Abstract: A control system for a gas-turbine engine has two parallel control units, either one of which can be switched to supply control signals to the engine in response to input signals, such as from the pilot's control lever and from various sensors. Each unit has a limiter that limits the fuel supply to the engine if the engine speed approaches or exceeds a predetermined maximum. A monitor unit in each control unit detects when the limiter has assumed control of the engine for more than a predetermined time, and switches the system to control by the other control unit. The predetermined engine speed may be different for different settings of the pilot's control lever.