What Are Backup Flight Control Systems?

Backup flight control systems are independent secondary control paths designed to maintain aircraft stability and control when primary systems fail. These systems are not just simple duplicates—they often use different technologies, power sources, or signal paths to ensure that a single failure mode cannot knock out all control capability. In modern commercial and military aircraft, backup systems range from mechanical cable linkages and independent hydraulic circuits to electrically powered actuators with dedicated batteries or ram air turbines. Regulatory bodies such as the Federal Aviation Administration (FAA) and the European Union Aviation Safety Agency (EASA) mandate that transport-category aircraft must have at least two independent means of controlling each primary flight axis (pitch, roll, yaw). This layered redundancy is the result of decades of accident investigation and engineering refinement.

Historical Evolution of Backup Controls

Early jet airliners like the Boeing 707 and Douglas DC-8 relied on fully mechanical cable-and-pulley systems with hydraulic boost. If the hydraulic boost failed, pilots could still apply brute force through the control column. As aircraft grew heavier and faster, pure mechanical control became impractical. The introduction of irreversible hydraulically powered actuators required redundant hydraulic systems. The first commercial fly-by-wire (FBW) aircraft, the Airbus A320, introduced a computer-managed primary control system but retained a mechanical backup for the rudder and an alternate electrical control law. Today’s FBW designs—such as the Boeing 787 and Airbus A350—have evolved toward electric backup systems that eliminate heavy cables and hydraulics, but the principle of multiple, diverse layers of control remains unchanged.

Main Types of Backup Systems

Backup flight control systems fall into three broad categories: hydraulic, electrical, and mechanical. Many modern aircraft combine elements of all three to achieve the required level of redundancy.

Hydraulic Backup Systems

Large transport aircraft typically have three or four independent hydraulic systems, each with its own pumps, reservoirs, and lines. If one system loses pressure due to a leak or pump failure, the remaining systems can still power all primary flight controls. For example, the Boeing 777 uses three hydraulic systems (left, center, right). The center system can be powered by an electric pump or an air-driven pump in an emergency. Power Transfer Units (PTUs) allow one system to pressurize another without exchanging fluid, providing a backup path. Hydraulic backup systems are extremely powerful and reliable, but they are heavy and require extensive plumbing.

Electrical Backup Systems

As aircraft move toward more electric architectures, electrical backup systems have become more common. These use dedicated generators, batteries, or ram air turbines (RATs) to power electric motors or electro-hydrostatic actuators (EHAs). EHAs combine a small hydraulic pump and an electric motor in a single unit, eliminating the need for centralized hydraulic lines. On the Airbus A380, for instance, some control surfaces use EHAs fed by separate electrical power busses. The Boeing 787 has no bleed air and almost entirely electrical systems, with backup power from batteries and a RAT. Electrical backups are lighter and more flexible but must be safeguarded against electrical faults and power loss.

Mechanical Backup Systems

Mechanical backups—cables, pushrods, or pulleys—are the oldest form of backup. Even in modern FBW aircraft, mechanical linkages often remain for the rudder and sometimes the stabilizer. The Airbus A320 has a cable-based rudder trim that can be used manually if all electrical control is lost. The Boeing 737 retains full mechanical reversion for the rudder, ailerons, and elevator, allowing the pilot to fly using control cables and pure muscle force in a “manual reversion” mode. Mechanical systems are simple and immune to electromagnetic interference, but they become less practical on very large or supersonic aircraft due to friction and column forces.

Redundancy Architectures

The design of backup systems is governed by redundancy principles. The goal is to prevent any single failure—whether hydraulic, electrical, software, or human—from causing loss of control.

Triple and Quadruple Redundancy

Most FBW aircraft use triple or quadruple redundant flight control computers (FCCs) and actuator channels. The Airbus A320 employs five computers: two primary (PRIMs) and three secondary (SECs). Each computer can independently compute control laws, and they cross-check each other. In Boeing’s 777, three primary flight computers (PFCs) each run identical software but are on separate power sources and data buses. If one fails, the others continue. If two fail, the remaining computer degrades to a simpler backup mode. This hardware redundancy is combined with dissimilar software in some aircraft to avoid common-mode bugs.

Dissimilar Backup Systems

To protect against design errors, many aircraft use dissimilar backup systems. For example, the Airbus A350’s primary actuation is electro-hydrostatic, while the backup employs direct electric actuation with different control algorithms. The Boeing 747-8 retains a mechanical backup for the rudder and manual stabilizer trim, even though its primary controls are fully powered. Dissimilarity means that even if a software bug affects all primary computers, the backup—often a simpler analog system—can still provide basic control.

How Backup Systems Activate

Backup systems can engage automatically or manually, depending on the failure scenario and aircraft design.

Automatic Activation

In modern FBW jets, the flight computers continuously monitor sensor outputs, hydraulic pressure, and electrical bus voltages. When a failure is detected (e.g., a pitch sensor disagrees with its peers), the computer automatically reconfigures to a degraded control law. On Airbus aircraft, this is called “alternate law” or “direct law,” which removes automatic protections but still allows safe flight. Automatic activation reduces pilot workload and response time.

Manual Activation

Pilots can also select backup modes manually. Many aircraft have a “flight control alternate” or “secondary” switch on the overhead panel. For instance, on the Boeing 777, if the primary flight computers are suspect, the crew can turn the flight control switches to “secondary,” which disengages the automatic fly-by-wire logic and reverts to a simpler backup mode. Training ensures pilots know when and how to engage these backups—a critical skill during emergencies like a system-wide hydraulic failure.

Emergency Power Sources

Backup flight controls are useless without power. Aircraft carry several emergency power sources to guarantee that backup systems remain alive even after a total engine failure or generator loss.

Ram Air Turbine (RAT): Deployed automatically or manually, a RAT is a small propeller that spins in the airflow to drive a hydraulic pump or electric generator. On the Airbus A330, the RAT powers a hydraulic pump that can drive the flight controls for several minutes—enough time for the crew to descend to a lower altitude or land. The Boeing 787 deploys a RAT that powers a generator to keep critical flight computers and electric actuators running.

Auxiliary Power Unit (APU): The APU can provide electrical and pneumatic power to backup systems if main engines are inoperative. However, the APU may itself fail, so backups incorporate multiple power sources.

Batteries: Modern aircraft have high-capacity lithium-ion batteries that can power flight control computers and electrically actuated backup elevators for limited periods. The Boeing 787’s battery system can supply control power for many hours during an emergency descent.

Backup Systems in Fly-by-Wire Aircraft

Fly-by-wire (FBW) eliminates heavy mechanical connections, but it creates a dependency on electronics. Manufacturers have designed different backup philosophies.

Airbus Approach

Airbus FBW aircraft (A320, A330, A380, A350) are designed with full-time computer control in normal law. The backup modes—alternate law, direct law, and mechanical backup—are automatically selected based on system health. In direct law, pilot stick inputs directly command surface position (similar to a mechanical system), with no automatic trim. The A320 retains a mechanical rudder trim cable and a manual stabilizer trim wheel that can be used even when all computers fail. The A380 and A350 use electro-hydrostatic actuators (EHAs) as backup and eliminate hydraulic lines for some surfaces.

Boeing Approach

Boeing FBW aircraft (777, 787, 747-8) use a “control law” system that blends pilot inputs with stability augmentation. The primary flight computers (PFCs) operate in either normal or secondary mode. In secondary mode, the computers still provide some shaping and envelope protection but with less assistance. The 777 has a purely mechanical backup for the rudder and manual stabilizer trim. The 787 uses a fully electric backup: if the primary actuators fail, electrically powered actuators from the backup power distribution system can take over. Boeing ensures that the backup system—often called “direct mode”—can be engaged by the crew with a simple switch.

Embraer and Other OEMs

Embraer’s E-Jets (E170/190 family) use a similar FBW architecture with triple-redundant computers and a direct law backup. Military aircraft like the Lockheed Martin F-35 implement quad-redundant flight control systems with dissimilar actuation to survive combat damage.

Testing and Maintenance of Backup Systems

Backup systems must be tested regularly to ensure they will work when needed. Aircraft incorporate built-in test equipment (BITE) that runs continuous health checks during flight and initiates more thorough tests on the ground. Pre-flight checks often require crews to manually test backup flight control modes—for example, moving the flight control switches to “alternate” and verifying the system responds correctly. Maintenance procedures include hydraulic fluid analysis, actuator endurance testing, and software updates. Redundant sensors and actuators are often arranged so that a failure of one channel can be identified and replaced without deactivating the entire system.

Regulatory Requirements

Certification standards such as FAA Advisory Circular 25.671-1 and EASA CS 25.671 require that no single failure cause loss of control. Backup systems must be designed so that a second failure still leaves a path to control. For critical control surfaces, the probability of loss of control is required to be less than one in a billion per flight hour. These stringent requirements drive the multiple, diverse backup architectures we see today.

The Future: More Electric and Distributed Backup

As aircraft adopt more electric architectures, the line between primary and backup systems blurs. Distributing actuators and power electronics throughout the airframe allows each control surface to be independently powered from multiple electrical busses. NASA and industry partners are researching more electric aircraft concepts where backup systems are integrated at the component level rather than added as separate modules. This reduces weight and maintenance while maintaining safety. Additionally, fly-by-wireless systems using robust communication protocols are being explored as a backup to wired buses. Future aircraft may rely on a network of smart actuators that can reconfigure in real time, self-diagnosing failures and redistributing control tasks.

Conclusion

Backup flight control systems are a cornerstone of aviation safety, providing multiple, independent layers of control that allow pilots to maintain aircraft stability even after serious failures. From hydraulic redundancy to fully electric backup powered by ram air turbines, these systems have evolved to meet ever-stricter safety standards. Understanding how they work—and how they differ between manufacturers—gives pilots, engineers, and passengers confidence in the robust design of modern aircraft. As technology advances, the trend toward integrated, more electric backup solutions will further enhance redundancy while reducing complexity, keeping the skies safe for all.