
Every backup asset with its rating, the circuits it feeds, the cold assets on them, and its test interval. Protected, unprotected and unknown are three different colours.
Tests with evidence
A test is logged with what the CT clamp saw: the generator took load, for how long, and how fast the transfer was, read against HTM 06-01’s restoration bands. Runtime achieved, transfer time and load are kept with the record.
Stale-test flags
When a test falls outside its interval, the asset is flagged, the alert goes out, and its backup stops counting towards any Verified Survivable Hours until it passes again.
An input to the business impact analysis, not another spreadsheet.
The monthly resilience evidence pack lists every critical cold asset with its runway, its protection, the backup tests and their results, the incidents and what was done. It is generated from the append-only record with a SHA-256 fingerprint, so it can go straight into the EPRR business impact analysis and the annual board statement.
The live demo’s Reports view links to a generated resilience evidence pack and a HACCP daily record from the simulated estate, each with its hash and size.
Battery sensors, no wiring, no IT connection.
Clip on, not wire in
Probe sensors sit inside the cabinet, door sensors on the frame, clamps around the circuit. Nothing is cut or drilled.
No IT project
One small gateway per building on Ethernet, Wi-Fi or 4G; the sensors talk to it by LoRaWAN. Nothing joins the trust network.
Sealed enclosures
Wipe-clean enclosures for infection-control areas; probes with food- and pharma-grade sheaths.
One morning per building
A typical building is surveyed and fitted in a morning; readings start before the engineer leaves.
The runway and the headroom are the same curve.
A cabinet that can survive a power cut for an hour can also give the grid twenty minutes without anyone noticing. Both are read off the same warming curve against the same target line. That is why resilience comes first and flexibility can only ever be sold inside it.
From about £470 of hardware per building, plus a per-asset subscription.
The reference kit — one gateway, four probe sensors, a door sensor and a current converter with clamps — comes to about £470 including VAT at distributor list prices. The subscription is per asset, as on the pricing page. Estates are quoted; a protected circuit adds its battery hardware at list price plus installation.
Sixteen weeks, six measured outcomes.
- Weeks 1–2
Survey and fit: distribution boards walked, circuits mapped, sensors clipped on, backup assets registered.
- Weeks 3–8
Baseline: thermal models fitted from each cabinet’s own warming episodes; backup tests logged with clamp evidence.
- Weeks 9–12
Drills aligned to the statutory generator tests: predictions compared with what the cabinets actually did.
- Weeks 13–16
Measured outcomes and the report: the evidence pack, the readiness statement, the numbers below.
Outcome measures, agreed up front
- Share of critical cold assets with a verified runway above the estate’s own threshold
- Critical loads found unprotected or mis-mapped
- Thermal-model prediction error during drills
- Alert time-to-acknowledge
- Sensor uptime through drills
- Staff hours per evidence pack
Seven offers on the same record.
Statuses are our plan as of 3 November 2026. None of these seven is in the live product yet; the roadmap says what moves each one.
Protected circuit
trial 2027An off-the-shelf LiFePO4 battery UPS on the circuit feeding vaccine, blood or pharmacy fridges. Tempa reads mains presence (Dragino POM01-L), battery charge through the vendor’s API and the cabinet temperature; the runway becomes the fridge’s warming curve plus battery hours plus verified generator, reported as Verified Survivable Hours.
Parts at list price: an EcoFlow Delta Pro 3 (4.1 kWh, 10 ms switchover, developer API) at £2,799 inc VAT; or a Victron MultiPlus-II 48/3000 at £455 ex VAT with a Pylontech US5000 (4.8 kWh) at £1,266 inc VAT and a Cerbo GX at £203, with open Modbus, MQTT and VRM access. Sizing: a pharmacy fridge draws about 1.5 kWh a day — Labcold datasheets give 1.53 and 1.56 kWh per 24 h, about 65 W on average, so roughly 12 hours per usable kWh for one fridge. List prices and datasheet figures; the runway is confirmed per asset in the trial. The battery is the proof behind the promise, not the profit: at these sizes its own flexibility income is small.
Storm mode
in buildWhen a Met Office warning covers the site or a live network fault covers the postcode, the site pre-cools to the bottom of the safe band (advice to staff now; automatic with Shift), charges batteries to full, checks backup status, sends the named contact the estate’s runway and opens an incident with a timeline.
Feeds: Met Office NSWWS, UK Power Networks, National Grid Electricity Distribution and SSEN live outage data.
Generator readiness ledger
trial 2027Run detection from a CT clamp, tank level and starter-battery voltage, so every statutory test is recorded automatically against HTM 06-01’s requirement that generators are maintained in an operational readiness state; fuel hours inside the runway; stale-test and low-fuel flags.
Sensors at list price: a Milesight CT101 clamp at £72, a Dragino LDDS75 tank-level sensor at €76 or a Tekelek TEK 766 at €177; the standard is HTM 06-01.
Outage playbook
in buildPer site: the keep-and-shed order, protected circuits, fuel and battery allocation, who to call. Printable, and live on the outage board.
Digital drill
in buildA weekly simulated power cut run on the thermal models and the backup register, producing a one-page readiness statement that feeds the EPRR annual board statement, with a trend.
Live risk feed
planned, pilot 2027During a real fault, the sites inside it ranked by time to harm, shared with the network control room and the integrated care board. Later, fleet readiness for network-loaned battery packs.
SSEN gave 20,000 EcoFlow Delta 3 packs to medically dependent customers in February 2026.
Compressor health
planned 2027Start-current trend, short-cycling and duty creep from the clamp, read against the temperature curve, to flag a cabinet likely to fail. Needs a year of data.
Before the trial.
- Does the trial control anything?
- No. There is no control or actuation in the trial: no relays, no setpoint changes, no switching. Tempa measures, models, records and advises. Automatic actions arrive with Shift, inside the envelope the trial has measured.
- Where does the data go?
- A UK (London) region database, with reports in UK or EU object storage. Readings are never edited or deleted. See the security page.
- What do you need from us?
- A plan of the distribution boards, the statutory test schedule for generators and UPS, and a named estates contact. One morning per building for the fit.
- What does it cost?
- From about £470 of hardware per building plus a per-asset subscription; estates are quoted. The trial itself is funded through a programme or free for the first estates.