DESC:
Form 2
The Patent Act 1970
(39 of 1970)
&
The Patent Rules 2003
Complete Specification
(See section 10 and rule 13)

Title of the Invention:
SELF-IMMOLATE PULSER UNIT FOR FUEL DISPENSER

Applicant: TOKHEIM INDIA PRIVATE LIMITED
Nationality: Indian
Address: Dover Fueling Solutions,
Building No. 2, Plot No.66,
TTC Industrial Area,
Mahape, Navi Mumbai – 400710,
Maharashtra, India

The following specification particularly describes the invention and the manner in which it is to be performed:

CLAIM OF PRIORITY
This application claims priority from India patent application number 201821013761, filed on April 11, 2018.

FIELD OF INVENTION
[0001] This invention relates to Fuel Dispenser, particularly to measurement of fuel quantity by Fuel Dispenser. More particularly, the invention relates to electronic measurement of fuel quantity, and still more particularly to secure electronic measurement of fuel quantity by Fuel Dispenser.

BACKGROUND
[0002] Fuel Dispensers are growing along with automobiles industry. Fuel being an expensive commodity, there is always a temptation by certain section of society or unsocial sector to fraudulently earn a fast buck.
[0003] Legal metrology department under Ministry of Consumer Affairs, Food and Distribution of Government of India actively and effectively ensures prevention of fraudulent means adopted to cheat consumers, by enactment and enforcement of laws, like The Legal Metrology Act, 2009. Dispenser Industry and oil companies proactively work to make Fuel Dispensers intrinsically safe and there is always an invisible race between wrong doers and technology.
[0004] In earlier days, Fuel Dispensers comprised mechanical means of fuel measurement, however with time electronics has taken over a significant part of fuel measurement for ensuring higher precision and communication. Correspondingly, more opportunities have ingressed, leading to higher challenges to prevent tampering. Patent application 748/DELNP/2012 discloses a system and method of detecting fuel theft at a fuel dispenser, wherein the dispenser has a primary flow meter, an auxiliary flow detection device positioned at an entrance of a dispenser and an auxiliary dispenser shutoff system. A rate of flow through the primary flow meter and a rate of flow through the flow detection device are calculated. The primary flow meter rate of flow and the auxiliary flow detection device rate of flow are compared. If the difference exceeds a threshold, a shutoff signal is provided to the auxiliary dispenser shutoff system to stop fuel flow through the dispenser.
[0005] Pulser unit in current times is generally defined as an interface unit which converts mechanical measurement input into an electronic output which is then processed and displayed. It is experienced that maximum kind of tampering attempts are targeted on Pulser unit in order to mutilate measurement information and ultimately claim more money from a buyer than the fuel quantity delivered.
[0006] Correspondingly, there are disclosures to make Pulser unit more and more secure. Patent Application No. 3188/MUM/2013 discloses one such inventive attempt.
[0007] Patent application Nos. 9549/DELNP/2015, 201627017999 and WO2008067507 are some disclosures outside Pulser unit.
[0008] Pulser Units are mounted in vapor intensive zone of Fuel Dispensers and have to be fire safe. Thus, Pulser Units need an inventive design if the inside of the Pulser Unit contains any fire hazard source.
[0009] Most of the times, manufacturers themselves need to access internals of pulser unit, that becomes a route for tamper in due course.
[0010] Present invention is an effective solution that provides a safe Pulser unit, which is protected from any kind of intervention.

OBJECTIVES
[0011] The objective is to invent a Pulser Unit that shall not tolerate any attempt to open Pulser unit.
[0012] Another objective is to invent a Pulser Unit that conforms to standards and regulations for deploying in fuel vapor intensive zone.
[0013] Another objective is to invent a Fuel Dispenser that shall self-destruct, self-remove, self-eject or self-eliminate one or more fuel quantity measurement component if the Fuel Dispenser or any constituent thereof is fraudulently opened.
[0014] Another objective is to invent a Pulser Unit that shall erase a computer program stored in a circuit residing in the Pulser Unit if the Pulser unit is minimally or partially opened.
[0015] Another objective is to invent a Pulser Unit that is irreparable once tampered.
[0016] Another objective is to invent a Pulser Unit that has large number of variations of internal arrangements.
[0017] Another objective is to invent a Pulser Unit that shall render a Fuel dispenser inoperable if the pulser unit is tampered while dispenser is dispensing or powered on, or while the dispenser is shut off.

SUMMARY OF INVENTION

[0018] A fuel dispenser comprises a hydraulic section and an electronic section disposed in a vapor zone and in a vapor-free zone. The Electronics comprises a display unit showing quantity of fuel delivered, money value, fuel rate, parameters of fuel, a measurement interface unit converting mechanical measurement input into electronic measurement output that is fed to a processing unit, the processing unit, a delivery sensor, an input unit, an output unit, optionally a Money Transaction Unit. The fuel dispenser characterized in that the measurement interface unit is a pulser unit disposed in the vapor zone. The pulser unit comprises a permanent identification assembly, a pulser housing assembly and a pulser lid. The pulser housing assembly further comprises a magneto-electro-mechanical rotation-pulse converter and a pulse processing circuit assembly comprises a lid open detection circuit.
[0019] The pulser unit includes a gate ONE protection and a gate TWO protection against a tamper. The tamper of gate ONE protection renders the pulser unit non-identifiable. The tamper of gate TWO protection causes a microcontroller circuit to execute an irreversible action to erase a bootable area in its flash memory and flash memory area containing a public key infrastructure (PKI) related information. An energy releasable by a low power battery present in the lid open detection circuit when the pulser unit is not provided with the pulser screws conforms to the vapour zone safety norms, and a 90 percent of a total energy of the low power battery boots up the microcontroller circuit and erases the bootable area in its flash memory and the flash memory area with the low power battery.
[0020] The gate ONE protection further comprises a bridge comprising a plurality of open pockets, each pocket has at least one hole aligning with corresponding hole in the pulser lid and the pulser housing assembly. The bridge is mounted on the pulser lid using a plurality of non-openable screws at a plurality of prescribed position, at least one radio-frequency identification, generally abbreviated as RFID is disposed in one of the open pockets. The plurality of non-openable screw is a unidirectional screw or a screw without head, or a screw whose head is ruptured as soon as it is tightened to a requisite torque.
[0021] The gate TWO protection comprises the pulser lid and the lid open detection circuit. The lid open detection circuit further comprises the low energy battery and a limit switch. The limit switch has a rotatable arm with an end. The end travels a vertical distance of minimum 3mm in order to switch between a position 1-3 to a position 1-2 of the limit switch.
[0022] The pulser lid presses the rotatable arm of the limit switch and an electrical connection of the limit switch takes the position to 1-3, keeping a switch sense signal HIGH. The electrical connection of the limit switch takes the position 1-2 when the pulser lid is partially lifted. When the operational input power supply circuit is energized, the switch sense signal has a HIGH logic level in the pulser lid in a closed condition, and a LOW logic level in the pulser lid in a partially open situation. When the operational input power supply circuit is de-energized, the battery power boots up the microcontroller circuit when the pulser lid is partially opened.

BRIEF DESCRIPTION OF DRAWINGS

[0023] Figure 1 is a generic block diagram of a Fuel Dispenser compartmentalized in a vapor zone and a vapor-free zone.
[0024] Figure 2 is a perspective view of a pulser unit.
[0025] Figure 3 is a perspective view of a permanent identification assembly of the pulser unit.
[0026] Figure 4 is a perspective sectional view of the pulser unit.
[0027] Figure 5 is a sectional perspective view of the permanent identification assembly of the pulser unit.
[0028] Figure 6A and Figure 6B show position of pulser lid in closed and partially opened condition respectively.
[0029] Figure 7 is a perspective view of a pulse processing circuit assembly showing a limit switch.
[0030] Figure 8 is a front sectional view of the pulse processing circuit assembly showing details of the limit switch.
[0031] Figure 9 is a circuit diagram of a pulse processing circuit assembly.
[0032] Figure 10 is a circuit diagram of a pulser lid open detection circuit.
[0033] Figure 11 is a partial top view of the pulse processing circuit assembly illustrating multiple probable positions of the limit switch.

DETAILED DESCRIPTION

[0034] The present invention shall now be described with the help of drawings. It is to be noted that there are many variations possible around present invention and the drawings or description should not be construed to limit the invention.
[0035] Constituents of current generation of fuel dispensers are generally divided into major sections:
- Hydraulics
- Electronics
[0036] Electronics generally comprises:
- Display unit showing quantity of fuel delivered, money value, fuel rate, parameters of fuel,
- Measurement Interface Unit converting mechanical measurement input into electronic measurement output, that is fed to a Processing unit,
- Processing Unit,
- Delivery sensor, Input Unit, Output Unit, Money Transaction Unit, et cetera.
[0037] Figure 1, a Fuel Dispenser (10) is generally compartmentalized in two major zones – a vapor zone (30) and a vapor-free zone (20). Most of the electronics is housed in the vapor-free zone (20), however a measurement interface unit (40) needs to be housed along with hydraulics in the vapor zone (30). Stringent safety norms exist worldwide for equipment housed in the vapor zone (30).
[0038] It is generally known that pulser unit is the biggest temptation for tampering. There are numerous instances of pulser units having tampered by mutilating its mechanical parts or electronic parts or both. Most of the times, manufacturers themselves need to access internals of pulser unit, that becomes a route for tamper in due course.
[0039] The present invention is on and around a pulser unit (100) which is essentially a measurement interface unit (40), Figure 2.
[0040] The pulser unit (100) as per present invention comprises:
- A permanent identification assembly (70),
- A pulser housing assembly (130) further comprising,
o a magneto-electro-mechanical rotation-pulse converter (140),
o a pulse processing circuit assembly (210), and
- A pulser lid (110).
[0041] The pulser unit (100) as per present invention has a two gate protection against tampering.
[0042] Figures 3 and 5, the permanent identification assembly (70) constitutes Gate ONE protection. The permanent identification assembly (70) comprises a bridge (71) further comprising a plurality of open pockets (72) and each pocket (72) having at least one hole aligning with corresponding hole in the pulser lid (110) and the pulser housing assembly (130). Once the pulser unit (100) is assembled and the pulser lid (110) is mounted on the pulser housing assembly (130) with a plurality of pulser bolts as necessary to conform to applicable safety regulations, further described below, the bridge (71) is mounted on the pulser lid (110) using a plurality of non-openable screws at a plurality of prescribed position. At least one radio-frequency identification (80) generally abbreviated as RFID is disposed in one of the open pockets (72) and the pocket (72) is then filled with a resin.
[0043] Once cured, the resin does not leave any access to the non-openable screws. When all the pulser bolts are loosened or removed, the non-openable screws ensure that the pulser lid (110) cannot move up more than 0.5mm from any side.
[0044] Any attempt to reach the non-openable screw through the resin or otherwise damages the RFID (80), destroying the identification thereby annulling the warranty. The pulser circuit still remains untampered. The non-openable screws may be unidirectional screws or screws without head, or screws whose head is ruptured as soon as it is tightened to requisite torque.
[0045] Figure 4, the pulser housing assembly (130) further comprises a magneto-electro-mechanical rotation-pulse converter (140) and the pulse processing circuit assembly (210). The pulse processing circuit assembly (210) has a microcontroller circuit (230), an operational input power supply circuit (240) and an inventive lid open detection circuit (220). The pulser lid (110) and the lid open detection circuit (220) constitutes a Gate TWO tamper protection.
[0046] Figure 9, in a preferred embodiment, the lid open detection circuit (220) comprises a low energy battery, preferred one being a 3V, 220mAh, 0.2mA discharge current, which retains up to 90% of its capacity after a 10 year shelf life. The lid open detection circuit (220) further comprises a limit switch (310), Figure 7. The limit switch (310) has a rotatable arm (311) having an end (312), Figure 8. The end (312) travels a vertical distance (313) of minimum 3mm in order to switch between a position 1-3 to a position 1-2 of the limit switch (310). Figures 6A and 10, when the pulser lid (110) is securely in its place, the rotatable arm (311) of the limit switch (310) is pressed and in that situation an electrical connection of the limit switch (310) takes the position to 1-3, keeping a switch sense signal (340) HIGH. Figures 6B and 10, the electrical connection of the limit switch (310) takes the position 1-2 when the pulser lid (110) is partially lifted, implying that the pulser lid (110) is raised more than 3mm.
[0047] Figure 9, tamper may be attempted during two situations -
(a) When the operational input power supply circuit (240) is energized and
(b) When the operational input power supply circuit (240) is de-energized
[0048] When the operational input power supply circuit (240) is energized, then in the pulser lid (110) closed condition, the switch sense signal (340) has HIGH logic level. Whenever the pulser lid (110) is partially opened, the switch sense signal (340) becomes LOW. Sensing this, the microcontroller circuit (230) erases the bootable area in its flash memory and flash memory area containing PKI related information. It is known that the PKI, abbreviating the Public Key Infrastructure is a set of roles, policies, and procedures needed to create, manage, distribute, use, store & revoke digital certificates and manage public-key encryption. The purpose of the PKI is to facilitate a secure electronic transfer of information. It is required for authentication method and requires rigorous proof to confirm the identity of the devices involved in the communication and to validate the information being transferred.
[0049] Erasing the bootable area and memory area of flash memory is an irreversible action and hence the pulser unit (100) gets electronically destroyed and cannot used again as it cannot boot up anymore.
[0050] When the operational input power supply circuit (240) is de-energized, the battery power is made use of to achieve the same outcome when the pulser lid (110) is partially opened.
[0051] During the operational input power supply circuit (240) is in de-energized condition, whenever the pulser lid (110) is partially opened, the microcontroller circuit (230) boots on the battery supply. Since the limit switch (310) is positioned between 1-2, the switch sense signal (340) is LOW. Sensing this, the microcontroller circuit (230) erases the bootable area in its flash memory and flash memory area containing PKI related information. This change is irreversible and hence the pulser unit (100) gets electronically destroyed and cannot used again as it cannot boot up anymore.
[0052] Construction of pulser housing assembly (130), pulser lid (110) and component selection of the circuit coordinated that energy release by the low power battery when the pulser unit (100) is not provided with the pulser screws conforms to vapor zone (30) safety norms at the same time the 90 percent of total energy of the low power battery is adequate to ensure the microcontroller circuit (230) getting booted up and erasing the bootable area in its flash memory and flash memory area with low power battery.
[0053] The pulse processing circuit assembly (210) periodically monitors a battery voltage on the ADC pin (221) by issuing a battery test signal when the power is present. This helps to keep track on the battery health and issue an output signal wherein the battery is non-operational.
[0054] In all situations, when the rotatable arm (311) of the limit switch (310) is made to move up the vertical distance (313) by more than 3mm, the pulser unit (100) is rendered inoperational, a message appears of the display and the fuel dispenser (10) fails to start. The only way to re-start such fuel dispenser (10) is by replacing the pulser unit (100).
[0055] Figure 11, the limit switch (310) is situated at any of a plurality of possible operational locations on the pulse processing circuit assembly (210), making it unpredictable to ascertain an actual location of the limit switch (310) in the pulser unit (100).
[0056] The low energy battery, the pulser bolts and the non-openable screws are not identified in the drawings consciously.
[0057] As is apparent, the pulser unit (100) as per present invention has virtually no possibility of getting tampered and can get only self-destroyed when such an attempt is made.
,CLAIMS:WE CLAIM:

01. A fuel dispenser (10) comprising a hydraulic section and an electronic section disposed in a vapor zone (30) and in a vapor-free zone (20), the Electronics comprising a display unit showing quantity of fuel delivered, money value, fuel rate, parameters of fuel, a measurement interface unit (40) converting mechanical measurement input into electronic measurement output, that is fed to a processing unit, the processing unit, a delivery sensor, an input unit, an output unit, optionally a money transaction unit; the fuel dispenser (10) characterized in that the measurement interface unit (40) is a pulser unit (100) disposed in the vapor zone (30), the pulser unit (100), comprising:
- a permanent identification assembly (70),
- a pulser housing assembly (130) further comprising:
o a magneto-electro-mechanical rotation-pulse converter (140), and
o a pulse processing circuit assembly (210) comprising a lid open detection circuit (220), and
- a pulser lid (110),

the pulser unit (100) having a gate ONE protection and a gate TWO protection against a tamper, the tamper of gate ONE protection renders the pulser unit (100) non-identifiable, the tamper of gate TWO protection causes a microcontroller circuit (230) to execute an irreversible action to erase a bootable area in its flash memory and flash memory area containing a Public Key Infrastructure (PKI) related information, an energy releasable by a low power battery present in the lid open detection circuit (220) when the pulser unit (100) is not provided with the pulser screws conforms to the vapor zone (30) safety norms, and a 90 percent of a total energy of the low power battery boots up the microcontroller circuit (230) and erases the bootable area in its flash memory and the flash memory area with the low power battery.

02. The fuel dispenser (10) as claimed in claim 01, wherein the gate ONE protection further comprises a bridge (71) comprising a plurality of open pockets (72), each pocket (72) having at least one hole aligning with corresponding hole in the pulser lid (110) and the pulser housing assembly (130), the bridge (71) is mounted on the pulser lid (110) using a plurality of non-openable screws at a plurality of prescribed position, at least one Radio-frequency Identification (80), generally abbreviated as RFID disposed in one of the open pockets (72), the pocket (72) filled with a curable resin.

03. The fuel dispenser (10) as claimed in claim 02, wherein the plurality of non-openable screw is a unidirectional screw or a screw without head, or a screw whose head is ruptured as soon as it is tightened to a requisite torque.

04. The fuel dispenser (10) as claimed in claim 01, wherein the gate TWO protection comprises the pulser lid (110) and the lid open detection circuit (220), the lid open detection circuit (220) further comprises the low energy battery and a limit switch (310), the limit switch (310) having a rotatable arm (311) with an end (312), the end (312) travels a vertical distance (313) of minimum 3mm in order to switch between a position 1-3 to a position 1-2 of the limit switch (310).

05. The fuel dispenser (10) as claimed in claim 04, wherein the pulser lid (110) presses the rotatable arm (311) of the limit switch (310) and an electrical connection of the limit switch (310) takes the position to 1-3, keeping a switch sense signal (340) HIGH, the electrical connection of the limit switch (310) takes the position 1-2 when the pulser lid (110) is partially lifted.

06. The fuel dispenser (10) as claimed in claim 01, wherein the tamper is attempted when at least one of an operational input power supply circuit (240) is energized and when the operational input power supply circuit (240) is de-energized.

07. The fuel dispenser (10) as claimed in claim 06, wherein when the operational input power supply circuit (240) is energized, the switch sense signal (340) has a HIGH logic level in the pulser lid (110) in a closed condition, and a LOW logic level in the pulser lid (110) in a partially open situation.

08. The fuel dispenser (10) as claimed in claim 06, wherein when the operational input power supply circuit (240) is de-energized, the battery power boots up the microcontroller circuit (230) when the pulser lid (110) is partially opened.

09. The fuel dispenser (10) as claimed in claim 01, wherein the pulse processing circuit assembly (210) monitors a battery voltage.

10. The fuel dispenser (10) as claimed in claim 04, wherein the rotatable arm (311) of the limit switch (310) when moved up the vertical distance (313) by at least 3mm renders the pulser unit (100) inoperational, a message appears on the display and the fuel dispenser (10) fails to start.

11. The fuel dispenser (10) as claimed in claim 04, wherein the limit switch (310) is situated at any one of a plurality of operational locations.