DEVICE FOR PREVENTING THE INTERRUPTION OF AN AIRCRAFT ENGINE

Description

TECHNICAL FIELD

[0001] The present invention relates to the inhibition of a propulsion engine shutdown in an aircraft. The present invention therefore relates to a device for preventing a propulsion engine shutdown, as well as a method implemented by such a device. STATE OF PRIOR ART

[0002] In many aircraft, pilots can shut down an engine used for propulsion by activating a dedicated control in the cockpit. For example, this control is integrated into an engine master lever (EML) used for engine control. When activated, this control triggers the electrical supply to a shut-off device designed to cut off the engine's fuel supply, such as a fuel shut-off solenoid. The engine's fuel supply is then stopped, resulting in engine shutdown.

[0003] A system is known from US document 2016 / 0318620 A1 to prevent the pilot from inadvertently cutting off the fuel and / or engine when it is unsafe to do so.

[0004] It is desirable to increase safety mechanisms in the field of aeronautics and in particular to provide a solution which makes it possible to prevent the engine from shutting down in the event of an error in the operation of the control device or failure to comply with emergency procedures, without inhibiting an effective engine shutdown when this is necessary for the safety of the aircraft for example in the presence of fire. DESCRIPTION OF THE INVENTION

[0005] One object of the present invention is to provide an inhibitor device for preventing the inappropriate shutdown of an aircraft propulsion engine. The shutdown is performed by a shut-off device selectively actuated by a control device under selective command from an aircraft pilot. The aircraft has another propulsion engine, referred to as the opposed propulsion engine. The inhibitor device includes a control unit in the form of electronic circuitry, which is configured to allow, by default, the possible actuation of the shut-off device by the control device and to: receive information representative of an activated or deactivated state of a propulsion engine firestop lever, information representative of an idled or non-idled state of a propulsion engine control, information representative of a correct or incorrect operating state of the propulsion engine, information representative of an on, off or failed state of the opposing propulsion engine, and information representative of a correct or incorrect operating state of the opposing propulsion engine; inhibit the possible actuation of the shut-off device by the control device, when the propulsion engine firestop lever is in an inactivated state, when in addition the propulsion engine is in a correct operating state, and when in addition the propulsion engine control is in a non-idled state;and inhibit the possible actuation of the shut-off device by the control device, when the propulsion engine fire-stop lever is in an inactivated state, when in addition the propulsion engine is in a correct operating state, when in addition the propulsion engine control is in an idle state, and when in addition the opposing propulsion engine is in a failed state or the opposing propulsion engine is in an incorrect operating state.

[0006] It is therefore possible to inhibit a shutdown (i.e., to prevent a stoppage) of the propulsion engine in the event of inappropriate actuation of the shut-off device by the control device, resulting for example from an erroneous command of the control device by the aircraft pilot or from failure to comply with emergency procedures, while ensuring an effective engine shutdown when necessary.

[0007] According to a particular embodiment, the electronic circuitry is further configured to receive information representative of an aircraft speed and / or information representative of an aircraft altitude; and to inhibit the possible actuation of the cut-off device by the control device when, in addition, the aircraft speed is greater than or equal to a predefined speed threshold and / or the aircraft altitude is greater than or equal to a predefined altitude threshold.

[0008] In one particular embodiment, the shut-off device causes the propulsion motor to shut down when the shut-off device is electrically powered by actuation of the control element. The inhibiting device includes a switch located on a power supply link from the control element to the shut-off device, such that it inhibits any potential power supply to the shut-off device from the control element when the switch is in the open position. The switch is in the closed position by default, and the control unit is configured to inhibit any potential actuation of the shut-off device by the control element by switching the switch to the open position.

[0009] The invention also relates to a cut-off system intended to selectively allow a cut-off of an aircraft propulsion engine comprising the inhibition device in any of its embodiments and comprising the cut-off member.

[0010] The invention also relates to an aircraft comprising at least one propulsion engine and, for each propulsion engine of the aircraft, the inhibition device in any of its embodiments.

[0011] According to a particular embodiment, the control member is a main motor lever, and the shut-off member is a high-pressure shut-off solenoid valve, or a low-pressure shut-off solenoid valve located upstream of the high-pressure shut-off solenoid valve in a propulsion engine fuel supply circuit.

[0012] The invention also relates to a method for preventing the inappropriate shutdown of an aircraft propulsion engine. The shutdown is performed by a shut-off device selectively actuated by a control device under selective command from an aircraft pilot. The aircraft has another propulsion engine, referred to as the opposed propulsion engine. The method is implemented by an inhibitor device, includes enabling by default the possible actuation of the shut-off device by the control device, and comprises the following steps: receive information representative of an activated or deactivated state of a propulsion engine firestop lever, information representative of an idled or non-idled state of a propulsion engine control, information representative of a correct or incorrect operating state of the propulsion engine, information representative of an on, off or failed state of the opposing propulsion engine, and information representative of a correct or incorrect operating state of the opposing propulsion engine; inhibit the possible actuation of the shut-off device by the control device, when the propulsion engine firestop lever is in an inactivated state, when in addition the propulsion engine is in a correct operating state, and when in addition the propulsion engine control is in a non-idled state;and inhibit the possible actuation of the shut-off device by the control device, when the propulsion engine fire-stop lever is in an inactivated state, when in addition the propulsion engine is in a correct operating state, when in addition the propulsion engine control is in an idle state, and when in addition the opposing propulsion engine is in a failed state or the opposing propulsion engine is in an incorrect operating state.

[0013] Also proposed is a computer program product according to claim 8, as well as an information storage medium according to claim 9 storing such a computer program. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The features of the invention mentioned above, as well as others, will become clearer upon reading the following description of at least one exemplary embodiment, said description being made in relation to the accompanying drawings, among which: [ Fig. 1 ] schematically illustrates, in top view, an aircraft equipped with at least one propulsion engine and an inhibitor device for each propulsion engine of said aircraft; Fig. 2 ] schematically illustrates a physical arrangement of a set formed by the inhibition device, a control element and a switching element; [ Fig. 3 ] schematically illustrates an example of the hardware architecture of a control unit for the inhibition device; [ Fig. 4 ] schematically illustrates an algorithm for inhibiting a motor cut-off implemented by the inhibition device. DETAILED DESCRIPTION OF IMPLEMENTATION METHODS

[0015] There Fig. 1 This schematically illustrates, in a top view, an aircraft 10. The aircraft 10 has two propulsion engines 11a, 11b on either side of the fuselage, such as a turbojet mounted under each wing of the aircraft 10. The aircraft 10 has a cockpit in which at least one pilot is intended to sit to maneuver the aircraft 10. The aircraft 10 also has avionics 16 to ensure the proper functioning of the aircraft 10, to provide piloting assistance and to transmit information from sensors of the propulsion engines 11a, 11b to onboard instruments located in the cockpit.

[0016] Aircraft 10 includes, for each propulsion engine 11a, 11b, an engine control system 100. Each propulsion engine 11a, 11b is therefore associated with an engine control system 100. For simplicity, only the control system 100 of propulsion engine 11a is illustrated in the Fig. 1 and is described later in the description, the other propulsion engine 11b being referred to as the opposed propulsion engine 11b. However, the aircraft 10 has a similar engine control system 100 associated with the propulsion engine 11b.

[0017] The engine control system 100 includes a control unit 14 for engine shutdown, located in the cockpit, and intended to allow a pilot of the aircraft 10 to selectively order the shutdown of the propulsion engine 11a. The control unit 14 is, for example, an EML (Engine Master Lever).

[0018] The engine control system 100 further includes a shut-off device 12, intended to selectively shut down the propulsion engine 11a. The shut-off device 12 is selectively actuated by the control device 14. In other words, when a pilot of the aircraft 10 actuates the control device 14 to order the shutdown of the propulsion engine 11a, the control device 14 then actuates the shut-off device 12.

[0019] In a particular embodiment, the shut-off member 12 is intended to selectively allow a stop of the fuel supply to the propulsion engine 11a. The shut-off member 12 is then connected to the control member 14 by an electrical supply link 13, and when the shut-off member 12 is electrically powered by actuation of the control member 14, the fuel supply to the propulsion engine 11a is stopped, which results in the engine being shut down.

[0020] The shut-off device 12 is preferably installed near the propulsion engine 11a and, in a particular embodiment, is a high-pressure shut-off valve (HPSOV). The shut-off device 12 can also be a low-pressure shut-off valve (LPSOV), located upstream of the high-pressure shut-off valve (HPSOV) in a fuel supply circuit for the propulsion engine 11a.

[0021] The motor control system 100 further includes an inhibition device 15. The inhibition device 15 includes inhibition means intended to inhibit a possible actuation of the switching member 12 by the control member 14.

[0022] In one particular embodiment, the inhibiting means include a switch, such as switch 20 described in Fig. 2 , placed on a power supply link of the cutting element 12 such as the power supply link 13. The power supply of the cutting element 12 then passes through the inhibition device 15 and a switch to the open position of said switch prevents the cutting element 12 from being powered electrically which thus inhibits a possible actuation of the cutting element 12 by the control element 14.

[0023] Alternatively, the inhibition means include a solenoid valve which, when activated, causes the fuel to be bypassed from the cut-off device 12, thus preventing, in the event of a possible actuation of the cut-off device 12, the fuel supply to the propulsion engine 11a from being stopped.

[0024] The inhibition device 15, through a control unit, monitors parameters and determines whether the actuation of the cutting member 12, by the control member 14 in order to perform a motor cut-off, should be inhibited or not.

[0025] The parameters monitored by the inhibiting device 15 may include flight parameters, such as speed and / or altitude, enabling the determination of whether the aircraft 10 is within a protective envelope where engine shutdown inhibition is permitted. The advantage of implementing such a protective envelope is that it allows engine shutdown when it poses no danger to aircraft safety, such as when the aircraft is stationary on the ground, and it allows engine shutdown in flight during emergency landings or ditching.

[0026] The monitored parameters may also include a parameter representing an emergency situation related to the propulsion engine 11a, such as a fire risk in the propulsion engine 11a. When an emergency situation is detected in the propulsion engine 11a, the actuation of the shut-off device 12 must not be inhibited. The parameter representing an emergency situation may be the state, activated or deactivated, of a fire-suppressor lever on the propulsion engine 11a. When activated, the fire-suppressor lever isolates the propulsion engine 11a from any source that could sustain a fire, such as electricity, oil, or fuel. Thus, a deactivated state indicates that no engine fire-suppressing procedure is in progress on the propulsion engine 11a.

[0027] The monitored parameters may also include the state, idle or not, of a control of the propulsion engine 11a, such as a throttle of the propulsion engine 11a. The monitored parameters may also include the operating state, correct or incorrect, of the propulsion engine 11a.

[0028] The monitored parameters may also include an on, shutdown, or failed state of the opposing propulsion motor 11b, as well as a correct or incorrect operating state of the opposing propulsion motor 11b. The on, off, or failed state of the opposing propulsion motor 11b is determined using two pieces of information concerning, firstly, a control parameter of the opposing propulsion motor 11b (such as a position of the control element 14 of said opposing propulsion motor 11b) and, secondly, a plurality of operating parameters of the opposing propulsion motor 11b. When the control parameter indicates an on or off motor, respectively, and the plurality of operating parameters further indicates that the motor is actually on or actually off, respectively, the opposing propulsion motor 11b is in an on or off state, respectively.Conversely, when the control parameter indicates an engine on but the plurality of operating parameters also indicates an engine effectively off, then the opposite propulsion engine 11b is in a failed state.

[0029] According to one embodiment, when the aircraft 10 is in the protective envelope and the opposite propulsion engine 11b is in a failed state or in an incorrect operating state, the actuation of the cut-off device 12 of the propulsion engine 11a is inhibited in order to prevent both propulsion engines 11a and 11b from being simultaneously unusable without the pilot being aware of it.

[0030] There Fig. 2 schematically illustrates an example of the material arrangement of an assembly formed by the inhibition device 15, the control organ 14 and the cutting organ 12, according to a particular embodiment.

[0031] The control unit 14 includes at least one switch 21, located on the electrical supply link 13. This switch 21 is in an open position by default. When the pilot activates the control unit 14 to command an engine shutdown, said switch 21 toggles from an open position to a closed position, thus enabling the shutdown device 12 to be electrically powered. The control unit 14 may also include one or more other switches connected to other aircraft components 10, allowing, for example, the avionics 16 to be informed of an engine shutdown when they change position.

[0032] In the particular embodiment of the Fig. 2 The inhibition device 15, placed between the control member 14 and the cutting member 12, includes a switch 20, such as an electromechanical relay, located on the electrical supply link 13 of the cutting member 12. The electrical supply of the cutting member 12 therefore passes through the switch 20.

[0033] The switch 20 of the inhibiting device 15 remains in the closed position as long as the aircraft is within the protective envelope. As long as the position of the switch 20 of the inhibiting device 15 is maintained closed, an actuation of the cut-off element 12 by the control element 14, and the resulting switching of the switch 21 to a closed position, then energizes the cut-off element 12 via the power supply link 13 and thus shuts down the propulsion engine 11a. The shutdown of the propulsion engine 11a is thus guaranteed under operating or safety conditions that require it.

[0034] In the particular embodiment of the Fig. 2 The inhibitor device 15, through its control unit, monitors parameters and determines whether the switch 20 of the inhibitor device 15 should be open or closed. When the monitored parameters meet predefined criteria, the control unit of the inhibitor device 15 switches the switch 20 to the open position, thus preventing the cut-off element 12 from being electrically powered, even when the cut-off element 12 is actuated by the control element 14 and the switch 21 of the control element 14 is in the closed position. The shutdown of the propulsion engine 11a is thus prevented by inhibiting the actuation of the cut-off element 12.

[0035] The monitoring of parameters by the control unit 150 of the inhibitor device 15 is carried out using information received, for example from the avionics 16, via a communication link 22. The inhibitor device 15 may also, or alternatively, receive information from other elements of the aircraft 10, such as sensors or actuators of the propulsion engine 11a, sensors or actuators of the opposite propulsion engine 11b or even the instruments on board of the aircraft 10.

[0036] There Fig. 3 schematically illustrates an example of the hardware architecture of a control unit 150 of the inhibition device 15. The control unit 150 then comprises, connected by an internal communication bus 320: a processor or CPU (Central Processing Unit) 310; a RAM (Random Access Memory) 311; a ROM (Read Only Memory) 312; a storage unit or a storage media reader, such as a HDD (Hard Disk Drive) 313; and an interface 314 allowing communication with the avionics 16 and / or sensors of the propulsion engine 11a, sensors of the opposed propulsion engine 11b or the aircraft's onboard instruments 10.

[0037] The processor 310 is capable of executing instructions loaded into RAM 311 from ROM 312, external memory (not shown), storage media, or a communication network. When the control unit 150 is powered on, the processor 310 can read instructions from RAM 211 and execute them. These instructions form a computer program that causes the processor 310 to implement all or part of the algorithms and steps described below in relation to the inhibitor device 15.

[0038] Thus, all or part of the algorithms and steps described below in relation to the inhibition device 15 can be implemented in software form by executing a set of instructions by a programmable machine, such as a DSP (Digital Signal Processor) or a microcontroller, or in hardware form by a dedicated machine or component, such as an FPGA (Field-Programmable Gate Array) or an ASIC (Application-Specific Integrated Circuit).

[0039] There Fig. 4 schematically illustrates an algorithm for inhibiting a motor cut-off, implemented by the inhibition device 15.

[0040] In step 400, the inhibitor device 15 begins monitoring the parameters. The inhibitor device 15 receives information, for example from the avionics 16, representative of these parameters in order to perform the monitoring. Note that step 400 and subsequent steps are performed only when the propulsion engine 11a is running.

[0041] In a step 401, according to a particular embodiment, the inhibition device 15 determines whether the aircraft 10 is in the conditions of the aforementioned protective envelope.

[0042] In one particular embodiment, the protective envelope is defined by a minimum speed of the aircraft 10. Thus, the inhibiting device 15 compares the speed of the aircraft 10 to a predefined speed threshold S1, for example, 80 knots. If the speed of the aircraft 10 is greater than or equal to the predefined speed threshold S1, the inhibiting device 15 performs step 403. Otherwise, the inhibiting device 15 performs step 409.

[0043] In one particular embodiment, the protective envelope is defined by a minimum altitude of the aircraft 10. Thus, the inhibiting device 15 compares the altitude of the aircraft 10 to a predefined altitude threshold S2, for example, 200 feet. If the altitude of the aircraft 10 is greater than or equal to the predefined altitude threshold S2, then the inhibiting device 15 performs step 403. Otherwise, the inhibiting device 15 performs step 409.

[0044] In a particular embodiment, the protective envelope is defined by both a minimum speed of the aircraft 10 and a minimum altitude of the aircraft 10, i.e. the conditions of protective envelope are met when the speed of the aircraft 10 is greater than or equal to the predefined speed threshold S1 and when in addition the altitude of the aircraft 10 is greater than or equal to the predefined altitude threshold S2.

[0045] In step 403, the inhibiting device 15 monitors a parameter representative of an emergency situation related to the propulsion engine 11a and determines whether or not an emergency situation has been detected in the propulsion engine 11a. To do this, the inhibiting device 15 determines whether the fire-stop lever of the propulsion engine 11a is in an activated or deactivated state. If the fire-stop lever is in an deactivated state, step 404 is performed. Otherwise, step 409 is performed. Thus, when an emergency situation is detected in the propulsion engine 11a, such as a fire hazard, the shutdown of the propulsion engine 11a is guaranteed.

[0046] In step 404, the inhibit device 15 monitors a parameter representative of the operating state of the propulsion motor 11a and determines, based on this parameter, whether the propulsion motor 11a is in a correct or incorrect operating state. If the propulsion motor 11a is in a correct operating state, step 405 is performed. Otherwise, step 409 is performed. Thus, the shutdown of the propulsion motor 11a is guaranteed in the event of incorrect operation of the propulsion motor 11a.

[0047] In step 405, the inhibit device 15 monitors a propulsion engine 11a control parameter and determines whether a propulsion engine 11a control, such as the propulsion engine 11a throttle, is in an idle state. The throttle is in an idle state when its position indicates a propulsion engine 11a power setting lower than a predefined power level. If so, step 406 is performed. Otherwise, step 408 is performed. Thus, if the control 14 is accidentally activated by the pilot, for example, due to confusion about which lever to operate or incorrect identification of the malfunctioning engine, the propulsion engine 11a can be prevented from shutting down.

[0048] In step 406, the inhibit device 15 determines whether the opposing propulsion motor 11b is on, off, or has failed. If the opposing motor 11b is on or off, step 407 is performed. If the opposing motor 11b has failed, step 408 is performed. Thus, when the opposing motor 11b has failed, the shutdown of the propulsion motor 11a is prevented.

[0049] In step 407, the inhibitor device 15 determines whether the opposing propulsion motor 11b is functioning correctly. If so, step 409 is performed. Otherwise, if the opposing propulsion motor 11b is malfunctioning, step 408 is performed. Thus, when the opposing propulsion motor 11b malfunctions, the shutdown of the propulsion motor 11a is prevented.

[0050] In step 408, the inhibitor device 15 inhibits any possible actuation of the switching element 12. For example, according to the particular embodiment described in Fig. 2 The inhibiting device 15 switches the switch 20 to the open position, preventing the electrical supply to the cut-off member 12 and thus preventing the propulsion motor 11a from stopping, even if the cut-off member 12 is actuation by the control member 14. It is therefore possible to prevent the propulsion motor 11a from stopping when the actuation of the cut-off member 12 is accidental, inappropriate or when emergency procedures are not correctly applied.

[0051] Furthermore, in a particular embodiment, the inhibiting device 15 sends a message, intended for a display device visible to the pilot, indicating that an engine cut-off of the propulsion engine 11a is inhibited and that the propulsion engine 11a cannot be stopped by the actuation of the cut-off member 12. Alternatively, the inhibiting device 15 sends such a message only when, in addition, the control member 14 is actuated by the pilot.

[0052] In step 409, the inhibitor device 15 allows possible actuation of the switching element 12. For example, according to the particular embodiment described in Fig. 2 The inhibiting device 15 keeps the switch 20 in the closed position. Actuating the cut-off member 12 by the control member 14 then allows the cut-off member 12 to be electrically powered, which results in the propulsion motor 11a being shut off.

[0053] After the implementation of step 408, the inhibitor device 15 returns to step 400, possibly after a predefined waiting period. Similarly, after the implementation of step 409, the inhibitor device 15 returns to step 400, possibly after a predefined waiting period.

Claims

1. Blocking device (15) for preventing an inappropriate shut-off of a propulsion engine (11a) of an aircraft (10), the shut-off being executed by a shut-off unit (12) actuated selectively by a controller (14) under the selective control of a pilot of the aircraft (10), the aircraft (10) comprising another propulsion engine (11b), called the opposite propulsion engine, the blocking device comprising a control unit in the form of electronic circuitry configured for enabling by default a possible actuation of the shut-off unit (12) by the controller (14), and for: - receiving (400) information representative of an activated or inactivated state of a fuel shut-off lever of the propulsion engine, information representative of a reduced or non-reduced speed state of a control of the propulsion engine (11a), information representative of a correct or incorrect operating state of the propulsion engine (11a), information representative of an on, shut down or failed state of the opposite propulsion engine (11b), and information representative of a correct or incorrect operating state of the opposite propulsion engine (11b); characterized in that the control unit is configured for: - blocking (408) the possible actuation of the shut-off unit (12) by the controller (14), when the fuel shut-off lever of the propulsion engine (11a) is in an inactivated state (403), if the propulsion engine (11a) is also in a correct operating state (404), and if, in addition, the control of the propulsion engine (11a) is in a non-reduced speed state (405); and - blocking (408) the possible actuation of the shut-off unit (12) by the controller (14), if the fuel shut-off lever of the propulsion engine is in an inactivated state (403), if, in addition, the propulsion engine (11a) is in a correct operating state (404), if, in addition, the control of the propulsion engine (11a) is in a reduced speed state (405), and if, in addition, the opposite propulsion engine (11b) is in a failed state (406) or the opposite propulsion engine (11b) is in an incorrect operating state (407).

2. Blocking device (15) according to Claim 1, wherein the electronic circuitry is also configured for: - receiving (400) information representative of a speed of the aircraft and / or information representative of an altitude of the aircraft; and - blocking the possible actuation of the shut-off unit (12) by the controller (14) if, in addition, the speed of the aircraft is greater than or equal to a predefined speed threshold, and / or the altitude of the aircraft is greater than or equal to a predefined altitude threshold.

3. Blocking device (15) according to either of Claims 1 and 2, wherein the shut-off unit (12) causes a shut-off of the propulsion engine (11a) when said shut-off unit (12) is supplied with power by the actuation of the controller (14), the blocking device comprising a switch (20) located on a power connector (13) running from the controller (14) to the shut-off unit (12), so as to block the possible supply of power to the shut-off unit (12) by the controller (14) when the switch (20) is in an open position, the switch (20) being in the closed position by default, and the control unit being configured for blocking the possible actuation of the shut-off unit (12) by the controller (14), by moving the switch (408) to the open position.

4. Shut-off system (100) for selectively allowing the shut-off of an aircraft propulsion engine (11a), the shut-off system (100) comprising the blocking device (15) according to any one of Claims 1 to 3 and comprising the shut-off unit (12).

5. Aircraft comprising at least one propulsion engine (11a, 11b) and, for each propulsion engine (11a, 11b) of the aircraft (10), a blocking device (15) according to any one of Claims 1 to 3 or the shut-off system (100) according to Claim 4.

6. Aircraft according to Claim 5, wherein the controller (14) is an engine master lever, and wherein the shut-off unit is a high-pressure shut-off solenoid valve, or a low-pressure shut-off solenoid valve located upstream of the high-pressure shut-off solenoid valve in a fuel supply circuit of the propulsion engine (11a).

7. Method for preventing an inappropriate shut-off of a propulsion engine (11a) of an aircraft (10), the shut-off being executed by a shut-off unit (12) actuated selectively by a controller (14) under the selective control of a pilot of the aircraft (10), the aircraft (10) comprising another propulsion engine (11b), called the opposite propulsion engine, the method being implemented by a blocking device (15), the method comprising enabling by default a possible actuation of the shut-off unit (12) by the controller (14), the method comprising the steps of: - receiving information representative of an activated or inactivated state of a fuel shut-off lever of the propulsion engine, information representative of a reduced or non-reduced speed state of a control of the propulsion engine, information representative of a correct or incorrect operating state of the propulsion engine, information representative of an on, shut down or failed state of the opposite propulsion engine (11b), and information representative of a correct or incorrect operating state of the opposite propulsion engine (11b); - blocking (408) the possible actuation of the shut-off unit (12) by the controller (14), when the fuel shut-off lever of the propulsion engine is in an inactivated state (403), if the propulsion engine is also in a correct operating state (404), and if, in addition, the control of the propulsion engine is in a non-reduced speed state (405); and - blocking (408) the possible actuation of the shut-off unit (12) by the controller (14), if the fuel shut-off lever of the propulsion engine is in an inactivated state (403), if, in addition, the propulsion engine is in a correct operating state (404), if, in addition, the control of the propulsion engine is in a reduced speed state (405), and if, in addition, the opposite propulsion engine is in a failed state (406) or the opposite propulsion engine is in an incorrect operating state (407).

8. Computer program product that can be stored on a storage medium and / or downloaded from a communication network so as to be read by a processor, and that is characterized in that it comprises instructions which, when they are executed by the control unit of Claim 1, allow the method according to Claim 7 to be implemented, when said computer program is executed by the processor.

9. Data storage medium storing a computer program according to Claim 8.