When a fighter pilot slams the throttle into afterburner, it feels like a direct command to the engine. It is not. On a modern jet the throttle is a request, sent as an electrical signal to a box of electronics bolted to the engine, and that box decides how much fuel to spray, how to angle the compressor vanes and when to open the bleed valves. The box is called a FADEC, and it is the reason a modern jet engine almost never surges, overheats or flames out when a pilot does something abrupt.

FADEC stands for Full Authority Digital Engine Control. The two words that matter are "full authority": the computer does not advise the pilot, it runs the engine outright. That brings huge gains in efficiency, safety and workload, and one uncomfortable trade-off that every engineer who certifies one has to live with.

From cables and cams to code

For most of aviation history, the throttle was mechanically linked to the engine. Rods, cables and a hydromechanical fuel control unit, full of cams, springs and flyweights, translated lever position into fuel flow. It worked, but it was heavy, needed constant adjustment and could not protect the engine from a ham-fisted pilot. Second World War Germany pushed the idea furthest with the BMW 801 radial's Kommandogerät, a mechanical-hydraulic computer that set mixture, propeller pitch and boost from a single lever.

Electronics arrived in stages. Concorde's Rolls-Royce/Snecma Olympus 593 used full-authority analogue control, and in 1968 Rolls-Royce, Elliott Automation and the National Gas Turbine Establishment ran a digital control system for several hundred hours on an Olympus Mk 320. In the 1970s NASA and Pratt & Whitney flew an experimental digital control on the modified left TF30 engine of an F-111, the work that led to the Pratt & Whitney F100 and the PW2000, which Wikipedia lists as the first military and first civil FADEC engines.

The decisive flight trials came at NASA's Dryden Flight Research Center, where a Digital Electronic Engine Control (DEEC) was tested on an F100 engine in a NASA F-15 in the early 1980s, a joint NASA, Pratt & Whitney and U.S. Air Force programme. NASA's own history of the effort, written by Terrill Putnam in 1984, traces how full authority digital controls were developed and ground tested before being proven in that F-15.

AEROCOR walks through FADEC operation on a light jet, from start-up to cruise.

How a FADEC actually works

At its heart a FADEC is a loop. The computer reads the power lever position as a thrust request, then reads everything else it needs to know: air density, inlet temperature, compressor and turbine temperatures and pressures, and the speed of each spool. It works out the right settings and drives the actuators, then reads the sensors again and corrects. Wikipedia puts the update rate at up to 70 times per second.

The outputs are more than just fuel. A FADEC sets fuel flow, positions the variable stator vanes that keep air flowing smoothly through the compressor, and opens or closes bleed valves to keep the compressor away from a stall or surge. It also runs the start sequence, handles relights, and enforces the engine's limits automatically, so a pilot cannot over-temperature or over-speed the engine however hard the lever is pushed.

That is the "full authority" in the name. Many earlier systems were supervisory: a digital box trimmed a hydromechanical control, and if it failed the pilot could fall back on the mechanical system. A true FADEC has no such fallback. If the computer stops, the engine stops.

Two brains for every engine

Engineers handle that risk with redundancy. A FADEC carries two or more separate but identical channels, each able to run the engine on its own, and each monitoring the other. If one channel loses a sensor or develops a fault, the other takes over. The FAA argues that this redundancy makes a FADEC failure statistically less likely than a double magneto failure on a traditional piston engine.

Redundancy has limits. Two identical channels running identical software can fail together if the fault is in the design, the software or the data loaded into them, rather than in the hardware. That is a common-mode failure, and it is the scenario certification authorities worry about most.

Aircraft Technicians explains the components of a FADEC system and how they talk to the engine.

Seville, 2015: when the data was wrong

The sharpest illustration came on 9 May 2015. An Airbus A400M, serial MSN023, took off from Seville in Spain on its first pre-delivery test flight, destined for the Turkish Air Force. Shortly after lift-off three of its four TP400 turboprops stopped responding to the crew's throttle inputs. Airbus later said the power of engines one, two and three froze after lift-off. The aircraft hit an electricity pylon during an attempted emergency landing near the airport, killing four of the six Airbus employees aboard.

The leading scenario reported at the time was that torque calibration parameter data had been accidentally wiped from three engines' control units when software was installed in final assembly, leaving them unable to operate normally, with no cockpit warning until the aircraft was about 120 metres in the air. Airbus ordered one-time checks of the engine control units across the fleet.

The lesson was not that FADECs are dangerous. It was that a full authority computer is only as good as the data and processes behind it, which is why FADEC software and its loading procedures are developed and checked with the same rigour as flight control code.

Why fighter pilots love it

For combat aircraft the payoff is "carefree handling". Early jet engines punished rough throttle movements, especially at high altitude and high angle of attack, with compressor stalls and flameouts. A FADEC manages the engine's internal schedules so the pilot can move the throttle as fast as the fight demands. The same F100 engine family powers F-15s and many F-16, and digital control has since become standard on modern fighter engines.

There are quieter benefits too. A FADEC logs engine health data for maintenance crews, cuts the number of gauges a crew has to watch, and lets a manufacturer offer one engine at several thrust ratings simply by changing the software. The cost is complexity, and the absolute dependence on electricity and software. The throttle in your hand is no longer a fuel valve. It is a polite request to a computer that knows the engine better than you do.

News footage from Seville after the A400M crash on 9 May 2015.

Sources: Federal Aviation Administration (FADEC guidance), NASA (T. W. Putnam, Digital Electronic Engine Control History, 1984; F-15 DEEC flight test), Wikipedia (FADEC; 2015 Seville Airbus A400M Atlas crash), AVweb, Handelsblatt