Tanks, gauges and overfill prevention

The underground tanks at a fuel station are out of sight, but they hold most of the hazard: Northfield's three tanks together can hold 30,400 gal (115,000 L) of fuel. Most of the time they sit quietly under the forecourt, feeding the dispensers through buried pipes. Two things can go wrong that the cashier can help prevent or catch early: an overfill, when more fuel is delivered than the tank can hold, and a leak, when fuel escapes from the tank or its piping into the ground. This lesson covers how the tanks are monitored, how to work out whether a delivery will fit, how overfill prevention works and what to do when the tank alarm panel lights up. HSE-351 covers leak detection, tank testing and spill reporting in depth.

The parts of a tank system

• The tank: usually double-walled steel or fiberglass, buried under the forecourt, with an interstitial space between the walls that can be monitored for leaks.
• Fill pipe and spill bucket: where deliveries go in (Lesson 8).
• Vent pipe: a tall pipe that lets air and vapor in and out as the fuel level changes, ending above the roofline away from windows and ignition sources.
• Submersible turbine pump: a pump inside the tank that pushes fuel through the piping to the dispensers.
• Piping and sumps: pipes from the tank to the dispensers, with sealed sumps under the dispensers and at the tank top to catch leaks.
• Automatic tank gauge (ATG): a probe in each tank, connected to a console, that measures the fuel level, the volume, the water at the bottom and the temperature, and runs leak tests.
• Overfill prevention device: a valve or alarm that stops or warns before the tank is overfilled.

The automatic tank gauge

The tank gauge console, usually in the store's back office or near the till, is the cashier's window into the tanks. It shows the volume of fuel in each tank, the ullage (the empty space available for a delivery), the water level, the temperature, and alarms. It also prints or stores delivery reports and leak test results that the station must keep. Many consoles also send alarms to the fuel company or a monitoring service.

Common alarms include high product (the tank is nearly full), overfill (the tank is fuller than it should be), low product, high water, sensor faults, leak test failures and sump alarms, which mean liquid has been detected in a sump under a dispenser or at the tank top. Each alarm needs a response, and some need it immediately. Northfield keeps a laminated card beside the console listing each alarm, what it means and what to do, which follows the console maker's manual and the company's procedure.

The most important rule is never to silence and ignore an alarm. Many consoles let the cashier acknowledge an alarm with a button so it stops beeping. Acknowledging is fine, but the alarm must still be recorded and acted on. An ignored sump alarm can mean a slow leak going on for months; an ignored high-product alarm during a delivery can mean fuel coming out of the fill port and the vent.

Will the delivery fit?

Before a delivery starts, the driver and the cashier check that each tank has room for the fuel being delivered. The tank's usable capacity is less than its full volume, because a margin must be left for the fuel to expand and for the overfill device to work. The calculation is simple. The ullage is the tank's working capacity minus the fuel already in it. If the delivery volume is larger than the ullage, the delivery will overfill the tank.

EPA's tank rules require overfill prevention that either automatically shuts off flow at 95% of tank capacity, restricts flow 30 minutes before the tank overfills or at 90% capacity, or sounds an alarm at 90% capacity or 1 minute before overfilling. Northfield's procedure uses 90% of full volume as the maximum fill level for planning deliveries, so the overfill device is a back-up rather than the plan.

The program below works out the ullage in each of Northfield's tanks from the gauge readings and checks a delivery order against it. The tank sizes are Northfield's; the readings and the order are an example.

# Will the delivery fit? Ullage to 90% of full volume (US gallons, example readings).
MAX_FILL = 0.90
tanks = {  # name: (full volume, current volume from gauge, ordered delivery)
    "Tank 1 regular": (13200, 4900, 6900),
    "Tank 2 premium": (6600, 2600, 2400),
    "Tank 3 diesel": (10600, 5700, 4200),
}
for name, (full, now, order) in tanks.items():
    ullage = full * MAX_FILL - now
    after = (now + order) / full
    verdict = "fits" if order <= ullage else f"DOES NOT FIT: reduce by {order - ullage:,.0f} gal"
    print(f"{name:15} ullage {ullage:>7,.0f} gal  order {order:>7,.0f} gal  -> {after:5.1%} full  {verdict}")

Tank 1 regular  ullage   6,980 gal  order   6,900 gal  -> 89.4% full  fits
Tank 2 premium  ullage   3,340 gal  order   2,400 gal  -> 75.8% full  fits
Tank 3 diesel   ullage   3,840 gal  order   4,200 gal  -> 93.4% full  DOES NOT FIT: reduce by 360 gal

The premium order fits with room to spare and the regular order only just fits, leaving the tank a little under 90% full. The diesel order does not fit: the diesel tank is fuller than the person who placed the order expected, perhaps because a cold snap slowed diesel sales. Delivering the full order would take the tank past 90%, into the zone where the overfill device acts and close to spilling. The driver must reduce the diesel drop, and the leftover fuel goes back to the terminal or to the next station on the route. This check takes a minute with the gauge console and prevents the most common cause of large delivery spills.

How overfill devices work

• Flow shut-off valve (drop tube valve): a float-operated valve inside the fill pipe that closes when the fuel reaches a set level, stopping the delivery. Because the delivery hose is full of fuel when the valve closes, the driver must then drain the hose, which takes care to avoid spilling.
• Ball float vent valve: a valve in the vent line that restricts flow as the tank fills, causing the delivery to slow. Not allowed in some installations and situations because of the risk of over-pressurizing the tank.
• High-level alarm: an audible and visible alarm near the fill ports, triggered by the gauge, that tells the driver to stop the delivery.

None of these devices is a substitute for checking the ullage first. They are a safety net for when the check is wrong or skipped. A tank that has been overfilled past its device can push fuel out of the vent pipe high above the forecourt, and a fill port that is overfilled can spill as soon as the hose is disconnected.

Stick readings and reconciliation

Before automatic gauges, stations measured tank levels with a long wooden or fiberglass stick, marked in centimeters or inches, lowered through the fill pipe. The stick reading is converted to volume using the tank's calibration chart. Many stations still keep a gauge stick as a back-up when the electronic gauge fails, and drivers sometimes use it. A water-finding paste on the end of the stick changes color where it touches water, showing how much water is at the bottom.

Stations also reconcile inventory daily: they compare the fuel in each tank at the start of the day, plus deliveries, minus sales recorded by the dispensers, with the fuel in the tank at the end. Small differences come from temperature and measurement error; a steady loss over weeks can mean a leak or theft. Tank rules require this kind of record keeping in many places, and HSE-351 explains how it is used for leak detection.

For supervisors: make the gauge part of every shift

Put the tank gauge on the opening and closing checklists: print or view the inventory, check for active alarms, and record anything unusual. Teach every cashier to read the console screens, not just the manager. Show them how to work out ullage before a delivery, and make it a rule that no delivery starts until the cashier has checked it with the driver. And never let anyone disable an alarm because it is annoying; if an alarm keeps sounding, call the service contractor.

Water in the tanks

Water gets into fuel tanks through loose fill caps, damaged spill buckets, condensation and, with ethanol blends, by being absorbed into the fuel. A little water sinks to the bottom, where the gauge measures it; ethanol blends can hold more water before it separates, but when it does, a layer of water and ethanol drops out together, leaving the gasoline above with less ethanol and a lower octane rating. Water and sediment drawn into customers' vehicles cause rough running and breakdowns. This is one reason a high-water alarm needs a call to the manager, and one reason the cashier checks that fill caps are closed and locked and that spill buckets are not full of rainwater or snowmelt, which can drain into the tank when the cap is opened.