Tank farm level, inventory and bund monitoring

At a glance

Item	Typical answer
Problem	Tank levels, temperatures and bund conditions sit in the gauging system and the control room of each depot. Head office sees stock once a day from a spreadsheet, and unplanned movements are found at the next dip.
What is connected	The tank gauging system over Modbus TCP, independent high-high level switches, inlet and outlet valve positions, bund hydrocarbon and water sensors, the bund sump pump and the status outputs of the fire and gas panel.
Who uses it	Depot operators, terminal managers, the stock and scheduling team at head office, maintenance and the HSE function.
Typical first scope	One depot of eight to fifteen tanks, read-only.
Time to first screen	Typically one to two weeks once the gauging system's Modbus map is known. Budget four to six weeks for a pilot whose stock figures the scheduling team accepts.

The situation

A depot or terminal holds fuels, solvents or chemicals in fixed-roof, floating-roof and pressurised tanks inside bunds. Each tank has a radar or servo gauge, a multi-point temperature element and often a water bottom measurement. A gauging system computes observed volume from the strapping table; an independent high-high switch feeds the overfill protection. Valves, pumps and the gantry live in the PLC or DCS, gas and fire detection in their own panel.

The depot itself is usually well instrumented; the gaps are elsewhere. Head office sees inventory in a daily report exported by the depot. A tank whose level creeps down overnight with both valves shut, a bund slowly filling from a weeping flange, or a gauge frozen at a plausible value are found at the morning round or the next dip. Depots run different gauging brands, so nobody has one picture of the network's stock.

The aim is not to replace the gauging or control system, but to lift their data into one place, add independent checks such as movement with closed valves, route alarms to the people who act and keep an audited history for stock, HSE and maintenance.

Goals and measures

Agree with the scheduling and HSE teams which figures they will use from Hermetry and which stay official in the gauging or stock system. Typical measures:

• Inventory by product = sum of observed volume (tov_m3) of all tanks holding that product, refreshed every minute. Where the gauging system computes standard volume (gsv_m3), use that for reporting.
• Ullage = safe fill capacity of the tank (an attribute) minus current volume. Schedulers use it to plan receipts.
• Days of cover = inventory of a product ÷ average daily outflow over the last 14 days, the outflow taken from the daily fall of volume on tanks in service.
• Unexplained movement = volume change while both the inlet and outlet valves of a tank report closed, per tank per day. It should be close to zero; persistent values point to passing valves, leaks or gauge drift.
• Data availability = minutes with a fresh reading ÷ minutes in the period, per tank. A gauge that stops updating is a hidden overfill risk.
• Time to acknowledge for Critical alarms, read from the alarm timeline.

Hermetry keeps one-minute, hourly and daily aggregates of every numeric key, so daily minimum, maximum and end-of-day values come from stored data. Roll hourly values into the depot's local day where the reporting day matters.

Architecture

Each depot gets one licensed gateway running Hermetry Edge. It reads the gauging system's host interface over Modbus TCP, the depot PLC over Modbus TCP or RTU, and contacts such as high-high switches and bund sensors on its digital inputs, then sends everything over MQTT with TLS on one outbound connection. Nothing on site accepts connections from the internet.

Each tank becomes its own device, reported by the gateway as a child device over the same connection, with its own readings, alarms, history and place in the asset tree. Bund corners without cabling can use battery LoRaWAN level or leak sensors heard by a LoRaWAN gateway on the depot; the codec library decodes common ultrasonic, radar and leak sensors. Settle the hazardous area classification first: equipment in a zoned area needs the right certification.

Component	Role	Notes
Tank gauging system	Level, temperature, water bottom, observed and standard volume	Stays the reference. Read-only Modbus TCP from its host or interface unit; register map from the vendor.
Independent high-high switch	Overfill protection input	Read as a contact for indication only; the trip stays in the overfill protection system.
Depot PLC or DCS	Valve positions, pump states, gantry status	Read-only in this design.
Fire and gas panel	Gas and fire alarm summary outputs	Volt-free contacts or Modbus; indication only.
Bund sensors	Hydrocarbon on water, bund water level, sump pump run	Wired to the gateway's inputs, or LoRaWAN where no cable runs.
Licensed gateway with Edge	Reads all of the above, publishes tanks as child devices	One per depot. Claimed with its factory identity; certificate from the platform's authority.
Licensed router	Uplink	The depot's network, or a 4G router with your own SIM. eSIM management is in development (Hermetry Connect).
Hermetry	Storage, alarms, rules, flows, dashboards, SCADA	EU, US or Türkiye region, or on your own servers where policy requires.

Profiles require TLS and can restrict the networks a device may connect from. Licensed gateways authenticate with an X.509 certificate from the platform's authority. See gateways and devices behind a gateway.

Point list

Per tank unless noted. Register references are illustrative; use your gauging system's map. Intervals are starting values.

Point	Telemetry key	Unit	Source	Interval	Notes
Product level	level_mm	mm	Gauging system, input register per tank	60 s	Declare 0 to the tank's reference height in the profile.
Level, percent of safe fill	level_pct	%	Gauging system, or computed in the root flow	60 s	Lets one drawing and one board fit tanks of different heights.
Average product temperature	product_temp_c	°C	Multi-point element via the gauging system	60 s
Water bottom	water_mm	mm	Interface measurement	5 min	Product tanks only.
Total observed volume	tov_m3	m³	Gauging system strapping calculation	60 s	Primary inventory value.
Gross standard volume	gsv_m3	m³	Gauging system, if it computes it	5 min	Use for reporting where available.
Level rate	level_rate_mm_min	mm/min	Derived in the root flow from level_mm	60 s	Stored as its own key; drives movement alarms.
High-high switch	hh_switch	bool	Gateway digital input	on change	True = switch tripped.
Inlet valve open	inlet_open	bool	PLC, coil or discrete input	on change	Use the closed limit switch if open is not wired.
Outlet valve open	outlet_open	bool	PLC	on change
Gauge healthy	gauge_ok	bool	Gauging system status word	60 s	False on gauge fault or stale value.
Bund hydrocarbon detected	bund_hc	bool	Hydrocarbon-on-water sensor, DI	on change	Per bund device.
Bund water level	bund_water_mm	mm	Ultrasonic or radar level, LoRaWAN or 4-20 mA	5 min	Per bund device.
Bund sump pump running	sump_run	bool	Run contact, DI	on change	Per bund device.
Gas alarm summary	fg_gas_alarm	bool	Fire and gas panel output	on change	Depot device.
Fire alarm summary	fg_fire_alarm	bool	Fire and gas panel output	on change	Depot device.
Loading gantry active	gantry_active	bool	PLC	on change	Depot device; explains outflow.
Gauging link status	tgs_comm_ok	bool	Gateway Modbus status	60 s	Depot device.
Mains present	mains_ok	bool	Phase monitoring relay	on change	Depot device.

Declare every key in the profile's Telemetry keys tab with label, unit, decimals and range. Gauges take the range as their scale, so a tank declared 0 to 14,000 mm scales correctly without per-widget settings.

Asset model

Build the tree in Sites & Assets around how stock and safety are managed:

• Region (free kind) with scheduler_team and region_code.
• Depot (Site) with location, time zone, operating_hours, permit_type and criticality.
• Bund (Area) with bund_capacity_m3 and drain_valve_tag.
• Tank (Machine, or a free kind Tank) with tank_tag, product, safe_fill_m3, reference_height_mm, roof_type (fixed, floating, sphere), heated and last_drained.
• Loading gantry and Transfer pump (Machine) where they are monitored.

Place each tank device on its tank asset, bund devices on the bund and the gateway on the depot. Add Feeds relations from receipt line to tank and from tank to gantry so drill-downs follow the product path. Placement decides which depot's status and alarm counts include a tank and which Rules-card rules of a place may act on it.

Limits that differ per tank belong on the tank device as server attributes, for example high_level_mm, low_level_mm, max_water_mm and max_temp_c. Alarm rules read them as thresholds, so one rule serves every tank. A tank without the attribute is simply not checked for that limit, which is a reason to review attributes at commissioning.

Device setup

Profiles

Create profiles Depot gateway, Storage tank, Bund and, if used, Bund level sensor (LoRaWAN). The gateway names each child and sends a type when it connects it; that type selects the child's profile, so tanks land on Storage tank automatically. If floating-roof and fixed-roof tanks need rules that a Rules card must tell apart, give them separate profiles, because Rules-card rules target one device or all devices of a profile.

Use the Recent message online rule on the tank profile, with a 60 s expected interval and a factor that tolerates one missed poll. Rate limits apply per child and to the gateway as a whole; twelve tanks a minute are far below the defaults.

Provisioning

The administrator claims the gateway by scanning its code or typing its claim details and picks Depot gateway. Tank child devices appear on their first report; rename them to the tank tag (TK-101) and place them on the tree at once.

Settings and reading intervals

On licensed gateways, remote device settings show each setting of the model with its value: Modbus address, polling interval, register blocks, input debounce. Apply a baseline per depot type with a bulk job that runs in waves and pauses when too few gateways apply it. If the gateway model supports a deadband, start at about 2 mm for level and 0.2 °C for temperature, and keep the heartbeat so a frozen gauge still reports.

Derived values in the root flow

The tank profile's root flow makes derived keys. A delta block takes the change of level_mm since the previous reading, a short script divides it by the minutes between readings, and a save-telemetry block stores level_rate_mm_min on the tank. The script can also compute level_pct from reference_height_mm, added by an enrich block. Keep strapping-table volume in the gauging system.

Time stamps and outages

Let the gateway stamp readings with its synchronised clock, or omit the time stamp so Hermetry stamps arrival. Readings more than ten minutes in the future are dropped. Licensed gateways can buffer readings while the uplink is down, with a capacity that depends on the model; buffered readings arrive with their original time stamps. Alarm rules evaluate them as backfill, so a bund event that came and went during an outage is in the history, marked Backfilled, without paging anyone for the past.

Firmware

Signed gateway firmware rolls out in waves from the profile: one low-risk depot, a soak time, then the rest; a failed gate pauses the rollout.

Dashboards

Board	Audience	Widgets and what they show
Network stock	Scheduling team, managers	Table of tanks with depot, product, level, volume, ullage and last reading, downloadable to Excel; stat cards per product with total volume (a compute script on the card sums the tank rows); map of depots coloured by status; alarm table filtered to Critical and Major.
Depot overview	Depot operators	The depot's SCADA drawing; progress cards per tank for percent of safe fill; state cards for high-high switches and bund sensors; activity feed of recent events; device table with each tank's last-seen time.
Tank page	Operators, schedulers	Opened by drill-down with the tank as a parameter. Gauge of level; line chart of level and temperature over 48 hours; bar chart of end-of-day volume (daily last value) for 30 days; attributes card with product, safe fill and last drained; the tank's alarm table.
Movements	Stock and HSE	Line chart of level_rate_mm_min per tank; alarm table of movement alarms over 30 days; heatmap of level rate by hour to spot night transfers.
Bunds and safety indications	HSE	State cards for bund hydrocarbon, sump pump and fire and gas summaries; bund water chart; alarm table of HSE alarm types.

Entity parameters keep the boards generic: the tank page takes the tank, the depot overview the depot asset. A read-only display link puts the depot overview on a control-room screen.

SCADA screens

Draw one layout per depot (tank positions differ) and one tank detail drawing for all tanks. The layout shows bunds as outlined areas, tanks inside them, the receipt line, transfer pumps, the manifold and the loading gantry, joined by pipe connections. Floating-roof tanks, spherical tanks, loading arms, metering skids, valve manifolds and emergency shutdown valves come from the Oil & gas pack; plain tanks, pumps and valves from the core set; gas and flame detector symbols from the Process pack's safety family. See symbols and industry packs.

• States: each tank fills from level_pct; a rule turns the level text amber above 90 % and blinks it red when hh_switch is true; valve symbols show open or closed from inlet_open and outlet_open; the sump pump shows running from sump_run.
• Second readings: each tank prints volume and temperature under the level; the bund prints its water level.
• Conversions: a one-line expression adapts raw register values, for example value / 10 for a level sent in tenths of a millimetre.
• Reuse: attach the tank detail drawing to the Storage tank profile's views so every tank gets its own view with its own bindings. Match everything proposes bindings for unbound symbols on the depot layout.

Clear the designer's Problems tab before applying. A drawing holds up to 200 symbols and 300 connections; split very large terminals into area drawings.

Rules and alarms

Alarm rules live on the tank, bund and depot profiles. Thresholds that differ per tank read device attributes. See alarm rules on device profiles.

Alarm	Condition	Delay and hysteresis	Severity	Notified	Escalation
High-high switch	hh_switch == true	Debounce 1 sample	Critical	Depot operators and terminal manager, SMS and push	Reminder every 5 min until acknowledged
Level high	level_mm >= attribute high_level_mm	Debounce 2 samples; hysteresis 20 mm	Major	Depot operators, push and in-app	Reminder every 15 min
Level low	level_mm <= attribute low_level_mm	Debounce 2 samples; hysteresis 20 mm	Minor	Scheduling team, e-mail	None
Unexplained fall	all of: level_rate_mm_min < -1, inlet_open == false, outlet_open == false	Debounce 5 samples	Critical	Depot operators and HSE, SMS	Reminder every 15 min
Unexplained rise	all of: level_rate_mm_min > 1, both valves closed	Debounce 5 samples	Major	Depot operators, push	Reminder every 30 min
Gauge fault	gauge_ok == false	Debounce 2 samples	Major	Maintenance, e-mail and push	Reminder every 60 min
Water bottom high	water_mm >= attribute max_water_mm	Debounce 3 samples; hysteresis 5 mm	Warning	Depot operators, in-app	None
Product temperature high	product_temp_c > attribute max_temp_c	Debounce 3 samples; hysteresis 1 °C	Major	Depot operators, push	Reminder every 30 min
Bund hydrocarbon	bund_hc == true	Debounce 30 s	Critical	Depot operators and HSE, SMS	Reminder every 10 min
Bund water high	bund_water_mm > 300	Debounce 2 samples; hysteresis 20 mm	Minor	Depot operators, in-app	None
Fire and gas indication	any of: fg_gas_alarm == true, fg_fire_alarm == true	None	Critical	Terminal manager and HSE, SMS	Reminder every 5 min
Tank offline	Inactivity rule, no reading for 5 min		Major	Depot operators, push	Reminder every 30 min

Lifecycle. An alarm opens when its condition holds through the debounce, is acknowledged (User role) with an optional note and resolves by itself when the condition clears. Alarms cannot be latched, so an unexplained fall that stopped after ten minutes resolves on its own; make the review of resolved alarms with an empty Acknowledged column part of the shift handover. Only one alarm is open per tank and type; repeats count as occurrences. Each rule carries a runbook text, for example the depot's procedure for a suspected passing valve.

Escalation. A higher severity notifies again, and reminders repeat until someone acknowledges. Recipients are users, roles (Owner, Admin, User) or e-mail addresses (up to 20 per rule); there are no on-call rotations behind IoT alarms, so keep the duty recipients, or a shared duty address, current. Debounce advances only when readings arrive; for "no level change for two hours" use a Rules-card "stays so for" timer.

Time-of-day rules. Profile alarm rules have no schedule. A Rules-card rule on the depot covers out-of-hours movement: when level_rate_mm_min stays above 1 for 5 minutes, only if the time is outside the depot's operating window or the day is in the tenant's holiday calendar, then raise a Major alarm and notify the duty manager's team. Rules-card conditions compare with fixed values, so use one rule per threshold.

Maintenance and floods. Mute a tank before cleaning or gauge work; alarms are still recorded, marked as muted, and the mute ends by itself (90 days at most). Above 20 notifications a minute Hermetry sends a five-minute digest; still keep mains failure Critical and its consequences at lower severity with longer debounce.

Automation and integrations

• Read-only by design. This blueprint sends no commands. Valve moves, pump starts and overfill trips stay in the depot control and safety systems.
• Transfers: a Rules-card rule can notify the scheduling team when a tank's inlet opens and again when level_pct passes 90, giving receipt progress messages without another system.
• Webhooks: alarm.created, alarm.acknowledged and alarm.cleared, signed with HMAC, feed the terminal's incident log or the CMMS. A flow can post a Critical bund alarm to a ticketing system through a configured HTTP endpoint with bearer or OAuth 2 client credentials.
• Stock systems: the stock or ERP system can read levels and volumes from the REST series API with an API key that is read-only, expires and is limited to the system's network. Hermetry figures are operational; official stock and custody transfer stay in the systems certified for them.
• Reporting: history tables download to Excel for daily stock sheets and monthly movement reviews. Scheduled, e-mailed reports are not built in today.

For support work, an engineer can open a licensed router's web panel through router remote access: an outbound tunnel, no inbound port, sessions limited to 4 hours and audited.

Roles and access

Who	Role or group	Can
Depot operator	User + IoT operator group	See their depot, acknowledge alarms, add notes, switch the depot's rules to Manual.
Scheduler	User + IoT viewer group	Read all depots, export history, no changes.
HSE officer	User	See bund and safety indications, acknowledge HSE alarms.
Terminal manager	User	See all depots, acknowledge alarms.
Automation engineer	Admin	Edit profiles, alarm rules, flows, drawings; mute tanks; roll out firmware; manage remote settings.
IT owner	Owner	Members, sign-in policy (2FA, SSO), API keys, firmware signing keys.

Attribute-based policies can narrow an operator to their own depot, or a storage client to their own tanks; test them with the policy simulator before go-live. The audit log records sign-ins, role changes, acknowledgements, alarm rule changes, attribute writes (keys, not values), mutes and firmware actions in a verifiable hash chain that can be exported for HSE audits.

Sizing and data

As an order of magnitude for two depots with 12 tanks and 4 bunds each:

• Tanks: 24 tank devices, one message a minute each: 24 × 1,440 = 34,560 messages a day.
• Bunds: 8 bund devices, a heartbeat every 5 minutes plus events, about 300 a day each: 2,400 a day.
• Depot devices and gateways: one message a minute each: about 2,900 a day.
• Total: roughly 40,000 messages a day, about 1.2 million a month. The estimate counts one message per device per reading; size the plan on that until you have measured your own traffic. Telemetry and attribute messages count toward the allowance; commands, alarms and connection events do not.
• Values: about 12 per tank message, so roughly 420,000 values a day, around 150 million a year.

The plan's retention class sets how long history is kept: raw readings for up to 90 days (in the one- and three-year classes), minute aggregates for up to 31 days, and hourly and daily aggregates for the full class length. Incident investigations therefore have every reading for three months and hourly minimum, maximum and last values for years; export raw data you must keep longer. The plan warns at 80 % and 100 % of the monthly allowance; devices are not stopped.

Rollout plan

Phase	Weeks	Work	Exit criteria
0. Survey	1-2	Gauging system interface and register map, PLC tags, available contacts, network path; agree measures and limits per tank.	Signed point list and attribute sheet per tank.
1. Pilot depot	3-8	Gateway, tank and bund profiles, root flow for level rate, depot overview, one layout drawing, alarm rules.	Two weeks of levels matching the gauging system within its resolution; every alarm forced end to end; schedulers accept volumes.
2. Network stock	9-12	Network stock board, Excel exports, webhooks to the incident log, display link in the control room.	Daily stock sheet produced from Hermetry for two weeks in parallel with the old one.
3. Remaining depots	13+	One depot every one or two weeks with baselines for gateway settings.	All depots online; movement alarms reviewed weekly with fewer nuisance events than the agreed limit.

Commissioning checklist

1. Gateway claimed on Depot gateway, certificate active, placed on the depot asset.
2. Each tank child device renamed to its tag, on Storage tank, placed on its tank asset; attributes high_level_mm, low_level_mm, max_water_mm, max_temp_c and reference_height_mm present.
3. Level, temperature, water bottom and volume compared with the gauging system's display for every tank; units and decimals correct.
4. High-high switch seen during the overfill protection system's own proof test: Hermetry shows hh_switch true and raises the Critical alarm. Coordinate with the safety team; never trip the switch for Hermetry alone.
5. Valve positions watched during a planned transfer and seen with the right sense.
6. Movement logic checked with the flow test runner on recorded readings before the alarm goes live.
7. Bund hydrocarbon sensor tested with its test kit; bund water level read against a dip.
8. Offline test: uplink unplugged for 15 minutes; offline alarm raised; buffered readings fill the gap after reconnection.
9. Problems tab of every drawing empty; runbook texts filled in.

Pitfalls

• Treating Hermetry as the gauging system. Volumes for custody transfer and official stock come from the certified gauging and stock systems. Hermetry shows and checks them.
• Movement alarms without valve signals. Without reliable valve positions, every transfer looks unexplained. Wire the closed limit switches first.
• A deadband that hides a frozen gauge. Keep a heartbeat and the gauge_ok status so a stuck value is visible.
• One limit for all tanks. Use per-tank attributes; a missing attribute means that tank is not checked, so audit them.
• Drifting clocks. Level rate depends on the time between readings; a gateway with a drifting clock produces false rates.
• Electronics in a hazardous zone without the right certification. Settle area classification before choosing sensor positions.

What Hermetry does not replace

Hermetry monitors and alerts. Overfill protection, emergency shutdown, fire and gas detection and every other safety function stay in certified, independent safety systems and must keep working when the link or the platform is down; Hermetry reads their states for indication only. The tank gauging system remains the reference for level and volume, and official stock, custody transfer and regulatory reporting stay in the systems certified and approved for them.