Full Authority Digital Engine Control (FADEC) System Operation

Full Authority Digital Engine Control, universally known as FADEC, represents the pinnacle of modern aircraft engine management technology. Unlike older hydromechanical fuel controls that relied on a pilot's manual manipulation of throttle levers and engine instruments, a FADEC system places an onboard digital computer in complete, continuous command of every significant engine variable. From the moment a start sequence is initiated to the moment thrust is reduced after landing, the FADEC governs fuel flow, fuel scheduling, variable geometry positions, bleed air valves, and a host of ancillary functions automatically and precisely. For today's AMT student, understanding FADEC is not optional—these systems appear on virtually every new commercial and business-aviation turbine powerplant, and maintaining them correctly is a core professional skill.

This article walks through how FADEC works mechanically and electronically, why it matters for safety and efficiency, the key specifications and regulations you need to know, and the subtle conceptual traps that show up on FAA knowledge tests.

Core Architecture of a FADEC System

At the heart of every FADEC installation is the Electronic Engine Control (EEC) unit—sometimes called the Engine Control Unit (ECU). This is a ruggedized, dual-channel digital computer mounted directly on the engine where it must survive extreme vibration, temperature swings, and electromagnetic interference. The dual-channel design is fundamental: both channels are powered and continuously process sensor data simultaneously, but typically only one channel's outputs actively control the engine at any given time while the other channel operates in standby, ready to assume control if a fault is detected—with no interruption to engine operation. This redundancy is why FADEC is classified as a full authority system—it commands engine fuel metering with no parallel mechanical fuel control in normal operation, though some installations retain a limited mechanical or hydromechanical backup capability, such as a manual fuel shutoff.

The EEC receives inputs from dozens of sensors positioned throughout the engine and aircraft, including:

• Throttle Resolver Angle (TRA): The actual angular position of the pilot's thrust lever, translated into a digital demand signal.
• Fan speed (N1) and core speed (N2): Tachometer probes on both spools feed real-time rotational data.
• Exhaust Gas Temperature (EGT) or Turbine Inlet Temperature (TIT): Thermocouple rakes that protect the turbine hot section.
• Total Air Temperature (TAT) and Altitude/Airspeed: Atmospheric data from the aircraft's air data system or dedicated engine probes.
• Fuel temperature and fuel pressure: Ensures accurate fuel density compensation and pump scheduling.
• Bleed valve and variable stator vane positions: Feedback loops confirming that commanded positions are actually achieved.

Using all of these inputs simultaneously, the EEC calculates the precise fuel flow rate needed to achieve the thrust demanded by the throttle position without exceeding any engine limit. Critically, it performs this calculation many times per second, far faster than any human operator could respond.

What FADEC Controls: Full Authority in Practice

The word full authority is significant. A traditional hydromechanical fuel control can be overridden or backed up by the pilot adjusting mixture and prop controls or by a separate manual fuel control mode. A FADEC, by contrast, owns fuel metering in normal operation. The pilot's thrust lever is not mechanically linked to the fuel control valve—instead, it is simply a demand input. The FADEC decides how much fuel actually flows.

In addition to metering fuel, a typical FADEC also controls:

• Variable Stator Vanes (VSVs) and Variable Bleed Valves (VBVs): These modulate compressor airflow to prevent stall and surge across a wide speed range.
• Turbine Clearance Control: Thermal management of blade-tip clearances improves efficiency and reduces wear at cruise power.
• Engine starting sequence: The FADEC opens the fuel valve and monitors light-off automatically, aborting a hung start or hot start before damage occurs.
• Thrust Reverser Deployment (on equipped aircraft): Interlocks are managed by the EEC to prevent unsafe deployment.
• Power Assurance and Derating: The EEC can apply automatic reduced-thrust takeoff settings (flex thrust), recalculated for ambient conditions, to extend engine life.

Sensing Redundancy and Fault Management

Because the EEC has full authority, its reliability must be exceptionally high. Engineers achieve this through sensor redundancy: most critical parameters are measured by multiple independent sensors. If one N1 sensor sends a signal that disagrees significantly with the others, the EEC flags it as failed and uses the remaining sensors. The pilot sees a maintenance message on the EICAS or equivalent display, but the engine continues to operate normally.

The dual-channel EEC architecture adds another layer. Channel A and Channel B are both powered and each independently processes all incoming data, but normally only one channel's outputs are actively controlling the engine while the other remains in standby—ready to take over within milliseconds. If the active channel detects an internal fault, the transition to the standby channel is automatic and transparent. Neither channel requires crew intervention to swap authority. During scheduled maintenance, technicians can manually force a channel transfer to verify that the standby channel is fully functional—an important inspection task for AMTs.

Power-up and Engine Start with FADEC

One of the most immediately noticeable benefits of FADEC is the simplicity of engine starting. On a FADEC-equipped turbofan, the flight crew (or a ground technician performing a maintenance run) selects the start switch. The FADEC then:

1. Opens the start valve to supply high-pressure air to the starter turbine.
2. Monitors N2 rise and initiates fuel flow at the correct speed threshold for reliable ignition.
3. Commands the igniters on and monitors EGT rise for confirmed light-off.
4. Accelerates the engine along a programmed speed schedule to idle, modulating fuel to stay within EGT limits.
5. Cuts the starter and igniters off at the correct N2 speeds.

If EGT approaches the limit during the acceleration phase—a situation that would otherwise result in a damaging hot start—the FADEC automatically reduces fuel flow or aborts the start entirely. This protection has dramatically reduced turbine hot-section damage incidents attributable to improper starting technique.

Why FADEC Matters: Safety, Efficiency, and Maintenance

From a safety standpoint, FADEC eliminates a category of human-error accidents. Compressor stalls from abrupt throttle movements, over-temperature exceedances from aggressive acceleration, and hung starts from improper fuel scheduling are all actively prevented by the control laws built into the EEC software. The engine cannot be commanded beyond its certified limits by a flight crew input alone.

From an efficiency perspective, FADEC continuously optimizes the combustion process for ambient conditions. At cruise altitude on a cold day, the EEC recognizes lower air density and temperature, adjusting fuel scheduling accordingly so the engine produces exactly the thrust requested without the over-fueling that a fixed mechanical schedule might apply. Fuel burn improvements of several percent over the life of an aircraft are economically significant for airlines and operators.

For AMTs, the FADEC creates a different maintenance paradigm. Because the EEC logs every exceedance, fault code, and parameter snapshot, maintenance troubleshooting begins with electronic fault retrieval rather than physical inspection alone. The EEC stores non-volatile fault memory that persists after power-down, allowing technicians to download data and reconstruct what happened during a reported anomaly. Understanding how to access, interpret, and clear these fault codes correctly—following the Aircraft Maintenance Manual (AMM) procedures precisely—is a critical skill.

Key Numbers and Rules

• Dual-channel redundancy: Both EEC channels are powered and computing simultaneously, but typically only one channel actively controls the engine at a time while the other remains in standby; control can transfer between channels with no power interruption.
• FADEC power supply: Many FADEC systems are powered primarily by a dedicated Permanent Magnet Alternator (PMA), often driven off the engine accessory gearbox, but most designs also draw on aircraft electrical bus power as a backup or for engine start and low-speed operation. FADEC is generally not fully independent of the aircraft electrical system—this nuance is a commonly tested fact.
• No manual reversion: Because FADEC is full authority, there is generally no separate hydromechanical backup fuel control for normal fuel metering, though some installations retain a limited mechanical backup, such as a manual fuel shutoff. System reliability requirements under FAA certification standards (14 CFR Part 33) are therefore extremely stringent.
• Software changes require FAA approval: Any modification to EEC control law software is considered a design change and must be approved through the certification process, coordinated with the engine Type Certificate holder.
• Fault codes are maintenance-essential: Clearing fault codes without performing the required investigation and corrective action is an airworthiness violation. All fault isolation must follow the AMM.

Common Test Traps

• FADEC is not just an autothrottle. An autothrottle moves the thrust lever mechanically in response to autopilot commands. FADEC controls the fuel metering valve directly, downstream of the thrust lever. The two systems can coexist on the same aircraft.
• The PMA power supply is a favorite question. Many students assume FADEC runs solely off the main aircraft electrical system, or conversely that it is completely independent of it. In fact, most systems use an engine-driven PMA as a primary power source while still relying on aircraft bus power as a backup or during start and low-speed conditions—neither extreme is fully correct.
• Dual channels are not two separate computers doing different jobs. Both channels are powered and process the same data simultaneously, but normally only one channel's outputs actively control the engine while the other is in standby. They are not split-task processors.
• A FADEC fault does not always mean the engine stops. The system is designed to degrade gracefully. A single failed sensor or a single channel fault typically results in a maintenance message and continued safe operation—not an in-flight shutdown.
• Software on the EEC is part of the type design. Students sometimes assume software is a field-configurable item. It is not. Loading unapproved software to an EEC violates 14 CFR and can invalidate airworthiness.