Mechanical Flight Control Systems

A mechanical flight control system connects the pilot's controls to the control surfaces through a chain of cables, rods, levers and shafts. On a light aeroplane the chain moves the surface itself, and the pilot feels the air load on it. On an airliner that is not fly-by-wire, such as the Boeing 737, the same kind of chain runs from the column, wheel and pedals to hydraulic power control units at the surfaces, which do the work (see powered flying controls). Even the fly-by-wire A320 keeps mechanical control of its rudder and trimmable stabiliser as a backup.

The linkage must pass on every movement exactly, without slack or binding, in the right sense and over the right range. It must survive gusts while the aeroplane is parked and give the crew a way out if part of it jams in flight. Engineers rig and inspect it, but its failure modes, and the checks that catch them, are part of every pilot's systems knowledge and of the EASA ATPL syllabus.

Control linkages overview

A cockpit input can reach a surface mechanically, by cables, rods, levers and chains; hydraulically, with the surface moved by hydraulic power but its control valve still worked through a mechanical linkage; or electrically, by fly-by-wire, where the actuation may still be hydraulic. The mechanical elements are:

Mechanical signalling still reaches far into the airline fleet. On the Boeing 737 the captain's wheel is cabled to the aileron power control units (PCUs) through the aileron feel and centring unit, the first officer's wheel to the spoiler PCUs through the spoiler mixer, and both columns to the elevator PCUs; the two elevators are interconnected by a torque tube. The E190 E1 commands every PCU by wire except those of the ailerons, which keep a conventional cable system. The A320 has two pairs of rigidly interconnected rudder pedals and mechanically interconnected stabiliser trim handwheels.

The cables, rods, pulleys and fairleads running through the fuselage are heavy, which is one reason for the move to fly-by-wire. Their virtue is that they tend to fail gradually, through stretch and wear that inspection can find, rather than all at once.

Cables, pulleys and fairleads

Control cables are flexible steel wire ropes, typically of stainless steel. A cable can only pull, so each surface is driven by a pair, one for each direction. Both cables stay in tension: as the control moves, the tension in one rises while that in the other falls, and the surface responds at once in both directions.

A control cable pulley is a grooved wheel turning on a sealed bearing that changes the direction of a cable as it is routed around the structure; guards keep a slack cable from riding out of the groove. A fairlead is a non-rotating guide, usually of nylon, fibre or a plastic-lined material, that keeps a cable straight and clear of the structure where it passes a bulkhead or along a long run. It does not turn the cable through a significant angle, which is the pulley's job, and a worn fairlead is replaced before it wears the cable.

Inspection looks for broken wires, fraying and corrosion, above all where a cable runs over a pulley or through a fairlead. Some cables are maintained on condition, staying in service while inspection shows them within limits. In the United States a flight control system malfunction or failure is one of the serious incidents that must be notified to the NTSB immediately, even when nobody is hurt and nothing is damaged.

Cable tension, turnbuckles and locking wire

Control cable tension must be right. Too low, and the controls have free play and backlash and a cable can jump off its pulley. Too high, and the controls are stiff, friction rises and cables, pulleys and bearings wear quickly. The correct value depends on the type, the cable size and the ambient temperature. Temperature matters because the cables are steel and the airframe mainly aluminium, which expands and contracts more: in the cold at altitude the airframe shrinks more than the cables and the tension falls, while heat raises it. Some systems include spring-loaded tension regulators to hold it nearly constant.

Tension is measured with a tensiometer and adjusted with a turnbuckle. A turnbuckle has a central barrel threaded left-hand at one end and right-hand at the other, with an end fitting screwed into each end. Turning the barrel draws the fittings together or pushes them apart. It is in safety when the thread engagement is adequate: on barrels with inspection holes the threads must fill the holes, and on others no more than three threads of each end fitting may show outside the barrel.

Vibration would otherwise turn the barrel, so the turnbuckle is then locked, most often with locking wire (lockwire or safety wire) passed through holes in the barrel and fittings and twisted tight, so that any tendency to unscrew pulls against it. Locking clips and plates are alternatives, and the same wire secures bolts and fittings throughout the aircraft.

After any adjustment the system is checked for tension, the safety and locking of every turnbuckle, pin and fitting, full travel in the correct sense, friction and backlash. Friction, measured with a spring balance through the full travel, must be low, or it masks the way control forces grow with speed. Backlash is free movement of the cockpit control when its direction is reversed, a sign of worn pivots, low tension or wrong parts.

Bellcranks and torque tubes

A bellcrank is a lever pivoted at its corner or middle with an arm on each side. A cable or rod pulling one arm rotates it, and the other arm pushes or pulls in a different direction, typically at right angles. Bellcranks turn a fore-and-aft cable run into a spanwise one, take a rudder cable into the fin and drive the horn of a surface. Unequal arms change travel and force, and the linkage geometry can give the up-going aileron more travel than the down-going one, which is how differential ailerons are produced (see roll control).

A torque tube transmits movement by twisting about its own axis. Inside a control column one carries the rotation of the wheel; elsewhere one links two surfaces so that they move together, like the tube joining the 737's elevators. Long shafts from a central power unit drive the actuators at every flap track on the same principle (see flap systems).

Primary and secondary stops

The primary stop is at or near the control surface and limits its maximum deflection. The range is often asymmetric: elevators usually move further up than down, because the flare and rotation at a forward CG need a lot of up-elevator, and the A320's move up to 30° nose-up and 17° nose-down. The secondary stop is at the cockpit control and limits the travel of the column or pedals. With the primary stop fully contacted there must still be a small clearance at the secondary stop. That proves the surface stop sets the limit, keeps the pilot from overstressing the linkage, and leaves a second stop if the first fails.

A control system that has been adjusted, repaired, modified or had parts replaced must pass a duplicate inspection before flight: one qualified person inspects and certifies it, then a second does so independently, with nothing disturbed in between. It exists because a single wrong assembly at a vital point, such as a cable termination, could be catastrophic, and it always checks the operating sense: crossed cables make the aeroplane respond the opposite way, a fault that shows itself at rotation. In the United States an aircraft whose flight characteristics may have been appreciably changed by maintenance must also be test flown before it carries passengers. The crew's full and free check before take-off is the last barrier; on the 737 each input is made slowly, one direction at a time, checking freedom, return to centre and correct surface movement on the display.

Gust locks

A gust lock, or flight control lock, holds the controls still while the aeroplane is parked. Without one, a strong or gusty wind can slam the surfaces against their stops hard enough to bend linkages, damage hinges or break bellcranks. External locks clamp onto the surfaces and are removed on the walk-round. Internal locks are engaged from the cockpit and lock the controls through the linkage.

Taking off with a lock engaged can be fatal, because the aeroplane cannot be rotated or controlled, so designs make it difficult. Many internal locks mechanically stop the throttles or thrust levers being opened while the lock is in, and on types with remotely operated locks the take-off configuration warning sounds if they are still engaged when the thrust levers are advanced.

None of this replaces the crew's checks. On 31 May 2014 a Gulfstream IV began its take-off at Bedford, Massachusetts, with the gust lock engaged and without the flight control check having been done. The take-off was abandoned too late, and the aeroplane overran the runway and burned, killing all seven people on board. Among the contributing factors the NTSB cited the crew's habitual non-compliance with checklists and the manufacturer's failure to ensure that the gust lock and throttle interlock would prevent a take-off attempt with the lock engaged.

Jam protection and disconnects

A control can jam through ice in the gaps around a surface, a loose article in the linkage, a seized bearing or a failed part. Duplicated hydraulic power does not help if the mechanical path itself is blocked, so jamming protection gives the pilot another way to control the aeroplane:

• Disconnect levers. A pitch disconnect separates the captain's elevator linkage from the first officer's, and a roll disconnect separates the two roll paths, so the pilot whose side is free keeps control, possibly with a reduced roll rate. On the E190 E1 pulling the aileron disconnect handle is the recall action for a jammed aileron, and it can be reconnected only on the ground by maintenance; on the E190-E2 the recall actions for a jammed elevator or control wheel are to pull the elevator or aileron disconnect handle.
• Shear rivets and breakout mechanisms. The two control wheels or columns are tied by a link designed to break or override at a set force, so force against the jam frees the other side.
• Duplicated paths. Separate routes, or a surface split into sections with separate actuators, let a jammed path be overridden while the working one carries the input.

View full schematic

The 737 combines these ideas. Its columns and wheels are connected through transfer mechanisms that let the pilots bypass a jammed control or surface. If the aileron system jams, force on the first officer's wheel rolls the aeroplane with the spoilers, while the captain's wheel and the ailerons stay jammed; if the spoiler system jams, force on the captain's wheel still works the ailerons. If a column jams, force against it breaks out one column, and whichever then moves freely gives adequate elevator control. Each input rod to the rudder PCUs has its own jam override, and the 737 MAX, whose spoilers are signalled electrically, adds an elevator jam landing assist that uses the flight spoilers.

Library articles are written for study and exam preparation. They do not replace your aircraft's approved documentation, your operator's procedures or the regulations themselves.