A Level Reading Is Not an Overfill Protection System

The hazard develops while the transfer looks routine

At a bulk-liquid terminal, incoming flow continues until the tank is deliberately stopped or diverted. If the indicated level is wrong, a transfer may be allowed to continue with no visible warning in the control room. Once liquid escapes, the hazard can extend beyond the tank: a volatile flammable product may form a vapour cloud that travels to an ignition source.

On 23 October 2009, gasoline overflowed from an aboveground storage tank at Caribbean Petroleum Corporation (CAPECO) in Puerto Rico. The U.S. Chemical Safety Board (CSB) found failures in the tank level control and monitoring system and an absence of additional safeguards such as an independent high-level alarm and automatic overfill prevention. The released gasoline formed a large vapour cloud that ignited. This is a documented investigation, not a hypothetical scenario.

One display is a measurement, not a complete barrier

A level transmitter can fail, be miscalibrated, be unavailable, or give an apparently reasonable but incorrect value. The person monitoring it may also be handling several transfers and alarms at once. Overfill prevention therefore needs layers selected from the facility’s hazard assessment: a defined maximum fill level, a credible estimate of available ullage and transfer time, a primary level system, an independent high-level warning, and an effective means to stop or divert flow before loss of containment.

Independence matters. An alarm that relies on the same faulty measurement, power source, logic or valve as the normal control may fail for the same reason. An independent protection function needs a clear trip or alarm set point, sufficient response time, an assigned response and periodic proof that the whole path works. The appropriate design depends on the product, tank, transfer rate and site risk assessment.

Make every receipt a controlled operation

Before transfer, confirm the intended tank, product, route, starting level, usable capacity, flow rate and the authorised stop point. Verify the status of the independent alarm and shutdown or diversion arrangement required for that service. Set an expected level trend and a latest safe stop time. If the trend, field indication or transferred volume does not agree, pause the receipt and investigate rather than assuming the display is right.

During the receipt, keep ownership and communication clear between the sending point, terminal control room and field. Manage tank or line-up changes as explicit transitions. At handover, transfer the actual tank state and remaining capacity, not just the planned final level. Testing should cover sensors, logic, alarms, final elements and the operator response; a record that one component was checked does not prove the entire safeguard will act in time.

A question for today’s team

If our primary tank-level indication failed during the next receipt, what independent signal would detect the rising level, who would act on it, and what verified device would stop or divert the flow in time?