If the liquid level gauge does not have a black screen and the DCS displays values, can it be concluded that the level protection is functioning normally?
Not necessarily.
On-site issues often arise not from broken instruments but from distorted liquid levels still displayed on the screen; alarms may trigger without sufficient margin for the setpoint; interlock signals may be issued while feed valves fail to shut fully.
AQ 3067—2026 "Criteria for Identifying Major Production Safety Hazards in Chemical and Hazardous Chemical Production and Operation Enterprises" will take effect on September 30, 2026. This standard focuses on key aspects of safety management for chemical and hazardous chemical production and operation enterprises, primarily covering personnel, design and planning, process technology, equipment and facilities, production operations, job safety, and safety management. It clarifies the criteria for identifying major hazards, providing clear guidance for enterprises in hazard identification, risk prevention and control, and safety management improvement.
Although AQ 3067-2026 does not have a separate chapter on "level instruments", the status of level instruments directly affects the determination of major accident hazards as long as they participate in automatic control, emergency shutdown, or safety interlocking.
The clauses in the standard that are closely related to liquid level instruments mainly include:
5.5.3: The relevant production equipment or storage facilities have not achieved automation control, and the automation control system has not been put into use or its functions have failed;
5.5.6: The inlet and outlet liquid phase material pipelines of the storage tanks in the hazardous chemical tank areas of major hazard sources at all levels have not achieved emergency shutdown function or have failed to function;
5.5.7: Failure to complete approval procedures for the removal of safety interlocks, failure to restore them as required, or failure to put relevant control and interlocking facilities into use or functional failure;
5.5.12: The low low liquid level alarm value of the internal floating roof storage tank is not set according to standard specifications, or the floating roof falls to the bottom during normal operation;
5.7.5: Change management issues such as failure to conduct security risk assessment and failure to follow approval procedures before the change.
The inspection of liquid level gauges mainly focuses on the following five items.
1.The Importance of Selection and Installation
Whether the liquid level gauge can measure accurately depends on the selection and installation first.
The easy to crystallize medium uses a pressure inducing method that is prone to clogging, the differential pressure level gauge does not consider density changes, the radar level gauge is installed in the feed impact zone, or the high liquid level has entered the measurement blind zone, all of which may cause long-term measurement deviations.
The trouble with this type of problem is that although the instrument does not report a malfunction and the verification records may be qualified, the operating data is not reliable.
5.2.1 of AQ 3067-2026 pertains to device design and safety facility design requirements after significant changes, while 5.5.3 focuses on automation control systems that have not been put into use or have functional failures. Although the selection and installation of the liquid level gauge are unreasonable and cannot directly constitute a major hazard, if it leads to the failure of the automatic control function, it should be judged according to relevant provisions.
There are three main things to observe on site:
Whether the measurement principle is suitable for the medium and working conditions;
Whether the installation position is disturbed by feeding, foam, mixing or internal components;
Whether the range and blind zone cover the alarm and interlock intervals.
2.Alarm values and interlock values do not rely on experience
The liquid level alarm can sound, but it does not mean that the set value is reasonable.
High high liquid level alarm and interlock values should allow time for personnel to handle, valves to close, and pipeline residue. Setting it too close to the upper limit of the device may result in alarms and interlocks not being able to prevent the liquid level from exceeding the limit even if they are activated.
Attention should be paid to low and low liquid levels in internal floating roof storage tanks. According to section 5.5.12 of AQ 3067-2026, if the low low liquid level alarm value is not set according to standard specifications, or if the floating roof falls during normal operation, it is considered a major accident hazard.
Therefore, it is not only necessary to follow habits, but also to combine the safe operating position of the floating roof, instrument errors, liquid level fluctuations, and pump shutdown time to set low and low liquid level values.
When the alarm value and interlock value are adjusted, they cannot be directly modified in the system. Standard 5.7.5 involves pre change risk assessment and approval procedures, and such adjustments to safety parameters should be included in change management.
3.The numerical values on the screen do not represent the true liquid level
The problem with liquid level gauges that are easily overlooked is that the signal appears normal but is actually distorted.
Common situations include blockage of the pressure pipe, jamming of the float, loss of radar echoes, incorrect range settings, forced signals, and retention of old data after communication interruption.
A liquid level gauge that displays 50% for a long time cannot directly determine the stability of the liquid level. It also depends on whether the liquid level changes with the incoming and outgoing materials, whether it matches the local liquid level, manual gauge, flow rate, and material balance.
Although AQ 3067-2026 does not separately list "measurement deviation of a single liquid level gauge" as a major hazard, if distorted liquid level signals cause automatic control or safety interlock functions to fail, it involves the contents of clauses 5.5.3 and 5.5.7, causing major accident hazards.
The key to judging is not whether the instrument has fault codes, but whether this signal can still support control and interlocking functions.
4.Display, alarm and interlock
Some devices' liquid level display, high liquid level alarm, high high liquid level interlock, and normal control all come from the same liquid level gauge.
On the screen, there may seem to be many functions, but in reality, there is only one measurement source. Once this watch drifts, gets stuck, or freezes, several functions may fail simultaneously.
Even if two level gauges are installed, it still depends on whether they share the same pressure pipe, power supply, isolation valve, or signal channel. If they share the same fault point, it cannot be understood as two independent sets of protection.
Standard 5.5.5 sets requirements for equipping SIS at all levels, and 5.5.7 focuses on whether interlocking facilities are put into use and whether their functions are effective. Whether independent high-level measurement, different measurement principles, or voting logic are required should be determined based on risk analysis and design requirements.
The key is not to install more watches, but whether a fault will take away several layers of protection together.
5.Liquid level interlock
Whether the liquid level interlock is effective depends on whether the valve, pump, or other executing equipment has acted as required.
Taking the example of cutting off the feed at high and high liquid levels, the complete chain includes:
Liquid level detection - interlock logic - output circuit - solenoid valve - shut-off valve
Merely verifying the liquid level signal entering the system or simply observing the valve icon changing color on the screen does not indicate that the interlock is effective.
The common problem on site is that the DCS displays that the valve is closed, but the actual valve does not move; The valve position feedback is normal, but the valve core is not tightly closed; Interlocking testing only tests inputs and does not test executing equipment; After the maintenance is completed, the bypass or software force is not lifted.
According to Article 5.5.6 of AQ 3067-2026, if the inlet and outlet liquid phase material pipelines of the storage tanks in the hazardous chemical tank area of the first and second level major hazard sources fail to achieve emergency cut-off function or function failure, it is a major accident hazard. 5.5.7 also stipulates that failure to complete approval procedures for the removal of safety interlocks, failure to restore them as required, or failure of control or interlocking facilities are considered major accident hazards.
So, the interlocking test cannot be stopped inside the control system. Whether the valve is closed properly and whether the material is cut off are the criteria for judgment.
6.Conclusion
The key to troubleshooting liquid level gauges is not to check whether there are numerical values on the screen, nor is it just to check the calibration records.
What really needs to be confirmed is:
Is the liquid level measurement reliable;
Whether the alarm and interlock values are reasonable;
Is there a single point of failure;
Can interlocking drive equipment to complete actions.
Among them, the clauses directly related to liquid level are 5.5.6, 5.5.7, and 5.5.12;
The selection and installation, signal reliability, and protection independence can be judged in combination with 5.2.1, 5.5.3, 5.5.5, and 5.7.5.
The liquid level gauge has a value, which only indicates that the system has received a signal. The key to on-site investigation is whether this signal is the actual liquid level and whether it can trigger effective protection.
