Measurement Provenance and Loss Attribution in Refined-Petroleum Distribution Systems

About: refined product moving from depot to retail station is measured by different instruments,recorded by different parties and copied through several documents before any shortfall isexamined. This paper studies what such records allow one to infer about where product waslost. A figure may be an acquired measurement, an administrative derivation or a preservedcopy, and these roles produce different constraints. The analysis constructs the set of operational histories consistent with the records, the physical balances and stated measurementassumptions, and derives loss bounds from that set.For instruments with additive offsets, a reading-level evidence graph represents these historiesexactly. The sharp bound on a single segment’s loss is a shortest-path distance; the bound ona linear aggregate, such as a tanker’s losses over a month, is a minimum-cost flow. The pathor flow certifies that the bound follows from the encoded constraints, and a feasible historyattaining it shows that the bound is sharp. An unknown positive gain, and an unknown zeroand gain on the same instrument, both with interval bounds, remain exact linear programmes;a single offset shared across independently varying gains introduces a nonlinear coupling.With fixed half-widths of 35 L at two otherwise unconstrained endpoints, a loss must exceed70 L to be bounded away from zero at zero realised error, and 140 L to be bounded away fromzero under every admissible error. Shared internal inventory readings cancel from totals, whileboundary inventory and flow errors remain; in cumulative counters, readout errors telescopewhile metering errors accumulate. In a synthetic study of disjoint transfer pairs, pooling withmeter and station calibrations gave positive lower bounds for 51, 19 and 0 of 98 positive lossesat residual half-widths of 2, 10 and 35 L, against 98, 69 and 11 when all offsets are known.The paper then asks which conclusions survive specified interventions on evidence: rewriting records, shifting an instrument’s zero within a calibration epoch, and falsification beforecapture. These classes admit different histories. An independently held copy adds no measurement but can preserve a conclusion against later alteration. Interventions on the physicalprocess itself, such as diversion or adulteration, are not evidence interventions: diversion isthe loss being bounded, and adulteration must be registered or excluded. All results holdunder their stated physical, measurement and intervention assumptions; a mathematicallyvalid bound does not certify the measurements on which it rests.Keywords: custody transfer; refined petroleum; data reconciliation; set-membership estimation; difference constraints; network flow duality; measurement provenance; loss attribution.Reproducibility: The accompanying archive contains the computational verification scripts, synthetic-study protocol, and supporting results. Python source code is licensed under GNU AGPLv3-only; research data and documentation are licensed under CC BY 4.0.