The four hydraulic systems

A 747 is far too large to be flown by muscle. Every primary flight control, the landing gear, the brakes, the nosewheel steering and the leading and trailing edge devices are moved hydraulically, and the aircraft is built around four independent hydraulic systems.

The layout

Systems 1 to 4 correspond to engines 1 to 4. Each has:

• an engine-driven pump, running whenever that engine is running, providing the primary supply in flight; and
• a demand pump in parallel — air-driven or electrically powered depending on the system — which cuts in automatically when demand rises or the engine-driven pump is unavailable.

That pairing is the point. Losing an engine does not lose a hydraulic system, because the demand pump keeps the system pressurised independently of the engine that normally drives it.

Why four, and why split this way

The 747 was certified in 1969 to standards that assumed things break, and the answer nearly everywhere was redundancy through separation rather than duplication in one box.

The flight controls are divided so that no single hydraulic failure removes an entire axis of control: control surfaces are split into sections powered by different systems, so a failed system costs you some authority in pitch, roll or yaw but never all of it. The aircraft is flyable and landable on a subset of its systems.

The same reasoning drives the electrical system, where generation is also per engine.

Where it ran out

Two accidents show the limit of the idea, and both are worth understanding because the failure was not in the redundancy but in the routing.

On Japan Air Lines 123 an aft pressure bulkhead failed, destroying much of the tail — and with it all four hydraulic systems at once, because all four ran through that part of the aircraft. The crew flew for 32 minutes on engine thrust alone.

On National Airlines 102 unrestrained cargo broke loose and destroyed the hydraulics and the stabiliser jackscrew together.

Redundancy protects against independent failures. Neither of these was independent: one event took every path. Designers call this common-mode failure, and separating systems physically — not just logically — is the only defence.

What changed on the 747-8

The 747-8 added fly-by-wire spoilers and outboard ailerons, part of the new wing. That is what makes its manoeuvre load-alleviation system possible: the aircraft can redistribute lift across the wing during unusual flight conditions, which let Boeing build a lighter structure and save about 1,400 lb.

Related

• 747 systems
• Flight controls
• Landing gear