Recommendation

SUBJECT - CESSNA 300/400 SERIES AUXILIARY FUEL PUMP
SYSTEMS





SAFETY DEFICIENCY



There are two modification states of the auxiliary fuel pump
system of Cessna piston twin-engine aircraft. Operating procedures
for the two systems are different and are not clearly understood by
operators. Use of incorrect auxiliary fuel pump operating
procedures has resulted in serious accidents.





FACTUAL INFORMATION



Related occurrences



Lack of standardisation of the Cessna auxiliary fuel tank
switching system and the associated lack of pilot familiarity with
the applicable operating procedures of the system were considered
to have been contributing factors to the three accidents described
below. These two factors were also considered to have contributed
to the outcomes of a number of other occurrences.





Occurrence 9300002



During a charter operation, both engines of a Cessna 310Q stopped
operating during cruise-flight. The pilot carried out a forced
landing in unsuitable terrain. The four occupants were seriously
injured.



The reason for an initial loss of power in the right engine was
considered to be exhaustion of the fuel in the right auxiliary
tank. As both engine-driven fuel pumps appeared to be operating
normally until the time of the power loss, the most likely reason
for the loss of power in the left engine and the failure of both
engines to re-start normally, is that the pilot had selected both
the auxiliary fuel pump switches to the HIGH position while he was
carrying out troubleshooting procedures.



The deficiency in the pilot's knowledge concerning the use of the
auxiliary fuel pump HIGH setting, and his lack of understanding of
what action should have taken priority during such a situation,
were not identified by the operator's check and training system.
The operator employed the pilot on a casual basis and had not
checked the pilot on the operating procedures of the Cessna 310 as
he had completed his endorsement on the aircraft type with another
operator.



The aircraft in this occurrence had its auxiliary fuel pump
switching system modified in accordance with Service Bulletin
MEB88-3 (SB MEB88-3) (see below).





Occurrence 9302853



The Cessna T303 was established on final approach. The pilot had
completed all pre-landing checks when both engines lost power
simultaneously at a height of about 200 ft. The aircraft touched
down heavily in a field some 100 m before the threshold to runway
04 and was substantially damaged as a result of ground impact
forces.



The simultaneous double-engine failure was considered to be the
result of both auxiliary electric fuel pumps being inadvertently
selected to the HIGH setting rather than LOW, while the pilot was
carrying out his pre-landing checks. As the throttles were moved
towards the idle position on the final approach to land, both
engines lost power due to an excessively rich mixture. The
auxiliary fuel pump switching system of this aircraft had been
modified in accordance with SB MEB88-3 (see below).





Occurrence 9800353



When both engines of a Cessna 310Q stopped during descent, the
pilot carried out a forced landing in a field. The aircraft
sustained substantial damage.



The investigation found that the left engine initially lost power
due to fuel exhaustion of the left auxiliary tank. When the main
fuel tank was selected in an attempt to restart the left engine and
the auxiliary fuel pump switch was moved to the ON position, the
pump mode changed to HIGH and the latching relay engaged. As a
consequence, an over-fuelling condition prevented the left engine
from being restarted. The right engine subsequently stopped due to
a similar over-fuelling condition when the right auxiliary fuel
pump was selected to ON during the time the pilot was carrying out
troubleshooting procedures.



Further investigation determined that the right engine fuel
pressure switch had a very high electrical resistance following its
activation. Consequently, electrical current was able to flow into
the latching circuit and lock the system to HIGH flow mode when
selected to the ON position.



The aircraft in this occurrence did not have its auxiliary fuel
pump switching system modified in accordance with SB MEB88-3 (see
below).





Auxiliary fuel pumps



Engine-driven fuel pumps were designed to supply engines with a
steady, uninterrupted flow of fuel to ensure continuous engine
operation. Cessna twin piston-engine aircraft also incorporated an
additional fuel pump for each engine - an electric auxiliary fuel
pump. This pump was used to ensure that a positive supply of fuel
would be available should the engine-driven fuel pump fail.
However, the auxiliary pump's normal function was to reduce excess
fuel vapour in the fuel supply lines for each engine. At present in
Australia, Cessna twin piston-engine aircraft may be equipped with
one of two auxiliary fuel pump switching systems, the original
(unmodified) system or a modified switching system. These two
systems are described below.





Operation of the original (unmodified) auxiliary fuel pump
system



A 3-position switch (LOW, OFF, ON), located in the cockpit, was
provided for each auxiliary fuel pump. In the LOW position, the
auxiliary fuel pumps operated at low speed, providing adequate fuel
flow for vapour purging.



In the ON position, the auxiliary fuel pumps also operated at low
speed whilst the engine-driven pumps were functioning. Should an
engine-driven fuel pump fail, a fuel pressure-sensing switch would
automatically switch the auxiliary fuel pump for the affected
engine to high speed to maintain fuel flow for engine
operation.



The procedures in the flight manual and owner's manual/ pilot's
operating handbook (POH) were for the auxiliary fuel pumps to be ON
for takeoff and landing. This was to ensure adequate fuel supply
during critical phases of flight. The fuel pumps were to be
switched to LOW at all other times, including those times when the
pilot was changing the fuel supply to the engine from one fuel tank
to another. A placard located near the fuel selector stated:



"TAKEOFF AND LAND WITH AUXILIARY FUEL PUMPS ON".



The unmodified fuel system included a fuel pressure-sensing switch
that activated the high-pressure output of the auxiliary fuel pump
when a pressure drop in the fuel injection system was sensed. This
automatic feature was only available with the pump switch in the ON
position. When the pump went into high-speed mode, it remained in
this mode even if fuel pressure was restored. Turning the boost
pump to LOW or OFF disengaged this mode. A pressure drop in the
system was normally the result of either engine-driven pump failure
or fuel starvation/exhaustion.



Failure of a fuel pressure-sensing switch may have resulted in the
automatic feature of the switch not functioning. This meant that
auxiliary fuel pump high-speed operation was not available when
required. Importantly, sensing-switch failure could have resulted
in the unwanted activation of the auxiliary fuel pump to the
high-speed mode while the engine-driven pump was also operating
(see occurrence 9800353). This would result in an over-rich mixture
and a reduction in engine power or complete power loss.



As a result of improved engine-driven pump reliability and the
reduction in the risk of power loss during takeoff and landing, the
manufacturer issued Service Bulletin MEB88-3, which mandated fuel
pump wiring modification, in August 1988.





Operation of the modified auxiliary fuel pump system



Auxiliary fuel pump wiring modification (SB MEB88-3) removed the
automatic fuel pressure-sensing switch and provided new auxiliary
fuel pump switches and placards in the cockpit. This modification
provided direct pilot activation (via the new cockpit switch) of
the output speed of the auxiliary fuel pumps, including the
high-speed mode, which had previously been controlled by the
automatic fuel pressure-sensing switch. Cessna considered that
manual activation of the auxiliary fuel pump in all modes was the
most desirable and simplest mode of activation.



The 3-position cockpit switch positions became LOW, OFF and HIGH.
The HIGH position was used to run the auxiliary fuel pumps at high
speed in the event of an engine-driven fuel pump failure. This was
manually selected by the pilot when required and featured a detent
to prevent inadvertent selection. An additional placard was
overlayed on the existing placard near the fuel selector, and
stated:



"TAKEOFF AND LAND WITH AUXILIARY FUEL PUMPS LOW".



A new placard was also provided to indicate that the aircraft had
been modified to show the proper switch positions for normal
operation. It was located near the auxiliary fuel pump switches,
and stated:



"THE AUXILIARY FUEL PUMP SYSTEMS IN THIS AIRPLANE HAVE BEEN
MODIFIED

BY SERVICE BULLETIN MEB88-3.



AUX PUMP LOW FOR TAKEOFF, LANDING AND VAPOR CLEARING. AUX PUMP
HIGH

FOR ENGINE DRIVEN PUMP FAILURE (VERY LOW OR NO FUEL PRESS), SEE
POH OR

AFM SUPPLEMENT OR SUPPLEMENTAL AFM".



An airplane flight manual supplement and a supplemental airplane
flight manual (dependent on model) were issued in December 1988
with the instructions that the auxiliary fuel pumps were to be
selected to LOW for takeoff and landing. The supplements contained
the following:



"CAUTION



If the auxiliary fuel pump switches are placed in the high
position with the engine driven fuel pump(s) operating normally,
total loss of engine power may occur".



The supplement was also to be inserted into the POH.





Extent of the safety deficiency



During the investigation of occurrence 9800353, it was evident
that different modification states of the auxiliary fuel pump
system existed within the Australian fleet of Cessna piston
twin-engine aircraft. It was also evident, in discussions with
various operators, that pilots were not sure of the different
operating procedures required for the two auxiliary fuel pump
standards. This was despite the fact that the flight manuals
contained the correct procedures for the specific aircraft.



An inspection of various aircraft at Bankstown airport in May 1998
revealed that of four Cessna 310 aircraft located on the aerodrome,
three had modified auxiliary fuel pump switching systems. However,
one of the modified aircraft was missing the upgraded fuel selector
panel placard. In addition, one of two Cessna 402 models was
modified. All of the available POHs of these aircraft contained
only the information on the unmodified auxiliary fuel pump
system.



All of the aircraft models affected by SB MEB88-3 are used in
fare-paying passenger operations in Australia.





Regulatory issues



The aircraft manufacturer introduced SB MEB88-3 to improve the
safety features of the auxiliary fuel pump system. Cessna
considered that incorporation of the modification and the
corresponding changes to the described operational publications
were mandatory. In SB MEB88-3, Cessna stated:



"Failure to comply with the modification could endanger the safety
of you and your passengers if a fuel pressure switch malfunction
occurs or has occurred which prevents the switch from going to the
HIGH fuel activation position, when needed, or causes an unwanted
switch activation to the HIGH fuel position which might result in
too much fuel going to the engine and a possible reduction in
engine power".



No Airworthiness Directive (AD) has been issued by the US Federal
Aviation Administration. Therefore, SB MEB88-3 is not mandatory for
general aviation operations in the USA. However, the manufacturer
advised that the service bulletin was mandatory for aircraft
operating under Federal Aviation Regulations Part 135 (Air Taxi
Operators and Commercial Operators).



The Australian Civil Aviation Safety Authority (CASA) did not
consider that compliance with the original issue of SB MEB88-3
needed to be mandatory. Consequently, CASA did not issue an AD to
enforce the modification of all affected aircraft in Australia. In
1989, CASA raised an AD for each affected aircraft model to ensure
that the necessary features of revision one of SB MEB88-3 were
incorporated into modified aeroplanes.





ANALYSIS



The Bureau considers that the following are the main issues
related to this safety deficiency:



(1) the manufacturer considers that failure to comply with SB
MEB88-3 could endanger the safety of flight operations, but this
service bulletin is not mandated by CASA;



(2) there is a resulting lack of standardisation of auxiliary fuel
pump systems on Cessna twin piston-engine aircraft used for
fare-paying passenger operations;



(3) there appears to be some confusion and lack of understanding
among operators of these aircraft regarding the differences between
the unmodified and modified auxiliary fuel pump systems.



(4) there has been substantial damage to aircraft and serious
injuries to occupants as a result of confusion between the two
systems; and



(5) Pilots' operating handbooks and aircraft placarding do not
always reflect the correct operating procedures;



(6) A significant number of Cessna piston twin-engine aircraft are
currently involved in fare-paying passenger operations throughout
Australia. The Bureau considers that the potential for other
similar occurrences is sufficient to require appropriate action by
both CASA and operators of these aircraft in the areas of
regulation and education/training in order to adequately address
this safety deficiency.