Regulatory Compliance Algorithms & Cyber-Physical Security for Enterprise Commercial Fleets

Split-Sleeper HOS, Chameleon Carrier Graph Resolution, and FSMA Cold Chain Audit Defense

Strong Tower Consulting, LLC

Minnesota | Founded 2008 | Scott Elliott, Founder & CEO

Senior Transportation Systems Architecture & Logistics Regulatory Engineering

Published October 2026

Executive Summary

Motor carriers, intermodal operators, refrigerated fleets, and freight brokerages lose money in four places that look unrelated but share one root cause: a regulation or a counterparty is treated as a paperwork problem when it is really a computation problem.

This paper gives a complete, independent architecture for each problem: formal models, proofs of the properties that matter, reference algorithms, data schemas, and diagrams. Each chapter stands alone, and each can be implemented incrementally.

Relationship disclosure. Strong Tower Consulting, LLC and Exspeedite LLC are separately organized sister companies under common ownership.

How to read this paper

• Chapters 1 and 4 are optimization and state-tracking problems. Read them if you run dispatch, safety, or drayage.
• Chapter 2 is a data and risk problem. Read it if you onboard carriers or tender freight.
• Chapter 3 is a physics and evidence problem. Read it if you haul temperature-controlled freight.
• Proofs are included where a property is load-bearing for compliance. If you only want the architecture, skip the "Proof" blocks.

Reference architecture (all chapters)

                    +--------------------------------------------+
                    |        EVIDENCE & DECISION LAYER           |
                    |  rules engine | scoring | dossier builder  |
                    +----------------------+---------------------+
                                           |
        +----------------+-----------------+-----------------+----------------+
        |                |                 |                 |                |
 +------+-------+ +------+-------+ +-------+------+ +--------+-------+
 | CH1: HOS FSM | | CH2: CARRIER | | CH3: COLD    | | CH4: INTERMODAL|
 | duty events  | | IDENTITY     | | CHAIN VAULT  | | MATCH + CLOCK  |
 | ELD stream   | | GRAPH        | | sensor chain | | gate/EDI feeds |
 +------+-------+ +------+-------+ +-------+------+ +--------+-------+
        |                |                 |                 |
 +------+----------------+-----------------+-----------------+--------+
 |                  IMMUTABLE EVENT LOG (hash chained)                 |
 +---------------------------------------------------------------------+

CHAPTER 1: FMCSA 49 CFR § 395.1(g) Split-Sleeper Berth State Machine

1.1 What the rule does, in plain English

A property-carrying driver normally gets a 14-hour driving window that starts at the first on-duty moment after 10 consecutive hours off, and an 11-hour driving limit inside it. The sleeper berth provision lets a driver break the 10 hours into two qualifying rest periods instead. When two such periods are paired, the time in them stops counting against the 14-hour window, and the window and driving counters are recalculated from the end of the first period of the pair.

The rule has three moving parts, and every implementation error we see traces to one of them:

• Which rest periods qualify, and which pairs are valid.

• When the pairing is evaluated: only when the second period completes. Until then, the driver is on a provisional clock.

• What gets recalculated when the pair completes, and what stays untouched (for example the 60/70-hour cycle).

1.2 Notation

All times are in seconds on a continuous timeline in the driver's home terminal time zone. H = 3600.

1.3 Qualifying periods and the pairing predicate

A run ρ is qualifying if ℓ(ρ) ≥ 2H.

A run is long-eligible if λ(ρ) ≥ 7H (at least 7 consecutive hours in the sleeper berth).

A run with ℓ(ρ) ≥ 10H is a full reset and needs no pairing.

Two adjacent qualifying runs (π, ρ) form a valid pair when

valid(π, ρ)  :=  ℓ(π) + ℓ(ρ) ≥ 10H
                 AND  ( long(π) AND ℓ(ρ) ≥ 2H   OR   long(ρ) AND ℓ(π) ≥ 2H )

The order does not matter: the long period may come first or second.

The named splits are points on one frontier

Let L be the long period and S the short period. The pairing predicate says L ≥ 7, S ≥ 2, and L + S ≥ 10 (hours). The minimum short period for a given long period is

S*(L) = max( 2 , 10 - L )     for L ≥ 7

So 7.5/2.5 is not a separate provision. It is a point on the frontier S*(L), and an engine that hard-codes only 8/2 and 7/3 will wrongly reject legal intermediate pairs. Implement the predicate, not a lookup table.

1.4 The finite state machine

State

Σ = ( a, x, π, d11, g, d8 )     with  a ∈ ℝ ∪ {⊥},  x ≥ 0,  π ∈ Runs ∪ {⊥}

Initial state after a full reset: Σ₀ = (⊥, 0, ⊥, 0, 0, 0).

Events

Events fire when a duty segment is closed. Non-duty segments are merged into runs; a run is closed at the moment the driver goes ON or D.

Transition function for RUN_CLOSE(ρ)

Case R3 is the recalculation. The old pending run π is consumed as the first period, ρ becomes the excluded period, and ρ immediately becomes the pending run for the next pairing. That last step is what makes chained splits work (a 2-hour period that completes one pair is also the first period of the next).

Legality predicate

Driving at time t is legal iff

d11 < 11H     AND     (a = ⊥  OR  t < a + 14H + x)     AND     d8 < 8H

The middle term is the pause-exclusion formulation: the deadline is pushed out by exactly the length of the excluded period.

State diagram

stateDiagram-v2
    [*] --> Reset
    Reset --> Working: DUTY_START, a = t
    Working --> InRun: status becomes OFF or SB
    InRun --> Working: run closes, length under 2h (R2)
    InRun --> PendingOpen: run closes, 2h or more, no valid pair (R4)
    InRun --> Paired: run closes, valid pair (R3)
    InRun --> Reset: run closes, 10h or more (R1)
    PendingOpen --> Working: duty continues, a and x unchanged
    Paired --> Working: a = end of first period, x = second length
    Working --> Working: DRIVE and ON events update d11, g, d8

PendingOpen and Paired are not extra storage states in the implementation. They are labels for the value of π and whether (a, x) changed at the last RUN_CLOSE.

1.5 The mathematics of the 14-hour window

Closed form

Let C14(t) be the window time consumed at t. With anchor a and excluded time x,

C14(t) = (t - a) - x          for t ≥ a        (x applies only after the second period completes)
Remaining window R14(t) = 14H - C14(t)
Deadline δ = a + 14H + x

Pause formulation

Equivalently define a clock-running indicator r(u) ∈ {0, 1} that is 0 on the excluded run and 1 elsewhere. Then C14(t) = ∫ from a to t of r(u) du. The clock "pauses" for the length of the second period.

Anchor recalculation

At RUN_CLOSE(ρ) with a valid pair, the anchor jumps backward in the sense of the timeline relative to where an unpaired clock would sit: it moves to e(π), the end of the first period. Everything before e(π) stops counting. This is why a pair can turn a nearly exhausted provisional window into a fresh one.

Theorem 1 (Pause equivalence)

For t ≥ e(ρ) after a valid pair (π, ρ), the elapsed-minus-excluded formula and the paused-clock integral give the same C14(t).

Proof. The run ρ occupies an interval of length ℓ(ρ) = x inside [e(π), t], because ρ begins after π ends. The indicator r is 0 on that interval and 1 elsewhere in [a, t] with a = e(π). Hence ∫ r = (t - a) - x. ∎

Theorem 2 (Monotone extension)

Completing a valid pair never moves the 14-hour deadline earlier than the provisional deadline held just before the second period began. In fact the deadline moves later by at least ℓ(ρ).

Proof. Let the provisional state before the pair completes be (a, x) with deadline δ = a + 14H + x, and let the new state be (a', x') = (e(π), ℓ(ρ)) with δ' = e(π) + 14H + ℓ(ρ). We show e(π) ≥ a + x. There are three cases for how π arose.

• π was itself the second period of an earlier valid pair (π₀, π). Then a = e(π₀) and x = ℓ(π). Since π starts after π₀ ends, e(π) = start(π) + ℓ(π) ≥ e(π₀) + ℓ(π) = a + x.
• π was never paired. Then x = 0. The anchor a is a duty start that occurred before π began, so a ≤ start(π) ≤ e(π), giving e(π) ≥ a + x.
• a = ⊥. No window was open, so there is no provisional deadline to move earlier.

In the first two cases δ' = e(π) + 14H + ℓ(ρ) ≥ a + x + 14H + ℓ(ρ) = δ + ℓ(ρ) ≥ δ. ∎

Operational meaning. A safety system can never be harmed by pairing evaluation. It can only discover more available hours. This justifies computing a provisional view in real time and a corrected view at pair completion.

Theorem 3 (Sustained throughput bound)

In any long chain of valid consecutive pairs, the long-run fraction of time spent on duty or driving is at most 7/12, equivalent to 14 working hours per 24-hour day.

Proof. Let the chain be P₁, w₁, P₂, w₂, …, where Pᵢ are qualifying runs and wᵢ is the total on-duty and non-qualifying time between Pᵢ and Pᵢ₊₁. Consider the moment just before Pᵢ₊₁ begins. The pair (Pᵢ₋₁, Pᵢ) is complete, so a = e(Pᵢ₋₁) and x = ℓ(Pᵢ). Elapsed time since a is wᵢ₋₁ + ℓ(Pᵢ) + wᵢ, so

C14 = wᵢ₋₁ + wᵢ ≤ 14H          (legality requires the window not be exceeded)

Every consecutive pair of work blocks therefore satisfies wᵢ₋₁ + wᵢ ≤ 14H. Summing over n consecutive blocks gives 2·Σw ≤ 14H·n, so Σw ≤ 7H·n. Each adjacent pair of rest periods is valid, so ℓ(Pᵢ) + ℓ(Pᵢ₊₁) ≥ 10H, and summing gives 2·Σℓ ≥ 10H·n, so Σℓ ≥ 5H·n. The work fraction Σw / (Σw + Σℓ) increases in Σw and decreases in Σℓ, so it is at most 7n / (7n + 5n) = 7/12. ∎

Operational meaning. Split-sleeper is a scheduling flexibility tool, not a source of extra sustained hours. The engine should be used to route a driver around a closed receiver or a bad traffic window, not to promise more miles per week. The same inequality is what a dispatcher optimizer can use as a feasibility cut.

Interaction with the other limits

1.6 Reference algorithm

Single pass, O(n) over the ELD event stream, constant memory.

from dataclasses import dataclass, field
from enum import Enum
from typing import Optional, List

H = 3600.0

class S(Enum):
    OFF = 0; SB = 1; ON = 2; D = 3

@dataclass
class Run:
    start: float
    end: float
    sb_max: float                      # longest contiguous SB sub-run
    @property
    def length(self): return self.end - self.start
    @property
    def is_long(self): return self.sb_max >= 7 * H

@dataclass
class State:
    a: Optional[float] = None          # window anchor
    x: float = 0.0                     # excluded second-period length
    pending: Optional[Run] = None      # last completed qualifying run
    d11: float = 0.0
    g: float = 0.0
    d8: float = 0.0

def valid(p: Run, r: Run) -> bool:
    return (p.length + r.length >= 10 * H and
            ((p.is_long and r.length >= 2 * H) or
             (r.is_long and p.length >= 2 * H)))

def close_run(st: State, r: Run) -> None:
    L = r.length
    if L >= 0.5 * H:
        st.d8 = 0.0
    if L >= 10 * H:                    # R1: full reset
        st.a, st.x, st.pending = None, 0.0, None
        st.d11 = st.g = 0.0
        return
    if L < 2 * H:                      # R2: not qualifying
        return
    p = st.pending
    if p is not None and valid(p, r):  # R3: valid pair
        st.a = p.end
        st.x = L
        st.d11 = st.g                  # driving between the two periods
    st.pending = r                     # R3 and R4: r is the next pending run
    st.g = 0.0

def process(segments) -> List[str]:
    """segments: time ordered (status, start, end), adjacent same-status merged."""
    st, violations = State(), []
    run: Optional[Run] = None
    for status, t0, t1 in segments:
        if status in (S.OFF, S.SB):
            if run is None:
                run = Run(t0, t1, (t1 - t0) if status == S.SB else 0.0)
                run._cur_sb = (t1 - t0) if status == S.SB else 0.0
            else:
                run.end = t1
                cur = getattr(run, "_cur_sb", 0.0)
                cur = cur + (t1 - t0) if status == S.SB else 0.0
                run._cur_sb = cur
                run.sb_max = max(run.sb_max, cur)
            continue
        if run is not None:
            close_run(st, run); run = None
        if st.a is None:
            st.a = t0
        dur = t1 - t0
        if status == S.D:
            st.d11 += dur; st.g += dur; st.d8 += dur
            if st.d11 > 11 * H: violations.append(f"11h exceeded at {t1}")
            if t1 > st.a + 14 * H + st.x: violations.append(f"14h window exceeded at {t1}")
            if st.d8 > 8 * H:  violations.append(f"8h without break at {t1}")
        elif dur >= 0.5 * H:
            st.d8 = 0.0
    return violations

1.7 Worked traces

All three traces start after a full reset. a is the window anchor, δ the deadline.

Trace A: 8/2

At 22:00 the driver has 12 hours of window and 9 hours of driving remaining. The driver had to begin the 2-hour period at or before 20:00, the provisional deadline.

Trace B: 7/3 (short period first)

Note the recalculation: driving before 15:00 stops counting once the pair completes.

Trace C: 7.5/2.5

1.8 Verification strategy

• Property tests for Theorems 1 to 3: random duty sequences, asserting that pair completion never moves the deadline earlier, and that the chained throughput bound holds.

• Golden vectors: the three traces above plus boundary cases (7:00:00 exactly, 6:59:59, 2:00:00 exactly, 9:59:59 total).

• Differential testing against ELD output files from certified devices over real fleet data; log every disagreement with the rule case (R1 to R4) that fired.

• Provisional vs final view: display provisional hours in real time, and re-emit corrected hours at each RUN_CLOSE so dispatch and the driver never see different numbers.

1.9 Deployment architecture

 ELD / telematics --> normalizer --> segment merger --> HOS FSM --> hours-remaining API
                                                           |               |
                                                           v               v
                                                   violation ledger   dispatch planner
                                                   (hash chained)     (feasibility cuts
                                                                       from Theorem 3)

The normalizer maps the event types in the ELD data file specification onto {OFF, SB, ON, D}, resolves personal conveyance and yard move flags, and flags unassigned driving. The planner calls the FSM in "what-if" mode to test candidate stop sequences before they are tendered.

Strong Tower Consulting provides independent systems architecture, feasibility audits, and engineering roadmaps for motor carriers and freight brokers. Call 763-244-1373 to evaluate practical implementation paths for your fleet.

CHAPTER 2: Fraudulent Chameleon Carrier FMCSA Graph Entity Resolution

2.1 The threat model

Onboarding fraud in freight comes in three shapes. They need different evidence, but one graph catches all three.

The defense is the same in each case: resolve identities across records, then measure how close a new applicant sits to known bad entities.

2.2 Graph schema

Node types

Edge types

graph LR
    C1[Carrier A<br/>DOT revoked] -- PRINCIPAL_OF --- P1[Principal]
    C2[Carrier B<br/>new DOT] -- PRINCIPAL_OF --- P1
    C1 -- LOCATED_AT --- A1[Address]
    C2 -- LOCATED_AT --- A1
    C1 -- OPERATES_VIN --- V1[VIN]
    C2 -- OPERATES_VIN --- V1
    C2 -- USES_PHONE --- T1[VOIP]
    C3[Carrier C<br/>applicant] -- USES_PHONE --- T1
    C3 -- SHARED_IP --- C2
    C2 -- REHYDRATED_DOT --> C1
    C3 -- COMMON_BENEFICIARY --- C2

Example queries (property graph, Cypher style)

// Applicant shares equipment with an entity that lost authority within 24 months
MATCH (new:Carrier {dot: $dot})-[:OPERATES_VIN]->(v:VIN)<-[:OPERATES_VIN]-(old:Carrier)
WHERE old.status IN ['REVOKED','OUT_OF_SERVICE','INACTIVE_ADVERSE']
  AND old.authority_revoked > date() - duration('P24M')
RETURN old.dot, collect(v.vin) AS shared_vins, count(v) AS n

// Two hops: applicant -> principal -> carrier -> address
MATCH p=(new:Carrier {dot:$dot})<-[:PRINCIPAL_OF]-(pr:Principal)
        -[:PRINCIPAL_OF]->(other:Carrier)-[:LOCATED_AT]->(a:Address)
WHERE other.dot <> new.dot AND a.commodity_flag = false
RETURN other.dot, other.status, a.canonical_street

2.3 Entity resolution

Step 1: Normalize and block

• Names: uppercase, strip punctuation and legal suffixes (LLC, INC, TRUCKING, TRANSPORT, EXPRESS), expand abbreviations, compute phonetic codes.
• Addresses: standardize to a postal canonical form, geocode, and flag commodity addresses (registered-agent offices, virtual offices, mail drops, truck stops).
• Phones: look up line type (landline, mobile, non-fixed VoIP), carrier, and port history.
• Blocking keys: zip3 + phonetic(name), canonical address, principal phonetic + state, VIN, phone. Blocking keeps pair comparison near linear.

Step 2: Fellegi-Sunter weights with value rarity

For each attribute k compare two records u and v.

m_k   = P(agree on k | same entity)
f_k(z) = population frequency of the shared value z
w_k   = log2( m_k / f_k(z) )                      if they agree on z
w_k   = log2( (1 - m_k) / (1 - f_k(z)) )          if they disagree
W(u,v) = Σ_k w_k
P(match) = 1 / ( 1 + 2^-( W + log2 prior_odds ) )

Because f_k(z) is the frequency of the specific shared value, agreement on a rare value is worth a lot and agreement on a common value is worth almost nothing. Two carriers at a registered-agent address in a state where thousands of entities use it produce f ≈ 0.02 and a small weight. Two carriers with the same 17-character VIN produce f ≈ 10⁻⁹ and an enormous one. This is the inverse-document-frequency idea applied to identity.

To avoid double counting correlated attributes (an address and a phone that both come from the same business card), group correlated attributes and take the maximum weight within a group rather than the sum.

Step 3: Edge confidence

p_e = P(match) becomes the confidence on the derived edge. Matching is done to a threshold τ_edge (start near 0.6) and re-tuned from labeled outcomes.

2.4 Deriving REHYDRATED_DOT

A new carrier n and an old carrier o with adverse history are linked when independent evidence of continuity accumulates.

For each evidence channel i in {principal, address, phone, VIN set, policy/agent, bank/payee, device/IP}:
    p_i  = match probability from Section 2.3
    g_i  = temporal gate = exp( -Δt / T_i )        (Δt = gap between old exit and new entry)
Evidence score   S(n,o) = 1 - Π_i ( 1 - p_i · g_i )          (noisy-OR)
Severity         sev(o) ∈ [0,1]  from the old entity's history:
                   revoked for safety or insurance = 1.0
                   out-of-service order            = 0.9
                   inactive after adverse events   = 0.6
                   voluntary clean exit            = 0.1
Edge weight      ω(n,o) = S(n,o) · sev(o)
Create edge if   S(n,o) ≥ τ_edge

The VIN channel deserves a continuity measure beyond exact equality. With V(n) and V(o) the sets of VINs seen on each entity,

Jaccard(n,o) = |V(n) ∩ V(o)| / |V(n) ∪ V(o)|
p_VIN        = 1 - (1 - q)^|V(n) ∩ V(o)|        (q = per-VIN continuity probability, near 0.9)

Each shared VIN is nearly independent evidence of operational continuity because sharing a physical truck is much rarer than sharing an address.

2.5 Scoring algorithm

Risk seeds and propagation

Let s₀(v) ∈ [0,1] be known-bad evidence on a node: revoked authority, out-of-service order, confirmed double brokering, cargo theft finding, fraud chargeback. Let W be the weighted adjacency matrix where each edge weight is ω_type · p_e, and let P be its row-normalized form so each row sums to at most 1.

Risk propagation is personalized PageRank with restart toward the seeds:

r = (1 - α) s₀ + α Pᵀ r         with damping α in (0,1), typically 0.5 to 0.7
r = (1 - α) ( I - α Pᵀ )⁻¹ s₀

Theorem 4 (Well-posedness and convergence)

For 0 < α < 1, the fixed point exists, is unique, is non-negative, and the iteration r⁽ᵏ⁺¹⁾ = (1-α) s₀ + α Pᵀ r⁽ᵏ⁾ converges geometrically from any start.

Proof. The map T(r) = (1-α) s₀ + α Pᵀ r is affine. Under the induced 1-norm, ‖αPᵀ‖₁ = α · max column sum of Pᵀ, which equals α times the maximum row sum of P, at most α < 1. So T is a contraction, and the Banach fixed-point theorem gives a unique fixed point with ‖r⁽ᵏ⁾ - r*‖ ≤ αᵏ ‖r⁽⁰⁾ - r*‖. Non-negativity follows because (I - αPᵀ)⁻¹ = Σ αᵏ (Pᵀ)ᵏ is a convergent series of non-negative matrices. ∎

Theorem 5 (Hub dilution)

A commodity node of degree k (for example a registered-agent address) passes at most α · r(h) / k of its risk to each neighbor, so shared common addresses cannot flood the graph with false risk.

Proof. Row normalization gives each outgoing edge of h weight at most 1/k when edge weights are equal, and at most ω_max / Σ ω in general. Each neighbor therefore receives at most α · r(h) / k (up to the weight ratio). Because k is large for commodity nodes and the edge weights already carry the value-rarity weights of Section 2.3, the contribution vanishes as k grows. ∎

Direct-feature risk and final score

Graph risk is combined with first-party evidence by noisy-OR so independent signals compound without exceeding 1.

R = 1 - ( 1 - r_graph ) · Π_j ( 1 - p_j )         over triggered direct features j

The probabilities p_j below are starting priors to be calibrated against your own labeled outcomes.

Capacity plausibility check. With U declared power units, weekly loaded miles M requested must satisfy M ≤ U · M_max, where M_max is a physical bound (for example 3,000 to 3,500 miles per unit per week for solo drivers). A carrier requesting M far above the bound is a capacity ghost.

Decision tiers

Every action stores the evidence subgraph (the nodes and edges that raised the score) so the decision is explainable to the applicant, to insurers, and in any later dispute.

2.6 Data sources and fusion

2.7 Pipeline

flowchart LR
    A[Applicant packet] --> B[Normalize and block]
    B --> C[Fellegi-Sunter match<br/>with value rarity]
    C --> D[Derive edges:<br/>REHYDRATED_DOT, SHARED_IP,<br/>COMMON_BENEFICIARY]
    D --> E[Propagate risk<br/>personalized PageRank]
    E --> F[Fuse with direct<br/>features, noisy-OR]
    F --> G{Tier}
    G -->|low| H[Approve]
    G -->|mid| I[Step-up verification]
    G -->|high| J[Analyst hold<br/>evidence subgraph]
    G -->|critical| K[Decline with reasons]
    I --> F
    J --> L[Outcome labels]
    H --> L
    K --> L
    L --> M[Recalibrate weights and priors]

2.8 Operations and fairness controls

• Cluster view. Run community detection (Leiden or Louvain) on the thresholded graph weekly. A cluster in which several members have adverse histories is a standing watchlist for any new applicant that links into it.
• Human review for adverse action. Scores route applicants; people decide. The evidence subgraph supports that decision and the explanation to the applicant.
• Backtesting. Replay historical onboardings and measure precision at each tier, time-to-detection, and stability of rankings when edge thresholds shift.
• Callback protocol. Verify any contact change by calling the number on the federal registration record, never the number on the packet.
• Data hygiene. Use salted hashes for personal identifiers and for bank and policy numbers. Keep the graph free of data that is not needed for the match.

Strong Tower Consulting provides independent systems architecture, feasibility audits, and engineering roadmaps for motor carriers and freight brokers. Call 763-244-1373 to evaluate practical implementation paths for your fleet.

CHAPTER 3: Refrigerated FSMA 204 Tamper-Proof Cold Chain Audit Vault

3.1 The problem

A receiver rejects a trailer of produce, protein, or dairy and cites a temperature reading. The carrier then faces a cargo claim under the Carmack Amendment (49 U.S.C. § 14706). The facts that decide the claim are usually these:

• What was the product core temperature at pickup, and did the shipper pre-cool the load?

• What did the unit do between pickup and delivery: setpoint, mode, defrost cycles, door events?

• What was the product core temperature (not just air temperature) over time?

• Can any of these records be shown to be unaltered since they were created?

A carrier with only a return-air chart can answer the second question and nothing else, and the receiver's probe reading at the dock tends to win. This chapter builds the records and the physics that answer all four.

Regulatory context

• Carmack Amendment: the claimant makes a prima facie case by showing delivery in good condition, arrival in damaged condition, and the amount of damages. The carrier then bears the burden of showing it was free from negligence and that the damage resulted from a recognized exception (for example act of the shipper or inherent vice of the goods).
• FSMA Section 204 traceability rule (21 CFR Part 1, Subpart S): requires key data elements (KDEs) at critical tracking events (CTEs) for foods on the Food Traceability List, with records provided to FDA as an electronic sortable spreadsheet within 24 hours on request. The compliance date was extended by FDA to July 20, 2028. Confirm the current date before planning.
• Sanitary Transportation of Human and Animal Food rule (21 CFR Part 1, Subpart O): carriers must keep records of temperature specifications and operations, and shippers must specify them.

Carriers that generate Shipping and Receiving CTE-grade data now support every shipper and receiver customer, and they build the evidence record for cargo claims at the same time.

3.2 Evidence architecture

   SENSORS (per trailer)                     EDGE RECORDER                     VAULT
 +-------------------------+          +--------------------------+     +----------------------+
 | return air probe        |          | secure element (keys)    |     | append-only storage  |
 | supply air probe        |  ----->  | monotonic counter        |---->| (write once, read    |
 | product pulp probes x N |          | hash chain + Merkle root |     |  many, object lock)  |
 | reefer unit mode, set-  |          | local signing            |     +----------+-----------+
 |   point, defrost flag   |          | store-and-forward buffer |                |
 | door and reefer events  |          +--------------------------+                v
 | GPS and time source     |                                          +----------------------+
 +-------------------------+                                          | independent time     |
                                                                      | anchor (RFC 3161)    |
                                                                      +----------+-----------+
                                                                                 v
                                                                      +----------------------+
                                                                      | DOSSIER BUILDER      |
                                                                      | thermal model, PDF,  |
                                                                      | manifest, verifier   |
                                                                      +----------------------+

Sensor set

3.3 Cryptographic logging

Record chain

Every sample is a record rᵢ = (device_id, seq, t_device, counter, payload). The chain value is

h₀ = H( device_id || trip_id || genesis_nonce )
hᵢ = H( hᵢ₋₁ || encode(rᵢ) )              H = SHA-256

Every N records (for example every 15 minutes) the device builds a Merkle tree over the records in the block, signs the root together with the last chain value:

block_sig = Sign_sk( merkle_root || hᵢ || block_index || counter || t_device )

The signing key sk lives in a secure element on the recorder and never leaves it. The public key is registered to the device in the vault at commissioning.

Independent time

At least once per hour (and at trip start and end) the block signature hash is submitted to a trusted timestamp authority using the RFC 3161 protocol. The returned token proves the block existed no later than that time. A second anchor is written to write-once storage with object-lock retention. Two independent anchors make backdating impractical.

Gap and tamper detection

Theorem 6 (Tamper evidence)

If SHA-256 is collision-resistant and the signing scheme is existentially unforgeable, then any modification, deletion, insertion, or reordering of records in a signed and timestamped block is detected by an independent verifier who holds only the public key, the records, and the timestamp token, except with negligible probability.

Proof sketch. Suppose an adversary produces records r' differing from the signed records r yet verifying under the same signed root. Either merkle_root(r') = merkle_root(r), which with differing leaves yields a SHA-256 collision, or the adversary produced a valid signature on a different root without sk, contradicting unforgeability. Chain-continuity covers cross-block edits: a changed record changes hᵢ and every later value, and the later signed blocks already commit to the original hᵢ. Backdating requires a forged timestamp token, which requires compromising the timestamp authority. The probability of a collision found by a generic attack is bounded by about 2⁻¹²⁸ (birthday bound for a 256-bit hash). ∎

Key management

Per-device keys generated in the secure element, rotated on a schedule, revoked on device loss, with a published revocation list in the vault. Firmware that handles keys is signed, and boot attestation values are recorded in the first block of each trip.

3.4 Thermal inertia mathematics

Return air is not product temperature. The sensor that the refrigeration unit controls responds in seconds to minutes. A pallet of produce responds in hours. A defrost cycle, a door opening, or a brief setpoint change can swing return air by several degrees without moving the core by a fraction of a degree. The model below makes that difference computable.

Lumped-capacitance model

For a load with mass m, specific heat c_p, effective surface heat transfer coefficient h, effective area A, and ambient (air) temperature T_a(t):

m · c_p · dT_p/dt = h · A · ( T_a(t) - T_p(t) ) + Q_r(T_p)

τ = m · c_p / ( h · A )                  thermal time constant

dT_p/dt = ( T_a - T_p ) / τ + Q_r / ( m · c_p )

Q_r is respiration heat for fresh produce (a rising function of temperature) and zero for frozen or processed goods.

Exact solution, piecewise-constant ambient

Over a sample interval Δ with ambient held constant at T_a[k] (and Q_r held at its start value), the exact update is

T_p[k+1] = T_a[k]  +  ( T_p[k] - T_a[k] ) · e^(-Δ/τ)  +  τ · q_k · ( 1 - e^(-Δ/τ) )
q_k = Q_r( T_p[k] ) / ( m · c_p )

This is exact for the model, with no discretization error from step size, so the estimator is stable for any sample rate.

Validity of the lumped model

The model is valid when the Biot number Bi = h · L_c / k_p is below about 0.1, where L_c is the characteristic length of the product and k_p its thermal conductivity. For palletized cartons, the air-gap and packaging resistance dominate, and Bi is small in effect. For dense or bulk product (large blocks, frozen cases, bulk bins) use a two-node model (air to package to core):

d/dt [T_pkg]   =  [ -(1/τ₁ + 1/τ₂)    1/τ₂ ] [T_pkg]  +  [ 1/τ₁ ] T_a
     [T_core]      [   1/τ₃            -1/τ₃ ] [T_core]    [  0   ]

where τ₁ is air-to-package, τ₂ package-to-core, and τ₃ core-to-package. The discrete update uses the matrix exponential.

Theorem 7 (Excursion bound)

Suppose the product starts at core temperature T₀, and the ambient air stays within [T_set - δ₋, T_set + δ₊] except during an excursion of duration d with ambient at most T_set + Δ_x (with Δ_x ≥ δ₊). If the product is at or below T_set when the excursion begins, then the core temperature at the end of the excursion exceeds T_set by at most Δ_x · ( 1 - e^(-d/τ) ).

Proof. Take the excursion ambient T_a ≤ T_set + Δ_x and initial T_p(0) ≤ T_set. Define y = T_p - T_set. Then dy/dt = (T_a - T_set - y)/τ ≤ (Δ_x - y)/τ. Comparison with the solution of the equality y' = (Δ_x - y)/τ, y(0) = 0, gives y(d) ≤ Δ_x (1 - e^{-d/τ}). Because the right side of the differential inequality is increasing in T_a and decreasing in y, the comparison principle applies. ∎

Worked example: defrost and door events

A mixed produce load has τ = 10 h (a measured value for tightly packed pallets in cartons; range in practice is roughly 4 to 24 hours depending on pack and airflow).

A return-air log shows a spike of 8 to 15 °C in each row. The core responds by under half a degree in the first two. That is the gap between what the air probe shows and what the product experienced.

Periodic disturbance attenuation

For a sinusoidal ambient disturbance of amplitude A and period P (for example regular defrost cycles), the steady-state core amplitude is

A_core = A / sqrt( 1 + ( 2π τ / P )² )

With τ = 10 h, P = 6 h, A = 4 °C: 2πτ/P = 10.47, so A_core ≈ 0.38 °C, an attenuation of about 90 percent.

Parameter estimation and uncertainty

• At loading, record pulp probe readings alongside air readings, and fit τ by least squares on the first several hours (ln of the normalized gap (T_p - T_a) is linear in t with slope -1/τ when ambient is steady).

• Use a Kalman filter on T_p with the pulp probes as measurements and the model above as dynamics, so probe noise and short dropouts do not create phantom excursions.

• Report a band, not a line. For forcing above the product temperature, the response is monotone in τ: larger τ means a slower rise. So evaluate the model at τ_low and τ_high from the fit confidence interval to produce an envelope; for more complex forcing use Monte Carlo sampling over τ.

Excursion metrics

For limit T_lim and estimated core temperature T̂_p(t):

Time above limit        E_t = ∫ 1[ T̂_p(t) > T_lim ] dt
Degree-hours above      E_d = ∫ max( 0, T̂_p(t) - T_lim ) dt
Worst-case (envelope)   E_d⁺ evaluated on the upper envelope

A load for which E_d⁺ = 0 has a mathematically supported claim that the product never exceeded the limit even if the air did.

3.5 The court-ready dossier

The dossier is a self-verifying package. Each piece is designed to meet an evidentiary need that the other side will probe.

Contents

Mapping to the Carmack framework

Evidence-admissibility design

The package is built to satisfy the usual foundation requirements, and the carrier's counsel decides how to present it:

• Business records. Routine, contemporaneous, system-generated logs maintained in the regular course of business (Federal Rule of Evidence 803(6)), with a custodian certification (FRE 902(11)).
• Machine-generated data. A qualified person's certification that copies from electronic devices and systems were verified by hash comparison (FRE 902(13) and 902(14)).
• Authentication of a process. The verifier and method statement document how the system produces accurate results (FRE 901(b)(9)).
• Summaries. Charts and tables are derived from, and traceable back to, the underlying records (FRE 1006).
• Expert testimony. The thermal model is a published first-order heat transfer model, validated against pulp probe data, with a stated error rate, which supports the usual reliability inquiry (FRE 702).

Producing the dossier

 trip ends --> assemble blocks + tokens --> verify chain --> fit model --> envelope --> render PDF
                                                |                                        |
                                                v                                        v
                                         integrity report                       hash manifest (SHA-256 of every file)
                                                                                         |
                                                                              timestamp the manifest, store in vault

The manifest hash is itself timestamped, so the dossier as delivered to the other party can be tied to a fixed moment.

3.6 Operating model

• Shipper onboarding: capture each shipper's pre-cool and loading temperature instructions in a structured form, so Section 2 is generated automatically.
• Real-time alerts are driven by the modeled core temperature and its envelope, not just return air. This cuts false alarms from defrost and door events and catches slow drifts that return air hides.
• Claim triage: when a rejection arrives, the dossier is assembled in minutes, and the excursion metrics decide whether to contest, settle, or counter with a shipper-responsibility notice.
• Retention matches the longest claim and FDA record window your customers require, with legal-hold flags that override deletion.

Strong Tower Consulting provides independent systems architecture, feasibility audits, and engineering roadmaps for motor carriers and freight brokers. Call 763-244-1373 to evaluate practical implementation paths for your fleet.

CHAPTER 4: Automated Intermodal Chassis Split & LFD Demurrage Mitigation

4.1 The operating problem

A drayage truck at a marine terminal makes gate moves. Each gate move costs time, fuel, and driver hours. Two kinds of waste dominate:

• Single-mission turns. A truck delivers an export, leaves empty, then returns later for an import. A dual-mission turn does both in one visit: the truck arrives with an export container mounted on its chassis, the terminal grounds that container, then loads an import container onto the same chassis, and the truck leaves with the import.

• Chassis splits. The container is at the terminal and the chassis must come from a pool yard elsewhere, which forces an extra stop and extra deadhead.

Layered on top is the clock. Each import container has a last free day (LFD). After it, ocean carrier and terminal demurrage accrues, and for rail containers the railroad's ramp storage or per diem. Detention and chassis rental accrue while equipment is out. Many of these charges are billed for days on which the cargo interest could not actually retrieve or return the container.

4.2 Dual-mission turns as bipartite matching

Model

• Left set E = {e₁, …, eₘ}: exports mounted on chassis, arriving at the terminal.
• Right set J = {j₁, …, jₙ}: imports grounded in the stack, awaiting pickup.
• A pair (eᵢ, jₖ) is an edge if the dual-mission turn is feasible.

Feasibility constraints

Edge weight

The weight is the savings from the dual turn versus doing the two moves separately, plus a risk term for imports near their LFD.

w(eᵢ, jₖ) = [ C_alone(eᵢ) + C_alone(jₖ) - C_chain(eᵢ, jₖ) ]  +  λ · U(jₖ, tᵢₖ)

C_*   = operating cost: deadhead miles, driver time, fuel, gate fees, chassis days
U(j,t) = avoided demurrage and per diem
       = Φ_j( t_alt(j) ) - Φ_j( t )
Φ_j(t) = cumulative tariff charge on container j if picked up at time t
t_alt  = the next feasible pickup time if j is not matched now

Because tariffs escalate with days past LFD, Φ_j is convex, so an import already past LFD earns a large U for every day of delay avoided. That makes the matcher prefer urgent imports without a hand-written priority rule.

Optimization problem

maximize   Σ w(eᵢ, jₖ) · x_ik
subject to Σₖ x_ik ≤ 1   for each export i
           Σᵢ x_ik ≤ 1   for each import k
           x_ik ∈ {0,1},  x_ik = 0 where (i,k) is infeasible

Unmatched exports and imports are served as single-mission moves at their standalone cost, which is already folded into w through C_alone.

Theorem 8 (Integrality and polynomial solvability)

The linear relaxation of the problem has an integral optimal solution, and it can be found in O(n³) time by the Hungarian algorithm.

Proof. The constraint matrix is the vertex-edge incidence matrix of a bipartite graph, which is totally unimodular: every square submatrix has determinant in {-1, 0, 1}. A linear program over a polytope {x : Ax ≤ b, x ≥ 0} with A totally unimodular and b integral has integral vertices, so the simplex method or any vertex-finding method returns a 0-1 solution. The Kuhn-Munkres (Hungarian) algorithm solves the equivalent assignment problem on the square-padded matrix in O(n³). ∎

Why greedy fails

Take two exports and two imports with savings (dollars):

         j1     j2
   e1   100     90
   e2    90     10

Greedy takes the largest edge (e1, j1) = 100, which forces (e2, j2) = 10, for a total of 110. The optimum is (e1, j2) + (e2, j1) = 90 + 90 = 180. Dispatchers who match by "best single pair first" leave roughly 40 percent on the table in this example, and the gap grows with problem size.

Rolling-horizon operation

Arrivals and releases are continuous, so the matcher runs on a rolling horizon:

• Every few minutes, build the graph from trucks within a radius of the terminal, exports with appointments in the next window, and available imports.

• Solve the assignment.

• Commit only edges that expire inside the next horizon, and release the rest to re-optimize. This keeps the plan stable while preserving flexibility.

• Add a small stability bonus ε on edges that were in the previous solution, to prevent churn from tiny weight changes.

4.3 Chassis split as a flow problem

The chassis pool adds capacity and location. Model it as a min-cost flow:

 source --> chassis pool yards (capacity = chassis on hand, by type)
        --> pickup move nodes (import container j requires a chassis of type T_j)
        --> dual-mission links (export chassis released at the terminal is reused for import j)
        --> sink

 arc costs = deadhead miles to the pool yard + chassis day-rate + pool dwell fees
 reuse arc cost = 0 (the chassis never leaves the terminal)

A dual-mission match creates a zero-cost chassis reuse arc, which removes the pool trip entirely. The flow formulation lets the optimizer decide when it is cheaper to take a split (pool pickup) for an urgent container than to wait for a dual match.

flowchart LR
    S((Source)) --> P1[Pool yard A<br/>cap by type]
    S --> P2[Pool yard B]
    P1 -->|deadhead cost| J1[Import j1]
    P2 -->|deadhead cost| J2[Import j2]
    E1[Export e1<br/>chassis mounted] -->|cost 0 reuse| J1
    E2[Export e2<br/>chassis mounted] -->|cost 0 reuse| J2
    J1 --> T((Sink))
    J2 --> T

4.4 LFD clock mathematics and clock-stop accounting

The retrievability indicator

The cargo interest can only be charged for time when it was practically able to retrieve the container. Define

u(t) = 1   if all of the following hold at time t:
             - container released and available (no unresolved hold)
             - terminal gate open and operating
             - a pickup appointment slot was available to the carrier
             - a compatible chassis was obtainable
             - the container was physically accessible in the yard
       = 0   otherwise

Each factor comes from a recorded data feed (Section 4.5). The indicator u(t) partitions time into chargeable and non-chargeable intervals.

Recomputed last free day

Let F be the free days allowed, K(d) ∈ {0,1} the tariff's calendar rule (for example excluding weekends and holidays), and θ ∈ (0,1] the fraction of the terminal's operating hours on day d during which u = 1 for the day to count. Define a day counter

c(d) = K(d) · 1[ coverage(d) ≥ θ ]        with  coverage(d) = (hours with u=1 on day d) / (terminal operating hours on day d)

LFD' = min { D : Σ_{d = d₀ to D} c(d) ≥ F }

The parameter θ encodes the dispute position (a strict reading uses θ = 1, meaning a day counts only if the container was retrievable all operating hours, and a lenient reading counts a day with any retrievability). Both are recorded in the dossier so the argument is explicit.

Theorem 9 (Clock-stop monotonicity)

For any retrievability indicator u, LFD' ≥ LFD, and the recomputed charge is no greater than the billed charge.

Proof. By construction c(d) ≤ K(d) pointwise, with equality when u ≡ 1 on operating hours. The tariff's original LFD is min { D : Σ K(d) ≥ F }. Since Σ c(d) ≤ Σ K(d) for every D, the recomputed sum reaches F no earlier, so LFD' ≥ LFD. For charges, let rate(k) be the nondecreasing daily rate for the k-th chargeable day after LFD. Moving the start of chargeable days from LFD to LFD' removes the earliest billed days, and every remaining day is assigned an index no larger than before. Because rate is nondecreasing, each remaining term does not increase, so the total does not increase. ∎

Disputed amount

Fee_billed  = Σ_{k = 1 to n_b} rate(k)
Fee_recomp  = Σ_{k = 1 to n_r} rate(k)             n_r = max(0, return_day - LFD')
Dispute     = Fee_billed - Fee_recomp  ≥ 0

4.5 Automated evidence generation under OSRA-22

Regulatory background

The Ocean Shipping Reform Act of 2022 (Pub. L. 117-146) and the Federal Maritime Commission's rules built on it govern demurrage and detention billing by ocean common carriers and marine terminal operators. In summary, the billing rule (46 CFR Part 541) requires timely invoices that carry specified minimum content, gives the billed party a window to dispute, requires the billing party to answer within a fixed period, and ties collectability to compliance. The FMC's interpretive rule on demurrage and detention (46 CFR Part 545) states the incentive principle: charges exist to encourage prompt movement of cargo and return of equipment, so they serve little purpose when the cargo interest cannot retrieve or return the container. Confirm the current text and periods for your trade lane.

Rail ramp storage and per diem are governed by railroad tariffs and the applicable rail regulatory framework rather than the FMC billing rule. The same clock-stop engine runs against the railroad's tariff definitions, and the evidence package carries that tariff in place of the FMC citations.

Clock-stop event taxonomy

Data inputs

• Gate-in and gate-out transactions and terminal operations status messages (for example EDI 322 and related EDI 315 and 214 status messages)
• Appointment records and availability snapshots taken at the times the carrier tried to book
• Driver GPS and geofence dwell
• Dispatch and communication logs
• Terminal and ocean carrier notices archived with timestamps
• Invoice and tariff documents as received

Pipeline

flowchart TD
    A[Container list with LFD and tariff] --> B[Collect feeds:<br/>gate, appointment, GPS, status, notices]
    B --> C[Hash and timestamp each artifact]
    C --> D[Compute u t and coverage per day]
    D --> E[Recompute LFD prime and fee]
    E --> F[Check invoice compliance:<br/>timeliness, content, billed party]
    F --> G[Assemble dispute package]
    G --> H{Deadline check}
    H -->|within dispute window| I[Submit with exhibits]
    H -->|window closing| J[Escalate to owner]
    I --> K[Track response clock]
    K --> L[Learn outcomes, adjust theta and exhibits]

Invoice compliance checks

The generator tests each invoice against the rule's elements and records pass or fail with the evidence:

Dispute package

• Cover letter with the legal basis and a request for specific relief.

• Timeline of container events with source references.

• Clock-stop table: each interval where u = 0, its code (CS1 to CS8), and the exhibit that proves it.

• Recomputed LFD and fee, with both θ readings if relevant.

• Invoice compliance findings.

• Exhibit index with SHA-256 hashes, capture timestamps, and a verifier.

Example manifest fragment:

{
  "container": "ABCD1234567",
  "tariff": "carrier-tariff-id",
  "billed": {"lfd": "2026-10-09", "days": 6, "amount": 2150.00},
  "recomputed": {"lfd_prime": "2026-10-13", "days": 2, "amount": 400.00, "theta": 1.0},
  "clock_stops": [
    {"code": "CS2", "from": "2026-10-09T08:00", "to": "2026-10-11T17:00",
     "exhibit": "appt-availability-snapshots.pdf",
     "sha256": "9f2c...e1"},
    {"code": "CS3", "from": "2026-10-12T06:00", "to": "2026-10-12T15:00",
     "exhibit": "pool-inventory-and-dispatch-log.pdf",
     "sha256": "41ba...07"}
  ],
  "dispute_amount": 1750.00
}

Prevention beats dispute

The same engine runs forward. For each import, it predicts retrievability windows from appointment supply and terminal advisories, and feeds the matcher's urgency term U. A container with a likely closure or appointment drought before its LFD gets priority in matching, and the dispatcher sees the risk date early enough to act. The dispute pipeline collects the evidence in the background for the days where prevention was not possible.

4.6 Key performance indicators

Strong Tower Consulting provides independent systems architecture, feasibility audits, and engineering roadmaps for motor carriers and freight brokers. Call 763-244-1373 to evaluate practical implementation paths for your fleet.

Implementation Roadmap

Each phase ends with measurable acceptance criteria: zero disagreements with certified ELD output after rule-case triage (Chapter 1), tier precision targets on replayed onboardings (Chapter 2), a verified dossier for every sampled trip (Chapter 3), and measured deadhead and fee recovery against baseline (Chapter 4).

Regulatory References

Regulatory citations in this paper reflect their text at publication. Rule text, compliance dates, and agency guidance change, so confirm the current eCFR text and agency notices when you implement.

• 49 CFR Part 395, including § 395.1(g) (sleeper berth provisions) and Subpart B (electronic logging devices)
• 49 U.S.C. § 14706 (Carmack Amendment)
• 21 CFR Part 1, Subpart S (food traceability) and Subpart O (sanitary transportation of human and animal food)
• Ocean Shipping Reform Act of 2022, Pub. L. 117-146
• 46 CFR Part 541 (demurrage and detention billing) and 46 CFR Part 545 (interpretive rules)
• Federal Rules of Evidence 702, 803(6), 901, 902(11), 902(13), 902(14), 1006
• RFC 3161 (Internet X.509 Public Key Infrastructure Time-Stamp Protocol)

About Strong Tower Consulting, LLC. Strong Tower Consulting, LLC is a Minnesota firm founded in 2008 by Scott Elliott, with more than 18 years of freight transportation systems engineering. The firm provides independent systems architecture, feasibility audits, and engineering roadmaps for motor carriers, intermodal operators, refrigerated fleets, and freight brokerages. Strong Tower Consulting, LLC and Exspeedite LLC are separately organized sister companies under common ownership.

Strong Tower Consulting provides independent systems architecture, feasibility audits, and engineering roadmaps for motor carriers and freight brokers. Call 763-244-1373 to evaluate practical implementation paths for your fleet.