Posts about: "Fuel Cutoff Switches (detent)" [Posts: 55 Pages: 3]

Not 757 - it was a 767. Second time it happened in about 12 months.

Determined to be an ergonomics problem with the switch layout in the flightdeck.

Early 767s (JT9D and CF6-80A) had a supervisory "EEC" (Electronic Engine Control - Boeing still uses "EEC" to identify what most people call the FADEC on modern engines). The procedure if an EEC 'failed' was to switch both EECs off (to prevent excessive throttle stagger - unlike FADEC, the engine could operate just fine with a supervisory EEC failed).

Problem was that the EEC ON/OFF switch was located on the aisle stand - right above the fuel cutoff switches. Turned out 'muscle memory' was when the pilot reached down there, it was usually to turn the fuel ON or OFF - which is what they did. Fortunately realizing what he'd done wrong, the pilot quickly restored the switches to RUN and both engines recovered. And yes, they continued on to their destination (RAT was still deployed since there is no way to retract it in-flight).

Previous event was with JT9D engines (United IIRC). In that case, only one engine recovered (second engine went into an unrecoverable stall), they simply came back around and did a single engine landing.

Realizing the ergonomic issue, the EECs were relocated to the pilot's overhead (retrofit by AD).

To the best of my knowledge, there hasn't been a repeat of an inadvertent dual engine shutdown since the EEC switches were relocated. It's also very difficult to 'accidentally' move the switches as there is a locking detent - the switch must be pulled out slightly before it can be moved to CUTOFF.

I tend to agree. I taught ground school for the 744, 748, 777, 320 and 330. I used to tell my students the most critical phase of flight is the 3 minutes after 100 knots. That\x92s when critical TO inhibits occur and ADP\x92s (777) come online etc etc. But the elephant in the room for me is thrust reduction. On the Boeing it can be an altitude or a flap setting where the AT will reduce thrust from derated TO to CLB. For the Bus it\x92s an altitude and the crew are prompted to move the TL\x92s to the CLB detent. If at positive rate (or climb) the PM selected one or two units of flap up instead of gear up would the thrust reduction explain the aircraft\x92s response? This would startle any PF and he wouldn\x92t (muscle memory) manually move the levers back to TOGA while trying to follow the FD Bars to maintain V2 and RWY heading.

If the RAT deployment is indeed confirmed then my theory is out the window\x85.

Exactly like the action of lifting the flap lever out of detent before moving it. What is significantly different is that you would have to do it twice. It is that which makes it improbable unless intentional.

The requirement to lift the cutoff switch out of the detent before moving it is an important point. However, those switches are close together and unless the the detent requires significant force I suggest that they could be operated together with one hand if that was an intentional action.

Extremely difficult to accomplish with one hand, might even be impossible. There also would be no muscle memory to do both at the same time. I was as most pilots taught always shut down one engine at a time even at the gate to insure you never build that type of habit pattern.

To simplify the chicken/egg:

Tdracer earlier confirmed that an airplane electrical power loss would allow engines to keep running , because 1) engines are fully-capable of suction feed operation in takeoff envelope (if boost pumps lost), and 2) the EECs are powered by their own PMAs when running and to substantially below idle (I recall roughly 10% N2). Airplane powers the EEC for ground starts, prior to PMA coming online, and as backup to the PMA after that.

Related:

Engine igniters are powered by the aircraft. So theoretical full loss of aircraft power would disable Autorelight upon a flameout. Ignitors typically don't make the cut for most-essential battery-only loads because it would also take an engine flameout, and the airplane past V1 in ground roll can fly fine on one engine that can achieve takeoff thrust.

Autorelight is relevant - if there was a single-engine failure post V1, autorelight will attempt to relight the engine, so there is no need for a pilot to try to cycle the fuel switch to reset the EEC (potentially grabbing the wrong one), or to otherwise intervene. In such a circumstance, they need to trust their training. I've heard accounts that the most likely pilot instinct in such a situation would be to push the throttle(s) forward.

Finally - there was talk earlier about accidentally cutting the fuel switches - and it was duly noted that they have to be pulled out over the detent, so very unlikely. The same cutoff effect could be achieved with the engine fire handle(s), right behind the fuel switches on the pedestal - though they are an upward pull, so also not subject to inadvertent or accidental engagement.

Not 757 - it was a 767. Second time it happened in about 12 months.

Determined to be an ergonomics problem with the switch layout in the flightdeck.

Early 767s (JT9D and CF6-80A) had a supervisory "EEC" (Electronic Engine Control - Boeing still uses "EEC" to identify what most people call the FADEC on modern engines). The procedure if an EEC 'failed' was to switch both EECs off (to prevent excessive throttle stagger - unlike FADEC, the engine could operate just fine with a supervisory EEC failed).

Problem was that the EEC ON/OFF switch was located on the aisle stand - right above the fuel cutoff switches. Turned out 'muscle memory' was when the pilot reached down there, it was usually to turn the fuel ON or OFF - which is what they did. Fortunately realizing what he'd done wrong, the pilot quickly restored the switches to RUN and both engines recovered. And yes, they continued on to their destination (RAT was still deployed since there is no way to retract it in-flight).

Previous event was with JT9D engines (United IIRC). In that case, only one engine recovered (second engine went into an unrecoverable stall), they simply came back around and did a single engine landing.

Realizing the ergonomic issue, the EECs were relocated to the pilot's overhead (retrofit by AD).

To the best of my knowledge, there hasn't been a repeat of an inadvertent dual engine shutdown since the EEC switches were relocated. It's also very difficult to 'accidentally' move the switches as there is a locking detent - the switch must be pulled out slightly before it can be moved to CUTOFF.

The fuel cutoff switches can't be "flipped" in either direction; they have to be lifted over a detent and then moved, a very positive action.

The spec sheet says 100,000 cycles.
Switches fail sometimes. I have changed lots of lots of malfunctioning toggle switches in my day.
But both at the same time?
It has to be a common thing happening at the same time.
Someone slipping both switches into a worn middle detent is such a thing though, that is one habit that could be developed. A slight bump at takeoff and they both go to cutoff.
Or they are worn and theres an iphone behind the throttles, as someone mentioned.

The switches themselves are on-on 4 pole toggles, and doesn\x92t fail into one position over the other, and gravity would prefer the cutoff position in this design.

I mentioned I have used my share of switches, knobs and buttons. In much larger quantities than what you find in aircraft, but without the life and death factor, and thus no SOP.

Unexpected things happen, no one dies, but I myself brodcasted jolly sounding very inappropriate intro music over a very dark news report on the unravelling Joseph Frietzl case by dropping my phone on a switch. Several million viewers, a good chunk of which called to complain.

Grave errors can be banal.

Other than that, common connectors, the harness itself, I have seen a large amount of unexpected electronic things happen when those get bendt the wrong way.

This isn\xb4t quite right. They could both have had a malfunction without this being an issue until something or someone hit them at the same time (e.g. on rotation). It\xb4s just another theory which isn\xb4t less plausible than many others.

The extended spec sheet for these switches shows that there are versions with a center indent, and others without. But the picture up above which is said to be of the 787/8 actual switch seems - to me - to not have a center indent option. Ie, it is either on or off, with a spring loaded lift of about 2mm needed to move it from one position to another.

The idea is to set the switch to CUTOFF and then to ON as that resets the FADEC (the circuit that controls the engine) and hopefully clears any issues it might have. The hope is that the turbine is still rotating fast enough for the FADEC to restart it. I believe this works the same as the auto-relight feature.
The turbine rotation would also provide the electrical power for that.

Do a thread search on "detent" to learn more about the construction of these switches than you ever wanted to know.
There's also a section on them in paulross 's https://paulross.github.io/pprune-th...171/index.html , but it may not be up to date. (Still a great resource, though.)

Unfortunately the wikipost linking to it is gone, presumably a victim to the recent forum changes.

I have rebuilt the site that organises this thread by subject here: https://paulross.github.io/pprune-th...171/index.html

Changes:

• Built the thread up to July 10, 2025, 12:31:00
• Add subjects: Relight, 51 Day Issue, Fuel Cutoff Switches (detent), ICAO, Fuel Cutoff Switches, Memory Items, Annex 13, Simulation Scenarios.
• Various technical fixes should give a better/more accurate presentation.

Project is here: https://github.com/paulross/pprune-threads
Raise issues here https://github.com/paulross/pprune-threads/issues or PM me.

This has all been answered in previous posts, but I'll repeat it for those you don't want to look back through something like 150 pages:

Thrust Lever Angle (TLA) is measured directly by the FADEC, using a resolver hardwired to and excited by the FADEC. Both FADEC channels have their own resolver input - on most Boeing aircraft it's a common resolver with two sets of electrically isolated windings, however on the 787 it actually uses two mechanically separate resolvers. The resolver is basically read as "sine" and "cosine" which is converted in the angle. This also makes error detection easy, using the sine squared + cosine squared relationship. Any other aircraft systems that use TLA use the TLA signal relayed back to the aircraft by the FADEC.

The fuel control switch is a two-position multiple pole 'latching' switch - you have to pull it out slightly over detent to move it between the RUN and CUTOFF positions (on other aircraft there is an interposing relay for some of the functions. not sure about the implementation on the 787). Moving the switch to cutoff sends a DC signal to both the High Pressure ShutOff Valve (HPSOV) in the fuel control and the spar valve commanding them to close. HPSOV is solenoid actuated and is near instantaneous, Spar Valve takes ~one second to change positions (yes, this is different than some other airframers that only send the signal to one valve or the other, but it's been standard Boeing design practice since the early 1970s). Both the HPSOV solenoid and the Spar Valve are designed to stay in their last commanded position if airframe power is lost. Moving the switch to CUTOFF also sends a 'reset' signal to the FADEC - meaning the FADEC will be offline for roughly one second. On the 787 (and 777 and 747-8), there is a brief pause (~0.25 seconds) before the shutdown signal is sent to the engine to allow the electrical system to reconfigure to prevent a brief interrupt of electrical power to the rest of the aircraft.

Pulling the Fire Handle does the same thing as the fuel condition switch - via separate wiring (physically isolated from the fuel switch wiring to help protect from things like rotor burst damage), with the exception of the FADEC reset (since there is no requirement to be able to restart the engine after a Fire Handle shutdown).

There is absolutely no TLA input into either the fuel conditions switch or the Fire Handle - you can shutdown the engine via either regardless of Thrust Lever Angle.

All this is standard Boeing design practice (and except for the no-break electrical power transfer) has been for at least 50 years. This is enforced by the Boeing "Design Requirements and Objectives" - DR&O - compliance with is demonstrated by an audit after the final design freeze.

Actually, why are switches that are only really required on the ground or in an engine shut down event where they are? Embraer's have the switches out of the way on an overhead panel and as well as detent locked, have a protective guard, one has to physically lift. If the PF had to physically carry out the engine shut down on an Embraer, he would have to raise his arm. Would be obvious to the PnF.

No there is not. Further investigation will likely see if the locking detents were in a decent state or not. TBQH, such a switch should be properly guarded. Like a Embraer is, like other types that one sees with switches one has to lift a guard to operate and is locked on with the guard in position. Boeing designers found out again in not making processes fool proof?

I raised this on one of the other threads, they are supposed to be isolated systems, and I am sure they are according to electromechanical tradition, but for both human factors and electromechanical reasons, should\x92nt they be off to each side of the cockpit to be considered isolated?

it would have to be small enough to fit between the idle throttle position and guards on each side of the switches and weigh enough to push the switches over the detent, unless the SAIB cones into play.

There is mention of fire damage or thermal damage to the centre pedestal, perhaps enough to identify the position of the switches but not to be able to determine their internal physical state relating to the detent mechanisms.

Yes, which is why I said a small such range of objects. I can't see how both switches could unintentionally be moved individually one after the other unless there was something wrong with the detent mechanisms. I suppose a careless hand is also a possibility, removed from the thrust levers on rotation?