ensure that shutdown is only initiated once