Refuelling Safety and Fuel Emergencies

Refuelling is one of the few moments when a large quantity of fuel is exposed to the open air next to an aircraft, vehicles and people. A refuelling fire needs two ingredients: fuel vapour, and a source of ignition such as a spark from static electricity, an electrical fault or a running engine. The precautions below exist to keep those two apart. A second set of checks makes sure that what goes into the tanks is the right grade, in the right quantity, and free of water and dirt.

The same fuel, badly managed, causes emergencies in flight. An aircraft can run out of fuel, fail to get the fuel it has to the engines, or lose it through a leak. The pilot's defences are the same in each case: know how much fuel is on board, know where it is, and notice early when the figures stop adding up.

Refuelling and defuelling

Refuelling puts fuel into the tanks; defuelling takes it out, for example for maintenance or when too much has been loaded, and the same precautions apply to both. Light aircraft are usually filled over the wing through a filler cap on each tank. Transport aircraft use pressure refuelling: a single connection, normally under the wing, feeds every tank through a manifold. It is quick, it keeps the fuel in a closed system with little spillage or vapour, and it is accurate, because the quantity for each tank is preselected on the refuel panel. US certification rules (14 CFR 25.979) require an automatic shut-off that stops each tank exceeding its maximum approved quantity. On the A320, for example, each tank's refuel valve closes at the preselected load or when a high-level sensor detects that the tank is full, so that it cannot overflow.

The fuelling staff do the physical work, but the pilot checks the result: the grade and quantity ordered, the precautions in force, and what was actually delivered.

Bonding and static electricity

Fuel flowing through hoses, filters and nozzles generates static electricity. If the aircraft and the fuelling equipment sit at different potentials, a spark can jump between them as the nozzle approaches the filler, exactly where the vapour is richest.

Two kinds of bonding prevent this. Aircraft bonding is built into the airframe: flexible braided straps connect the structure and its components so that every metal part sits at the same electrical potential. Their contact surfaces must be clean bare metal, because paint, anodising or grease would add resistance. Refuelling bonding connects the aircraft to the fuelling equipment:

• The aircraft is bonded to the fuel truck or dispenser with a dedicated bonding wire and clip before any filler cap is removed. A conductive hose is not relied upon for this.
• For over-wing fuelling, the nozzle is also bonded to the aircraft structure before the cap comes off. Funnels, filters and cans must be bonded too, and plastic funnels or pipes are never used.
• For pressure refuelling, the metal-to-metal contact between nozzle and aircraft coupling makes a separate hose bond unnecessary, although the aircraft is still bonded to the vehicle.

Fuelling zone precautions

The fuelling zone extends at least 6 m (20 ft) around the filling and venting points on the aircraft and on the fuelling equipment. Inside it:

• nobody smokes, and only authorised people and vehicles, kept to a minimum, may enter;
• the aircraft's engines are not operated, and the APU exhaust must not discharge into the zone, or the APU is started before the filler caps are removed;
• strobe lights are switched off, and only certified flameproof or intrinsically safe torches and lamps are used, designed so that they cannot release enough electrical or thermal energy to ignite vapour;
• the weather radar does not transmit, because its microwave energy can ignite fuel vapour and injure people nearby.

Aircraft manuals add their own rules. The A320's limitations, for example, allow APU starts and shutdowns during refuelling, but not a restart after a failed start or an automatic shutdown, and call for a normal APU shutdown if fuel is spilled.

View full schematic

Refuelling with passengers on board

Turnaround times make it attractive to fuel while passengers are boarding, seated or leaving. Under EASA's CAT.OP.MPA.195, an aircraft must not be refuelled or defuelled with AVGAS or wide-cut fuel such as Jet B, or a mixture of them, while passengers are embarking, on board or disembarking. These fuels give off ignitable vapour at ordinary temperatures.

With kerosene-type fuels such as Jet A-1 it is permitted if the necessary precautions are taken and the aircraft is properly manned by qualified personnel ready to start and direct an evacuation. The AMC lists them:

• one qualified person at a specified location, in two-way communication with the ground crew supervising the fuelling;
• crew, staff and passengers warned that fuelling will take place;
• seat belt signs off, no smoking signs on, and enough interior lighting to identify the emergency exits;
• passengers told to unfasten their seat belts and not to smoke;
• enough qualified personnel on board for an immediate evacuation;
• the ground beneath the exits intended for evacuation kept clear, and ground equipment positioned so that those exits and escape routes from them remain usable;
• fuelling stopped immediately if fuel vapour is detected inside the aircraft or any other hazard arises.

Fire extinguishing equipment and people trained to use it must be available, with a means of calling the rescue and fire-fighting service.

Hot refuelling

Hot refuelling means refuelling with an engine running. EASA's rules provide for it mainly for helicopters, as refuelling with engines running or rotors turning under specific conditions (for example SPO.OP.157 for specialised operations). Because the normal fuelling zone rules require engines to be stopped, and a running engine is itself an ignition source beside the vapour, hot refuelling is done only where the aircraft's manuals and the operator's procedures specifically provide for it.

Fuel spills

A fuel spill during fuelling is handled as a fire risk until the fuel has been dealt with. Fuelling stops and the rescue and fire-fighting service is called. Ignition sources are kept away from the vapour; on the A320, as noted above, the APU is given a normal shutdown. At aerodromes, foam, usually aqueous film-forming foam (AFFF), is the agent for fuel spills and fuel fires: the foam floats on the liquid, excludes oxygen and prevents re-ignition.

Misfuelling and the fuel delivery note

Misfuelling is filling an aircraft with the wrong grade. The dangerous case is jet fuel in a piston engine. AVGAS is dyed so that the grade can be recognised: 100LL is blue, grade 100 green, and the old grade 80 was red. Jet A-1 is not dyed and ranges from straw-coloured to colourless, with a smell of paraffin and an oily feel. A spark-ignition engine run on jet fuel has almost no resistance to detonation. It will usually start and may run at low power, then detonate and fail when take-off power is applied, typically just after lift-off. A ground run proves nothing, and partial draining leaves contaminated fuel in the lines. The whole system must be drained and inspected before flight. A lower grade of AVGAS than the one placarded is never acceptable, while a higher grade may be used where the flight manual permits it.

The fuel delivery note, or fuel receipt, records what was actually delivered. The pilot compares its grade and quantity with what was ordered and with the gauges. Units are a classic trap. Fuel is delivered by volume but planned by mass, and the conversion needs the specific gravity, about 0.8 for Jet A-1. If 10,000 litres at a specific gravity of 0.75 were entered on the load sheet as 10,000 kg, the aircraft would carry only 7,500 kg, 2,500 kg less than the crew believed (see fuel mass and fuel loading).

Fuel sampling and contamination checks

Water is the most common contaminant. It enters mainly as condensation in partly empty tanks, and through leaking caps and seals after rain. Being denser than fuel, it collects at the lowest point of each tank, where the drain is fitted. Microbiological growth at the fuel-water interface can also block filters in turbine fuel systems.

The fuel contamination check consists of draining a sample from each tank sump and from the fuel strainer into a clear tester, before the first flight of the day and after every refuelling, allowing a few minutes for water to settle first. The sample is examined for:

• water, which shows as clear beads or a layer beneath the fuel. A cloudy haze that sinks slowly is water in suspension, while one that rises quickly is only entrained air;
• sediment such as rust or dirt;
• the wrong grade, shown by the colour and smell.

Draining continues until the sample is clean, and the drain is then checked closed. Water that keeps reappearing points to a leaking cap or seal and is a maintenance matter.

Fuel exhaustion and fuel starvation

Fuel exhaustion means that no usable fuel remains on board. It follows from poor planning, poor monitoring or an unrecognised leak. In 1978 United Airlines Flight 173 held near Portland, Oregon, while the crew dealt with a landing gear problem, and ran out of fuel with a serviceable aircraft still in the hold; the accident helped start the development of crew resource management.

Fuel starvation means that usable fuel remains but does not reach the engine. Typical causes are a fuel selector left on an empty tank, a pickup unported during a slip or uncoordinated manoeuvre with a low tank, failed booster pumps at high altitude, where suction feed may not supply the engine, a blocked filter, or water in the fuel. Crossfeed and tank selection are therefore checked before each phase of flight.

In flight, the defence against both is the fuel check: fuel on board compared with the plan and with the fuel used (see in-flight fuel management). Under SERA a pilot committed to one aerodrome, who can accept no further delay, declares MINIMUM FUEL; once the calculated fuel on landing at the nearest suitable aerodrome would be less than the final reserve, the pilot declares MAYDAY FUEL.

In-flight fuel leaks

A fuel leak is detected by arithmetic before it is seen. The signs are fuel on board falling faster than the fuel flow explains, the sum of fuel on board and fuel used falling short of the departure figure, a growing imbalance between tanks, or a mist of fuel streaming from a wing or engine. Modern designs add dedicated leak alerts, as required for example by the certification basis of the A320neo.

The fuel leak procedure of each type governs the actions, but the logic is common. The crew first confirm the leak and locate it, and do not open the crossfeed to correct the imbalance until they have done so. If the leak is in one engine's feed line, an open crossfeed does not refill the low tank; it lets fuel from the good side flow out through the leak as well. In 2001 Air Transat Flight 236, an A330 leaking fuel from a cracked tube on its right engine, ran out of fuel over the Atlantic after the crew took the leak for an imbalance and opened the crossfeed, feeding the left tanks' fuel to the leak; it glided to a landing in the Azores. If the leak is from an engine, the procedure usually leads to shutting that engine down. In every case the aircraft diverts to the nearest suitable aerodrome and the crew declare an emergency early, while the fuel still gives them options.

Library articles are written for study and exam preparation. They do not replace your aircraft's approved documentation, your operator's procedures or the regulations themselves.