Why doesn't the Convair 580 have check valves to prevent inadvertent fuel transfer? The Convair 580's fuel system is composed of two wing-mounted fuel tanks (one in each wing), each with its own shutoff valve (which can be closed to isolate its respective tank from the rest of the fuel system and prevent fuel from entering or leaving the tank) and boost pump (which forces the fuel, under pressure, to the respective engine(s)), plus a pair of crossfeed valves (one on each side of the aircraft) to allow an engine to be fed from its contralateral fuel tank if necessary.

Normally, the crossfeed valves are kept closed, and each engine is fed from its ipsilateral fuel tank.  However, if crossfeeding does become necessary (for instance, if one fuel tank drains due to a leak [in which case both engines must be fed from the non-leaking tank] or if one engine fails [in which case the remaining engine must be periodically switched between the left and right tanks to prevent the weight of the fuel in the tank ipsilateral to the failed engine from unbalancing the aircraft and causing a loss of control]), the crossfeed valves are opened, and the tank shutoff valve for the tank not being used must be shut off; otherwise, the boost pump for the tank being used can end up pumping fuel into the tank not being used rather than to the engines.1

Transferring fuel from one tank to the other is expressly prohibited for the Convair 580, as doing so could lead to, in increasing order of severity:


Fuel being lost through the overflow vents in the recipient tank (which is bad because it wastes fuel);
The aircraft's entire fuel supply being pumped into the tank not being used (which is bad because it can result in both engines flaming out despite the aircraft's fuel system containing plenty of fuel);
The recipient tank (and its associated wing) bursting (which is bad for reasons that should be immediately obvious).


However, there is no mechanism to prevent fuel from transferring between tanks if the pilot forgets to close the shutoff valve for the tank not being used, which leads to the Convair 580 being an aircraft where fuel transfer is, simultaneously,


Prohibited under any and all circumstances, as doing so could cause a fuel tank to overflow and/or burst; and
Quite easy to make happen, simply by opening the crossfeed valves and forgetting to close the shutoff valve for the tank not being used.


This seems almost trivially easy to solve, by placing one-way check valves in the lines leading from the fuel tanks so that fuel is physically prevented from transferring from one tank to the other, but, according to the NTSB (footnote 46, page 25/35):


  One-way check valves are not typically installed on airplanes, and the accident airplane did not have one installed. According to a Kelowna Flightcraft representative, one Convair 580 operator modified its fleet of about 30 Convair 580 airplanes in the 1960s under an engineering order by installing a one-way check valve, which prevented fuel from flowing back into the fuel tanks when the fuel tank shutoff valve was left open. However, the representative stated that this operator was no longer in business and that its airplanes had represented a small percentage of the entire Convair 580 fleet.


I can see no reason not to use one-way check valves in the Convair 580's fuel system, given the potentially-lethal consequences of transferring fuel between tanks and the frightening ease of inadvertently doing so.  So why doesn't it use them?



1: The boost pump for the tank not being used must be shut off to keep fuel from being pumped from that tank, rendering it incapable of preventing fuel from transferring into the tank not being used.2  Even if the pilot forgets to turn it off, fuel can still be forced through the pump in the reverse direction if it (the pump) happens to be less powerful than the boost pump for the tank being used.

2: And, if the pilot closed the shutoff valve without turning off the associated boost pump, the force of the pump pumping against the closed valve could potentially cause a fuel line to burst.
A check valve is another failure point in the fuel system (they can stick) so you have to do a risk analysis to decide if the benefit of adding them outweighs the risk of the added failure mode introduced, with sufficient weight to justify mandating them by AD.  With no AD, it's up to KFC to decide if it wants to do anything on its own.

Assuming this was a one-off event (the report only mentions one previous less serious  but similar event) that is more or less attributable to bad piloting, the balance of risk, when added to the burden of forcing an AD on operators, would have been determined to not fall within the threshold needed to mandate such a change (I've participated in these kinds of projects over the years).

If another crash or two happens later with more or less the same circumstances, it's more likely to trigger an AD.  But these airplanes have been flying a very long time like this.

Yes there is a tendency to think the need to do something is obvious, but if ADs were issued for every potential design deficiency to cover every eventuality, there would be eleventy jillion ADs out there.  That being said, there was probably an internal debate with discussions between Transport Canada and KFC, with pro and con factions arguing it out, and TC was probably convinced that mandating check valves would not provide sufficient risk mitigation to justify the burden of issuing an AD (The FAA could do something on their own, but usually they will work with TC on this and go along with TC's resolution).