Main Fuel Pumps

Six pumps feed two engines: two main pumps in each collector cell, plus one standby pump per side. This article covers the machines themselves — how a pump is built, why running one dry is a fire-protection event rather than a wear item, how the standby takes over without being asked, and why the pump can be changed without draining the tank.

1. The line-up

The placement is doctrine, not convenience: the mains live in the always-full collector cell (tanks and storage) for negative-g feed; the standby lives in the aft division so that closing the SPLIT valve still leaves a powered pump on the surviving side of the tank.

All are three-phase 115 VAC motor-driven centrifugal pumps; a two-stage element (an inducer feeding a main impeller) takes the inlet flow smoothly to delivery pressure, which keeps the pump resistant to vapour and slosh at the inlet.

2. The thermal fuse — why dry-running is forbidden

Each motor phase is protected by a non-resettable thermal fuse. Fuel is the pump's coolant and lubricant; a pump running in an empty cell heats up until the fuse blows — permanently:

[!warning]- The fuse trades a pump for a tank A motor inside a fuel tank must never become an ignition source. Rather than risk a hot motor in vapour, the design sacrifices the pump: once the thermal fuse opens, the pump is dead until replaced. This is why procedures are quick to switch pumps OFF when a tank runs empty (the FUEL CTR TK XFR FAULT logic in transfer faults exists precisely because a pump kept running in an empty tank is burning itself), and why "pump OFF" steps in ECAM procedures are not housekeeping but fire prevention.

3. Pressure monitoring and the automatic standby

Each pump's delivery line carries a pressure switch. Low output pressure — pump failed, tripped, or starved — does two things: raises the pump's LO PR condition (the FAULT light on the overhead pushbutton and the associated ECAM alert), and on the main pumps, triggers the takeover:

"The corresponding standby pump automatically replaces the faulty main pump."

That line sits inside the single-pump ECAM procedure itself — by the time the alert displays, the replacement has happened. The standby is not a spare you select — it is armed by design. With its pushbutton in the normal (auto) position it sleeps until a main pump's pressure drops, then runs. On the SD FUEL page a sleeping standby shows as a crossline (off) symbol; when it takes over, the symbol goes in-line green.

Because the takeover is silent and automatic, the alert philosophy follows: a single main pump LO PR is a one-line procedure (switch the affected pump OFF — the standby already has the load); the side only becomes serious when the group fails (FUEL L(R) WING PUMPS LO PR), which is where the leak-or-not decision tree starts (pump failures and gravity feed).

4. Canister mounting — pump change without tank entry

Each pump is installed in a canister: the wetted housing stays in the tank, the pump element withdraws through it. A shut-off feature in the canister seals the fuel as the element comes out, so a pump can be replaced without defuelling or entering the tank — the maintenance-hours argument behind the architecture, and the reason a pump swap can be a turnaround item rather than a hangar visit.

5. Dispatch — where the tolerance sits

Some operators' MEL draws the line between the two pump types sharply:

• One main pump inoperative — dispatchable (category C) with conditions in the spirit of: extra fuel margin (in the region of 2 000 kg) to cover the degraded-feed case, restrictions on ETOPS operation for specific pump positions, and part-number-level applicability limits.
• Standby pump inoperative — no dispatch. Both standbys must work, full stop.

The asymmetry encodes the architecture: a main pump has a live backup standing behind it; the standby is the backup. Lose a layer of redundancy and you can buy it back with fuel and routing limits; lose the backup itself and there is nothing left to buy with.

Self-test

[!note]- Q1. Why are the main pumps inside the collector cell but the standby outside it? Mains need the cell's negative-g guarantee for normal feed; the standby sits in the aft division so that even with the SPLIT valve closed, the isolated aft fuel still has a powered pump.

[!note]- Q2. What does the thermal fuse protect — the pump or the aircraft? The aircraft. It permanently kills an overheating motor before it can become an ignition source inside a tank. The pump is the sacrifice; that is why dry-running must be stopped promptly by switching pumps off.

[!note]- Q3. What must the crew do for the standby pump to take over from a failed main? Nothing. With the standby pushbutton in its normal position, a main pump's low pressure (or being switched OFF) starts the standby automatically.

[!note]- Q4. Why can a fuel pump be changed without draining the tank? Canister mounting — the element withdraws through a housing whose shut-off seals the fuel as it leaves.

[!note]- Q5. Why does the MEL allow one main pump inoperative but never a standby pump? A main pump has the standby behind it (redundancy can be compensated with fuel/route limits); the standby is the last powered layer — its loss is not compensable.

Key takeaways

References

• AMM 28-21-00 Description and Operation (pump construction, canister, pressure switches, standby logic, thermal protection).
• FCOM DSC-28-10-40 (pump arrangement and automatic standby), PRO-ABN-FUEL pump LO PR procedures.
• Some operators' MEL 28-21 items (main vs standby asymmetry).
• The asymmetry rationale and fire-protection framing are integrative synthesis.

Independent study material, not an Airbus publication and not endorsed by the manufacturer. Always defer to the current operator FCOM, FCTM, and QRH for operational use.