Posts about: "Fuel Cutoff Switches" [Posts: 802 Pages: 41]

It was stated earlier that 2 of the poles in the switch are wired to separate Remote Data Concentrators. The RDCs feed data into the Common Data Network (essentially an Ethernet LAN).

The EAFRs simply sniff the required data from the CDN, so there's no DFDAU as such.

For some parameters, including the fuel cutoff switches, the EAFRs also record a "Source Index." For the fuel cutoff switches, there are 4 sources numbered 1 through 4 as well as a valid/invalid flag. I don't know what the sources are, but perhaps they're the 2 RDCs plus the 2 channels of the EEC/FADEC. It appears that source 1 (the default) is not the EEC.

I'm not surprised though it gets frustrating when folk start defaulting to the most remote possibilities instead of the more likely ones. The flight data recorder logged the fact that the switches were moved to cutoff, 1 second apart, very soon after airborne, then some seconds later moved back to run. None of that fits with any realistically conceivable mechanical failure nor automated system fault. Both of those are physical actions taken by a pilot. The first action was to shut them down, and the second action was an attempt to start them up again (tragically close to being successful). Nor does it fit with a muscle memory mistake or confusion with another switch.

Which leads to a very unpleasant possibility that many people would rather not consider, and some even refuse to consider, despite there being at least one historical precedent that I can think of (a pilot for a particular airline many years ago who had an undiagnosed mental health condition and admitted to struggling with impulsive thoughts of shutting down all 4 engines on a B747).

A bit late to check them now, but I don't expect anything will be found on the 787s. They are just doing this to cover themselves, I think.

Fully agree just seems crazy to me that a non-insignificant number on this forum are chasing a 0.00000000001% chance over the 99.99999999% very obvious answer looking at you square in the face. We might never know if it was intentional or not, only the full CVR may give insight but even then who knows. While its fun to try and dive into the system details, but main problem is no currently employed Boeing engineer who knows the system well enough or could cross check could even comment here without losing their job. All of us who no longer work there can comment but without access to the internal details their is no way any of us can exactly remember the systems 100%.

787 has RDC's - Remote Data Concentrators. Doing the same function. Two of the switch pole-sets go each to one of 2 different RDC's, that feed the EAFR's / QAR, and the common core network so that any system that wants to know, can. The wiring is positive voltage from the RDC's to the switch and to GND through the common pin. So the RDC's would be able to detect anomalies such as both contacts open, or both contacts closed. The EAFR will see two independent channels per switch.
The other 2 contact sets feed latching relays (again driven each coil independently by dropping to GND at the switch) that then drive spar valves and reset signals to the FADEC Channels. (and more).

So - for the benefit of those that hang on to the 'possibility' of electrical gremlins and 'ghost' switch signals.

Each switch has 4 mechanically separated 'channels' - 2 of which do electromechanical things to the engines through separate paths, the other 2 feed through independent paths the FDR and the rest of the computer systems. The results of the electromechanical actions also feed back to the FDR.

Thus the readout from the EAFR will PROVE that the switches MUST have been PHYSICALLY MOVED.

And - I'm nervous to challenge you tdracer - there's quite the authority gradient and I know I'm at the bottom end, but I can't let this fly...
Its 'Deefer Doo'. Fight me.

I'm still not clear on something, no surprise there.

If you are the PF and you are just after rotation, and for whatever reason, the fuel control switches transition to "CUTOFF", when and how do you notice this?
Presumably your hands are on the yoke and you are looking very intently out the windshield. So, to me it seems unlikely that you saw whatever happened to the switches, however they moved.

Do you get a warning indication that the switches have moved? If so, then that would be what I needed to know. You got a warning and therefore you looked right at the switches.

If not, do you just notice that you have lost power? If that is the case, where do you look first? I presume it would be at the engine info gauges/displays.

What I'm getting at is what priority is given to looking at the fuel cutoff switches in this situation?
How long until you look at those switches as the possible cause of the engine problems?

Well this is probably why it took 10 seconds, whole right side of the flight deck would be blacked out. My guess is that the EICAS messages that you see during sim engine fires/relights training helped. Don't have the post but it exists earlier upthread but there is an fuel cutoff EICAS message that happens when fuel switches move. Obviously can never count out a side vision of the PM, especially if its not a traditional movement in that stage of flight.

The longer it takes before an investigative body (aaib, police) starts looking into both pilot\x92s motives for a possible maliscious intent, the more time there is to erase evidence, or to cover up something.
I am not saying there is any evidence pointing to this, but the clock is ticking.

I find this newly announced probe into the fuel control switches quite surprising. I dont expect anything to be found.

Not a B787 pilot but many hours on its wide body predecessors.

It is conceivable that you could notice hand movement around the throttle quadrant in your peripheral vision (noone's hands are on the thrust levers between V1 and shortly after takeoff), however even if you didn't, you'd immediately notice the loss of performance. The instinctive reaction is big loss of performance -> quick glance across at instruments -> why are they winding back? Also if the fuel control switches were moved to cutoff you'd suddenly get EICAS messages saying the engines were shutdown. So there are immediate clues and it's only a minor head movement to see where the fuel control switches are because they're right down there behind the thrust levers. Then the immediate action for a dual engine failure, which would by then likely be obvious with both sets of instruments showing everything winding back, is "fuel control switches cutoff, then run". There is no significant pause in that action because it's only to reset the electronic engine controls, so the 10 second gap between setting them back to "run" is not explained by the dual engine failure procedure but perhaps by a startle factor. One way or another, your eyes are going to end up checking where those switches are.

Display and Crew Alert (DCA)/EICAS would indeed receive signal about Fuel Cutoff switches (L&R) position and written to EAFR (source:
https://data.ntsb.gov/Docket/Documen...man-Master.PDF )

Having seen it today, fuel control switch to cut off produces a L/R ENG SHUTDOWN EICAS message almost immmediately or ENG SHUTDOWN if both. No aural warning. Generators instantly off line therefore it is likely all FO instruments blanked. Definitely a startle event for the PF in this case.

Surprising from a technical pov, yes, but not from a political pov; it was initiated by India\x92s Directorate General of Civil Aviation. Better for them to imply Boeing's switches were to blame than something closer to home. They must be worried.

Yes - an airline I am familiar with is currently formulating an inspection procedure, (despite every pilot and engineer in contact with an aircraft or simulator having given every fuel switch 'a good tug' today). We're not expecting findings....
But we will be able to say we've inspected.

I've been 'arm chair' flying this scenario and I imagine (for me) the sequence would go something like this.

I'm pilot flying, so my gaze and attention is firmly out the front rotating to the planned takeoff attitude.

Initially and in no particular order:
- I would feel the loss of thrust as a sudden loss of acceleration.
- There would be a significant nose down pitch trim change that I would feel through the yoke.
- There would be lots of audio cues: Changes in engine and air conditioning noises. Lots of click-clacking as electrical relays change state with the loss of electrical power.

My eyes would be drawn inside. I would notice blanking of some of the displays and then look to the EICAS display. My first thought would be probably that we have suffered a major electrical malfunction. There would be lots of messages. I'm not B787 endorsed, but presumably close to the top of the messages would be ENG SHUTDOWN. This message is shown when 'Both engines were shut down by the fuel control switches or the engine fire switches.'

I think I would then look at the fuel control switches and seeing them both in the cutoff position I would say 'why did you cutoff' or stronger words to that effect.

After that it all depends on the response of the other pilot. If they are uncooperative, I would be putting the fuel control switches back to run. All whilst frequently checking and adjusting my flight path.

Reuters, July 14 2025
Amid Air India probe, US FAA, Boeing notify fuel switch locks are safe, document, sources say

WASHINGTON/NEW DELHI/MONTREAL, July 13 (Reuters) - The U.S. Federal Aviation Administration and Boeing (BA.N), have privately issued notifications that the fuel switch locks on Boeing planes are safe, a document seen by Reuters showed and four sources with knowledge of the matter said.

The FAA's Continued Airworthiness Notification on July 11 came after a preliminary report into Air India's Boeing 787-8 crash, which killed 260 people last month, raised questions over engine fuel cutoff switches.

The FAA's notification to Civil Aviation Authorities, seen by Reuters, said: "although the fuel control switch design, including the locking feature, is similar on various Boeing airplane models, the FAA does not consider this issue to be an unsafe condition that would warrant an Airworthiness Directive on any Boeing airplane models, including the Model 787."

When asked for comment, the FAA said it did not have anything to add beyond the notification.

Boeing also referred to the FAA notification in a Multi-Operator-Message sent to the airlines in the past few days, which said the planemaker is not recommending any action, two of the sources with direct knowledge said.

When asked for comment, Boeing referred Reuters' questions to the FAA.

The preliminary investigation report into the crash by India's Aircraft Accident Investigation Bureau (AAIB), referred to a 2018 FAA advisory, which recommended, but did not mandate, operators of several Boeing models, including the 787, to inspect the locking feature of the fuel cutoff switches to ensure it could not be moved accidentally.

The report said Air India had said it had not carried out the FAA's suggested inspections as the FAA 2018 advisory was not a mandate. But it also said maintenance records showed that the throttle control module, which includes the fuel switches, was replaced in 2019 and 2023 on the plane involved in the crash.

The report noted "all applicable airworthiness directives and alert service bulletins were complied on the aircraft as well as engines."

ALPA India, which represents Indian pilots at the Montreal-based International Federation of Air Line Pilots\x92 Associations, in a statement on Saturday rejected the presumption of pilot error and called for a "fair, fact-based inquiry."

"The pilots body must now be made part of the probe, at least as observers," ALPA India President Sam Thomas told Reuters on Sunday.

ALPA India, in a letter posted on X, said the preliminary investigation report referred to the 2018 FAA advisory "concerning the fuel control switch gates, which indicates a potential equipment malfunction."

In the flights final moments, one pilot was heard on the cockpit voice recorder asking the other why he cut off the fuel. "The other pilot responded that he did not do so," the report said.

It said fuel switches had almost simultaneously flipped from run to cutoff just after takeoff. The report did not say how the switches could have flipped during the flight.

Two U.S. safety experts said on Saturday they backed ALPA India's request to be observers in the probe, but said the investigation report did not suggest a bias toward pilot error.

John Cox, a pilot and former ALPA U.S. representative, said AAIB's report seemed objective and fair.

With all the ‘experts’ swimming about on this thread, I’m very loathe to dip my toes in the water for fear of sharks but…

Having read the vast majority of postings here on this accident, plus the prelim report, I can’t see how anyone could dispute that ‘someone selected both FCS’s to cutoff Immediately after lift off and before gear retraction’. Which, as all have said, begs the question, was it intentional? A brain fart? Or a “I gotta do this now because of a perceived problem”? I can’t think of any other option.

Like all Boeing pilots (current or retired) we’ve all had a quick and dirty education on a system called MCAS - which is of course a 737 Max issue, but…one does wonder.

The accident aircraft had a stabilizer snag on the previous flight. The accident crew would’ve noted it in the log. Is there a chance that, just at lift off the EICAS stab warning/caution reappeared and the PM thought it would be pre-emptive to turn off the stab trim switches? BUT…muscle memory, startle factor, etc, he grabbed the wrong (but more familiar) nearby switch(es) and selected them. In the ensuing maelstrom, the gear was forgotten, the PM desperately tried to put the FCS’s back to RUN, the PF was struggling with a blank panel but it was too late airspeed and altitude were heading south and… they flew directly to the crash site.

Grasping at straws, I toss this hypothetical scenario into the pool - probably because I just can’t get my head around the ‘intentional’ option.

Now…where did I put the shark repellant.

This seems to quite clearly answer the question: (from the prelim report)

That's the Embraer option.

The other option I can imagine is a mechanical stop with an override button, like the landing gear lever. Can't switch the fuel levers off unless you're slow and on the ground, the engine is failed or on fire, or you push override.

bluemic

How\x92s the water in that shark infested sea?

When I read that on the previous sector the aircraft had a stab issue written up I wondered the same thing. It\x92s a fanciful theory but they all are. I\x92m leaning towards the action slip \x93brain fart\x94 although why might always be the subject of speculation. Assuming that the captain did place the fuel control switches to cutoff just after rotation then whatever the explanation will most likely defy logic.

Incidentally this tragic accident wasn\x92t discussed that much in my company even though it operates the 787. I think there\x92s a realisation that it would be pointless speculation until there is the final report. What was noticeable early on is that we\x92re no maintenance actions mandated by Boeing, GE, the FAA etc. Equally nothing from a flight ops perspective.

The report makes no comment on how the handling pilot determined fuel was cut off, the assumption is he eyeballed the switch.
But, is it feasible that the handling pilot was well aware of fuel issue (loss of thrust, decreasing engine sound, instrumentation) without requiring a scan of the fuel cutoff switches, certainly if the non handling pilot said he hadn\x92t touched the switches and that the handling pilot had his hands full, low level and descending?

The problem with the switches with hinged covers is that they have a single, "safe" position when they're covered. But the fuel switch is safe at CUTOFF when parked, and safe at RUN when the aircraft is operating, so that won't work.