Chapter 3: Landing Gear, Flight Controls, Hydraulics and Fuel

A structural part is judged by the loads it carries, how it fails and how a crack is found in time. A system component adds three facts: it moves, so it wears; it is serviced, so its maintenance history often outgrows its design history; and it sits in a redundant architecture, so its importance depends on what still works when it fails. These facts drive almost every field that suppliers, operators and maintenance organisations want in a component record.

Numbers follow the book's facts policy. Certification values are cited to the transport-category airworthiness code (14 CFR Part 25 and CS-25 share paragraph numbers, so “25.473” refers to both). Type-specific values are given only as labelled illustrations, and figures from the WIA-SPACE-016 PHASE documents that are wrong as general rules are flagged where they appear.

3.1 Landing gear loads and the oleo-pneumatic strut

What the landing gear has to do

The landing gear supports the aircraft on the ground, absorbs touchdown energy, transmits braking and steering forces, and retracts in flight. Transport aircraft use a tricycle layout: a steerable nose gear and two or more main gears carrying most of the weight and all braking. Very heavy aircraft add wing or body gears because pavement strength, not gear strength, becomes the limit.

Main gear members are usually ultra-high-strength steels such as 300M or high-strength titanium alloys: very strong in a compact section, but sensitive to corrosion, hydrogen embrittlement and surface damage, hence heavy protective finishes and inspections aimed at surface pits and cracks. Most gear structure is safe-life: each part has a life limit in landings, published in the Airworthiness Limitations of the type's instructions for continued airworthiness, and is retired at that limit regardless of condition. The data consequence is direct: a gear part without a reliable count of cycles since new cannot be shown to be airworthy.

Certification load cases

Gear loads are not chosen by the designer. Paragraphs 25.471 to 25.511 define the ground-load conditions, with landing assumptions in 25.473. The code states conditions; forces are computed per type from weights, geometry and strut characteristics, which is why this book quotes no “typical” g values.

Note that the absorbed energy follows from a specified sink speed; the load factor is a design output. The PHASE-4 source's “dynamic load 2.5–3.0 × static”, “braking load 1.0g” and “side load 0.3g” are not CS-25 conditions and must not be used as design or validation limits. A WIA record should reference the applicable paragraphs instead of copying such numbers.

How the oleo-pneumatic strut works

Almost every transport-category gear uses an oleo-pneumatic shock strut. A chrome-plated or thermally sprayed sliding tube (the piston) moves inside an outer cylinder that is attached to the airframe. The upper chamber contains dry nitrogen; the lower chamber is filled with hydraulic oil. When the aircraft lands, the piston is forced upwards, oil is driven through a small orifice into the upper chamber, and the gas is compressed.

• The gas is the spring. Nitrogen compression follows approximately p·Vⁿ = constant, with n between 1 (slow, isothermal loading on the ramp) and about 1.3–1.4 (fast, nearly adiabatic touchdown). The gas stiffens as it is compressed and also carries the static weight, which is why the servicing charge is defined against strut extension rather than as a single pressure.
• The oil is the damper. Oil forced through the orifice produces a force proportional to the square of stroking velocity and dissipates energy as heat, so the aircraft does not bounce. A tapered metering pin often varies the orifice area with stroke to keep the force nearly constant, and a recoil orifice slows extension after impact.
• Seals, bearings and fluid level are what wear. Typical findings are seal leaks, loss of nitrogen charge, wrong oil level and damage to the sliding tube; servicing restores both fluid and gas to the manufacturer's charts.

Strut quality is expressed as efficiency, η = E / (F_max · S): absorbed energy divided by the energy of an ideal rectangular force–stroke curve with the same peak force and stroke. An undamped gas spring reaches roughly half of that ideal; well-tuned oleo struts are commonly described as reaching about 0.75–0.9. That is a textbook range; a given strut's value comes from its 25.723 drop tests.

Worked example: sizing the stroke

The following calculation is illustrative only. It shows how the certification sink speed, the strut efficiency and the permitted gear load factor fix the stroke. None of the input values is taken from a real type.

Inputs (example values, not from any type certificate)
  mass reacted by one main gear     m  = 30 000 kg
  limit descent velocity (25.473)   v  = 3.05 m/s   (10 ft/s)
  strut efficiency                  eta = 0.80
  stroke available                  S  = 0.40 m

Vertical kinetic energy to absorb (lift = weight, so gravity
work during the stroke is balanced by lift):
  E = 1/2 * m * v^2 = 0.5 * 30 000 * 3.05^2 = 139.5 kJ

Peak strut force:
  F_max = E / (eta * S) = 139 500 / (0.80 * 0.40) = 436 kN

Gear load factor on the reacted mass:
  N = F_max / (m * g) = 436 000 / (30 000 * 9.81) = 1.48

Rearranged as a sizing rule:
  S = v^2 / (2 * g * eta * N)   =>   0.40 m for N = 1.48

The example ignores the tyre, which absorbs some energy and adds deflection, and the effect of the lift assumption on reacted mass. Its shape is still the one used in early design: a longer stroke or better damper lowers peak load and saves structure elsewhere, at the cost of a longer, heavier gear that must still fit its bay. The resulting limit load feeds the structural analysis, where the 1.5 factor of safety from Chapter 1 gives the ultimate load.

3.2 Tyres, carbon brakes and anti-skid

Tyres

Aircraft tyres run at pressures, loads and speeds far beyond road tyres and are qualified under a technical standard order (TSO-C62, or the equivalent ETSO), each with a size, ply rating, rated load and rated speed. On larger aircraft, tyres on braked wheels must be inflated with dry nitrogen or another inert gas to keep oxygen content low (25.733(e)), because a brake fire can make the rubber release volatile gases that oxygen would turn explosive.

Removal criteria are set by the tyre manufacturer and the aircraft maintenance manual: tread worn to a specified groove or wear-indicator level, cuts beyond limits, flat spots after a skid, sidewall damage or heat exposure. The “minimum tread depth of 1.6 mm” in the PHASE-4 source is a road-vehicle rule and does not apply to aircraft tyres. Because tyres are routinely retreaded, a casing has its own history (retread level and count) distinct from the tread in service, and frequent pressure checks matter because under-inflation raises sidewall flexing and heat, a classic precursor of failure.

Wheels and brakes

Wheels are qualified together with their brakes (TSO-C135 for transport-aircraft wheels and wheel-and-brake assemblies). A braked wheel carries fusible plugs that melt and deflate the tyre in a controlled way if the wheel becomes too hot, preventing a burst after an abnormal stop (25.731). An over-pressure relief device protects against over-inflation.

A transport brake is a stack of rotors keyed to the wheel and stators keyed to the torque tube, clamped by hydraulic pistons or, on some newer types, electric actuators. The stack is a heat sink that absorbs kinetic energy, E = ½·m·v², within seconds and sheds it slowly. As an order of magnitude, 60,000 kg at 70 m/s is about 147 MJ, part of it removed by drag and reverse thrust and the rest shared among the braked wheels. The worst case is a rejected take-off at maximum weight with fully worn brakes, for which 25.735 requires the energy capacity to be demonstrated; brake-temperature monitoring and turnaround limits follow from the same physics.

Carbon–carbon heat sinks have largely replaced steel on large aircraft because they are lighter and keep friction and strength when hot. Carbon wear depends more on the number of applications than on energy per stop, so taxi-braking technique strongly affects brake life. Wear is read from wear pins whose protrusion shows remaining heat-sink thickness: a quantitative, per-serial-number measurement ideal for a structured inspection record.

Anti-skid

Braking force on a tyre is greatest when the tyre is rolling slightly slower than the aircraft is moving. The difference is expressed as the slip ratio, s = (V_aircraft − ω·R) / V_aircraft, where ω is the wheel's angular speed and R its rolling radius. A freely rolling wheel has s = 0; a locked wheel has s = 1. The friction coefficient rises from zero to a peak at a small slip ratio, often in the region of 10–20 percent in general tyre literature, and then falls towards a lower sliding value. A locked wheel therefore both brakes less effectively and destroys the tyre within seconds.

The anti-skid system measures each wheel's speed, estimates the aircraft reference speed, and modulates brake pressure through a servo valve so that each wheel stays near the peak of its friction curve; it also provides locked-wheel and touchdown protection. Autobrake uses the same loop to command a target deceleration. The response time and sampling rate in the PHASE-4 source are illustrative; actual values belong to each brake-control unit's equipment specification.

3.3 Primary and secondary flight controls

The flight controls move surfaces that change the aerodynamic forces on the aircraft. They are usually divided into primary controls, which the pilot uses continuously to control attitude, and secondary controls, which change the aircraft's configuration or trim.

The geometric proportions and hinge moments listed in the PHASE-3 source (for example a rudder area of 25–30 percent of the fin) are conceptual-design ranges from textbooks and vary widely between types; they are not requirements of this standard and are not repeated here.

Two concerns dominate control-surface maintenance. The first is flutter, a self-excited oscillation coupling surface motion with structural bending or torsion. It is prevented by stiffness, mass balance and, above all, by keeping free play in hinges, actuator attachments and linkages within published limits (aeroelastic stability is addressed in 25.629). The second is the integrity of single load paths that cannot practically be duplicated, such as the screw jack and nut of a trimmable stabiliser, which carry detailed wear checks and lubrication tasks. Both produce numbers (measured free play, measured end play) that belong in structured inspection data.

High-lift systems guard against asymmetric flap or slat deployment with asymmetry detection, wing-tip brakes and torque limiters (interconnected flaps are covered by 25.701). A tripped torque limiter or an asymmetry event is a maintenance event that should be linked to every serial number in the affected drive line.

3.4 Fly-by-wire

Architecture

In a fly-by-wire (FBW) system the pilot's controller produces electrical signals that flight control computers (FCCs) combine with sensor data under control laws to command the actuators, with no continuous mechanical link to most surfaces. The gains are weight, software-shaped handling and envelope protection; the price is that computers, sensors, power and networks become safety-critical.

Loss of pitch or roll control would be catastrophic in the sense of AC 25.1309-1A and AMC 25.1309 (Chapter 1), so it must be extremely improbable and not follow from any single failure. Three techniques are combined:

• Redundancy. Several computers, typically three or four channels or command/monitor lane pairs, take independent sensor inputs from separate electrical buses, and each actuator can usually be driven by more than one computer and hydraulic system.
• Monitoring. Channels cross-compare outputs; one that disagrees beyond a threshold is disconnected and another takes over. Thresholds and times are design parameters; the “failure detection < 20 ms” and “fault recovery < 200 ms” in the PHASE-3 source are unsourced and at best illustrative.
• Dissimilarity. Identical channels share design errors, so many FBW systems use computers with different processors and software written by separate teams. Their software and hardware are developed to the highest assurance levels of DO-178C and DO-254 within the ARP4754A system process.

Data buses

Two avionics data-bus standards appear in the source specification, and both are relevant to flight-control components because the bus defines which part numbers can talk to which.

Control laws

A control law relates pilot input to aircraft response; computers step down to simpler laws when failures remove what a richer law needs. Names differ by manufacturer; the table uses the source's Normal / Alternate / Direct terms in the general form of published descriptions. Exact protections are type-specific and defined in each flight manual.

The PHASE-3 source calls Direct law “mechanical backup feel”, which is wrong. Direct law is still electrical: the computers pass the input straight to the actuators without protections. A mechanical backup, where fitted, is a separate, limited cable or trim linkage to a few surfaces, increasingly replaced by an independent electrical backup on newer designs. The two involve different parts and different failure analyses, so records must not conflate them.

3.5 Hydraulic systems

Pressure class and architecture

Hydraulic power still drives flight-control actuators, gear retraction, brakes, steering and thrust reversers. Most transport aircraft use a nominal 3,000 psi (about 207 bar); several newer large types use 5,000 psi (about 345 bar) to shrink tubes and actuators, and some replace one hydraulic system with electrically powered actuation.

Three independent systems are usual, named by colour, letter or side. Each primary control can be moved by at least two systems, and no single failure (engine, pump or leak) removes enough power to lose control. A simplified layout:

   Engine 1                                            Engine 2
      |                                                   |
    [EDP]                    [EMP] [EMP]                 [EDP]
      |                        |     |                    |
      v                        v     v                    v
 +-----------+   PTU    +-------------------+       +-----------+
 | SYSTEM 1  |<========>|     SYSTEM 3      |       | SYSTEM 2  |
 | reservoir |  (power  | reservoir, [RAT]  |       | reservoir |
 | filters   |   only,  | for emergency     |       | filters   |
 | accum.    |  no fluid| power             |       | accum.    |
 +-----+-----+  mixing) +---------+---------+       +-----+-----+
       |                          |                       |
       +---- ailerons, elevators, rudder, spoilers -------+
       |       (each surface fed by at least two systems) |
       +---- gear retraction, nose-wheel steering         |
       |                          +---- brakes (alternate)|
       +---- brakes (normal)                  flaps/slats-+

EDP = engine-driven pump    EMP = electric motor pump
PTU = power transfer unit   RAT = ram air turbine

Component roles:

• Engine-driven pumps (EDPs): variable-displacement piston pumps on the engine gearbox that supply main flow and hold pressure by adjusting displacement.
• Electric motor pumps (EMPs): ground power, supplementary flow at high demand, or the main source for a system without an EDP. Some types also use air-driven pumps.
• Power transfer unit (PTU): a hydraulic motor and pump on one shaft that lets one system pressurise another without exchanging fluid, so a leak in one cannot drain the other.
• Ram air turbine (RAT): deploys when normal power is lost and drives a hydraulic pump or a generator, depending on the type.
• Reservoirs, accumulators and filters: reservoirs are pressurised against pump cavitation, accumulators store energy for peak demand and brakes, and filters, especially pump case-drain filters, are a key condition-monitoring point, since debris there is often the first sign of a failing pump.

Paragraph 25.1435 sets proof and ultimate pressure factors that differ by element type. The PHASE-3 figures of 4,500 psi proof and 9,000 psi burst for a 3,000 psi system reflect factors (1.5 and 3.0) that apply to some elements only, not a single rule for every component.

Hydraulic fluids

The choice of fluid is a design decision fixed by the type certificate, and fluids must never be mixed. Two families matter here:

The PHASE-3 source gives MIL-PRF-5606 or 83282 as the airliner main-system fluid; transport jets in fact use AS1241 phosphate esters. Mineral oil remains common in sealed shock struts, so one aircraft may legitimately carry two fluid families, and records should state the fluid for each serviced item.

Fluid condition is monitored too: phosphate-ester fluids absorb water and degrade by hydrolysis, so samples are analysed for acid number, water, chlorine and particle count. These results describe a system rather than one serial number, a modelling question taken up in Section 3.7.

3.6 Fuel systems

Tanks and structure

On transport aircraft most fuel is carried in integral tanks: sealed sections of the wing box between the spars, closed by ribs, often with a centre tank in the wing centre section and on some types a tank in the horizontal stabiliser. The tank is both structure and system: fastener sealant, access panels and internal pumps, valves, probes and wiring are all maintained through the same openings.

General tank requirements are in 25.963 to 25.977; among them 25.969 requires expansion space of at least 2 percent of tank capacity and 25.975 requires vents. Lightning protection of the fuel system is covered by 25.954.

Feeding the engines

Each engine is fed from its own tank by two or more electric boost pumps. Centre-tank pumps often override wing pumps so centre fuel is used first while wing fuel keeps relieving wing bending. A crossfeed valve lets any tank feed any engine, and if boost pumps fail the engine pump can suction feed within flight-manual altitude and temperature limits. Paragraph 25.953 requires that a component failure not cause power loss on more than one engine; 25.955 sets fuel-flow requirements.

Fuel is also a heat sink for engine oil, hydraulic fluid and generator oil in fuel-cooled heat exchangers, which turns fuel temperature and minimum tank quantities into system constraints. Quantity is typically measured with capacitance probes and densitometers, which are tank-internal components with their own histories.

Because fuel is a large fraction of take-off mass, burn sequence moves the centre of gravity (CG); some long-range aircraft transfer fuel to a tail trim tank in cruise to reduce trim drag. CG limits are type-specific; the “15–30 percent MAC” in the PHASE-3 source is a textbook example, not a general limit.

Jettison, flammability and ignition prevention

Paragraph 25.1001 requires a jettison system unless the aircraft meets the specified climb requirements at maximum take-off weight less the fuel for a 15-minute flight comprising take-off, go-around and landing. Where installed, it must jettison enough fuel within 15 minutes to meet those requirements, without creating a fire hazard and without being able to dump a minimum reserve. The jettison rates and “safety height above 5,000 ft” in the PHASE-3 source are unsourced and not repeated.

Fuel tank safety under 25.981 has two parts: preventing ignition sources inside tanks, and limiting the time the ullage is flammable. Ignition-source prevention produces critical design configuration control limitations (CDCCLs), which forbid certain changes to tank-internal wiring and components during maintenance. Flammability reduction is commonly achieved by feeding nitrogen-enriched air from hollow-fibre air separation modules into the ullage. For records, tank components carry configuration constraints that must survive repair and modification, and inerting components are serialised, reliability-monitored items.

3.7 Recording system components

WIA-SPACE-016 records all four kinds of hardware with the same AircraftComponent object (introduced in Chapter 1, dissected in Chapter 4), using the ComponentType values landing-gear, flight-control, hydraulic-system and fuel-system. The question here is narrower: which data carry meaning for each, and where does v1.0 fall short?

What is meaningful for each type

Two observations follow. First, ATA iSpec 2200 chapter numbers (32 landing gear, 27 flight controls, 29 hydraulic power, 28 fuel) are how operators already index these parts; carrying them in metadata.ataChapter makes WIA records joinable with existing maintenance data. Second, ComponentType names systems, while serial numbers belong to items within them. Use type for the system and record the item class (for example "pump" or "shock-strut") in metadata rather than inventing new top-level types.

Example: a main landing-gear shock strut

The following record describes a main-gear shock strut in service. All identifiers, dimensions and counts are illustrative. The manufacturer name is fictitious, and the life-limit reference is a placeholder for the relevant item of the type's Airworthiness Limitations.

{
  "id": "acc-7f3c2a90-mlg-strut-lh",
  "type": "landing-gear",
  "status": "maintenance",
  "partNumber": "EXG-3211-100-07",
  "serialNumber": "EXG-SN-004417",
  "manufacturer": "Example Gear Systems (fictitious)",
  "manufacturingDate": "2014-03-18",
  "dimensions": {
    "length": 2650,
    "width": 540,
    "height": 610,
    "weight": 412
  },
  "material": {
    "type": "steel-low-alloy",
    "grade": "300M, vacuum-remelted, quenched and tempered",
    "strength": 1930,
    "fatigueLimit": 0,
    "density": 7830,
    "corrosionResistance": "low"
  },
  "inspectionHistory": [
    {
      "id": "insp-2024-11-02-001",
      "inspectionDate": "2024-11-02",
      "inspector": "MRO-EX-Station-3/insp-118",
      "method": "magnetic-particle",
      "result": "pass",
      "findings": "Outer cylinder and axle: no linear indications. Sliding tube coating intact.",
      "nextInspectionDate": "2026-11-02"
    },
    {
      "id": "insp-2025-06-14-004",
      "inspectionDate": "2025-06-14",
      "inspector": "LINE-EX-ICN/insp-042",
      "method": "visual",
      "result": "conditional",
      "findings": "Seal weep at gland nut within AMM allowable limit; strut serviced (oil and N2). Re-inspect at next weekly check.",
      "nextInspectionDate": "2025-06-21"
    }
  ],
  "metadata": {
    "ataChapter": "32-11",
    "itemClass": "shock-strut",
    "position": "main gear, left",
    "cageCode": "EX000",
    "installedOn": { "registration": "EX-ABC", "since": "2021-09-30" },
    "cyclesSinceNew": 18642,
    "cyclesSinceOverhaul": 4210,
    "lifeLimitRef": "ALS Part 1, item 32-xx (placeholder)",
    "lifeLimitUnit": "landings",
    "strutFluidSpec": "MIL-PRF-5606",
    "strutGas": "nitrogen",
    "materialExtension": {
      "field": "material.type",
      "value": "steel-low-alloy",
      "note": "Not in the v1.0 MaterialType enum; proposed additive extension"
    }
  }
}

Several features of this example are deliberate and worth reading closely.

• The material does not fit the v1.0 enum. MaterialType offers two aluminium alloys, one titanium alloy and four composite or fibre values, but no steel. A high-strength steel strut therefore cannot be described truthfully by a v1.0-valid record. Picking the nearest value (for example titanium-ti6al4v) would pass validation and falsify the record. This example uses steel-low-alloy, one of the values proposed in Chapter 2 (§2.7.4), keeps the alloy (300M) in grade, flags it in metadata.materialExtension, and will fail strict validation against the v1.0 schema. That is the honest outcome. Chapter 4 explains how such additions are handled under the schema-evolution notes of the standard: new enum values are additive, but consumers that validate enums strictly must be told through a declared profile.
• Units follow the SDK types. Millimetres and kilograms for dimensions, MPa for strength, kg/m³ for density (7,830, not 7.83 g/cm³). fatigueLimit assumes a single endurance limit, which notched high-strength steel in corrosive service does not meaningfully have, so the example sets it to 0 and relies on the life limit; a future revision could make the field optional.
• Cycles live in metadata. v1.0 has no hours or cycles fields, although they decide whether a safe-life part may stay installed. Until a revision adds them, they go in metadata under names agreed in an interoperability profile, next to a reference to the life limit they are counted against; the book points to that document rather than inventing the limit.
• A conditional result carries its own deadline. The second inspection records a seal weep that is within limits but must be re-checked. The conditional result with a short nextInspectionDate is exactly the pattern that the maintenance-event flow in Chapter 6 relies on.
• Optional objects are omitted rather than faked. A safe-life strut's structuralAnalysis belongs to the manufacturer's type-design data, and its release certificate (certification) is discussed in Chapter 6. Placeholder numbers would make the record look more complete and be less true.

Hydraulic and fuel items

For a hydraulic pump or fuel boost pump, material records the housing for completeness while metadata carries operating hours, fluid specification, pressure class and removal reasons. Fluid samples and filter indications should be recorded as system-level maintenance events linked to the serial numbers installed at the time, so that a later analysis can ask which pump was fitted when the particle count began to rise. Tank-internal fuel parts should reference any applicable CDCCL.

Flight-control computers carry loadable software, so the software part number and version must be recorded alongside the hardware part number; v1.0 again leaves this to metadata (see Chapter 4). Actuators and surfaces carry free-play and rigging measurements, which are more useful as numbers with units than as “pass” in a text field.

Summary

Landing gear, flight controls, hydraulics and fuel are the moving, serviced, redundant parts of an aircraft. Their certification rests on conditions defined in the airworthiness code, not on universal numbers, and their life is decided by cycles, hours, wear measurements and condition monitoring traceable to a serial number. WIA-SPACE-016 v1.0 can hold these facts, but several of the most important (cycles, hours, software part numbers, steel alloys, measured values) must travel in metadata or proposed extensions. Chapter 4 shows how to make such extensions explicit and verifiable.