The A330 MRTT Programme: Safety Challenges
‘If you can walk away from a landing, it’s a good landing.
If you use the airplane the next day, it’s an outstanding landing’
INTRODUCTION
The Airbus A330 MRTT (‘Multi Role Transport Tanker’) is a military derivative of the A330-200 airliner. It is designed as a dual-role Air-to-Air Refueling and Transport aircraft. It was conceived to be a modern platform able to last long time in service and prepared to sustain successive upgrades.
Integrating Air-to-Air Refueling (AAR) Systems in the A330-200, already fitted with Fly-by-Wire and Digital Networks technologies, posed several challenges. Among them, those related to the Safety of the Systems and the Operations were paramount. This article introduces the most relevant.
SAFETY CHALLENGES
The A330 MRTT was developed to ensuring the highest Safety level in the development and the Certification of the final product. Due to the particular specificities of the proposal to implement a conversion from a civil configuration (A330-220) into a military one (A330 MRTT), the definition of the Safety level was a significant challenge driven by:
- a) The complexity of the A330 MRTT Military Certification as Aerial Tanker, based on the civil certification of the A330-200, while the overall platform shall be military certified considering the delta of the military modification.
- b) The intrinsic risks of the AAR operation itself. The AAR operation involves two (2) independent aircraft, in a very demanding operational environment (physical connection between both aircrafts, while holding a stationary relative position in close formation).
- c) The interaction between the systems of both the Tanker (TKR) and the Receiver (RCVR), so that failures in the system in one platform can propagate and impact the other platform.
Therefore, it was necessary to develop, and agree with the Military Authority, a dedicated Airworthiness and Safety framework for the A330 MRTT. In order to maximize consistency with the A330-200 design principles (based on the civil safety requirement JAR 25.1309 Amdt 13), the A330 MRTT military modification was developed considering an adaptation of the civil safety requirements (which were tailored taking into account the military context). Also, it was decided to apply the robust civil Standards for Safety (SAE ARP 4754 and SAE ARP4761) in the development of the A330 MRTT military modification. These standards outline the methodology applicable for identification, validation and verification of Safety requirement at Aircraft, System and Equipment levels.
The adaptation of the Civil Safety requirements was discussed and agreed with the Military Airworthiness Authority and captured in a dedicated MCRI (Military Certification Review Item) included in the A330 MRTT Airworthiness Basis. Therefore, despite the A330 MRTT is a Military Programme, the civil safety practices were considered in the design, implementation and certification of the military capabilities.
A) Safety requirements applicable to the A330 MRTT design, when considering the collaborative TKR-RCVR joint operation
The AAR operation is included within the scope of the A330 MRTT certification as a TKR.Therefore, when defining the certification boundaries and associated safety criteria it was necessary to consider that the A330 MRTT is not a stand-alone aircraft and that a second aircraft (the RCVR) is flying in close proximity.
Due to the need to consider this collaborative operation TKR-RCVR within the A330 MRTT certification, it was identified at the early stages of the A330 MRTT Programme, that conventional safety requirement should be adapted to properly capture the A330 MRTT operational specificities. As illustrative example: ‘Safety requirement in conventional A/C certifications are defined by considering potential failures in the platform to be certified and assessing their consequences over the platform itself’.
Nevertheless, the A330 MRTT certification was extended to cover also potential failures in the A330 MRTT having consequences over the RCVR.
B) Holistic safety process covering the A330 MRTT design as a whole
The safety process applied to the A330 MRTT development was established ensuring that both the civil A330-200 baseline and the A330 MRTT military modification are integrated and considered as whole:
- a) The civil certification of the A330-200 ensures the adherence of the A330 MRTT baseline with the highest Safety standards.
- b) The systems modification performed over the A330-200 to implement the military capabilities was performed following the same safety process and methodology as per the civil baseline applying the tailoring agreed in the applicable MCRI.This included:
- The installation of the AAR systems (underwing pods and boom)
- The modification of existing systems in the civil baseline (Fuel system, Flight Control System, Electrical System…)
- The installation of additional supporting systems (Vision System, Operator Console…)
The above described process required the reassessment of existing A330-200 civil systems affected by the physical modification (due to interfaces with the military systems), to ensure the proper integration of the civil and military systems from the Safety perspective. As an illustrative example: ‘The electrical system architecture existing in the civil A330-200 was reassessed to ensure that the system architecture was acceptable, considering the new consequences of certain failures affecting the military systems’
- c) The operational use of the A330 MRTT is significantly different from the one considered for the A330-200 design. Therefore, it was identified at the early stages of the A330 MRTT development the risk that, certain A330-200 systems not affected by the military modification (e.g.: Landing Gear, Powerplant…), could be affected by the new AAR operation in terms of safety.
This means that the consequences of a failure in these systems might be more severe during AAR (A330 MRTT scenario) than in free flight (A330-200 scenario). In such cases, the architecture of the civil system should be rechecked against the more demanding safety requirement driven by the military operation.
Through this holistic and systematic process assessing not only the military modification (new or modified systems on board), but also considering the new operation as a driver for Safety requirement affecting the non-modified systems, the overall safety process applied to the A330 MRTT ensures a rigorous approach to safety as part of the design and certification of the platform.
THE WAY AHEAD
The way ahead for the A330 MRTT is to shift from being a bare platform with AAR capabilities to becoming a high-tech smart node in the sky. Three (3) main lines of action have been established: Advanced automation, next generation hardware and unmanned interoperability:
- A) A330 MRTT+ [Neo]: As an Airbus derivative, the A330 MRTT has to evolve along the commercial frame does. Now, the new tankers will transition from the A330-200 airframe to the more efficient and capable A330-800neo. The first announced Customer for the A330 MRTT+ is Thailand with the delivery expected by 2029.
- B) SMART MRTT [Autonomous Refueling (A3R) and Autonomous Assets Refueling (A4R)]: In February 2026, Singapore became the first country to achieve full certification for A3R, allowing for fully automated boom refueling in day and night conditions. In addition to this capability, Airbus Defence is expanding the MRTT AAR capabilities towards unmanned drones aerial refueling without any human intervention on either side.
The A3R capability, certified for the first time in history on the MRTT, represents a paradigm shift in this type of operation, a new way of doing refueling with Boom, since it began back in the 1960s
- C) Connectivity HUB (C3IS): Beyond the AAR function, the A330 MRTT is also evolving to become a Flying Data Hub able to act as a advanced Command and Control (C2) node.
NOTES & GLOSSARY
[1] United States Air Force officer, flying ace, and record-setting test pilot who in October 1947 became the first pilot in history confirmed to have exceeded the speed of sound in level flight.
Contributors
With special thanks to AAR Engineering and Aviation Safety team at Airbus Defence & Space