Posts about: "Fuel Cutoff Switches" [Posts: 802 Pages: 41]

787 pilots, If throttles are NOT at idle, will their respective fuel cut off switches still trigger a shutdown?

The above checklist procedure implies throttle lever angle and cutoff switches are independant for resetting FADECs.

If so, is it time for this convention from the days where throttles and cutoffs were mechanical systems, not resolvers and switches, to end?

Risk vs reward? Requires more coordination between PF and PM in cases where cutoff is not desired by PF- keep throttle/s up, cannot be surprised by a fuel cutoff.

You do not want a condition where you can't shut the fuel off when you need to because some condition is not met.

Yes, switch directly controls spar valve (fuel supply) position - no fuel - no fire.

Thank you so much for that particular schematic, it confirms the direct link between the switches and the fuel cut off without software in between.
The switch itself is 4-pole, or a double-on, double-on switch, capable of independentently signaling whrough completely isolated poles. The plot thickens. IF the switches really are involved, there is either some kind of shortcut in within the LRU/very messed up witing harness, some freak automated muscle memory thing or deliberate action.

To be less subtle- someone cuts off switches, unknown to PF and possibly PM, with throttles off idle... Would do nothing.

Worst case, at next idle TLA, engine shuts down. I bet eyes go to cutoff switches after a scan, surely EICAS/ECAM has a Captain Obvious alert set.

Runaway RPM or locked RPM, some FADECS latch at 86 or so % N1- you'd still need TLA of idle for the cut off switch to work.

Volcanic ash, loss of all engines, desire the simultaneous FADEC reset of cycling the cutoffs- just coordinate with PM for idle TLA.

Other jets have this standard, today.

I'd say the throttle needing to be at idle is one heck of a CRM/TEM-based reason. Dual resolvers can fail, but throttles no longer get locked by jammed cable runs to the FCU on the engine. A resolver bypass would possibly be required in extremis 10 to the minus 6 to 9th case.

Who flies the throttles in normal? PF
Who typically performs the steps, including idle TLA of shutdown/restart in flight? PM.

I have rebuilt the site that organises this thread by subject here: https://paulross.github.io/pprune-th...171/index.html

Changes:

• Built the thread up to July 10, 2025, 12:31:00
• Add subjects: Relight, 51 Day Issue, Fuel Cutoff Switches (detent), ICAO, Fuel Cutoff Switches, Memory Items, Annex 13, Simulation Scenarios.
• Various technical fixes should give a better/more accurate presentation.

Project is here: https://github.com/paulross/pprune-threads
Raise issues here https://github.com/paulross/pprune-threads/issues or PM me.

Assuming the 2nd/3rd-hand 'leaked' info about fuel switches is even accurate the scenarios of what they know (investigators / leaker) would be:

1. They know exactly 1 fuel switch was cut off, perhaps implying single engine failure + wrong engine shutdown
2. They know 1 or both switches were cycled off then on, implying a last-ditch attempt at some sort reset at any point up to say ~30s
3. They know both fuel switches were cut off, and remained off, implying sabotage

Working logically through these:

1. If the cut off happened within 20s of leaving the ground perhaps it could explain why CCTV shows the initial climb then level for ~10s before descent. It could also explain the RAT and gear trucks perhaps if gear up was delayed? However, in this scenario they must know that the engine failed, that information would be clearly recorded and surely the leak would lead with that info? Also 'switches' is plural implying both, the radio call didn't mention single engine failure and like you say its quite hasty, even within 20s.
2. Again assuming switches plural, this implies either of the prevailing theories of dual engine failure leading to loss of AC or loss of AC leading to reduced thrust or engine failure. However, it also seems strange to lead with that info rather than the state of the engines or electrical systems in any flight data, unless someone can explain how the data would be impacted?
3. If this was the case then it would imply that there is no voice or engine data to explain the cut off, nothing was said and the engines were normal up until that point

Just for emphasis, the fuel control switches control both the spar valve AND the shutoff inside the fuel controller at the engine. It’s not the spar valve the starves the engine of fuel it’s the HP valve. If it were only the spar valve, shut downs at the gate would take awhile.

Agreed, but that knowledge does nothing to convince anyone that TLA is not involved in the response to fuel cut off.

Not entirely correct, the engine fuel valve is controlled by fire handle, the spar valves are at the tank. See attached.

The "Spar valves" ahould be on the fire levers/switches. FADECS/Pylons on the cutoff switches.

I'm trying to mix the best of the old and the new.

Fast, erroneous, uncoordinated or nefarious- gives a way to intervene, without changing the standards.

Throttles are no longer mechanical. Keep them forward off idle and the cutoff switch does nothing.

Fire/fail/flameout/stall- PM takes the confirmed bad throttle to idle. Then, if appropriate, fuel cutoff and then continue with the fire switch that should also isolate fuel before the engine, air, hydraulics, and electrics.

Bias- I've had mechanical fuel cutoff, mechanical throttles and mechanical isolations- DC9.

Electric throttles, fuel cutoffs and mechanical isolations- C-17s and MD-11s.

Have not had all electrical on switches, throttles and electrical circuits for isolation, only- which allows for more options and unintended consequences.

I think the correct Boeing reply would be: "it is not part of the certification process". So yes, loss of thrust on both engines during the takeoff phase is not really countered for in the procedures.

That does not mean that the pilots "out of habit" would have reverted to the procedure. Who would not? But in that case, the fuel control switches would be found in the RUN position post crash (if anything was left). So did they find the switches in the cutoff position, or did the action of switching got "stored" somewhere in FDM (not a specialist on these things, only to hear many times in the past that "maintenance is already aware" if we had an issue and called maintenance post flight)

That functional separation exists on MD-11 (for which I see you are rated) but not for 777 and 787. The key difference is that MD-11 fire shut off valves (equivalent to Boeing spar valves) are mechanically operated but 777 and 787 spar valves are electrically operated.

Boeing chose to have both the HP and spar valves controlled by the fire handles AND the cut off switches.

With the recent (albeit unofficial) indications that both engine fuel control switches were found in the CUTOFF position, I wonder if it's time to reassess the tone and meaning of Captain Sabharwal's final transmission (perhaps translated from Hindi) “Thrust not achieved… falling… Mayday! Mayday! Mayday!”

Viewed in light of the reported switch positions, the phrasing feels increasingly ambiguous. As is often stated on PPRunE, communication comes after aviation so you wonder why in the crisis and at low altitude, this message was transmitted. Being so atypical, the message merits re-examination.

This statement has been questioned earlier. Moosepileit, would you please cite the authoritative information supporting this statement? Is the EEC considering throttle position while "deciding" whether to allow a fuel cut off switch action to be completed (engine fuel valve powered to "off position) as switched by a pilot?

In bold, all we know from the unofficial report is that the cut off switches are the centre of attention, or words to that effect.

Given that it would have been obvious to the crew very late on that they were going down, might the switches being set to CUTOFF be a last ditch measure to try to prevent a post-crash fire?

We are on a roll discussing the fuel control switch positions based on unsubstantiated reports which at least meet the stringent requirements of being "rumours". On the basis of those reports and in the vacuum of information, we seem to now be discussing how the fuel control switches function.

1. There is no thrust lever interlock to the fuel control switch function. Don't know of any Boeing design that has that, nor Airbus, but the comment on the MD11 may or may not be valid. MDD had some odd functions in different systems, some good, some, less so.
2. Switching off the fuel control switches gives an immediate shutdown, at any time.
3. The rumour seems to be quite bizarre, as it presumes that as the aircraft is being rotated, (it still has symmetric thrust at that point) presumably someone with extra sets of hands turns off both fuel control switches, simultaneously. That is a 2 handed action. We are to assume that someone leans over and grabs both switches without the knowledge of the pilot who has at a minimum one hand but procedurally two hands on the control column?

Pretty easy to post & discuss unsubstantiated rumours in the absence of facts, and with those that are being possibly defamed being dead.

I am no longer interested in being a witness to the abuse of anonymity that arises on this thread.

cheers

That said, switches found in the RUN position don\x92t generate investigative focus, they're assumed to be where they should be. The mere fact that the fuel switches are attracting attention implies there's something abnormal.

This has all been answered in previous posts, but I'll repeat it for those you don't want to look back through something like 150 pages:

Thrust Lever Angle (TLA) is measured directly by the FADEC, using a resolver hardwired to and excited by the FADEC. Both FADEC channels have their own resolver input - on most Boeing aircraft it's a common resolver with two sets of electrically isolated windings, however on the 787 it actually uses two mechanically separate resolvers. The resolver is basically read as "sine" and "cosine" which is converted in the angle. This also makes error detection easy, using the sine squared + cosine squared relationship. Any other aircraft systems that use TLA use the TLA signal relayed back to the aircraft by the FADEC.

The fuel control switch is a two-position multiple pole 'latching' switch - you have to pull it out slightly over detent to move it between the RUN and CUTOFF positions (on other aircraft there is an interposing relay for some of the functions. not sure about the implementation on the 787). Moving the switch to cutoff sends a DC signal to both the High Pressure ShutOff Valve (HPSOV) in the fuel control and the spar valve commanding them to close. HPSOV is solenoid actuated and is near instantaneous, Spar Valve takes ~one second to change positions (yes, this is different than some other airframers that only send the signal to one valve or the other, but it's been standard Boeing design practice since the early 1970s). Both the HPSOV solenoid and the Spar Valve are designed to stay in their last commanded position if airframe power is lost. Moving the switch to CUTOFF also sends a 'reset' signal to the FADEC - meaning the FADEC will be offline for roughly one second. On the 787 (and 777 and 747-8), there is a brief pause (~0.25 seconds) before the shutdown signal is sent to the engine to allow the electrical system to reconfigure to prevent a brief interrupt of electrical power to the rest of the aircraft.

Pulling the Fire Handle does the same thing as the fuel condition switch - via separate wiring (physically isolated from the fuel switch wiring to help protect from things like rotor burst damage), with the exception of the FADEC reset (since there is no requirement to be able to restart the engine after a Fire Handle shutdown).

There is absolutely no TLA input into either the fuel conditions switch or the Fire Handle - you can shutdown the engine via either regardless of Thrust Lever Angle.

All this is standard Boeing design practice (and except for the no-break electrical power transfer) has been for at least 50 years. This is enforced by the Boeing "Design Requirements and Objectives" - DR&O - compliance with is demonstrated by an audit after the final design freeze.