Cold-chain protection for refrigerated freight

We see a spoiling shipment before the alarm does.

Vaccines, medicines and fresh food travel in refrigerated trucks. When the cooling starts to fail, today's alarms wait until the cargo is already too warm. AxonFDE reads the warning signs early, works out the best response, and acts only once a person has approved it.

Replay a simulated incident, minute by minute How it works
AxonFDE COLD CHAIN CARGO —

The trailer display replays this shipment's recorded temperature.

The problem

A temperature alarm tells you the cargo is ruined. It doesn't tell you it's about to be.

Cargo with a narrow safe range

Many vaccines must stay between 2 and 8 °C for the whole journey. A few degrees too warm for too long and a truckload of medicine can't be used.

Alarms that fire too late

A standard alarm goes off only once the cargo has already left its safe range. By then there is nothing left to save.

Paperwork that disagrees

The company's order system and the signed shipping document often state different limits. If you trust the wrong one, a shipment at risk looks perfectly fine.

How it works

Four steps, and a person signs off before anything happens.

  1. 01

    Sense

    Reads the truck's sensors every minute: cargo temperature, outside heat, how hard the cooling unit is working, fault codes. It also reads the order system and the shipping papers.

  2. 02

    Predict

    Spots the trend, not just the current reading: a cooling unit slowly losing the fight shows up long before the cargo is too warm.

  3. 03

    Decide, with a human

    Prices every option, including doing nothing, and recommends the best. A fleet manager approves it. If conditions change after they sign, the approval is refused and must be renewed.

  4. 04

    Verify

    Checks afterwards whether the action actually worked, and reopens the case if it didn't. Every step is written to a record that can't be edited.

Live replay

One shipment, minute by minute.

Loading the recorded run…

Route position is illustrative. Temperatures, cooling-unit speed, fault codes and alerts are the recorded values.

What happened

    Cargo temperature, as the sensor reported it

    The simulator also knows the true temperature. The site is deliberately never given it: a test fails if it is ever served, so everything above is what a real sensor could have reported.

    Results

    Measured, not promised.

    Every number here is read from a stored benchmark run over simulated shipments. Nothing is typed in by hand, and anything not yet measured is left off rather than estimated.

    These are historical benchmark results from the run identified below. The current verification repair is evaluated separately; it does not rewrite C11.

    Engineering evidence

    An action ran. Did it actually help?

    Outcome verification now refuses premature finalization and asks for review when readings are stale, compressed into an instant, or exactly constant. A constant sensor could be healthy or stuck; this system cannot tell from one channel.

    Freeze the test first

    A versioned fault pack includes valid recoveries, continued warming, missing data and deliberately lying sensors. The acceptance protocol was committed before the repair.

    Count the cost of caution

    False confirmations, missed recoveries and abstentions are reported together. More human review is a cost, even when it prevents an unsupported automatic resolution.

    Keep the limit visible

    A nonconstant lying sensor can still fool the verifier. Constructed fault tests and simulated regressions do not establish performance in a real fleet.

    Download the before/after test evidence (JSON) · Read the frozen protocol · Reproduce the repair

    Why a thermometer isn't enough

    Is the cargo warming, or is the thermometer lying?

    Both of these shipments report a climbing temperature. Only one of them is in trouble.

    The AI

    The AI explains. The rules decide. Here is exactly what it said.

    A language model investigates the same incident: it ranks possible causes and writes the explanation a manager reads. It is never allowed to invent a reading, set a confidence above what the rules permit, or choose the action.

    Likely causes, as ranked by the model

    White bar: the model's confidence. Cyan tick: the ceiling the rules allow. The model can only narrow belief inside that ceiling, never raise it.

    What it told the fleet manager

    —

    Every step, on the record

    What the system did with this shipment, in order.

    Recorded from the last full run of the real code, against real databases.

      Safety

      Built so the AI can't go rogue — and tested to prove it.

      It can't invent evidence

      A language model is never allowed to be the source of a sensor reading. The database itself rejects one.

      Consequential actions need approval

      Gated actions require a valid, unexpired approval that matches exactly what the approver saw. Low-risk actions follow the explicit policy catalogue.

      It can't change your records

      Read-only access to the company's order system, through six approved views, with every query checked before it runs.

      It can't rewrite history

      The audit log is append-only and hash-chained, so an edited or deleted entry is detectable.

      It admits what it doesn't know

      A missing reading stays missing and lowers confidence. It is never filled in with a guess.

      It shows its work

      Every number on this page traces to a stored run that anyone with the code can reproduce.