Cockpit engine and system controls, switches
Thread Starter
Fleet Manager
Joined: Aug 2006
Aviation Qualifications: CPL
Posts: 7,081
Likes: 2,938
From: Ontario, Canada
Cockpit engine and system controls, switches
Carrying on from enthusiastic discussion, we'll have this thread as a repository for cockpit engine and systems controls, including switches. This is not an accident discussion thread. Nor is it a thread to discuss pilot deliberate action which was undesired. This is a "how does it operate?", "why was it designed that way?", and what thoughts do we have about how it could be better and more safe?
Discussion on locks and guards which prevent unintended operation are welcome, and thoughts on more advanced systems which prevent unintended operation/misuse/or cascading failure are welcome. I'll be back along later with thoughts I have about this, because in part, I certify these controls as a part of my work in aircraft certification. I'm really thinking about how it should work well, and what can be done to prevent it being hazard prone.
Discussion on locks and guards which prevent unintended operation are welcome, and thoughts on more advanced systems which prevent unintended operation/misuse/or cascading failure are welcome. I'll be back along later with thoughts I have about this, because in part, I certify these controls as a part of my work in aircraft certification. I'm really thinking about how it should work well, and what can be done to prevent it being hazard prone.
Joined: Jun 2025
Aviation Qualifications: Spotter
Posts: 34
Likes: 31
From: Uk
I welcome the creation of this thread, particularly as it has been started by an experienced member who it seems is open to the possibility, that maybe a long established concept of design and operation might be improved upon.
However reliable a single component may have proved to be, having blind faith in it can be dangerous. Whether or not failure is likely, any measures that mitigate against it, I feel, should be considered.
Hopefully those who are responsible for designing and operating these systems can evaluate any methods that might be proposed to further increase safety.
However reliable a single component may have proved to be, having blind faith in it can be dangerous. Whether or not failure is likely, any measures that mitigate against it, I feel, should be considered.
Hopefully those who are responsible for designing and operating these systems can evaluate any methods that might be proposed to further increase safety.
Joined: Oct 2019
Aviation Qualifications: Non-Aircrew
Posts: 1,691
Likes: 1,069
From: USA
I had occasion to work with a minor investigation into a guarded switch (the red flip-cover type) where letting the cover snap closed would result in the switch changing state. Mainly it was that the sheet metal enclosure was carrying the shock load from letting the cover snap shut into a rotation of the switch body and this would dislodge the switch lever.
---
On another case we had a radar station and the operators kept reporting that the cursor on the screen would randomly wander across the screen. It was very intermittent.
The EEs kept looking at all the wiring, the software guys were stumped. Our company was responsible for the radar system, but another company was responsible for the station (among others) that the radar system mounted to.
Eventually we got some engineers on board the USAF test flights because there was no hint of a cause. It took a while to spot the problem, but it turned out it was the radar operator. The station had a desk-like surface and the cursor control stick, a force/strain gauge system, was mounted underneath with a hole for the stick to poke through. The connector on the side of the control stick box exited the side of the box (pretty sure; it's been 30 years).
If you got to this point, have you spotted the problem?
It turned out the operator would get a bit fatigued, lean back in the station chair, and then put one ankle on the other leg's knee and - dun, dun, DUN! - brace their foot on the connector.
Being a strain gauge control, any deformation of the housing was picked up as an input to the stick. It wasn't a large input; the cursor would just start creeping across the screen. If the operator wasn't watching, and they were fatigued after all, the cursor would appear to them to have jumped to a new spot. They would snap to paying attention and the cursor would cease motion.
This was really a problem to be solved by the installation company who designed the station - but parallel subcontractors get stuck with whatever the prime contractor wants and so I got to design a box to go around the control stick box so that the operator couldn't kick the connector with a boot anymore.
---
For a human factors problem - we had a system mounted to the roof of a vehicle. It was very important that the system was locked down before moving the vehicle. There was a manual latch to do this locking. All very standard. We were to make no changes to the vehicle wiring beyond drawing battery power. To idiot proof this there was a switch controlling a beeper that would sound if the system wasn't in use and the latches weren't locked. Unfortunately this could only sound if the system was turned on.
I suggested this was a bad idea, but management managed to convince the customer that this was OK and that their troops could be trained to operate the latch.
They did not operate the latch and the system fell off because they were moving the vehicle, not operating the system.
I had wanted to use a push-pull cable to cover the 6-8 foot distance, attached to the latch, and operating a flag on the dashboard that would flip down and have "UNLATCHED" on the flag, possibly covering the speedometer. Since the flag would move out of the way when latched, the speedometer would be uncovered whenever the vehicle was ready to be driven. No electricity, no wiring change.
Since the EEs were running the project, they didn't do that.
---
On another case we had a radar station and the operators kept reporting that the cursor on the screen would randomly wander across the screen. It was very intermittent.
The EEs kept looking at all the wiring, the software guys were stumped. Our company was responsible for the radar system, but another company was responsible for the station (among others) that the radar system mounted to.
Eventually we got some engineers on board the USAF test flights because there was no hint of a cause. It took a while to spot the problem, but it turned out it was the radar operator. The station had a desk-like surface and the cursor control stick, a force/strain gauge system, was mounted underneath with a hole for the stick to poke through. The connector on the side of the control stick box exited the side of the box (pretty sure; it's been 30 years).
If you got to this point, have you spotted the problem?
It turned out the operator would get a bit fatigued, lean back in the station chair, and then put one ankle on the other leg's knee and - dun, dun, DUN! - brace their foot on the connector.
Being a strain gauge control, any deformation of the housing was picked up as an input to the stick. It wasn't a large input; the cursor would just start creeping across the screen. If the operator wasn't watching, and they were fatigued after all, the cursor would appear to them to have jumped to a new spot. They would snap to paying attention and the cursor would cease motion.
This was really a problem to be solved by the installation company who designed the station - but parallel subcontractors get stuck with whatever the prime contractor wants and so I got to design a box to go around the control stick box so that the operator couldn't kick the connector with a boot anymore.
---
For a human factors problem - we had a system mounted to the roof of a vehicle. It was very important that the system was locked down before moving the vehicle. There was a manual latch to do this locking. All very standard. We were to make no changes to the vehicle wiring beyond drawing battery power. To idiot proof this there was a switch controlling a beeper that would sound if the system wasn't in use and the latches weren't locked. Unfortunately this could only sound if the system was turned on.
I suggested this was a bad idea, but management managed to convince the customer that this was OK and that their troops could be trained to operate the latch.
They did not operate the latch and the system fell off because they were moving the vehicle, not operating the system.
I had wanted to use a push-pull cable to cover the 6-8 foot distance, attached to the latch, and operating a flag on the dashboard that would flip down and have "UNLATCHED" on the flag, possibly covering the speedometer. Since the flag would move out of the way when latched, the speedometer would be uncovered whenever the vehicle was ready to be driven. No electricity, no wiring change.
Since the EEs were running the project, they didn't do that.
Joined: Dec 2002
Posts: 2,767
Likes: 345
From: UK
Pilot DAR, an interesting subject, looking forward to your views and interactions with others.
However, the questions posed may have been inadvertently framed as a technical issue independently from everyday, normal human interaction, and also that the human aspect starts with a 'hazard' opposed to positive human contributions in operation - an operation in context.
The latter is important as many designs agreed years previously may now be assumed to remain adequate in ever evolving operational situations today - people change.
As an example, a design with linear SHELL thinking, still has to work in an operation requiring a systems view of SHELL. No longer individual components - looking into boxes (H), instead focus on connections and interactions, interfacing instantly and simultaneously with everything - increasing complex and uncertain; we can no longer look at one aspect in isolation.
However, the questions posed may have been inadvertently framed as a technical issue independently from everyday, normal human interaction, and also that the human aspect starts with a 'hazard' opposed to positive human contributions in operation - an operation in context.
The latter is important as many designs agreed years previously may now be assumed to remain adequate in ever evolving operational situations today - people change.
As an example, a design with linear SHELL thinking, still has to work in an operation requiring a systems view of SHELL. No longer individual components - looking into boxes (H), instead focus on connections and interactions, interfacing instantly and simultaneously with everything - increasing complex and uncertain; we can no longer look at one aspect in isolation.
Thread Starter
Fleet Manager
Joined: Aug 2006
Aviation Qualifications: CPL
Posts: 7,081
Likes: 2,938
From: Ontario, Canada
An element of my thinking on this includes asking if the control has a gate or not, and its criticality. I am not at all a jet pilot, so I approach discussion of controls in a jet with caution. That said, I am very familiar with "lift to actuate" toggle switches, which are the type used as the engine RUN/CUTOFF switches we were discussing elsewhere. In my mind, those "lift to actuate" switches are "gated" just as a propeller control might have a gate to prevent inadvertent selection into feather, or a condition lever has a gate to prevent engine shut down. The "gate" in this sense is different from a guard.
Thinking to the Twin Otter, the condition levers are guarded, you have to move a clear plastic shield to move the lever(s) toward shut down. The propeller levers are gated, a second motion is required to get them into feather, and the power levers are gated as you have to roll the handles to unlock a gate to select them backward into Beta range. All good for me. Add to that, the Twin Otter autofeather system is designed (and it's a pre takeoff check) that when autofeather is armed (for takeoff) a power loss of an engine will result in the automatic feather of that engine. However, if the second engine also loses power, it will not autofeather. If you want to feather the second engine, you have to do it manually by moving that propeller lever past a gate. I like that system too. My MT reversing propeller, in addition to a guarded switch to actuate reverse, also has a maximum propeller RPM (well below flight) and maximum airspeed [diaphragm switch] (well below flying speed) to prevent the operation of reverse in flight. Serious protections against a serious error which a pilot could make - good!
So, I wonder to myself, if 1960's technology can include this simple protection against a second error, why would the RUN/CUTOFF switches of a very modern airliner have at least that protection. I presume that there must be a reason, but darned if I can imagine it!
And/or, why not have a "confirmation" button/screen tab etc. which lights up saying that the second switch has been moved to "CUTOFF", confirm you want that to happen by pushing this button - very similar to the Twin Otter autofeather system - the next one won't unless a second action is performed.
As said, it's hard to guard against a brain fart, but it is possible. A gated switch/control is a start - two distinct actions to make the selection. A guarded switch - okay, still two actions, though one action could do it if it were the right action. I don't accept that a brain fart will end up shutting down two engines one immediately after the other, when two distinct actions on one switch, then two more on a second switch are required to accomplish that, but maybe I'm wrong. I do know that a Basler DC-3T was splashed because a crew member pulled both condition levers past their gate and into cutoff right after takeoff. But, that can be one hand [on two levers] one action - because the Basler's condition lever gates are more like a gentle reminder than a hard gate.
I agree that it's much more difficult to design away the opportunity for deliberate malicious pilot action, though in the case of simply switching off one engine after another, the afore mentioned "confirm that you really want to do that" would give a second crew member a hope of acting to prevent the second malicious shut down. Heck my computer requires that I confirm I want to delete a file, it can't be that difficult.
Sure, every new system we introduce to protect against something introduces another thing that can fail, so there is a balance. That' why when flying the Twin Otter, I would do the pre takeoff autofeather test.
I am certainly guilty of the occasional brain fart, or simply having my finger on the wrong switch when brain commanded my hand to move something. A couple of years ago, chocked on the apron with the new test airplane I did it, and though the plane did not move as a result of my mis step, the result was very noticeable to the group of people watching, and certainly a large reduction in safety at the moment. the next prototype will have a very different switch arrangement for that test function, because I have specified it. The team seeing me make the error agrees that someone else would too, so let's design out the error before we freeze the design!
We learn by mistakes. Hopefully, our learning is broad enough that we can begin to anticipate mistakes before they are made. I give a lot of thought to these factors/errors when I consider certification of new designs. These discussions help!
Thinking to the Twin Otter, the condition levers are guarded, you have to move a clear plastic shield to move the lever(s) toward shut down. The propeller levers are gated, a second motion is required to get them into feather, and the power levers are gated as you have to roll the handles to unlock a gate to select them backward into Beta range. All good for me. Add to that, the Twin Otter autofeather system is designed (and it's a pre takeoff check) that when autofeather is armed (for takeoff) a power loss of an engine will result in the automatic feather of that engine. However, if the second engine also loses power, it will not autofeather. If you want to feather the second engine, you have to do it manually by moving that propeller lever past a gate. I like that system too. My MT reversing propeller, in addition to a guarded switch to actuate reverse, also has a maximum propeller RPM (well below flight) and maximum airspeed [diaphragm switch] (well below flying speed) to prevent the operation of reverse in flight. Serious protections against a serious error which a pilot could make - good!
So, I wonder to myself, if 1960's technology can include this simple protection against a second error, why would the RUN/CUTOFF switches of a very modern airliner have at least that protection. I presume that there must be a reason, but darned if I can imagine it!
And/or, why not have a "confirmation" button/screen tab etc. which lights up saying that the second switch has been moved to "CUTOFF", confirm you want that to happen by pushing this button - very similar to the Twin Otter autofeather system - the next one won't unless a second action is performed.
As said, it's hard to guard against a brain fart, but it is possible. A gated switch/control is a start - two distinct actions to make the selection. A guarded switch - okay, still two actions, though one action could do it if it were the right action. I don't accept that a brain fart will end up shutting down two engines one immediately after the other, when two distinct actions on one switch, then two more on a second switch are required to accomplish that, but maybe I'm wrong. I do know that a Basler DC-3T was splashed because a crew member pulled both condition levers past their gate and into cutoff right after takeoff. But, that can be one hand [on two levers] one action - because the Basler's condition lever gates are more like a gentle reminder than a hard gate.
I agree that it's much more difficult to design away the opportunity for deliberate malicious pilot action, though in the case of simply switching off one engine after another, the afore mentioned "confirm that you really want to do that" would give a second crew member a hope of acting to prevent the second malicious shut down. Heck my computer requires that I confirm I want to delete a file, it can't be that difficult.
Sure, every new system we introduce to protect against something introduces another thing that can fail, so there is a balance. That' why when flying the Twin Otter, I would do the pre takeoff autofeather test.
I am certainly guilty of the occasional brain fart, or simply having my finger on the wrong switch when brain commanded my hand to move something. A couple of years ago, chocked on the apron with the new test airplane I did it, and though the plane did not move as a result of my mis step, the result was very noticeable to the group of people watching, and certainly a large reduction in safety at the moment. the next prototype will have a very different switch arrangement for that test function, because I have specified it. The team seeing me make the error agrees that someone else would too, so let's design out the error before we freeze the design!
We learn by mistakes. Hopefully, our learning is broad enough that we can begin to anticipate mistakes before they are made. I give a lot of thought to these factors/errors when I consider certification of new designs. These discussions help!
Joined: Jun 2025
Aviation Qualifications: Spotter
Posts: 34
Likes: 31
From: Uk
So, I wonder to myself, if 1960's technology can include this simple protection against a second error, why would the RUN/CUTOFF switches of a very modern airliner have at least that protection. I presume that there must be a reason, but darned if I can imagine it!
I agree that it's much more difficult to design away the opportunity for deliberate malicious pilot action, though in the case of simply switching off one engine after another, the afore mentioned "confirm that you really want to do that" would give a second crew member a hope of acting to prevent the second malicious shut down. Heck my computer requires that I confirm I want to delete a file, it can't be that difficult.
I agree that it's much more difficult to design away the opportunity for deliberate malicious pilot action, though in the case of simply switching off one engine after another, the afore mentioned "confirm that you really want to do that" would give a second crew member a hope of acting to prevent the second malicious shut down. Heck my computer requires that I confirm I want to delete a file, it can't be that difficult.
"why would the RUN/CUTOFF switches of a very modern airliner NOT have at least that protection"
I'm assuming you intended to include the 'not' in your sentence, but I'm guessing the answer is, because this is the first time such an obscure event has occurred.
The possibility that it might happen, as is being contemplated now, had not been considered at the design stage.
"Heck my computer requires that I confirm I want to delete a file, it can't be that difficult."
Possibly the most intriguing sentence yet, amongst the tens of thousands of contributions, in three hamster wheel threads that revolve around such a simple system.
Personally, I can think of no reasons why your logic should not be seriously considered, with a view to effectively mitigate against unintended actions, and also to somewhat frustrate any attempt at a deliberate action.
Some will probably think no improvement is necessary because nothing is infallible, and it could introduce unnecessary complications. They might also say the costs involved are not justified because the current risk is so small.
I'll stand down now, and leave this discussion to those who are directly involved, as my initial concerns have at least been recognised.
Thank you.
Last edited by Abbas Ibn Firnas; 6th February 2026 at 16:37.
Joined: Jan 2008
Posts: 17,687
Likes: 2,030
From: Reading, UK
probably should have gone with fool proof ,!
Joined: Oct 2019
Aviation Qualifications: Non-Aircrew
Posts: 1,691
Likes: 1,069
From: USA
"Heck my computer requires that I confirm I want to delete a file, it can't be that difficult."
In the computer there is a single action that can select any of up to dozens of actions to be performed on the file. One right clicks and then rolls the cursor down a list, an action with no physical feedback about which action is being selected, using a control that might initiate several thousand actions each hour.
Were the engine shutdown tied to the movement of the control wheel, then adding a confirmation would be required.
Perhaps, for confirmation, one would have series controls on opposite sides of the cockpit, like the turning of keys in a nuclear missile silo, for such critical controls. Both have to change state for the state to change.
In the computer there is a single action that can select any of up to dozens of actions to be performed on the file. One right clicks and then rolls the cursor down a list, an action with no physical feedback about which action is being selected, using a control that might initiate several thousand actions each hour.
Were the engine shutdown tied to the movement of the control wheel, then adding a confirmation would be required.
Perhaps, for confirmation, one would have series controls on opposite sides of the cockpit, like the turning of keys in a nuclear missile silo, for such critical controls. Both have to change state for the state to change.
Thread Starter
Fleet Manager
Joined: Aug 2006
Aviation Qualifications: CPL
Posts: 7,081
Likes: 2,938
From: Ontario, Canada
Perhaps, for confirmation, one would have series controls on opposite sides of the cockpit
The only time I have shut down an engine is haste was an FCU runaway on a PT-6 in the Piper Cheyenne. Was was pilot monitoring, and I did not like what I saw on the fuel flow indicator. My Captain said: "We may have to shut that one down". When he said that I placed my hand on the condition lever for that engine, identified and confirmed. I watched him gently retard the power lever, and as he did, the ITT suddenly shot toward the red line. I shut the engine down, just as it passed by ten degrees, before cooling again. We agreed that I did the right thing, and ultimately saved the engine from an overtemp. Everyone was happy with what I had done, though I accept that I didn't really follow procedure in terms of waiting confirmation from the other pilot before I shut down, we had sort of pre-briefed that - sort of...
But that was a six seat turboprop, and I was thinking to save a $100,000 inspection, while everyone agreed that the other engine was perfectly fine. An airliner is a different situation - spend the engine to save the lives!
Joined: Apr 2004
Posts: 2,166
Likes: 86
From: Planet Earth
The 727 engine anti ice panel had a rotary switch to check the valve position agreed with switch selection
With the EAI switches forward all engine anti ice valves opened and correct operation was confirmed with three green lights, turning the switches off would see the lights go out then turn green again once the valves closed
The green lights showed the valves agreed with the switch position
On one occasion the FO tested this panel but then turned off the rotary selection switch while leaving the EAI switches in the forward, on position
All lights were out so everything appeared normal, it was only during the ensuing climb that the lack of performance was apparent, the EAI switch position was noticed and turned off, everything returned to normal
That switch panel was a poor design, should not have been possible to have all lights out with EAI on
With the EAI switches forward all engine anti ice valves opened and correct operation was confirmed with three green lights, turning the switches off would see the lights go out then turn green again once the valves closed
The green lights showed the valves agreed with the switch position
On one occasion the FO tested this panel but then turned off the rotary selection switch while leaving the EAI switches in the forward, on position
All lights were out so everything appeared normal, it was only during the ensuing climb that the lack of performance was apparent, the EAI switch position was noticed and turned off, everything returned to normal
That switch panel was a poor design, should not have been possible to have all lights out with EAI on
Joined: Oct 2006
Aviation Qualifications: A&P
Posts: 1,346
Likes: 270
From: USA
On the flip side, you still need to ensure the crew will react properly to those gates and guards. For example, during an in-flight fire on an EC135 helicopter the pilot noted the guarded FIRE light and stated he pressed the lighted switch to activate the fire extinguisher but nothing happened. However, during the post accident investigation, the cockpit fire warning unit was recovered that still had the wire guard over the FIRE light switch safetied closed. So sometime by design you prevent one failure only to induce another.
Joined: Mar 2005
Aviation Qualifications: Military
Posts: 6,562
Likes: 952
From: Aus
All our company twin time had been accumulated on Bell 212/412 helos, which were then replaced with the S-76. The Bells had the fire handles in the centre of the instrument panel with red lights in the handle which you pulled and turned to blow the bottles.
The S-76 had an engine fire warning in a group of four red lights to the right of the flight instruments, the engine fire warning was the upper right light (no indication which engine), you then had to look to the overhead to see which engine had the fire light illuminated. The check pilot on the conversion caught everybody out by giving an an engine fire indication during the engine cool down period. The instrument panel light illuminated, upper right caption, student swiftly shutdown #2, had the student bothered to look to the overhead he would have found the fire to be in #1. Lesson indelibly imprinted.
The S-76 had an engine fire warning in a group of four red lights to the right of the flight instruments, the engine fire warning was the upper right light (no indication which engine), you then had to look to the overhead to see which engine had the fire light illuminated. The check pilot on the conversion caught everybody out by giving an an engine fire indication during the engine cool down period. The instrument panel light illuminated, upper right caption, student swiftly shutdown #2, had the student bothered to look to the overhead he would have found the fire to be in #1. Lesson indelibly imprinted.
Thread Starter
Fleet Manager
Joined: Aug 2006
Aviation Qualifications: CPL
Posts: 7,081
Likes: 2,938
From: Ontario, Canada
you still need to ensure the crew will react properly to those gates and guards.
But a reminder to me that too many safety features can defeat the intended operation underlying system!
On the flip side
Joined: Apr 2010
Posts: 53
Likes: 25
From: China
I'm glad there's a topic like this, where pilots and engineers can have an in-depth dialogue about a specific issue. As a cockpit engineer and works in human factors, I think a typical scenario for switch-operation errors is the separation between mind and hands. My English is not good, and I don't know if there is an idiom in English that precisely captures this idea; broadly speaking, it means the mind's intention is separated from what the hands actually do.
In my view, it can be called a separation between the designer's mental flow and the operator's mental flow.
As designers, when we configure cockpit switches, we use the engineer's mental flow. As a non-native English speaker, I can't grasp the imagery English has for the word of “switch”, so I can only construct this mental-flow process using my native language.
When we consider switches, we usually think from two types of imagery. One is based on the mechanical structural characteristics of the switch, for example whether it is moved or pressed. The other is described by its volume, that is, its sense of space. Chinese as a language has very rich expressive imagery, and, as is well known, each Chinese character carries an independent meaning and does not require multisyllabic way, which determines the neatness of Chinese expression. Based on these features of Chinese, we can very easily define switches in a highly precise way.
In the operational side, we need to rename these switches so pilots can reorient them by operational semantics — for example, if a switch's function is to turn something on and off, redefine that switch as a "switch," regardless of its structure or size. If it is used for electrical control, rename it as an "electrical level." The purpose of this is to align the engineers' design flow with the pilots' operational flow. Whether called a switch (on-off) or an electrical gate(high-low), in Chinese they are two completely interchangeable syllables; this change will not produce substantive effects from design documents to training materials — for example, the length and timing of standard callouts will not change.
Furthermore, in this sense we often encourage pilots to develop their own colloquial names for these switches; we regularly evaluate those slang terms and promptly feed them back into development and training. The aim is to ensure that the operational characteristics of these switches are genuinely integrated into the pilots' operational flow, minimizing instances of hand–mind mismatch.
In addition, I note that a key indicator of the hand–mind mismatch phenomenon is time-based. As a device of distributed memory, a switch's interaction with the hand is time-dependent — broadly speaking, a kind of muscle memory.
I am still conducting data analysis in this area; it is just that the Jeju Air and Air India incidents have made this research feel urgent. I have already begun writing a book, planning to submit to a publisher next year.
Overall, better mitigating the problem of mismatched intention and action requires sufficient identification—not to add more safeguards, but to understand the mechanisms influencing diversion and achieve more effective governance. One small insight of mine is that timing precision for Callout is an effective way to manage the muscle-memory effect.
In my view, it can be called a separation between the designer's mental flow and the operator's mental flow.
As designers, when we configure cockpit switches, we use the engineer's mental flow. As a non-native English speaker, I can't grasp the imagery English has for the word of “switch”, so I can only construct this mental-flow process using my native language.
When we consider switches, we usually think from two types of imagery. One is based on the mechanical structural characteristics of the switch, for example whether it is moved or pressed. The other is described by its volume, that is, its sense of space. Chinese as a language has very rich expressive imagery, and, as is well known, each Chinese character carries an independent meaning and does not require multisyllabic way, which determines the neatness of Chinese expression. Based on these features of Chinese, we can very easily define switches in a highly precise way.
In the operational side, we need to rename these switches so pilots can reorient them by operational semantics — for example, if a switch's function is to turn something on and off, redefine that switch as a "switch," regardless of its structure or size. If it is used for electrical control, rename it as an "electrical level." The purpose of this is to align the engineers' design flow with the pilots' operational flow. Whether called a switch (on-off) or an electrical gate(high-low), in Chinese they are two completely interchangeable syllables; this change will not produce substantive effects from design documents to training materials — for example, the length and timing of standard callouts will not change.
Furthermore, in this sense we often encourage pilots to develop their own colloquial names for these switches; we regularly evaluate those slang terms and promptly feed them back into development and training. The aim is to ensure that the operational characteristics of these switches are genuinely integrated into the pilots' operational flow, minimizing instances of hand–mind mismatch.
In addition, I note that a key indicator of the hand–mind mismatch phenomenon is time-based. As a device of distributed memory, a switch's interaction with the hand is time-dependent — broadly speaking, a kind of muscle memory.
I am still conducting data analysis in this area; it is just that the Jeju Air and Air India incidents have made this research feel urgent. I have already begun writing a book, planning to submit to a publisher next year.
Overall, better mitigating the problem of mismatched intention and action requires sufficient identification—not to add more safeguards, but to understand the mechanisms influencing diversion and achieve more effective governance. One small insight of mine is that timing precision for Callout is an effective way to manage the muscle-memory effect.
Thread Starter
Fleet Manager
Joined: Aug 2006
Aviation Qualifications: CPL
Posts: 7,081
Likes: 2,938
From: Ontario, Canada
For the purpose of this discussion, a "switch" could be considered a control which is used to select something on, or off. If the level/amount (high/low) of something is being controlled, that would more commonly be a rheostat or potentiometer for electrical systems, or a valve (throttle, heat valve, and dozens of other examples) for "flow" type systems. There are rheostats and potentiometers for electrical systems which include a switch at one extreme of the motion, like a light, which may be normally off, then turned on with the rheostat by turning/sliding, and increased in brightness by moving more. There are also valves with a "switch" gated at one extreme, a propeller control with a feather position at one extreme would be an example.
In the context of what's going to kill you by doing it wrong, more likely an on/off switch, rather than a rheostat or potentiometer. In the case where a sliding or rotating valve may have a dramatic effect on the operation of the aircraft, (like a power lever/throttle) generally, the effect becomes evident by a [power] change, which the pilot should recognize, and correct before it becomes fatal. On the other hand, a switch is binary, on one moment, off the next. Various guards have been designed to prevent mis operation. Sometimes muscle memory can overcome these safeguards, relegating them to nothing more that preventing the switch from being unintentionally moved by being bumped.
In the case of engine run/cutoff switches, which are a prime topic inspiring this thread, 100% critical. In a more cautionary world, the guards could have been more foolproof. Or, better yet, a secondary acknowledgement required to complete the action, particularly for a second engine, once the first has been selected cutoff. It is noteworthy that elsewhere it has been recently reported that the operation of the Air India 171 switches to off was a deliberate pilot action by the pilot not flying. No guard is going to prevent that, though a secondary acknowledgment required to cut off the second engine might have. I imaging that in the background, designers are considering that for the next generation of systems.
In the context of what's going to kill you by doing it wrong, more likely an on/off switch, rather than a rheostat or potentiometer. In the case where a sliding or rotating valve may have a dramatic effect on the operation of the aircraft, (like a power lever/throttle) generally, the effect becomes evident by a [power] change, which the pilot should recognize, and correct before it becomes fatal. On the other hand, a switch is binary, on one moment, off the next. Various guards have been designed to prevent mis operation. Sometimes muscle memory can overcome these safeguards, relegating them to nothing more that preventing the switch from being unintentionally moved by being bumped.
In the case of engine run/cutoff switches, which are a prime topic inspiring this thread, 100% critical. In a more cautionary world, the guards could have been more foolproof. Or, better yet, a secondary acknowledgement required to complete the action, particularly for a second engine, once the first has been selected cutoff. It is noteworthy that elsewhere it has been recently reported that the operation of the Air India 171 switches to off was a deliberate pilot action by the pilot not flying. No guard is going to prevent that, though a secondary acknowledgment required to cut off the second engine might have. I imaging that in the background, designers are considering that for the next generation of systems.
Joined: Apr 2004
Posts: 34
Likes: 1
From: England
There are some interesting alternatives out there. I understand some Embraer aircraft inhibit engine shutdown if the throttle is above idle. It looks like Gulfstream have considered similar protections. US11306664B2 - System and method to prevent unintended aircraft engine shutdown - Google Patents
This would at least lead to the normal operation being an easily reversible action before fuel cut off.
This would at least lead to the normal operation being an easily reversible action before fuel cut off.
Joined: Apr 2010
Posts: 53
Likes: 25
From: China
In fact, that is exactly what I meant to express here. As engineers, when we select a switch, the switch’s name comes from the supplier’s product manual. As mentioned before, switch developers usually name the switch after its physical structure/mode of operation; at the same time, at least in Chinese, switches are also named for their spatial characteristics(shape). But when the device gets into the hands of the operator—say, a pilot—they will rename the switch according to their own context. Take the engine fuel switch as an example: from an engineer’s perspective it means simply on or off—that is its design intent—but from a pilot’s perspective it is a remote-control device, and because that remote control is implemented via electrical signals, our pilots prefer to call it an “electric gate”(sorry for not exact translation from Chinese) rather than a “switch.”
As a result, engineers and pilots develop different contexts for the same device depending on their purposes for using the switch. This is what I mean by a divergence of mindsets: engineers choose, design, and operate according to their own mindset, while pilots use their own understanding. I have a dedicated research project on this topic: cockpits slang and its cultural impact on cockpit engineering development. I don’t know whether my European and American colleagues have done similar research; to me, this is a subtle and fascinating subject, and whenever an incident occurs I tend to think about this connection to some extent.
As a result, engineers and pilots develop different contexts for the same device depending on their purposes for using the switch. This is what I mean by a divergence of mindsets: engineers choose, design, and operate according to their own mindset, while pilots use their own understanding. I have a dedicated research project on this topic: cockpits slang and its cultural impact on cockpit engineering development. I don’t know whether my European and American colleagues have done similar research; to me, this is a subtle and fascinating subject, and whenever an incident occurs I tend to think about this connection to some extent.