Posts about: "Fuel Cutoff" [Posts: 302 Pages: 16]

Engine isolation means just that. No common wire bundles, no common connectors. You can move the fuel levers at any time - there is no lockout of any kind with respect to thrust lever position (imagine dropping something into the lever linkage that jams the thrust lever at max power - then being unable to shut that engine down?)
Obviously, since the thrust levers are placed next to each other - the separation that's available in the center console is limited, but as soon as the wiring exits that constrained area, the separation increases. Furthermore, the same engine-to-engine wiring separation also applies to channel A/B FADEC channels, as well as the fuel switch/fire handle wiring.
All these requirements are documented in the Boeing DR&O (Design Requirements and Objectives) - and there is an audit done late in the design process to insure compliance.
In short, you're barking up a tree stump - there is nothing there.

If we are to take the TCMA patent at face value, the fuel cut-off switches are directly-acting, not some sort of signalling protocol.

That's a pretty big "if" but here's the patent drawing:

Searching the web, I found out that regulations concerning new FDR require parameter 35g "fuel cut-off lever position" to be recorded. I also found that for a 2003 event with a 757, this was recorded (as was fuel flow).

I expect that this is also true for the 787. Can anyone confirm this?

Have the spring loaded Fuel Shut Off Valves been examined by GE on both engines???

Why would spring loaded valves fail on both engines? The final valve in the GEnx Fuel Metering Unit (FMU) before the fuel flow meter and things like the fuel nozzles, is called the HPSOV and is spring loaded to closed, but fuel from the Fuel Metering Valve (FMV) can keep it open with minimal pressure (certainly enough presssure for engine start). Tank electric pumps and the engine-mounted, mechanically-driven two-stage pump supply fuel to the Fuel Metering Valve. During main tank pump failure, the engine mounted pump suction feeds the engine. There are altitude limitations during climb (according to the FCOM).

There are several ways that the HPSOV can close:
An EEC (engine ECU) can close the upstream Fuel Metering Valve (FMV) electronically, so the HPSOV will lose its opening pressure.
The HPSOV can be acted on by a Shutoff Solenoid Valve (which directs fuel pressure in an opposite manner to the pressure coming from the Fuel Metering Valve).

Unfortunately, the diagram I am using is truncated, and I can't see if the Shutoff Solenoid Valve is magnetically latched in its last commanded position like typical fuel shutoff valves. Nor can I see what controls it. I suspect things like the respective cockpit fire handle and fuel cutoff lever, but also EEC commands.

There is probably a copyright on the diagram, so I won't post it here. Perhaps someone can fill in the gaps for me?

As an electronics and software engineer who has read the AD and related materials on the 248 day bug my understanding is that:

1. The specific 248-day integer overflow was patched, and before the fix was rolled out, the AD required this system to by power cycled every 120 days to prevent overflow
2. The PCU software still has the functional requirement to be able to command all AC GCUs to enter failsafe mode, this means that while the initial bug was fixed, the ability for this particular software system to command the same result is still a functional part of the architecture - presumably for safety management of the AC system
3. This was not the first or last "software overflow error" issue in Boeing or even in the 787

Although I'm not qualified in aviation engineering I do believe from an engineering safety standpoint that this architecture creates a rare but entirely feasible scenario in which the aircraft would be without AC power for at least 30 seconds until the APU could restore it.

I do agree that the engine driven pumps should be able to provide fuel alone, the whole point of these pumps is to keep the plane flying within some limitations, high altitude is one of those limitations, I propose that there may be others based on the following:

• Some more knowledgable people here have proposed or countered vapour lock, fuel contamination and automatic fuel cut-off theories to various degrees - even if these are not enough on their own, loss of electrical during rotation at high temperature could combine with these in a way we have not yet considered
• Thrust is nonlinear, and while I'm not qualified to say how much loss of fuel flow or loss of thrust would be critical in this scenario we do know that it was a hot takeoff with significant weight and gear remaining down - I know others here have run sims but I don't think anyone has focused on specific thrust / fuel flow params
• While electric fuel pumps might not be physically necessary for takeoff, my final point is: why are they required for takeoff? Is it not to mitigate cavitation, fuel sloshing at rotation, or any other kind of problem that might be relevant here?

Similar failures have happened on 737s/A320s/A330s and others. I'm not denying it's possible. There's a reason it's a certification requirement for the engines not to be dependent on aircraft power. The APU is MELable and battery starts are not extremely reliable.

Thrust is non-linear and complex. Reaction engines (i.e. fans, props) are generally most efficient at minimum power - lowest excess velocity. Turbine engines are generally most efficient at high power. These cancel out somewhere in the middle. With two engines at low power, you also don't have the drag from the dead engine or the drag from the rudder countering yaw.

Cavitating destroys pumps rapidly - someone upthread said replacing the fuel pump immediately is SOP if it has suction fed. Expect end of life in tens of hours rather than tens of thousands.

Some aircraft have switched to using jet/venturi pumps powered by returned fuel, like the A220. The electric boost pumps there are mainly for redundancy and are shut down in cruise; only one in each wing tank. Some A320s replace the centre override pumps with venturi transfer pumps.

A bit of a pedantic point, but the locking lever in the photo above is not the right action for the fuel cut off switches on the 787. The switch above has two locked positions and a biased further position. You could say ON-OFF-BIASSED. There are some photos earlier in the thread (assuming they are still there) of the correct Honeywell switch and its gate.

Edit: And here it is:

Many thanks, DTA.
For those unfamiliar with cockpit controls in general, I\x92ll leave my \x93schematic\x94 image to show the principle of \x93lift-and-move\x94 the toggle vice just pushing the toggle in a desired direction.
Cheers,
PJ2

It\x92s also not inconceivable that a human being who KNOWS they\x92ve had a dual engine failure at the worst time has immediately launched into memory items. Those memory items include \x91cycling\x92 the fuel cut off switches\x85

787 pilots, If throttles are NOT at idle, will their respective fuel cut off switches still trigger a shutdown?

The above checklist procedure implies throttle lever angle and cutoff switches are independant for resetting FADECs.

If so, is it time for this convention from the days where throttles and cutoffs were mechanical systems, not resolvers and switches, to end?

Risk vs reward? Requires more coordination between PF and PM in cases where cutoff is not desired by PF- keep throttle/s up, cannot be surprised by a fuel cutoff.

You do not want a condition where you can't shut the fuel off when you need to because some condition is not met.

Yes, switch directly controls spar valve (fuel supply) position - no fuel - no fire.

Thank you so much for that particular schematic, it confirms the direct link between the switches and the fuel cut off without software in between.
The switch itself is 4-pole, or a double-on, double-on switch, capable of independentently signaling whrough completely isolated poles. The plot thickens. IF the switches really are involved, there is either some kind of shortcut in within the LRU/very messed up witing harness, some freak automated muscle memory thing or deliberate action.

I have rebuilt the site that organises this thread by subject here: https://paulross.github.io/pprune-th...171/index.html

Changes:

• Built the thread up to July 10, 2025, 12:31:00
• Add subjects: Relight, 51 Day Issue, Fuel Cutoff Switches (detent), ICAO, Fuel Cutoff Switches, Memory Items, Annex 13, Simulation Scenarios.
• Various technical fixes should give a better/more accurate presentation.

Project is here: https://github.com/paulross/pprune-threads
Raise issues here https://github.com/paulross/pprune-threads/issues or PM me.

Agreed, but that knowledge does nothing to convince anyone that TLA is not involved in the response to fuel cut off.

The "Spar valves" ahould be on the fire levers/switches. FADECS/Pylons on the cutoff switches.

I'm trying to mix the best of the old and the new.

Fast, erroneous, uncoordinated or nefarious- gives a way to intervene, without changing the standards.

Throttles are no longer mechanical. Keep them forward off idle and the cutoff switch does nothing.

Fire/fail/flameout/stall- PM takes the confirmed bad throttle to idle. Then, if appropriate, fuel cutoff and then continue with the fire switch that should also isolate fuel before the engine, air, hydraulics, and electrics.

Bias- I've had mechanical fuel cutoff, mechanical throttles and mechanical isolations- DC9.

Electric throttles, fuel cutoffs and mechanical isolations- C-17s and MD-11s.

Have not had all electrical on switches, throttles and electrical circuits for isolation, only- which allows for more options and unintended consequences.

This statement has been questioned earlier. Moosepileit, would you please cite the authoritative information supporting this statement? Is the EEC considering throttle position while "deciding" whether to allow a fuel cut off switch action to be completed (engine fuel valve powered to "off position) as switched by a pilot?

From the Report:

- fuel cut offs were found in the RUN position

- on take off roll both engines lost power as the fuel cut offs went from RUN to cutoff

- CVR recorded one pilot asking why they had gone to CUTOFF

- within 10 seconds the fuel cutoff was moved back to RUN

-RAT was deployed, APU had begun auto start

- 32 seconds after Vr the MAYDAY was called



This should also dispel a lot of the comments about AAIB-India, Indian culture in general and general competence. For a preliminary report this is far more thorough and extensive than what would normally be expected and they\x92ve kept Boeing, GE, FAA and investigators from US, UK, Canada and Portugal in the loop from the start



They have also clarified why it took so long to do the EAFR download- because of the extensive damage they had to source specialist equipment from the NTSB that only arrived on the 23rd of June (they downloaded on the 24th) so all that talk of a \x91coverup\x92 is pretty embarrassing now

of course the big question is why/how those switches were commanded into cutoff in the first place the exact sequence at Vr is the most critical, there hasn\x92t been much scrutiny at all that I can see in the Indian/international media of the personal
background of the flight deck crew which has happened in other suspected pilot initiated disasters in the past, I guess this is an avenue investigators will have been doing themselves