Fuel Management System Product

Overview

Fuel Management Systems (FMS) are the central nervous system of retail fuel stations and fleet depots. An FMS coordinates authorization (fuel purchase), metering (volume measurement), inventory reconciliation (leak detection), and compliance reporting (audits). The system comprises three tiers: on-site Site Controller Module, back-office cloud server, and payment gateway integration.

The site controller is a fanless industrial PC running real-time FMS firmware. It communicates via RS-485 Modbus with the Console Display Unit for inventory data, and via relays to the Pump Unit solenoid shutoff. When a customer swipes a card at a dispenser, the Payment Interface Module requests authorization from the site controller, which forwards the request to the back-office via cellular modem. Within 2 seconds, authorization is returned, the site controller energizes the pump relay, and fuel flows.

Site Controller Architecture

The Site Controller Module is a rugged DIN-rail mounted industrial PC running a Linux-based FMS operating system. The Embedded Industrial PC processor is typically an Intel Atom or ARM multi-core CPU, paired with 4 GB RAM and 32 GB SSD for transaction history. The Ethernet Switch provides local Gigabit networking to Fuel Dispenser payment units and Console Display Unit.

The RS-485 Serial Module is an isolated serial interface (Modbus RTU) connecting to pump controllers and ATG probes. Isolation prevents electrical noise from high-current pump circuits from corrupting data signals. The Power Input Module accepts 24 VDC from the site's main power panel, includes surge protection, and a supercapacitor module that sustains the controller for 15+ minutes during brief brownouts, allowing graceful shutdown and transaction logging.

Transaction Authorization Flow

A customer insert a card into the Payment Interface Module and selects a pump. The dispenser's payment processor sends a pre-authorization request to the site controller via Modbus TCP or CAN. The site controller receives the card details, PAN, and amount requested.

The site controller forwards the authorization to the back-office Back-Office Cloud Server via the Wireless Telemetry Gateway (cellular or satellite). The back-office Payment Card Integration gateway (PCI Level 1 certified) sends the request through the payment processor network (Visa, Mastercard, or specialized fuel card processors like Fuelman, Comdata).

Assuming approval, the processor returns an authorization code. The back-office relays this to the site controller (typically <1 second). The site controller energizes the Dispenser Control Interface pump relay, enabling the Pump Unit motor. The customer fuels; the Fuel Dispenser reports volume to the site controller in real time. When the nozzle automatic shutoff trips, fuel flow ceases, and the site controller captures the final volume.

The site controller sends a settlement request to the back-office with actual volume dispensed, not the authorized amount (useful if customer fueled less than pre-authorized). The back-office adjusts the charge, routes the transaction through the payment processor for clearing, and records it in the Database and Audit Log Storage.

Inventory Reconciliation and Leak Detection

The site controller polls the Console Display Unit every 5–15 minutes, retrieving current tank level and temperature-corrected volume. The controller performs daily reconciliation: Actual Inventory = Previous Day's Closing Inventory + Today's Deliveries − Today's Total Dispensed.

If Actual Inventory is consistently lower than calculated (e.g., missing 50 gallons in a week), the FMS leak detection algorithm flags a potential slow leak. The controller triggers a dry-contact alarm relay to the Leak Monitoring System sensor circuit and logs an alert in the Database and Audit Log Storage.

Modern FMS systems employ machine-learning models trained on historical inventory patterns, distinguishing between legitimate temperature-driven fluctuations and actual theft/leakage. A slow leak at 0.2 gallons per hour might accumulate to 50 gallons per month—significant enough to exceed environmental liability thresholds.

Back-Office Cloud Server

The Back-Office Cloud Server is a virtual or bare-metal server hosting the FMS database engine and API gateway. The Database Engine is typically PostgreSQL or MySQL, storing:

• Transactions (card number token, volume, price, timestamp)
• Inventory snapshots (ATG readings, temperature, timestamp)
• Alarms (leak detection, equipment faults, payment declines)
• Audit logs (who accessed what, when)

The REST API Gateway exposes REST endpoints for site controllers to push transactions and pull authorization responses. Communication is encrypted (HTTPS/TLS 1.2+) and includes mutual authentication. Site controllers are provisioned with client X.509 certificates; back-office servers verify identity before accepting requests.

The Web Dashboard UI dashboard is a single-page application (React or Vue) displaying real-time inventory across all sites, transaction history, exception reports (failed authorizations, high leak rates), and KPIs (gallons dispensed, fuel sold, average price per site).

Card Processing and PCI Compliance

The Payment Card Integration is the most security-sensitive component. Card data (PAN, expiration, CVC) must never be stored or transmitted unencrypted. The site controller never handles full card details; the Payment Interface Module reads the card and transmits only a tokenized form or a one-time encrypted blob.

The back-office Hardware Security Module (HSM) (a physical Hardware Security Module) decrypts the blob, formats a payment processor request, and re-encrypts the PAN before transmission to the processor. The Card Tokenization Service replaces the PAN with an opaque token stored in the transaction database. This reduces PCI DSS audit scope: instead of auditing 1000s of transactions containing real card numbers, only the HSM's cryptographic operations are scope.

Wireless Telemetry

The Wireless Telemetry Gateway provides connectivity. Retail sites may have cellular LTE coverage; rural fleet depots may use satellite (Globalstar or Iridium). The gateway includes a Data SIM Card provisioned for data-only service (voice disabled), reducing cost and surface area for SIM swapping attacks.

Telemetry is typically pushed on a 4-hour cycle: site controller aggregates all transactions, inventory snapshots, and alarms from the past 4 hours and sends to back-office. If cellular is unavailable, the site controller stores transactions locally on the 32 GB SSD; upon reconnection, it transmits queued data. This ensures fault tolerance: a 1-day cellular outage does not cause loss of transaction records.

Receipt Printing (Optional)

The optional Receipt Printer is a thermal receipt printer integrated into the Cabinet Enclosure. The site controller sends receipt data (card last 4 digits, pump number, gallons, price, authorization code) to the Thermal Print Head via serial or Ethernet. The Stepper Motor feeds Paper Roll at 3 inches per second, printing a 4-inch-wide receipt.

Modern FMS systems increasingly transmit receipts via email or SMS rather than printing, reducing paper waste and eliminating printer maintenance.

Compliance and Auditing

The Database and Audit Log Storage includes an encrypted audit log: every transaction, every alarm, every configuration change, and every access is timestamped and signed. Regulatory agencies (EPA for environmental, state fuel boards for metrology, PCI DSS for payment) audit these logs. The Backup and Disaster Recovery performs daily snapshots to off-site cloud storage (AWS S3, Azure Blob) or tape; retention is typically 7 years to satisfy fuel tax and environmental regulations.

The Key Management System (KMS) service (Vault or AWS KMS) manages encryption keys for sensitive data at rest. Keys are rotated annually; old keys are archived for historical transaction decryption if audited.

Performance and Reliability

Authorization latency is critical: a 5-second delay annoys customers and may result in abandoned transactions. The site controller must be capable of 100+ transactions per hour. Database indexes on (site_id, timestamp) enable rapid transaction queries. Back-office APIs cache frequently accessed data (e.g., pump availability) in Redis to reduce query latency.

Uptime requirement is 99.9% (3 days downtime per year). Site controllers are deployed with dual Ethernet and dual modem paths; if primary cellular fails, a dial-up backup (V.92 modem) provides slower but functional telemetry. Back-office servers are deployed across availability zones (multi-region for critical enterprise customers), with automated failover.