--- title: "High-High Tank Level Alarm and API 2350 Overfill | Citia" description: "Overfill protection under API 2350: how high and high-high tank level alarms differ, why high-high must be independent of the ATG, and how to set and test it." url: https://citia-engineering.com/en/knowledge/tank-overfill-protection language: en updated: 2026-11-13 type: article site: Citia Engineering Indonesia --- # High and high-high tank level alarms: overfill protection under API 2350 A high alarm warns that a tank is nearing its normal fill limit; the high-high alarm is the last layer before the critical level and should come from a sensor independent of the ATG. | Field | Value | | --- | --- | | Topic | Tank Farm & Inventory | | Author | Tim Engineering Citia | | Updated | 2026-11-13 | Key takeaways A high alarm tells the operator that a tank is approaching its normal fill limit, while the high-high alarm is the final layer before the critical level and should come from a sensor separate from the ATG, as API 2350 recommends. The automatic tank gauge (ATG) already raises level alarms, but the gauge can fail silently, and its alarms fail with it. API Standard 2350, Overfill Prevention for Storage Tanks in Petroleum Facilities, now in its 5th edition (2020), treats overfill prevention as a system of levels, people, procedures and independent equipment. This guide explains the alarm levels, the tank categories, how to set the high-high point and how to test it. - A high alarm tells the operator the tank is nearing its normal fill limit; the high-high alarm is the last warning before the critical high level. - API 2350 recommends that the high-high alarm come from a sensor independent of the automatic tank gauge, so one failure cannot disable both. - The gap between high-high and critical high is set by response time: enough volume to detect, confirm and stop the receipt at the maximum fill rate. - An alarm that has not been tested end to end, from sensor to horn and control room, cannot be assumed to work. ## High, high-high and critical high: the levels Every tank has a height above which something bad happens: product spills over or the roof and shell are damaged. Everything else is set downward from that point. API 2350 calls these heights levels of concern. Critical high is the highest level the product can reach without overflow or damage. High-high is the emergency alarm set far enough below critical high that the transfer can be stopped in time. The maximum working level is the highest level to which the tank is routinely filled. An optional AOPS level sits below critical high where an automated overfill prevention system is installed. The ordinary high alarm, usually from the ATG, is an operational warning set by the site between the maximum working level and high-high. It tells the operator to prepare to stop, not that an emergency has begun. - Critical high (CH): Overflow or damage above this level - AOPS level (optional): Automatic termination, below CH - High-high (HH): Emergency alarm with time left to stop - High (H): Operational warning, usually from the ATG - Maximum working (MW): Normal upper fill limit ## Why high-high must be independent of the ATG If the same instrument both measures the level and raises the last alarm, a single fault can blind the operator at the worst moment. Servo gauges can stick when a displacer catches on a still pipe. Radar gauges can lock onto a false echo from a nozzle or a heating coil. A gateway or power fault can freeze every value in the control room. In each case the ATG level stops rising on screen while the real level keeps rising, and an ATG-based high-high alarm never sounds. Independence therefore means a separate sensor, and ideally separate wiring, power and alarm logic, so that one failure cannot take out both the measurement and the protection. Some radar gauges offer an independent second channel in one housing; Emerson describes this 2-in-1 function for the Rosemount 5900S as a back-up level and overfill prevention measurement. Whether it is independent enough for a given tank is a decision for the site's risk assessment. - ATG: Measures level for inventory and raises the operational high alarm. - Independent HH sensor: Separate level switch or radar with its own wiring. - TMS / SCADA: Shows level and the high alarm to the operator. - Alarm logic and annunciator: Horn and light at the tank farm, alarm in the control room. - Stop the receipt: Operator stops pumps or closes valves; an AOPS does it automatically. ## API 2350 tank categories API 2350 does not ask every tank for the same equipment. It sorts tanks into categories according to how the facility is attended, whether level is watched locally or remotely, and how alarms are handled. The 5th edition added Category 0 for tanks gauged by hand only, and treats an automated overfill prevention system (AOPS) as an addition that can sit on top of the other categories. The table below gives the logic of each category in plain words. One terminal can hold tanks of different categories, for example a tank that receives from ships at night and a tank filled only in daytime with staff on site. Use the standard itself for the exact criteria; API sells it through its webstore and the text should not be copied from unofficial sources. - Category 0: Manual hand gauging only | People and procedures carry all the protection - Category 1: Personnel attend and watch level locally | Local gauging and alarms during the whole receipt - Category 2: Level sent to a control room by the ATG | Alarms reach the operator remotely - Category 3: Remote monitoring with less local attendance | Independent high-high alarm in addition to the ATG - AOPS (additional): Automatic action without the operator | Engineered sensors, logic and valves ## Setting the high-high point: response time decides A high-high alarm is only useful if, after it sounds, there is still enough room in the tank for people to react. The setpoint is therefore calculated, not guessed, and the calculation is kept as an engineering document. The calculation starts at critical high and works down. Take the maximum flow rate the tank can receive. Estimate the response time: how long it takes to detect the alarm, confirm it, and stop the pump or close the valve, including valve travel. Multiply rate by time to get a volume, and convert that volume to a height with the tank calibration table . The 5th edition of API 2350 puts more weight on these reaction times, and its annexes guide the calculation. Write every setpoint, its basis and its date into a register. When a pump is upgraded and the fill rate goes up, the high-high point must move down. That link is easy to forget during a project that only touches the pumps, because the pump team rarely opens the tank alarm register. - Fix critical high: From tank construction: shell height, roof type, overflow points. - Take the maximum fill rate: From ship, pipeline or pump capacity, whichever is highest. - Estimate response time: Detect, confirm, stop pumps, close valves. - Convert to height: Rate times time gives volume; the tank table gives height. - Place HH and MW: HH below CH by that height; MW below HH with an operating margin. - Record and review: Keep a setpoint register and review it after any change in rate or tank. ## Low and low-low alarms protect the pumps Overfill gets the attention, but a tank pumped too low causes its own damage. Low and low-low alarms protect the equipment downstream of the tank. When the level falls toward the suction nozzle, a pump starts drawing vapour and runs dry, which damages seals and bearings. On floating-roof tanks, pumping below the roof landing level puts the roof on its legs and creates a vapour space under it. A low alarm warns the operator to stop the transfer or switch tanks; a low-low alarm can trip the pump through an interlock, as the operating philosophy defines. The low-low setpoint is set the same way as high-high, from the bottom up: the level at which damage begins, the outflow rate and the time needed to stop. Record it in the same setpoint register, and test it with the same discipline. In practice, low-low alarms are often skipped in periodic tests because they seem less dangerous than high-high. ## Testing level alarms end to end An overfill alarm spends years doing nothing, which is exactly why it must be tested: a fault in a silent system stays hidden until the day it is needed. A proper function test moves the real sensor, or simulates the process at the sensor, and checks every link: the signal, the logic, the horn and light at the tank farm, the alarm in the control room and the operator acknowledgement. Testing only the SCADA display proves nothing about the sensor on the roof. The test interval comes from API 2350, the manufacturer and, where the function is a safety instrumented function, the IEC 61511 calculation; it should be written in the maintenance plan, not left to memory. Record each result on a test sheet, so auditors and the next crew can see the last known state of the alarm. Alarm management matters too. ISA-18.2 sets out how to rationalise alarms so that high-high stands out instead of drowning in nuisance alarms. API 2350 itself does not require IEC 61511 for an AOPS, but many owners apply it when the overfill function trips valves automatically. - Tank and tag: Which sensor and setpoint were tested - Method: Real level, sensor actuation or simulation at the sensor - Links checked: Signal, logic, local horn and light, control room, acknowledgement - As found and as left: Setpoint and response before and after the test - Bypasses: Any inhibit applied and confirmation it was removed - Signatures: Technician and operations witness ## Field notes from Citia level alarm work On real sites, overfill protection succeeds or fails on details: sensor choice, documentation and testing during live operations. In the high-low alarm project at Pertamina Lubuk Linggau (Aroja) in 2024, Citia installed a high-low alarm system on storage tanks using VEGAPULS 6X non-contact radar sensors. The control system warns at the high and low alarm limits; at high-high or low-low it can trigger an alarm or an interlock signal according to the operating philosophy. The aim was to prevent overfill, dry running of pumps and product loss. Citia INTEGRA HLA follows the same structure: an ATG or independent level sensor, PLC or SCADA, and a local annunciator, with setpoints and alarm responses set in an engineering review. Two other projects show the testing side. In the pump emergency shutdown project at Pulau Baai in 2025, wiring diagrams and cause and effect charts did not match the field. The team verified point to point, simulated the logic offline and cut over during a scheduled shutdown. The Cikampek tank-monitoring upgrade in 2025 ran loop checks and functional tests of alarms and interlocks before handover. Citia's notes on level alarm reliability add the maintenance point: sensors drift without regular calibration. ## Terms used in this guide Control every alarm bypass: High-high alarms are sometimes inhibited during maintenance and never restored. Put every bypass under a permit with a named owner and an expiry time, and show active bypasses on the operator screen until they are removed. - Overfill: Product rising above the critical high level, causing spillage or tank damage. - Level of concern (LOC): A defined tank level used to set alarms and actions under API 2350. - Critical high (CH): Highest level product can reach without overflow or damage. - High-high (HH): Emergency alarm level set below CH with enough time to stop the transfer. - Maximum working level (MW): Highest level for routine filling. - AOPS: Automated overfill prevention system: sensors, logic and valves that stop a receipt without the operator. - Level switch: Point sensor that changes state when the liquid reaches its position. - Proof test: Periodic test that shows a protective function still works from sensor to final action. ## Frequently asked questions Q: What is the difference between a high and a high-high alarm? A: A high alarm is an operational warning that the tank is nearing its normal fill limit, while a high-high alarm is the emergency alarm just before critical high. The high alarm asks the operator to prepare; the high-high alarm demands the transfer stop now. Q: Why must the overfill alarm be independent of the ATG? A: The overfill alarm must be independent because a stuck or frozen ATG would also silence any alarm that depends on it. A separate sensor, ideally with separate wiring and logic, keeps the last layer working when the gauge fails. Q: How often should a level switch be tested? A: A level switch should be tested at the interval set by API 2350, the manufacturer and, for safety instrumented functions, the IEC 61511 calculation. Write the interval into the maintenance plan and test end to end, not just the display. Q: What is AOPS? A: AOPS is an automated overfill prevention system that stops a receipt without operator action, using its own sensors, logic and valves. Under API 2350 it is optional and sits on top of the tank category, with its activation level set below critical high. Q: What is API 2350? A: API 2350 is the American Petroleum Institute standard for overfill prevention for storage tanks in petroleum facilities, currently in its 5th edition (2020). It covers levels of concern, tank categories, alarms, response times and the management system around them. Q: Can the ATG high alarm serve as the high-high alarm? A: Not where independence is required, because a single ATG fault would remove both the measurement and the last alarm. The ATG high alarm remains useful as the operational warning below high-high. ## Sources and further reading 1. API Standard 2350, 5th Edition: Overfill Prevention for Storage Tanks in Petroleum Facilities, American Petroleum Institute, 2020 (https://www.api.org/products-and-services/standards/important-standards-announcements/standard-2350) 2. IEC 61511-1:2016 Functional safety: safety instrumented systems for the process industry sector, IEC, 2016 (https://webstore.iec.ch/en/publication/24241) 3. ISA-18 Series of Standards (alarm management), ISA (https://www.isa.org/standards-and-publications/isa-standards/isa-18-series-of-standards) 4. Rosemount 5900S Radar Level Gauge, product data sheet, Emerson, 2026-02 (https://www.emerson.com/documents/automation/104522.pdf) 5. VEGAPULS 6X radar level sensor, VEGA (https://www.vega.com/en/products/product-catalog/level/radar/vegapuls-6x) 6. Citia INTEGRA HLA: tank high-high level alarm, Citia (https://citia-engineering.com/en/products/high-low-alarm) 7. Level alarm at Pertamina Lubuk Linggau (Aroja), Citia, 2024 (https://citia-engineering.com/en/projects/level-alarm-at-pertamina-lubuk-linggau-aroja) 8. Cover photo by Carl Young, CC BY-SA 4.0 (cropped and colour graded), Wikimedia Commons (https://commons.wikimedia.org/wiki/File:Refinery_Tanks_5.jpg) Review your tank overfill protection: Share your tank list and current alarm setup with siTia, Citia’s WhatsApp assistant, to discuss an independent high-high layer. ## Contact - Company: PT Citia Engineering Indonesia - siTia - Virtual Assistance: [WhatsApp +62 813-2206-507](https://wa.me/628132206507). siTia answers questions about our products, projects and enquiries on WhatsApp. Replies are automated, and a person from the Citia team follows up. - Email: services@citiaengineering.com - Phone / WhatsApp (siTia): +62 813-2206-507 - Location: Bandung, Indonesia [Contact Citia](https://citia-engineering.com/en/contact.md) ## Structured data (JSON-LD) ```json { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://citia-engineering.com/#organization", "name": "Citia Engineering Indonesia", "legalName": "PT Citia Engineering Indonesia", "alternateName": "Citia", "url": "https://citia-engineering.com", "logo": { "@type": "ImageObject", "url": "https://citia-engineering.com/media/citia-logo.png", "width": 950, "height": 328 }, "description": "Citia is an engineering and system integration company in Bandung, Indonesia. We connect field devices, PLC and SCADA, terminal software and enterprise systems, then install, test and maintain them.", "email": "services@citiaengineering.com", "telephone": "+62 813-2206-507", "address": { "@type": "PostalAddress", "addressLocality": "Bandung", "addressRegion": "Jawa Barat", "addressCountry": "ID" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "services@citiaengineering.com", "telephone": "+62 813-2206-507", "url": "https://citia-engineering.com/en/contact" }, { "@type": "ContactPoint", "contactType": "customer support", "name": "siTia - Virtual Assistance", "telephone": "+62 813-2206-507", "url": "https://wa.me/628132206507", "areaServed": "ID", "availableLanguage": [ "id", "en" ] } ], "areaServed": { "@type": "Country", "name": "Indonesia" }, "knowsAbout": [ "Terminal automation system", "Automatic tank gauging", "Tank management system", "SCADA", "Programmable logic controller", "Modbus", "Field instrumentation", "Weighbridge", "Pipeline pressure monitoring", "Industrial IoT" ], "brand": [ { "@type": "Brand", "name": "INTEGRA" }, { "@type": "Brand", "name": "CATALYST" } ], "sameAs": [ "https://www.facebook.com/citiaengineering/", "https://www.instagram.com/citiaengineering/" ] }, { "@type": "WebSite", "@id": "https://citia-engineering.com/#website", "url": "https://citia-engineering.com", "name": "Citia Engineering Indonesia", "inLanguage": [ "en", "id" ], "publisher": { "@id": "https://citia-engineering.com/#organization" }, "potentialAction": [ { "@type": "SearchAction", "name": "Search Citia News", "target": { "@type": "EntryPoint", "urlTemplate": "https://citia-engineering.com/en/news?q={search_term_string}" }, "query-input": "required name=search_term_string" }, { "@type": "SearchAction", "name": "Cari di News Citia", "target": { "@type": "EntryPoint", "urlTemplate": "https://citia-engineering.com/id/news?q={search_term_string}" }, "query-input": "required name=search_term_string" } ] }, { "@type": "WebPage", "@id": "https://citia-engineering.com/en/knowledge/tank-overfill-protection#webpage", "url": "https://citia-engineering.com/en/knowledge/tank-overfill-protection", "name": "High and high-high tank level alarms: overfill protection under API 2350", "description": "Overfill protection under API 2350: how high and high-high tank level alarms differ, why high-high must be independent of the ATG, and how to set and test it.", "inLanguage": "en", "isPartOf": { "@id": "https://citia-engineering.com/#website" }, "publisher": { "@id": "https://citia-engineering.com/#organization" }, "about": { "@id": "https://citia-engineering.com/#organization" }, "breadcrumb": { "@id": "https://citia-engineering.com/en/knowledge/tank-overfill-protection#breadcrumb" }, "dateModified": "2026-11-13", "mainEntity": { "@id": "https://citia-engineering.com/en/knowledge/tank-overfill-protection#entity" } }, { "@type": "BreadcrumbList", "@id": "https://citia-engineering.com/en/knowledge/tank-overfill-protection#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Citia", "item": "https://citia-engineering.com/en" }, { "@type": "ListItem", "position": 2, "name": "Knowledge", "item": "https://citia-engineering.com/en/knowledge" }, { "@type": "ListItem", "position": 3, "name": "High and high-high tank level alarms: overfill protection under API 2350", "item": "https://citia-engineering.com/en/knowledge/tank-overfill-protection" } ] }, { "@id": "https://citia-engineering.com/en/knowledge/tank-overfill-protection#entity", "url": "https://citia-engineering.com/en/knowledge/tank-overfill-protection", "mainEntityOfPage": { "@id": "https://citia-engineering.com/en/knowledge/tank-overfill-protection#webpage" }, "@type": "TechArticle", "headline": "High and high-high tank level alarms: overfill protection under API 2350", "description": "A high alarm warns that a tank is nearing its normal fill limit; the high-high alarm is the last layer before the critical level and should come from a sensor independent of the ATG.", "dateModified": "2026-11-13", "author": { "@id": "https://citia-engineering.com/#organization" }, "publisher": { "@id": "https://citia-engineering.com/#organization" }, "inLanguage": "en", "articleSection": "Tank Farm & Inventory", "datePublished": "2026-11-13", "image": "https://citia-engineering.com/media/covers/tank-overfill-protection.webp" }, { "@type": "FAQPage", "@id": "https://citia-engineering.com/en/knowledge/tank-overfill-protection#faq", "url": "https://citia-engineering.com/en/knowledge/tank-overfill-protection", "inLanguage": "en", "isPartOf": { "@id": "https://citia-engineering.com/en/knowledge/tank-overfill-protection#webpage" }, "mainEntity": [ { "@type": "Question", "name": "What is the difference between a high and a high-high alarm?", "acceptedAnswer": { "@type": "Answer", "text": "A high alarm is an operational warning that the tank is nearing its normal fill limit, while a high-high alarm is the emergency alarm just before critical high. The high alarm asks the operator to prepare; the high-high alarm demands the transfer stop now." } }, { "@type": "Question", "name": "Why must the overfill alarm be independent of the ATG?", "acceptedAnswer": { "@type": "Answer", "text": "The overfill alarm must be independent because a stuck or frozen ATG would also silence any alarm that depends on it. A separate sensor, ideally with separate wiring and logic, keeps the last layer working when the gauge fails." } }, { "@type": "Question", "name": "How often should a level switch be tested?", "acceptedAnswer": { "@type": "Answer", "text": "A level switch should be tested at the interval set by API 2350, the manufacturer and, for safety instrumented functions, the IEC 61511 calculation. Write the interval into the maintenance plan and test end to end, not just the display." } }, { "@type": "Question", "name": "What is AOPS?", "acceptedAnswer": { "@type": "Answer", "text": "AOPS is an automated overfill prevention system that stops a receipt without operator action, using its own sensors, logic and valves. Under API 2350 it is optional and sits on top of the tank category, with its activation level set below critical high." } }, { "@type": "Question", "name": "What is API 2350?", "acceptedAnswer": { "@type": "Answer", "text": "API 2350 is the American Petroleum Institute standard for overfill prevention for storage tanks in petroleum facilities, currently in its 5th edition (2020). It covers levels of concern, tank categories, alarms, response times and the management system around them." } }, { "@type": "Question", "name": "Can the ATG high alarm serve as the high-high alarm?", "acceptedAnswer": { "@type": "Answer", "text": "Not where independence is required, because a single ATG fault would remove both the measurement and the last alarm. The ATG high alarm remains useful as the operational warning below high-high." } } ] }, { "@type": "DefinedTermSet", "@id": "https://citia-engineering.com/en/knowledge/tank-overfill-protection#glossary", "url": "https://citia-engineering.com/en/knowledge/tank-overfill-protection", "inLanguage": "en", "isPartOf": { "@id": "https://citia-engineering.com/en/knowledge/tank-overfill-protection#webpage" }, "name": "Terms used in this guide", "hasDefinedTerm": [ { "@type": "DefinedTerm", "name": "Overfill", "description": "Product rising above the critical high level, causing spillage or tank damage.", "inDefinedTermSet": { "@id": "https://citia-engineering.com/en/knowledge/tank-overfill-protection#glossary" } }, { "@type": "DefinedTerm", "name": "Level of concern (LOC)", "description": "A defined tank level used to set alarms and actions under API 2350.", "inDefinedTermSet": { "@id": "https://citia-engineering.com/en/knowledge/tank-overfill-protection#glossary" } }, { "@type": "DefinedTerm", "name": "Critical high (CH)", "description": "Highest level product can reach without overflow or damage.", "inDefinedTermSet": { "@id": "https://citia-engineering.com/en/knowledge/tank-overfill-protection#glossary" } }, { "@type": "DefinedTerm", "name": "High-high (HH)", "description": "Emergency alarm level set below CH with enough time to stop the transfer.", "inDefinedTermSet": { "@id": "https://citia-engineering.com/en/knowledge/tank-overfill-protection#glossary" } }, { "@type": "DefinedTerm", "name": "Maximum working level (MW)", "description": "Highest level for routine filling.", "inDefinedTermSet": { "@id": "https://citia-engineering.com/en/knowledge/tank-overfill-protection#glossary" } }, { "@type": "DefinedTerm", "name": "AOPS", "description": "Automated overfill prevention system: sensors, logic and valves that stop a receipt without the operator.", "inDefinedTermSet": { "@id": "https://citia-engineering.com/en/knowledge/tank-overfill-protection#glossary" } }, { "@type": "DefinedTerm", "name": "Level switch", "description": "Point sensor that changes state when the liquid reaches its position.", "inDefinedTermSet": { "@id": "https://citia-engineering.com/en/knowledge/tank-overfill-protection#glossary" } }, { "@type": "DefinedTerm", "name": "Proof test", "description": "Periodic test that shows a protective function still works from sensor to final action.", "inDefinedTermSet": { "@id": "https://citia-engineering.com/en/knowledge/tank-overfill-protection#glossary" } } ] } ] } ```