8.6.

Gas (common to all vessels under IGC Code)

8.6.1. Were the Master and officers familiar with the company procedures for the
maintenance, testing and setting of the independent cargo tank high-level and overfill
alarms, and were these alarm systems fully operational and properly set?
Short Question Text
Cargo tank overfill alarms

Vessel Types
LPG, LNG

ROVIQ Sequence
Cargo Control Room, Main Deck

Publications
SIGTTO: ESD Systems 2nd Edition 2021
SIGTTO: Liquified Gas Handling Principles on Ships and in Terminals. Fourth Edition.
ICS: Tanker Safety Guide (Gas) - Third Edition

Objective

To ensure that independent cargo tank high-level and overfill alarms are always fully operational, properly
set and used during all cargo loading, discharging and transfer operations.

Industry Guidance

ICS: Tanker Safety Guide (Gas) - Third Edition

Appendix 4 Cargo System Instrumentation

A4.3 Level Alarms, Automatic Shutdown and Emergency Shutdown.

To prevent over-filling of cargo tanks, high level alarms and automatic shutdown systems may be required depending
on the cargo system. These systems may be activated by floats operating a switch device, capacitance probes,
ultrasonic, radar or other approved devices.

Whatever system is used, the setpoint may be affected by the properties of the cargo, including density or dielectric
constant, and adjustments should be made in accordance with the instructions provided by original equipment
manufacturers.

Automatic shutdown systems require particular care. They are normally designed to shut the main cargo tank filling
valve if the liquid level rises above the maximum level permitted by the IGC code.

A4.3.1 High Level Alarms

The IGC Code requires tanks to be fitted with high level alarms which are independent of any alarms fitted to the
closed gauging system. The alarm should provide an audible and visual warning. The activation point should be set
to alarm when the cargo is approaching the normal full condition of the tank.

A4.3.3 Automatic Shutdown Systems

An additional sensor operating independently of the high liquid level alarm should automatically actuate a shut-off
valve to the tank in a manner that will both avoid excessive liquid pressure in the loading line and prevent the tank
becoming liquid full.

Page 202 of 579 – SIRE 2.0 Question Library Part 2 – Version 1.0 (January 2022)
Care should be taken to ensure that the activation point is set accurately, and that the operation of the device is
checked by simulation whenever the system is decommissioned.

SIGTTO: Liquified Gas Handling Principles on Ships and in Terminals. Fourth Edition.

7.7.5 Commencement of loading

The use of automatic shutdown during topping off.

When topping off tanks, it is not considered prudent for ship staff to rely on the use of the high-high level alarm
system to close the tank valve. The high-high level alarm may activate the closing of the filling valve prior to the
planned innage being reached, due to movement of the surface of the cargo as a result of sloshing or through
agitation of the cargo due to boiling off at the surface.

It is also considered prudent, during topping off and all critical valve and machinery operations, to have an observer
present to view/confirm the closing of the filling valve, rather than having to rely on the remote indication of the cargo
control/automation system.

SIGTTO: ESD Systems 2nd Edition 2021

4. Overflow Control and Vacuum Protection

Overflow control and vacuum protection are safety systems that perform a critical function on a ship. This section
provides a brief overview of IGC Code requirements and gives recommendations for overflow control systems,
including testing.

4.3 Testing of Overflow Control

The IGC Code has specific requirements for testing overflow control systems. A function test (IGC Code 13.3.6)
should be carried out prior to cargo operations. This may be carried out as per the manufacturer’s instructions for a
function test during the pre-arrival test.

A proof test is a periodic test that is carried out to detect dangerous hidden faults in a safety system. The overflow
control system should be proof tested (IGC Code 13.3.5) by raising the cargo liquid level at specified intervals. The
cargo operational manual (IGC Code 18.2) should include a description of the procedure to test the high-level alarm
(IGC Code 13.3.5) in a safe and controlled manner.

Overflow control systems are typically based on a float, ultrasonic or radar design. For overflow control that is
activated by a float-type sensor, failures caused by a damaged or punctured float can be identified by a proof test
(IGC Code 13.3.5). This type of test is the actual scenario that the overflow control system is designed to protect
against, so it also works for radar systems.

Any alternate means of testing should clearly demonstrate how it is equivalent to a proof test. It should document how
it addresses the possible failure modes that are specific to the system design. This alternate means of testing should
be documented and would, typically, require Flag State approval.

TMSA KPI 6.1.2 requires that procedures for pre-operational tests and checks of cargo and bunkering equipment are
in place for all vessel types within the fleet. Tests and checks of equipment may include:

• Alarms and trips.

• Tank gauging equipment.

IMO: ISM Code

Page 203 of 579 – SIRE 2.0 Question Library Part 2 – Version 1.0 (January 2022)
7. The Company should establish procedures, plans and instructions, including checklists as appropriate, for key
shipboard operations concerning the safety of the personnel, ship and protection of the environment. The various
tasks involved should be defined and assigned to qualified personnel.

IMO: IGC Code

13.3 Overflow control

13.3.1 Except as provided in 13.3.4, each cargo tank shall be fitted with a high liquid level alarm operating
independently of other liquid level indicators and giving an audible and visual warning when activated.

13.3.2 An additional sensor operating independently of the high liquid level alarm shall automatically actuate a shut
off valve in a manner that will both avoid excessive liquid pressure in the loading line and prevent the tank from
becoming liquid full.

13.3 .3 The emergency shutdown valve referred to in 5.5 and 18.10 (i.e. cargo emergency shut-down or ESD) may
be used for this purpose. If another valve is used for this purpose, the same information as referred to in 18.10.2.1.3
shall be available on board. During loading, whenever the use of these valves may possibly create a potential excess
pressure surge in the loading system, alternative arrangements such as limiting the loading rate shall be used.

13.3.4 The high liquid level alarm and automatic shut off of cargo tank filling need not be required, when the cargo
tank:

• .1 is a pressure tank with the volume not more than 200 m3; or
• .2 is designed to withstand the maximum possible pressure during the loading operation, and such pressure
is below that of the set pressure of the cargo tank relief valve.

13.3.5 The position of the sensors in the tank shall be capable of being verified before commissioning. At the first
occasion of full loading after delivery and after each dry-docking, testing of high-level alarms shall be conducted by
raising the cargo liquid level in the cargo tank to the alarm point.

13.3.6 All elements of the level alarms, including the electrical circuit on the sensor(s), of the high, and overfill alarms,
shall be capable of being functionally tested. System shall be tested prior to cargo operation in accordance with
18.6.2.

13.3 .7 When arrangements are provided for overriding the overflow control system, they shall be such that
inadvertent operation is prevented. When this override is operated, continuous visual indication shall be given at the
relevant control station(s) and the navigation bridge.

15.1.2 Loading limit (LL) means the maximum allowable liquid volume relative to the tank volume to which the tank
may be loaded.

15.6.1 A document shall be provided to the ship, specifying the maximum allowable loading limits for each cargo tank
and product, at each applicable loading temperature and maximum reference temperature. The information in this
document shall be approved by the Administration or recognised organization acting on its behalf.

15.6.2 Pressures at which the PRVs have been set shall also be stated in the document.

15.6.3 A copy of the above document shall be permanently kept on board by the master.

18.6.2 Essential cargo handling controls and alarms shall be checked and tested prior to cargo transfer operations.

IMO: SOLAS

Chapter II-2 Regulation 11

Page 204 of 579 – SIRE 2.0 Question Library Part 2 – Version 1.0 (January 2022)
6.3.1 Preventive measures against liquid rising in the venting system

Provisions shall be made to guard against liquid rising in the venting system to a height which would exceed the
design head of cargo tanks. This shall be accomplished by high-level alarms or overflow control systems or other
equivalent means, together with independent gauging devices and cargo tank filling procedures. For the purposes of
this regulation, spill valves are not considered equivalent to an overflow system.

Inspection Guidance

This question relates only to those alarm systems that are independent of the tank gauging system, and for the
purposes of this question, “overfill alarms” means those alarm systems variously described as:

• Overflow alarms.
• Overflow control systems.
• Automatic shut off systems.
• Automatic shutdown systems.
• High-high level alarms
• Extra-high-level alarms.

The vessel operator should have developed procedures for the maintenance, setting and testing of the cargo tank
high-level and overfill alarm systems, including:

• The mandatory use of the alarms during all cargo tank loading, discharging and transfer operations.
• Set points for all tank level alarms.
• Testing procedures and frequency.
• Records of testing and maintenance to be kept.
• Guidance on the operation of shipboard automatic closing valves.
• Controls on overriding of overfill alarms/automatic shutdown systems.
• Procedures, based on risk assessment, to enable continued cargo loading, discharge or transfer operations
in the event of a failure of the cargo tank high-level or overfill alarm system, or a single alarm for an
individual cargo tank.

The instructions within the manufacturer’s manuals and the vessel’s maintenance plan may form part of the
procedures.

The overfill alarm system should only be overridden in exceptional circumstances, such as if the tank has been
overfilled and it is necessary to bypass the overflow control system to discharge the tank. Such systems are
occasionally overridden at sea during reliquefication and in bad weather conditions.

(See IGC 13.3.4 above for those pressurised vessels where these alarm systems are not required. In older GC
vessels, the overfill alarm sensor does not need to be independent of the high-level sensor)

Suggested Inspector Actions

• Sight, and where necessary review the company procedures for the maintenance, setting and testing of the
cargo tank high-level and overfill alarm systems.
• Sight and where necessary review the document specifying the maximum allowable loading limits for each
cargo tank and product at each applicable loading temperature and maximum reference temperature.
• Review the records of testing and maintenance of the cargo tank high-level and overfill alarm systems.
• Inspect the alarm indicator panels in the cargo control room or position and verify:
o The panel was switched on with all cargo tanks being monitored.
o The audible and visible alarms were operational.
• Inspect the alarm equipment on deck including the audible and visible alarm fittings, where fitted.

Page 205 of 579 – SIRE 2.0 Question Library Part 2 – Version 1.0 (January 2022)
 • Interview the accompanying officer to verify their familiarity with:
o The company procedures for the maintenance, setting and testing of the cargo tank high-level and
overfill alarm systems.
o The circumstances under which the cargo tank high-level and overfill alarm systems or individual
tanks alarms may be isolated and the safeguards to ensure they were always in operation during
cargo transfer operations.

Expected Evidence

• The company procedures for the maintenance, setting and testing of the cargo tank high-level and overfill
alarm systems.
• Records of the maintenance, testing and setting of the cargo tank high-level and overfill alarm systems.
• The document specifying the maximum allowable loading limits for each cargo tank and product, at each
applicable loading temperature and maximum reference temperature.

Potential Grounds for a Negative Observation

• There were no company procedures for the maintenance, testing and setting of the cargo tank high-level
and overfill alarm systems.
• The company procedures for the maintenance, testing and setting of the cargo tank high-level and overfill
alarm systems did not include:
o The mandatory use of the alarms during all loading, discharging and transfer operations.
o Set points for all alarms.
o Testing procedures and frequency.
o Records of testing and maintenance to be kept.
o Guidance on the operation of shipboard automatic closing valves.
o Controls on overriding of overfill alarms/automatic shutdown systems.
o Procedure, based on risk assessment, to enable continued cargo loading, discharge or transfer
operations in the event of a failure of the cargo tank high-level or overfill alarm system or a single
alarm for an individual cargo tank.
• The accompanying officer was not familiar with:
o The company procedures for the maintenance, testing and setting of the cargo tank high-level and
overfill alarm systems.
o The circumstances under which the cargo tank high-level and overfill alarm systems or individual
cargo tank alarms may be overridden and the safeguards to ensure they were always in operation
during cargo transfer operations.
• There were no records of testing and maintenance of the cargo tank high-level and overfill alarm systems,
including tests:
o Prior to cargo operations.
o After dry-docking or decommissioning.
• High-level and/or overfill alarms had not been regularly tested in accordance with the manufacturer’s
instructions.
• The document specifying the maximum allowable loading limits for each cargo tank and product, at each
applicable loading temperature and maximum reference temperature was not available on board.
• Overfill alarms were set above the applicable maximum allowable loading limit for a cargo tank.
• High-level and/or overfill alarms were not set at the level required by company procedures.
• High-level and/or overfill alarms were not in operation at the time of inspection, during loading, discharging
or transfer operations.
• The high-level or overfill alarm system had been overridden during cargo transfer operations.
• The high-level or overfill alarm system was defective in any respect.

Page 206 of 579 – SIRE 2.0 Question Library Part 2 – Version 1.0 (January 2022)