What happens when the 747's controls fail

The obvious question about a 747's flight controls is what happens when the hydraulics go. The obvious answer - that the aircraft reverts to some simpler mechanical mode - is wrong for this aeroplane, and the mistake is common enough to be worth correcting directly.

A Boeing study of the 747 primary flight control system, published through NASA, is blunt about it. Of the elevator system: "No provision has been made for manual reversion." And of the design as a whole: "Manual reversion has been eliminated because of the high number of power sources, command paths, power actuators, and control surfaces. Such capabilities give the flight control system great failure tolerance."

Mode A and Mode B reversionary control belongs to the 707, 720 and 727. The 747 has none of it. On the 747, all flight control surfaces are power actuated, and the strategy is to make a failure almost meaningless rather than to provide a degraded mode to fall back into.

Two sources per surface, four different pairings

The hydraulic system story is more specific than "four systems for redundancy." Each aileron, each rudder and each inboard elevator is driven by two independent hydraulic sources, and - this is the part that matters - the identity of those two sources varies from surface to surface, drawn from four different pairings of the four systems.

The result is that airplane control about all three axes - roll, pitch and yaw - is powered by all four hydraulic systems. No single system failure removes an axis. It costs you a particular surface. Lose hydraulic system 1 on a 747-400 and the left outboard elevator is inoperative; lose system 3 and the upper yaw damper stops working. Aileron, elevator and rudder authority all remain.

The study also notes what systems 2 and 3 are doing most of the time: in normal operation they have no assignment other than flight control. The two outboard engines are effectively dedicated to keeping the controls alive.

Each system can also be driven by a second pump - air-driven, fed from the engine bleed air or the APU, in parallel with the engine-driven pump. Hydraulic pressure is lost only when both power sources are unavailable.

The one real weak point

There is an honest caveat in that same study, and it is the part that explains more than one accident:

The distribution of pressure for each hydraulic system is not redundant. A line breakage or component housing fracture will result in hydraulic fluid loss and subsequent pressure loss even though the power source may still be available.

Power generation is redundant. The plumbing carrying that power is not. That is exactly the mechanism behind Japan Air Lines Flight 123, where a failed rear pressure bulkhead ruptured all four hydraulic lines at once - four redundant systems, one common path.

What backs the controls up

With no reversionary mode, the 747's backups are specific mechanisms rather than a general fallback.

The stabilizer can fly the aeroplane. The study identifies inherent functional redundancy here: pitch control can be achieved by changing the incidence of the horizontal stabilizer, and stabilizer trim is used for pitch control in certain elevator failure modes. It is not a substitute elevator - authority is limited, the approach is flown faster, and the nosewheel steering is gone - but it is not nothing.

Stabilizer trim has an emergency manual mode. The trim system uses a ball-screw actuator driven by two hydraulic motors, and it offers four modes of trim control: three electrical, and an emergency manual-mechanical mode. The electrical modes are pilot manual-electric, copilot manual-electric and autopilot automatic, and the open-loop design is specifically built to prevent trim running away in the direction opposite to the one commanded.

The aileron load limiter bypasses jammed cables. The lateral system uses two separate runs of body control cables. The load limiter performs two functions: it provides an alternative system to move the ailerons if either body cable system jams, and it has a lost-motion feature that stops cable movement feeding back undesirably into the control wheels. If the left body cables jam, the pilot's wheel is inoperable and the copilot's wheel must be used; if the right body cables jam, the left wheel still works. The design accepts that you might have to change hands.

Yaw damping is split. Two identical yaw damper systems, one acting on the upper rudder and one on the lower, both countering dutch roll and working to keep the turn coordinated.

The 747-400 locks out its outboard ailerons. Above roughly 235 knots the outboard ailerons are locked in neutral, which prevents over-controlling them at high speed; the lockout is inhibited once the flaps are extended. It has an operational cost: with the lockout active on approach, the maximum crosswind component the aircraft may accept is reduced.

The 747-8 went further

The 747-8 added fly-by-wire outboard ailerons and spoilers, and with them a Pitch Augmentation Control System that senses an imminent tail strike and reduces elevator deflection automatically. It is a different kind of answer to the same question: rather than removing authority after a failure, the -8 commands it away in advance when the geometry demands it.

Related

• Flight controls - the surfaces and how they are driven
• Hydraulic systems - the four systems and their pumps
• Autopilot and flight guidance - the guidance on top of these controls
• JAL 123 - where the redundancy collapsed