What Is FADEC? How Modern Jet Engines Are Controlled

On a modern airliner, the thrust levers are not connected to the engines. They are an input to a computer, and that computer decides how much fuel the engine gets.

FADEC — Full Authority Digital Engine Control — is that computer and everything around it. The unsettling part, and the part that defines the term, is the word authority.

What “Full Authority” Actually Means

It means there is no manual backup. The FAA states it without hedging: “Full Authority Digital Engine Control (FADEC) means just that. There is no direct pilot control over the engine or manual control mode.” SKYbrary puts the consequence plainly — “If a total FADEC failure occurs, the engine fails.”

That is the dividing line. A system that lets the pilot take over manually is classified as an EEC or ECU, not a true FADEC.

The FAA’s fact sheet adds the sentence that makes it real: “The hardest fact for most to get accustomed to is that the system provides no reversion to manual control.”

One honest complication, because you will meet it in the regulations. FAA Advisory Circular 33.28-1 defines FADEC as a control system “in which the primary functions are provided electronically and the electronic unit has full-range authority over the engine power or thrust” — and then records that “FADEC systems have been certificated that employ either two identical channels to provide full-operational capability after failure of one channel or a single channel with a simplified electronic or hydromechanical back-up to provide an alternate operating mode.”

So the regulator’s usage is looser than the operational one, and it contemplates an electronic backup as well as a hydromechanical one. Note too that the definitional sentence most explainers rely on — that a system permitting manual override is “only an EEC or ECU” — traces to an uncited Wikipedia passage that SKYbrary reproduces, not to a regulator.

The formulation that holds up: full authority means the electronic control has full-range authority over thrust in normal operation, with no pilot-operable manual reversion. A unit with a backup mode the crew reverts to is supervisory in that mode, whatever the label on the box.

EEC or FADEC? The Terminology Is a Mess

Strictly: the EEC (or ECU) is the computer — the line-replaceable box. FADEC is the system: that computer plus its sensors, harnesses, actuators, dedicated alternator and the hydromechanical unit it commands.

In practice manufacturers use the terms however they like. Airbus and CFM call the box an ECU on the CFM56-5A; Boeing and CFM call the equivalent box an EEC on the CFM56-7B. The FAA managed, in a 2025 proposed airworthiness directive, to write “Electronic Engine Control (EEC) Full Authority Digital Electronic Control (FADEC) software” — both terms for one thing in one phrase, and a non-standard expansion of the acronym for good measure.

Regulators use a third term entirely: EECS, Electronic Engine Control System.

What FADEC Replaced

The hydromechanical fuel control unit — a genuinely ingenious machine that solved the problem with levers, springs and oil.

It had a computing section and a metering section. In the pneumatic class of control — one common architecture among several — flyweight governors driven off the gas generator gear train responded to engine speed by centrifugal force, modulating a pneumatic servo to hold the speed the power lever demanded. Other designs used hydraulic servos and three-dimensional cams to do the same scheduling job. Either way a servo-operated metering valve did the actual fuel metering, with a bypass valve holding a constant pressure differential across it so flow stayed proportional to valve opening.

It worked. But operating procedures were complicated, fuel metering was less accurate than an electronic system can manage, and there is a hard limit on how many sensor inputs you can feed into a mechanical computer.

Two Channels, One Engine

Transport-category FADECs are built around a dual-channel controller — channel A and channel B, two identical computers in one box. (As the AC above notes, single-channel designs with a backup mode have also been certificated, and many small-engine FADECs are single-channel.)

Both channels receive and process every input, all the time. Only one issues commands: the active channel. The other runs in parallel as standby, ready to take over.

Three details from the CFM56-5A worth knowing:

• The channels alternate. When both are equally healthy, active and standby swap at every engine start — specifically once N2 exceeds 11,000 rpm. Neither channel accumulates all the running hours.
• They share everything. A Cross Channel Data Link makes every input to one channel available to the other, so both stay operational even when one loses a sensor.
• Losing a sensor does not cause a channel change as long as the CCDL is working. The controller simply walks down a hierarchy: averaged value, local value, cross-channel value, then a model value synthesised from other parameters, and finally a failsafe position that protects the engine.

Certification drives this. The requirement lives in 14 CFR 33.28(d)(2); the guidance in AC 33.28-3 is more candid than most people quote. It notes that “achieving true single fault tolerance could require a triplicated design approach,” and that real dual-channel systems are therefore described as “essentially single fault tolerant” — they may still have uncovered single faults that lead to a loss-of-control event and yet be found compliant. Where overspeed protection is provided solely by the control system, the design must be at least two independent faults removed from an uncontrolled overspeed event.

It powers itself

A detail that surprises people: in flight the FADEC does not run on aircraft power. A dedicated control alternator on the accessory gearbox feeds the ECU directly once core speed is up — from roughly 10% N2 on the CFM56-5A. Aircraft 28 V DC is used only for starting, below about 12% N2, and above 15% N2 the controller switches it off automatically.

On the CFM56-5A the segregation goes further: the aircraft normal bus is hardwired to channel B, the emergency bus to channel A.

What It Reads, and What It Controls

Engine-side inputs: N1 and N2 speeds; temperatures T12 (fan inlet), T25 (HPC inlet), T3 (compressor discharge), EGT, oil temperature; pressures P0 (ambient), PS12, PS3; fuel flow; vibration; and position feedback from every actuator it commands.

Aircraft-side inputs, routed through the Engine Interface Unit: thrust lever angle, air data from two ADIRUs (altitude, total air temperature, Mach), and configuration and start commands. On other types the air-ground (weight-on-wheels) discrete is also a FADEC input — remember that one, because it matters in the A220 case below.

Outputs split by medium. Through the hydromechanical unit, fuel-servo actuated: the fuel metering valve, variable stator vanes, variable bleed valves, and the HP and LP turbine clearance control valves. Separately and electrically: the starter air valve and both ignition exciters. And through its own hydraulic control unit: the thrust reverser.

Note what that list means. The FADEC is not just a fuel controller — it manages compressor airflow and turbine tip clearances continuously, which is a large part of why modern engines are as efficient as they are.

Automatic Starting

This is where an AME sees FADEC most directly. On a CFM56-5A the controller runs the entire sequence:

• 16% N2 — one igniter energised
• 22% N2 — fuel delivered to the combustor
• 50% N2 — starter air valve closed, igniter de-energised

And throughout, it prevents the engine exceeding its starting EGT limits on the ground. The crew no longer sits watching the EGT gauge with a hand near the fuel switch — in automatic start, that job moved into software.

Worth knowing the exception: the CFM56-5A also has a manual start mode, in which the ECU “provides limited engine protection and limitation on EGT only.” So the absolutism of “no manual mode” is about thrust control in flight, not about every function on the ground.

How Reliable Does It Have to Be?

There is a number, and it is worth knowing because it is the answer to “what if it fails?”

Both the FAA and EASA state the same safety objective in near-identical words: the control system should not cause more than one LOTC/LOPC event per 100,000 engine flight hours — loss of thrust control and loss of power control taken together. For reciprocating engines the figure is 45 LOPC events per million engine flight hours, described as the upper limit acceptable for the most complex control systems.

Note “should,” not “shall.” These are advisory-material safety objectives, not a hard numerical regulation — but they are the numbers designs are actually assessed against.

On the software side, FAA AC 33.28-3 states that for turbine engines, DO-178C Level A is normally needed — the highest design assurance level there is, reserved for failure conditions classified as catastrophic, and carrying 71 separate objectives. Hardware follows DO-254.

When FADEC Gets It Wrong

A400M, Seville, 9 May 2015

An Airbus A400M on its first post-assembly test flight crashed shortly after takeoff from Seville. Six Airbus Defence and Space employees were on board; four were killed and two seriously injured.

In a statement on 2 June 2015 relaying preliminary recorder findings, Airbus Defence and Space said three of the four engines “experienced power frozen after lift-off and did not respond to the crew’s attempts to control the power setting in the normal way,” remaining at flight idle for the rest of the flight. In late May, Airbus’s Chief Strategy Officer had told Handelsblatt that the black boxes attested there were no structural defects, but that Airbus had a serious quality problem in final assembly.

The widely reported mechanism is that engine torque calibration parameters were inadvertently erased during ECU software installation on the final assembly line. Without them the control units could not interpret torque sensor data. There was no alerting system and no post-work documentation check to catch it.

Be careful how you state the status of this one

Two things matter, and most write-ups get at least one wrong.

There is no public final report. The investigation went to CITAAM, Spain’s military aircraft accident commission — not the civil authority that publishes ICAO Annex 13 reports. A technical report exists and was used in the legal proceedings; it has never been released publicly.

The criminal case was not closed. A Seville court provisionally dismissed it in April 2018, and that is where most accounts stop. But the dismissal was appealed and reversed — the Audiencia Provincial de Sevilla reopened the case in October 2019, holding that the absence of crew training and documentation covering an irreversible engine-freeze condition could amount to negligent homicide. Reporting from that ruling indicates it cited control-unit software defects as well as installation issues.

So resist the tidy version — “the software was fine, only the data was missing.” That is Airbus’s 2015 framing, and the later judicial record does not simply endorse it. What is well established is the failure mode: a control system that behaved exactly as programmed on calibration data that was no longer there, with nothing in the process designed to notice.

airBaltic A220, Copenhagen, 2021

A more instructive case for how FADEC interacts with the rest of the aircraft. An A220-300 suffered an uncommanded dual engine shutdown on landing, losing braking capability along with engine power and hydraulics.

The FAA’s description of the mechanism is worth reading twice: the autothrottle increased thrust to hold Mach, the pilot immediately commanded idle, and that “caused a transient disagreement between actual and commanded thrust. This disagreement triggered the thrust control malfunction (TCM) detection logic and resulted in dual engine shutdown once the weight on wheels signal was activated upon landing.”

A protection function did exactly what it was written to do, on an input sequence its authors had not anticipated. The Transportation Safety Board of Canada led the investigation and cautioned against abrupt thrust lever movement; the fix was a FADEC software revision to the TCM logic, mandated by FAA AD 2022-27-04 with a corresponding EASA directive.

These are not museum pieces either. In November 2025 the FAA proposed an AD on GE CF34 engines “to prevent EEC FADEC software from automatically locking the engine at idle until it is restarted.”

What Comes Next

FADEC4, the current generation, was developed by the FADEC Alliance — Safran, BAE Systems and GE Aerospace — and carries roughly ten times the computing power of FADEC3. It equips LEAP engines on the A320neo, 737 MAX and C919.

The direction of travel is distributed control: moving electronics closer to the functions they operate, partly because next-generation engines need to host around 50% more functions at mixed criticality levels in one controller. CFM’s RISE open-fan demonstrator is projected to need five times the computing capacity of FADEC4.

Frequently Asked Questions