Why Independent Tank Gauging and Safety Systems are Critical for IGC Code Compliance

Distinguishing Safety from Measurement
Although the tank gauging system and the safety system are complementary in purpose, they are different in nature. The tank gauging system supports operational efficiency and commercial accuracy, while the safety system is designed to function under abnormal or failure conditions. This distinction underpins a long-established principle in safety engineering: that critical safety functions should be independent from operational measurement systems. This ensures that a failure in one system does not compromise the other, preserving a critical layer of protection.

The Emergence of Integrated Solutions
Historically, gas carriers have adhered to this principle by maintaining a clear separation between tank gauging and safety instrumentation. However, in recent years, some solutions have emerged that integrate safety functionality within the tank gauging system. This shift has largely been driven by efforts to reduce installation complexity and capital expenditure, particularly in newbuild projects where space, weight and cost considerations are tightly managed.

While such integration may appear efficient, it introduces a significant risk. If the tank gauging system were to experience a fault – whether due to sensor failure, signal error or software malfunction – the safety functions that depend on it could also be compromised. In effect, a single point of failure could disable both the system used to monitor tank levels and the system designed to prevent dangerous overfill conditions.

What the IGC Code States
The current version of the IGC Code, adopted in 2016, stipulates that every cargo tank on board a liquefied gas carrier must be equipped with at least one level indicator, one high-level alarm, and one overfill alarm. It also specifies that the high-level alarm must operate independently of the level indicator, and that the overfill alarm must be independent of the high-level alarm. However, it does not explicitly state that the overfill alarm must also be independent of the level measurement system. Some stakeholders have interpreted this omission as a justification for integrating overfill alarm functionality within the tank gauging system. However, this interpretation does not align with the broader objective of the IGC Code, which is to ensure the highest possible level of safety in the transport of liquefied gases.

SIGTTO Recommendations
The Society of International Gas Tanker and Terminal Operators (SIGTTO) is a respected organisation representing a broad range of gas tanker and terminal operators. One of its primary objectives is to promote safety and operational reliability across the industry. SIGTTO, which holds consultative status with the IMO, has observed that integrating safety-related functionality within tank gauging systems represents a misinterpretation of the intent of the IGC Code. SIGTTO’s 2021 publication, ‘ESD Systems - Recommendations for Emergency Shutdown and Related Safety Systems’, states that to minimise risk, gas carriers should not be allowed to employ solutions where safety functionality is integrated into the tank gauging system.

Other Regulations and Guidelines 
Several other international organisations have regulations and guidelines that support the necessity for clear independence between safety functionality and the tank gauging system on gas carriers. For example, the US Coast Guard’s (USCG) Code of Federal Regulations stipulates that the overfill alarm must be independent of the tank gauging system. The code states: “Independence as applied to two systems means that one system will operate when there is a failure of any part of the other system.” This wording clarifies that the tank gauging system must be kept separate from safety functions, raising doubts that the USCG will accept integrated solutions for gas carriers entering US waters in the long term. Another example is provided by the Marine Environmental, Safety and Quality Assurance Criteria of ExxonMobil. This specifies that all cargo tanks must be equipped with an independent high-level alarm in addition to any alarms incorporated into the tank gauging system.

The IGC Code Clarification
In response to concerns about the current wording of the IGC Code and the potential for misinterpretation, the IMO is expected to introduce a clarification. The forthcoming revision, scheduled to be published in 2028 and applied to vessels constructed on or after July 1, 2028, will explicitly require that high-level and overfill alarms are independent not only of each other but also of any level measurement devices.

This change does not represent a shift in philosophy, but rather a formalisation of what has always been the intended interpretation of the code. By making this requirement explicit, the IMO aims to eliminate ambiguity and ensure consistent application across the industry. For shipowners, shipyards and system integrators, this clarification has important implications. It effectively closes the door on integrated solutions that combine measurement and safety functions, instead requiring that systems be designed with clear and demonstrable independence.

Technology Considerations: Float Versus Radar
The choice of level measurement technology plays a crucial role in achieving compliance with the IGC Code while maintaining operational efficiency. Traditional float-based devices, while simple and relatively inexpensive, present several limitations in cryogenic environments. Their reliance on mechanical components makes them susceptible to wear, sticking or failure, particularly under extreme temperature conditions. Maintenance can be complex and often requires intrusive procedures, including gas-freeing the tank, which introduces additional operational challenges and safety risks. Proof-testing, an essential requirement for safety systems, can also be time-consuming and labour-intensive when it involves manual manipulation of mechanical components.

Because of these issues and challenges, radar-based measurement technology has become the preferred solution on modern gas carriers. By using microwave signals to determine liquid levels, radar gauges eliminate the need for moving parts within the tank, significantly improving reliability. They are capable of delivering high accuracy even in challenging conditions and can be proof-tested remotely from the control room, allowing operators to verify functionality without direct interaction with the tank.

Designing Compliant System Architectures
When it comes to system architectures, achieving full independence can be approached in different ways. One option is to install four separate radar devices per tank, each dedicated to a specific function: primary level measurement, secondary level measurement for redundancy, high-level alarm and overfill alarm. This approach provides a straightforward path to compliance, as each function is clearly segregated. However, it also increases system complexity, installation effort and cost. Each device generally requires its own still pipe – i.e., a vertical tube that guides the radar signal in a straight path and provides a controlled measurement environment by isolating the instrument from turbulence, foam or obstructions that could weaken the signal and cause inaccurate readings. On large gas carriers still pipes can extend more than 50 metres in length, adding to both structural complexity and material expense.

An alternative approach is to implement a solution that is based on ‘2-in-1’ radar technology. In this innovative concept, dual radar level gauges – such as Emerson’s Rosemount™ TGU 53 and OFC Tank Radar Gauges – can be used for primary and secondary level measurement, while a second dual unit provides independent high-level and overfill alarms. Although the units share a physical housing, their measurement functions and internal electronics remain completely independent, ensuring compliance with the requirement for separation. This approach reduces the number of required installations and requires only two still pipes – one for measurement and one for safety – thereby simplifying design and reducing costs.

Summary
The expected clarification of the IGC Code serves to reinforce a fundamental principle that underpins safe operations in the gas shipping industry: safety systems must be capable of functioning independently under all foreseeable conditions. As the 2028 implementation date approaches, the industry has an opportunity to align more closely with best practices and adopt solutions that prioritise independence. 2-in-1 radar technology provides a practical path to compliance, combining installation efficiency with fully independent measurement and safety functions. By enabling clear separation within a streamlined architecture, it supports the intent of the IGC Code while optimising space, cost and operational reliability. In adopting such approaches, shipowners and operators will not only ensure compliance with evolving regulations but also strengthen the overall safety framework that protects personnel, assets and the environment.

For more information read our white paper ‘Separation for Increased Safety: Independent Level and Overflow Control Compliant with the Forthcoming IGC Code’