Ground verification and overfill prevention are two separate links in the loading permissive chain. The loading pump or control valve is allowed to run only when the ground monitor sees a valid connection to the truck and the overfill sensors report every compartment at a safe level. If either condition is lost during loading, the permissive drops, the valve closes and the pump stops. The real design decisions are which signals to monitor, which device holds the permissive logic, how the system behaves on a fault, how bypasses are controlled and how the whole chain is proof tested.
The truck-to-rack interface is covered on the bottom loading page and LPG-specific ESD functions on a separate page; this page focuses on the permissive chain at flammable liquid and solvent racks.
Grounding: attaching a clamp is not the same as verifying the connection
Flowing liquid carries charge, and that charge can accumulate on an isolated truck. Electrostatic guidance treats grounding every conductive part of a liquid handling system as a basic measure. It matters even more with low-conductivity hydrocarbon solvents, which hold charge for a long time; with electrostatically conductive solvents such as alcohols and ketones, grounding is not relaxed either, because the products are flammable.
A ground clamp on its own does not prove that it is actually attached to the truck, that the cable is intact, or that the connection holds for the whole load. Ground monitors check the connection continuously and supervise their own circuits, blocking loading on a fault.
Overfill prevention covers two different places
Overfill prevention can mean two different things under different standards: keeping a truck compartment from overfilling during loading, or keeping a terminal storage tank from overfilling as it receives product. The truck loading permissive chain concerns the first.
Topic | Scope | Effect on design |
Truck compartment overfill prevention | Systems that prevent overfilling of tanks carrying liquid fuels as dangerous goods during loading; in Europe, EN 13922 sets technical requirements for this tank equipment | The rack permissive unit must be compatible with the sensor type on the truck |
Product recognition | EN 14116 defines the digital interface for product recognition devices on liquid fuel tanks; its subject is identifying the product in a compartment, not overfill | At terminals that use it, it can add a permissive input that blocks wrong-product loading |
Storage tank overfill protection | API Std 2350 covers overfill protection for aboveground storage tanks receiving flammable and combustible liquids at terminals; it does not apply to tanks filled only from tank trucks or rail cars | A matter for tank farm level and shutdown logic, not the truck loading permissive chain |
Sensors on the truck, permissive unit at the rack
In bottom loading the operator cannot see inside the compartment; level sensors in each compartment connect through the truck's overfill socket to the permissive unit at the rack. European gasoline loading legislation lists two-wire thermistor, two-wire optic and five-wire optic sensors on the truck side as examples. The rack unit must recognize the sensor types used by the fleet that will load there. In top loading there may be no sensor on the truck; level detection is then usually done with a probe on the loading arm or loading head, and the probe's position in the compartment is checked before loading starts.
An overfill sensor does not replace the cutoff that the meter and batch controller make at the target quantity. The batch controller stops the ordered quantity; the overfill sensor is an independent last barrier that acts if that cutoff fails or if the compartment was already partly full. For the same reason, published industry practice for bottom loading calls for an independent secondary control system and enough ullage in the tank for it to work.
The permissive chain step by step
1. The truck is positioned at the rack and its identity or order is checked.
2. The ground connection is made; nothing further proceeds until the monitor confirms a valid connection.
3. The overfill socket is connected, or in top loading the probe is placed; all sensors are checked as healthy and in a safe state.
4. Product recognition and loading arm position signals are evaluated where used.
5. With all permissives present, the batch controller releases the pump and control valve.
6. Permissives are monitored throughout loading; loss of any one stops flow, and restarting needs operator acknowledgment.
At small sites the permissive unit can be wired straight into the batch controller. At multi-bay sites permissives also go to a PLC and the terminal automation system, which stop loading when an input drops and log the event. Whether these become safety instrumented functions, and what safety integrity level (SIL) they target, is set by a site-specific risk assessment.
Fault behavior and bypass control
The core principle of the permissive chain is that loss of signal is read as the safe state: a broken cable, a disconnected plug or a de-energized monitor must remove the loading permissive. Self-checking circuits prevent a failed sensor or monitor from being read as a valid permissive.
Most sites can bypass the chain for exceptions, such as a truck with a failed sensor, and an uncontrolled bypass makes the whole chain meaningless. Limiting bypass by key or authorization level, restricting its duration and logging who used it, when and for which truck are defined at the design stage.
Proof testing and records
Grounding and overfill functions rarely act in normal operation, so their failures only show up in testing. The test program confirms that a wetted sensor removes the permissive, that loading stops when the ground is broken and that valve closure time stays acceptable. Intervals follow manufacturer recommendations, the risk assessment and site procedures, and results are recorded.
Design criteria
Parameter | Why it matters in design | Effect on selection |
Truck fleet and sensor types | If the permissive unit does not recognize fleet sensors, the rack cannot be used | Sensor compatibility of the permissive unit, multi-sensor support if needed |
Loading method | Bottom loading puts the sensor on the truck; top loading often puts it on the arm | Socket or probe type, position verification |
Product conductivity and flash point | Basis for static risk and hazardous area classification | Ground monitoring requirement, explosion protection method of equipment |
Location of permissive logic | A standalone unit, a PLC and a terminal automation system offer different flexibility and logging | Wiring, communication and event logging architecture |
Bypass policy | Uncontrolled bypass defeats the chain | Authorization level, time limit and logging |
How TLY Enerji contributes
Depending on project scope, TLY Enerji provides engineering support for loading racks: defining and supplying ground monitoring and overfill prevention equipment based on fleet and product data, integrating these permissives into the batch controller, PLC or SCADA system, site installation, function testing and commissioning. Reviewing the permissive chain on existing racks and post-commissioning technical support can also be discussed when scope is agreed.
Information needed to review your permissive chain
· Number of bays, loading method and products per arm
· Overfill sensor types used by the trucks that load at the site
· Existing ground monitoring and permissive equipment, with any fault history
· Architecture of the batch controllers, PLC and terminal automation system
· Risk assessment or HAZOP outputs and any target safety integrity level
Related pages
· Solvent truck loading systems: Where static charge builds up in solvent loading and why initial flow is limited.
· Bottom loading systems: Adapter, vapor connection and overfill socket at the truck-to-rack interface.
· ESD and safety interlock systems for LPG terminals: Emergency shutdown and interlock functions for pressurized liquefied gas.
· Automated truck loading terminals: Passing permissives to the terminal automation and records layer.
Frequently asked questions about grounding and overfill prevention
If there is an overfill sensor, is the batch controller cutoff still needed?
Yes. The batch controller stops the ordered quantity and ends loading normally. The overfill sensor is an independent last barrier for when that cutoff fails, the compartment was already partly full or the wrong compartment is being loaded. Keeping the two from depending on the same signal or the same failure is important for the reliability of the permissive chain.
Does API Std 2350 cover truck loading?
No. API Std 2350 addresses overfill of aboveground storage tanks at terminals while they receive flammable or combustible liquids, and it does not apply to tanks filled only from tank trucks or rail cars. Preventing a truck compartment from overfilling during loading falls under separate requirements for the truck equipment and the rack permissive unit.
Can a truck with a failed sensor be loaded?
That is decided by the site's written procedure, and even where it is technically possible it should be treated as an exception. Bypass should require authorization, be time-limited and be logged every time. Many operators prefer not to load a truck with a failed sensor until it is repaired, which is the most direct way to preserve the purpose of the permissive chain.
Is a SIL rating mandatory for these functions?
Not in every project. Whether grounding and overfill functions are engineered as safety instrumented functions, and which safety integrity level they target, is decided by a site-specific risk assessment. Some monitors are offered by their manufacturers as suitable for a given SIL, but it is the whole function and the risk analysis that determine the level, not the device alone.