Modeling Distribution and the Cold Chain to the Patient
📍 Where we are: Part V · Fill-Finish and Release, modeled — Chapter 20. The units are serialized and ready to ship. This chapter follows them out of the factory to the patient — and confronts what becomes of a digital thread when it leaves the graph that built it.
The medicine is made, released, and serialized. The last leg is distribution: getting temperature-sensitive vials, intact and within their cold chain, from the plant through distributors and pharmacies to the patient who needs them [1]. This chapter completes the thread the whole book has built — the one that lets you walk from a vial in a patient's hand back to WCB-CHO-001. But it also reaches the model's true edge: distribution happens in systems the manufacturer does not own, across organizational boundaries, so the graph that has held everything so far must now either let go or learn to span owners it cannot control.
You can track a package perfectly inside your own warehouse. The moment it leaves with a courier, it enters someone else's tracking system — you get updates if they choose to share them, in their format, on their terms. A vaccine's cold chain is that handoff with a temperature requirement: it must stay cold every step, but most of those steps happen in trucks, warehouses, and pharmacies you do not run. This chapter models the journey to the patient and faces the honest limit: the digital thread you built so carefully now has to be carried by people and systems beyond your walls.
What this chapter covers
We model the cold chain as a monitored process, excursions as events that threaten product quality, and the shipment linking serialized units to their journey. We complete the end-to-end thread, dissect a distribution record, and spend the chapter's weight on the genuinely hard, genuinely open problem: provenance across organizational boundaries — federating a digital thread through systems you neither own nor control — and the patient-identity edge where the thread, for good reasons, must stop.
The cold chain is a monitored process with consequential events
Distribution is, in the model, a chain of handling processes — shipping, storing, receiving (bp:HandlingProcess and its subclasses bp:Shipment, bp:StorageProcess, bp:ColdChainProcess) — each an occurrent that the serialized units participate in, extending the EPCIS event story past the factory. What makes it distinct is temperature: the product must stay within a validated range — for this product bp:storageTempLowC 2.0 to bp:storageTempHighC 8.0 deg C — monitored continuously by a data logger, and a departure from that range — an excursion — is a consequential event that can compromise the product's quality and shelf life [2]. Modeled, the cold chain is a process bearing a temperature signal via bp:hasTrace (the same index-versus-payload discipline — the graph references the logger stream and records the excursion as a discrete bp:TemperatureExcursion event), and that excursion bp:isAbout the affected serialized unit, recording an out-of-range fact (bp:excursionTempC 11.4) that bears on its fitness for use. This is the stability story made dynamic: the release decision assumed proper storage, and the cold chain is where that assumption is either kept or broken, unit by unit, in transit.
The cold chain as a monitored process: a logger traces the validated 2 to 8 degrees Celsius window while a transient excursion to 11.4 degrees is a discrete modeled event — and custody crosses organizational boundaries the manufacturer's graph cannot author past the first handoff.
Original diagram by the authors, created with AI assistance.
The thread completes — and reaches its edge
With distribution modeled, the trilogy's central thread is whole. A scanned vial at a pharmacy carries its SGTIN, which derivedFrom its drug-product lot, which derivedFrom the drug substance, back through polishing, capture, the bioreactor, the seed train, to the cell bank — the full lineage the knowledge-graph chapter walks in one query, now stretching from a patient's hand to a frozen vial of cells. This is the digital thread the next chapter assembles in full. But notice where it strains: every edge inside the factory, and the first shipment to a distributor, was written by systems the manufacturer controls, while the edges further out — which truck, which downstream warehouse, which pharmacy, which patient — are written by other organizations, if they are written at all.
The canonical dataset now carries the first leg of distribution as real individuals: a bp:Shipment that consumes the released lot, a bp:ColdChainProcess bearing the temperature trace, a bp:DataLogger, a bp:TemperatureExcursion, and the bp:CustodyRole that names the handoff to a distributor. The right upper vocabulary is the W3C PROV-O namespace, and align.ttl makes the claim explicit — bp:Shipment rdfs:subClassOf prov:Activity — so a shipment is, by alignment, an activity that consumes a manufactured entity. The excerpt below is a true slice of instances.ttl: the shipment prov:used the released drug product (DP-001) and outputs the serialized vial, whose own bp:derivedFrom DP-001 edge keeps factory-lineage continuity.
@prefix bp: <https://example.org/bioproc#> .
@prefix prov: <http://www.w3.org/ns/prov#> .
bp:SHIP-001 a bp:Shipment ; rdfs:label "shipment of pallet P-001 to distributor" ;
prov:used bp:DP-001 ; # the released drug product (true individual)
bp:hasOutput bp:VIAL-DP-001-000042 . # the serialized vial that ships
bp:COLDCHAIN-001 a bp:ColdChainProcess ; rdfs:label "2-8 C cold-chain transport" ;
bp:hasParticipant bp:VIAL-DP-001-000042 ;
bp:storageTempLowC 2.0 ; bp:storageTempHighC 8.0 ;
bp:hasTrace bp:Trace-Logger-DP001 .
bp:LOGGER-01 a bp:DataLogger ; rdfs:label "cold-chain temperature logger" .
bp:EXCURSION-001 a bp:TemperatureExcursion ; rdfs:label "transient temperature excursion" ;
bp:isAbout bp:VIAL-DP-001-000042 ; bp:excursionTempC 11.4 .
bp:CUSTODY-distributor a bp:CustodyRole ; rdfs:label "distributor custody role" .
Because bp:derivedFrom is an owl:TransitiveProperty, the vial's derivedFrom DP-001 edge (asserted where the serialized unit is declared) closes the whole walk from the pharmacy shelf back to WCB-CHO-001. The prov:Activity alignment on bp:Shipment, plus prov:used, adds the custody dimension the factory graph never needed: which process moved this unit. The catch is that everything past bp:SHIP-001's handoff to the distributor — who carried it onward, where it sat, at what temperature in the next owner's warehouse — would be authored elsewhere, which is exactly the boundary the next section confronts: the graph models the manufacturer's first leg honestly and stops where it loses authorship, not before it begins.
It is worth being precise about which standard vocabularies the distribution leg actually borrows, because each carries a different commitment. align.ttl asserts bp:Shipment rdfs:subClassOf prov:Activity and bp:EPCISEvent rdfs:subClassOf prov:Activity — PROV-O supplies the activity/agent/used/generated frame for anything that consumed an entity and produced or moved another, which is precisely what a shipment and an EPCIS commissioning/aggregation/shipping event are. The cold-chain logger is aligned bp:DataLogger rdfs:subClassOf sosa:Sensor (W3C SOSA), the right model for a device that observes a property over time. The serialized unit itself aligns up to IOF as bp:SerializedUnit rdfs:subClassOf iof:MaterialProduct. Notably, the GS1 SGTIN is not given an OWL superclass: a GS1 item key is an identifier system, not an ontological category, so the model cross-links it with skos:exactMatch to a urn:epc:id:sgtin: URN rather than subclassing it — and align.ttl flags both the GS1 packaging tiers and the exact GS1 EPCIS/CBV bizStep term as ILLUSTRATIVE, because GS1's vocabularies are not hosted where the alignment's other IRIs were verified. This is the alignment being honest about a real seam: the interface standard (GS1/EPCIS) and the provenance standard (PROV-O) meet here, but only one side has dereferenceable IRIs the model could verify.
The alignment, exactly as align.ttl records it — and honest about the GS1 seam:
# align.ttl — the distribution leg grounded UP (excerpt).
bp:Shipment rdfs:subClassOf prov:Activity . # PROV-O 'Activity' (a shipment consumes the released lot)
bp:EPCISEvent rdfs:subClassOf prov:Activity . # the EPCIS event side is also an occurrent
bp:DataLogger rdfs:subClassOf sosa:Sensor . # W3C SOSA 'Sensor' (the cold-chain logger)
bp:SerializedUnit rdfs:subClassOf iof:MaterialProduct . # IOF biopharma 'material product'
# A GS1 SGTIN is an identifier system, not an OWL class — cross-linked by skos:exactMatch, not subclassed:
# bp:VIAL-DP-001-000042 skos:exactMatch <urn:epc:id:sgtin:...> . # ILLUSTRATIVE URN value
# bp:ColdChainProcess / bp:TemperatureExcursion stay ILLUSTRATIVE — no canonical external leaf.
The last leg, unpacked: serialized units travel a monitored cold chain whose excursions are modeled events, while the custody handoffs cross organizational boundaries into systems the manufacturer does not control — and the thread stops, deliberately, at the patient's privacy edge.
Original diagram by the authors, created with AI assistance.
The unsolved part: provenance across boundaries you do not control
This is where the model meets a wall that is organizational, not technical, and it is the honest culmination of the book's running theme. Inside the factory, one organization controls the systems, the identifiers, and the data quality, so the graph can guarantee its own integrity. Distribution shatters that: the thread must continue through distributors, third-party logistics, and pharmacies, each with its own systems, identifiers, data standards, and incentives. The manufacturer's beautiful, validated graph can model the first handoff — the shipment, the cold-chain leg it logged, the custody role it assigned — but it ends where authorship passes to the distributor; beyond that, provenance depends on a federation of independent graphs that must agree on what a unit is and choose to share what happened to it. This is the owl:sameAs reconciliation problem at supply-chain scale, compounded by the fact that you cannot mandate another company's data quality — you can only standardize the interface (GS1, EPCIS) and hope each party holds up its end. Cross-organizational digital-thread federation, with trust and data-sharing across parties who do not fully trust each other, is a genuinely open problem that no ontology resolves on its own; it needs governance, standards adoption, and often technology (shared registries, verifiable credentials) the field is still developing.
The second edge is the patient, and here the model should stop on purpose. The thread could, in principle, reach the individual who received a specific vial — and for pharmacovigilance that linkage has value — but the patient is a person with privacy rights, not a manufacturing entity, and extending lineage to an identified individual crosses from data integrity into data protection (and a different body of law entirely). The honest model terminates the manufacturing thread at the point of dispensing, linking to that a unit was dispensed without ingesting who received it, and treats any further linkage as a separate, consent-governed, privacy-regulated system. The standard this chapter sets is therefore doubly sober: the thread is technically completable to the patient's doorstep but organizationally fragile beyond the factory, and it should not be completed into the patient themselves without leaving the manufacturing graph's purpose and law behind.
Why it matters
Distribution is where the digital thread proves its ultimate value — recall a defective lot and find every affected unit's last known location — and simultaneously where its guarantees thin to a thread of cooperation between organizations. Model the cold chain and its excursions and a quality decision made at release can be revisited in light of what happened in transit; model the organizational boundary honestly and you know exactly where your graph's integrity ends and a federation's begins. Pretend the thread is as solid in the supply chain as in the plant and you will trust a recall trace that depends on data you never controlled. This chapter is where the model's reach and its limits are both at their greatest — and where Part VI's questions about governance, FAIRness, and honest verdicts become unavoidable.
In the real world
Cold-chain distribution under Good Distribution Practice, with continuous temperature monitoring and excursion management, is mandatory for biologics and codified in GDP guidance and pharmacopeial chapters [1][2][3]. Serialization and EPCIS already provide the interface for cross-organizational tracking, which is why track-and-trace recalls work at all — but they provide an interface, not a unified graph, and the dream of a seamless end-to-end digital thread from cell bank to patient remains, in practice, a federation of cooperating systems with real seams at every organizational handoff. The industry is actively working on shared registries and trusted data exchange to close those seams, and it is precisely the unfinished, cross-party nature of that work — not any missing ontology — that keeps the full thread aspirational past the factory wall. Part VII returns to the layer this leg rides on: GS1 and EPCIS as the production-grade backbone for cross-organizational tracking, and the enterprise knowledge graphs that try to stitch those federated, separately-owned systems into one navigable view.
Key terms
- Cold chain — the validated temperature range a product must stay within through distribution, modeled as monitored handling processes bearing a temperature signal.
- Excursion — an out-of-range temperature event in transit, modeled as a discrete fact affecting specific units and their fitness for use.
- Shipment / handling process — the shipping, storage, and receiving occurrents serialized units participate in, continuous with the EPCIS supply-chain events.
- Organizational-boundary federation — the open problem of continuing a digital thread through distributors and pharmacies whose systems, identifiers, and data quality the manufacturer does not control.
- Patient-identity edge — the deliberate termination of the manufacturing thread at dispensing, short of an identified individual, where data integrity gives way to data protection law.
Where this leads
Part V is complete: the medicine has reached the patient, and the thread — within the factory, ironclad; beyond it, a fragile federation — is whole end to end. Part VI steps back from the process to the graph itself. The next chapter, Assembling the Digital Thread: Lineage, Impact, and the Whole-Lifecycle Query, puts every edge this book has laid into one navigable whole and shows the queries it finally makes possible — the lineage walks, the impact analyses, the cross-lifecycle questions that were the entire reason to model the process as knowledge.