Siphoning vs. a Legitimate Fuel Drop: How Octane Tells the Difference
Not every unexplained fuel drop is theft. Engine load spikes, gradient driving, and sensor noise all cause readings that look like siphoning but are not. Here is how the detection model handles each.
The naive version of fuel theft detection is simple: if the tank level drops faster than expected, raise an alert. This approach works as a proof of concept and falls apart in production. Every fleet has vehicles where sensor noise, load variation, temperature effects on the sensor, or driving conditions produce fast level drops that have nothing to do with extraction. A system that raises an alert for every fast drop becomes useless within a week because fleet managers stop trusting it.
The detection problem is actually a classification problem. The question is not whether the fuel level dropped. It dropped; the sensor data shows it. The question is which of several competing explanations best fits the specific pattern of that drop given everything else we know about the vehicle, its current state, and its operating history. Siphoning is one explanation. There are several others, and getting the classification right is the core engineering challenge in fuel intelligence.
What a siphoning event looks like in the data
A genuine siphoning event has a distinctive signature across multiple data channels, not just the fuel level sensor. The level drops rapidly, typically 10 to 30 liters over a 5 to 20 minute window, which corresponds to a drop rate substantially faster than normal consumption. The vehicle is stationary during the event: GPS shows no movement, engine RPM is at idle or off, and the ignition state may show engine-off. The consumption correlation between engine load and fuel level breaks down: engine load is low or zero while the fuel level is falling at a rate inconsistent with idle consumption.
After the event, the consumption pattern typically resumes normally. The curve shows a step-down in level at the time of the event, then continues its normal consumption slope afterward. There is no compensating refuel event in the data around the same time window that would explain the sudden level reduction as a misregistered top-up.
The stationary requirement is important. Mobile siphoning (from a moving vehicle) is rare in commercial fleet context because it requires physical access to the tank. The vast majority of fleet siphoning events occur at parked vehicles: overnight at a depot, during an extended rest stop on a long-haul route, or during a prolonged loading or unloading stop. The detection model weights stationary periods differently from moving periods when evaluating anomalous level drops.
What gradient driving looks like, and why it matters
Egypt's road network includes several corridor routes with significant gradient sections, particularly on routes through the Sinai, the Red Sea coast road, and the routes into Upper Egypt. A fully loaded truck climbing a sustained gradient section can consume fuel at a rate two to three times its flat-road average. The level sensor shows a fuel drop that, if you evaluate it against the vehicle's flat-road baseline, looks anomalous.
Without GPS-derived grade estimation, a detection model that uses flat-road consumption parameters as its baseline will generate false positives on every gradient route during loaded uphill segments. The rate of drop during a heavy loaded climb at 8 percent grade can approach the lower end of siphoning-rate thresholds, particularly on older vehicles with less efficient fuel systems.
Octane uses GPS elevation change data to estimate grade for each vehicle segment. When a vehicle is moving on a positive grade, the expected consumption rate is adjusted upward from the flat-road baseline. A level drop that is consistent with the adjusted consumption estimate for that grade and load condition is classified as normal gradient consumption, not anomalous. Only drops that exceed the grade-adjusted expectation by a meaningful margin qualify for further anomaly evaluation.
We want to be precise about what "meaningful margin" means here: it is not a fixed percentage but a model output that varies based on the vehicle's historical variance at similar conditions. A vehicle with stable, predictable consumption at known grade conditions has tighter expected bands than a vehicle with high variance in its history. The threshold is per-vehicle and per-condition, not global.
Engine load spikes and their signatures
Heavy equipment and utility vehicles in commercial fleets sometimes carry power take-off systems, hydraulic lifts, refrigeration units, or other auxiliary power consumers that draw from the engine. When these systems are active, fuel consumption per unit time increases significantly even when the vehicle is not moving.
An articulated refrigerated truck parked at a delivery point with its reefer unit running at full compressor load will show meaningful fuel consumption while stationary. The consumption rate is lower than siphoning in most cases, but the overlap range is real: a struggling compressor on a hot day can produce consumption rates that approach the low end of the siphoning signature range.
The distinguishing feature is typically the OBD engine load PID. A high-consumption stationary event driven by an auxiliary system shows elevated engine load concurrent with the fuel consumption. A siphoning event does not drive engine load because the engine is not consuming the fuel. When the consumption and engine load readings are correlated, the event is classified as high-auxiliary-load consumption rather than anomalous removal. When they are uncorrelated, specifically when fuel is leaving the tank but engine load does not explain the rate, the event scores higher on the siphoning classification.
Sensor noise and the classification problem
Fuel level sensors in commercial vehicles are resistive float sensors that measure the float position against a resistance strip in the fuel tank. They are accurate enough for operational use but have characteristics that create noise in high-precision telemetry applications. At low fill levels, most float sensors become less linear. Fuel slosh during vehicle motion causes momentary level readings that are lower or higher than the true level. Temperature affects the fuel density slightly, which affects the volumetric measurement for the same mass of fuel.
These characteristics produce readings that look like small, fast level changes when the vehicle is in motion. A sloshing event during a tight cornering maneuver might show a 3 to 5 percent level drop over 30 seconds, then recovery. A temperature-induced density shift might show a slow 2 to 3 percent change over several hours. Neither of these is theft, but both deviate from a simple "expected level based on consumption" baseline.
The detection model uses a combination of rate-of-change thresholds, duration requirements, and motion correlation to filter sensor noise from genuine events. A drop that recovers within a few seconds or minutes is noise, not siphoning. A drop that is concurrent with high lateral acceleration (cornering) is slosh, not siphoning. A drop that is slow, directional, and temperature-correlated is a density effect, not siphoning. Only drops that are fast, sustained, direction-consistent, and not correlated with motion, load, temperature, or other known noise sources qualify for siphoning classification.
The cost of false positives and why precision matters
Every false positive in a theft detection system has a real operational cost. A fleet manager who receives an alert investigates it. Investigation takes time, involves conversations with drivers, may involve reviewing GPS records, and sometimes involves confrontation or disciplinary action. If the alert was wrong, the time was wasted and the confrontation was unjust. If this happens repeatedly, the fleet manager stops trusting the system and stops responding to alerts. At that point, the system is worse than useless: it is generating organizational friction without providing protection.
The precision requirements for a useful commercial fleet theft detection system are substantially higher than what a simple threshold-based approach can achieve. Getting precision to a level where each alert has a meaningful probability of being genuine requires modeling the full signal space, not just the fuel level channel. That modeling requires telemetry data beyond the fuel sensor: GPS, engine load, RPM, ignition state, auxiliary load indicators, and environmental temperature.
This is why we treat signal quality and multi-channel correlation as core infrastructure rather than optional features. The detection model is only as good as the data it receives, and the data quality layer is what ensures the model is seeing signal rather than noise. When an alert fires in Octane, it has passed through a classification pipeline that evaluated multiple data channels against a per-vehicle baseline. That does not make every alert correct. But it makes each alert worth investigating.