Cabin Pressure Controller — The Brain of Pressurisation

Pressurisation Principles gave the physics — the cabin-altitude schedule, max ΔP, the five modes, outflow-valve metering. This deep-dive opens up the brain that runs it: the Cabin Pressure Controller (CPC) — a dual-channel industrial controller of the same family as the pack and zone controllers, but with a unique feature: each controller carries its own analogue manual-backup section (a rare "analogue fallback built into the box"). It covers the dual-unit + backup architecture, the vibrating-cylinder sensor, the six inputs, the four BITE types, the three operating modes, and the outflow-valve interlocks. The outflow valves themselves are ata-21-12; the safety / negative-relief valves and the RPCU are ata-21-13.

1. Location

The cabin pressure controllers 311HL and 312HL are installed in the rack 800VU of the avionics compartment. Only one of the cabin pressure controllers operates at a time. They are automatically changed over after each flight or if there is a failure on the ground or in flight. Data is continuously sent from one cabin pressure controller to the other cabin pressure controller through a Cross Channel Data Link (CCDL). — AMM 21-31-00 §3.B

[!note]- All three ATA 21 controllers live in rack 800VU

The three dual-channel controllers covered so far are all in avionics rack 800VU: the pack controllers (531HH/532HH, two LRUs, inside the pack), the zone controller (630HK, one LRU, after the pack), and now the CPC (311HL/312HL, two LRUs, cabin pressure). Five LRUs, one access panel, but independent cards + independent power. The design clusters the ATA 21 critical computers in the avionics bay — isolated from belly-fairing anomalies, on the avionics power topology, reachable from below the cockpit.

2. Dual-unit + manual-backup topology

                    cabin pressure (actual)
                         ▼  pressure port (controller case)
            ┌──────────────────────────────────────┐
            │ CPC 311HL / 312HL                    │
            │                                       │
            │ ┌─ AUTOMATIC PART (microprocessor)──┐ │
            │ │  vibrating-cylinder sensor        │ │
            │ │  8 functions · ARINC 429 inputs   │ │
            │ │  discrete inputs · BITE           │ │
            │ └──────────────┬────────────────────┘ │
            │                ▼ command               │
            │   outflow-valve AUTO motors            │
            │   (313HL3/4 + 315HL3/4)                │
            │                                        │
            │ ┌─ MANUAL (backup) PART (analogue)──┐  │
            │ │  independent power (controller #1)│  │
            │ │  independent pressure sensor →    │  │
            │ │  ECAM cabin-alt signal in MAN     │  │
            │ └──────────────┬────────────────────┘  │
            │                ▼ in manual mode         │
            │   MAN V/S CTL toggle 5HL               │
            │   → outflow-valve MANUAL motors        │
            │     (313HL5 / 315HL5, slower)          │
            └────────────────────────────────────────┘
                  CCDL: 311HL ←──data──→ 312HL

Sources: AMM 21-31-00 §3.B/§6.B + FCOM DSC-21-20-20.

3. The six inputs

Two identical, independent, automatic controllers are used for cabin pressure control. They receive signals from the Air Data Inertial Reference System (ADIRS), the Flight Management Guidance and Envelope Computer (FMGEC), the Engine Interface Unit (EIU), the Landing Gear Control Interface Unit (LGCIU), the Proximity Switch Control Unit (PSCU) and the pack flow control valves. — FCOM DSC-21-20-20

Plus discrete inputs: PFCV closed (pack OFF), PSCU doors locked, the DITCHING pb (close the outflow valves), the RAM AIR pb (partly open the valves below 1 PSI ΔP), the EIVMU (takeoff mode), and LGCIU 1+2 (ground/flight).

4. Two outflow valves + six motors

   [FWD outflow valve 313HL]  (rectangular frame, belly fairing, below flotation line)
     ├─ auto motor 1 (313HL3) ← active controller
     ├─ auto motor 2 (313HL4) ← other controller (backup)
     └─ manual motor (313HL5) ← MAN V/S CTL direct
   [AFT outflow valve 315HL]  (same)
     ├─ auto motor 1 (315HL3) / auto motor 2 (315HL4) / manual motor (315HL5)
   → 6 motors total (4 auto + 2 manual), each on an independent supply

Two outflow valves are located below the flotation line. Each outflow valve assembly consists of a flush, skin-mounted, rectangular frame, carrying inward and outward opening flaps linked to the actuator. The actuator contains the drives of two electric motors, and the drive of a third electric motor. Either of two electric motors operates the valve in automatic mode, and a third electric motor operates it in manual mode. To allow an easy and smooth control of the cabin's vertical speed in manual mode, the outflow valves move at a slower speed than in automatic mode. — FCOM DSC-21-20-20

Detail in Outflow Valve.

5. Safety / negative-relief / RPCU (intro)

Detail in Safety / Negative-Relief Valves.

6. Changeover rules

Only one of the cabin pressure controllers operates at a time. They are automatically changed over after each flight or if there is a failure on the ground or in flight. — AMM 21-31-00 §3.B

[!note]- Counter-intuitive: the CPC swaps both routinely and on failure — more aggressive than the pack controller

The pack controller swaps "at end of flight if there is no failure" — a fault stops the swap; the CPC swaps "after each flight or on failure" — it swaps with no fault and on a fault. The reason (integrative): a CPC failure is severe (cabin altitude directly affects every occupant), so it uses a more aggressive "use both" strategy — routine swap keeps both controllers in regular use; failure swap acts immediately. Pilot meaning: an in-flight CAB PR SYS 1 FAULT has controller #2 take over immediately (not "wait for end of flight" like the pack controller).

7. Automatic part — eight functions

The automatic part of each cabin pressure controller has the subsequent functions: to sense the actual pressure in the fuselage, to calculate the actual reference pressure, to calculate the reference position signals for the outflow valves, to monitor itself, to control the system interfaces (internal and external), to keep failure data, to send data to the other cabin pressure controller, to control the power supply to the outflow valve motors and electronics. — AMM 21-31-00 §3.B

Sense cabin pressure (→ ECAM cabin altitude + ΔP); compute the reference pressure (the cabin-altitude schedule); compute the outflow-valve position signals (→ SD PRESS valve position); self-monitor (BITE); control the interfaces; keep failure data (CMS codes); send data to the other CPC over the CCDL; control the outflow-valve motor + electronics power.

8. The manual-backup part

Each cabin pressure controller has an automatic part and a manual (back-up) part. For operation in manual mode, each controller has a backup section, which is powered by an independent power supply in the controller N° 1 position. This section also has a pressure sensor that generates the cabin altitude and pressure signal for the ECAM, when MAN mode is selected. — AMM 21-31-00 §3.B + FCOM DSC-21-20-20

[!warning]- Counter-intuitive: in manual mode the ECAM cabin altitude / ΔP comes from controller #1's backup section, not the active automatic part

In automatic mode the ECAM cabin altitude is computed by the active controller's automatic part. In manual mode it is provided by controller #1's backup section (an independent analogue circuit + an independent pressure sensor). The precision differs: the automatic part (digital) is high precision; the backup section (analogue) is coarse (~±1000 ft). If controller #1's backup section also fails, the ECAM cabin altitude shows amber XX. The philosophy: manual mode is a true emergency fallback — independent of the digital microprocessor; even with the avionics otherwise unpowered (as long as the backup section's own independent supply survives), the ECAM can still show cabin altitude.

9. The vibrating-cylinder pressure sensor

The cabin pressure sensor within the pressure controller 311HL (312HL) is of a vibrating cylinder type. The principle is, that a physical body vibrates at its natural frequency with high stability under constant environmental conditions. ... The frequency depends on the environment, specifically temperature and pressure surrounding the cylinder. Therefore, the frequency can be used as a reference. — AMM 21-31-00 §6.B (2)

[!note]- Vibrating cylinder vs strain gauge

A metal cylinder vibrates at its natural frequency; an external pressure change alters the cylinder's material stress → its vibration frequency → the frequency is read and the pressure inferred. Advantages over a strain gauge: extreme stability (frequency does not drift with element aging), low temperature drift (compensable frequency-temperature coefficient), very high precision (< 0.01 % class), and a direct digital output into the controller's digital circuits. Cost: expensive (a dedicated LRU), but a long life. Failure mode: a frozen value or a step jump, not a slow drift — so the crew can trust the ECAM cabin-altitude digit as essentially the true value.

10. PIN programming — the common LRU

PIN PROGRAMMING. BIT14 BIT13 BIT12. 0 0 0: NO OR FAULTY PIN PROGRAMMING. 0 0 1: A330 CONFIGURATION ... — AMM 21-31-00 §5.D

[!note]- The controller is a common LRU — PIN programming sets the configuration

The CPC LRU is a common part programmed by pins on the aircraft connector: certain pins grounded select the A330 configuration (BIT 14/13/12 = 0/0/1); ungrounded = "no/faulty" (the controller does not work). A spare controller is a common part; once fitted, the connector PIN identifies the configuration and the controller runs the matching software; a wiring error → the controller reports a fault. Pilot meaning: a CPC LRU is interchangeable within the A330 fleet (moving a controller between two fleet aircraft is fine) — simpler spares.

11. BITE — four types

There are the subsequent tests: Power-Up Built-In Test (PUBIT), State-Change Built-In Test (SCBIT), Initiated Built-In Test (IBIT), Continuous Built-In Test (CBIT). — AMM 21-31-00 §8.A

[!warning]- The controller runs SCBIT 70 s after landing — this is why the outflow valves show "odd behaviour" just after touchdown

A pilot may see, ~70 s after landing, an ECAM outflow-valve position change / a brief cabin-altitude digit jump / a state flicker — usually the controller running SCBIT (testing its own circuits, the outflow-valve motor response, sensor consistency). Do not pull the cockpit master switch / external power immediately after landing — let the controller finish SCBIT; a brief ECAM anomaly that self-clears within ~1 minute is normal SCBIT, not a fault.

12. LDG ELEV selector (310HL)

The LDG ELEV selector 310HL has a dual (redundant) potentiometer. It has a range of 2000 ft. (609.59 m) below sea level to 14000 ft. (4267.12 m) above sea level. There is a detent to hold the switch in the AUTO position and a mechanical stop between this and the 14000 ft. position. It is possible to pull the switch a bit to override the mechanical stop ... — AMM 21-31-00 §6.A (5)

[!warning]- "AUTO" plus a 14,000 ft upper limit reached by pulling past a mechanical stop

The dual (redundant) potentiometer reflects the high reliability landing-elevation data needs (a wrong value → an abnormal cabin altitude / ear discomfort at touchdown). The AUTO detent is the default (the controller uses the FMGEC field elevation); a mechanical stop between AUTO and 14,000 ft prevents the knob from being turned out of AUTO inadvertently; pulling the knob overrides the stop for the genuine "I must set the landing elevation manually" case (FMS lost / a diversion to a non-database field). 99 % of flights keep it in AUTO; it cannot be set above 14,000 ft (mechanically at the top — reasonable: the highest civil airfields sit near that figure).

13. Three operating modes — automatic / semi-automatic / manual

(1) Automatic Operation. In automatic operation, internal and external data is used to control the pressure in the fuselage. No crew procedure is necessary if the landing-field elevation data is available from the FMGES. (2) Semi-Automatic Operation. ... You must manually set the landing field elevation on the LDG ELEV selector 310HL. Manual Operation. ... push the MODE SEL pushbutton-switch 14HL (the MAN light comes on), lift the guard and set the MAN VALVE SEL toggle-switch 8HL to operate the applicable outflow valve(s) (AFT, BOTH or FWD), push the MAN V/S CTL toggle-switch 5HL to the UP position to decrease the pressure ... or to the DN position to increase the pressure ... — AMM 21-31-00 §7

Exiting manual mode (press MODE SEL again) swaps the active and backup controllers — a useful side effect that can force a controller swap to clear a fault.

14. Single pack OFF + ΔP > 4 PSI → aft outflow valve closes

When one pack is OFF and ΔP is above 4 PSI, the aft outflow valve closes and the forward outflow valve controls the cabin pressure. — FCOM DSC-21-20-20

[!note]- Why the aft outflow valve closes on single-pack operation

A single pack delivers ~60–120 % of one pack's capacity (NORM or HI). If both outflow valves opened by their automatic ratio, the single pack's inflow could not keep up with the two valves' release → ΔP hard to hold. The fix: close the aft outflow valve → halve the release area → the forward valve alone holds ΔP. The trigger ΔP > 4 PSI means it occurs only at high-altitude cruise, not on the ground / low altitude. So on single-pack operation, the ECAM aft-outflow-valve field showing "closed" is a normal single-pack indication, not a fault.

15. RAM AIR + ΔP < 1 PSI → outflow valves ~50 % open (automatic only)

Note: When the RAM AIR pushbutton is ON, and ΔP is below 1 PSI, the system drives the outflow valves about 50 % open if it is under automatic control. If the system is under manual control, the outflow valves do not automatically open, even if ΔP is below 1 PSI. — FCOM DSC-21-20-20

[!warning]- RAM AIR ON + ΔP < 1 PSI auto-opens the outflow valves ~50 % — giving the ram air an exit

After a dual-pack failure, RAM AIR ON lets outside air into the cabin (no pressurisation). ΔP < 1 PSI means the cabin is near ambient — a fully closed outflow valve is pointless (air leaks through the fuselage anyway). Opening the valves ~50 % gives the ram air an exit, forming an "in + out" convection. Why 50 %, not 100 %: keep margin for a fast re-close if ΔP rises (e.g. the aircraft descends and re-pressurises). Manual mode does not auto-open — the pilot may be controlling pressure manually and would not want an automatic override.

16. Cabin altitude 15,000 ft → outflow valves close

The outflow valves automatically close, if the cabin altitude reaches 15 000 ft, provided that the valves are in automatic mode. — FCOM DSC-21-20-20

[!warning]- Why the outflow valves close when cabin altitude reaches 15,000 ft

Cabin altitude 15,000 ft is near the hypoxia-danger band (failure in seconds at 25,000 ft; in minutes at 15,000 ft). Closing the valves reduces the cabin air loss → slows the pressure drop → gives the occupants and crew more time. The bleed inflow continues, so the cabin-altitude rise slows. Backstop: if there is cabin fire/smoke with the valves closed, the safety valves still work on ΔP (relieve above 8.85 PSI); if RAM AIR is on, the 50 %-open rule takes priority (integrative — the FCOM does not state this). A pilot can override into manual mode to open the valves (an emergency descent may want the flow) — but at 15,000 ft most crews are already on oxygen and descending, so this is a rare real case.

17. Outflow-valve fail-safe design

They are of failsafe design: If there is a failure in the valve drive, the differential pressure between the inside and outside of the aircraft in combination with the external airflow closes the valve. — AMM 21-31-00 §3.C

[!note]- The outflow valve closes by airflow even with no motor

The flap is force-loaded on both faces: inside cabin pressure pushes it open / outside pressure + airflow pushes it closed. In cruise the cabin pressure > ambient → the net force is "open", so a motor is needed to control the opening. On a drive failure → the valve loses active control → the external airflow becomes the dominant force → the valve moves toward the closed position. Closed = pressurisation retained = the crew has time to react. This is a fail-to-closed design — a drive failure does not leave the valve at a random position; the airflow physically pushes it near closed, retaining cabin pressure.

18. Single / dual failure + manual mode + RPCU

Manual-mode entry: press MODE SEL pb (14HL, MAN light on); lift the guard and set MAN VALVE SEL (8HL) to AFT / FWD / BOTH; push MAN V/S CTL (5HL) UP to decrease pressure (cabin altitude up) / DN to increase pressure (cabin altitude down) — spring-returned to neutral. Exit: press MODE SEL again — the active and backup controllers swap (the useful side effect).

[!warning]- RPCU drives the manual motor directly — bypassing the controllers

One might ask "with both controllers failed, how does the RPCU drive the outflow valves?" — the RPCU does not go through the controllers; it uses external relays (22HL + 23HL) to put 28 V DC (from the permanent essential bus 301PP) directly on the manual motors (313HL5 + 315HL5). This is the last fail-safe: all controllers failed + on the ground + stationary + residual pressure not released → the RPCU opens the outflow valves to release the residual pressure, so passengers are not knocked over by a sudden airflow when a door is opened on the ground.

ECAM failure indications: a safety valve open on the ground (or open > 60 s in flight) → CAB PR SAFETY VALVE OPEN; an outflow valve < 100° open for > 70 s on the ground → CAB PR FWD (AFT) OFV NOT OPEN (per AMM 21-31-00 §7.D — on the ground the valves should be fully open at 100°, the ground mode).

Self-test

[!note]- Q1. How do the CPC changeover rules compare with the pack controller's?

Same: both are dual-channel controllers in rack 800VU, both auto-swap on failure. Different: the pack controller swaps "at end of flight if no fault" (a fault stops the swap); the CPC swaps "after each flight or on failure" (routine + failure both trigger). The reason: a CPC failure is severe (cabin altitude affects everyone's life), so it uses a more aggressive "use both" strategy — the routine swap keeps both controllers in regular use and avoids backup aging.

[!note]- Q2. What are the automatic and manual-backup parts, and which feeds the ECAM cabin altitude in manual mode?

The automatic part = a microprocessor digital circuit (ARINC + discrete inputs + computation + BITE). The manual-backup part = an analogue circuit (independent of the digital microprocessor). Controller #1's backup section has an independent power supply + an independent pressure sensor — in manual mode it feeds the ECAM cabin altitude + ΔP. The automatic part is high precision; the backup section is coarse (~±1000 ft). The philosophy: manual mode is a true emergency fallback, independent of the digital microprocessor / power / sensor.

[!note]- Q3. What advantage does the vibrating-cylinder sensor have over a strain gauge?

A metal cylinder vibrates at its natural frequency; an external pressure change alters its material stress → its vibration frequency → frequency is read, pressure inferred. Advantages: extreme stability (no drift — frequency is a physical quantity, not an aging element), low temperature drift (compensable), very high precision (< 0.01 %), direct digital output. Cost: expensive, long life. Failure shows as a frozen value or a step jump, not a slow drift — so the crew can trust the ECAM cabin-altitude digit.

[!note]- Q4. When does each BITE type run, and can the crew see it?

PUBIT (power-up): after cold start / reset (power off > 200 ms), air or ground, ≤ 2 s. SCBIT (state-change): ground only, starting 70 s after landing, ≤ 45 s — the reason for "odd outflow-valve behaviour just after touchdown". IBIT (initiated): ground only, maintenance-triggered via the MCDU, ≤ 45 s, required around an LRU change. CBIT (continuous): always running. The crew sees the indirect SCBIT effect — a brief ECAM PRESS anomaly 70–120 s after landing that self-clears within ~1 minute is normal SCBIT.

[!note]- Q5. Why does the aft outflow valve close on single-pack operation + ΔP > 4 PSI? Is it a fault?

Not a fault — an FCOM design behaviour. A single pack delivers ~60–120 % of one pack's capacity; if both valves opened by their automatic ratio, the single pack's inflow could not keep up with the two valves' release → ΔP hard to hold. Closing the aft valve halves the release area, letting the forward valve alone hold ΔP. The trigger ΔP > 4 PSI means it occurs only at high-altitude cruise. On single-pack operation, the ECAM aft-valve "closed" is a normal indication.

Key takeaways

Common misconceptions

Scope — what this deep-dive covers and defers

References

A330 specifics per FCOM DSC-21-20-20 (the two CPCs, the six ARINC inputs, the CCDL, the controller #1 backup section, the two outflow valves with three motors each, the single-pack ΔP > 4 PSI aft-valve close, the RAM AIR 50 % open, the 15,000 ft auto-close, the safety/negative-relief valves and RPCU) and AMM 21-31-00 §1/§2/§3/§5/§6/§7/§8 (the rack 800VU location and CCDL, the automatic + manual-backup architecture and changeover rules, the eight automatic functions, the vibrating-cylinder sensor, the PIN programming, the four BITE types with their timings, the LDG ELEV selector range and detent, the three operating modes, the outflow-valve fail-safe design, the discrete interfaces, the RPCU driving the manual motors directly from essential bus 301PP, and the ECAM failure indications) — the English AMM being the fact source where the Chinese FCOM carries no AMM content. The changeover-aggressiveness rationale, the vibrating-cylinder vs strain-gauge comparison, the single-pack flow-balance reasoning, and the 15,000 ft life-protection logic are integrative syntheses. All engineering detail is from the A330 knowledge base; no cross-type comparison is made, and no fleet tail numbers appear.

Independent study material, not an Airbus publication and not endorsed by the manufacturer. Always defer to the current operator FCOM, FCTM, and QRH for operational use.