PID level control on integrating tanks: surge, averaging and overflow risk

Tank level is the loop that makes a good temperature tuner look foolish. A self-regulating heater settles to a new temperature when you hold the output; a pumped tank with outflow independent of level does not settle at all. Hold the inlet valve a little too open and the level climbs until you overflow. Hold it a little too closed and you pump the vessel dry. That plant is an integrator. Reaction-curve rules that divide by a steady-state gain K do not apply, because there is no steady-state gain. Treating a surge drum like an oven is how you get a valve that slams every time the feed composition changes, or a level that quietly walks into a trip while the PID waits for a “time constant” that does not exist.

This article is about when level is integrating, when it is not, how averaging control uses the tank as a filter, and how to get PI numbers from an integrator-plus-delay model. Two library plants sit in PID Solver 360: the self-regulating gravity-drained tank with K = 0.8 m/%, τ = 60 s, L = 4 s, and the integrating tank with K_i = 0.02 m/(s·%), L = 2 s. Use the auto tuner on the right model. The general PID workflow is in the tuning guide and in the documentation; the physics below is inventory.

Mass balance first: two tanks that are not the same loop

A vessel of constant cross-section A (m²) has

A dh/dt = q_in − q_out

with h in m and flows in m³/s. Everything about the loop is in how q_in and q_out depend on h and on the valve.

Pumped tank, level-independent outflow. A centrifugal pump on the outlet, or a downstream flow controller holding q_out constant, makes outflow (to first order) independent of head. The inlet valve sets the imbalance:

A dh/dt = q_in(u) − q_load

Linearise q_in around a valve opening, dq_in = K_v du, and you have a pure integrator

G(s) = h(s)/u(s) = (K_v / A) · 1/s = K_i / s

with K_i in m/(s·%). There is no steady height for a given u unless q_in exactly equals q_load. A 1 % mismatch ramps level forever. Valve stroke and transmitter lag add delay, so the design model is integrator-plus-dead-time:

G(s) = K_i · e^(−L s) / s

The library integrating example uses K_i = 0.02 m/(s·%) and L = 2 s. A 1 % extra opening ramps level at 0.02 m/s, which is 1.2 m/min. That is a compact vessel or a large valve: on A = 1.0 m², K_v = 0.02 m³/s per percent, which is 72 m³/h per percent — a laboratory or skid-scale tank. A 4 m diameter surge drum (A ≈ 12.6 m²) with a 50 m³/h trim (K_v ≈ 0.14 m³/h/% = 3.9×10⁻⁵ m³/s/%) has

K_i = K_v / A ≈ 3.1×10⁻⁶ m/(s·%)

and will take hours to move a metre at 1 % mismatch. Do not copy `Kp = 2.3` from the library skid onto that drum. The SIMC formula below scales with 1/K_i; the structure is the same.

Gravity-drained tank. Outflow through a restriction depends on head, q_out = a √(2 g h) for a simple orifice. Linearise at h0:

dq_out/dh |_{h0} = a √(2 g) / (2 √h0) = q_out(h0) / (2 h0)

Then

τ = A / (dq_out/dh) = 2 A h0 / q_out
K = K_v · τ / A     (m per % inlet valve)

This plant is self-regulating: more level, more outflow, a new balance. The FOPDT tank-level example with K = 0.8 m/%, τ = 60 s, L = 4 s is that linearisation. At a 2.5 m hold, τ = 60 s implies the outflow changes enough with head that the tank “forgets” an inlet bump in about a minute. Many plant tanks with small bottom nozzles have τ of tens of minutes and look integrating on any practical tuning horizon even though a theorist can point to a pole on the real axis.

The practical test: step the inlet valve in manual and wait. If level goes to a new flat line, you may use FOPDT rules. If level holds a constant slope, you have an integrator and you must not use those rules. If level is still ramping after five minutes on a tank you believed was gravity-drained, treat it as integrating for tuning; the self-regulation is too weak to help you.

A reaction-curve K requires a settled PV. An integrating level never settles in open loop. If you wait “until it flattens” you will wait until the trip.

Why FOPDT reaction-curve rules fail on an integrator

Ziegler–Nichols, Cohen–Coon, AMIGO and the usual IMC-PID formulas all start from

G(s) = K e^(−L s) / (τ s + 1)

and they all have K in the denominator of Kp. On an integrator the open-loop step is a ramp. If you naively read “K” as the amount level moved in the first 60 s, you have invented a gain that depends on how long you watched. Wait twice as long, “K” doubles, Kp halves, and the loop is a different animal every time you bump it. That is not robustness. That is an undefined parameter.

A second failure is τ. Some fitting tools will force an FOPDT onto a ramp by choosing a huge τ and a huge K with K/τ ≈ K_i. If you then apply SIMC for self-regulating plants,

Kp = τ / [K (τc + L)]

the τ/K ratio is 1/K_i and you can luck into a sensible Kp. Ti = min(τ, 4(τc+L)) then becomes 4(τc+L) because τ is huge, which is actually the SIMC integrator rule. So a confused FOPDT fit can accidentally give the right PI if τ is large enough to clip. It can also give Ti = τ of 40 minutes and a loop that never corrects a leak. Use the integrator formulas on purpose.

A third failure is the closed-loop Ziegler–Nichols Ku experiment. An integrator plus delay does have a finite ultimate gain, so a P-only oscillation test is mathematically defined. Doing that test on a live level loop is how you splash the bund. Prefer a small open-loop ramp to read K_i and L, then compute.

How to read K_i and L from a bump:

• Controller in manual, level in a safe band (not near empty, not near the high trip).
• Step the valve by a known Δu, say 5 %.
• After the dead time, level should ramp at a constant slope dh/dt.
• K_i = (dh/dt) / Δu.
• L is the time from the OP step to the start of that ramp.

On the library skid, Δu = 5 % should produce dh/dt = 0.10 m/s after about 2 s. If the ramp bends over, gravity drain or a changing pump curve is appearing and the pure integrator is only an approximation around that level.

Surge versus tight level: decide the job before the gains

Not every level loop is a quality loop. Most are inventory loops. The tank exists to absorb upstream and downstream flow disturbances so that the next unit sees a smooth feed. That is surge or averaging level control. A minority of levels are tight: a crystalliser interface, a boiler drum, a reactor weir, anything where the level is the product spec or the safety constraint.

The two jobs want opposite PIDs.

Tight level: keep h close to SP despite load changes. Use higher Kp, shorter Ti, accept a lively inlet or outlet valve. The valve is allowed to move quickly because the vessel is not there to filter flow.

Averaging (surge) level: let h wander in a wide band — 30–70 % is a classic — so that the manipulated flow stays almost still while upstream noise comes and goes. Use low Kp, long Ti (or P-only with a well-chosen bias). The tank is the filter. If you “improve” an averaging loop until the level is a flat line, you have moved every disturbance into the outlet flow and the downstream composition controller will hate you.

A numeric illustration on the library integrator, K_i = 0.02 m/(s·%), L = 2 s, vessel from 1 m to a 3 m setpoint, 0–100 % valve. Tight SIMC with τc = L = 2 s:

Kp = 1 / [K_i (τc + L)] = 1 / (0.02 × 4) = 12.5 %/m
Ti = 4 (τc + L) = 16 s

That Kp means a 0.1 m error already asks for 1.25 % more valve, and a 1 m error asks for 12.5 %. On a skid with 1.2 m/min ramp capability that is snappy. On a plant drum it would be violent if K_i were copied wrong — but on this skid it is “tight”. The library instead uses averaging-style SIMC with τc = 20 s:

Kp = 1 / [0.02 × (20 + 2)] = 2.27 %/m
Ti = 4 × 22 = 88 s

which matches the library Kp = 2.3, Ki = 0.026 (Ti = Kp/Ki ≈ 88 s), Kd = 0. A 1 m error asks for only 2.3 % extra valve. Level is allowed to swing; the valve does not.

Pick τc from the allowed level swing and the size of the expected flow step, not from a habit. A 10 % inlet-flow step lasting a long time will ramp the integrating tank until the PI corrects it. Roughly, the peak level error on a sustained load step Δq for SIMC averaging is on the order of K_i and τc combined — simulate it. If a 10 % load step drives level through the high trip, τc is too long or the trip is too close to SP.

P-only versus PI on level

P-only is legitimate on surge tanks and almost never legitimate on a tight spec.

A proportional controller on an integrator can hold a constant load with zero error only if the bias (manual reset) is exactly the valve position that matches that load. When the load changes, the new balance requires a new valve position, which P-only can only produce with a standing error:

u = u0 + Kp (SP − h)

At equilibrium on an integrator you need u = u_load. Therefore

h_ss = SP − (u_load − u0) / Kp

Level droops as throughput changes. That is averaging by construction: high feed rate sits the tank a little low (if you are throttling the inlet — signs depend on whether you manipulate in or out). Operators who understand droop will set SP in the middle of the band and size Kp so that the level stays inside 20–80 % over the whole rate range. Example: rate range needs 20 % to 70 % valve, u0 = 45 %, Kp = 2 %/m on a 0–4 m transmitter. The droop for a 25 % valve change is 25/2 = 12.5 m, which is more than the tank — that Kp is too small for the valve range. Raise Kp until the droop over the production rate range fits in the allowed band, e.g. 1.5 m of allowed wander → Kp ≥ 25 % / 1.5 m ≈ 17 %/m on that arithmetic. Then check stability with L included; on a slow drum L is seconds and Kp = 17 %/m may still be fine, on the fast library skid it may not.

PI removes droop: the integrator finds u_load and h_ss = SP. On a surge tank that is not always a gift. Zero offset means the loop will slowly drag level back to SP after a rate change, and while it does so it will move the manipulated flow in a long tail. If the point of the tank was to keep that flow still, a slow PI with large Ti is a compromise: no long-term offset, but almost P-like over the hour. SIMC’s Ti = 4(τc+L) with a large τc is exactly that compromise. Tyreus–Luyben is in the same spirit: conservative Kp, long Ti.

Derivative on level is usually off. A DP level transmitter on a boiling or bubbling surface is noisy; a radar can be quieter. Tight boiler-drum control sometimes uses a little D, filtered, and often uses three-element feedwater (steam flow feedforward plus level). For a surge drum, Kd = 0. If you need damping, you wanted a different Kp, not a differentiator. Structure guidance matches P, PI, PD or PID: P or PI for inventory, PID only for the rare tight, clean, laggy level.

Integrator-plus-delay tuning: SIMC and Tyreus–Luyben

SIMC for G = K_i e^(−L s)/s is the pair you should memorise:

Kp = 1 / [ K_i (τc + L) ]
Ti = 4 (τc + L)
Kd = 0

τc = L is the tightest Skogestad recommends; larger τc is averaging. Parallel Ki = Kp / Ti. For the library skid with τc = 20 s, L = 2 s, K_i = 0.02:

Kp = 2.27 %/m
Ti = 88 s
Ki = 0.0258  (library 0.026)

For a plant surge drum with K_i = 3.1×10⁻⁶ m/(s·%), L = 5 s, and averaging τc = 600 s (ten minutes — you are using the volume):

Kp = 1 / [3.1e-6 × 605] ≈ 530 %/m
Ti = 4 × 605 ≈ 2420 s  (40 min)

Kp = 530 %/m looks alarming until you remember a 0.1 m error is 53 % valve on a tank whose whole span might be 4 m. You will often clip `Kp` so that a full-span error cannot demand more than 100 % valve, and you will use SP in percent of span. In percent-of-span, with a 4 m span, K_i becomes 7.75×10⁻⁵ %span/(s·%valve) and Kp is in %valve/%span. Do the conversion on paper once. This is the same units trap as on flow, except a factor-of-a-thousand error on level overflows the tank instead of wearing a trim.

Tyreus–Luyben PI from the ultimate point is the other industrial default for integrating and sluggish loops. Identify Ku and Pu with a relay or from the model (do not cycle a live drum into a trip). Then

Kp = Ku / 3.2
Ti = 2.2 Pu

TL is slower than Ziegler–Nichols (Kp = Ku/2.2, Ti = 2.2 Pu for PI) and is meant to avoid the quarter-decay ring. On an integrator-plus-delay, Ku and Pu are set by K_i and L. For a delay-dominated integrator the ultimate period is on the order of 4 L in the simplest approximations, but use the exact argument condition rather than folklore when you have the tuner. Compare TL and SIMC on the same model in the simulator with the high-level and low-level trips drawn as horizontal lines, not as afterthoughts.

IMC for integrators is SIMC’s parent: choose a closed-loop time constant, invert the model, add the delay carefully. You will land on the same Kp–Ti pair. Cohen–Coon does not have a legitimate integrator version; do not use it.

Ziegler–Nichols open-loop (reaction curve) should not be used. Closed-loop ZN on an integrator is often too aggressive for a vessel with a nearby trip. If you want a fast tight level (small reflux drum, tight interface), SIMC with τc = L or a carefully checked ZN is the neighbourhood; still simulate the trip margins.

Cascade: inner flow, outer level

The best tight and the best averaging implementations often put a flow PI on the valve and let level write the flow setpoint. The inner loop eats valve nonlinearities and header pressure; see flow-loop practice. The outer loop is then a cleaner integrator, K_i in (m/s) per (m³/h of SP), with a little extra L from the flow loop’s settling.

Averaging master: slow PI or P-only writing a flow SP that barely moves. Tight master: faster PI, still usually Kd = 0. Anti-windup on the master must freeze when the flow valve is at a stop, or the level integral will wind during a pump trip and flood the tank when the pump returns. The same back-calculation idea as anti-windup applies; the consequence of getting it wrong is a spill, not a scorched wafer.

Do not cascade level onto a temperature loop. Heat does not move inventory except in the slow sense of density, which is not this problem.

Gravity-drained versus pumped: a numeric pair you can simulate

Take a tank A = 2.0 m², normal level h0 = 2.0 m, normal throughput q = 10 m³/h = 0.00278 m³/s.

Gravity drain. A bottom orifice sized for 10 m³/h at 2 m head has q_out = k √h with k = 0.00278/√2 = 0.00196 m²·⁵/s. Then

τ = 2 A h0 / q = 2 × 2.0 × 2.0 / 0.00278 ≈ 2870 s  (48 min)

If the inlet valve has K_v = 0.20 m³/h per percent (5.56×10⁻⁵ m³/s/%),

K = K_v / (dq_out/dh) = K_v · τ / A ≈ 0.080 m/%

Dead time from a slow valve and a damped DP: L = 4 s. L/τ ≈ 0.0014 — extremely lag-dominant. FOPDT SIMC with τc = 60 s (you do not want a 48 min closed-loop time):

Kp = τ / [K (τc + L)] ≈ 2870 / (0.080 × 64) ≈ 560 %/m
Ti = min(2870, 4×64) = 256 s

K = 0.08 m/% means a 10 % valve move is 0.8 m of steady-state level change, which is moderate. Kp = 560 %/m would still saturate on a 0.2 m error. The formula is telling you the linearised plant has a long τ and a modest K, so SIMC wants high gain to make the closed loop faster than 48 min. On the real tank you will hit valve limits and noise first. This is why gravity tanks with weak self-regulation are often tuned as integrators with a conservative τc, even though a FOPDT exists. The library gravity example chose a much stronger self-regulation (τ = 60 s, K = 0.8 m/%) — a small tank or a large drain — so that a FOPDT PID with Kp = 12, Ki = 0.2, Kd = 8 is even plausible. Treat that example as a fast self-regulating level, not as a 50 m³ surge drum.

Pumped outlet, same `A` and `K_v`. Outflow is 10 m³/h regardless of head (flow controller or a tall discharge head). Then

K_i = K_v / A = 5.56e-5 / 2.0 = 2.78×10⁻⁵ m/(s·%)

A 5 % valve mismatch ramps at 1.39×10⁻⁴ m/s ≈ 0.50 m/h. From 2.0 m, you have on the order of two hours to a 3 m high trip if the PI is in manual — slow enough that operators miss it on a busy board, fast enough to be a real spill if nobody is looking. SIMC averaging with τc = 600 s, L = 4 s:

Kp = 1 / [2.78e-5 × 604] ≈ 60 %/m
Ti = 2416 s

A 0.5 m error asks for 30 % extra valve: visible, not hysterical. Tight control with τc = 20 s would give Kp ≈ 1800 %/m, which will fight every bubble in the DP; do not do that on a surge drum.

Run both models in PID Solver 360. The gravity library plant is the fast self-regulating cousin; the integrating library plant is the fast pumped cousin. Neither is the 48-minute gravity tank; you must change K, τ or K_i to match the vessel you have. The industrial applications overview places these next to ovens and flow loops so the time scales stay honest.

Emptying and overflow are the real cost functions

IAE on a level loop is a weak spec. The real constraints are:

• Low-low trip, NPSH, agitator blades, heater elements that must stay covered.
• High-high trip, relief, overflow to bund, off-spec from a flooded condenser.

A PI that is “a bit slow” on a temperature loop wastes time. A PI that is a bit slow on an integrator wastes the tank. During a large load step the level will ramp until the integral catches up. You must simulate the worst Δq with the valve already near a stop.

Worked risk on the library integrator. Level 1 m, SP 3 m, K_i = 0.02 m/(s·%), valve 0–100 %. During the climb the error is large and OP will saturate at 100 %. With anti-windup the integral does not keep charging past the stop; without it, you overshoot 3 m by a wide margin and may hit a 3.5 m trip. Enable anti-windup. Even with it, if a load (extra outlet flow) appears while you are already at 100 % inlet, level falls and you cannot do more than 100 %. The PID is not a bigger pump. Alarms and a sized trim are part of the control scheme.

Setpoint in the middle of the band is an averaging habit: room to absorb both directions. Tight levels sit near a process optimum and need a closer trip or a larger vessel. Never set SP 5 cm below a high-high on an averaging loop with τc = 10 min.

Rate limits on the valve help averaging: the level PID may ask for a jump; a 2 %/s clamp on OP keeps the downstream flow from spiking. The level will then use more of the tank. That is the correct trade.

P-only with too little Kp looks “smooth” until a rate change walks the level into a trip with a standing offset. That is the droop equation, not a surprise. Size Kp from the band, then confirm the ramp rate at the valve’s remaining authority still beats the trip.

Pitfalls that show up on the night shift

Using FOPDT Ziegler–Nichols because the DCS tuner asked for an S-curve. The S-curve never arrived. Someone fitted noise. Kp is random.

Tight tuning on a surge tank to make the trend look professional. Downstream flow now carries every upstream blip. Composition loops ring. Put the variance where the tank was bought to put it.

Derivative on a noisy DP. The valve follows the bubbles. Operators put the loop in manual. You have lost inventory control.

Wrong manipulated stream. Throttling the inlet versus the outlet flips the sign and flips whether a high load fills or empties the tank. Direct/reverse action must match. A pumped outlet throttle on an integrating tank is still an integrator.

No cascade when the valve is equal-percentage and the header swings. Level then fights installed gain. A flow slave is cheaper than a spill.

Copying library `Kp = 2.3` onto a 200 m³ tank. K_i was 0.02 on a skid. On the 200 m³ tank K_i might be 10⁻⁵. The SIMC Kp scales as 1/K_i.

Minutes versus seconds on `Ti`. Averaging Ti = 40 min entered as 40 s is tight control by accident.

Ignoring the second independent outflow. A manual bleed, a sampling pump, a leaking drain — a constant unmeasured q — is a load. PI will offset it; P-only will droop. If the leak can grow, you need a low-level trip, not more Kd.

Tuning in a simulator without trips drawn. Closed-loop metrics that look excellent can still have peaked 0.2 m above a trip you forgot to model. Put uMin/uMax and the legal PV band into the experiment.

A commissioning sequence for level

Decide surge versus tight. Write the allowed band and the trips on the loop sheet. Identify integrating versus self-regulating with a small manual bump in a safe band. Fit K_i and L, or K, τ and L if it truly flattens. Compute SIMC with τc from the band (large for surge, ~L for tight). Keep Kd = 0 unless you have a documented tight, clean application. Enable anti-windup. If the valve is nasty, add a flow slave first.

Simulate the design load step and the start-up (library: 1 → 3 m) in the solver with limits on. Look at whether OP saturates and whether PV enters the trip band. Then, on the plant, a 2–5 % SP change in auto — not an empty-to-full fill — and watch both ends of the tank. If you need to fill from empty, use a ramp or a sequenced pump start; do not ask averaging PI to be a filling machine.

When the linear model is right but the cost is “stay out of the trip and do not move the outlet much”, the optimiser can trade those terms. It cannot invent hold-up that the mechanical designer did not provide.

Level control is inventory control. The PID is a small part of a scheme that includes vessel volume, trip setpoints, a valve that can actually match the load range, and a decision about whether this tank is a filter or a spec. Use integrator rules on integrators, FOPDT rules only when the bump test truly settles, and put derivative back on the oven where it belongs. The complete PID guide will not contradict that; it will only remind you that Ki still has units, and on a tank those units are the difference between a quiet night and a bund.