Posts about: "Fuel Cutoff" [Posts: 302 Pages: 16]

Display and Crew Alert (DCA)/EICAS would indeed receive signal about Fuel Cutoff switches (L&R) position and written to EAFR (source:
https://data.ntsb.gov/Docket/Documen...man-Master.PDF )

Reuters, July 14 2025
Amid Air India probe, US FAA, Boeing notify fuel switch locks are safe, document, sources say

WASHINGTON/NEW DELHI/MONTREAL, July 13 (Reuters) - The U.S. Federal Aviation Administration and Boeing (BA.N), have privately issued notifications that the fuel switch locks on Boeing planes are safe, a document seen by Reuters showed and four sources with knowledge of the matter said.

The FAA's Continued Airworthiness Notification on July 11 came after a preliminary report into Air India's Boeing 787-8 crash, which killed 260 people last month, raised questions over engine fuel cutoff switches.

The FAA's notification to Civil Aviation Authorities, seen by Reuters, said: "although the fuel control switch design, including the locking feature, is similar on various Boeing airplane models, the FAA does not consider this issue to be an unsafe condition that would warrant an Airworthiness Directive on any Boeing airplane models, including the Model 787."

When asked for comment, the FAA said it did not have anything to add beyond the notification.

Boeing also referred to the FAA notification in a Multi-Operator-Message sent to the airlines in the past few days, which said the planemaker is not recommending any action, two of the sources with direct knowledge said.

When asked for comment, Boeing referred Reuters' questions to the FAA.

The preliminary investigation report into the crash by India's Aircraft Accident Investigation Bureau (AAIB), referred to a 2018 FAA advisory, which recommended, but did not mandate, operators of several Boeing models, including the 787, to inspect the locking feature of the fuel cutoff switches to ensure it could not be moved accidentally.

The report said Air India had said it had not carried out the FAA's suggested inspections as the FAA 2018 advisory was not a mandate. But it also said maintenance records showed that the throttle control module, which includes the fuel switches, was replaced in 2019 and 2023 on the plane involved in the crash.

The report noted "all applicable airworthiness directives and alert service bulletins were complied on the aircraft as well as engines."

ALPA India, which represents Indian pilots at the Montreal-based International Federation of Air Line Pilots\x92 Associations, in a statement on Saturday rejected the presumption of pilot error and called for a "fair, fact-based inquiry."

"The pilots body must now be made part of the probe, at least as observers," ALPA India President Sam Thomas told Reuters on Sunday.

ALPA India, in a letter posted on X, said the preliminary investigation report referred to the 2018 FAA advisory "concerning the fuel control switch gates, which indicates a potential equipment malfunction."

In the flights final moments, one pilot was heard on the cockpit voice recorder asking the other why he cut off the fuel. "The other pilot responded that he did not do so," the report said.

It said fuel switches had almost simultaneously flipped from run to cutoff just after takeoff. The report did not say how the switches could have flipped during the flight.

Two U.S. safety experts said on Saturday they backed ALPA India's request to be observers in the probe, but said the investigation report did not suggest a bias toward pilot error.

John Cox, a pilot and former ALPA U.S. representative, said AAIB's report seemed objective and fair.

This seems to quite clearly answer the question: (from the prelim report)

That's the Embraer option.

The other option I can imagine is a mechanical stop with an override button, like the landing gear lever. Can't switch the fuel levers off unless you're slow and on the ground, the engine is failed or on fire, or you push override.

The report makes no comment on how the handling pilot determined fuel was cut off, the assumption is he eyeballed the switch.
But, is it feasible that the handling pilot was well aware of fuel issue (loss of thrust, decreasing engine sound, instrumentation) without requiring a scan of the fuel cutoff switches, certainly if the non handling pilot said he hadn\x92t touched the switches and that the handling pilot had his hands full, low level and descending?

Quote:

Originally Posted by YYZjim

The preliminary report narrows things down a lot but not as much as it could have done. The report will have been approved by several people. What we see is their consensus. Why did they choose this version?

I agree that the Preliminary Report will have been a very carefully chosen synopsis, but I don't think it precludes a system behaviour that might or might not even be categorised as either an electrical or mechanical malfunction, as such.

Consider that the Preliminary Report only references the CVR contents to indicate one crew querying why he (the other) cutoff, and the other denying it. Clearly very pertinent data to this investigation, so I'm not ruling out both of the crew being sincere, until I understand the aircraft system better.

If the cutoffs weren't triggered by the crew moving the switches, then the most likely thing was that both FADECs encountered a situation that invoked cutoff, practically at the same moment. That might suggest that the data from independent Run/Cutoff switches via independent poles that possibly route via a PIP or PIPs to various RDCs and in turn the CCS (which means these paths have a common mode) resulted in data to both FADECs "failing" in a critical manner simultaneously.

The only CCS vulnerability I'm aware of is what happens if the CCS is kept powered for 51 days, shortly after which, the Time Manager data integrity for ARINC 664 messages is compromised, possibly only considered critical n conjunction with a CDN Switch failure. AD 2020-06-14 therefore requires a maintenance action of cycling the CCS power at least once every 25 days.

Two such omitted, or incorrectly executed maintenance actions in a row would have to happen for that known issue to be relevant. Perhaps there is some other input in the CCS system that influences both lanes of data to the FADECs for the Cutoff to be triggered, but I'm not aware of such.

If the data to both FADECs became good again around the same time (perhaps no longer Stale Data, or an alternative source selected, or other mechanism), and given the unavailability of APU power at this point, might Engine 1 restart be initiated first, and might Engine 2 restart be triggered 4 seconds later by the FADECs? Is that possible without the crew cycling the switches?

Regarding AD 2020-06-14, which was approved quickly, Boeing subsequently offered revised wording, which changed "may" to "will", see FAA Docket 2020-0205-0004, but as it did not alter the maintenance action, it was not adopted. A fuller description of possible consequences was in FAA Docket 2020-0205-0001_content, but it was quite wide ranging, and didn't attempt to characterise specific aircraft systems behaviour.

For anyone wanting more information on the CCS, in the context of that Airworthiness Directive, I recommend reading A Reverse Engineer’s Perspective on the Boeing 787 ‘51 days’ Airworthiness Directive at IOActive.

As a non-professional pilot, please accept that my knowledge of much beyond the CCS is patchy, but I welcome this scenario being critiqued.

Thank you for your time, and I'm just donning my hard hat and flack jacket.

This has been discussed to death previously. I suggest looking for tdracer's excellent insights into FADEC design and implementation. From the beginning we've been discussing various very rare types of circumstances. Based on the preliminary report we can now lay most of those to rest.

Which actually brings me to this one because I would like to ask for a bit of clarification: By "fuel switch discrete" are you referring to the Fuel Control Switches discussed in the preliminary report?
I would assume from your statement, that if a mismatch in the NC/NO signal on the switch was detected the FADEC would not direct the Fuel Cutoff Valves to close (as far as the types you are familiar with are concerned), is that correct?

The report states:
So this would then mostly preclude the possibility of one or both switches being faulty electrically.

The report then states:
There is a 10 second gap between cutting fuel and re-enabling it and a 4 second gap between switches during re-enabling. Is there a mechanical reason why these switches would be slower to operate in either direction? There are obviously reasons such as startle factor and stress that might negatively affect the speedy operation of switches by anyone, but I am nonetheless curious if this might not be a pointer to some sort of mechanical issue after all, such as asymmetric wear or FOD.

One of the initially discussed variants was inadvertent operation of the Fuel Cutoff Switches instead of putting up the landing gear. There was some pushback against that idea based on the position of the landing gear. As far as I recall the observed position of the landing gear was ultimately deemed to be caused by loss of hydraulics, and not as caused by interruption of the raising operation, making it fully compatible with the preliminary report. It's curious that the report does not mention the positive rate and gear up call out, either for its absence or it being made. It does note that the landing gear lever was in the down position, which isn't unusual for a severe event just after V2 but also in line with the theory.

With what we know now from the preliminary report that option seems to be a good candidate as the source of initiation for an action slip. Both the PF instead of calling Gear Up Action Slipping and operating the Cutoff Switches, or the PM instead of calling Positive Rate doing so would fit that scenario and timeline.

With Airbus it is required. However, I cannot speak about Boeing's operating philosophy.

To quote from Airbus' Flight Crew Training Manual:

In flight, the PF and PM must crosscheck before any action on the following controls:

‐ ENG MASTER lever (With Boeing this would be the fuel cut-off switches)

‐ IR MODE selector

‐ All guarded controls

‐ Cockpit C/Bs.

Since we have had a few 787 qualified pilots contributing lately, hopefully one of them can clear up whether or not that's standard in their checklists / SOPs, etc.

I first didn't understand his answer as well (it was my question). In the meantime I know more about the logic: The fuel shutoff valves are not operated by the FADEC. The switches are wired directly to latching relays that drive the (latching) fuel valves. Using an additional pole of that switch the FADEC just gets the information that the switch was operated (and of course the current position). The FADEC can then e.g. execute the engine restart sequence if required.

Come on... I fly the 787, and there is absolutely no way you can hit the fuel cutoff switches by accident when selecting the gear switch, for either pilot. This is absolutely ridiculous.

Having read through most of the posts in this and the other threads, and the preliminary report a few times in parts, am mystified by this:

The Preliminary Report states: "The CCTV footage obtained from the airport showed Ram Air Turbine (RAT) getting deployed during the initial climb immediately after lift-off (fig. 15). No significant bird activity is observed in the vicinity of the flight path. The aircraft started to lose altitude before crossing the airport perimeter wall."

Does this mean the RAT deployed "immediately after" in the sense of within 1 second after lift-off?

We, as a group, certainly seem to be interpreting the "immediately thereafter" in a prior paragraph to mean that the E1 and E2 fuel cutoff switches went RUN -> CUTOFF within 1 second or so after max airspeed of 180kts at 08:08:42.

The prior paragraph for quick ref:
"The aircraft achieved the maximum recorded airspeed of 180 Knots IAS at about 08:08:42 UTC and immediately thereafter, the Engine 1 and Engine 2 fuel cutoff switches transitioned from RUN to CUTOFF position one after another with a time gap of 01 sec. The Engine N1 and N2 began to decrease from their take-off values as the fuel supply to the engines was cut off."

Additionally, have to say, this PR has a few major weaknesses in it:
- no timestamp for RAT deployment, though RAT hydraulic power coming online has one; also is it for initial power or rated power?
- no timestamp for the pilot conversation about 'cutoff', though it is provided for the MAYDAY.
- no timestamps for E1/E2 Fuel Cutoff Switches going from RUN -> CUTOFF, though they're provided for CUTOFF -> RUN.

After all the analysis on PPRuNE, fuel switch failure (well, dual switch failure, at practically the same time) seems so unlikely it's no longer worthy of consideration. However, I'm still open to the idea of a failure elsewhere that may have signalled the fuel switches had transistioned from Run to Cutoff wthout physical movement of either switch. Why? Firstly, because of this (taken from the preliminary report)



The STAB cutout switches are located next to the Fuel cutoff switches. What did Air India’s on duty AME do as part of their troubleshooting? Were panels removed to gain access to the rear of the switches and wiring? What about wiring and data connections elsewhere? What may have been disconnected/disturbed as part of this process? Do the STAB cutout switches and Fuel cutoff switches share any connectors that could have been inadvertantly cross-connected? Etc. It would not be the first time that an engineer had innocently done something that later caused an accident. And I haven't read anything about possible nefarious action by a (disgruntled?) engineer - but I've seen lots of accusations directed at the pilot(s)...

Secondly, the preliminary report's version of (part of) the conversation in the cockpit -
Until proven beyond reasonable doubt I'm chosing to take the cockpit conversation at face value, because I really don't want to believe any of the following scenarios:
A) one of the pilots lied
B) one of the pilots attempted to deflect blame onto the other pilot for the benefit of the CVR
C) One of the pilots unknowingly operated the fuel cutoff switches.
D) One of the pilots deliberately operated the fuel cutoff switches.

It is all too easy to blame one of the pilots when in reality no one outside of the official investigation may yet know what most likely happened.

Inspired by the mention in the PR about a MEL on the \x91core network\x92, I came across the polemics between Boeing and IOActive a few years ago about the alleged vulnerability of 787 core systems to outside interference (hacker attack from within a/c and/or ground), including the highly sensitive CDN module, from where also the fuel cut-off module can be accessed. It\x92s definitely not my specialty, but I thought to flag it in case someone has more informed ideas about this. To my mind it could potentially \x93outshine\x94 intentional crew action. Boeing at the time denied such options, of course. Obviously also in good faith, moreover it seems to be Honeywell &GE code anyhow, but who knows where we are 6 years on.

https://www.wired.com/story/boeing-7...ecurity-flaws/

I would stay away from assuming any intentional harm as it goes against the definition of safety I learned at Eurocontrol: Safety is the absence of unintended harm. Safety Culture and Security are so often mutually exclusive that I don't consider security considerations worthwhile in the context of aviation accidents.
Wires or wiring is mentioned twice in the report:
Considering the state of the rest of the components, with basically everything showing signs of burn damage, it will be a hell of a puzzle and very time consuming to reconstruct that and nigh impossible to find any source of error there. I was actually intrigued by the potential for FOD. But I'd imagine they would have been able to identify anything pretty easily.

While severely burnt the switches are still solidly in place and anything that was lodged in the switch housing itself would likely still be there. And I guess it would also be unlikely for FOD to equally impact both switches. I think I just talked myself out of the FOD theory.

I find option C to be at least a productive train of thought because it may provide methods of mitigation. That is after all what we're trying to achieve in discussing this kind of accident. I would expect or at least look positively on a suggestion to use the Embraer model for operating the cutoff valves. While it introduces a secondary element that may fail, requiring the Throttle Control Levers to be at idle just seems like a good idea. How is this handled by Airbus?

I cannot read the linked article. Would you please describe what you mean by "the fuel cut-off module", preferably with reference to the related aircraft schematics showing the signal paths between the fuel switches, spar valves, and engine HPSOV.

I believe it is highly unlikely that anything will occur in any of the legal - or investigatory - processes happening now or which will occur, that will meet the "proof beyond a reasonable doubt" standard.

SLF here, but I did read all 3 threads. To me, this doesn't seem likely. But it got me thinking, what about the fuel switches being partially cross-connected left to right and right to left? If each of the 8 channels (4 for each switch) has its own connector, it could be possible. From what I understood from earlier posts, from the 4 channels of each switch, there are 2 can shut down an engine. If that's the case, assuming some cross-connection, a single switch movement might be able to affect both engines.

But, even if this were possible, there are problems with this hypothesis too. The problem would most likely be discovered during engine startup, if the engines are started one by one, not at the same time, as they probably wouldn't start unless both switches are set to RUN. And not sure how this would fit the various delays recorded on the FDR. And you still need something/somebody to move at least one of the switches after rotation to trigger the issue. Both switches being moved by the pilots still seems much more likely to me than some technical issue.

"Software faults" do not usually come out of the blue, for no particular reason. Just because it's recorded by software it doesn't mean that it's not something hardware related that triggers it. In a previous reply, not sure if in this thread, it was mentioned that the message meant that there was implausible data coming from those STAB cutoff switches, if I remember correctly. Something like a channel showing both on and off at the same time, or the other way around, or some other inconsistency. That could have been an intermittent issue, that might indeed not be reproducible with a BITE test, and just be cleared. But if the STAB cutoff switches did indeed have a problem, or one was suspected due to recurring reports, is it really so unlikely that they might try to look for some hardware issues, such as a loose connector? For the Lion Air accident involving MCAS, after repeated issues during previous flights, they did exactly that: disconnected and reconnected some connectors to check for issues, among other things.

It also is both possible without imagining things, and consistent with - shall we call it "best practices" under Annex 13 - for the person or persons who wrote and approved the preliminary report to have taken into consideration the attention their report would receive from many audiences, not only aviation professionals.

The prevalence of the 787 type. The quite recent travails of Boeing and the pace of its recovery (and some doubters that it can or will recover). The orders of magnitude increase in information, as well as misinformation or even disinformation, about this accident compared to .... well, compared to the UPS accident in Birmingham in 2013 (Flight 1354), cited as it was the first "current" accident occuring as of my stumbling across this forum and its threads. Sure, not a dramatic passenger aircraft accident but still valid for comparing the information environment then, and now.

The persons responsible for this report, I think, did not act improperly if they included information not strictly necessary for the purpose of keeping aviation cognescenti updated about what is known with some (imprecisely defined) level of certainty and clarity. Such other information items could be intended to make some effort at mitigating ("minimizing" would be hoping for too much) the volumes of noise emanating from all over.

Then there's the point about the report source knowing who did what, and when, but not providing specifics. Perhaps forensic analysis of the voice recording is ongoing, perhaps an analysis was completed but with reason to examine more closely. Regardless, I do not find it an affront either to solid, long-established principles of the Chicago Convention and Annex 13, or to the general ideas about advancing aviation safety, for the report sources to not treat the 30-day rule for preliminary reports as some "complete download demand function." Given what is reported about the fuel cutoff switches moving and the summarized cockpit statements, either way the final facts resolve will be tremendously impactful for the airline, the CAA of India, and the country (including but not only in its role as a major aviation Member State).

I wouldn't hold this view if it was a question of deception. I see it instead as a matter of reasonable discretion, about both ..."what to leave in, what to leave out" (with apologies to Bob Seeger, "Against the Wind", 1980).

There would have been multiple similar failures in different locations. The data for the EAFR is completely separated from the wiring and circuitry for the HP fuel valves. - And that on both engines.

That is nonsense. There is no "fuel cut-off module". The fuel cut-off HP valves are operated directly by the cut-off switches through simple latching solenoids. No computer involved, not part of any communication network of the plane. The FADECs (which itself are totally separated from the rest of the aircraft) only get information on the status of the switches; e.g. to faciliate engine restart.