Refuelling Systems and Fuel Jettison

Fuel goes into an aircraft, and sometimes comes out again, through its refuelling system. On a light aeroplane that is little more than a filler cap on each tank; on a transport aircraft it is a closed circuit: one coupling under the wing feeds a manifold to every tank, valves open and close under the control of a panel set to the quantity ordered, and level sensors shut each tank off before it can overflow. Run in reverse, the same pipework takes fuel out for defuelling.

Some large aeroplanes can also get rid of fuel in flight. A fuel jettison system, also called fuel dumping, pumps fuel overboard so that an aircraft that must land soon after a heavy take-off can bring its mass down quickly. This article covers the systems. The precautions at the bowser, from bonding to fuelling with passengers on board, are in refuelling safety and fuel emergencies, and the tanks themselves in fuel tanks, venting and inerting.

Gravity (overwing) refuelling

Gravity refuelling, or overwing refuelling, is the simplest method. The nozzle goes into a filler opening on top of the tank and the fuel runs in, the tanks being filled one after another. It is the normal method on light aircraft, each tank having its own filler cap on the upper surface of the wing, and the quantity is checked by looking into the tank or with a dipstick (see fuel quantity and temperature indication).

With the fuel open to the air at the filler, the static precautions are strict. The aircraft is bonded to the fuelling equipment with a dedicated wire before any cap is removed, and the nozzle is bonded to the aircraft structure before the cap comes off. Funnels, filters and cans must be bonded too, and plastic funnels or pipes are never used.

Transport aircraft keep gravity refuelling as a back-up. The Airbus A320, for example, has gravity refuelling points on top of the wings through which the wing tanks can be filled.

Pressure refuelling

Pressure refuelling, also called single point pressure refuelling or underwing refuelling, is the normal method on transport aircraft. The fuel truck or dispenser connects one hose to a refuelling coupling, usually under the wing, and fuel is pumped under pressure along the aircraft's refuel gallery, a manifold with a refuel valve at the entry to each tank. ATPL texts list its advantages:

• Speed: every tank is filled at the same time from one point.
• Safety: the fuel stays in a closed system, with little spillage or vapour. The metal-to-metal contact between nozzle and coupling makes a separate hose bond unnecessary, although the aircraft is still bonded to the vehicle.
• Accuracy: the quantity for each tank is preselected, and the system stops each tank automatically.

The Boeing 737 NG has a single point pressure fuelling station in the right wing, used for fuelling, defuelling and the ground transfer of fuel between tanks. The A320 has one or two refuelling couplings under the wings, so it can be refuelled from the right side or, where a second coupling is fitted, from the left. At nominal refuel pressure the A320's wing tanks take about 17 minutes to fill, all tanks about 20 minutes, and all tanks with one or two additional centre tanks about 25 and 27 minutes.

The order in which the tanks fill protects the structure. The A320's automatic refuelling starts with the outer tanks, because their fuel is kept longest in flight for wing bending and flutter relief. When an outer tank is full, fuel overflows into the inner tank through a spill pipe, and if the load ordered exceeds the capacity of the wing tanks, the centre tank is filled at the same time. When refuelling manually, the order is wing tanks, then centre tank, then additional centre tanks. On the 737 NG the main tanks must be full if the centre tank contains more than 453 kg (see fuel mass and fuel loading).

Refuel panel and automatic shut-off

The refueller works from a refuel panel near the coupling, which shows the quantity in each tank and lets the total required be preselected. The A320's refuel control panel, under the right wing, is typical:

In automatic refuelling the system distributes the preselected total between the tanks and closes each refuel valve when the tank holds its share, or when sensors detect a high fuel level. Electrical transients, caused by switching between APU, external and engine power, can stop the process, and the preselected quantity must then be entered again. The A320 can be refuelled with only battery power: momentarily selecting the BATT POWER toggle to ON supplies the fuel quantity indication from a hot bus, the system tests itself for about 40 seconds, and the supply cuts off after 10 minutes if no refuel operation is selected, or at the end of refuelling. On the flight deck a green REFUELG memo shows while the refuel panel door is open.

On the 737 NG, opening the refuelling door powers the fuelling system through a proximity sensor; with the battery switch on, fuel pressure then opens the fuelling valves, and each tank has its own quantity indicator at the station.

The essential safeguard is the automatic shut-off. ATPL texts describe it as a high level float switch in each tank: when the fuel reaches the maximum level, it closes that tank's refuel valve. It backs up the preselected quantity, which normally stops the flow first, and it prevents an overfill that would spill fuel through the vents or overpressurise the tank. The certification rules, CS 25.979 and 14 CFR 25.979, require an automatic shut-off that stops each tank exceeding its maximum approved quantity, a means of checking it before each fuelling, an indication at each fuelling station if it fails to stop the flow, and a means of preventing damage to the fuel system if it does fail. The A320's HI LVL test is such a check, and each tank's overpressure relief valve is the last defence against a valve that stays open.

Defuelling procedures

Defuelling removes fuel from the aircraft: for maintenance, after a misfuelling, or because more fuel is on board than the next flight can carry. Topping the tanks up after the last flight limits condensation overnight, but it can leave the aircraft too heavy for the next day's payload, and some fuel then has to come out.

On the A320 the refueller sets MODE SELECT to DEFUEL XFR. This opens the refuel/defuel transfer valve, which connects the engine feed system to the refuelling gallery, so that the tank pumps push fuel back out through the refuel coupling. A tank's refuel valve also opens if its REFUEL VALVES switch is at OPEN, and an amber OPEN light shows that the transfer valve is open. The same valve lets the pumps move fuel from one tank to another on the ground. The 737 NG has a manual defuelling valve, outboard of engine No. 2, which interconnects the engine feed system and the fuelling station for defuelling and for tank-to-tank transfer.

Defuelling carries the same fire risk as refuelling, and the same precautions apply, including CAT.OP.MPA.195 when passengers are on board. The A320 limitations allow APU starts and shutdowns during refuelling and defuelling, but no APU start after a failed start or an automatic shutdown, and a normal APU shutdown if fuel is spilled.

Fuel jettison

A transport aeroplane's maximum landing mass is lower than its maximum take-off mass, because the landing gear and its attachments are designed for touchdown loads at the lower figure (see maximum structural and regulated masses). An aeroplane that must return soon after a heavy take-off can hold to burn fuel, make an overweight landing, or, if it has the system, jettison fuel. Fuel jettison is an emergency procedure to reduce mass quickly where an overweight landing could damage the aeroplane, not a routine way of adjusting the landing mass.

Not every large aeroplane needs one. Under CS 25.1001, and the FAA's 14 CFR 25.1001, a jettison system must be installed unless the aeroplane meets the landing climb requirement of CS 25.119 and the approach climb requirement of CS 25.121(d) at maximum take-off mass less the fuel for a 15-minute flight made up of a take-off, a go-around and a landing at the departure aerodrome (see approach speeds and go-around climb requirements). Jettison systems are typically found on twin-aisle and larger aeroplanes. Types without one rely on the manufacturer's overweight landing procedure; the A320 limitations permit an immediate landing above the maximum landing weight after an in-flight turn-back or diversion, provided that procedure is followed.

Where a system is required, CS 25.1001 sets its capability:

• it must jettison enough fuel within 15 minutes for the aeroplane to meet those climb requirements;
• on a turbine-engined aeroplane it must not be able to jettison the fuel in the tanks used for take-off and landing below the level that allows a climb from sea level to 10,000 ft and then 45 minutes of cruise at the speed for maximum range;
• the crew must be able to close the jettison valve at any point during the operation.

The decision to jettison rests with the commander alone, compatible with safety. In controlled airspace the crew tells ATC, and ICAO's PANS-ATM has the controller agree with the crew the route, preferably over water, clear of cities and towns and away from areas where thunderstorms have been reported or are expected; the level, not less than 6,000 ft (1,800 m), so that the fuel can evaporate before reaching the ground; and the duration. PANS-ATM states no datum for that figure, and national procedures such as the FAA's differ. ATC keeps other traffic separated from the jettisoning aircraft. ATPL texts add that once jettisoning starts, electrical switching is restricted to essential use, HF transmissions are suspended and VHF is restricted to emergency and flight safety messages.

With fire or smoke on board the crew does not delay to burn or jettison fuel; an overweight landing followed by an inspection is far preferable (see managing non-normal situations and diversion). Jettison also has a planning use: under the drift-down method of one-engine-inoperative en-route compliance, fuel may be jettisoned to the extent consistent with reaching the aerodrome with the required reserves (see one-engine-inoperative en-route performance).

Jettison valves and nozzles

The fuel leaves through jettison valves, which ATPL texts call dump master valves, typically one on each wing, at the trailing edge and well outboard. The position is chosen so that the airflow carries the fuel clear of the fuselage, engines, control surfaces and air intakes, and breaks it up into a mist that evaporates, while outlets on both wings keep the jettison symmetrical. The aircraft's own fuel pumps push the fuel to the outlets.

On the flight deck the crew normally preselects the quantity of fuel to remain, and the system stops automatically when it is reached; the crew can stop it earlier if circumstances change. Low level float switches in the main tanks keep the minimum required by CS-25 on board, so the system cannot jettison more than the rule allows. The jettison control is typically a guarded switch, so that selecting it takes two deliberate actions.

Before certification, flight trials must show that the system and its operation are free from fire hazard, that the fuel discharges clear of every part of the aeroplane, that fuel and fumes do not enter any part of it, and that jettisoning does not adversely affect controllability. The design must also ensure that no reasonably probable single malfunction can create a hazardous condition through asymmetric jettisoning or an inability to jettison fuel.

Library articles are written for study and exam preparation. They do not replace your aircraft's approved documentation, your operator's procedures or the regulations themselves.