For my ATO, i have double/triple fail safe.
1. Tunze have both secondary sensor (float sensor) and max on time beside the primary optical sensor. If all fails-
2. Secondary optical water sensor that will power off tunze if water lever get too high
My ATO reservoir is 4G but its auto-refill ...