Gas Turbines - Fuel Systems — Page 385, Lesson 481

Let's pick this up right where the evolution of engine control left off. I want to walk you through how we got from a system that merely watched the engine to one that completely commands it. At the time this technology was developing, the computer hardware and software had become advanced enough to control every aspect of engine monitoring and control. But here's the catch — long-term reliability had not yet been established. Nobody trusted it to run the engine unsupervised for thousands of hours. So the electronic system was used in a 'supervisory' capacity only. That means it monitored and advised, but the pilot retained the final authority. The pilot had the capability to over-ride the electronic system and return to mechanical control at any time. That was the safety net. Now, as technology continued to advance, that single channel system was superseded by a dual channel Full Authority Digital Electronics Control system — that's FADEC. Let me break that name down, because every word matters. 'Full Authority' means it has complete command over the engine — no pilot override. 'Digital' means it works in ones and zeros, not analog signals. 'Electronic' distinguishes it from mechanical or hydro-mechanical systems. And 'Control' is its job — it controls the engine. The key advance here is the duplication of the channels. This gave the FADEC system built-in redundancy, because only one channel is required to manage all aspects of engine monitoring and control. If one channel fails, the other takes over seamlessly. But it's even better than that. The EECs — the Electronic Engine Controls — have a much improved level of reliability and an inbuilt fault tolerance system. Fault tolerance means the channel in command can operate safely even when some of its internal elements are not fully operational. So it doesn't need to be perfect to keep flying — it can degrade gracefully and still do its job. Now, because of this improvement in safety and long-term reliability, the need to revert engine control back to the pilot in the event of malfunction was completely negated. Think about what that means. The old 'supervisory' only function was upgraded to a full command role. The modern FADEC has no manual reversion facility at all. There is no lever, no switch, no procedure to hand control back to the pilot. The computer is in charge, period. So what does FADEC actually do? It precisely controls fuel flow — that's its primary job, metering exactly the right amount of fuel for the conditions. It maximizes engine performance, getting the most thrust or power out of the engine at all times. It monitors engine inputs and outputs — pressures, temperatures, speeds, all of it. It reduces pilot workload, because the pilot doesn't have to constantly adjust settings. And it minimizes the risks to engine health, protecting the engine from operating outside its limits. Now, the physical construction. The FADEC incorporates, in a single housing, dual Electronic Engine Control interfaces. One EEC is channel 'A' and the other is channel 'B'. Each channel is, in reality, a sophisticated computer. And here's the critical part — each channel operates both in tandem and in isolation. In tandem means they work together, cross-checking each other. In isolation means if one fails, the other runs the show entirely on its own. That's the redundancy in action. Let me show you the difference between the two systems. This is the supervisory EEC — notice it has provision for manual reversion, that pilot override I mentioned. And this is the FADEC — no manual reversion, full authority, dual channel. So the progression is clear. First we had a single channel system that supervised but let the pilot take over. Then we got a dual channel system with redundancy and fault tolerance, so reliable that the pilot never needs to intervene. That's the FADEC we fly today.