High and high-high tank level alarms: overfill protection under API 2350

A high alarm tells the operator that a tank is approaching its normal fill limit, while the high-high alarm is the final layer before the critical level and should come from a sensor separate from the ATG, as API 2350 recommends.

The automatic tank gauge (ATG) already raises level alarms, but the gauge can fail silently, and its alarms fail with it. API Standard 2350, Overfill Prevention for Storage Tanks in Petroleum Facilities, now in its 5th edition (2020), treats overfill prevention as a system of levels, people, procedures and independent equipment. This guide explains the alarm levels, the tank categories, how to set the high-high point and how to test it.

If the same instrument both measures the level and raises the last alarm, a single fault can blind the operator at the worst moment.

Servo gauges can stick when a displacer catches on a still pipe. Radar gauges can lock onto a false echo from a nozzle or a heating coil. A gateway or power fault can freeze every value in the control room. In each case the ATG level stops rising on screen while the real level keeps rising, and an ATG-based high-high alarm never sounds.

Independence therefore means a separate sensor, and ideally separate wiring, power and alarm logic, so that one failure cannot take out both the measurement and the protection. Some radar gauges offer an independent second channel in one housing; Emerson describes this 2-in-1 function for the Rosemount 5900S as a back-up level and overfill prevention measurement. Whether it is independent enough for a given tank is a decision for the site's risk assessment.

API 2350 does not ask every tank for the same equipment. It sorts tanks into categories according to how the facility is attended, whether level is watched locally or remotely, and how alarms are handled.

The 5th edition added Category 0 for tanks gauged by hand only, and treats an automated overfill prevention system (AOPS) as an addition that can sit on top of the other categories. The table below gives the logic of each category in plain words.

One terminal can hold tanks of different categories, for example a tank that receives from ships at night and a tank filled only in daytime with staff on site. Use the standard itself for the exact criteria; API sells it through its webstore and the text should not be copied from unofficial sources.

A high-high alarm is only useful if, after it sounds, there is still enough room in the tank for people to react. The setpoint is therefore calculated, not guessed, and the calculation is kept as an engineering document.

The calculation starts at critical high and works down. Take the maximum flow rate the tank can receive. Estimate the response time: how long it takes to detect the alarm, confirm it, and stop the pump or close the valve, including valve travel. Multiply rate by time to get a volume, and convert that volume to a height with the tank calibration table. The 5th edition of API 2350 puts more weight on these reaction times, and its annexes guide the calculation.

Write every setpoint, its basis and its date into a register. When a pump is upgraded and the fill rate goes up, the high-high point must move down. That link is easy to forget during a project that only touches the pumps, because the pump team rarely opens the tank alarm register.

Overfill gets the attention, but a tank pumped too low causes its own damage. Low and low-low alarms protect the equipment downstream of the tank.

When the level falls toward the suction nozzle, a pump starts drawing vapour and runs dry, which damages seals and bearings. On floating-roof tanks, pumping below the roof landing level puts the roof on its legs and creates a vapour space under it. A low alarm warns the operator to stop the transfer or switch tanks; a low-low alarm can trip the pump through an interlock, as the operating philosophy defines.

The low-low setpoint is set the same way as high-high, from the bottom up: the level at which damage begins, the outflow rate and the time needed to stop. Record it in the same setpoint register, and test it with the same discipline. In practice, low-low alarms are often skipped in periodic tests because they seem less dangerous than high-high.

On real sites, overfill protection succeeds or fails on details: sensor choice, documentation and testing during live operations.

In the high-low alarm project at Pertamina Lubuk Linggau (Aroja) in 2024, Citia installed a high-low alarm system on storage tanks using VEGAPULS 6X non-contact radar sensors. The control system warns at the high and low alarm limits; at high-high or low-low it can trigger an alarm or an interlock signal according to the operating philosophy. The aim was to prevent overfill, dry running of pumps and product loss.

Citia INTEGRA HLA follows the same structure: an ATG or independent level sensor, PLC or SCADA, and a local annunciator, with setpoints and alarm responses set in an engineering review.

Two other projects show the testing side. In the pump emergency shutdown project at Pulau Baai in 2025, wiring diagrams and cause and effect charts did not match the field. The team verified point to point, simulated the logic offline and cut over during a scheduled shutdown. The Cikampek tank-monitoring upgrade in 2025 ran loop checks and functional tests of alarms and interlocks before handover. Citia's notes on level alarm reliability add the maintenance point: sensors drift without regular calibration.