Short answer
Use cumulative reconciliation, not per-event drop thresholds. The US EPA sets its inventory-control threshold at 1.0 per cent of flow-through volume plus 130 gallons, and expects statistical reconciliation to detect a leak as small as 0.2 gallons per hour, a slow loss no single-event rule will ever see.
Key takeaways
- The US EPA inventory-control threshold is an overage or shortage of 1.0% of flow-through volume plus 130 gallons, a cumulative test, not a single-event one.
- EPA expects statistical inventory reconciliation to detect a leak at least as small as 0.2 gallons per hour, or a 150-gallon release within a month.
- On a small tank, sensor uncertainty is a large share of the loss being hunted: ±0.5% of a 1,000-litre tank is 5 litres before anything else is considered.
- A distributed estate has the opposite economics of a depot, no single tank justifies a visit, so the reading must arrive by itself.
- Run per-event thresholds and cumulative reconciliation together; they fail in different directions and each covers the other.
01The distributed estate is a different problem
A depot with one large tank and a gate is a solved problem: a person is present, a meter is read, and a discrepancy is somebody's job that shift. A distributed estate inverts every one of those conditions. Thirty or three hundred small tanks sit at telecom towers, pump stations, remote yards and construction compounds, each holding a quantity whose value would not cover the fuel burned by the pickup sent to inspect it. Nobody is present. No meter is read. A discrepancy is nobody's job because nobody knows there is one. The consequence is not that theft is larger at these sites, often it is smaller per event, but that it is invisible for far longer, and cumulative loss over a year at thirty sites is a serious number assembled from individually unremarkable ones.
02Why the per-event threshold breaks on a small tank
A per-event rule says: alert when the level drops by more than X in less than Y minutes. On a large tank X can be set well clear of the noise. On a small tank it cannot, because the noise is proportionally much larger. The OMNICOMM listing reads to ±0.5 per cent, which is excellent, and on a 1,000-litre tank that is still five litres of legitimate measurement uncertainty before temperature, tilt or geometry enter the calculation. Add the thermal band and the honest floor for a defensible single-event threshold climbs to a substantial fraction of what a thief would take in one visit. Set the threshold below that floor and it fires on nothing; set it above and the actual theft passes underneath. Neither setting is a tuning failure. The instrument is simply the wrong one for the question.
03What regulators do instead
The regulators who have had to find small losses in stored fuel for decades do not use per-event thresholds. The US EPA describes inventory control as a cumulative test: a discrepancy counts when the overage or shortage reaches 1.0 per cent of flow-through volume plus 130 gallons. Read the shape of that rule carefully, because it is instructive. It scales with throughput rather than with tank size, it carries a fixed allowance for measurement error, and it accumulates over a reconciliation period instead of judging any single reading. The EPA goes further with statistical inventory reconciliation, which it expects to detect a leak at least as small as 0.2 gallons per hour, or a 150-gallon release within a month. Nothing in that specification could be delivered by watching for sudden drops.
04What reconciliation needs in order to close
Reconciliation is arithmetic on four quantities, and it fails whenever one of them is missing. Opening level, deliveries received, dispensed or consumed volume, and closing level should agree to within an explicit allowance. Most distributed estates can produce the two levels once a sensor is fitted, and struggle with the middle two. Deliveries are recorded on paper at the tanker, or not at all. Consumption is inferred from generator run hours that nobody logs. So the first engineering task on a distributed site is rarely the sensor, it is capturing the delivery and the run hours as data with timestamps, so the reconciliation has all four terms. A reconciliation with a guessed term is not a weaker reconciliation; it is a calculation whose residual is dominated by the guess.
05The sensor still has to survive being ignored
A distributed tank is defined by the absence of attention, so the probe must be specified for years of it. The OMNICOMM listing reads across 0 to 4,000 millimetres at ±0.5 per cent, is rated IP68 and −40 °C to +85 °C, responds in under a second, and draws under 30 milliamps from a 9 to 40 V DC supply over RS-485 Modbus RTU. The Eurosens Dominator RS, listed in the Wialon sensor catalogue, is the comparable alternative at ±1 per cent maximum measurement error, IP67, −40 to +85 °C, a 10 to 60 volt supply and protection to 170 volts with reverse polarity protection. Under IEC 60529 that IP67 second digit means immersion to one metre for thirty minutes, and the first digit means dust-tight, which is the relevant pair for a tank top nobody will inspect.
06Ranking sites instead of alerting on each
Once reconciliation runs across a whole estate, the useful output is not an alert per tank. It is a ranking. Compute each site's residual as a percentage of its own throughput over the same period, sort descending, and the top of that list is where a visit is worth making. This reframes the economics that made the distributed estate hard in the first place: you are no longer paying for a visit to a low-value tank, you are paying for a visit to the one site in thirty whose numbers do not close. The ranking also degrades gracefully. A site with a missing delivery record simply cannot be ranked and is flagged as such, which is honest, rather than being silently scored as compliant because its residual happened to be small.
07Run both rules, because they fail differently
None of this argues for abandoning per-event alerts. It argues for demoting them. A sudden large drop at three in the morning with the generator off is worth waking somebody for, and a per-event rule is the only thing that can catch it inside the hour. What a per-event rule cannot do is find twenty litres a week for a year. Reconciliation catches exactly that and cannot catch anything inside the hour, because it needs a period to accumulate over. Running both gives an estate two independent detectors with complementary blind spots, the fast rule tuned deliberately loose so it only fires on the unmistakable, and the cumulative rule tuned tight because it has an averaging period on its side.
| Property | Per-event threshold | Cumulative reconciliation |
|---|---|---|
| Time to detect | Minutes | One reconciliation period |
| Catches a large single siphon | Yes | Only as part of the total |
| Catches slow repeated loss | No | Yes, the EPA target is 0.2 gal/hour |
| Sensitive to sensor noise | Very, noise is per reading | Less, noise averages down |
| Needs delivery records | No | Yes, with timestamps |
| Needs consumption or run hours | No | Yes |
| Useful output | An alert | A ranking of sites by residual |
Figures and sources
- US EPA inventory-control threshold for a book-versus-measured fuel discrepancy: overage or shortage ≥ 1.0% of flow-through volume plus 130 gallons (Source: US EPA, Release Detection for Underground Storage Tanks, Internal Methods, as of 2026-08-31)
- US EPA statistical inventory reconciliation sensitivity for slow repeated losses: detect a leak at least as small as 0.2 gal/hour, or a 150-gallon release within a month (Source: US EPA, Release Detection for Underground Storage Tanks, Internal Methods, as of 2026-08-31)
- OMNICOMM fuel level sensor accuracy and measuring range: ±0.5%; 0–4,000 mm; response < 1 second (Source: ENTEK.AI product catalogue, as of 2026-08-31)
- OMNICOMM fuel level sensor sealing, temperature band and electrical requirements: IP68; −40 °C to +85 °C; 9–40 V DC; < 30 mA; RS-485 Modbus RTU (Source: ENTEK.AI product catalogue, as of 2026-08-31)
- Eurosens Dominator RS published maximum measurement error: ±1% (Source: Wialon sensor catalogue, Eurosens Dominator RS, as of 2026-08-31)
- Eurosens Dominator RS operating envelope for an unattended outdoor tank: −40 to +85 °C; IP67; 10–60 V supply; protected to 170 V with reverse polarity protection (Source: Wialon sensor catalogue, Eurosens Dominator RS, as of 2026-08-31)
- IP67, both digits, per the standard that defines the code: dust-tight (no ingress of dust); immersion up to 1 m for 30 minutes (Source: IEC 60529, Degrees of protection provided by enclosures (IP Code), as of 2026-08-31)
- RS-485 signalling type, which is what allows several tanks to share one wiring run: differential, multi-drop balanced bus (TIA/EIA-485) (Source: TIA-485-A, Electrical Characteristics of Generators and Receivers for Balanced Digital Multipoint Systems, as of 2026-08-31)
Questions
Diesel keeps going missing from small tanks. How small a loss can reconciliation find?
The US EPA sets the expectation for statistical inventory reconciliation at a leak at least as small as 0.2 gallons per hour, or a 150-gallon release within a month. That sensitivity comes from accumulating over a period, which is precisely what a single-event threshold cannot do.
No alert fires on our small tanks. Why not just set a tighter threshold?
Because the sensor's own uncertainty scales with the tank. Even at ±0.5 per cent, a 1,000-litre tank carries five litres of legitimate uncertainty before temperature or tilt are considered, so a tighter threshold produces false alerts rather than earlier detection.
What do I need before reconciliation will work at all?
Four terms with timestamps: opening level, deliveries received, volume consumed or dispensed, and closing level. Most sites can supply the levels once a probe is fitted; the usual gap is delivery records and generator run hours, and a guessed term dominates the residual.
Should I drop per-event alerts entirely?
No, demote them. Keep a deliberately loose per-event rule for the unmistakable case, such as a large drop at night with the generator off, because nothing else detects that inside the hour. Reconciliation then covers the slow loss the loose rule ignores.