GNC Rfid PDF

CNG Cylinder and Vehicle
Verification at the Point of

Refuelling
Methodologies for increasing the safety of compressed natural gas
vehicles
NGV Global Position Paper
PO Box 128446, Remuera, Auckland, New Zealand. Tel: +64 9 523 3567 Fax: +64 9 520 3122. email: admin@iangv.org. GST No.:
25-758-480
Table of Contents
Executive Summary ................................................................................................... 6
Introduction ............................................................................................................ 12
Risk in Perspective ............................................................................................... 14
Why is Verification Needed? ................................................................................... 16
How Can These Problems Be Avoided? ................................................................... 18
Options for Verification ........................................................................................... 19
The Electronic Verification Process ......................................................................... 22
Contact Button Systems .......................................................................................... 24
RFID Systems .......................................................................................................... 27
Verification of CNG Cylinders .................................................................................. 28
Features of Electronic Verification .......................................................................... 30
Vehicle and Tag ................................................................................................... 30
The Tag ........................................................................................................... 31
Tag Voltage ..................................................................................................... 31
Tag Capacity .................................................................................................... 31
Tag Data .......................................................................................................... 31
Contact ........................................................................................................... 32
CNG Cylinder Tags ........................................................................................... 32
Tamper Resistance .......................................................................................... 32
The Reader ...................................................................................................... 33
Data Read ....................................................................................................... 34
Dispenser Functionality ................................................................................... 34
Dispenser Type ................................................................................................ 35
Data Transfer from Reader .............................................................................. 35
Read Cylinder Capacity Dynamically ................................................................ 35
Detect Additional Cylinders ............................................................................. 35
Detect Leaks in System? .................................................................................. 36
CNG Cylinder and Vehicle Verification at the Point of Refuelling 2011 NGV Global
Page 2 of 66
Encryption........................................................................................................... 36
Tag Data Encryption ............................................................................................ 36
Encryption Level .............................................................................................. 37
Proprietary system requirements .................................................................... 37
Traceability ..................................................................................................... 37
Pass/Fail List Functionality............................................................................... 37
Database Functionality ........................................................................................ 38
Single Operator? ............................................................................................. 39
Fleet Monitoring ............................................................................................. 39
Loan Management .......................................................................................... 39
Account Payments .......................................................................................... 40
Prepayments ................................................................................................... 40
Cross border compatibility .............................................................................. 40
Additional Features ............................................................................................. 41
Forced inspection program compliance ........................................................... 41
Detects tampering........................................................................................... 42
Continuation to subsequent owners ............................................................... 42
End of life cylinder monitoring ........................................................................ 42
Theft recovery ................................................................................................. 42
Prevent drive away with fuel coupling connected ........................................... 43
Warranty tracking ........................................................................................... 43
Product recalls ................................................................................................ 43
Costs for Establishing and Operating Electronic Verification Systems for NGVs ....... 44
Regulator or Industry Driven? ................................................................................. 47
Database and Encryption Safeguards ...................................................................... 50
Data Privacy ........................................................................................................ 50
Pros and Cons of the Three Verification Systems .................................................... 52
Fleet Vehicles and Private Refuelling Stations ......................................................... 54
Home Refuelling ..................................................................................................... 55
Implementation ...................................................................................................... 56
Page 3 of 66
Conclusions ............................................................................................................. 58
Glossary .................................................................................................................. 60
Appendix1 - Argentinas History of Verification ....................................................... 62
Appendix 2 Comparison of On-site vs. Off-site Database Functionality ................. 66
About NGV Global
NGV Global services the rapidly growing natural gas vehicle (NGV) industry
worldwide. Together with our network of affiliated associations, we represent more
than 300 companies and organisations.
The prime objective of the Association is to increase the use of natural gas and
biomethane for transport and to facilitate efficiency, safety and durability in all areas
of the industry.
More information www.ngvglobal.org
PO Box 128446,
Remuera,
Auckland 1541,
New Zealand
Ph: 64 (9) 523 3567, Fax: 64 (9) 520 3122.
See our other websites at www.iangv.org andwww.ngvglobal.com
2011. NGV Global (International Association for Natural Gas Vehicles). All rights reserved.
Page 4 of 66
Notes:
This document is intended as a basis for discussion only and should not be
used as an implementation guide or model.
The subject matter concerns itself exclusively with verification of

compressed natural gas (CNG) vehicles and equipment. Although liquefied
natural gas (LNG) vehicles may have applications for verification, these are
of a separate nature and are not included.
Any recommendations made in this report relate only to the system

concepts and should not be considered an endorsement of any particular
manufacturer or supplier.
Page 5 of 66
Executive Summary
The key difference between compressed natural gas (CNG) vehicles and vehicles of
other fuel types is that the former stores fuel on board under high pressure. A full
CNG cylinder typically has fuel stored between 200 and 250 bar (20,000 and 25,000
kPa or 3,000 and 3,600 psia). Just as with other fuels, this requires a level of
understanding and respect.
Existing industry standards already require additional precautions for CNG vehicles.
Adherence has helped give the natural gas vehicle (NGV) industry an exceptional
track record for safety to date, especially when compared to other fuel types.
Unfortunately, and also as for other fuels, there are some people who choose to
take unnecessary risks; their actions diminish the safety threshold and demonstrate
a lack of knowledge and disregard for correct procedures. While this problem is not
isolated to NGV operators, the introduction of a point-of-refuelling control measure
can prevent gas being dispensed into unsafe vehicles or those not designed for
natural gas.
Point-of-refuelling is the critical point of control in the CNG fuel chain, where control
can be implemented before high pressure gas is dispensed into the vehicle.
The control methodology hinges upon various forms of verification. The goal of
verification is to identify an irregularity on a CNG vehicle and to prevent gas from
being dispensed until the irregularity is rectified.
The irregularity might be that the vehicle does not meet current inspection
requirements; or it may have been tampered with since its most recent inspection;
or it may have had a mechanical fault since its most recent inspection.
In most countries NGV installations must be certified and in some cases regularly
inspected and recertified.
In some countries only certified vehicles are allowed to be fuelled at CNG stations;
the certification status of these gas vehicles is verified prior to refuelling either
visually or electronically.
Most countries do not have refuelling verification systems in place.
For verification to be successful, it must operate as a one-in, all-in system, with all
fuelling stations in a marketplace participating. Having some stations participate and
some not would dramatically reduce the effectiveness and accuracy of the system. A
Page 6 of 66
later section investigates whether such schemes should be regulator or industry

driven.
In most existing cases where verification exists today, the verification is performed
by checking a certificate on the vehicle, usually a sticker or decal affixed to the
chassis or windscreen. The attendant checks the sticker for validity and if it is not
current, then the vehicle is not approved for filling.
A key limitation with this form of verification is that it is subject to human error. An
attendant can easily make the mistake of misreading a sticker and proceed to fill the
vehicle.
This option is also open to forgery or fraud. In some areas, there has been a vibrant
market of counterfeit stickers or decals that have been sold to motorists to use on
their vehicles, even though their vehicles are not fully certified or inspected.
Under the human verification method, the fuel court attendants may also be
exposed to intimidation and threatening behaviour from motorists. There have been
instances where attendants have refused to fill a vehicle and have subsequently
been verbally or physically threatened or abused by irate motorists, sometimes even
requiring hospitalisation.
Electronic verification systems are harder to circumvent than human verification.
They are significantly less prone to human error and can be more difficult to
overcome through forgery or fraud.
Because the systems rely on an electronic form of intervention, there is also less
chance of a fuel court attendant being intimidated, bullied, or harassed into
dispensing fuel into an unsafe vehicle.
Electronic verification is currently used in Peru and Colombia.
Recognising the limitations of human verification systems, several other countries in
Latin America and in Asia have considered or are currently considering switching to
an electronic verification system.
Of those that have considered and not switched, the main barrier to date appears to
be cost rather than any specific technological barriers. This paper shows though, if
properly amortised, the costs are very small and may, in fact, return net savings.
Electronic verification systems have three basic components: an external database
that contains information about which vehicles may or may not be fuelled; a tag
placed on the vehicle that uniquely identifies that vehicle; and a reader attached to
Page 7 of 66
the fuel dispenser that compares the information on the vehicles tag with the
information in the database, and approves or denies fuelling.
Electronic verification systems currently come in two types, Contact Button and
Radio Frequency Identification (RFID) systems.
In both cases, a motor vehicle is generally fitted with a digital tag and subjected to
initial inspection to set up the tag and regular inspections thereafter. The initial
inspection takes place when the vehicle is manufactured or when the CNG
components are installed, and the regular inspections happen on a regular cycle
thereafter. That cycle depends on local regulations or standards, but would usually
be 12, 24, or 36 months, possibly longer in some cases. Encrypted data relating to
the vehicle is then uploaded to a centrally-managed database.
The nozzle of the dispenser has a reader embedded or attached to it. When a
vehicle arrives at a fuelling station for fuelling, this reader reads data from the tag on
the vehicle and communicates that data to the dispenser. The reader may be
physically connected to the tag, in the case of contact button system, or it may work
off radio frequency, which is the basis of the RFID system.
Using the data from the tag, the dispenser passes the information to a digital
terminal where it checks the data from the vehicle against a pass list, in the case of
a dispenser working in real time online, or to a fail list that can be downloaded to
the dispenser daily. Whether the vehicle attained a pass or fail reading
determines whether the vehicle has been approved to receive fuel, or not, which in
turn determines how the dispenser is activated. The system can be coded to either
deliver fuel at full pressure, partial pressure or not at all.
Electronic validation systems can also operate independently if the live central
database is not available for a short period. RFID systems can do this using
information written to the vehicle tag and the fail list on the local system. Contact
button systems currently rely on the pass list of a local version of the database and
then upload transaction data to the central database when it can again be accessed.
In both cases a database is still a central requirement for day-to-day operation.
For the purposes of this paper, a number of electronic systems have been reviewed.
This includes two contact systems which are currently operational in Colombia and
Peru. As RFID systems are currently only in the trial phase (although they are, in fact,
market ready) the review of RFID systems is therefore only theoretical. In this case,
information from two separate suppliers was used to compile this review.
Page 8 of 66
It is important to note that the statements in this document about the features of
verification systems relate only to the systems reviewed. Any recommendations
made in this report relate only to the system concepts and should not be
considered an endorsement of any particular manufacturer or supplier.
Electronic verification of CNG cylinders on the vehicle at the time of refuelling
provides a means to determine if the cylinder set up has been altered and/or if the
cylinders have passed their inspection or expiry date. This adds another level of
security to the verification system, making it more complete and effective.
Although visual inspection of cylinders at refuelling has been tried on a limited scale
it is neither practical nor desirable and the method has not been reviewed in detail.
Electronic methods are presented as the only viable means for verifying cylinders at
the point of refuelling. Some RFID systems incorporate extra capabilities whereby
they can check the data from separate tags fitted on the cylinders of the vehicle (this
requires the cylinder tag to be hardwired to the vehicle tag).
On the surface, it may appear that both the contact button and RFID systems might
be expensive to establish and operate. If the costs are correctly amortised, even if
they are entirely passed on to the consumer, the end cost is a fraction of a cent per
unit of fuel dispensed (e.g. per kilogram, per cubic metre or per gasoline gallon
equivalent) or only a few dollars per vehicle per annum.
Because the systems also produce quantifiable benefits, it could be argued that they
are cost neutral or profitable to implement. Such benefits include:
Reduced risk and cost of vehicle incidents (including injury and death costs)
Reduced risk and cost of fuelling station incidents
Possible reduced insurance premiums for fuelling station operators 1
Enhanced fleet management data
Reduced theft of NGVs (and increased recovery of stolen NGVs)
Reduced staffing requirements on station forecourts and costs related to

exposure of staff to consumer harassment
Improved efficiency and reduced default rates of conversion loan schemes as

electronic verification systems can be used to tally fuel consumption,
This has not been tested in this review
Page 9 of 66
calculate fuel savings compared to liquid fuels and determine repayment of

vehicle conversion loans.
The question of who should initiate and impose a verification system, including
managing the database, is left open, although the choice of government regulators
or a consortium of industry members is explored. The outcome depends to a large
extent on market dynamics.
Several factors need to be taken into account when implementing an electronic
verification system, including database operations, data privacy, encryption
protocols, considerations of private fleets and home refuelling units. The overall
methodology of programming the tags and managing the data are crucial elements
to the success of the verification system and require thorough scrutiny and ongoing
audit.
For new and emerging NGV markets, the challenges of introducing a program are
smaller because (a) motorists are not being asked to change how they refuel their
NGVs, (b) the costs can be rolled into the program right at the beginning and c)
because there are very few existing vehicles to be incorporated into the program.
While there may be logistical concerns, these can be overcome and there are
countless examples within the energy, motor vehicle and other industries where
industry transitions have been implemented and adapted on a much larger scale
than a CNG verification program would require.
Transition planning must factor in logistical considerations, financial expense and
education of industry and consumers on a large scale. A transition from nonverification to verification of CNG vehicles and cylinders would require significant
levels of patience, commitment, cooperation and inconvenience; however NGV
Global contends the end would justify the means.
The paper concludes that RFID systems present the simplest and most secure form
of verifying a vehicle while at the same time providing additional features not easily
achieved with contact button systems. There are fewer means of circumventing the
RFID system; it has the highest likelihood of detecting tampering or foul play of a
vehicles natural gas system while providing the highest degree of verification,
ultimately contributing to reduced incidents and increased safety.
The process of initiating an RFID system will vary from country to country. Whether
it is initiated by regulators or by industry, a high level of consultation will be
required.
Page 10 of 66
NGV Global recommends that local and international steering committees be

formed comprising stakeholders from all sectors of industry. NGV Global also
recommends the inclusion of industry regulators, ISO and the UN in ongoing
discussions.
Page 11 of 66
Introduction
The key difference between compressed natural gas (CNG) vehicles and vehicles of
other fuel types is that the former stores fuel on board under high pressure. A full
CNG cylinder typically has fuel stored between 200 and 250 bar (20,000 and 25,000
kPa or 3,000 and 3,600 psia). Just as with other fuels, this requires a level of
understanding and respect.
Existing industry standards already require additional precautions for CNG vehicles.
Adherence has helped give the NGV industry an exceptional track record for safety
to date, especially when compared to other fuel types.
Unfortunately, and also as for other fuels, there are some people who choose to
take unnecessary risks; their actions diminish the safety threshold and demonstrate
a lack of knowledge and disregard for correct procedures. While this problem is not
isolated to NGV operators, the introduction of a point-of-refuelling control measure
can prevent gas being dispensed into unsafe vehicles or those not designed for
natural gas.
Based on data collected over the years2, NGV Global has been able to ascertain that
usually when a preventable incident has occurred, it has been because:
a conversion to CNG has not been done to a recognised international or local

standard
the vehicle involved has been tampered with and is thus in breach of
accepted standards
the vehicle has undergone damage or repair from personnel not familiar
with the additional requirements of CNG vehicles
an attempt has been made to use CNG in a vehicle for which it is not
designed (e.g. LPG vehicles)
NGV Global collects information on incidents in collaboration with other industry bodies, in
particular the Clean Vehicle Education Foundation (CVEF) in the United States. Due to the sensitive
nature of some of this information, we are not able to make this public at this time. We are however
exploring possible avenues to make conclusions from the information gathered more widely
available.
Page 12 of 66
It should also be noted, that in many cases, incidents are often misreported in the
media as CNG vehicle incidents. Though the vehicle(s) involved may have CNG
equipment or fuel on board, more often than not, they have little or no impact on
the cause or effect of the incident. Fires caused by electrical faults or accidents
frequently cause severe damage to the vehicle but the CNG components are often
left intact and/or the fuel is released safely due to pressure relief devices built into
the system.
The major contributing factor in preventable CNG vehicle incidents is Illegal or
unqualified mechanical works related to installations or repairs. CNG installations,
inspections or repairs must always be carried out by someone with qualifications
specific to CNG installations. Standard auto mechanics, or even LPG (propane)
conversion mechanics, do not necessarily have suitable qualifications.
The added element of high pressure componentry means additional precautions are
required in order to ensure the safest possible operation of CNG vehicles and
refuelling stations for all.
This paper explores some of the precautionary options available, specifically CNG
cylinder and vehicle verification at the point of refuelling.
Page 13 of 66
Risk in Perspective
When motorists are introduced to the idea of natural gas as a fuel, often their
first reaction is concern about the safety of such vehicles. A common reaction
is, Wouldnt that be dangerous? Isnt there is risk of explosion?
These concerns may be built upon preconceived ideas about natural gas in
general or they may have evolved out of hearing or reading news about an
incident involving a NGV.
NGV Globals data indicates that the great majority of NGV incidents
reported by the media actually have little, if anything, to do with the CNG fuel
or equipment. More often than not, due to the high standards implemented
by the industry, the natural gas components remain intact, even in the event
of a catastrophic fire.
Motorists are often surprised to hear that in many respects, NGVs are
actually much safer than most other vehicle types - particularly gasoline and
ethanol vehicles and, to a lesser degree, diesel vehicles.
The simple fact is that motor vehicles themselves are inherently hazardous. A
very large mass moving at very fast speeds with large amounts of stored
energy on board is a hazardous combination, regardless of the fuel used.
Human beings have become accustomed to these dangers and have adjusted
behaviours to minimise risk. We know not to smoke cigarettes when were
refuelling a car. We maintain safe speeds and distances on the roads. We
adjust our driving distance to suit road and weather conditions. And when
were driving, we maintain an awareness of other drivers.
The characteristics of methane (natural gas) mean it is safer than most other
fuels:
Nontoxic. We can breathe methane with no toxic response (sufficient

oxygen must still be inhaled though).
Lighter than air. In the event of an incident, methane tends to rise

and disperse away from the incident, reducing the risk of fire,
whereas liquid fuels (including propane or LPG) tend to pool at the
scene and increase the risk of localized fire.
Page 14 of 66
Has a narrow flammability range. It requires a specific temperature

and concentration in air3 to ignite. In essence, it is more difficult to
ignite than most other transport fuels.
So, while it is correct to say that NGVs have their dangers, they must be
considered in the context that all motor vehicles and all fuels have their
dangers.
Approximately 1100 degrees Fahrenheit or 600 degrees Celsius and 5-15% concentration in air.
Page 15 of 66
Why is Verification Needed?

In rare circumstances, a CNG incident may occur because of a genuine technical
fault, either with a cylinder, a valve, some tubing, or some other component on the
vehicle or fuelling station.
However, incidents more commonly occur due to tampering, foul play, or work
being done on the system by unauthorized personnel. Anecdotal evidence suggests
that this is most often done as a cost saving measure.
In some cases, the tampering is done by persons who are unaware of the risks posed
by high pressure systems or who falsely assume that CNG systems operate at the
same pressure as propane (LPG) systems (20 bar).
NGV Global has received reports of motorists buying CNG equipment, including CNG
cylinders, on the retail or second hand market, through services such as eBay,
Craigslist, auction or other means, and then performing do-it-yourself installations.
The availability of such products to the end user may give rise to the perception that
CNG installations can be done by someone proficient in general automotive
engineering when this is not the case.
Reports have also been received of Type 2 CNG cylinders 4 also being sold on the
second hand market but with the fibre wrapping removed to make the cylinder
appear new. This dramatically reduces the strength of the cylinder, making it totally
unsuitable for CNG use. Such cylinders have been known to explode and in some
cases have caused death.
In other instances, the tampering is done by persons who are fully aware of the risks
but perform the dangerous installation anyway. In one case reported to NGV Global,
a vehicle was converted illegally and driven to a fuelling station to be filled with
CNG. Knowing that the cylinders were at risk of explosion, the driver and his
accomplice ensured they were well away from the vehicle when it was being filled
by the station attendant. The cylinders did explode, killing two station attendants
and injuring others at the station.
Incidents may also occur where a cylinder or vehicle has not been subjected to
regular inspection (such as required under ISO Standard 11439). This can occur
4
Type 2 cylinder - a metal cylinder (steel or aluminium) with a partial wrapping that goes around the
cylinder. The wrapping, which is usually made of glass, aramid or carbon, contained in an epoxy or
polyester resin, is added to give the cylinder the necessary strength.
Page 16 of 66
because there is no local inspection regime in place or a regime not being enforced,
or because the vehicle owner does not comply with the regime, either deliberately
or because they arent aware of the requirement.
The inspection process is important as it presents an opportunity for the cylinder to
be inspected by a person qualified to know what signs of wear and tear to look for.
These might include corrosion, chafing of the cylinder lining, chemical abrasion (e.g.
battery acid spills), excess water or oil within the cylinder itself, or wear and tear on
the high pressure tubing and components on the vehicle.
Italy has a unique cylinder inspection program operated by Gestione Fondo

Bombole Metano (GFBM), a subsidiary of the countrys major gas supplier,
ENI. Under the Italian program, CNG cylinders that do not pass periodic
inspection are replaced free of charge with one owned by GFBM.
In many cases, incidents arise where an unapproved cylinder has been used for CNG
installation. Typically this might be an LPG, acetylene or oxygen cylinder. These
cylinders are not designed to withstand the pressures that CNG fuelling systems
deliver. As a result, they typically explode with catastrophic consequences. The
fatality mentioned earlier involved the use of welded acetylene cylinders.
Incidents may also occur due to overfilling of the vehicle, however most standards
and the use of prescribed standard fittings makes this a rare occurrence. Under
industry standards and codes, fuelling station operators are responsible for ensuring
the correct fuel pressure is delivered to the dispenser. However, in some cases
motorists have made use of adaptors or could potentially fit inappropriate couplings
to their vehicle to take delivery of the higher pressure fuel.
In summary, it is almost always human error, sometimes deliberate and sometimes
accidental, that is the cause of most cylinder related CNG vehicle and station
incidents.
Page 17 of 66
How Can These Problems Be Avoided?

Fortunately, the unique refuelling requirements of CNG vehicles can be used to
advantage via systems that control fuel delivery to the vehicle.
Point-of-refuelling is the critical point of control in the CNG fuel chain, where control
can be implemented before high pressure gas is dispensed into the vehicle. It is also
the point where most incidents occur.
The methodology for this is various forms of verification. The goal of verification is
to identify an irregularity on a CNG vehicle and to prevent gas from being dispensed
until the irregularity is rectified.
The irregularity might be that the vehicle does not meet current inspection
requirements; or it may have been tampered with since its most recent inspection;
or it may have had a mechanical fault since its most recent inspection.
In most countries NGV installations must be certified and in some cases regularly
inspected and recertified.
In some countries only certified vehicles are allowed to be fuelled at the CNG
stations; the certification status of these gas vehicles is verified prior to refuelling
either visually or electronically.
Most countries do not have formal refuelling verification systems in place.
For verification to be successful, it must operate as a one-in, all-in system, with all
fuelling stations in a marketplace participating. Having some stations participate and
some not would dramatically reduce the effectiveness and accuracy of the system. A
later section investigates whether such schemes should be regulator or industry
driven.
Page 18 of 66
Options for Verification

There are many options available for verifying the integrity of vehicles at the point of
refuelling.
The first option is a self-verification system, relying on motorists to be fully
educated and fully compliant with inspection requirements. As motorists are not
always educated or compliant, this often means self-verification is no verification.
With this method, there are no controls over how vehicles are refuelled or how highpressure fuel is dispensed to a vehicle. This system is easy to circumvent and
someone can either deliberately or accidentally fill a vehicle which is not fully
certified, or has been damaged or has been tampered with.
The self-verification system is more commonly employed in countries with higher
per capita incomes, including most European countries, USA, Canada and Australia.
In general, these countries have a culture of high compliance with safety
requirements and relatively low records of CNG related incidents. However, as CNG
vehicle populations increase in these countries, as the age of CNG cylinders and
vehicles in service increases and as vehicles go through a second or third generation
of ownership, evidence suggests that incident rates are likely to increase without
more stringent and active verification protocols in place.
The second option is visual verification usually by a fuelling station attendant. This
requires an attendant to be present at the fuel dispenser on the forecourt. Countries
with visual verification include many Asian nations, Argentina, Brazil, Bolivia, Iran,
Egypt and Italy.
In the majority of cases, the verification is performed by checking a certificate on the
vehicle, usually a sticker or decal affixed to the chassis or windscreen. The attendant
checks the sticker for validity and if it is not current, then the vehicle is not approved
for filling.
A key limitation with this form of verification is that it is subject to human error. An
attendant can easily make the mistake of misreading a sticker and proceed to fill the
vehicle.
This option is also open to forgery or fraud. In some situations, there has been a
vibrant market of counterfeit stickers or decals that have been sold to motorists to
use on their vehicles, even though their vehicles are not fully certified or inspected.
Page 19 of 66
Some industry insiders suggest that non-compliant or fraudulent vehicles account

for between 10-25% of vehicles refuelled, even with fuelling attendants on site.
Under the human verification method, the fuel court attendants may also be
exposed to intimidation and threatening behaviour from motorists. There have been
instances where attendants have refused to fill a vehicle and have subsequently
been verbally or physically threatened or abused by irate motorists, sometimes even
requiring hospitalisation.
In one such case, the attendant recognised that a vehicle had Type 2 cylinders with
the fibre wrapping removed (such as mentioned earlier). He refused to fill the
vehicle but was coerced by the driver and his passenger to do so. The cylinders
exploded causing severe damage to the vehicle and fuelling station.
Another issue with this form of verification is that the fuel court attendants are
usually unskilled workers and may not have been trained to detect warning signs of
a vehicle that has been tampered with or may not be suitable to have high-pressure
fuel on board.
Human verification forms are thus too prone to error or can be too easily
circumvented to be relied on completely.
Stickers for Visual ID Peru
Argentinas ID sticker
The third option for verification is electronic verification. This system is the focus of
this paper and currently includes two possible methods, direct contact (using a
contact button) or RFID (Radio Frequency Identification).
Electronic verification systems are harder to circumvent than human verification.
They are significantly less prone to human error and can be more difficult to
overcome through forgery or fraud.
Page 20 of 66
Because the systems rely on an electronic form of intervention, there is also less
chance of a fuel court attendant being intimidated, bullied, or harassed into
dispensing fuel into an unsafe vehicle.
Electronic verification is currently used in Peru and Colombia.
Recognising the limitations of human verification systems, several other countries in
Latin America and in Asia have considered or are currently considering switching to
an electronic verification system.
Of those that have considered and not switched, the main barrier to date appears to
be cost rather than any specific technological barriers (see Costs chapter for details).
Page 21 of 66
The Electronic Verification Process

Electronic verification systems currently come in two types: Contact Button or Radio
Frequency Identification (RFID) systems.
In both cases, a motor vehicle is generally fitted with a digital tag and subjected to
initial and regular inspections thereafter. The initial inspection takes place when the
vehicle is manufactured or when the CNG components are installed, and the regular
inspections happen on a regular cycle thereafter. That cycle usually depends on
local regulations but would usually be 12, 24, or 36 months, possibly longer in some
cases.
Encrypted data relating to the vehicle is then uploaded to a centrally-managed
database (see Database chapter for more details).
The nozzle of the dispenser has a reader embedded or attached to it. When a
vehicle arrives at a fuelling station for fuelling, this reader reads data from the tag on
the vehicle and communicates that data to the dispenser. The reader may be hard
wired to the tag, in the case of contact button system, or it may work off radio
frequency which is the basis of the RFID system.
Using the data from the tag, the dispenser passes the information to a digital
terminal where it checks the data from the vehicle against a pass list, in the case of
a dispenser working in real time online, or to a fail list that can be downloaded to
the dispenser daily. Whether the vehicle attained a pass or fail reading
determines whether the vehicle has been approved to receive fuel, or not, which in
turn determines how the dispenser is activated. The system can be coded to either
deliver fuel at full pressure, partial pressure or not at all.
Electronic validation systems can also operate independently if the live central
database is not available for a short period. RFID systems can do this using
information written to the vehicle tag and the fail list on the local system. Contact
button systems currently rely on the pass list of a local version of the database and
then upload transaction data to the central database when it can again be accessed.
In both cases a database is still a central requirement for day-to-day operation.
Even where a station attendant operates the dispenser, the system could be
configured so they would not have the ability to override the verification from the
dispenser.
Page 22 of 66
Some RFID systems incorporate extra capabilities whereby they can check the data
from separate tags fitted on the cylinders of the vehicle (this requires the cylinder
tag to be hardwired to the vehicle tag). If the volume of the cylinder has increased, if
an extra cylinder has been added or if a cylinder has been replaced and a tag of that
cylinder does not match the data on the vehicle tag, then the dispenser does not
activate and high-pressure fuel is not available to that vehicle.
For the purposes of this paper, a number of electronic systems have been reviewed.
These include two contact systems and two RFID systems. The contact systems are
currently operational in Colombia and Peru. As RFID systems are currently only in
the trial phase (although they are in fact market ready) the review of RFID systems is
therefore only theoretical. In this case, information from two separate suppliers was
used to compile this review.
It is important to note that these reviews relate only the systems as reviewed and
may not be definitive for each system. In other words, some manufacturers may or
may not have features which others in the same category would have. Any
recommendations made in this report relate only to the system concepts and should
not be considered an endorsement of any particular manufacturer or supplier.
Page 23 of 66
Contact Button Systems

Perus verification system was implemented at the commencement of their NGV
program. Colombia uses a similar system. The system uses a touch button, also
known as an ibutton or Dallas button.
The ibutton does not have an internal power source. It requires connection to a
reader in order to be supplied with power to receive input and send output and
must have physical contact with a reader to function.
The ibutton is basically a digital chip enclosed in a resistant box that protects the
chip from the environment and provides the means for connecting the chip to an
appropriate reader. In general this casing is a stainless steel circular box where the
bottom is connected to the chips ground and the top to the chips data contact.
Both parts of the can are insulated and are used as contacts to communicate with
the chip.
The chips used for NGV identification (NGV ID) are of a type called address only
ibuttons. It has a unique alphanumeric code, which is used to identify the chip and
vehicle. The code is also engraved on the stainless steel casing.
They have 64 bits ROM (read only memory). Key Features (as supplied by the
manufacturer):
Page 24 of 66
Can be read in less than 5ms
Operating range: 2.8V to 6.0V, -40C to +85C
Unique factory-lasered 64-bit registration number assures error-free device
Selection and absolute traceability because no two parts are alike
Built-in multidrop controller for 1-wire net
Digital identification by momentary contact
Data can be accessed while affixed to object
Economically communicates to bus master with a single digital signal at

16.3kbps
Button shape is self-aligning with cup-shaped probes
Durable stainless-steel case engraved with registration number withstands

harsh environments
The system verifies that the chips address corresponds to the certified vehicle and
that the technical validity of the certification has not expired. Using information
from the database, it also checks that there are no registered restraints to fuelling
the vehicle. Restraints, for example, might be associated with vehicle being reported
as stolen or product recalls for faulty components.
Address verification is carried out by checking against the central database managed
by the relevant authority. If everything is satisfactory, the dispenser receives an
enabling signal and proceeds to fuel the vehicle. The process is done in real time and
takes only a few moments.
There is no need to maintain contact between reader and ibutton during refuelling.
Once the dispenser is shut down the system resets and in order to activate it again, a
different chip must be read.
The dispenser also communicates to the central database the amount of fuel sold to
the vehicle and the price charged.
Page 25 of 66
As an additional benefit, if the vehicle has an associated loan being paid through the
natural gas sale, the system may also be used to communicate the relevant
information to the loan provider5.
Contact button
Reader
The chip is enabled by a certification agency that receives the converted/inspected

vehicle, verifies data and work done and then sends the information to the central
database.
Before handing the newly converted vehicle over to the certification agency, the
workshop technicians may fill the vehicle using their own special chip (see picture
below). This allows the workshop to bypass the system so the vehicle may be driven
to the certification agency (if it is located separately to the conversion workshop).
It is common in some countries for gas companies or government bodies to provide loans
(sometimes with low interest) to motorists to support the costs of conversion. These loans may be
repaid through a levy added or built in to the fuel price.
Page 26 of 66
RFID Systems
RFID systems differ primarily in the way the data is read and communicated; they
also have additional capabilities.
The communication between the reader on the nozzle and the tag on the vehicle is
activated automatically. This happens when the nozzle is removed from the
dispenser and finds a vehicle tag within very close range. That range must be very
small, less than 10 cm, ensuring that the reader cannot misread a vehicle or read
multiple vehicles at once.
The automatic read of the tag means the action of refuelling does not require an
additional step (such as is required by contact button systems). Assuming there are
no communication issues with the system terminal and database, the read and
activation process is almost instantaneous. Even without access to the external
database, verification can be done by reading data already on the tag and, if
available, checking it against the fail list. This is because RFID tags have additional
data capabilities not available on the contact button systems (as reviewed).
The RFID reader also maintains a constant signal with the tag, preventing the
possibility of a tag on one vehicle being used to activate a dispenser but the fuel
being dispensed into another vehicle.
The extra data capabilities of an RFID also mean it can (for example) be used to
measure the fuelling capacity of a vehicle dynamically, thus an additional cylinder
surreptitiously fitted to the vehicle can theoretically be detected (see features
section for more details).
Some tags have been developed with the capability of detecting if a vehicle has been
subjected to high impact or high temperatures. This adds another layer of capability,
meaning the system could potentially detect if a vehicle might have been involved in
an accident or fire and might consequently require reinspection of the CNG cylinder
and high pressure system.
The possibility of providing an interface between an RFID tag and a vehicles onboard diagnostic (OBD) system has also been discussed but this capability is not
included in this review.6
6
A vehicles OBD could be used to verify the status of its CNG cylinders and potentially either prevent
the vehicle from being used or restrict it to a limp home mode.
Page 27 of 66
Verification of CNG Cylinders

Electronic verification of CNG cylinders on the vehicle at the time of refuelling
provides a means to determine if the cylinder set up has been altered and/or if the
cylinders have passed their inspection or expiry date. This adds another level of
security to the verification system, making it more complete and effective.
CNG cylinders can be identified visually or electronically. Although visual inspection
of cylinders at refuelling has been tried on a limited scale, it is neither practical nor
desirable and the method has not been reviewed in detail.
In Argentina, for example, a massive recall was initiated for Type 3 cylinders over a
short period to address serious safety concerns that arose at that time. Even under
those circumstances, which generated fear amongst station attendants and owners,
the control was not completely effective.
In general, CNG cylinders are mounted inside metallic enclosures, such as the trunk
of the vehicle, within the chassis or body, beneath the vehicle or, in the case of some
buses, on the roof of the vehicle.
Metal structures enclosing the cylinders and their tags act as filters that affect or
even prevent communication (or examination) from outside. All these conditions
make it difficult to provide a simple system to verify the data of the cylinders
installed on the vehicle before every refill.
However, current RFID technology will allow electronic cylinder IDs to be checked
together with the vehicle if special tags are installed and physical connection is
provided between the cylinders and the installed vehicle chip or tag7.
The use of contact buttons, on the other hand does not allow for this solution, which
is why the systems in force in Latin America cannot provide cylinder verification.
Argentina had considered introducing this control, but the logistics behind the
implementation, such as the need for a complete and thorough review of the onboard cylinder database, have so far prevented it from being established.
Standards already exist covering RFID identification of gas cylinders in general (ISO 21007-1:2005).
The identification aspects of this standard could also be used for CNG fuelling verification practices.
Page 28 of 66
Electronic validation of CNG cylinders is therefore presented as the only viable

means for verifying cylinders at the point of refuelling. Further, a comprehensive
control system will incorporate cylinder verification into the total vehicle verification
system.
CNG cylinders may be located in a range of on-board locations the trunk of a

vehicle, on the roof (bus) or beneath the chassis (bottom image).
Page 29 of 66
Features of Electronic Verification

Electronic systems vary in their degrees of complexity but, in general, most of them
have the following components or processes.
The tables below break down the systems into sections and compare the Contact
Button and RFID systems.
Vehicle and Tag
CONTACT BUTTON SYSTEM
RFID SYSTEM
Tag
Chip embedded in small

case fixed to chassis near
receptacle
Chip embedded in resin

affixed to vehicle near
receptacle and cylinders
Tag voltage
None (power sourced via

reader)
None (power sourced via

reader antenna)
Tag capacity
64 bit
2048 bit
Static Spark
Risk
Possible without correct

grounding prior to
connection (unlikely though
as the nozzle would usually
connect to the vehicle first)
Not possible, no contact

between antenna and tag
Tag data
Read only
Read/Write
Contact
Physical contact with reader
Radio contact with reader
Cylinder tags
No
Optional (hard wired to RFID

chip)
Tamper
resistance
Moderate
Advanced
Page 30 of 66
The Tag
The tag is the store house on the vehicle for the data that applies to that vehicle and
its components.
In the case of a contact system this is usually an electronic chip embedded in a small
case that is affixed to the chassis of the vehicle near the fuelling receptacle. It is
located there in order to allow the contact button from the fuelling dispenser to
reach the tag itself. With the RFID system, the chip is usually embedded in resin and
affixed to the vehicle with high strength glue near the receptacle. In some cases,
additional ID tags may be put on each CNG cylinder. These tags would then
communicate with the vehicles main RFID tag.
The vehicle tag capability can be expanded to include monitoring for impact, high
temperature and other considerations.
Tag Voltage
Neither the contact button nor RFID tags are self-powered. With the contact system,
the tag is energised when it makes contact with the reader. The RFID tag is
energised when it is in range of the antenna on the fuelling nozzle.
Tag Capacity
The contact buttons reviewed have a 64 bit capacity. RFID tags reviewed have a
2048 bit capacity.
Tag Data
With the contact button system the tag is a read-only device. As it only contains an
ID number and no additional data, it is not designed for information to be written to
the tag once the vehicle is operational. (If the vehicle goes through a reinspection or
change, the data is changed on the database but the tag ID remains the same).
An RFID system can be configured for data to be written dynamically to the tag itself
(by the reader attached to the fuel dispenser). In this way the vehicle could, for
example, record its own refuelling history which in turn can be used for fleet
management or vehicle diagnostic purposes. The tag data could also be used as a
backup if contact with the central database is restricted from time to time.
Page 31 of 66
Contact
With the contact system, as the name implies, physical contact is made between the
reader and the tag itself (via the button). With an RFID system, contact is made by
very low frequency, low energy radio signal.
CNG Cylinder Tags

There are no cylinder tags fixed to the CNG cylinder on the vehicle in the reviewed
systems.8
With an RFID system, there is an option to add cylinder tags to the system. These
would usually be hard wired to the main RFID chip on the vehicle itself and could be
used to detect if cylinders have been replaced illegally.
The cylinder tag capability can also be expanded to include monitoring for impact,
high temperature and other considerations.
Systems that have tags on CNG cylinders provide for more robust verification than
those that do not.
Tamper Resistance
An important feature of an electronic verification system is its tamper resistance.
With a contact system, the tamper resistance is moderate only since the tag itself
may be altered or even removed from a vehicle and put onto another vehicle.
With an RFID system, the tamper resistance is much more advanced. The tag casing
is designed so any attempts to remove the tag would probably damage it and render
it unusable.
RFID Tag
destroyed in
attempt to
remove from
vehicle
RFID Tag
(undamaged)
This is technically possible but adding this capability to the button system would require upgrading
the entire system (including tags, readers and communications units). This would add cost to the
button system but still not offer the full advantages of the RFID system.
Page 32 of 66
The Reader
CONTACT BUTTON
SYSTEM
RFID SYSTEM
Location of reader
Separate line
Attached to nozzle
Activation
Contact required at
beginning to activate
dispenser only
Continuous read signal

required (i.e. antenna must
be within range
throughout fill)
Data read
On initial contact only
Dynamic
Can fuel another vehicle

from same read
Possible but difficult
Not possible
The reader is the physical tool attached to the refuelling dispenser nozzle which
reads the data from the tag on the vehicle. The reader on the contact system is
located on the end of a separate line near the end of the nozzle. An RFID reader is an
antenna attached to the end of fuelling nozzle in a manner to prevent
tampering/removal.
In both cases, the reader is connected to the dispenser controller with a wire affixed
to the delivery hose.
With a contact system, contact is only required between the reader and the chip at
the beginning of the filling process to activate the dispenser.
With an RFID system, a continuous read signal is required at the reader throughout
the filling process. If the reader should lose radio contact with the tag (because it
Page 33 of 66
has been moved away from the receptacle on the vehicle) then dispensing of the
fuel will not commence. This prevents the reader picking up a signal from one
vehicle and allowing fuel to be dispensed into another vehicle.
Data Read
With the contact button system, the read of the data only happens at the initial
point when contact is made. With an RFID system, the data read is dynamic,
meaning the reader continues to read data from the tag throughout the filling
process.
A key difference between the two types of readers is the ability to fuel another
vehicle from the same read. With the contact button, this can be achieved (though
with some difficulty). In a situation where the fill is being supervised, it would be
difficult to do without the attendant being aware of this happening. However, with
unsupervised fills, it is possible that a dispenser can be activated with one vehicle
but the fuel is dispensed to another unverified vehicle.
With an RFID system, provided it is correctly specified and configured, it is not
possible to read from one vehicle and fill to another.
Dispenser Functionality
CONTACT BUTTON
SYSTEM
RFID SYSTEM
Dispenser type
Any digital dispenser
Any digital dispenser
Data transfer from

reader
Beginning of fill
Dynamic and continuous.
Read cylinder
capacity
dynamically
No Capacity determined
via database which can
limit fill accordingly.
Yes Reads from tag and

measures available capacity.
Shuts down fill upon capacity
discrepancy.
Verify cylinders
No
Yes
Detect additional
cylinders?
No
Yes (via dynamic volume

measurements)
Page 34 of 66
Detect leaks in
system?
No
Possible but not fool proof.
Dispenser Type
Contact button and RFID systems can both be used on any form of digital CNG
dispenser. Even existing dispensers which are already in operation can be adapted
to take on either of these systems (except in rare situations).
Data Transfer from Reader

With the contact button, the dispenser can read from the tag at the beginning of fill
only whereas with the RFID system, the data is read constantly throughout the filling
process.
Read Cylinder Capacity Dynamically

Not specifically related to the dispenser itself but the functionality of the software
within the dispenser, is the ability to read the CNG cylinder tag (RFID only). If the tag
data does not match the vehicle data the dispenser is not activated. As fuelling
starts, the RFID dispenser controller calculates the total capacity. If at any time
during the fill, the fuel dispensed exceeds that which is recorded on the vehicle tag,
the fill is terminated.
With the contact system, it is not possible to read the cylinder tag but the cylinder
capacity can be written to the database. Processing within the dispenser can
potentially be used to calculate if additional cylinders are on board.
Detect Additional Cylinders

With an RFID system, the dispenser can also take a dynamic read of the capacity of
the cylinder and detect whether the overall capacity of the system has changed
relative to what it was when the vehicle was certified.
This means that if an additional cylinder has been added or cylinder replaced with a
larger cylinder illegally, the dispenser is able to detect this difference and cease
dispensing fuel to the vehicle. This is because the increased capacity is interpreted
as a sign of tampering. If the tag and database has not been updated then it means
that the vehicle has not been certified correctly thus should not get a full pressure
fill (or should get no gas at all).
Page 35 of 66
Detect Leaks in System?

It is also beneficial to be able to detect leaks in the system at the point of refuelling.
Some dispensers have an excess flow monitoring system that would detect a major
leak such as a hose rupture.
Other leaks may also be detected with an RFID system by the calculation and
monitoring of cylinder volume but this depends on the size of the leak and is not fool
proof (i.e. small leaks are unlikely to be detected).
Encryption
CONTACT BUTTON
SYSTEM
RFID SYSTEM
Encryption Level
64 bit (as reviewed but

higher may be possible)
128 bit (same as

banking)
Proprietary system
required
Yes
Yes
Traceability
Yes (via database

records)
Yes (via database

and tag records)
Pass/Fail List
functionality (checks
database dynamically)
Yes
Yes
Fail list functionality

(database
downloaded once
daily)
No (theoretically
possible but requires
more advanced
system)
Yes
Tag Data Encryption

There are options available to prevent unauthorized tags from being utilized. The
contact system is only operable if it can access a database of approved vehicles (as
reviewed). With tag data encryption, it is not necessary to maintain a list of valid
vehicles, only a fail list of vehicles and/or identified system components that are
Page 36 of 66
not to be fuelled. The table in Appendix 2 outlines the advantages and

disadvantages of the two alternative methods of authorization.
Encryption Level
A critical component of the system is the level of encryption between the tag, the
reader and the database. With the contact button systems observed, this was a 64bit system; higher levels of encryption may be possible but this would require an
upgrade of the tag and reader system.
With RFID systems, the encryption would usually be 128-bit, the same level of
encryption that is used by banking and some defence systems.
Proprietary system requirements

In order for the encryption to function correctly, with both the contact system and
the RFID system, a proprietary encryption system is required. Though open
encryption systems are available, this potentially makes it possible for illicit tags to
be manufactured.
This means that the encryption system for an entire refuelling network should
originate from the same supplier to enable cross compatibility between stations and
vehicles. The encryption system can however be licensed to multiple tag suppliers.
As much as possible, this should be standardised within and between countries to
ensure cross-border compatibility (see also Database Functionality). This aspect will
require considerable discussion before systems are implemented.
Traceability
Both systems also have varying degrees of traceability, meaning that the refuelling
history of a vehicle could be compiled if necessary. In some cases, particularly fleet
operations, this is a desired additional benefit as the fleet operator is able to track
vehicle activity more closely.
With the RFID system, the recent refuelling history (currently up to 5 transactions)
can be written to the actual tag on the vehicle.
Pass/Fail List Functionality

Although both systems would do it with varying degrees of complexity, each is able
to operate on a pass list system. A pass list system is where the system generates a
list of vehicles which are verified and should pass the test when the reader reads
Page 37 of 66
from the vehicle tag. This functionality works best when the database is able to be
read in real time but can work for a short time if the database is offline (by capturing
interim data and uploading this to the database when access is available again).
The alternative to operating a pass list is to have a fail list which is downloaded to
the dispenser daily and is, as the name suggests, a list of all vehicles which are not
currently certified for high pressure refuelling. The advantage of operating a fail list
is that real time communication is not required and the verification process happens
entirely on site, using data on the vehicle tag.
With the contact button system, this is theoretically possible (with more
sophisticated chips), although the systems observed did not have that functionality.
With an RFID system, the fail list functionality is a possibility and as a supplement to
the capability to verify from the tag itself.
Database Functionality
CONTACT BUTTON
SYSTEM
RFID SYSTEM
Single
operator?
Preferred but not required
Preferred but not required
Fleet
monitoring
Optional*
Optional*
Loan
Management
Optional*
Optional*
Account
payments
Optional*
Optional*
Prepayments
Theoretically (if the

balance is on the database)
Optional (balance is on the

vehicle tag)
Cross border
compatibility
Theoretically (requires use

of same contact button
and cross talk between
databases)
Theoretically (requires same

encryption protocol and
cross talk between
databases)
*Optional features on contact button system require 24/7 database connectivity. On RFID some
optional features can operate with intermittent database connectivity (i.e. using data capabilities on
the tag).
Page 38 of 66
Single Operator?
The component that ties the verification system together is the central database.
With both the contact systems reviewed the database in each country is managed
and operated by a single authority or trust. The actual read of the tag and operation
of the database are separate functions though, thus one is not dependent on the
other.
Both systems can theoretically be set up where multiple databases are operated,
either by regulators or gas suppliers, or even a consortium of gas suppliers. 9 To
maximise the interoperability between networks they would need to operate with
the same encryption system and cross talk functionality would be required between
databases (similar to the way different banks communicate banking and credit card
information to and from retail or online payment systems).
It is possible to set up either system in different ways. As is the case for Peru,
Colombia and Argentina, a central regulatory authority may exercise control.
Alternatively, the industry itself can set up and manage the database. There are
advantages and disadvantages for each (refer to later section for detail).
Fleet Monitoring
Both systems also offer the opportunity for central fleet monitoring including fuel
use patterns, distance of driving, etc. RFID has the option of capturing the data on
the tag itself as a backup if the database isnt accessible.
Loan Management
The systems may be used to manage loans provided to finance the conversion of a
vehicle. If a motorist is paying off a loan for the conversion of the vehicle, the
database can transmit data to the loan manager. Under such a system, a levy is
added to the cost of the fuel and when paid, this levy is deducted from the loan on
the vehicle10.
9
At the time of writing, there are no consortium style databases in operation. However, there are
many industries where centrally managed databases have been used quite effectively. This includes
the credit card and banking industries.
10
This feature has proved so successful that in Peru, banks have used it to manage subsequent loans
for other items (fridges, TVs, etc) when the vehicle loan has been paid off. Because the consumer has
become used to paying a particular price for their fuel, the loan payment is not perceived as an
additional burden. Consumers have also used the system to build up a favourable credit rating with
loan providers.
Page 39 of 66
The dispenser increases the sale price per unit by an amount set by the loan
manager. When the transaction is completed, the dispenser price returns to the
posted price. The methodology simplifies the station accounting that is based on
units of fuel sold versus the amount of cash/credit cards the attendant has received.
If some of the sales are at different prices, it is not only more difficult to produce an
accurate sales report; it also opens the system to fraud.
RFID has the option of capturing the data on the tag itself as a backup if the
database isnt accessible.
Account Payments
The database can also be used as a standard retail point of sale system where
account payment and fuel use information is included in the data stored on the
system.
With the RFID system, transaction data can be recorded on the vehicle tag (currently
up to a maximum of 5 transactions) to provide the ability for the vehicle owner to
verify the fuel received.
Prepayments
Prepayments operate similar to a prepaid balance function on a mobile phone. The
RFID tag on the vehicle maintains a prepaid balance that is debited as a transaction
proceeds. This balance could be topped up using a vending machine on site at
refuelling stations.
This functionality is only possible with the RFID system; however, a prepayment
system could function on the contact button system if the balance resides on the
database rather than on the tag.
Cross border compatibility

It is desirable to have cross-border compatibility to allow vehicles to travel from one
region or country to another. This is possible under both systems; however, the
cooperation between regulators and/or system providers in the different regions or
country is critical.
In most cases it would require the same sort of contact button or RFID system to
enable vehicles to be verified when travelling to another country or region.
Page 40 of 66
Additional Features
As well as the obvious immediate features of verification systems, there are some
other ancillary benefits which arise from such programs.
CONTACT BUTTON
SYSTEM
RFID SYSTEM
Yes
Yes
Detects tampering
No
Possible
Passes to subsequent
owners
Yes
Yes
End of life cylinder

monitoring
Yes (via database

reference)
Yes (real time via

cylinder tag reference
or database reference)
Theft recovery
Yes
Yes
Prevent drive away with

fuel coupling connected
No
Possible
Warranty tracking
Yes
Yes
Product recall uses
Yes
Yes
Forces inspection program

compliance
Forced inspection program compliance

Verification programs force compliance of inspection regimes for CNG vehicles and
cylinders. If such regulations or standards are not enforced or are not monitored,
then people can own and drive CNG vehicles without having the proper inspections
undertaken. This is a critical component which on its own may be viewed as
justification for setting up a verification system.
Page 41 of 66
Detects tampering
The contact button system does not detect tampering of a vehicle and its CNG
components. An RFID system, depending on its complexity, has this capability (e.g. it
can detect that a cylinder is added or an approved cylinder is replaced from what
was originally approved).
Continuation to subsequent owners

With the contact button or RFID system, the system changes ownership with the
vehicle. This means the onus is not on the first owner of a vehicle to educate
subsequent owners that there is an inspection program in place to be complied
with. By having a contact button or RFID system in place, the new owner learns that
in order to purchase fuel, the vehicle must be inspected regularly and must not be
tampered with.
End of life cylinder monitoring

Because CNG cylinders have a limited life span that sometimes may be shorter than
the lifespan of a vehicle, both the contact button and RFID systems serve to monitor
the end of life of the cylinder and can give a warning when the cylinder needs to be
replaced.
Contact button systems rely on the database record for the vehicle being updated if
a cylinder is replaced but an RFID system can potentially read the data on the
cylinder itself.
The RFID system can also be used to identify expired cylinders that may have been
reinstalled on another vehicle after they have been removed. With the contact
button system, expiry will only be detected during a regular visual inspection.
Theft recovery
Both systems provide a degree of theft security. If a vehicle is stolen and the theft is
registered on the central database, the CNG network can be coded not to deliver
fuel to the vehicle. Stolen bi-fuel vehicles will still have the ability to run on gasoline
though.
Consideration needs to be given though to the risks this might pose to fuelling
station attendants or operators who could potentially be at risk if exposed to
criminal behaviour (e.g. possible threats arising due to non-delivery of fuel).
Page 42 of 66
Prevent drive away with fuel coupling connected

CNG dispensers currently rely on breakaway couplings on the dispenser hose to
protect infrastructure if a vehicle drives away while the fuelling coupling is still
attached. An RFID system can be set up to disable the vehicles ignition system until
the coupling has been removed from the vehicle. This would reduce drive away
incidents and lower repair costs arising from such incidents.
Warranty tracking
The system can also be used for warranty tracking of vehicles. When a vehicle is due
for regular inspection to comply with its warranty, the dispenser can provide an
audible or visual warning that the inspection is required (requires cooperation with
the vehicle supplier). The dispenser could also potentially print a warning on the
payment receipt (currently operational in Peru).
Product recalls
Both systems can be utilised for product recalls, through services offered by the
database manager.
Vehicles arriving to be refuelled can receive an audible or visual warning that a
product recall is underway and advise the vehicle owner what they are required to
do under this product recall.
If the recall is safety related, the fuelling network could even be coded not to deliver
fuel to the vehicles so they cant be used until the problem on the vehicle has been
rectified. This can be done either by removing the vehicle from the pass list or
adding it to the fail list.
With the RFID system, if individual components on the vehicle are tagged, then the
system can also be set to read the actual component rather than relying on the
database to inform the dispenser that the component is fitted.
Page 43 of 66
Costs for Establishing and Operating Electronic

Verification Systems for NGVs
On the surface, it may appear that both the contact button and RFID systems might
be expensive to establish and operate. If the costs are correctly amortised, even if
they are entirely passed on to the consumer, the end cost is a fraction of a cent per
unit of fuel dispensed (e.g. per kilogram, per cubic metre or per gasoline gallon
equivalent) or only a few dollars per vehicle per annum.
Because the systems also produce quantifiable benefits, it could even be argued that
they are cost neutral or profitable to implement. Such benefits include:
Reduced risk and cost of vehicle incidents (including injury and death costs)
Reduced risk and cost of fuelling station incidents
Possible reduced insurance premiums for fuelling station operators11
Enhanced fleet management data
Reduced theft of NGVs (and increased recovery of stolen NGVs)
Reduced staffing requirements on station forecourts and costs related to

exposure of staff to consumer harassment
Improved efficiency and reduced default rates of conversion loan schemes as

electronic verification systems can be used to tally fuel consumption,
calculate fuel savings compared to liquid fuels and determine repayment of
vehicle conversion loans.
Due to the wide range of factors to be considered when implementing an electronic

verification system it is beyond the scope of this paper to do a specific analysis that
provides a definitive cost both for setup and operation. Stakeholders would need to
conduct their own analysis based on their specific conditions directly with
commercial providers.
11
This has not been tested in this review.
Page 44 of 66
Also excluded from the discussion is the cost associated with establishing cylinder
inspection programs. Industry codes and standards already specify minimum CNG
vehicle cylinder inspection and end-of-life requirements. Regardless of whether
these are regulated or only require voluntary compliance by the vehicle owners,
there should already be such systems in place and costs factored into the industry
economy. In any event, these costs need to be considered separately from the costs
of electronic verification.
In the big scheme of things electronic verification costs are quite small and there is
not much difference in cost between a contact button system and an RFID system.
Costs (in $US) have been roughly broken down as follows:
CONTACT BUTTON
SYSTEM
RFID SYSTEM
Tag (one time cost;

includes hardware cost.
Programming time
would be an additional
10-20 minutes of labour
when the vehicle
undergoes its initial
inspection)
Less than $10
$5-$10 (basic vehicle tag

only)
Reader, dispenser unit,

station processor and
communications unit
(One time cost. More
hoses on site lowers
cost/hose)
$4,000 (includes
capability for a four
hose unit)
$1,000-$3,000
(depending on complexity
of features)
Database setup
Depends on complexity
of requirements and
operating model
Depends on complexity of
requirements and
operating model
Operating costs (to

support ongoing
database costs,
licensing fees of system
provider, etc.)
Unknown but estimated

at a fraction of a cent
per unit of fuel
dispensed.
Largely dependent on fuel

volumes but ranging from
$0.005 to $0.075 per
transaction (i.e. also a
fraction of a cent per unit
of fuel dispensed.)
$4-$5 (optional additional

tags for cylinder and
other components)
$12-$15 (Optional
intelligent tag to read
cylinder and vehicle kit
info.)
Page 45 of 66
Database management costs for both the contact button and RFID systems could
not be obtained or determined accurately for the purposes of this paper. An
indicative cost of the setup and management of the database can however be
obtained from Argentina.
Though Argentina only has a visual inspection program in place, this program does
include a central vehicle and cylinder database. The estimated setup cost of this
system, which also includes the actual vehicle certification process, was
approximately $US2 million with an estimated ongoing annual operating cost of
$US6 million. With an NGV population in excess of 1.5 million units, this equates to
less than $US1.30 per vehicle for the setup and approximately $US4 per vehicle per
annum for operational costs. In Argentina that cost is borne by the users who pay it
through the cost of the recertification. ENARGAS sells the stickers and covers costs
with the proceeds.
Though Argentinas large NGV population may lower the per vehicle database
operating costs, NGV Global contends that even if the per vehicle costs were three
to five times higher, the cost would still be justifiable.
In simple terms, Argentina, Colombia and Peru are not wealthy countries, yet they
have all proven that a centrally operated vehicle and cylinder database is affordable
and manageable. The methodology for utilising the database (i.e. visual, contact
button or RFID) only represents a small incremental cost on top of this.
Even for countries with existing large NGV populations, cost should not be seen as a
prohibitive factor. Though there are additional logistical considerations (see
Implementation section) over a new or emerging market, costs should be
recoverable in a relatively short period of time.
Though some gas companies and station operators may choose to absorb their costs
internally, most costs will be able to be passed on to the consumer through slight
increases in retail CNG costs. This could be problematic in markets with regulated
pricing mechanisms and may require negotiation with the appropriate government
bodies.
Page 46 of 66
Regulator or Industry Driven?

The question of who should initiate and impose a verification system, (including
housing and managing the database) is left open, although the choice of
government regulators or a consortium of industry members is explored. The
outcome depends to a large extent on market dynamics.
In countries that may have high levels of regulatory avoidance and a culture of low
safety compliance, it may be more appropriate for industry regulators to impose and
manage the verification system.
An example of a regulatory model (Peru) is outlined below:
Source adapted from Cofide.com
In countries where high levels of cooperation exist between gas retailers, conversion
providers, CNG cylinder providers, and those responsible for the inspection and
certification of vehicles, it may be more viable for an industry driven system to be
established.
Commercial examples of such cooperation include banking cooperatives such as the
EFTPOS systems for processing payment card and ATM transactions in New Zealand
and Australia (most countries have similar local systems). In both countries these
Page 47 of 66
were established by a single bank but are now owned by a collective of banks and
managed independently.
Applying a similar business model to CNG verification may require the creation of a
stand-alone operating company or trust that is specifically dedicated to establishing
and operating the verification database.
Even a not-for-profit model could be established to manage the database setup and
operation. ICANN, the Internet Corporation for Assigned Names and Numbers is
such a model. ICANN is basically responsible for establishing and operating the IP
and domain name systems that form the backbone of the internet.
Although CNG vehicle and cylinder database management would present a lower
degree of complexity, the ICANN stakeholder model (see below) demonstrates the
level of cooperation industry can achieve, even without regulatory drivers.
Source - http://www.icann.org/en/about/
Similar bodies could be established for the purposes of operating CNG vehicle and
cylinder databases. Given the success of the ICANN model, it could even be argued
Page 48 of 66
that a global body be set up. This could help improve efficiencies and overcome
cross border compatibility issues.
Seed funding from industry or governments could be used to examine this concept.
Even where a cooperative model is established, it may also require regulatory
backup to prevent refuelling stations operating without a verification system in
place.
An alternative to having the verification system regulated could be for gas retailers
to collectively mandate the establishment of systems to ensure such stations do not
receive gas to compress and sell.
Regardless of the model, harmonised standards or codes of practice are
recommended to ensure the highest levels of efficiency, safety and cross-border
compatibility. Some components are already covered by existing standards (e.g. ISO
21007 parts 1 and 2 standards for identification of gas cylinders). Whether a specific
standard is required for overall CNG RFID systems is open to discussion. An
alternative to a full standard could be an ISO International Workshop Agreement
(IWA). An IWA is a set of guidelines that are not as onerous as an ISO standard to put
together.
Page 49 of 66
Database and Encryption Safeguards

If the database were to be operated by private or listed company or a not-for-profit
model, the industry would need some reassurance that database functionality and
continuation will be guaranteed in the event of suppliers of the intellectual property
(database model and encryption protocols) becoming inoperable, for whatever
reason.
A worst case scenario would be a supplier going bankrupt and rendering the
database or encryption system unusable and thus making dispensers incapable of
providing fuel to motorists.
Discussions amongst industry members have suggested that a third party or trust
model may be the best system to own the underlying intellectual property.
Under such a system, the intellectual property behind the database and/or the
encryption protocols could be made available under license to the aforementioned
trust by the original developer or supplier. If the developer or supplier were to be
forced into bankruptcy, the IP would be quarantined from the insolvency (though
ongoing licensing fees may be payable to creditors of the bankrupt body).
Where a regulator owns or operates the database, this may be less of a concern;
however, the regulator may still need to rely on intellectual property provided by a
database or encryption provider. That intellectual property would need to be
quarantined against business failure.
Consideration will also need to be given to liability issues associated with owning
and/or managing the database? Though it would be unlikely, there may be a risk of
error, including out-of-date data, which might prevent the system functioning as
designed.
Data Privacy
Additional safeguards would need to be considered with respect to privacy of data.
As the electronic verification systems rely on the existence of a central database
which tracks certain information, consideration must be given to the privacy of
motorists and who might have access to that data.
It is envisioned that the databases, whether operated by regulators or by industry
bodies, would be subject to standard privacy regulations already operating in most
countries and the use of the data would be in accordance with these requirements.
Page 50 of 66
The data collected would certainly be less intrusive than the data which is stored
and available from existing applications such as mobile telephones and credit cards.
Existing protocols ensure sufficient levels of individual privacy and could be applied
similarly to a CNG vehicle and cylinder database.
Page 51 of 66
Pros and Cons of the Three Verification Systems

VISUAL
CONTACT BUTTON
RFID
Low infrastructure costs
Low infrastructure costs
Low cost of button
Low cost of tags
No infrastructure
required
Easy fitment of button
Easy fitment of tag
Easy fitment of
sticker or decal
Overrides human
judgement (deliberate and
accidental)
Overrides human
judgement (deliberate
and accidental)
Relatively difficult to fuel

another vehicle
Impossible to fuel another

vehicle
High fraud prevention
Maximum fraud
prevention
PROS Low cost of

sticker or decal
Manage loan programs
Accurate tracking of vehicle Manage loan programs

and cylinder population
Difficult (almost
and statistics
impossible) to transfer tag
to other vehicles
Can detect increases in
cylinder volume (though
Can eliminate need to
not in real time)
have attendants at
Can exclude stolen vehicles dispenser
from refuelling network
Can incorporate home
refuellers in the system
(may lead to reduced
compliance)
Can eliminate need to have
attendants at dispenser
(NB: current systems still
use attendants)
Can detect replacement

of cylinders or increase in
cylinder volume in real
time
Accurate tracking of
vehicle and cylinder
population and statistics
Can exclude stolen
vehicles from refuelling
network
Possible to incorporate
home refuellers in the
system
Can incorporate cylinder
and other components
Data on the tag can be
Page 52 of 66
VISUAL
CONTACT BUTTON
RFID
used as a backup if
database isnt accessible
Possible interface with
vehicle OBD systems12
Possible to interface with
vehicle ignition system to
prevent drive-off while
attached to the coupling
CONS Puts onus on

station attendant
to authorise or
reject a fill
Subjects station
attendant to
bullying
Higher labour
costs (station
attendants)
High exposure to
fraud
Sticker/decal
must be replaced
if windscreen
breaks
Can only track
CNG cylinder
variations when
regular inspection
is due (i.e.
cylinders added
or replaced)
Cannot include
home refuellers in
the system
12
Additional infrastructure
requirements
Additional infrastructure
requirements
Relies on single provider of

encryption protocol
Relies on single provider

of encryption protocol
Additional step required

(i.e. validating the tag)
when certifying the vehicle

(i.e. validating the tag)
when certifying the
vehicle

(i.e. attaching contact
button) when refuelling the
vehicle
Button can be transferred
to other vehicles (e.g. if a
vehicle is destroyed)
Does not verify cylinders
Does not detect capacity
fluctuation until after fuel
is dispensed
Cannot detect replacement
cylinders
Possible static discharge
when contact is made
between button and
reader (unlikely though as
nozzle is usually connected
to the vehicle first)
Not discussed in detail in this document.
Page 53 of 66
Fleet Vehicles and Private Refuelling Stations

A common feature of NGVs is that they are often owned by fleets which also
operate a private CNG refuelling station within their depot. Buses and refuse trucks
are the most common examples but other sectors are increasingly taking this
approach.
As commercial and government fleets usually have more structured maintenance
programs in place, a case could be made for the exclusion of private fleets from a
verification system.
Drawbacks of this approach include:
The private fuelling station could become an avenue for refuelling of illegal
or tampered vehicles. Countries with low levels of compliance and high levels
of corruption may be particularly prone.
Even with higher operational standards in place, human error can still occur
within commercial and government fleets. Verification gives an added degree
of confidence and safety at low cost.
Excluding the fleet vehicle from a verification scheme would mean it is

unable to refuel at a public station if the need should arise.
Most fleet vehicles end up in the public marketplace thus would ultimately
need to participate in the verification program anyway.
RFID tags could however be used to prevent private fleet vehicles from being fuelled
at public stations, with a simple coding on the tag data.
Given the low cost of implementing a scheme within a private fleet and the
additional benefits arising, the exclusion of fleet vehicles would thus not be
recommended.
Page 54 of 66
Home Refuelling
Though mass penetration of home CNG refuelling units is likely to be some years
away, consideration needs to be given to how these could be included in a
verification system.
RFID tags could carry sufficient data to activate the dispenser without contacting the
database but full integration would require some sort of communications capability
to be built into the home refuelling unit. With most homes now having internet with
wireless routers, a low cost transceiver could be incorporated to activate the home
refueller as required.
Alternatively a modem could be incorporated within the unit, requiring a dial up to
activate the dispenser.
Another alternative could be to code an RFID unit within the home refueller to only
dispense fuel to vehicles registered at that address. If the vehicles registered go
beyond their inspection dates for the vehicle or cylinder, the RFID unit could
depower the refuelling unit. Alternatively ripple control systems such as those used
for turning on electric hot water systems could be activated by the utility to
depower the unit.
More work needs to be done on this but theoretically, there is no reason to exclude
home refuellers from the system.
Page 55 of 66
Implementation
One of the biggest challenges with electronic verification systems is rolling them out
into existing NGV marketplaces.
For new and emerging markets, the challenges of introducing a program are smaller
because (a) motorists are not being asked to change how they refuel their NGVs, (b)
the costs can be rolled into the program right at the beginning and c) because there
are very few existing vehicles to be incorporated into the program.
Peru for example, introduced electronic verification from the beginning of its NGV
program. The costs of the verification components and systems have been
considered as part of the business from day one so there is wide acceptance
amongst stakeholders and motorists.
The late introduction of verification systems may result in strong opposition from
one or more of the sectors involved (see case study Argentinas History of
Verification), however this should be evaluated against the benefits offered by the
systems.
While there may be logistical concerns, these can be overcome and there are
countless examples within the energy, motor vehicle and other industries where
industry transitions have been implemented and adapted on a much larger scale
than a CNG verification program would require, including
Introduction of unleaded gasoline
Introduction of low sulphur diesel
Transition of mobile phone networks from analogue to digital
Transition from analogue to digital television
Transition from imperial to metric systems
Government introduction of a Goods and Services Tax
Transition planning must factor in logistical considerations, cost of implementation

and operations, and education of industry and consumers on a large scale.
Transition will also require patience, commitment and cooperation and cause
varying levels of inconvenience.
Page 56 of 66
In all cases, the sooner a program is implemented the better, with benefits
becoming immediately obvious when operational. In most economies CNG vehicles
only represent a small part of the vehicle population thus the logistical
considerations are much more manageable than if they were a major proportion.
An overnight rollout period is unrealistic. A phase in program would need to be
considered carefully to ensure all vehicles are included in the program and there is
minimal disruption to refuelling. Where there is no existing database of NGVs or
cylinders, an initial census or inventory of existing vehicles and cylinders in operation
would be a large part of the phase-in program.
As well as educating consumers, industry itself would need to be consulted and
educated during the establishment phase of a program.
Conversion workshops, OEM vehicle manufacturers and inspection/certifying
agencies would need to be involved and processes set up for providing initial data
for the database and procedures established for when a vehicle fails a workshop
inspection or verification at refuelling.
Consideration also needs to be given to which authority will assume responsibility
for verification of vehicles and cylinders. Some markets require a regulator to certify
vehicles prior to use, while others allow conversion workshops to also issue
certifications. Either model could work with appropriate administrative steps and
security precautions in place. Getting the authorisation process right is critical for
the program is to operate effectively.
In established markets, consideration also needs to be given to PR aspects of the
program, including keeping the risk element of CNG vehicles in perspective.
As a precursor to implementation, NGV Global recommends that local and
international steering committees be formed comprising stakeholders from all
sectors of industry. (If required, NGV Global and/or our network of allied and
affiliated associations may assist with facilitating workshops or forums to bring
stakeholders together).
In summary, the success of a verification program depends on the quality of the
initial and subsequent inspections of the vehicles and CNG equipment. Without a
thorough and authoritative inspection regime in place, the balance of the system
becomes less valuable. Regulators and industry should therefore work closely
together to ensure that best practice systems are adopted. Such systems are
beyond the scope of this document but NGV Global can assist with directing readers
to operators of current inspection regimes.
Page 57 of 66
Conclusions
Compressed natural gas vehicles do not increase the overall risk of harm to motorist
or the public. They are arguably safer.
Compressed natural gas vehicles do, however, have additional factors that need to
be taken into consideration for their safe operation.
Existing international and national standards already take these factors into
consideration and have enabled a relatively safe track record for the more than 13
million NGVs currently on the road worldwide.
The single element that produces the greatest safety hazard is human error, either
deliberate or accidental.
The point of refuelling is the point of most control and most risk in the overall
vehicle/fuel chain.
Verification of compressed natural gas vehicles and/or cylinders contributes to safe
operation and produces a range of additional benefits in the process.
Visual verification of CNG vehicles and cylinders is the least effective form of
verification, thus as a minimum, electronic systems should be considered.
RFID systems present the simplest and most secure form of verifying a vehicle while
at the same time providing additional features not easily achieved with contact
button systems. There are fewer means of circumventing the RFID system; it has the
highest likelihood of detecting tampering or foul play of a vehicles natural gas
system while providing the highest degree of verification, ultimately contributing to
reduced incidents and increased safety.
Whether verification is used or not, regular inspection of CNG cylinders and
installations is a must and this requires industry and regulatory oversight to be fully
effective. Although industry standards do require inspections in many countries,
these inspection programs are not always being enforced, thus there are too many
cylinders on the road which have not been subjected to the required inspection. In
the face of growing NGV numbers this problem will only increase if verification
systems are not implemented.
RFID systems can be implemented for a similar cost to contact button systems while
providing additional benefits. The overall initial and operating costs of verification
Page 58 of 66
systems appear to be a viable and justifiable investment relative to the price of not
having them.
The price of not having systems in place has not been evaluated in this paper but
relative to the potential loss of life, major injury and catastrophic damage, the costs
of verification systems appear small and can be measured in fractions of a cent per
kilometre or mile driven.
Resistance to verification systems is likely to emerge in established markets,
primarily due to perceived cost. Education will be required to address this. The
smaller the market, the easier a system is to implement, so a verification program
should be set up as early as possible.
Any new NGV markets that are being developed should be encouraged to introduce
RFID verification systems from start-up.
Ultimately, the costs associated with a verification system are likely to be passed to
the end-user. Though these costs are small, efforts should be made to ease this
burden and amortize the cost into fuel chain where possible.
Some cooperation will be required with gas industry regulators particularly where
price is regulated.
A critical component for the success of RFID systems will be cross-border and
regional compatibility. This will require coordination of databases, encryption
systems and readers and should be considered from the earliest stages of
discussion.
The process of initiating an RFID system will vary from country to country. Whether
it is initiated by regulators or by industry, a high level of consultation will be
required.
NGV Global recommends that local and international steering committees be
formed comprising stakeholders from all sectors of industry. (If required, NGV Global
and/or our network of allied and affiliated associations may assist with facilitating
workshops or forums to bring stakeholders together).
Industry standards may need to be formed or adapted to accommodate widespread
use of RFID systems. NGV Global will monitor feedback on this and initiate such
standards within ISO if required.
Page 59 of 66
Glossary
chip
A silicon microchip.
CNG
compressed natural gas
contact button
A touch-button system, requiring connection to a reader in

order to be supplied with power to send data. Must have
physical contact with a reader to function.
ID
identification
ISO 11439
International Standard. ISO 11439 Gas cylinders -- High pressure

cylinders for the on-board storage of natural gas as a fuel for
automotive vehicles
ISO 21007
International Standard. ISO 21007-1:2005 Gas cylinders -Identification and marking using radio frequency identification
technology
kPa
A unit of pressure: 1000 pascals. Standard atmospheric pressure

is 101,325 Pa = 101.325 kPa. (absolute pressure in kilopascals =
14.696 psia = 101.325 kPa)
Methane
CH4 Primary component of natural gas
NGV
Natural gas vehicle; in this paper, refers to vehicles powered by

compressed natural gas or compressed biomethane (renewable
gas)
NGV ID
Natural gas vehicle identification
OBD
on-board diagnostic (system)
OEM
original equipment manufacturer
Point-ofRefueling
The location at which natural gas fuel is transferred to a

vehicles on-board storage system, i.e. a cylinder. A dispenser
nozzle.
psia
A unit of atmospheric pressure. The weight of air upon the

surface of the earth, measured at approximately 14.7 psia
(pounds per square inch absolute). Also known as one
atmosphere. 1 psia = 1 psi = 6.895 kPa (approx.)
Page 60 of 66
RFID
radio frequency identification
tag
A tiny radio device that is also referred to as a transponder,

smart tag, smart label, or radio barcode. The tag comprises a
simple silicon microchip (typically less than half a millimeter in
size) attached to a small flat aerial and mounted on a substrate.
The whole device can then be encapsulated in different
materials (such as plastic) dependent upon its intended usage.
The finished tag can be attached to an object, typically an item,
box, or pallet, and read remotely to ascertain its identity,
position, or state. Tag is the context of this paper is a passive
tag. For an active tag there will also be a battery.
Type
Cylinder types are 1 (I), 2 (II), 3 (III) and 4 (IV)
Verification
Type 1 - All metal (aluminium or steel)

Type 2 - Metal liner reinforced by composite wrap (glass
or carbon fiber) around the middle (composite hoop
wrapped)
Type 3 - Metal liner reinforced by composite wrap
around entire tank (fully wrapped composite)
Type 4 - Plastic gas-tight liner reinforced by composite
wrap around entire tank (all composite)
Verification is the process of checking that a product, service, or

system meets specifications and that it fulfils its intended
purpose.
Page 61 of 66
Appendix1 - Argentinas History of Verification

One of the oldest and simplest systems of verification was first implemented in
Argentina in 1995.
Vehicles are inspected each year including safety considerations such as leakage
tests and revision of the integrity of components and vehicle structure. The
workshop that performs the inspection submits the results of the inspection to
ENARGAS (the regulatory authority), through an equipment manufacturer with
which the workshop operates.
Once authorised, a new sticker is assigned and sent to the workshop to affix to the
windscreen. Sometimes inconsistencies or errors run undetected, and the sticker is
awarded incorrectly as a result.
Currently the sticker is manufactured with security measures that make it difficult to
forge; it also is destroyed when removed from the windshield, so it is practically
impossible to remove it from one vehicle to stick it to another one (unless the full
windscreen is replaced).
Some early versions of the stickers were easy to remove so were used to legalize
stolen or unauthorized conversion kits and cylinders.
The complete set of documents, shown in the following pictures, is the prenumbered sticker, with expiration date, an NGV image sticker and an NGV
identification card. The documents are printed and sold blank by the ENARGAS to
the registered companies that produce and sell conversion equipment.
These companies assign the number of one sticker to each operation (conversion,
periodic inspection, etc), register the number together with the vehicles and NGV
equipments data, print the ID card and submit the data to the central database
administered by ENARGAS.
This database is consulted before the vehicles are accepted for any operation, and
also by insurance companies, police, etc.
Argentina in 2006 tried to introduce electronic verification. For this purpose
ENARGAS prepared a tender for electronic IDs to be installed together with the
standard stickers and also installed on the on-board cylinders.
The tender practically chose RFID technology but did not specify it as an exclusive
option, as it left a door open for optical reading.
Page 62 of 66
The encrypting algorithm had to be at least 48 bit, with a capacity of storing at least
400 characters for the vehicles data. The standards to be followed were ISO 15693
(Identification cards -- Contactless integrated circuit cards -- Vicinity cards) and
ISO/IEC 14443 (Identification cards -- Contactless integrated circuit cards -- Proximity
cards).
The RFID would have to allow data to be written on the tag and data locked on the
tag. There were no specifications for readers or the way that cylinders would be
checked. The tender was called off before any offer was presented.
Main opposition to the frustrated Argentine attempt came from representatives of
the vehicle owners, who did not want to pay additional costs and were afraid that
malfunctioning of the system would impede them from refuelling. Service station
owners also opposed to the change, as they did not want to bear the cost of buying
new electronic systems and modifying or replacing their dispensers.
Some service station owners objected as they did not want electronic real-time
controls on the volume of gas sold at their stations. Some station owners also
expressed fears that if the system were implemented and uncertified vehicles were
rejected, the station attendants may suffer aggressive behaviour from consumers,
especially in the early stages of implementation when the public may not be
completely aware that this is an automatic operation.
One final consideration that helped prevent the use of digital verification was local
laws against trusts and monopolist practices (i.e. due to the reliance on a single
encryption protocol).
The current systems reliability depends on the visual inspection carried out by the
fuelling station attendant who must check, before connecting the dispenser hose to
the NGV, that the vehicle has the proper and legal identification documents.
These documents are: a) a sticker adhered to the windscreen and b) an NGV ID card
that must be carried by the vehicle driver. The main problem for this type of
verification is that ultimate control rests in the hands of the least specialized
personnel in the whole industry.
Often these clerks are faced with personal violence situations and aggressive
behaviour from drivers of uncertified vehicles who are denied service. There have
been some severe cases that have resulted in injuries requiring hospitalization for
the station personnel.
Page 63 of 66
This kind of system is also susceptible to fraud and falsification of the documents
involved. Over the years stickers have been forged, or have been removed from
legal vehicles and placed on other vehicles, or have been placed in uncertified
vehicles by unscrupulous workshops.
Even though the security measures for the design and printing of the stickers have
grown in complexity, forgery is still a problem. Complicity of station attendants or
owners is also a real problem.
In 2008 in the province of Santiago del Estero the regulatory authorities detected a
widespread violation of the system; more than 30% of the vehicles were refuelling
without verification or with forged or expired documentation.
In 2009 almost 10,000 stickers disappeared from the regulators stock and could not
be detected. It is believed that these were sold in the black market to avoid periodic
cylinder inspection or to avoid full compliance, or other irregularities (including theft
of the NGV equipment).
In June and July 2010 the Argentine Regulator sanctioned several fuelling stations
that had been detected fuelling uncertified vehicles. Sanctions are sometimes
monetary and can also include closure of the station for certain periods that varies
according to the stations history of violations.
The first closure lasts 24 hours; subsequent closures may eventually lead to
complete disqualification of the filling station if there are repeat irregularities.
The procedure of visual identification of NGVs suffered some difficulties during the
Argentine crisis period between 2002 and 2004. The demand for conversion
equipment was so high (30,000 conversions per month) that converted vehicles
began to be stolen at a much higher rate than liquid fueled vehicles both for using
the components in legal conversions (conversions by workshops who sold them to
buyers in good faith who did not know that they were buying stolen elements) and
also for low cost conversions for people that could not afford to pay for a full price
operation and either thought they were buying used equipment or did not ask many
questions about the low price.
NGV owners began to hide the verification sticker, causing problems with the
workshops that tried to comply with the regulations (it is mandatory that stickers
are not to be handed to the owners, and that they should be stuck on the
windscreens).
Page 64 of 66
Eventually ENARGAS decided to supply stickers that were to be installed either

under the bonnet or on the drivers door. This disguised sticker lasted for a couple of
years, but firemen and safety personnel complained that if a vehicle was involved in
a fire they did not know if it was an NGV or a liquid fuelled vehicle. Argentina has
since reverted to the windscreen sticker system
CIAS DE SEG.
Page 65 of 66
Appendix 2 Comparison of On-site vs. Off-site

Database Functionality
Source Viridis Technologies Inc.
Option
Functionality
Advantage
Disadvantage
Data base located

on site
Tag validity lookup on local

data base
Capacity to verify unlimited

number of vehicles
a) Data base is not

current, requires
frequent updating
b) PC required at each
station
c) Costly to maintain
database
Data base located

off site
Tag validity lookup on

remote data base
Data base is up to date
a) Costly communication
interface between
station & host system.
b) PC required at each
station
c) Costly to maintain
database
Tag data
encrypted,
dispenser
controller
decryption
validates tags
Only properly encrypted

tags can be accepted.
a) Fast authorization, no
need to verify tag ID
with external data base
b) Dispenser can
communicate with host
via Internet, GSM, etc.
c) PC not required at
station
d) Tag/antenna
communication security
ensures encrypted data
cannot be intercepted
Only one encryption

protocol & tag technology
can be used in any market
Dispenser data base

includes black listed tags
and has the ability to lock
out particular vehicles, such
as those with faulty
components
Page 66 of 66

GNC Rfid PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

GNC Rfid PDF

Uploaded by

Copyright:

Available Formats

CNG Cylinder and Vehicle

Verification at the Point of

NGV Global Position Paper

About NGV Global

The subject matter concerns itself exclusively with verification of

Any recommendations made in this report relate only to the system

later section investigates whether such schemes should be regulator or industry

Reduced risk and cost of fuelling station incidents

Possible reduced insurance premiums for fuelling station operators 1

Enhanced fleet management data

Reduced theft of NGVs (and increased recovery of stolen NGVs)

Reduced staffing requirements on station forecourts and costs related to

Improved efficiency and reduced default rates of conversion loan schemes as

This has not been tested in this review

calculate fuel savings compared to liquid fuels and determine repayment of

NGV Global recommends that local and international steering committees be

a conversion to CNG has not been done to a recognised international or local

Nontoxic. We can breathe methane with no toxic response (sufficient

Lighter than air. In the event of an incident, methane tends to rise

Has a narrow flammability range. It requires a specific temperature

Why is Verification Needed?

Italy has a unique cylinder inspection program operated by Gestione Fondo

How Can These Problems Be Avoided?

Options for Verification

Some industry insiders suggest that non-compliant or fraudulent vehicles account

Stickers for Visual ID Peru

The Electronic Verification Process

Contact Button Systems

Can be read in less than 5ms

Operating range: 2.8V to 6.0V, -40C to +85C

Unique factory-lasered 64-bit registration number assures error-free device

Selection and absolute traceability because no two parts are alike

Built-in multidrop controller for 1-wire net

Digital identification by momentary contact

Data can be accessed while affixed to object

Economically communicates to bus master with a single digital signal at

Button shape is self-aligning with cup-shaped probes

Durable stainless-steel case engraved with registration number withstands

The chip is enabled by a certification agency that receives the converted/inspected

Verification of CNG Cylinders

Electronic validation of CNG cylinders is therefore presented as the only viable

CNG cylinders may be located in a range of on-board locations the trunk of a

Features of Electronic Verification

Vehicle and Tag

CONTACT BUTTON SYSTEM

Chip embedded in small

Chip embedded in resin

None (power sourced via

None (power sourced via

Possible without correct

Not possible, no contact

Physical contact with reader

Radio contact with reader

Optional (hard wired to RFID

CNG Cylinder Tags

Continuous read signal

On initial contact only

Can fuel another vehicle

Possible but difficult

Any digital dispenser

Any digital dispenser

Data transfer from

Dynamic and continuous.