Failed Driveaway Interlock on Aircraft Refuellers and Hydrant Dispensers: What Should You Do?

A failed driveaway interlock is an aircraft refuelling equipment serviceability defect affecting an important vehicle safety function.

The driveaway interlock is an engineered safety function fitted to motorised into-plane fuelling equipment to prevent driveaway or roll-away while specified components remain deployed, connected or otherwise out of their correct stowed position. This includes aircraft refuellers and self-propelled hydrant dispensers fitted with brake-interlock systems.

In a recent ARC NV Aviation Fuel Quiz, we asked a practical question for aircraft refuelling operators, supervisors, maintenance personnel and fleet managers:

During the daily interlock check, an interlocked component is moved out of stowage, but the interlock does not activate, and the amber warning light remains off. What should you do?

A. Continue operation if the parking brake is applied manually
B. Remove the equipment from service, report the defect, and arrange repair
C. Activate the interlock override and continue normal fuelling operations

The correct answer is:

B — Remove the Equipment From Service, Report the Defect and Arrange Repair

If an interlocked component is moved out of its normal stowed position and the expected interlock response cannot be confirmed, the equipment has failed an important serviceability check.

The vehicle should not be released for normal aircraft fuelling operation.

The correct response is to remove the equipment from service, report the defect and arrange appropriate technical assessment and repair.

Follow us on our LinkedIn page: Aircraft Refueller Company.

Industry requirements for into-plane fuelling equipment support this approach. The daily interlock check is intended to confirm that the selected interlock and its associated warning indication respond correctly. If the check indicates that the interlock function is defective, the vehicle should be prevented from entering normal service until the fault is corrected.

The daily check therefore serves an important purpose: identifying an unavailable safety function before the equipment is required for operational aircraft fuelling.

What Is a Driveaway Interlock System?

During aircraft refuelling, hoses, couplings, platforms and other equipment must often be moved away from their normal transport positions.

Vehicle movement while these components remain deployed can damage the aircraft, the fuelling vehicle, hydrant equipment, hoses, couplings, or other assets around the aircraft. It can also expose personnel working in the area to unnecessary risk.

The driveaway interlock provides an engineered layer of protection against this type of event.

Depending on the vehicle design, the system may monitor items such as pressure fuelling couplings, overwing nozzles, fuelling cabinet doors, tank-top handrails, bottom-loading connections, elevating platforms, hydrant inlet couplers, pantographs, bonding-cable stowage and functions associated with the vehicle pump or Power Take-Off (PTO).

Not every aircraft refueller or hydrant dispenser will have the same configuration. A hydrant dispenser, for example, has different operating equipment from a tank-carrying aircraft refueller.

The principle remains consistent:

When equipment designated as part of the driveaway interlock system is not correctly stowed, the intended vehicle-movement protection must remain effective.

For European operators, this falls within the wider technical framework for aircraft fuelling equipment, which includes JIG 1, EI 1540, and applicable European equipment standards such as EN 12312-5.

This complements the broader principles discussed in ARC NV’s guide to aviation refuelling standards.

Why the Interlock Is More Than a Warning Light

The amber warning indication forms part of the driveaway interlock system by showing the driver that an interlock condition has been detected. However, the interlock is not merely a warning function. Its primary purpose is to provide the intended vehicle-movement protection when an interlock-protected component is moved from its correct stowed position.

If an interlocked component is moved from its correct stowed position, but the expected response does not occur and the amber indication remains off, the operator should not assume that the problem is simply a failed lamp.

The defect may involve the interlock switch or sensor, its mechanical activation point, wiring, connectors, pneumatic supply, vehicle brake interface, electrical controls, warning circuitry or, on electronically controlled equipment, part of the Programmable Logic Controller (PLC) system.

Determining the cause is part of the technical assessment.

The operator’s immediate responsibility is to recognise that the required check has failed and that the vehicle should not be regarded as serviceable.

Why the Parking Brake Is Not an Acceptable Substitute

Option A suggested continuing operation provided the parking brake is applied manually.

That is not an acceptable substitute for correcting a failed driveaway interlock.

The parking brake and the driveaway interlock are related vehicle-safety functions, but they are not interchangeable.

On some aircraft refuellers, application of the parking brake is also a permissive condition for other functions. For example, the vehicle design may require the parking brake to be applied before the Power Take-Off (PTO) can engage.

That is separate from the purpose of the driveaway interlock.

The interlock is designed to respond automatically when an interlock-protected component is moved from its correct stowed position. If that automatic function fails, normal operation should not continue simply because the operator can apply the parking brake manually.

This distinction is important.

A manual action cannot be treated as an informal replacement for an engineered automatic safety function.

Aircraft refuelling safety relies on several layers of protection working together. Correct operator actions should complement functioning equipment safeguards rather than replace them.

The same principle applies throughout aircraft ground refuelling: serviceable equipment and disciplined operating procedures are both required.

Amber Interlock Status, Red Override Indication and the Interlock Override

The interlock condition and the override condition are deliberately distinguished.

An amber indication communicates that an interlock-protected component has activated the interlock system.

A red indication communicates that the normal interlock protection has been overridden.

The difference is operationally significant.

Amber indicates that an interlock condition has been detected.

Red means that an override has been deliberately activated.

This leads directly to option C in the quiz:

Activate the interlock override and continue normal fuelling operations.

That is also incorrect.

The override exists so that a vehicle can be moved when an active interlock would otherwise prevent intentional movement. This may be necessary in an emergency or where a failure within the interlock system itself prevents the vehicle from being moved to a safe or controlled location.

It is not intended to become an alternative normal operating mode.

The override should therefore remain controlled against casual or unauthorised use, and its use should be traceable.

Activating the override after identifying a failed driveaway interlock does not restore the missing safety function. It bypasses it.

There is an important difference between using an override to permit necessary vehicle movement under an approved emergency or controlled procedure and using it to continue routine aircraft fuelling with a known interlock defect.

The first is part of the purpose of an override. The second is not.

Daily and Weekly Driveaway Interlock Checks

The daily interlock check and the more comprehensive weekly test serve related but different purposes.

Daily Interlock Check

The daily check provides regular confirmation that the system remains operational.

One interlocked component is selected and moved from its normal stowed position, with different components checked in rotation. The operator confirms that the interlock responds and that the associated warning indication operates correctly.

If the expected response cannot be confirmed, the check has failed.

The equipment should therefore be removed from operational service and the defect reported for repair.

This is also consistent with the broader pre-fuelling principle that aircraft fuelling equipment should be confirmed serviceable before leaving the parking or equipment-control area for operational duties.

Weekly Complete Interlock Test

The weekly check provides a broader functional verification of the interlock system.

For a conventional interlock system, each applicable interlock is checked to confirm that it produces the intended vehicle response. The override and the associated warning indications are also verified, while switches, sensors, cables, and related components are examined for secure installation, damage, or other conditions that could affect reliable operation.

The objective is to confirm that the interlock actually performs its safety function—not merely that a lamp illuminates.

The test must also be carried out carefully.

Particular care is required with heavy aircraft refuellers and vehicles fitted with automatic transmissions. Only sufficient drive demand should be applied to confirm that the interlock has engaged. The vehicle should not be forced against the braking system.

The purpose is to verify the brake response, not to load the drivetrain against the brakes.

Before moving the vehicle, a 360-degree walk-around should also confirm that the equipment is correctly stowed and the movement area is clear.

PLC-Controlled Interlock Systems

Modern aircraft refuelling equipment may use PLC-controlled interlock architecture.

Where the brake-interlock system is certified to the required Performance Level PL(b) in accordance with EN ISO 13849-1, or equivalent, the weekly testing method can differ from the conventional complete dynamic test.

In such systems, one interlock may be dynamically checked by attempting controlled vehicle movement, with a different interlock selected in rotation, while the remaining interlocks are verified through their correct system indications.

The presence of a PLC does not remove the requirement for functional verification.

It changes how an appropriately designed and certified system may be checked.

The approved test procedure for the individual vehicle should therefore always be followed.

What Should Happen After a Failed Driveaway Interlock Check?

Once a failed driveaway interlock has been identified, the response moves from operational detection to controlled defect management.

Remove the Equipment From Service and Prevent Unintended Use

The aircraft refueller or self-propelled hydrant dispenser should not be released for normal fuelling duties.

It should be controlled in accordance with the location’s approved unserviceability procedure so that another operator cannot unknowingly return it to operation.

Depending on the local system, this may include returning the vehicle to a designated maintenance or parking area, controlling the keys and clearly identifying the equipment as out of service.

The principle is straightforward:

A known safety-function defect should be physically and administratively controlled, not managed only through verbal communication.

Report, Assess and Repair the Defect

The defect should be reported to the appropriate supervisor, maintenance function, or equipment-control point.

The report should describe what was actually observed: which interlock was checked, whether the expected vehicle response occurred, whether the amber indication operated, and whether any other abnormal behaviour was present.

Competent maintenance personnel can then investigate the actual cause.

Depending on the system design, this may involve the switch or sensor, mechanical activation arrangement, wiring and connectors, pneumatic controls, vehicle brake interface, warning circuit, PLC inputs or outputs, or the override system.

An amber warning light remaining off, for example, does not automatically prove that only the lamp has failed.

The affected interlock function needs to be assessed as a complete safety function.

Fully Function-Test Before Return to Service

Repair is not the end of the process.

Before the equipment is released back into normal operation, the repaired function must be demonstrated to work correctly.

Replacing a switch, repairing wiring, or correcting a PLC input does not by itself prove that the interlock protection has been restored.

The appropriate functional test provides that confirmation.

Where equipment has been outside normal operational control for an extended period or has undergone significant repair, the scope of the return-to-service checks should reflect the work performed.

Repair without functional verification is not a complete return-to-service process.

The defect, repair, functional test, and release should also be traceable in the equipment maintenance records.

Why Repeated Driveaway Interlock Faults Deserve Engineering Attention

A single interlock fault may result from an isolated switch, sensor, wiring, or adjustment problem.

Repeated faults deserve greater attention.

Recurring failures can indicate a broader reliability issue involving component positioning, vibration, mechanical impact, electrical connections, pneumatic controls, environmental exposure, or ageing equipment.

When similar defects recur, maintenance history should be reviewed for patterns rather than treating each event as an unrelated failure.

The appropriate response may therefore extend beyond replacing the failed component. Improved mounting, component protection, rewiring, control-system upgrades or wider refurbishment may provide a more effective long-term solution.

This is particularly relevant to ageing aircraft refuelling fleets, where repeated minor defects can gradually increase downtime and reduce equipment availability.

Effective refuelling vehicle maintenance should therefore consider both the immediate defect and the reliability history of the complete vehicle.

The same maintenance philosophy applies when other serviceability defects are identified, such as a small fuel leak during an aircraft refueller inspection or an unreadable differential pressure gauge on into-plane fuelling equipment.

The Driveaway Interlock Does Not Replace the Final Walk-Around

A correctly functioning driveaway interlock is an important engineered safety function, but it does not replace the operator’s final visual inspection.

Before moving away from the aircraft, the operator should confirm that the fuelling equipment has been properly disconnected, relevant components are correctly stowed, and the area surrounding the vehicle is clear.

An interlock can monitor only those components and conditions incorporated into its design. It cannot identify every obstruction, incorrectly positioned item, or unsafe condition around the vehicle.

Effective protection therefore comes from combining equipment design, functioning interlocks, warning indications, operator checks, scheduled maintenance, and disciplined operating procedures.

No single safeguard replaces all the others.

Conclusion: A Failed Driveaway Interlock Means the Equipment Is Not Ready for Normal Service

A driveaway interlock helps prevent a significant aircraft-ground-operation hazard: movement of a fuelling vehicle while critical equipment remains deployed, connected, or incorrectly stowed.

That is why the daily interlock check matters.

It gives the operator an opportunity to identify an unavailable safety function before the vehicle enters normal aircraft fuelling service.

When an interlocked component is moved out of stowage, but the system fails to respond correctly, and the amber warning indication remains off, the required decision is clear:

Remove the equipment from service. Report the defect. Prevent unintended use. Repair the fault. Functionally verify the affected system before return to service.

The parking brake is not a substitute for the driveaway interlock.

The override is not a normal operational solution.

And repair without functional verification does not complete the return-to-service process.

For aircraft refuellers and self-propelled hydrant dispensers operating across European airports, maintaining these engineered safety functions is an important part of equipment serviceability, reliability and lifecycle management.

Contact Us

If your operation is experiencing recurring driveaway interlock faults, braking-interface problems, electrical or pneumatic control issues, PLC faults, sensor failures or increasing aviation refuelling equipment downtime, ARC NV can support with inspection, maintenance, repair, refurbishment, spare parts and lifecycle evaluation.

Contact ARC NV to discuss how we can support the safe, reliable and compliant operation of your aircraft refuellers and hydrant dispensers throughout their lifecycle.

Email: question@arc-refuellers.be
Telephone: +32 3 844 55 68