Abstract: A fail-safe fluid transfer control apparatus has full redundancy in the response to various inputs such as overfill probe signals, ground detection signals, and the like. Independent microprocessor controllers independently evaluate the inputs and each output control signals to close a respective relay when the inputs indicate that fluid transfer may commence. The relays are arranged in series such that both must be closed for a fluid transfer to commence. The control signals from each controller include a static signal and an alternating signal, both of which must be properly output to close its respective relay. Each controller monitors the state of each relay, and discontinues its control signals if either relay appears to be malfunctioning. Each controller runs an different, independently written firmware program to process the detected inputs to prevent a common firmware error.