Electronic FADECs can and do fail. Mechanical speed/fuel/air/turbo regulators can and do also fail. I do not know which type has a higher failure rate and I refuse to guess. My point is that having both types functional MAY give the pilots a second chance warning about a potential N2 over speed and allow them enough time to respond to an engine or FADEC fault, and before any serious damage is done.
No Fly Zone, FADEC has proved to be
much more reliable than the hydromechanical control systems - roughly an order of magnitude more reliable. In fact, dual channel redundant FADEC systems are sufficiently reliable that we allow "Time Limited Dispatch" - where one can dispatch for an extended period of time (up to 2000 hours for one FADEC engine type) with "loss of redundancy" engine control faults without adversely affecting the Shutdown or "Loss of Thrust Control" rates. In fact, introduction of FADEC has been a primary contributor to the dramatic reduction in shutdown rates I've seen during my career that has allowed ETOPs. When I started, one shutdown per 10,000 hrs. was "acceptable" - today one shutdown per 100,000 hours is cause for concern, and many engine type shutdown rates are 1 or 2 per
million hours.
Many of the early FADEC systems used some sort of 'flyball' overspeed protection system. A primary concern was overheat - something like a burst anti-ice duct could heat the FADEC well above its temperature limit (~100 deg. C), and the manner that a FADEC would fail due to overheat is rather unpredictable (including possibly commanding the fuel metering valve wide open) - and the designers were not confident they could design an electronic overspeed protection that would stay alive during an overheat long enough to protect from a FADEC going crazy.
However over time, FADEC designers have come up with electronic overspeed protection systems - independent from the engine control portion of the FADEC - that can be made from (relatively) simple electronic components that have much better high temperature characteristics relative to the rest of the FADEC. These have been certified to stay alive well above the temperature at which the rest of FADEC will fail.
Lomapaseo, failures which could result in what we call "UHT" - Uncontrollable High Thrust - are extremely rare. In the FADEC fleet, they are on the order of 1 per hundred million engine operating hours - again roughly an order of magnitude better than the ~10-7/hr. rate for mechanical engine controls (a leading cause for mechanical controls being broken/separated throttle cables). "Up and Away", UHT is not normally a big deal - there is enough airspeed that the aircraft is controllable, and the engine can simply be shut down if needed. However on the ground can be a different story.
The most recent Boeing engine/aircraft combinations (777-300ER/200LR, 787, and 747-8, and the upcoming 737 MAX and 777X) also have a system that - on ground only - will shutdown an engine that goes to high thrust uncommanded, or remains at high thrust after the throttle is retarded. Airbus also has a system on their latest aircraft that is intended to protect against UHT, but understandably I don't know much about it.
Oh, barit1, just razzing you a bit
