According to the outcomes of an investigation into disruptions to AFS’ supply of aircraft fuel to airlines at Schiphol this summer, the malfunction on 24 July can be traced back to a fault in the electrical installation (a loose supply wire). According to the Netherlands Organisation for Applied Scientific Research (TNO), which carried out the investigation on behalf of Aircraft Fuel Supply (AFS) and Royal Schiphol Group (Schiphol), the far shorter failure on 9 August was probably caused by a broken fire detector or faulty power supply. TNO has concluded that there was probably no connection between the two malfunctions.
Both malfunctions (on 24 July and 9 August) made it temporarily impossible to refuel aircraft. AFS and Schiphol commissioned TNO to assess the cause of the events and the way the malfunction was handled.
The TNO assessment focused on the facts and handling of the disruption to AFS’ systems. Any technical, organisational, human and process-related factors that may have contributed to the occurrence and handling of the malfunction by AFS and other parties involved were taken into account. TNO took stock of the relevant facts by means of interviews, workshops, document research and a test of the affected systems. TNO also discussed the failure with those immediately involved and relevant experts.
Cause of failure on 24 July
The failure on 24 July was caused by a fault in the electrical installation – a loose neutral wire – which probably occurred a few months earlier during a modification. This fault did not cause any failures in the period from February to 24 July due to the fact that the connected systems are normally powered via an Uninterruptible Power Supply (UPS), rather than the faulty wire. The UPS was switched off during scheduled maintenance work on 24 July 2019, connecting the systems to the loose wire. Some of the connected systems then experienced a power surge, causing several power supplies and components to burn out. This resulted in an Emergency Shut Down (ESD), causing all fuel deliveries to be halted in accordance with strict safety protocols.
The failure handling procedure on 24 July lasted approximately 8.5 hours. Once the problem had been identified, the power supply was stabilised. The affected systems were then checked and restored to normal working order. Finally, the electrical installation was gradually restarted. The lengthy failure handling process can be explained by the large number of systems requiring inspection and – in some cases – repair. It also took AFS some time to safely recommission the various systems.
Cause of malfunction on 9 August
According to the TNO investigation, the malfunction on 9 August was caused by a failure in which false emergency stop alarms were triggered at a pier. These failures did not reoccur following replacement of the fire control panel and a faulty power supply, and can thus be assumed to have been caused by one or both of these components.
Conclusion and recommendations
TNO concludes that AFS followed all applicable procedures and that the duration of the failure handling procedure on 24 July can be explained by the large number of systems that had to be checked and repaired. TNO has issued several recommendations in order to prevent similar failures from occurring in future or limit their potential consequences. Firstly, basic principles for security of supply and continuity should be formulated in consultation with the parties involved. TNO also recommends that complex technical failures be included in the crisis plan and the business continuity management plan. TNO furthermore proposes compartmentalising the design of AFS systems so that local alarms can be safely handled without disrupting the entire fuel supply process.
AFS adopts recommendations as a part of new projects
AFS’ Managing Director Inge Stegmann is glad that TNO has completed the study and announced the results.
ppLoadLater.placeholderFBSDK = ppLoadLater.placeholderFBSDK.join("n");