Disagree button for engine shutdown
 

The commonalities between jeju and Air India are astounding, engine shutdown when totally not appropriate.

I would suggest cockpits be added with a 2nd shutdown switch. That if an engine shutdown is commanded by the crew, and the computer disagrees its necessary, that the crew need to push a 2nd, more guarded and inaccessible, switch to command the shutdown.

I have discussed this very concept with certification authorities for future consideration. Considering the many twin engine airplanes will not allow the autofeather system to feather the second engine, the same theme has merit when it comes to shutting down the engine entirely! There have been cases where two (both) engines were shut down by mistake, resulting in a crash. Automated systems, along with electric, rather than completely manual, shut off controls, gives us a new design opportunity to prevent what might be thought of as a single point failure in pilot action.

I can understand why you might want to pull the fuel cut-off switches for an engine fire but would it be more logical that the thrust had to be reduced to idle for a short period - perhaps 5 seconds - first ?

You've chosen two examples where we don't have final reports, so we don't really know what happened.

Your proposal would not prevent malicious shutdown.
It would not prevent wrong engine shutdown when the crew is convinced they have the correct engine, and thus operate the second switch without further thought.

It may help when the shutdown was commanded as an action slip, but many pilots think that never happened anyway—it's certainly very rare.

But you would run the danger of creating situations where it becomes impossible to shut down an engine due to a computer malfunction; or a situation where the crew thinks they have shut down the engine when it is still running because the system is still waiting for a confirmation they didn't think it would ask for.
As an example, if weight-on-wheels fails, the system might require confirmation when shutting the engines down at the stand when it normally is not required.

Hang on, to shut an engine down we follow a set procedure of diagnosis, agreement of the condition, and then a monitored and confirmed drill with both pilots fully involved. If this is done properly then the chances of shutting down the wrong engine are extremely small. The thrust lever is retarded first, then the fuel control switch cutoff, then the fire switch if necessary. Each one is done carefully and deliberately and I always check that the other engine is still running at (usually higher thrust) after closing the thrust lever, and before moving the fuel control switch. Just a quick glance. I’d be even more careful for real I think, especially if both engines were at idle in the descent.

As I write this there are approx 4,000 Boeing Aircraft in the sky at this time, according to Chatgpt, with 263,000 Commercial Movements today worldwide, a third of them Boeing.
Approx 3,700 to 3,800 people will die today because of Automobiles, and other road transport, shall we ban cars?

Seeing 100% of Pilot Suicides are caused by human's maybe we should remove the human form the flight deck?


Sorry, but without the full report on what happened, its a bit early to be jumping to conclusions.

Agreed.

Shutting down all engines at the take-off phase of flight is unthinkable to most pilots, and adding layers of electronics between the switches and the FADECs and valves would not improve the robustness, because that would introduce the possibility of malfunctions, leading to uncommanded shut-downs.

Possibly, only possibly; a physical gate moved by the thrust levers, so that the fuel cut-off could not be moved unless the relevant thrust lever was at idle. That way, PM would not be physically able to move the switches because PF would have their hands on the thrust levers at that point and therefore able to resist - or at least be warned of what PM might be attempting.

But airliners have flown millions of hours and take-offs without this problem ever arising, so I would question the need for any change, (while re-stating my personal call to make pilot rosters more reasonable).

But, 'we' need to introduce some sort of reporting system that pilots could use for personal stress issues, without fear of reprisals. E.g. the fatigue reporting system could be expanded to include stress. Pilot licence or earnings replacement insurance should not be allowed to be refused for mental issues in the event of a pilot losing their medical.

Such measures might help pilots under (any form of) stress to get help and be excused line duties if necessary, until they had satisfactorily sorted their problems out.

Peer support programs already exist and used by many airlines. It's a positive evolution that needs more development as well...

As to the initial proposition of this thread, I don't see how this would solve the issue for the mentioned cases. If you want to shut down the engine, you shut it down. If you shut down the wrong one, at one point both pilots were convinced it was the "correct" engine to shut down. Surges and stalls can be deceiving. Ie everybody talks about vibration, yet Boeing knows vibration is deceiving and the instrument unreliable.

I preface by saying that I am not a jet pilot at all, though lots of twin propeller time. I have flown the DA-42, where an engine failure is a no pilot action event, other than securing it when time permits - big jet like in procedures.

In a twin prop, getting the failed one feathered promptly is pretty important. I understand that a jet, less so. Wait it out steady up to altitude X, then start securing things. So, I ask myself, and considering the immensely low risk of a malicious shutdown, what if software delayed any action to shut down a second engine by umpteen seconds? Sure, pilot action for a first engine event. But, is there any need for instant action behind that for a second engine shut down! Engine fire aside, whatever could possibly cause a pilot to decide to shut down the second engine could probably wait 30 seconds before the shut down command was actioned by the airplane. So a message: "You have commanded the shutdown of the second engine. This shutdown will occur in thirty seconds unless you XXX". If nothing else, it would give a very surprised second pilot time to do something to prevent the shutdown, rather than dealing with it after the shutdown had commenced.

I'm thinking about this from a certification perspective, as we have already been having discussions in this theme....

I hear the arguments against, which is pilots are well trained, but with Kegworth we now have at least 3 recent instances where the wrong/both engines were shut down. I would suggest at the least, if not my suggested solution, than a safety body should take this issue onboard as a priority and come up with a solution for the next generation of passenger jets. Air India and others could give us a chance to make a step forward in airline safety, or could be a wasted opportunity. The other priority issues are US runway incursions and aircrew mental health (EgyptAir, germanwings, MH370). ICAO or whoever should take these concerns on board and aim for a step change in safety.

This process has begun in its infancy in Canada, with discussions I have had with Transport Canada staff. That said, short of FAA NPRM action to change FAR 25 (which would be a good idea), the execution of the "good idea" in here must be by the aircraft designed (approval applicant) rather than the "safety body". A good way to begin that is that the customers (the airlines, in this case) ask for this in the design of the products that they buy. It'll be an awkward ask though, as the airlines would rather not discuss why they think they could need this feature!

So we're in that regulatory grey zone, where a good idea lacks actual regulation, and lacks a proponent to carry it forward to be a requirement and feature - but, the theme is not overlooked....

The current layout of the Boeing fuel control switches has remained the same for 70 years - literally generations of pilots know and use this layout.
The potential of a redesign introducing undesirable unintended consciences is very high - especially if it's a knee-jerk response. Something like this needs to be carefully and thoroughly vetted before it sees the light of day. For example, requiring the thrust lever at idle - what if the lever gets jammed somehow and can't be moved to idle? Requiring both pilots to take an action - what if one pilot is incapacitated?

As I understand it, Kegworth both pilots agreed on the engine - it's just that they were both wrong.

I think the first step is to better educate and train the pilots that there is almost never a reason to rush shutting down a turbofan engine. Even with an engine fire, the bult in protections give you minutes to take action, not seconds. Was there some reason (that we don't yet know about) that caused Jeju to 'rush to judgement' and shutdown an engine quickly? Or did they just panic, and get it wrong?

There are lots of ways a panicked pilot can crash an aircraft - shutting down the wrong engine is just one. Maybe the answer is to get pilots to not panic?

Things like EICAS/ECAM have made it far easier to correctly identify a malfunctioning engine - are pilots being appropriately trained to use that?

Exactly, engine identification is the issue, not the execution.

The issue with "vibration" has always caused confusion, back in the BMI days and still today... we even had those discussions on the 777.

Birdstrikes might lead to surges/stalls, but with airframe vibrations, many crews will consider it "severe damage". Which is what this crew did. So maybe they identified the wrong engine. But if the discussion now ends up in a "yes both engines were vibrating, but engine X was the only engine providing electrical power and was the wrong engine to shut down", we are not done with the Boeing 737 procedures and blaming pilots is just too simple office talk. This would be a fun sim scenario by the way...

So yes, the BIG question should be brought to the Boeing table: why no EICAS to help the situational awareness? (I know, money) Allowing correct identification is key here.

Engine fire notwithstanding, is there a rush to shut down a turbofan engine at all? Particularly shortly after takeoff?

The only thing I can think of is severe engine vibrations from something like a fan blade-out event. I've been told the resultant vibrations have been so bad that the pilots can't see the displays.
That being said, it's unlikely that and engine will keep running after such an event, and shutting it down doesn't get rid of the vibration, it just lessens it somewhat.

I’ve been associated with two (I think THE two) Fan Blade Off events involving the BR 725 engines on Global Expresses. I personally knew the first crew. They reported a loud bang and instantly very severe vibrations that were disorienting, not in the spatial way, in a hard to read and understand the instruments way. They did nothing because couldn’t decide what to do. Soon the engine shut itself down. There was still vibration, but reduced. The USAF E-11 crew had a similar event, but despite using the old “move the throttle to identify the dead engine” decided wrong and caged the wrong one. The affected engine shut down and the vibration, we believe, continued. The crew appears to never recognized the engine with status message ENG SHUTDOWN was perfectly usable and could have restarted, perhaps due to extent of continuing vibration.

Doing nothing until you understand the situation you are in is very valid. If you can keep your guts out of your throat, of course.

BTW, the Gulfstreams with BR 725 have a very specific procedure due to the possibility of the FBO engine creating an harmonic with structure at certain speeds.

Not being able to see the displays is a "definition" to identify severe turbulence.

When it comes to fan blad failures, the Boeing FCTM is pretty scary. It states vibration may be severe, but "it is extremely unlikely that the vibration will damage the airplane structure or critical systems". It furthermore discusses the impact on human performance and gives some advice "to find relief" like leaning forward or even... standing up. I think the main goal is to remain seated with seatbelts on. When reading this the first time I did wonder what level of vibration we are talking about and what the psychological effect would be if an FCTM needs to comfort you it will not damage the structure.

I've talked to some people who've experienced engine surges. Most of them fairly "as expected" from simulator training, but one described it as "much more violent" than the simulator.

Perhaps adding the engine auxiliaries (generator/s and pump/s) to the detailed engine status display might be helpful? If everything on one engine is orange, you don't want to shut down the other engine, at least not without getting the APU running first (depending on aircraft architecture).

I wonder if you could get a general 'engine health' or 'maximum predicted available thrust' rating out of the FADEC. Display it on the N1/EPR dials post engine malfunction.

On detection of high cockpit vibration, swap the engine display to a large-text large-dial version, in the same way that fire/smoke procedures are printed in large text for easy visibility. New aircraft with massive displays mean you can probably seize display area from lower-priority displays (subject to an override back to normal mode) to get easier-to-read information.

There is no need to reinvent the wheel. Aircraft manufacturers should simply take a page out of Embraers book. In an Ejet, the engine will not shut down unless the trust lever is at idle before the run switch is selected to stop. preventing incorrect shutdowns.

And Boeing have a failure case in which the thrust lever remains stuck in its position. Much fun on leveloff after takeoff.

Because introducing software between cut-off switches and the engine will also introduce a whole raft of potential failures and malfunctions. I would be interested to know how the eJet is configured to accomplish this.


After Kegworth, they did. It was found that the Boeing engine displays were potentially confusing: In the Boeing 737 they consisted of two sets of vertical columns of engine parameter gauges. The column nearest the LHS had the major parameters such as N1, EGT, fuel flow, N2. The column nearest the RHS had secondary parameters such as Oil pressure, oil temperature and quantity, engine vibration etc.

So scanning the columns of gauges from left to right it went left engine, right engine, left engine, right engine. This is believed to have caused confusion as to whether the high vibration reading was referring to the left or the right engine, since the vibration gauge was to the right of all the primary gauges

Recommendations were made suggesting that Boeing change the gauge layout so that they were all fully symmetrical, so that left gauge meant left engine, and right gauge meant right engine, but I don't know if they ever did this ?

Agreed. (You've still got the fire handle or fire push-button to shut an engine down if the thrust lever is jammed)..

See above re gauge layout.

Yes. Every 6 months we practise engine shut-downs in the SIM - usually during, or immediately after take-off; a high stress situation.

As some have asked or suggested, there is no urgency or reason to quickly shut down a gas turbine engine, even if it is on fire.

The overriding priority is to FLY and control the aircraft; i.e. get it under control (usually with a large amount of rudder, given that the thrust might suddenly have become very asymmetric), and climb safely away. So gear needs to come up, for example.

Audible warnings are cancelled and we "ignore" the failed engine or the engine on fire until we are safely climbing away. Only then do we begin the drills, starting with "what happened ?" Then we must consider the flight path and the terrain ahead. Since our rate of climb will now be much lower than normal, we might not clear obstacles ahead, and we might have to make an emergency turn before completing an engine shut-down.

If an engine has failed; before shutting it down both pilots very carefully check the engine instruments, or ECAM/EICAS, AND also all the warning lights on the overhead panel to double check and confirm that the "correct" engine is being shut down. Both of us also check and confirm that each critical switch or lever is the correct one before moving it.

So, yes, we are trained and rehearsed very carefully and intensively to perform engine shut-downs carefully and diligently.

Having said that it's in a simulator, which you know is not going to kill you, and therefore you don't necessarily have that extra factor of the real world coming at you, and the real world can change behaviour.

And one hopes the same high standards are demanded throughout the World.

One thing though I think needs to change is airline pilot trainers examining their own pilots. There is a potential incentive for company type rating examiners, TREs, to get their pilots through their SIM exams. I personally think that SIM exams should be conducted by aviation authority examiners, who do not know the candidates. This might help reveal issues, if they existed.

.

Have advances in engine control/management introduce unnecessary complications, eg this switch to turn the engine 'Off'?

My antique experiences of jet engine management were all back in the analogue computer days, but the vast majority relied on pulling the SSL (Speed Select lever) back past a mechanical lock to shut off or rolling the throttle back past a pilot operated mechanical lock to shut off. In all cases the lock occurred at ground idle.

So maybe something similar is not inconceivable in this digital age, incorporated into the Thrust Levers quadrant and removing the intriguing but IMO unnecessary switchology and computer processing of the Fuel Shut Off switch?

From Uplinker
"One thing though I think needs to change is airline pilot trainers examining their own pilots. There is a potential incentive for company type rating examiners, TREs, to get their pilots through their SIM exams. I personally think that SIM exams should be conducted by aviation authority examiners, who do not know the candidates. This might help reveal issues, if they existed."

I asked in the Air India accident thread if this system applied in India or if they still used the government examiners as we used to. but it was passed over without comment.
My adviser from within the industry is disappointed with our system as it stands. He feels that the authorities really have little power to control or improve the quality of airmanship when type rating checks are done by company pilots...

I have seen references to a similar shutoff mechanism on fighter aircraft and I think BBD bizjets. One of the issues is that it's virtually identical to what Airbus uses for reverse thrust - lift the latch, and pull thrust levers rear of idle, and this has apparently caused some inadvertent shutdowns when moving back and forth. Modern engines auto-select ground, flight, or approach idle as necessary.

The switches apparently are not (solely) computerised. They use relay logic to shut the low-pressure fuel valve, and may or may not actually instruct the FADEC to shut down.

Note previous comments by TDR and others that the move to FADECs resulted in a significant (order of magnitude or better?) increase in engine controls reliability - not necessarily engine reliability as a whole, but still a very very significant improvement.


I'd be interested in a listing of all the ways you can shut a typical turbine engine down, and what the delay is on them - apparently the spar valve is quite slow (a minute or two at idle).

A difficulty or a mess
 

The proposal to add a switch, complexity, overlooks the obvious - fix the original issue.
As per James Reason 'drain the swamp not swat mosquitoes'.

First identify the issue, not 'problem' which suggests a solution. Applying systems thinking to complexity recognises that there may not be a unique solution, only small improvements.
Is the issue a difficulty or a mess; "… where the issue is a 'difficulty' then people with a solution are an asset. When the issue is a 'mess', then people with a solution are part of the problem". Russel Ackoff

With hindsight this form of issue can be identified in many incidents / accidents, and reflects the choice of action in design and certification, with roots in safety mindset - cheaper, quicker, …
Quality has unique value, an insurance perhaps never used, or not recognised if used, but if absent is a cruel reminder of human fallibility - thinking at organisational level.

" There is a rather touching faith in the magical ability of technology to solve problems in a way which turns a mess into a mere difficulty. This belief is particularly widespread amongst decision makers who do not understand the technology. It is also complicated by the false belief that expertise in one area enables that expert to offer informed advice across a whole range of domains where they do not have the necessary know-how.
Modern technology induces a kind of techno-paralysis, whereby the victim suspends all sense of reason when dealing with it. Yet technology, no matter how sophisticated, is just a tool. It is not magic and will not automatically evolve towards a state where it will comprehensively address an ill-defined mess. Policy makers, however, rarely seem to understand this. The computer on its own cannot rectify an ill-defined 'digital' (binary, linear, thinking) decision making (DDM) mess. " Ray Corrigan

"LIKE", that Ray Corrigan quote about technology :ok:

Keep it simple, but improve training and remove fatigue from airline rosters.

What an excellent ^^^ post.

The Challenger 600-series and CRJs have a latch mechanism as described, but they don’t have FADECs. The Challenger 300-series and Global Expresses have FADECs and virtually identical fuel switches.

Notably, while no final report has been issued, the Challenger accident in Naples has been suspected to be caused by a pilot reaching around underneath the latches at the same time the PF retarded the thrust to IDLE going past the latch detent into shutoff.

All engine controls shut off fuel at fuel controller, no design uses the spar valves as shutoffs exclusively. The spar valves just isolate the fuel lines in case of fire and back up the HPSOV. I’ve shut off a couple of TF-39s using the valves when the fuel controller valve failed, it’s a wait.

Curious
 

Howdy. I am trying to understand the concept of "Disagree"
On a recent incident, a Fly by Wire Boeing (787) had both engines Cut simultaneously. Is it more difficult to ID a Failure in an engine with FBW recovered Yaw?
Would a pilot Cut two engines at once, without CRM and a pause to make damn sure the correct engine is being Cut?

What would a Disagree system look like in this scenario?

I started the "disagree" conversation. I intend this to mean the computer disagrees. The consensus is most aircraft computer systems these days are very very smart, and have a good grasp of what the aircraft is doing, what it should be doing and what constitutes smart actions and what is not. So if a pilot tries to shut down an engine, and the computer thinks that's not a great idea (Kegworth, Jeju, Air India, no doubt others) then the computer says "disagree" and the pilots are required to then press a 2nd button located someplace else. To my mind this second button would have the fidelity of the current "fuel off" button, i.e. it's a straight cut-off, no ifs or buts.

In every system I worked on "Disagree" meant that a command had been issued but the commanded system had not (yet) assumed the commanded state.

That is very different from "Miscompare" which is when two independent systems provide different data for a system state or parameter when both independent systems would normally provide the same information.

The issue is now you've put a 'logic device' in charge. The entire hardware system currently in use on all Boeing aircraft is specifically designed to prevent exactly that - a rogue computer doing something stupid.
Yes, we give the FADEC the authority to control the engine - and potentially the authority to perform a shutdown for rotor overspeed (and TCMA using the rotor overspeed protection). By design, the rest of the FADEC doesn't use the digital 'cutoff' command from the aircraft except during autostart - once out of the 'start' mode, that logic tree is disabled. But all that is separate between engines. If you put an aircraft logic device in the CUTOFF circuit, you've suddenly introduced a potential single failure that can affect both engines.
In the aftermath of the Air India crash, you should certain see why that might not be a good idea (and besides, it would violate the engine isolation requirements of 25.901(c).).

td. arf
 

""By design, the rest of the FADEC doesn't use the digital 'cutoff' command from the aircraft except during autostart - once out of the 'start' mode, that logic tree is disabled. But all that is separate between engines. If you put an aircraft logic device in the CUTOFF circuit, you've suddenly introduced a potential single failure that can affect both engines.
In the aftermath of the Air India crash, you should certain see why that might not be a good idea (and besides, it would violate the engine isolation requirements of 25.901(c).). ""

Hello... If pilots have performed a "Double cut"" does FADEC do AutoStart? Is it not interrupting a CutOff command? In both? In the QRH, it cautions pilots not to interrupt a Restart. Is that right?
Looking for the sampling rate for Pilots' RUN/CUTOFF switches....anyone?

Sampling rate has been given many times as 1Hz. Read through both the FDR group's report (#1) and minimally-processed FDR data (#2) on a previous GEnx/787 engine issue: https://data.ntsb.gov/Docket?ProjectID=84481

If the switches are cutoff, the FADEC does not attempt to start the engine.

If the switches are moved back on, the FADECs do anything they can to recover the engine, except use the actual starter motors (unless the start switch is moved too).

The starter motors wouldn't have been available in this case as no ground power, APU, or second engine for cross-start.

"IAS Disagree" seems to be far closer to the latter?

So So
 

Also "AoA Disagree Alert".

Thanks for the help, and your patience......

One last. The sampling rate for FADEC CUT?

Depends on what sample rating you're talking about. FDR sample rate for most engines parameters is 1/second (as stated previously, I've never seen an engine parameter at higher than 1/second, some 'lesser' parameters are slower). Sample rate for the spar valve and fuel shutoff valves is a non-sequitur - as those are hardwired connections.
FADEC 3 (GEnx, as well as LEAP and later model GE90s) has a major frame rate of 60 ms and a minor frame rate of 15 ms, so it depends on the parameter you're looking at (e.g. does the FADEC look at each minor cycle or each major cycle).

Yes, sorry, I was referring expressly to the EAFR's sampling of the cutoff switches as recorded by RDCs.

There is no such thing named that - you would have to actually describe what you mean. And this is not the thread.

Perhaps you should download and read the linked FDR report and data.

to clarify : the 2nd button would operate exactly as the current 1st button does, fuel etc shutoff no questions ifs or buts. It could be operated without button 1 having being operated, but that would be outside SOP, but would be available for cases where button 1 (joint control by pilot and computer) doesn't shut the engine down.

What I'm aiming for is the mental break, almost a 3rd pilot in the cockpit saying "wait a minute".. By making the pilot move towards button 2, when button 1 should have done the job (Jeju, Kegworth, AI) it means the computer thinks its not a wise move, and it will hopefully make the pilot take another few seconds to say "weird, why does the computer not like my first command" and perhaps another instrument scan and check.

99.99% of the time in line operations button 1 is the right button to press, so when a pilot is directed to button 2 they should take a second to re-evaluate. It's a trade off. It's an extra 5 seconds in worse case emergency, say engine fire and computer US, but in many many routine ops that have a minor emergency it will actually prevent a crash.

Simon

Button 2 basically is the fire shutdown switch I believe, except that also kills the hydraulic pumps.

I would generally be in favour of a landing-gear-lever style solenoid lock. The physical switch still does exactly what it does now; you just can't move it unless justified or you hit override.