--- a/py/config.py	Wed Jul 24 23:21:33 2019 +0800
+++ b/py/config.py	Wed Jul 24 23:24:51 2019 +0800
@@ -5,7 +5,12 @@
 UPLOAD_SLEEP = 83 # nice and prime
 
 FRIDGE_DELAY = 600 # 10 mins, to avoid fridge damage from frequent cycling off/on
-FRIDGE_WORT_INVALID_TIME = 300 # 5 mins
+
+# time to wait before just using fridge for fallback
+FRIDGE_WORT_INVALID_TIME = 180 # 3 minutes
+# time to wait before turning it off if neither sensors work.
+# must be > FRIDGE_WORT_INVALID_TIME 
+ALL_INVALID_TIME = 480 # 8 minutes
 
 # 12 hours of "offline" readings stored
 MAX_READINGS = 12*60*60 // SENSOR_SLEEP

--- a/py/fridge.py	Wed Jul 24 23:21:33 2019 +0800
+++ b/py/fridge.py	Wed Jul 24 23:24:51 2019 +0800
@@ -16,6 +16,7 @@
         self.gpio = gpio.Gpio(config.FRIDGE_GPIO_PIN, "fridge")
         self.integrator = utils.StepIntegrator(self.server.now, self.server.params.overshoot_delay)
         self.wort_valid_clock = 0
+        self.fridge_valid_clock = 0
         self.fridge_on_clock = 0
         self.off()
         if nowait:
@@ -63,6 +64,9 @@
         if wort is not None:
             self.wort_valid_clock = self.server.now()
 
+        if fridge is not None:
+            self.fridge_valid_clock = self.server.now()
+
         self.integrator.set_limit(params.overshoot_delay)
 
         # Safety to avoid bad things happening to the fridge motor (?)
@@ -110,6 +114,13 @@
                         W("wort has been invalid for %d" % (self.server.now() - self.wort_valid_clock))
                     turn_off = True
 
+            if wort is None and fridge is None:
+                invalid_time = self.server.now() - max(self.wort_valid_clock, self.fridge_valid_clock)
+                D("both sensors broken, invalid_time %(invalid_time)f" % locals())
+                if invalid_time > config.ALL_INVALID_TIME:
+                    L("Both sensors broken for %(invalid_time)f seconds" % locals())
+                    turn_off = True
+
             if turn_off:
                 L("Turning fridge off")
                 self.off()