Disagree button for engine shutdown
Joined: Nov 1999
Aviation Qualifications: ATPL
Posts: 3,150
Likes: 744
From: UK
I hear the arguments against, which is pilots are well trained, but with Kegworth we now have at least 3 recent instances where the wrong/both engines were shut down. I would suggest at the least, if not my suggested solution, than a safety body should take this issue onboard as a priority and come up with a solution for the next generation of passenger jets..........
So scanning the columns of gauges from left to right it went left engine, right engine, left engine, right engine. This is believed to have caused confusion as to whether the high vibration reading was referring to the left or the right engine, since the vibration gauge was to the right of all the primary gauges
Recommendations were made suggesting that Boeing change the gauge layout so that they were all fully symmetrical, so that left gauge meant left engine, and right gauge meant right engine, but I don't know if they ever did this ?
The current layout of the Boeing fuel control switches has remained the same for 70 years - literally generations of pilots know and use this layout.
The potential of a redesign introducing undesirable unintended consciences is very high - especially if it's a knee-jerk response. Something like this needs to be carefully and thoroughly vetted before it sees the light of day. For example, requiring the thrust lever at idle - what if the lever gets jammed somehow and can't be moved to idle?......
The potential of a redesign introducing undesirable unintended consciences is very high - especially if it's a knee-jerk response. Something like this needs to be carefully and thoroughly vetted before it sees the light of day. For example, requiring the thrust lever at idle - what if the lever gets jammed somehow and can't be moved to idle?......
.......As I understand it, Kegworth both pilots agreed on the engine - it's just that they were both wrong....
......I think the first step is to better educate and train the pilots that there is almost never a reason to rush shutting down a turbofan engine. Even with an engine fire, the bult in protections give you minutes to take action, not seconds..........
There are lots of ways a panicked pilot can crash an aircraft - shutting down the wrong engine is just one. Maybe the answer is to get pilots to not panic?
Things like EICAS/ECAM have made it far easier to correctly identify a malfunctioning engine - are pilots being appropriately trained to use that?
There are lots of ways a panicked pilot can crash an aircraft - shutting down the wrong engine is just one. Maybe the answer is to get pilots to not panic?
Things like EICAS/ECAM have made it far easier to correctly identify a malfunctioning engine - are pilots being appropriately trained to use that?
As some have asked or suggested, there is no urgency or reason to quickly shut down a gas turbine engine, even if it is on fire.
The overriding priority is to FLY and control the aircraft; i.e. get it under control (usually with a large amount of rudder, given that the thrust might suddenly have become very asymmetric), and climb safely away. So gear needs to come up, for example.
Audible warnings are cancelled and we "ignore" the failed engine or the engine on fire until we are safely climbing away. Only then do we begin the drills, starting with "what happened ?" Then we must consider the flight path and the terrain ahead. Since our rate of climb will now be much lower than normal, we might not clear obstacles ahead, and we might have to make an emergency turn before completing an engine shut-down.
If an engine has failed; before shutting it down both pilots very carefully check the engine instruments, or ECAM/EICAS, AND also all the warning lights on the overhead panel to double check and confirm that the "correct" engine is being shut down. Both of us also check and confirm that each critical switch or lever is the correct one before moving it.
So, yes, we are trained and rehearsed very carefully and intensively to perform engine shut-downs carefully and diligently.
Having said that it's in a simulator, which you know is not going to kill you, and therefore you don't necessarily have that extra factor of the real world coming at you, and the real world can change behaviour.
And one hopes the same high standards are demanded throughout the World.
One thing though I think needs to change is airline pilot trainers examining their own pilots. There is a potential incentive for company type rating examiners, TREs, to get their pilots through their SIM exams. I personally think that SIM exams should be conducted by aviation authority examiners, who do not know the candidates. This might help reveal issues, if they existed.
.
Last edited by Uplinker; 22nd July 2025 at 08:19.
Joined: Aug 1999
Aviation Qualifications: ATP+Mil
Posts: 4,411
Likes: 83
From: Gold Coast, Australia
The commonalities between jeju and Air India are astounding, engine shutdown when totally not appropriate
I would suggest cockpits be added with a 2nd shutdown switch. That if an engine shutdown is commanded by the crew, and the computer disagrees it's necessary, that the crew need to push a 2nd, more guarded and inaccessible, switch to command the shutdown.
I would suggest cockpits be added with a 2nd shutdown switch. That if an engine shutdown is commanded by the crew, and the computer disagrees it's necessary, that the crew need to push a 2nd, more guarded and inaccessible, switch to command the shutdown.
My antique experiences of jet engine management were all back in the analogue computer days, but the vast majority relied on pulling the SSL (Speed Select lever) back past a mechanical lock to shut off or rolling the throttle back past a pilot operated mechanical lock to shut off. In all cases the lock occurred at ground idle.
So maybe something similar is not inconceivable in this digital age, incorporated into the Thrust Levers quadrant and removing the intriguing but IMO unnecessary switchology and computer processing of the Fuel Shut Off switch?
Joined: Jan 2003
Posts: 517
Likes: 37
From: Kelowna Wine Country
From Uplinker
"One thing though I think needs to change is airline pilot trainers examining their own pilots. There is a potential incentive for company type rating examiners, TREs, to get their pilots through their SIM exams. I personally think that SIM exams should be conducted by aviation authority examiners, who do not know the candidates. This might help reveal issues, if they existed."
I asked in the Air India accident thread if this system applied in India or if they still used the government examiners as we used to. but it was passed over without comment.
My adviser from within the industry is disappointed with our system as it stands. He feels that the authorities really have little power to control or improve the quality of airmanship when type rating checks are done by company pilots...
"One thing though I think needs to change is airline pilot trainers examining their own pilots. There is a potential incentive for company type rating examiners, TREs, to get their pilots through their SIM exams. I personally think that SIM exams should be conducted by aviation authority examiners, who do not know the candidates. This might help reveal issues, if they existed."
I asked in the Air India accident thread if this system applied in India or if they still used the government examiners as we used to. but it was passed over without comment.
My adviser from within the industry is disappointed with our system as it stands. He feels that the authorities really have little power to control or improve the quality of airmanship when type rating checks are done by company pilots...
Joined: Jan 2025
Aviation Qualifications: Non-Aircrew
Posts: 640
Likes: 782
From: New Zealand
Have advances in engine control/management introduce unnecessary complications, eg this switch to turn the engine 'Off'?
My antique experiences of jet engine management were all back in the analogue computer days, but the vast majority relied on pulling the SSL (Speed Select lever) back past a mechanical lock to shut off or rolling the throttle back past a pilot operated mechanical lock to shut off. In all cases the lock occurred at ground idle.
So maybe something similar is not inconceivable in this digital age, incorporated into the Thrust Levers quadrant and removing the intriguing but IMO unnecessary switchology and computer processing of the Fuel Shut Off switch?
My antique experiences of jet engine management were all back in the analogue computer days, but the vast majority relied on pulling the SSL (Speed Select lever) back past a mechanical lock to shut off or rolling the throttle back past a pilot operated mechanical lock to shut off. In all cases the lock occurred at ground idle.
So maybe something similar is not inconceivable in this digital age, incorporated into the Thrust Levers quadrant and removing the intriguing but IMO unnecessary switchology and computer processing of the Fuel Shut Off switch?
The switches apparently are not (solely) computerised. They use relay logic to shut the low-pressure fuel valve, and may or may not actually instruct the FADEC to shut down.
Note previous comments by TDR and others that the move to FADECs resulted in a significant (order of magnitude or better?) increase in engine controls reliability - not necessarily engine reliability as a whole, but still a very very significant improvement.
I'd be interested in a listing of all the ways you can shut a typical turbine engine down, and what the delay is on them - apparently the spar valve is quite slow (a minute or two at idle).
Joined: Dec 2002
Posts: 2,776
Likes: 353
From: UK
A difficulty or a mess
The proposal to add a switch, complexity, overlooks the obvious - fix the original issue.
As per James Reason 'drain the swamp not swat mosquitoes'.
First identify the issue, not 'problem' which suggests a solution. Applying systems thinking to complexity recognises that there may not be a unique solution, only small improvements.
Is the issue a difficulty or a mess; "… where the issue is a 'difficulty' then people with a solution are an asset. When the issue is a 'mess', then people with a solution are part of the problem". Russel Ackoff
With hindsight this form of issue can be identified in many incidents / accidents, and reflects the choice of action in design and certification, with roots in safety mindset - cheaper, quicker, …
Quality has unique value, an insurance perhaps never used, or not recognised if used, but if absent is a cruel reminder of human fallibility - thinking at organisational level.
" There is a rather touching faith in the magical ability of technology to solve problems in a way which turns a mess into a mere difficulty. This belief is particularly widespread amongst decision makers who do not understand the technology. It is also complicated by the false belief that expertise in one area enables that expert to offer informed advice across a whole range of domains where they do not have the necessary know-how.
Modern technology induces a kind of techno-paralysis, whereby the victim suspends all sense of reason when dealing with it. Yet technology, no matter how sophisticated, is just a tool. It is not magic and will not automatically evolve towards a state where it will comprehensively address an ill-defined mess. Policy makers, however, rarely seem to understand this. The computer on its own cannot rectify an ill-defined 'digital' (binary, linear, thinking) decision making (DDM) mess. " Ray Corrigan
As per James Reason 'drain the swamp not swat mosquitoes'.
First identify the issue, not 'problem' which suggests a solution. Applying systems thinking to complexity recognises that there may not be a unique solution, only small improvements.
Is the issue a difficulty or a mess; "… where the issue is a 'difficulty' then people with a solution are an asset. When the issue is a 'mess', then people with a solution are part of the problem". Russel Ackoff
With hindsight this form of issue can be identified in many incidents / accidents, and reflects the choice of action in design and certification, with roots in safety mindset - cheaper, quicker, …
Quality has unique value, an insurance perhaps never used, or not recognised if used, but if absent is a cruel reminder of human fallibility - thinking at organisational level.
" There is a rather touching faith in the magical ability of technology to solve problems in a way which turns a mess into a mere difficulty. This belief is particularly widespread amongst decision makers who do not understand the technology. It is also complicated by the false belief that expertise in one area enables that expert to offer informed advice across a whole range of domains where they do not have the necessary know-how.
Modern technology induces a kind of techno-paralysis, whereby the victim suspends all sense of reason when dealing with it. Yet technology, no matter how sophisticated, is just a tool. It is not magic and will not automatically evolve towards a state where it will comprehensively address an ill-defined mess. Policy makers, however, rarely seem to understand this. The computer on its own cannot rectify an ill-defined 'digital' (binary, linear, thinking) decision making (DDM) mess. " Ray Corrigan
Joined: Dec 2002
Aviation Qualifications: ATP+Mil
Posts: 3,985
Likes: 568
From: Where the Quaboag River flows, USA
I have seen references to a similar shutoff mechanism on fighter aircraft and I think BBD bizjets. One of the issues is that it's virtually identical to what Airbus uses for reverse thrust - lift the latch, and pull thrust levers rear of idle, and this has apparently caused some inadvertent shutdowns when moving back and forth. Modern engines auto-select ground, flight, or approach idle as necessary.
The switches apparently are not (solely) computerised. They use relay logic to shut the low-pressure fuel valve, and may or may not actually instruct the FADEC to shut down.
Note previous comments by TDR and others that the move to FADECs resulted in a significant (order of magnitude or better?) increase in engine controls reliability - not necessarily engine reliability as a whole, but still a very very significant improvement.
I'd be interested in a listing of all the ways you can shut a typical turbine engine down, and what the delay is on them - apparently the spar valve is quite slow (a minute or two at idle).
The switches apparently are not (solely) computerised. They use relay logic to shut the low-pressure fuel valve, and may or may not actually instruct the FADEC to shut down.
Note previous comments by TDR and others that the move to FADECs resulted in a significant (order of magnitude or better?) increase in engine controls reliability - not necessarily engine reliability as a whole, but still a very very significant improvement.
I'd be interested in a listing of all the ways you can shut a typical turbine engine down, and what the delay is on them - apparently the spar valve is quite slow (a minute or two at idle).
Notably, while no final report has been issued, the Challenger accident in Naples has been suspected to be caused by a pilot reaching around underneath the latches at the same time the PF retarded the thrust to IDLE going past the latch detent into shutoff.
All engine controls shut off fuel at fuel controller, no design uses the spar valves as shutoffs exclusively. The spar valves just isolate the fuel lines in case of fire and back up the HPSOV. I’ve shut off a couple of TF-39s using the valves when the fuel controller valve failed, it’s a wait.
Joined: May 2024
Aviation Qualifications: CPL
Posts: 379
Likes: 36
From: Kaupuala
Curious
Howdy. I am trying to understand the concept of "Disagree"
On a recent incident, a Fly by Wire Boeing (787) had both engines Cut simultaneously. Is it more difficult to ID a Failure in an engine with FBW recovered Yaw?
Would a pilot Cut two engines at once, without CRM and a pause to make damn sure the correct engine is being Cut?
What would a Disagree system look like in this scenario?
On a recent incident, a Fly by Wire Boeing (787) had both engines Cut simultaneously. Is it more difficult to ID a Failure in an engine with FBW recovered Yaw?
Would a pilot Cut two engines at once, without CRM and a pause to make damn sure the correct engine is being Cut?
What would a Disagree system look like in this scenario?
Thread Starter
Joined: Aug 2020
Posts: 138
Likes: 72
From: UK
I started the "disagree" conversation. I intend this to mean the computer disagrees. The consensus is most aircraft computer systems these days are very very smart, and have a good grasp of what the aircraft is doing, what it should be doing and what constitutes smart actions and what is not. So if a pilot tries to shut down an engine, and the computer thinks that's not a great idea (Kegworth, Jeju, Air India, no doubt others) then the computer says "disagree" and the pilots are required to then press a 2nd button located someplace else. To my mind this second button would have the fidelity of the current "fuel off" button, i.e. it's a straight cut-off, no ifs or buts.
Joined: Apr 2009
Aviation Qualifications: Non-Aircrew
Posts: 1,601
Likes: 704
From: DM33
In every system I worked on "Disagree" meant that a command had been issued but the commanded system had not (yet) assumed the commanded state.
That is very different from "Miscompare" which is when two independent systems provide different data for a system state or parameter when both independent systems would normally provide the same information.
That is very different from "Miscompare" which is when two independent systems provide different data for a system state or parameter when both independent systems would normally provide the same information.
Joined: Jul 2013
Aviation Qualifications: Non-Aircrew
Posts: 5,682
Likes: 3,345
From: Everett, WA
I started the "disagree" conversation. I intend this to mean the computer disagrees. The consensus is most aircraft computer systems these days are very very smart, and have a good grasp of what the aircraft is doing, what it should be doing and what constitutes smart actions and what is not. So if a pilot tries to shut down an engine, and the computer thinks that's not a great idea (Kegworth, Jeju, Air India, no doubt others) then the computer says "disagree" and the pilots are required to then press a 2nd button located someplace else. To my mind this second button would have the fidelity of the current "fuel off" button, i.e. it's a straight cut-off, no ifs or buts.
Yes, we give the FADEC the authority to control the engine - and potentially the authority to perform a shutdown for rotor overspeed (and TCMA using the rotor overspeed protection). By design, the rest of the FADEC doesn't use the digital 'cutoff' command from the aircraft except during autostart - once out of the 'start' mode, that logic tree is disabled. But all that is separate between engines. If you put an aircraft logic device in the CUTOFF circuit, you've suddenly introduced a potential single failure that can affect both engines.
In the aftermath of the Air India crash, you should certain see why that might not be a good idea (and besides, it would violate the engine isolation requirements of 25.901(c).).
Joined: May 2024
Aviation Qualifications: CPL
Posts: 379
Likes: 36
From: Kaupuala
td. arf
""By design, the rest of the FADEC doesn't use the digital 'cutoff' command from the aircraft except during autostart - once out of the 'start' mode, that logic tree is disabled. But all that is separate between engines. If you put an aircraft logic device in the CUTOFF circuit, you've suddenly introduced a potential single failure that can affect both engines.
In the aftermath of the Air India crash, you should certain see why that might not be a good idea (and besides, it would violate the engine isolation requirements of 25.901(c).). ""
Hello... If pilots have performed a "Double cut"" does FADEC do AutoStart? Is it not interrupting a CutOff command? In both? In the QRH, it cautions pilots not to interrupt a Restart. Is that right?
Looking for the sampling rate for Pilots' RUN/CUTOFF switches....anyone?
In the aftermath of the Air India crash, you should certain see why that might not be a good idea (and besides, it would violate the engine isolation requirements of 25.901(c).). ""
Hello... If pilots have performed a "Double cut"" does FADEC do AutoStart? Is it not interrupting a CutOff command? In both? In the QRH, it cautions pilots not to interrupt a Restart. Is that right?
Looking for the sampling rate for Pilots' RUN/CUTOFF switches....anyone?
Joined: Jan 2025
Aviation Qualifications: Non-Aircrew
Posts: 640
Likes: 782
From: New Zealand
Sampling rate has been given many times as 1Hz. Read through both the FDR group's report (#1) and minimally-processed FDR data (#2) on a previous GEnx/787 engine issue: https://data.ntsb.gov/Docket?ProjectID=84481
If the switches are cutoff, the FADEC does not attempt to start the engine.
If the switches are moved back on, the FADECs do anything they can to recover the engine, except use the actual starter motors (unless the start switch is moved too).
The starter motors wouldn't have been available in this case as no ground power, APU, or second engine for cross-start.
"IAS Disagree" seems to be far closer to the latter?
If the switches are cutoff, the FADEC does not attempt to start the engine.
If the switches are moved back on, the FADECs do anything they can to recover the engine, except use the actual starter motors (unless the start switch is moved too).
The starter motors wouldn't have been available in this case as no ground power, APU, or second engine for cross-start.
In every system I worked on "Disagree" meant that a command had been issued but the commanded system had not (yet) assumed the commanded state.
That is very different from "Miscompare" which is when two independent systems provide different data for a system state or parameter when both independent systems would normally provide the same information.
That is very different from "Miscompare" which is when two independent systems provide different data for a system state or parameter when both independent systems would normally provide the same information.
Joined: May 2024
Aviation Qualifications: CPL
Posts: 379
Likes: 36
From: Kaupuala
So So
Sampling rate has been given many times as 1Hz. Read through both the FDR group's report (#1) and minimally-processed FDR data (#2) on a previous GEnx/787 engine issue: https://data.ntsb.gov/Docket?ProjectID=84481
If the switches are cutoff, the FADEC does not attempt to start the engine.
If the switches are moved back on, the FADECs do anything they can to recover the engine, except use the actual starter motors (unless the start switch is moved too).
The starter motors wouldn't have been available in this case as no ground power, APU, or second engine for cross-start.
"IAS Disagree" seems to be far closer to the latter?
If the switches are cutoff, the FADEC does not attempt to start the engine.
If the switches are moved back on, the FADECs do anything they can to recover the engine, except use the actual starter motors (unless the start switch is moved too).
The starter motors wouldn't have been available in this case as no ground power, APU, or second engine for cross-start.
"IAS Disagree" seems to be far closer to the latter?
Thanks for the help, and your patience......
One last. The sampling rate for FADEC CUT?
Joined: Jul 2013
Aviation Qualifications: Non-Aircrew
Posts: 5,682
Likes: 3,345
From: Everett, WA
Sampling rate has been given many times as 1Hz. Read through both the FDR group's report (#1) and minimally-processed FDR data (#2) on a previous GEnx/787 engine issue: https://data.ntsb.gov/Docket?ProjectID=84481
FADEC 3 (GEnx, as well as LEAP and later model GE90s) has a major frame rate of 60 ms and a minor frame rate of 15 ms, so it depends on the parameter you're looking at (e.g. does the FADEC look at each minor cycle or each major cycle).
Joined: Jan 2025
Aviation Qualifications: Non-Aircrew
Posts: 640
Likes: 782
From: New Zealand
Thread Starter
Joined: Aug 2020
Posts: 138
Likes: 72
From: UK
to clarify : the 2nd button would operate exactly as the current 1st button does, fuel etc shutoff no questions ifs or buts. It could be operated without button 1 having being operated, but that would be outside SOP, but would be available for cases where button 1 (joint control by pilot and computer) doesn't shut the engine down.
What I'm aiming for is the mental break, almost a 3rd pilot in the cockpit saying "wait a minute".. By making the pilot move towards button 2, when button 1 should have done the job (Jeju, Kegworth, AI) it means the computer thinks its not a wise move, and it will hopefully make the pilot take another few seconds to say "weird, why does the computer not like my first command" and perhaps another instrument scan and check.
99.99% of the time in line operations button 1 is the right button to press, so when a pilot is directed to button 2 they should take a second to re-evaluate. It's a trade off. It's an extra 5 seconds in worse case emergency, say engine fire and computer US, but in many many routine ops that have a minor emergency it will actually prevent a crash.
Simon
What I'm aiming for is the mental break, almost a 3rd pilot in the cockpit saying "wait a minute".. By making the pilot move towards button 2, when button 1 should have done the job (Jeju, Kegworth, AI) it means the computer thinks its not a wise move, and it will hopefully make the pilot take another few seconds to say "weird, why does the computer not like my first command" and perhaps another instrument scan and check.
99.99% of the time in line operations button 1 is the right button to press, so when a pilot is directed to button 2 they should take a second to re-evaluate. It's a trade off. It's an extra 5 seconds in worse case emergency, say engine fire and computer US, but in many many routine ops that have a minor emergency it will actually prevent a crash.
Simon
Joined: Jan 2025
Aviation Qualifications: Non-Aircrew
Posts: 640
Likes: 782
From: New Zealand
Button 2 basically is the fire shutdown switch I believe, except that also kills the hydraulic pumps.
I would generally be in favour of a landing-gear-lever style solenoid lock. The physical switch still does exactly what it does now; you just can't move it unless justified or you hit override.
I would generally be in favour of a landing-gear-lever style solenoid lock. The physical switch still does exactly what it does now; you just can't move it unless justified or you hit override.