Modern transport category aircraft are hydraulically intensive machines. The primary flight controls, secondary flight controls, landing gear, nose-wheel steering, wheel brakes, thrust reversers, ground spoilers, and cargo-door actuators all draw power from hydraulic systems operating at pressures that commonly reach 3,000 psi in conventional systems and up to 5,000 psi in newer designs such as those found on the Boeing 787. Because a total loss of hydraulic power could render the aircraft uncontrollable, 14 CFR Part 25 — the airworthiness standard governing transport category airplanes — requires, under sections such as 25.1309 (equipment, systems, and installations) and 25.1435 (hydraulic systems), that the overall hydraulic architecture be fail-safe: no single probable failure may cause loss of the aircraft. The engineering answer to that requirement is layered, physically separated redundancy, and understanding that architecture in detail is essential for any Airline Transport Pilot (ATP) candidate.
The Multi-System Architecture
Most large transport aircraft carry two or three fully independent hydraulic systems, commonly designated System 1 and System 2, or System A and System B, with many widebody aircraft adding a third system (System C or a dedicated center system). The word independent is key: each system has its own reservoir, its own pump set, its own dedicated hydraulic lines, and its own suite of actuators. The systems are intentionally routed through different structural zones of the airframe so that a localized catastrophic event — a tire burst, a wheel-well fire, an uncontained engine failure sending shrapnel through the fuselage — has a low probability of disabling more than one system simultaneously.
This physical separation is not merely good engineering practice; it is an explicit Part 25 airworthiness requirement. The regulations demand a safety analysis showing that any single failure, or any combination of failures not shown to be extremely improbable, does not result in loss of the aircraft. Hydraulic system routing, therefore, is reviewed by the FAA during type certification as part of the overall Failure Mode and Effects Analysis (FMEA). Redundancy of hardware is meaningless if the redundant hardware shares a common vulnerability.
System Components in Depth
Reservoirs
Each independent hydraulic system maintains its own reservoir, sized to supply adequate fluid volume through any credible failure mode including a significant fluid leak in one system. Transport category reservoirs are pressurized — commonly using engine bleed air or gaseous nitrogen, though specific methods and implementation vary by aircraft type — to a positive pressure above the fluid. This pressurization serves the purpose of ensuring adequate fluid delivery to the pump inlet at high altitudes where ambient pressure is low, preventing pump cavitation and foaming. Light general aviation aircraft use simple gravity-fed, atmosphere-vented reservoirs, which is an important distinction that appears on knowledge tests.
Engine-Driven Pumps (EDPs)
The engine-driven pump is the primary, highest-flow hydraulic power source in normal operations. It is mechanically coupled to the engine accessory gearbox, so it produces pressure continuously as long as that engine is running. Hydraulic system-to-engine relationships vary by aircraft design: on some transport aircraft each engine drives a pump feeding its own associated system, while on others a given system may be powered by pumps from more than one engine, or a single engine may feed a shared system. This design variation means the specific redundancy picture — which systems remain powered after losing a given engine — depends on the aircraft type and must be learned from that aircraft's systems documentation. EDPs are variable-displacement pumps — they modulate fluid delivery to match system demand while maintaining a nominally constant system pressure, reducing heat generation and pump wear.
Electric Motor-Driven Pumps (EMDPs)
Every independent hydraulic system also carries at least one electric motor-driven pump (sometimes called an EMDP or AC motor pump). These pumps are powered by the aircraft's electrical buses and serve several roles: they back up the EDP if that engine is shut down or its EDP fails; they support ground operations before engines are started; and on some designs they are available in flight to augment system pressure during high-demand phases such as gear retraction or multiple simultaneous control surface deflections. The critical distinction for test purposes is that EMDPs are backup sources — they generally produce lower flow rates than EDPs and are not the primary pressure source in normal flight.
Air-Driven Pumps (ADPs)
Some transport aircraft designs include air-driven pumps (ADPs) that use high-pressure bleed air to drive a hydraulic pump through a turbine mechanism, though the specific use of ADPs varies by aircraft model and manufacturer rather than being tied to any one airframe family. ADPs offer an alternative backup that is independent of the electrical system, which is valuable when managing dual failures involving both an EDP and electrical power. They are quieter than EMDPs and can be selected on or off in flight as required by abnormal procedures.
Ram Air Turbine (RAT)
The ram air turbine is the last-resort emergency power source. It is a small propeller mounted in a retractable housing on the fuselage or wing leading edge that deploys automatically when both engine-driven and electrical power are lost, or manually by the crew. The RAT drives either a hydraulic pump, a generator, or both (depending on aircraft design) using kinetic energy from the airstream. The critical limitation is that the RAT powers only essential systems — typically the flight controls needed to maintain basic controllability and minimal avionics — not the full hydraulic consumer list. Landing gear, thrust reversers, and non-essential utilities are typically shed. RAT output also varies with airspeed, so it provides progressively less power at lower airspeeds.
Priority Valves and Load Shedding
Because flight controls and braking are more critical than cargo doors or utility functions, hydraulic systems include priority valves. When system pressure drops below a threshold, priority valves automatically close off lower-priority consumers, protecting pressure for flight-critical actuators. This automatic load shedding allows the crew to maintain control of the aircraft even when system capacity is degraded. Understanding which functions are shed first is essential for following Quick Reference Handbook (QRH) abnormal procedures correctly, because the crew must not manually operate a shed system that the priority valve is protecting pressure from.
Flight Control Powering: Dual-Path Architecture
For primary flight control surfaces — ailerons, elevator, and rudder — the architecture does not merely provide a backup pump; it provides dual hydraulic actuators or dual-powered actuators on the same surface, each supplied by a different hydraulic system. If System A fails, the System B actuator continues to move the surface; the failed actuator becomes a passive follower or is bypassed entirely. This is why a complete hydraulic system failure on a large transport does not necessarily cause loss of control: primary flight controls often retain authority through the surviving system. Secondary controls such as leading-edge slats or trailing-edge flaps may have asymmetry protection that stops surface travel if one side loses power, preventing a roll-inducing asymmetric flap condition.
Key Numbers and Design Rules
- Typical system pressure: 3,000 psi for most conventional transports; up to 5,000 psi in newer high-efficiency designs.
- Number of systems: Minimum two fully independent systems on Part 25 aircraft; many widebodies carry three.
- Reservoir pressurization: Positive pressure, commonly using bleed air or nitrogen, to prevent cavitation and ensure pump inlet supply; specific methods vary by aircraft type.
- EDP: Primary pressure source; variable-displacement; mechanically driven by engine accessory gearbox.
- EMDP/ADP: Backup sources; lower flow than EDPs; available on ground and as in-flight backup.
- RAT: Last-resort emergency source; powers essential systems only; output is airspeed-dependent.
- Priority valves: Automatically shed non-critical consumers below a set pressure threshold.
Common Test Traps
- Confusing EDPs and EMDPs: EDPs are the primary normal-flight pressure source; EMDPs are backup. A question asking which pump provides pressure in normal cruise has a clear answer: the EDP.
- Overstating RAT capability: The RAT does not restore normal hydraulic operation. It supplies essential-only systems and cannot power the full aircraft. Selecting gear down, for example, may require an alternate extension system after RAT deployment.
- Forgetting reservoir pressurization: Transport category reservoirs are pressurized; light aircraft reservoirs are not. This distinction is tested and has a safety rationale tied to high-altitude pump cavitation.
- Assuming redundancy is just about pumps: Physical separation of lines and components is equally mandated. Two pumps sharing a common hydraulic line through the same wheel well provide no real redundancy against a wheel-well fire.
- Priority valve operation: Priority valves act automatically — the crew does not select them. QRH procedures account for this load shedding, and crews must know what functionality is already lost before attempting manual actions.