At 4:47 a.m., the very-high-level alarm of kerosene storage tank in the process of being filled sounded in the control room of a refinery. As per procedure, a control-room technician activated the emergency stop of the pumps supplying the tank but nothing happened. The tank’s bottom valve was closed by the control system, stopping the transfer. A technician went to the tank and manually stopped the three pumps. He did not see any signs of an overflow. The kerosene in the tank was 6 cm below the maximum operating level.

That morning, it was found that the mechanical sensor that measures the very high level was incorrectly positioned. Modified three months earlier, it had been placed 8 cm below its theoretical level. In addition, the function to stop the supply pumps had been wired to the safety PLC two days before the event. Tests performed after this wiring work were inconclusive, as the signal lost too much intensity while being transmitted. A temporary procedure, consisting of using the emergency stop to shut off the pumps, had been established. This procedure called for pulling the button, which is what the technician did. However, the button actually had to be turned and then pulled.

That day, the operator corrected the very high level sensor’s position. He installed electrical relays to amplify the signal so that the supply pumps could be shut off from the control room. The emergency stop button was replaced by a pull switch.