Deadman Control in Aviation Refuelling

In aviation fuel operations, seconds matter. A small delay in stopping flow can increase the quantity of fuel released during a spill, increase exposure around the aircraft, and reduce the operator’s ability to respond effectively. This is why the deadman system is treated as a mandatory safety feature, not an optional convenience.

Fuel flow control is one of the most important safety functions in aircraft refuelling. During pressure fuelling, large quantities of fuel are transferred in a short time, often close to aircraft, ground support equipment, personnel, and airport infrastructure. In this environment, the ability to stop fuel flow quickly and reliably is not optional — it is a critical safety requirement.

In last week’s ARC LinkedIn quiz, we asked a simple but safety-critical question:

What happens when the operator releases the deadman control during fuelling?

The correct answer is:

B. Fuel flow stops immediately

This answer may appear simple, but the deadman control is one of the most important safety devices on an aviation refueller or hydrant dispenser. It is not only an operating control. It is a safety barrier designed to ensure that fuel flows only while the operator remains actively in control of the fuelling operation.

If the operator releases the deadman control, fuel flow must stop automatically. This protects the aircraft, the operator, the fuelling vehicle, and the surrounding ramp environment.

What Is a Deadman Control?

A deadman control is a hand-held device that must be held or activated by the fuelling operator to allow fuel to flow. When the operator releases it, the system automatically stops fuel flow.

This function is especially important during single-point pressure fuelling, where the fuelling nozzle does not have a normal trigger-style on/off mechanism like an automotive fuel nozzle. Instead, fuel flow is controlled through the fuelling equipment’s valve system, activated by the deadman handle.

In practical terms:

• The operator holds the deadman control to allow fuel to flow.
• If the operator releases the control, fuel flow stops.
• If the operator becomes incapacitated, moves away, or loses control of the operation, the system is designed to close automatically.

This is why the correct quiz answer is not «fuel flow reduces» or «fuel flow continues at a low rate.» The intended safety function is the complete shutdown of fuel flow.

Why the Deadman Function Is Critical

The correct answer is:

B. Fuel flow stops immediately

Aircraft fuelling operations involve high flow rates, complex equipment, and safety-critical interfaces between the refuelling vehicle, hydrant system, aircraft fuel system, and operator.

In this environment, any delay in stopping fuel flow can increase the consequences of an incident. A spill, hose failure, coupling issue, or abnormal condition can develop quickly. The deadman system gives the operator an immediate way to stop fuel transfer, while also stopping flow automatically if the operator is no longer able to maintain control.

The safety principle is clear:

No positive operator action = no fuel flow.

This principle protects against several operational risks, including:

• Fuel spill escalation.
• Operator incapacity.
• Loss of attention or control.
• Movement away from the fuelling position.
• Failure to respond quickly to an emergency.
• Delayed isolation of a leak or abnormal condition.

The deadman control is therefore both a technical safety device and an operational discipline. It depends on correct design, correct maintenance, and correct operator behavior.

This is also why defeating, wedging, taping, or bypassing the deadman handle is considered a serious safety violation. Doing so removes the positive-control principle and can delay the isolation of a leak or spill.

How the Deadman System Works

Deadman systems can be designed in different ways depending on the refuelling equipment. They may be pneumatic, electric, electro-pneumatic, radio-controlled, or use a combination of technologies.

On many hydrant dispensers, the deadman handle sends a signal to a pneumatic control valve. This valve sends air pressure to the hydrant coupler or to an in-line valve. When the operator releases the deadman, the air signal is removed or exhausted, causing the valve to close and stop fuel flow.

On refuellers, the deadman may act on a valve downstream of the delivery pump, through an in-line pressure control valve, or through another part of the fuel transfer control system. The exact design may differ, but the safety objective remains the same:

Fuel must only flow while the operator maintains active control.

The deadman system is therefore not just a handle or switch. It is part of the vehicle’s wider fuel control and emergency shutdown philosophy.

«Immediately» Means Automatic Shutdown — Not Valve Shock

The quiz answer says fuel flow stops immediately. Operationally, this means that releasing the deadman must automatically initiate shutdown without requiring further action from the operator.

However, from an engineering perspective, the shutdown must still be controlled.

A valve that closes too slowly may allow excessive fuel overrun after the operator releases the control. A valve that closes too violently may create pressure shock or hydraulic hammer in the system. Both conditions are undesirable.

A properly designed deadman system must therefore balance two requirements:

• It must stop fuel flow quickly.
• It must close progressively enough to avoid damaging pressure shock.

This is why deadman performance is normally assessed against defined closure time and overrun limits. The objective is not simply to close fast. The objective is to close safely and reliably, within the required performance envelope.

As an industry benchmark (JIG), the deadman control system should completely stop fuel flow within 5% of the actual fuel flow rate at the time of release. For example, if the actual fuel flow rate at the time of release is 1,500 L/min, fuel flow should stop before the overrun exceeds 75 L.

For equipment performance, the deadman opening and closing behavior is also important. The opening time should be controlled so that high pressure is not suddenly imposed on the aircraft. The industry benchmark (JIG) identifies a typical requirement of at least 5 seconds from commencement of flow to full flow, while the closure time should be progressive and normally within 2 to 5 seconds from release.

Where no specific local, national, international, or aircraft-operator requirement applies, commonly applied industry guidance gives the following reference values for deadman control performance:

Maximum vehicle flow rate	Minimum deadman opening time	Deadman closing time range	Maximum fuel overrun
< 2,000 L/min	3 seconds	> 2 but < 5 seconds	100 L
> 2,000 but < 4,000 L/min	5 seconds	> 2 but < 5 seconds	200 L
> 4,000 L/min	5 seconds	> 2 but < 5 seconds	5% of flow rate

This gives a more complete interpretation of the quiz answer:

The release of the deadman must trigger an automatic shutdown — but the system must close within controlled performance limits, not through uncontrolled valve shock.

Deadman Control and Pressure Protection

 

Pressure control is a central part of safe aircraft refuelling. Aircraft fuel systems are designed to operate within defined pressure limits. Excessive pressure or sudden pressure surge can damage aircraft fuel system components.

For this reason, refuelling vehicles and hydrant dispensers are fitted with pressure control systems such as hose-end pressure control valves, in-line pressure control valves, venturi sensing arrangements, and controlled valve opening and closing actuation.

The deadman system works alongside these pressure control functions.

When the deadman is activated, the fuel system should open in a controlled manner. This helps avoid sudden pressure application to the aircraft. When the deadman is released, the system should close quickly enough to stop flow, but not so abruptly that it creates excessive shock pressure upstream.

This makes the deadman control an important part of the complete pressure control chain. It is not isolated from the rest of the system. It must be correctly integrated with the fuelling vehicle’s valves, pump control, air system, electrical control logic, and emergency shutdown philosophy.

For pressure fuelling equipment, fuel system components are normally protected by pressure control arrangements as aircraft fuelling systems are generally designed around limits such as 50 psi / 3.5 bar at the vehicle delivery nozzle, with shock or surge protection considerations in the range of 100–120 psi / 6.9–8.3 bar.

This is why deadman opening and closing times are not only operational details. They are part of the pressure protection strategy.

Intermittent Timer: Preventing Misuse

Many aviation deadman systems include an intermittent timer feature. This requires the operator to release and re-activate the deadman at regular intervals, typically not exceeding two minutes.

This feature exists for a very important reason: it helps prevent misuse.

Without an intermittent timer, an operator could intentionally wedge, tape, clamp, or block the deadman control in the active position. This would allow fuel to continue flowing even if the operator moves away from the fuelling position.

That situation is dangerous because the operator may no longer be able to detect a spill, respond to an abnormal condition, or stop fuel flow quickly.

The intermittent timer helps ensure that the operator remains present, attentive, and actively involved throughout the fuelling operation. In many systems, a visual or audible warning is activated before shutdown. If the operator does not reset the deadman by releasing and re-pressing the control, the system automatically stops fuel flow.

The intermittent feature should require operator reactivation within a predetermined interval not exceeding two minutes, and this feature should be checked at least annually. It also notes that some systems provide a warning signal around 15 to 20 seconds before automatic shutdown, allowing the operator to release and regrip the deadman correctly.

The message is simple:

The deadman must prove that the operator is present, attentive, and in control.

Wired and Wireless Deadman Systems

Deadman controls may be wired or wireless. Both can be acceptable when properly designed, maintained, and controlled by procedure.

A wired deadman is physically connected to the vehicle by a cable. It is widely used, familiar to operators, and relatively straightforward to inspect.

A wireless deadman can provide more flexibility, particularly around large aircraft or during hydrant dispenser operations. However, wireless systems require strict operational control. The operator must remain within the permitted working distance and maintain line of sight with the fuelling equipment.

Where cordless deadman systems are used, the operator should remain within 20 meters and in line of sight of the fuelling vehicle during cordless deadman operation. The applicable requirement should therefore be confirmed against the operator’s adopted standard, local procedure, and equipment approval basis.

Wireless systems must also be managed to avoid interference with other airport systems and to prevent unintended activation of auxiliary functions. Where a cordless deadman includes a hose reel rewind function, that function should be deactivated during fuelling to prevent inadvertent hose reel operation.

Deadman Override: Backup Function, Not Routine Operation

Some refuelling equipment includes a deadman override function. This may allow the fuelling operation to be completed if the normal deadman control fails.

However, an override is not a shortcut. It must not become a normal operating method.

The preferred override arrangement is a push-and-hold type control. This maintains the positive-action principle because the operator must continue holding the override to maintain fuel flow. If an override is not of the push-button type, it should be sealed to prevent unauthorized or routine use.

Use of a deadman override should be controlled by local procedures and should normally require approval, supervision, recording, and maintenance follow-up.

A deadman override should never defeat other critical safety functions. If the vehicle is equipped with additional safety systems, such as water detection or emergency shutdown functions, the override must not cancel those protections.

A properly controlled override is a backup function. It is not an alternative way to operate.

Inspection and Testing Requirements

A deadman system cannot be assumed safe simply because it is installed. It must be inspected, tested, and maintained.

Daily functionality checks are essential. The operator should confirm that the deadman starts and stops fuel flow correctly. If the deadman does not function properly, the equipment should be removed from service until repaired.

Inspection should also include the physical condition of the handle, cable, hose, reel, connection point, and stowage arrangement. Damaged cables, poor connections, worn controls, or entanglement risks can affect safe operation.

Periodic performance testing should confirm that the system stops fuel flow within the required limits. This may include checking opening time, closing time, and fuel overrun after release.

The following inspection and testing intervals apply to the deadman and related shutdown functions:

Interval / Trigger	Requirement
Daily	Perform a functional check of the deadman control system. Confirm the deadman override seal is in place. Remove the vehicle from service if the deadman does not operate correctly.
Monthly	Check the correct operation and performance of the deadman control system. Emergency shutoff devices such as remote pulls, push buttons, or switches should perform like a deadman by stopping product flow within 5% of the actual flow rate at the time of release.
Quarterly	Flow test fuelling vehicle pressure control systems and deadman control valves over a range of flow rates up to the maximum attainable flow.
At least annually	Check the intermittent timer feature, where fitted, including the requirement for periodic reactivation within the defined interval.
After repair, alteration, adjustment, or a relevant system change	Repeat testing after any repair, alteration, or adjustment to pressure control equipment, or after changes such as vehicle hose replacement, where hose diameter or length may affect pressure control performance.

Records should be maintained to demonstrate that the system has been tested and remains fit for service. Testing should be performed by competent personnel who understand the operation of the valves, the purpose of the tests, and the failure conditions that can occur, with records showing the valves tested and the flow rates and pressures obtained.

Common Operational Risks

The most common deadman risks are not only technical. Human factors are equally important.

Typical risk scenarios include:

• The deadman handle is wedged or taped open.
• The operator moves away from the fuelling position.
• The deadman cable becomes damaged or entangled.
• The wireless deadman is used outside the permitted area.
• The intermittent timer is ignored or not functioning.
• The override is used without proper authorization.
• Daily checks are skipped or treated as a formality.
• A known defect is not reported or not acted upon.

These risks weaken the deadman as a safety barrier.

For the system to remain effective, three elements must work together:

• Correct equipment design.
• Correct inspection and maintenance.
• Correct operator behavior.

If any of these elements fail, the safety function’s reliability is reduced.

Why Deadman Design Matters

At ARC, safety-critical systems such as the deadman control are considered part of the overall refueller safety philosophy.

A well-designed refueller or hydrant dispenser must not only deliver fuel efficiently. It must also stop fuel safely, predictably, and reliably.

This requires attention to:

• Valve selection and actuation.
• Opening and closing performance.
• Pressure control integration.
• Deadman handle ergonomics.
• Cable, hose, and connection protection.
• Safe stowage of the deadman control.
• Accessibility for inspection and maintenance.
• Clear operator interface.
• Reliable fault response.
• Ease of testing and serviceability.

A refuelling vehicle must support the operator, protect the aircraft, and simplify maintenance. The deadman system is a clear example of how engineering design directly supports operational safety.

Conclusion: The Deadman Is a Safety Barrier, Not Just a Control

The answer to the quiz is clear:

When the operator releases the deadman control, fuel flow stops.

This is the intended safety function and one of the most important protection measures in aircraft refuelling.

The deadman system ensures that fuel flow depends on continuous, positive operator action. If the operator releases the control, becomes incapacitated, or fails to reset the intermittent timer, the system must stop the flow of fuel.

For aviation fuel professionals, the deadman should be viewed as more than a handle. It is a critical safety barrier that combines equipment design, pressure control, operator discipline, inspection, and maintenance.

Contact Us

Safe refuelling depends on reliable equipment, practical design, and well-maintained safety systems.

At ARC NV, we support aviation fuel operators with:

• New aviation refueller and hydrant dispenser design.
• Refurbishment and upgrade solutions.
• Maintenance and repair support.
• Vehicle inspection and lifecycle management.
• Safety-critical system integration and serviceability improvements.

If you are evaluating your refuelling fleet, reviewing safety system performance, or planning new equipment, our team is ready to assist.

Contact us today: ✉️ question@arc-refuellers.be

Let’s work together to improve refuelling safety, reliability, and long-term operational performance.