Recommendation R19980237

Recommendation issued to: Civil Aviation Safety Authority

Recommendation details
Output No: R19980237
Date issued: 17 March 1999
Safety action status:



There are two modification states of the auxiliary fuel pump system of Cessna piston twin-engine aircraft. Operating procedures for the two systems are different and are not clearly understood by operators. Use of incorrect auxiliary fuel pump operating procedures has resulted in serious accidents.


Related occurrences

Lack of standardisation of the Cessna auxiliary fuel tank switching system and the associated lack of pilot familiarity with the applicable operating procedures of the system were considered to have been contributing factors to the three accidents described below. These two factors were also considered to have contributed to the outcomes of a number of other occurrences.

Occurrence 9300002

During a charter operation, both engines of a Cessna 310Q stopped operating during cruise-flight. The pilot carried out a forced landing in unsuitable terrain. The four occupants were seriously injured.

The reason for an initial loss of power in the right engine was considered to be exhaustion of the fuel in the right auxiliary tank. As both engine-driven fuel pumps appeared to be operating normally until the time of the power loss, the most likely reason for the loss of power in the left engine and the failure of both engines to re-start normally, is that the pilot had selected both the auxiliary fuel pump switches to the HIGH position while he was carrying out troubleshooting procedures.

The deficiency in the pilot's knowledge concerning the use of the auxiliary fuel pump HIGH setting, and his lack of understanding of what action should have taken priority during such a situation, were not identified by the operator's check and training system. The operator employed the pilot on a casual basis and had not checked the pilot on the operating procedures of the Cessna 310 as he had completed his endorsement on the aircraft type with another operator.

The aircraft in this occurrence had its auxiliary fuel pump switching system modified in accordance with Service Bulletin MEB88-3 (SB MEB88-3) (see below).

Occurrence 9302853

The Cessna T303 was established on final approach. The pilot had completed all pre-landing checks when both engines lost power simultaneously at a height of about 200 ft. The aircraft touched down heavily in a field some 100 m before the threshold to runway 04 and was substantially damaged as a result of ground impact forces.

The simultaneous double-engine failure was considered to be the result of both auxiliary electric fuel pumps being inadvertently selected to the HIGH setting rather than LOW, while the pilot was carrying out his pre-landing checks. As the throttles were moved towards the idle position on the final approach to land, both engines lost power due to an excessively rich mixture. The auxiliary fuel pump switching system of this aircraft had been modified in accordance with SB MEB88-3 (see below).

Occurrence 9800353

When both engines of a Cessna 310Q stopped during descent, the pilot carried out a forced landing in a field. The aircraft sustained substantial damage.

The investigation found that the left engine initially lost power due to fuel exhaustion of the left auxiliary tank. When the main fuel tank was selected in an attempt to restart the left engine and the auxiliary fuel pump switch was moved to the ON position, the pump mode changed to HIGH and the latching relay engaged. As a consequence, an over-fuelling condition prevented the left engine from being restarted. The right engine subsequently stopped due to a similar over-fuelling condition when the right auxiliary fuel pump was selected to ON during the time the pilot was carrying out troubleshooting procedures.

Further investigation determined that the right engine fuel pressure switch had a very high electrical resistance following its activation. Consequently, electrical current was able to flow into the latching circuit and lock the system to HIGH flow mode when selected to the ON position.

The aircraft in this occurrence did not have its auxiliary fuel pump switching system modified in accordance with SB MEB88-3 (see below).

Auxiliary fuel pumps

Engine-driven fuel pumps were designed to supply engines with a steady, uninterrupted flow of fuel to ensure continuous engine operation. Cessna twin piston-engine aircraft also incorporated an additional fuel pump for each engine - an electric auxiliary fuel pump. This pump was used to ensure that a positive supply of fuel would be available should the engine-driven fuel pump fail. However, the auxiliary pump's normal function was to reduce excess fuel vapour in the fuel supply lines for each engine. At present in Australia, Cessna twin piston-engine aircraft may be equipped with one of two auxiliary fuel pump switching systems, the original (unmodified) system or a modified switching system. These two systems are described below.

Operation of the original (unmodified) auxiliary fuel pump system

A 3-position switch (LOW, OFF, ON), located in the cockpit, was provided for each auxiliary fuel pump. In the LOW position, the auxiliary fuel pumps operated at low speed, providing adequate fuel flow for vapour purging.

In the ON position, the auxiliary fuel pumps also operated at low speed whilst the engine-driven pumps were functioning. Should an engine-driven fuel pump fail, a fuel pressure-sensing switch would automatically switch the auxiliary fuel pump for the affected engine to high speed to maintain fuel flow for engine operation.

The procedures in the flight manual and owner's manual/ pilot's operating handbook (POH) were for the auxiliary fuel pumps to be ON for takeoff and landing. This was to ensure adequate fuel supply during critical phases of flight. The fuel pumps were to be switched to LOW at all other times, including those times when the pilot was changing the fuel supply to the engine from one fuel tank to another. A placard located near the fuel selector stated:


The unmodified fuel system included a fuel pressure-sensing switch that activated the high-pressure output of the auxiliary fuel pump when a pressure drop in the fuel injection system was sensed. This automatic feature was only available with the pump switch in the ON position. When the pump went into high-speed mode, it remained in this mode even if fuel pressure was restored. Turning the boost pump to LOW or OFF disengaged this mode. A pressure drop in the system was normally the result of either engine-driven pump failure or fuel starvation/exhaustion.

Failure of a fuel pressure-sensing switch may have resulted in the automatic feature of the switch not functioning. This meant that auxiliary fuel pump high-speed operation was not available when required. Importantly, sensing-switch failure could have resulted in the unwanted activation of the auxiliary fuel pump to the high-speed mode while the engine-driven pump was also operating (see occurrence 9800353). This would result in an over-rich mixture and a reduction in engine power or complete power loss.

As a result of improved engine-driven pump reliability and the reduction in the risk of power loss during takeoff and landing, the manufacturer issued Service Bulletin MEB88-3, which mandated fuel pump wiring modification, in August 1988.

Operation of the modified auxiliary fuel pump system

Auxiliary fuel pump wiring modification (SB MEB88-3) removed the automatic fuel pressure-sensing switch and provided new auxiliary fuel pump switches and placards in the cockpit. This modification provided direct pilot activation (via the new cockpit switch) of the output speed of the auxiliary fuel pumps, including the high-speed mode, which had previously been controlled by the automatic fuel pressure-sensing switch. Cessna considered that manual activation of the auxiliary fuel pump in all modes was the most desirable and simplest mode of activation.

The 3-position cockpit switch positions became LOW, OFF and HIGH. The HIGH position was used to run the auxiliary fuel pumps at high speed in the event of an engine-driven fuel pump failure. This was manually selected by the pilot when required and featured a detent to prevent inadvertent selection. An additional placard was overlayed on the existing placard near the fuel selector, and stated:


A new placard was also provided to indicate that the aircraft had been modified to show the proper switch positions for normal operation. It was located near the auxiliary fuel pump switches, and stated:



An airplane flight manual supplement and a supplemental airplane flight manual (dependent on model) were issued in December 1988 with the instructions that the auxiliary fuel pumps were to be selected to LOW for takeoff and landing. The supplements contained the following:


If the auxiliary fuel pump switches are placed in the high position with the engine driven fuel pump(s) operating normally, total loss of engine power may occur".

The supplement was also to be inserted into the POH.

Extent of the safety deficiency

During the investigation of occurrence 9800353, it was evident that different modification states of the auxiliary fuel pump system existed within the Australian fleet of Cessna piston twin-engine aircraft. It was also evident, in discussions with various operators, that pilots were not sure of the different operating procedures required for the two auxiliary fuel pump standards. This was despite the fact that the flight manuals contained the correct procedures for the specific aircraft.

An inspection of various aircraft at Bankstown airport in May 1998 revealed that of four Cessna 310 aircraft located on the aerodrome, three had modified auxiliary fuel pump switching systems. However, one of the modified aircraft was missing the upgraded fuel selector panel placard. In addition, one of two Cessna 402 models was modified. All of the available POHs of these aircraft contained only the information on the unmodified auxiliary fuel pump system.

All of the aircraft models affected by SB MEB88-3 are used in fare-paying passenger operations in Australia.

Regulatory issues

The aircraft manufacturer introduced SB MEB88-3 to improve the safety features of the auxiliary fuel pump system. Cessna considered that incorporation of the modification and the corresponding changes to the described operational publications were mandatory. In SB MEB88-3, Cessna stated:

"Failure to comply with the modification could endanger the safety of you and your passengers if a fuel pressure switch malfunction occurs or has occurred which prevents the switch from going to the HIGH fuel activation position, when needed, or causes an unwanted switch activation to the HIGH fuel position which might result in too much fuel going to the engine and a possible reduction in engine power".

No Airworthiness Directive (AD) has been issued by the US Federal Aviation Administration. Therefore, SB MEB88-3 is not mandatory for general aviation operations in the USA. However, the manufacturer advised that the service bulletin was mandatory for aircraft operating under Federal Aviation Regulations Part 135 (Air Taxi Operators and Commercial Operators).

The Australian Civil Aviation Safety Authority (CASA) did not consider that compliance with the original issue of SB MEB88-3 needed to be mandatory. Consequently, CASA did not issue an AD to enforce the modification of all affected aircraft in Australia. In 1989, CASA raised an AD for each affected aircraft model to ensure that the necessary features of revision one of SB MEB88-3 were incorporated into modified aeroplanes.


The Bureau considers that the following are the main issues related to this safety deficiency:

(1) the manufacturer considers that failure to comply with SB MEB88-3 could endanger the safety of flight operations, but this service bulletin is not mandated by CASA;

(2) there is a resulting lack of standardisation of auxiliary fuel pump systems on Cessna twin piston-engine aircraft used for fare-paying passenger operations;

(3) there appears to be some confusion and lack of understanding among operators of these aircraft regarding the differences between the unmodified and modified auxiliary fuel pump systems.

(4) there has been substantial damage to aircraft and serious injuries to occupants as a result of confusion between the two systems; and

(5) Pilots' operating handbooks and aircraft placarding do not always reflect the correct operating procedures;

(6) A significant number of Cessna piston twin-engine aircraft are currently involved in fare-paying passenger operations throughout Australia. The Bureau considers that the potential for other similar occurrences is sufficient to require appropriate action by both CASA and operators of these aircraft in the areas of regulation and education/training in order to adequately address this safety deficiency.

Output text

The Bureau of Air Safety Investigation recommends that the Civil Aviation Safety Authority:

(1) reconsider mandating Cessna Service Bulletin MEB88-3; and

(2) ensure that documentation (aircraft flight manuals, owners' manuals, and pilots' operating handbooks) and placarding of aircraft affected by Cessna Service Bulletin MEB88-3, reflect the auxiliary fuel pump wiring modification state of the aircraft.

Initial response
Date issued: 01 July 1999
Response from: Civil Aviation Safety Authority
Action status: Closed - Accepted
Response text:

CASA has reconsidered mandating Cessna Service Bulletin MEB88-3, but has concluded that such action would not be appropriate. Airworthiness directives should not be used to correct deficiencies not directly associated with an unsafe condition. While CASA recognises that mandating Cessna Service Bulletin MEB88-3 will overcome standardisation issues within the Australian fleet, CASA does not believe that BASI has demonstrated an airworthiness deficiency with the auxiliary fuel pump system that warrants airworthiness directive action.

With the second recommendation BASI has identified a safety deficiency relating to inconsistent status of aircraft flight manuals, pilot operating handbooks, and aircraft placards. CASA agrees with this recommendation. Where such documentation does not reflect the configuration of the aircraft, there is a potential for pilots to use inappropriate procedures that could compromise the safety of the aircraft. CASA will therefore direct Certificate of Registration holders of affected Cessna 300 and 400 series aircraft to ensure that the documentation relating to auxiliary fuel pump configuration reflects the modification status of the aircraft to which it pertains.

I have attached the Technical Specialists review of the BASI report for your information.

The delay in responding to your recommendation R980237 is regretted, but was caused by the need to secure information from the FAA.

Last update 01 April 2011