WO2011101783A1

WO2011101783A1 - Control system for safe fueling of vehicles

Info

Publication number: WO2011101783A1
Application number: PCT/IB2011/050628
Authority: WO
Inventors: Gordon Ian Patterson; Ashleigh Laura Patterson
Original assignee: Gordon Ian Patterson; Ashleigh Laura Patterson
Priority date: 2010-02-16
Filing date: 2011-02-15
Publication date: 2011-08-25
Also published as: RU2012139662A; EP2536656A1

Abstract

A fuel dispensing system includes an RFID reader attached to a fuel nozzle, which is adapted to wirelessly communicate with an RFID transponder and a controller adapted to: (a) initiate dispensing of fuel in response to at least two of the following initiation conditions: (i) an authorized customer; (ii) an authorized vehicle; (iii) an authorized fuel tank; and (iv) an authorized fuel; and (b) terminate dispensing of fuel upon a first occurrence of at least one of the following termination conditions: (i) interruption of communication between the RFID reader and the RFID transponder; (ii) filling to maximum capacity of the tank; (iii) complete depletion of authorized funds; and (iv) filling to a preset limit. A method of conducting a fuel dispensing transaction is also described.

Description

CONTROL SYSTEM FOR SAFE FUELING OF VEHICLES

SPECIFICATION BACKGROUND OF THE INVENTION

1. FIELD OF INVENTION

[0001] This invention relates generally to fuel dispensers and, more particularly, to fuel dispensers, systems and methods for dispensing pressurized fuel.

2. DESCRIPTION OF RELATED ART

[0002] In recent years, traditional gasoline pumps and service stations have evolved into elaborate point-of-sale (POS) devices having sophisticated control electronics and user interfaces with large displays and touch-pads or screens. The fuel dispensers include various types of payment means, such as card readers and cash acceptors, to expedite and further enhance fueling transactions.

[0003] Remote transaction systems for gasoline dispensers have evolved such that the dispenser is adapted to communicate with various types of remote communication devices, such as transponders, to automatically provide various types of identification and information to the fuel dispenser, and to other remote locations. See, e.g., U.S. Patents Nos. 5,605, 182, 5,923,572, 6,073,840, 6,085,805, 6,089,284, 6,098,879, 7,069,251 and 7,640,185.

[0004] A key issue surrounding the adoption of alternative fuels (i.e., fuels other than gasoline, such as, e.g., compressed natural gas) is ensuring that each vehicle receives the proper fuel. Improper identification of a vehicle's fuel can result in the vehicle being rendered inoperable, or worse.

[0005] The natural gas vehicle industry has been seeking solutions to the problem of defective and faulty storage vessels and components on board vehicles. When there is no method to ascertain that the vehicle is safe to fuel, there is a risk of explosion, personal injury and death when a cylinder fails.

[0006] Attempts have been made to solve the problem by issuance of approval certification stickers placed on a vehicle indicating its components are approved. This system has failed primarily due to dependence on the station operator and the ability to fraudulently replicate certification stickers.

[0007] Magnetic cards, infrared identification, bar codes and authorized stickers have all been used in the past to identify inspected and certified vehicles. However, such systems placed too much reliance on the actions of the operator and the service station attendant, and have accordingly been prone to user intervention and fraudulent replication of the identifiers. [0008] Accordingly, it is desired to provide improved safety for fueling alternative fuel vehicles without depending on the fueling station attendants to verify the suitability of a vehicle for fueling. It is further desired to provide a fueling system that prevents tampering with the vehicle identification tag and the fueling station system. It is still further desired to provide a fueling system adapted for secure collection of transfer of transaction data to be used in billing and carbon trading systems.

[0009] All references cited herein are incorporated herein by reference in their entireties.

BRIEF SUMMARY OF THE INVENTION

[0010] Accordingly, a first aspect of the invention comprises a fuel dispensing system comprising: (1) a dispenser having a nozzle adapted to engage a receptacle of a fuel tank and dispense a fuel into the fuel tank; (2) an RFID reader attached to the nozzle, and is adapted to wirelessly communicate with an RFID transponder, which is attached to the fuel tank at or adjacent to the receptacle, only when the nozzle is engaged by the receptacle; and (3) a controller adapted to be operatively connected to the dispenser and the reader so as to control dispensing of the fuel as a function of signals received by the reader, wherein the controller is adapted to: (a) initiate dispensing of fuel upon receipt by the reader of at least one signal from the transponder indicating at least two initiation conditions selected from the group consisting of: (i) an authorized customer; (ii) an authorized vehicle; (iii) an authorized fuel tank; and (iv) an authorized fuel; and (b) terminate dispensing of fuel upon a first occurrence of at least one termination condition selected from the group consisting of: (i) interruption of communication between the RFID reader and the RFID transponder; (ii) filling to maximum capacity of the tank; (iii) complete depletion of authorized funds; and (iv) filling to a preset limit.

[0011] A second aspect of the invention comprises a method of conducting a fuel dispensing transaction, comprising: (1) providing a fuel dispensing system of the invention; (2) connecting the nozzle of the dispenser to the receptacle of the fuel tank; (3) attempting to establish at least one communication link between the RFID transponder of the fuel tank and the RFID reader of the nozzle; (4) refusing the transaction if the at least one communication link is not established; (5) decrypting at least one signal from the RFID transponder if the at least one communication link is established; (6) dispensing fuel to the fuel tank upon receipt by the reader of at least one signal from the transponder indicating at least two initiation conditions selected from the group consisting of: (i) an authorized customer; (ii) an authorized vehicle; (iii) an authorized fuel tank; and (iv) an authorized fuel; (7) repeatedly checking for communication between the RFID transponder and the RFID reader, to confirm that the nozzle and the receptacle are connected; (8) repeatedly checking for remaining fuel tank capacity; and (9) terminating the dispensing of fuel upon a first occurrence of at least one termination condition selected from the group consisting of: interruption of communication between the RFID reader and the RFID transponder, filling to maximum capacity of the tank, complete depletion of authorized funds and filling to preset limit.

BRIEF DESCRIPTION OF SEVERAL VIEWS OF THE DRAWINGS

[0012] The invention will be described in conjunction with the following drawings in which like reference numerals designate like elements and wherein:

[0013] FIG. 1 is a flow chart providing a general overview of an embodiment of the process of the invention.

[0014] FIG. 2 is a flow chart showing the main steps of the tag validation cycle of the process of FIG. 1.

[0015] FIGS. 3 and 4 are flow charts showing the main steps of the fueling cycle of the process of FIG. 1.

[0016] FIG. 5 is a flow chart showing the main steps of the prepaid fueling cycle of the process of FIG. 1.

[0017] FIG. 6 is a flow chart showing the main steps of the prepaid tag programming cycle of the process of FIG. 1.

[0018] FIG. 7 is a flow chart showing the main steps of the tag programming cycle of the process of FIG. 1.

[0019] FIGS. 8A and 8B are flow charts showing the main steps of alternative cylinder and device validation cycles of the process of FIG. 1.

[0020] FIG. 9 is a flow chart showing the main steps of the secondary tag validation cycle of the process of FIG. 1.

[0021] FIG. 10 is a block diagram showing an overview of the control systems of an embodiment of a fueling station in accordance with the invention.

[0022] FIG. 11 is a block diagram showing an embodiment of an RFID transponder in accordance with the invention.

[0023] FIG. 12 is a block diagram showing an embodiment of another RFID transponder in accordance with the invention.

[0024] FIG. 13 is a block diagram showing an embodiment of a dispenser control system and an RFID reader control system. [0025] FIG. 14 is a schematic illustration of a vehicle bearing elements of an embodiment of the system of the invention.

[0026] FIG. 15 is a front view of an embodiment of a fuel dispenser in accordance with the invention.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS OF THE INVENTION

[0027] Before referring to the figures, some general considerations as to the terms used and as to the advantages of the present invention are first highlighted.

[0028] The inventive system automatically identifies vehicles and/or fuel tanks prior to fueling to verify that the vehicle and/or fuel tank is authorized for fueling. In particular, the inventive system enhances the reliability and safety of the fueling process, while at the same time minimizing the likelihood of fraud and theft.

[0029] The system is particularly well-suited for use at fueling stations for vehicles that operate on pressurized fuels. As used herein, the expression "pressurized fuel" means a fuel that is stored at a pressure above ambient pressure. Non-limiting examples of pressurized fuels suitable for use in the claimed invention include compressed natural gas, liquefied natural gas, blended fuel (e.g., hydrogen and compressed natural gas), hydrogen gas and liquefied petroleum gas (aka propane).

[0030] The inventive system automates the pressurized fuel fueling process, thereby assuring regulatory authorities and fueling station owners that fueling is restricted to vehicles (or fuel tanks) equipped with an authorized tag and presented in a safe condition. In addition to safety and accounting applications, the RFID system offers applications that are directly applicable to carbon credits, including recording and transmitting transactions to a remote computer to process carbon credits and billing functions. Transmission of these and other data from the system to remote locations is preferably conducted over a standard communication line such as cellular, internet or phone modem, but dedicated communication lines are also within the scope of the invention.

[0031] When a vehicle that is fit with a vehicle identification tag (or RFID transponder) arrives at a fueling station, an RFID reader of the dispenser nozzle wirelessly reads data encrypted in the transponder. Once the data are verified, an RFID control system automatically authorizes the dispenser to dispense fuel to the vehicle. Repeated verification occurs while fuel is being dispensed to ensure that the connection between the nozzle and the vehicle is safely maintained for the entire duration of the fill. If at any point communication is interrupted, the RFID control system immediately stops dispensing fuel to the vehicle. Upon completion of the refueling process, transaction data can be written to the RFID transponder and all transaction data are sent to a central computer.

[0032] The inventive system can use low frequency, high frequency or ultra high frequency RFID. Additionally, the RFID system can use either passive or active tags.

[0033] In essence, the inventive system is fully automatic and provides no opportunity for user interference with the core functions of the system. RFID technology does not require a direct line of site or visual recognition for identification, nor is the reading of the vehicle identification tag affected by dirt, debris, vibration, metal or extreme temperatures.

[0034] The vehicle identification tags are programming using an encryption system which limits tag programming to only certified users and prevents fraudulent replication of tags. The RFID transponders are permanently mounted on the vehicle (or fuel tank) and are packaged in such a way that they are fatally damaged if tampered with to prevent any interchanging of programmed transponders.

[0035] In addition, the system provides traceability, which has not been obtained by any previous identification technology. A complete database of certified vehicles and certified installers/inspectors will preferably be created and maintained.

[0036] In a first aspect of the invention, the inventive system is comprised of a dispenser, an RFID reader, an RFID transponder, at least one sensor, and a controller.

[0037] As best seen in FIG. 15 , dispenser 600 is shown constructed according to and as part of the present invention. The dispenser provides a fuel delivery path from an underground storage tank (not shown) to vehicle 700, (shown in FIG. 14). (Suitable fuel storage sources include but are not limited to pressurized storage tanks, underground tanks, above-ground tanks and/or mobile tanks.) The delivery path includes fuel delivery line 602 having fuel metering device (i.e., flowmeter) 604. Fuel delivery line 602 communicates with fuel delivery hose 606 outside of dispenser 600 and delivery nozzle 608. Nozzle 608 is adapted to engage receptacle 702 of fuel tank 708 of vehicle 700. Upon engagement, RFID reader 609 of nozzle 608 is close enough to communicate with RFID transponder 402 of fuel tank 708.

[0038] RFID reader 609 is preferably encapsulated in a housing comprising a polymeric coating adapted to protect the reader from the elements and the fuel. The housing is also adapted to electrically insulate the reader, so as to avoid creating conditions conducive to triggering an explosion of the fuel. Preferred coatings include epoxies. It is also preferred from a safety standpoint that RFID reader 609 operates at a power from 1 to 5 watts or from 0.1 to 5 watts, more preferably less than 0.6 watts. [0039] Dispenser 600 also includes dispenser control system 516, which is adapted to receive volume data from flowmeter 604 through cabling 610 as well as provide control of fuel delivery. Dispenser control system 516 is preferably adapted to cause speaker 612 to emit audible messages to a customer. These messages may include warnings, instructions and advertising.

[0040] Dispenser 600 is preferably equipped with a payment acceptor, such as magnetic card reader 614 or cash acceptor 616, along with receipt printer 618. Dispenser is preferably equipped with a personal RFID card reader 619, which is used to read data from RFID cards manually presented by the customer. With these options, dispenser control system 516 may read data from the magnetic strip of a card inserted in magnetic card reader 614, read data from a personal RFID card swiped across personal RFID card reader 619, and/or receive cash from a customer via cash acceptor 616, and communicate such activities to station controller 400 (see FIG. 10). Station controller 400 typically communicates with a remote network, such as a card verification authority, to ascertain whether a transaction proposed to be charged to or debited from an account associated with the card read by card reader 614 and/or card reader 619 is authorized. The expression "controller" as used herein to identify elements of the invention (including but not limited to station controller 400), encompasses devices such as, e.g., microprocessors, discrete logic circuits, application specific integrated circuits (ASICs), programmable logic circuits, digital signal processors (DSPs), etc.

[0041] Dispenser 600 includes at least one type of display, such as, e.g., at least one alpha-numeric display 620 together with a high-resolution graphics display 622. Graphics display 622 can in certain embodiments have an associated key pad 624 adjacent to the display or integrated with the display to provide a touch interface. Dispenser 600 may include an additional, auxiliary key pad 626 associated with card reader 614 and/or 19 for entering secret codes or personal identification numbers (PINs). Notably, the displays 620, 622 and key pads 624, 626 may be integrated into a single device and/or touchscreen interface.

[0042] Dispenser 600 includes or is associated with dispenser control system 516. Fig. 13 includes a schematic depiction of an embodiment of a dispenser control system of the invention. Dispenser control system 516 includes dispenser controller 518 operatively connected to flowmeter 604, printer 618, speaker 612, cash acceptor 616, magnetic card reader 614, keypad 624, keypad 626 and graphics display 622.

[0043] Dispenser controller 518 is also operatively connected to RS 485/232 Interface 514 of RFID reader control system 500. Interface 514 is operatively connected to RFID Controller 504, which is also operatively connected to LAN interface 512 (which in turn is operatively connected to station controller 400), programming interface 510, memory 508, alpha-numeric display 620, and RFID reader 609. Reader 609 preferably communicates via antennas 515 at radio frequencies in the microwave range; however, in alternative embodiments, these communications may include infrared, acoustic or other known remote communication methods acceptable for use in a fueling environment.

[0044] RFID reader 609 communicates with RFID transponder 402 of vehicle 700, which is adjacent to receptacle 702. Receptacle 702 is in fluid communication with fuel tank 704 (see FIG. 14). RFID transponder 402 is adapted to report to RFID reader 609 information collected from cylinder identification sensor 422, temperature sensor 424, pressure sensor 426, impact sensor 428, auxiliary sensor 430 and interface to vehicle subsystems 432 (see vehicle sensor environment 421 of FIG. 12).

[0045] RFID transponder 402 combines the function of a passive RFID tag with an intelligent processor/board. In particular, RFID transponder comprises: (a) antenna 404, which energizes the transponder and wirelessly communicates data to and receives data from dispenser antennas 515; (b) transmitter 406; (c) receiver 412; (d) memory 408 (preferably programmed and programmable); (e) microcontroller 414; (f) first power level 410; (g) input/output (I O) interface 416; (h) software 418; (i) second power level 419; and (j) clock 420.

[0046] Microcontroller 414 is preferably powered by a power source independent of the power received by antenna 404. Thus, in certain embodiments, microcontroller 414 is powered by at least one of a battery (not shown) of RFID transponder 402 and a vehicle power source. Microcontroller 414 is operatively connected to the sensors of vehicle sensor environment 421 via I/O interface 416. The connection can be wired or wireless. In wired embodiments, the connection can be a single wire, a bi-directional cable or a two- wire cable.

[0047] In alternative embodiments, vehicle sensor environment 421 can comprise more or less than all of the sensors shown in FIG. 12. For example, it is within the scope of the invention to provide a plurality of a particular type of sensor, such as multiple cylinder ID (identification) sensors installed in buses having multiple cylinders. In certain embodiments of the invention, the system will identify each cylinder in a vehicle having multiple cylinders through a circuit board installed adjacent to the fueling connection on the vehicle. This board will have the capability of reading the tag data, storing the same data that the RFID tag does and communicating with the dispenser in the same manner as the RFID system. [0048] Cylinder ID sensor 422 is adapted to identify the cylinder to dispenser control system 516. Preferably the sensor includes an SHA-1/HMAC based security and authentication IC. It is preferred that cylinder ID sensor 422 be permanently bonded to cylinder 704, as shown in FIG. 14. Preferably, data including a unique cylinder ID is permanently encrypted in the sensor memory.

[0049] It should be noted that the term "cylinder" as used herein is intended to denote a fuel tank, and is not limited to fuel tanks having a cylindrical shape.

[0050] Temperature sensor 424 preferably has one of two alternative configurations. In the first configuration, temperature is read and transmitted to the microcontroller 414. In the second configuration, a warning signal is transmitted to microcontroller 414 if the measured temperature exceeds a preset temperature limit. Temperature sensor 424 is preferably located inside cylinder 704 or the piping connecting the cylinder to the balance of the vehicle system, or may be incorporated into valves inside the gas handling system.

[0051] Pressure sensor 426 preferably has one of two alternative configurations. In the first configuration, pressure is read and transmitted to the microcontroller 414. In the second configuration, a warning signal is transmitted to microcontroller 414 if the measured pressure exceeds a preset pressure limit. Pressure sensor 426 is preferably located inside cylinder 704 or the piping connecting the cylinder to the balance of the vehicle system, or may be incorporated into valves inside the gas handling system.

[0052] Impact sensor 428 is preset to transmit a warning signal to microcontroller 414 if the sensor senses an impact exceeding a preset limit. The limit is preferably selected to provide a reasonably safety margin below the amount of force at which the structural integrity of the cylinder and or its associated piping is compromised. Impact sensor can be located on cylinder 704, in vehicle 700 or on the piping connecting cylinder 704 to the balance of the vehicle system.

[0053] Interface to vehicle subsystems 432 is adapted to read data from, and write data to, the electronics system of the vehicle. Data received by interface 432 are converted to a protocol used by transponder 402. Interface 432 receives and transmits data via microcontroller 414.

[0054] Auxiliary sensor 430 provides a means for connecting transponder 402 to other devices within the vehicle, such as, e.g., pressure regulators, controllers and failure detection sensors, such as, e.g., sensors for leak detection, gas detection, fire detection, etc.

[0055] A second aspect of the invention is a process for fueling vehicles. FIG. 1 is a flowchart showing a general overview of an embodiment of the second aspect of the invention. The process begins when a reader attached to a fueling nozzle reads an RFID transponder (i.e., tag) attached to a fuel tank (Block 20). If the tag is not valid (Block 22) the transaction is terminated (Block 24). If the tag is valid, it is then determined whether the tag is to be programmed (Block 26). If the tag is to be programmed, it undergoes a tag programming cycle (Block 28). If not, the system determines whether secondary identification is required (Block 30). If secondary identification is required, the driver is prompted to swipe an additional RFID tag (i.e., personal RFID transponder) on the dispenser (Block 32). The transaction is terminated (Block 36) if the driver is not authorized to fill the vehicle (Block 34). If the driver is authorized to fill the vehicle, the system checks whether a cylinder/accessory verification system is installed (Block 38). If so, the system verifies cylinders, over-pressure, over- temperature and other alarms (Block 40). Optionally, this information interfaces with vehicle systems (Block 42). If the components cannot be verified (Block 44), the transaction is terminated (Block 46). If the components do pass verification or were not required to be verified, the system checks whether temperature and pressure sensors are installed (Block 45). If so, the system performs a temperature and pressure validation cycle (Block 47). After the cycle, or if temperature and pressure sensors are not installed, the system checks to see whether the tag has been prepaid or preset (Block 48). If so, the tag undergoes a prepaid tag verification/programming cycle (Block 50) and then a prepaid fueling transaction (Block 52). If the tag is not prepaid or preset, or the prepaid tag verification/programming cycle has been completed, the fueling transaction begins (Block 54). During that transaction, the system continuously verifies the presence of the tag, tank capacity, pressure and any errors (Block 56). This continues until the transaction is completed (Block 58). Information regarding the transaction is stored in the dispenser and the station controller (Block 60), and the system returns to an idle state (Block 62).

[0056] FIG. 2 is a flow-chart showing the tag validation cycle. Beginning with the system in an idle state monitoring the reader for any signals (Block 64), an operator connects the nozzle to the vehicle (Block 66), the reader detects the tag and conveys a signal to the dispenser controller (Block 68). The dispenser controller reads the tag data (Block 70). If the tag is not valid (Block 72), the dispenser controller displays a message that the tag is invalid and the transaction is terminated (Block 74) and the vehicle is rejected (Block 76). If the tag is valid and is to be programmed, control passes to the tag validation cycle of FIG. 7 (Block 78). Programmed tags are then decrypted to verify whether data are valid (Block 80). [0057] Cryptography is preferably based on a public key carried on tags and a private key, which is known by the encryption service (tag programmer) server and a tag reader controlled by the dispenser controller. When a tag is programmed by a encryption service server (which can be incorporated as part of the dispenser controller), a public key is generated and tag data are encrypted with a private key and the public key. An index to the private key along with the encrypted public key are saved on the tag. When the tag is used at a station, dispenser controller: (a) reads the encrypted tag data using a tag reader; (b) finds a private key using tag data; (c) applies the private key to the data; (d) retrieves the decrypted public key; and (e) applies the decrypted public key to the data to retrieve the data.

[0058] Invalid data results in the dispenser controller displaying a message such as "INVALID TAG - TRANSACTION TERMINATED" (Block 82) and then rejecting the vehicle (Block 76). If the data are valid, secondary identification may be required (Block 84). If so, control passes to the secondary tag validation schedule shown in FIG. 9. If secondary identification tests are not required or are satisfied, the expiry date of the tag is checked (Block 86). Expired tags result in a consistent message from the dispenser controller (Block 88) and vehicle rejection (Block 76). If the tag is not expired, the vehicle is screened against a black list (Block 90). If the vehicle is on the black list, the dispenser controller displays a vehicle rejected message (Block 92) and the vehicle is rejected (Block 76). If the vehicle is not on the black list, the system checks to see whether a cylinder verification system has been installed (Block 94). If so, control passes to one of the alternative cylinder and peripheral device validation cycles of FIGS. 8A and 8B. If the cylinder satisfies the verification system or is not required to be verified, the system then checks to see whether the transaction is to be prepaid or preset (Block 96). If so, control passes to FIG. 6. If not, the transaction is authorized (Block 98) and control passes to FIG. 3.

[0059] The system then checks to see whether a price change has been completed (Block 100 of FIG. 3). If not, the system makes a single attempt at re-trying a price change (Block 108). After one failed attempt at changing the price (Block 102), the transaction is terminated (Block 104) and the display shows a message such as "INVALID PRICE" (Block 106). If the price change is completed, the system reads and records meter and dispenser totals (Block 110). The system continues to read and record until all of the totals have been read and recorded (Block 112). The total cylinder capacity in liters and kilograms of gas is read (Block 114). (Other units of measure, such as gallons, cubic feet, pounds and GGE, or gasoline gallon equivalent, also being within the scope of the invention.) The cylinder capacity of the vehicle is verified by measuring pressure, flow, gas temperature, ambient temperature and gas composition (Block 116).

[0060] All variables are a function of direct measurement and changes in gas temperature, pressure, and flow rate as a fill is taking place. The system begins by determining the target settled pressure to be reached at the end of the fill. This is a function of the ambient air temperature. Then the vehicle starting pressure is measured. As gas is introduced into the vehicle the system measures the rate of change of all measured factors. After sufficient change in pressure has been noted, the system calculates the volume of the cylinder(s). See, e.g., U.S. Patent No. 5,868, 176 for additional information regarding controlling the fill of a cylinder with pressurized fuel.

[0061] If the calculated cylinder capacity matches the data on the tag (Block 1 18), the dispenser is turned on (Block 120). The target filling pressure is set (Block 122), and the dispenser begins the fueling cycle (Block 124). The tag is read at short (e.g., 0.1 or 0,5 or 1 second intervals) (Block 126) to ensure a secure connection between the nozzle and the fuel tank. If the tag is not the same as read at the beginning of the transaction (Block 136), the transaction is terminated (Block 138) and a message such as "TAG CHANGED - TRANSACTION TERMINATED" is displayed (Block 140). If the tag remains the same, control passes to part two of the fueling transaction cycle as shown in FIG. 4.

[0062] Similarly, the capacity of the cylinder is recalculated at short (e.g., 0.1 or 0.5 or 1 or 5 or 10 second) intervals (Block 128) to continuously confirm whether the calculated capacity matches the recorded capacity stored in the tag data (Block 130). If so, control passes to part two of the fueling transaction cycle as shown in FIG. 4. If at any time the calculated cylinder capacity does not match the tag data, the transaction is terminated (Block 132) and a message such as "INVALID CYLINDER DETECTED - TRANSACTION TERMINATED" is displayed (Block 134).

[0063] If the calculated capacity of the cylinder matches the tag data, gas pressure, temperature and flow are continuously measured (FIG.4, Block 154). The target pressure for the particular vehicle is calculated (Block 156) and compared with the measured vehicle pressure (Block 158). If the pressures are not equal, the tag is read at half second intervals (Block 126 of FIG. 3). If the pressures are equal, the transaction is completed (Block 160), transaction data are recorded in the dispenser control (Block 162) and the display prompts the operator to disconnect the nozzle and deactivate the dispenser (Block 164). The system then checks for a communications link to the station controller (Block 166). If the communication link is not operative, the transaction is flagged in the dispenser controller to future transmission (Block 168). If the communication link is operative, the system checks whether any previous transactions were flagged for future transmission station control (Block 170). If no previous transactions were flagged for future transmission, the current transaction data are transmitted to the station controller (Block 172). Otherwise, stored transaction data are transmitted to the station controller (Block 174). The system checks for data being received by the station controller (Block 176). If the data have not been received, one additional attempt (Block 178) is made to retransmit the stored data to the station controller (Block 180). If the data cannot be transmitted despite one repeated attempt, the transaction is flagged in the dispenser for future retransmission (Block 182) and the system returns to the idle state (Block 186). If data is received by station controller (Block 176), the transaction flags for the stored transactions are erased (Block 184) and the system returns to idle state (Block 186).

[0064] Referring to FIG. 5 by way of FIG. 2, if there is a preset transaction (Block 190), the customer presets the amount of the sale (Block 192), and the system compares whether the available amount on the tag is less than the preset amount (Block 194). If so, the system reads the amount of funds available on the tag (Block 196) and displays a message such as "FUNDS NOT AVAILABLE - SELECT LESSER AMOUNT" (Block 198). The customer is then provided with an additional opportunity to preset the amount of the sale (Block 192). Once the customer presets a sales amount less than the amount on the tag, the dispenser controller is programmed to stop at a preset amount (Block 200). If there is no preset transaction in the tag (Block 190), the system reads the amount of funds available on the tag (Block 202).

[0065] Following the steps of Blocks 200 and 202, the total cylinder capacity in the desired units of measure, such as liters and/or kilograms of gas, is read (Block 204), cylinder capacity on the vehicle is verified (Block 206), and the calculated cylinder capacity is compared with the theoretical capacity stored on the tag (Block 208). If the capacities do not match, the transaction is terminated (Block 210), and a message such as "INVALID CYLINDER DETECTED - TRANSACTION TERMINATED" is displayed (Block 212). If the capacities do match, the operator activates the dispenser (Block 214), a target filling pressure is set (Block 216), and a dispenser fueling cycle commences (Block 218). The tag is then read at short (e.g., 0.1 or 0.5 or 1 second) intervals (Block 220). The cylinder calculation is repeated at short (e.g., 0.1 or 1 or 10 second) intervals (Block 222) with repeated checking of the calculated cylinder capacity against the capacity stored in the tag data (Block 224). If the capacities do not match, the transaction is terminated (Block 210) and a message such as "INVALID CYLINDER DETECTED - TRANSACTION TERMINATED" is displayed (Block 212). If the capacities do match, the tag data read (Block 220) is compared with the tag data at the beginning of the transaction (Block 226). If the data are inconsistent, the transaction is terminated (Block 228) and a message such as "TAG CHANGED - TRANSACTION TERMINATED") is displayed (Block 230). If the tag data do match, the system calculates the amount delivered, calculates new funds available amount and updates the tag every second (Block 232). Gas pressure, temperature and flow are continuously measured (Block 234), vehicle pressure is calculated (Block 236) and the system checks whether a preset amount has been reached (Block 238). If the vehicle pressure is not equal to the target pressure (Block 240), the tag is read again at the short intervals of Block 220. If the vehicle pressure is equal to the target pressure, or the preset amount of Block 238 has been reached, the transaction is terminated (Block 242), the amount available on the tag is updated (Block 244), a message such as "TRANSACTION COMPLETED" is displayed (Block 246) and transaction data are recorded in the dispenser control (Block 248). The system then checks to see whether communication linked to the station controller is operative (Block 250). If not, the transaction is flagged in the dispenser control for future transmission (Block 252) and the system returns to the idle state (Block 254). If the communication linked to the station controller is operative, the system checks whether there are any previous transactions flagged for future transmission station controller (Block 256). If so, the system selects the previously stored transactions (Block 258). The system flow then continues the same as it would if there had not been any such previous transactions flagged, whereby all transaction data to the station controller are transmitted (Block 260), then transactions flags for stored transactions are erased (Block 262) and the system returns to the idle state (Block 254).

[0066] A tag bearing preset transaction data from Block 96 of FIG.2 for the prepaid amount and the date of last tag update at Block 264 if FIG. 6. A connection to the station server is established (Block 266) and the system data base is checked to see whether the tag ID needs to be updated (Block 268). If not, system flow returns to the beginning of FIG. 2. If so, a connection is established with the host server (Block 270) and a search for tag data are initiated. If tag data are not found (Block 272), the transaction is terminated (Block 274) and the display controller displays the message "Tag Data Not Available - See Attendant" (Block 276). If tag data are found, the prepaid amount information is downloaded to the dispenser control (Block 278). The prepaid download is then checked for accuracy at Block 280. If the download is inaccurate, the system will retry the download once (Block 282). If the download still fails, the transaction is terminated (Block 284) and the message "Unable to Add Prepaid Amount to Tag - See Attendant" is displayed (Block 286). If the prepaid download is correct, the prepaid data are downloaded to the vehicle tag (Block 288). The prepaid amount is then read from the tag (Block 290) and the dispenser controller compares the data from the tag with the data received from the server (Block 292). If the prepaid amount does not appear to be programmed correctly on the tag, the system makes one attempt at downloading the prepaid data to the tag again (Block 296). If the programming still fails, the transaction is terminated (Block 298) and the system displays the message "Unable to Add Prepaid Amount to Tag - See Attendant" (Block 300). If the tag prepaid amount is downloaded correctly, the tag prepaid amount transaction is recorded in the transaction log and system flow returns to FIG. 3.

[0067] Tags to be programmed from Block 78 of FIG. 2 are checked for programming at Block 304 of FIG. 7. If the tag is programmed, flow returns to FIG. 3. If not, the system reads the unique tag identifier (Block 306)_> then connects to the station server or remote server (Block 308), and looks up the tag ID (Block 310). If the tag data to be programmed are not found (Block 312), the transaction is terminated (Block 314) and the system displays a message such as "TAG DATA NOT AVAILABLE - SEE ATTENDANT" (Block 316). If the tag data are found, the data are downloaded to the dispenser controller (Block 318) and the download is checked (Block 320). If the tag data downloaded incorrectly, the system retries the download once (Block 322). If the retry fails, the transaction is terminated (Block 324) and the system displays a message such as "TAG DATA NOT AVAILABLE - SEE ATTENDANT" (Block 326). If the tag data downloaded correctly, the tag data is downloaded to the vehicle tag (Block 328), the tag data is read from the tag (Block 330), the dispenser controller compares the data from the tag with data received from the server (Block 332) and the system checks to see whether the tag data were programmed on the tag correctly (Block 334). If not, the system retries the tag data download once (Block 336). If the retry fails, the transaction is terminated (Block 338) and the system displays a message such as "UNABLE TO PROGRAM TAG- SEE ATTENDANT" (Block 340). If the tag data are programmed on the tag correctly, the tag programming is recorded in the transaction log (Block 342) and flow returns to FIG. 2.

[0068] Cylinder verification for Block 94 of FIG. 2 begins with the vehicle tag reading data from all connected tags and transmitting the data to the display control at Block 344 of FIG. 8. If the cylinder and other devices IDs do not match the primary tag data (Block 346), the display control displays a message that at least one of the devices is invalid and the transaction has been terminated (Block 348). The vehicle is then rejected (Block 350). [0069] In the embodiment of FIG. 8A, if the device IDs match the primary tag data, the system reads the high temperature alarm tag (Block 352). If the high temperature alarm is on, a message such as "CYLINDER FAILURE -TRANSACTION TERMINATED" (Block 356) is displayed and the vehicle is rejected (Block 350). If the high temperature alarm is off, the high pressure alarm tag is read (Block 358). If the high pressure alarm is on, the system displays a message such as "CYLINDER FAILURE - TRANSACTION TERMINATED" (Block 362) and the vehicle is rejected (Block 350). If the high pressure alarm is off, the system reads the high impact alarm tag (Block 364). If the high impact alarm is on (Block 366), the system displays a message such as "CYLINDER FAILURE - TRANSACTION TERMINATED" (Block 368) and the vehicle is rejected (Block 350). If the high impact alarm is off, flow returns to FIG. 2.

[0070] In the alternative cycle of FIG. 8B, which is performed repeatedly throughout the fill, if the device IDs match the primary tag data, the system reads the temperature sensor (Block 800). If the measured temperature is above a predetermined limit (Block 802), the system confirms whether the fuel flow rate is at a minimum value (Block 804). If the fuel flow rate is at the minimum value, a message such as "HIGH CYLINDER TEMPERATURE - TRANSACTION TERMINATED" is displayed (Block 806), and the vehicle is rejected (Block 350). If the fuel flow rate is not at the minimum value, the flow rate and/or inlet pressure is decreased (Block 808) and the temperature is measured again.

[0071] If the measured temperature is below a predetermined limit, the pressure sensor is read (Block 810). If the measured pressure is above a predetermined limit (Block 812), a message such as "MAXIMUM PRESSURE REACHED" is displayed (Block 814), and the vehicle is rejected (Block 350).

[0072] If the measured pressure is below a predetermined limit, the system reads the high impact alarm tag (Block 364). If the high impact alarm is on (Block 366), the system displays a message such as "CYLINDER FAILURE - TRANSACTION TERMINATED" (Block 368) and the vehicle is rejected (Block 350). If the high impact alarm is off, flow returns to FIG. 2.

[0073] The secondary identification required by Block 84 of FIG. 2 begins with the display of a message such as "SWIPE DRIVER RFID TAG ON DISPENSER" at Block 370 of FIG. 9. If the driver is not approved for the vehicle, the system displays a message such as "INVALID DRIVER ID - TRANSACTION CANCELED" (Block 374), and the transaction is terminated with the system returning to the idle state (Block 376). If the driver is verified, the system checks for restrictions on the driver (Block 378). If there are no restrictions for the driver, flow returns to FIG. 2. If there are restrictions for the driver, the system checks for time/date restrictions (Block 380). If there are not time/date restrictions, the system checks for fuel allocation limits (Block 382). If there are no fuel allocation limits, the system check for other limits (Block 384) and if none are found, flow returns to FIG. 2. If there are time/date restrictions (Block 380), the system checks to see whether the date is valid (Block 388). If not, the system displays a message such as "DRIVER NOT PERMITTED - TRANSACTION CANCELED" (Block 390), and the transaction is terminated and the system returns to idle state (Block 392). If the date is valid, flow returns to Block 382. If there are fuel allocation limits, the system sets the dispenser to stop at the allocation limit for the driver (Block 394) and displays a message indicating the maximum amount to be delivered (Block 396). Flow then returns to Block 384. If there are no other limits (Block 384) or such other limits have been set (Block 386), control then returns to FIG. 2.

[0074] While the invention has been described in detail and with reference to specific examples thereof, it will be apparent to one skilled in the art that various changes and modifications can be made therein without departing from the spirit and scope thereof.

Claims

CLAIMS WHAT IS CLAIMED IS:

1. A fuel dispensing system comprising:

a dispenser having a nozzle adapted to engage a receptacle of a fuel tank and dispense a fuel into the fuel tank;

an RFID reader attached to the nozzle, and is adapted to wirelessly communicate with an RFID transponder, which is attached to the fuel tank at or adjacent to the receptacle, only when the nozzle is engaged by the receptacle; and

a controller adapted to be operatively connected to the dispenser and the reader so as to control dispensing of the fuel as a function of signals received by the reader, wherein the controller is adapted to:

(a) initiate dispensing of fuel upon receipt by the reader of at least one signal from the transponder indicating at least two initiation conditions selected from the group consisting of: (i) an authorized customer; (ii) an authorized vehicle; (iii) an authorized fuel tank; and (iv) an authorized fuel; and

(b) terminate dispensing of fuel upon a first occurrence of at least one termination condition selected from the group consisting of: (i) interruption of communication between the RFID reader and the RFID transponder; (ii) filling to maximum capacity of the tank; (iii) complete depletion of authorized funds; and (iv) filling to a preset limit.

2. The system of claim 1, wherein the fuel is pressurized.

3. The system of claim 2, wherein the fuel comprises at least one member selected from the group consisting of compressed natural gas, liquefied natural gas, hydrogen gas and liquefied petroleum gas.

4. The system of claim 1 , wherein the reader, including an antenna, is encapsulated in a polymeric coating and operates at a power of less than 0.6 watts.

5. The system of claim 4, wherein the polymeric coating is an epoxy.

6. The system of claim 1 , wherein the controller is adapted to initiate dispensing of fuel upon receipt by the reader of at least one signal from the transponder indicating at least three of the initiation conditions are satisfied.

7. The system of claim 1 , wherein the controller is adapted to initiate dispensing of fuel upon receipt by the reader of at least one signal from the transponder indicating all four of the initiation conditions are satisfied.

8. The system of claim 1 , further comprising at least one sensor selected from the group consisting of a temperature sensor, a pressure sensor and an impact sensor, wherein the at least one sensor is operatively connected with the fuel tank, such that at least one measurement from the at least one sensor is used by the controller to evaluate an initiation condition and a termination condition.

9. The system of claim 1, further comprising a temperature sensor, a pressure sensor and an impact sensor, wherein the sensors are operatively connected with the fuel tank, such that measurements from sensors are used by the controller to evaluate an initiation condition and a termination condition.

10. The system of claim 9, wherein the controller uses the measurements to determine whether the fuel tank is safe for initial and continued filling.

11. A method of conducting a fuel dispensing transaction, comprising:

providing a fuel dispensing system of claim 1;

connecting the nozzle of the dispenser to the receptacle of the fuel tank;

attempting to establish at least one communication link between the RFID transponder of the fuel tank and the RFID reader of the nozzle;

refusing the transaction if the at least one communication link is not established; decrypting at least one signal from the RFID transponder if the at least one communication link is established;

dispensing fuel to the fuel tank upon receipt by the reader of at least one signal from the transponder indicating at least two initiation conditions selected from the group consisting of: (i) an authorized customer; (ii) an authorized vehicle; (iii) an authorized fuel tank; and (iv) an authorized fuel;

repeatedly checking for communication between the RFID transponder and the RFID reader, to confirm that the nozzle and the receptacle are connected;

repeatedly checking for remaining fuel tank capacity; and

terminating the dispensing of fuel upon a first occurrence of at least one termination condition selected from the group consisting of: (i) interruption of communication between the RFID reader and the RFID transponder; (ii) filling to maximum capacity of the tank; (iii) complete depletion of authorized funds and (iv) filling to preset limit.

12. The method of claim 11 , wherein the fuel is pressurized.

13. The method of claim 12, wherein the fuel comprises at least one member selected from the group consisting of compressed natural gas, liquefied natural gas, hydrogen gas and liquefied petroleum gas.

14. The method of claim 11, wherein the RFID reader, including an antenna of the RFID reader, is encapsulated in a polymeric coating and operates at a power of less than 0.6 watts.

15. The method of claim 14, wherein the polymeric coating is an epoxy.

16. The method of claim 11 , wherein dispensing of fuel is initiated upon receipt by the reader of at least one signal from the transponder indicating at least three of the initiation conditions are satisfied.

17. The method of claim 11 , wherein dispensing of fuel is initiated upon receipt by the reader of at least one signal from the transponder indicating all four of the initiation conditions are satisfied.

18. The method of claim 11, wherein at least one sensor selected from the group consisting of a temperature sensor, a pressure sensor and an impact sensor is operatively connected with the fuel tank, and provides at least one measurement that is used by the controller to evaluate an initiation condition and a termination condition.

19. The method of claim 11 , wherein a temperature sensor, a pressure sensor and an impact sensor are operatively connected with the fuel tank, and provide measurements that are used by the controller to evaluate an initiation condition and a termination condition.

20. The method of claim 19, wherein the controller uses the measurements to determine whether the fuel tank is safe for initial and continued filling.