Opinion: Deadly switches
That ubiquitous key-operated igniton switch is fraught with peril
Shortly before 5 p.m., the pilot was preflighting the Cessna 182 Skylane while his wife had opened the right cabin door and was preparing to climb into the right seat.
She heard a noise that sounded like the airplane’s engine was trying to start. She found the pilot lying on the ramp in front of the airplane. He had sustained severe head injuries and was nonresponsive. The Skylane’s ignition key was in his pocket. The pilot’s wife called for help, which quickly arrived. He was transported to the hospital by medevac helicopter but succumbed to his injuries.
NTSB findings
Accident investigators found that the right magneto of the airplane’s Continental O-470 engine was “hot”—the mag’s P-lead was not grounded out by the cockpit ignition switch. They found that the switch was not in the Off position, but rather was in an intermediate position between the Off and Right detents. In that position, the switch did not ground out the right mag.
The airplane’s Gerdes ignition switch was designed to prevent the key from being removed from the lock cylinder in any position except Off. However, when investigators tested the switch using the key found in the pilot’s pocket, they found that it could be removed in any switch position. Further research revealed that both the key and the lock cylinder chamber had worn to the point that the integrity of the key retention feature had been compromised.
A review of the NTSB’s database revealed three previous cases where loss of ignition switch-to-key integrity led to unintended engine startup. In all three, the key was not in the ignition switch and the pilot believed it was in the Off position when the engine started, resulting in injury or uncommanded movement of the airplane and collision with other aircraft or ground vehicles.
Airworthiness directives
These ubiquitous key-operated turn-to-start ignition switches were manufactured by Bendix/TCM, Gerdes, and ACS. The Gerdes and ACS switches share the same design—ACS acquired the assets of Gerdes—while the Bendix/TCM switches use a different design. All these ignition switches are the subject of recurring airworthiness directives.
Bendix/TCM switches with certain part numbers or markings are subject to AD 76-07-12, which requires a functional check of switch operation every 100 hours. This AD is unusual in that it permits the required check to be performed by the pilot. The required check is performed immediately after a normal preflight runup, and requires that the ignition switch be rotated through the Off detent to the extreme limit of its travel in the Off direction. The engine should stop firing. If it continues to run with the switch in this extreme position, the switch is faulty and must be repaired or replaced (by an A&P) before further flight.
All Gerdes and ACS switches are subject to AD 93-05-06, which requires that the switch be disassembled, inspected for wear or corrosion, repaired as necessary, and lubricated with a special grease every 2,000 hours. The AD also requires that an arc-suppression diode be installed at the starter solenoid (relay) if one is not already installed. ACS offers an inexpensive kit (about $25) containing all the parts and supplies required to comply with this AD, which must be performed or supervised by an A&P.
We’ve seen quite a bit of A&P confusion about these ADs. It’s not unusual to see mechanics signing off the wrong AD for the brand of switch installed in the airplane. Some mechanics assume that ACS switches manufactured after 1993 are not subject to AD 93-05-06, but that’s not what the AD says.
Note that neither of these ADs address the issue of switch-to-key integrity. Neither requires a check that the key can only be removed when the switch is in the Off position. Nor is such a switch-to-key integrity check called for by the Cessna annual inspection checklist, by any Cessna service bulletin, or by FAR Part 43 Appendix D. Somehow this unsafe condition seems to have slipped through the cracks.
Annual inspection
Interestingly, when the NTSB interviewed the IA who performed the annual inspection of the Skylane about six months and 30 hours prior to the fatal accident, the mechanic testified that he had indeed performed a switch-to-key integrity check and had verified that the key could not be removed in any switch position other than Off. Is it possible that the switch and key suffered enough additional wear in just 30 hours to defeat the switch’s key-retention function? Probably not.
A more likely explanation in my opinion is that the IA might have been using a different key than the one the pilot used, and that the key the IA used was much less worn. In my experience, most owners provide their shops and mechanics with a spare key rather than handing over the key they have on their keyring. Many owners leave a spare key at their shop all the time. Such a key is not used very often and so probably remains in relatively pristine condition compared to the key on the pilot’s keyring.
Speaking of keyrings, inserting the ignition key into the switch with a bunch of other keys or other paraphernalia hanging from it is a great way to accelerate the wear on the key and the lock cylinder chamber. The combination of weight on the key’s head and vibration of a running engine is a prescription for rapid deterioration of switch-to-key integrity.
Self-protection strategies
The best way to protect yourself and your airplane from falling victim to this problem is to always assume that the magnetos are hot regardless of the position of the ignition switch or the location of the ignition key. Never rotate the prop by hand unless you absolutely have to.
If you’re in the habit of rotating the prop to a certain position after you park your airplane—e.g., horizontal for two-blade props or blade-down for three-blade props—try to get out of the habit. If you must rotate the prop by hand—e.g., for towbar access—then always rotate it in the opposite direction of normal rotation. I realize you may have been taught that rotating the prop backwards can harm dry vacuum pumps, but I’ve been doing it for five decades and I can tell you it’s one of those old wives’ tales that refuse to die.
In addition, get into the habit of doing regular mag switch functional checks. These are most conveniently done during your regular preflight runup. While doing your normal mag check, tug on the key and verify that it cannot be removed from the switch in any position other than Off. At the completion of the runup, throttle back to idle and then turn the mag switch very briefly to Off and then back to Both to make sure that the engine stops firing when the mag switch is in the Off position.
Do not rely on the checks your IA does during annual inspections. The switch-to-key integrity check is probably not on his inspection checklist and is not addressed by any AD or SB. Even if the IA does perform a switch-to-key integrity check, chances are he’s doing it with a different key than the one you use to fly.
Mechanics need to observe these self-protection practices, too. Mechanics probably turn the propeller by hand more than pilots, and are definitely at risk. Before manipulating the propeller for a compression test, borescope inspection, or cylinder change, be absolutely positively certain that both magnetos are grounded out. Use a buzz box, ohmmeter, or clip leads—whatever it takes. An uncommanded engine start inside a crowded maintenance hangar would not be fun at all.
