A fail-safe permissive interlock against aircraft misfuelling: system concept, barrier-degradation model and Monte Carlo risk assessment

Manuscript prepared for The Aeronautical Journal (Cambridge University Press, Research Article). Delivering the wrong fuel to an aircraft remains a recurrent ground-operations hazard whose usual defences (placards, filler-port restrictors, checklists) are passive or administrative and are repeatedly defeated on the ramp. The paper develops and assesses a fail-safe permissive interlock for refuelling vehicles: a durable code at each fuel port is read at the vehicle, an edge controller compares the aircraft's registered fuel requirement with the vehicle's declared product, and a start permissive is issued only on a verified match, without altering the existing deadman or emergency shut-off. A closed-form event hazard, a mean-field model of barrier compromise through bypass and habitual override, and a fleet Monte Carlo (5,000 replicates, parameter and stochastic uncertainty separated) compare four barrier configurations; a virtual fault-injection campaign tests the controller logic. Under assumed, ideation-stage parameters the interlock as first conceived lowers the nominal misfuelling hazard by about 83% but not to zero; in 20-vehicle fleets a transient tag-fouling episode drives 19.7% of replicates into a bypassed state, and tamper analytics removes it. All results are model-conditional; no hardware has been built. Code, tests and results: https://github.com/sandlerleon/misfuelling-interlock-mc.