Safety Valves, Negative-Relief Valve & RPCU — The Mechanical Backstop

Cabin Pressure Controller and Outflow Valves gave the software + hardware + motor layers. This deep-dive opens up the mechanical backstop — three safety valves, one negative-pressure relief valve, one Residual Pressure Control Unit (RPCU). All three are built from pure pneumatics / springs / simple electrics, and none depends on the cabin pressure controllers, the outflow-valve motors, or any digital control system. Even with the avionics unpowered and every computer dead, these three still protect the physical pressure limits and release residual pressure on the ground — the true fail-safe layer.

1. Three parts — location

   ┌──────────────────────────────────────────┐
   │  ABOVE the flotation line                 │
   │    safety valve 1 (316HL)  aft pressure   │
   │    safety valve 2 (317HL)  bulkhead       │
   │    safety valve 3 (318HL)  (all three)    │
   │                                           │
   │══════════════════════════════ flotation line
   │                                           │
   │  BELOW the flotation line                 │
   │    fwd outflow valve (313HL)              │
   │    aft outflow valve (315HL)              │
   │    negative-relief valve (5319HL)         │
   │      forward lower fuselage               │
   └──────────────────────────────────────────┘
   RPCU (314HL): avionics bay, right; 28 V DC essential bus 301PP;
                 external relays 22/23HL; not on a rack

[!warning]- The safety valves sit above the flotation line — so they stay dry in a ditching and may remain free to operate

Compare the outflow valves below the flotation line: below-the-line openings (outflow valves) are closed by the DITCHING pb to keep water out; above-the-line parts (the safety valves on the aft pressure bulkhead, and the negative-relief valve forward but above the waterline) are not on the DITCHING close list. So even in a ditching, if the cabin pressure goes abnormal, the safety valves can still pneumatically relieve or admit air — not overridden by the DITCHING pb. This above/below differentiation is the design logic.

[!note]- All three safety valves are at the same location (the aft pressure bulkhead) — not dispersed

One might expect "three safety valves" to be spread around the airframe. They are all on the aft pressure bulkhead. A pneumatic mechanical valve needs no dispersed redundancy; one location is easier to maintain (one access panel, one test procedure); the three work in parallel — one open is enough to protect ΔP, so even with two failed the third still works. Maintenance runs one "safety-valve position-indication operational check" (AMM 21-31-00-710-805-A) for all three.

2. The three parts — function

The safety + negative-relief valves protect the ΔP limits in flight (mechanically triggered); the RPCU releases residual pressure on the ground (electrically triggered, but not through the CPC).

3. Safety valve — poppet-type pneumatic valve

The safety valves 316HL (317HL, 318HL) are poppet-type pneumatic valves. The safety valve have a valve part and a control part in a housing. The valve part has a cap with a filter, a diaphragm, an adapter and a bell mouth. The control part has a position switch, a poppet valve and a control valve. — AMM 21-31-00 §6.D

   ┌──────────[ SAFETY VALVE internal ]──────────┐
   │  VALVE PART:                                 │
   │    cap + filter (316HL1) → filters the air   │
   │    diaphragm (spring-loaded)                 │
   │    adapter + bell mouth (flow path)          │
   │  CONTROL PART:                               │
   │    position switch → SDAC → ECAM             │
   │    poppet valve (opens if external P > int.) │
   │    control valve: diaphragm + stem + helical │
   │      spring; stem = accurate limit control   │
   │        ΔP > +8.847 PSI → stem moves → relieve │
   │        ΔP < −0.261 PSI → stem moves → admit   │
   └──────────────────────────────────────────────┘

4. Bidirectional thresholds — +8.847 PSI / −0.261 PSI

The poppet valve opens if the external pressure is more than the internal pressure. The control valve has a diaphragm, a stem and a helical spring to hold the stem in position. The stem gives accurate limit control. If the internal pressure is more than 0.61 bar (8.847 psi) above the external pressure, the stem moves and air flows out of the fuselage. If the internal pressure is more than 0.018 bar (0.261 psi) below the external pressure, the stem moves and air flows into the fuselage. This equalizes the pressure. — AMM 21-31-00 §6.D

[!warning]- The thresholds are asymmetric: +8.847 PSI overpressure but only −0.261 PSI negative

+8.847 PSI is near the structural max ΔP (the fuselage is designed for 8.6 PSI cruise + a small margin). −0.261 PSI is very small (1.8 kPa). Why so small on the negative side: the fuselage withstands inside-out pressure far better than outside-in (it is designed as "internal pressure holding the shell out"; reversed, the shell tends to buckle inward). So 0.261 PSI of negative ΔP immediately opens the valve to admit air and prevent structural deformation; a rapid descent with the cabin lagging is the classic negative-ΔP case, and the valve must respond at once. Pilot meaning: never deliberately let the cabin pressure fall below ambient — it is a structural-damage risk, more dangerous than overpressure; in manual mode, when descending the cabin, stop reducing pressure as ΔP nears 0.

5. Safety-valve filter

The safety valve filters 316HL1 (317HL1, 318HL1) are installed in the safety valves 316HL (317HL, 318HL). They filter the air that goes through the pressure actuator if the safety valves operate. — AMM 21-31-00 §3.D (1)

When a safety valve operates, the air passing through the pressure actuator is filtered, protecting the actuator's diaphragm / stem / spring from particles. A clogged filter slows or disables the valve — a design risk — so it is a periodic-replacement item; MMEL 21-31-03A provides the safety-valve dispatch condition.

6. Position switch → SDAC → ECAM

The position switch is connected electrically to the System Data Acquisition Concentrators (SDACs). — AMM 21-31-00 §6.D

[!note]- The safety valve itself is pure mechanical/pneumatic — but the position switch is electrical

The valve's operation (open/close) needs no electrical power — pure pneumatic / spring / mechanical; even with the aircraft fully unpowered it still triggers on ΔP. The position switch needs power, to report the valve's position to the SDACs so the crew can see it on the ECAM. So with no power the valve still works but the ECAM does not show the position change (it works silently); when power returns the switch reports the position and the ECAM updates. Pilot meaning: in an emergency, do not worry whether the safety valve is working — it works mechanically; the ECAM is for your awareness only.

7. A specific configuration (FSN 105–150)

ON A/C FSN 105-150 (1) Valve Assembly. The valve assy has an aluminum housing with a spring loaded diaphragm and a deflector with a built-in check valve. The chambers (cabin chamber and servo chamber) at both sides of the diaphragm have access to the cabin pressure via orifices. — AMM 21-31-00 §6.D (1), FSN 105-150 effectivity

Some airframes carry a slightly different internal valve assembly (aluminium housing, spring-loaded diaphragm, a deflector with a built-in check valve, chambers fed via orifices). Spares must be held to the effectivity.

8. Negative-pressure relief valve (5319HL)

The negative-pressure relief valve 5319HL is installed in the forward lower fuselage. It prevents too much negative differential pressure in the fuselage. It is installed because of the large volume of the aircraft. The negative-pressure relief valve 5319HL prevents possible negative pressure in the fuselage. It is a rectangular mechanical valve. Four springs hold it in position on four spring rods. A seal is installed to prevent air leaks when the valve is closed. There are mechanical stops to prevent damage to the seal. If the pressure in the fuselage is less than the external pressure, the valve opens and air flows in. When the pressure in the fuselage is the same or more than the external pressure then the springs or the pressure difference closes the valve. — AMM 21-31-00 §3.E + §6.E

[!note]- The negative-relief valve and the safety valves both guard against negative ΔP — but they are different designs

Feature	Safety valves (3)	Negative-relief valve (1)
Trigger	opens at −0.261 PSI	mechanical, set directly by the inside/outside difference
Structure	poppet pneumatic + spring + diaphragm + control valve	rectangular valve + 4 springs + 4 spring rods
Flow	smaller (poppet bore)	larger (rectangular opening)
Response	slower (pneumatic + control circuit)	very fast (pure mechanical)
Location	aft pressure bulkhead (3 together)	forward lower fuselage (separate)

Why the aircraft needs a negative-relief valve in addition to the safety valves: the AMM states it directly — "because of the large volume of the aircraft." A large cabin volume means a rapid descent produces a large pressure-difference change per unit time → the cabin lags the rising external pressure → a strong negative ΔP. The safety-valve flow alone is not enough → the negative-relief valve provides a larger flow to equalise quickly, and being purely mechanical it responds faster. Dual protection: the safety valves give a precise ΔP limit, the negative-relief valve gives a large fast flow.

9. Negative-relief valve operational test

Operational test of the negative pressure-relief valve. (1) Push the negative pressure-relief valve to the fully open position. (2) Release the negative pressure-relief valve. (3) Make sure that the negative pressure-relief valve closes correctly. — AMM 21-31-00-710-806-A

[!note]- A mechanical valve — maintenance pushes it open by hand, with no power

The test is almost unbelievably simple: push the valve fully open by hand, release it, and check that the springs + gravity close it correctly. No power, no signal, no test equipment — pure mechanical action. This is the extreme of the "fail-safe pure mechanical" philosophy: a simple test, low maintenance cost, an obvious failure mode.

10. RPCU (314HL) — physical detail

The Residual Pressure Control Unit (RPCU) is an electronic box with 2 connectors for the electrical interface connection. The RPCU is not attached to a rack and has no local controls or indicators. The RPCU is permanently connected to the 28VDC essential bus 301PP and has a discrete 28VDC output for the power supply of the manual motor of the outflow valve. — AMM 21-31-00 §6.F

[!warning]- The RPCU is an electronic box, but not in an avionics rack — mounted directly to the avionics-bay structure

Most avionics live in a rack (rack 800VU etc.); the RPCU is one of the few "standalone-mounted" units. Why: it is permanently on the 28 V DC essential bus (no need for a rack's common power interface); it needs no cooling / ARINC / discrete I/O (just two connectors); it has no local control or indicator (fully automatic — maintenance never operates it); mounting it to the structure is more stable, better vibration-isolated. Pilot meaning: the RPCU is one of the least attention-needing units on the aircraft — it works silently, rarely fails, and maintenance only inspects it periodically.

11. RPCU — four conditions + the flow

The Residual Pressure Control Unit (RPCU) 314HL controls the residual pressure in the cabin if: There is a failure in the two automatic control parts of the CPCS; The CPCS is set to the manual mode. The RPCU opens the outflow valves automatically after landing if: The outflow valve is not fully open; The CPCS is in manual mode or there is a failure of the two CPCs; The crew did not open the outflow valves in the manual mode. ... It uses the external relays 22HL and 23HL to supply power directly to the manual motors of the outflow valves 313HL5 and 315HL5. — AMM 21-31-00 §3.F

   normal flight: outflow valves controlled by the active CPC; RPCU on standby
        ▼ landing
   LGCIU reports ground; valves should reach 100° within ~80 s
        ▼ abnormal
   ① outflow valve < 100° (not fully open)
   ② dual-CPC failure OR pilot selected manual mode
   ③ on the ground (LGCIU)
   ④ all engines stopped OR ADIRS speed < 100 kt
        ▼ all four met
   RPCU activates → external relays 22/23HL → 28 V DC (essential bus 301PP)
   directly to the manual motors 313HL5 + 315HL5 (bypassing the CPC + actuators)
        ▼
   manual motors run → gearbox drives the gates → valves fully open
        ▼
   residual pressure released → doors safe to open

[!warning]- The RPCU is one of the few electrical units that "actively saves the day" — the pilot does nothing

Most systems are "pilot acts + system assists". The RPCU is the opposite: it judges all four conditions automatically and activates with no crew action. Pilot meaning: after landing, if the ECAM still shows PRESS abnormal + the valves not fully open, wait a few minutes for the RPCU to step in; if the four conditions are not all met (e.g. ADIRS speed still > 100 kt while taxiing), the RPCU does not activate — wait until parked + engines off. There is no RPCU pushbutton to press (no local control).

12. Three-part coordination — a rapid descent producing negative ΔP

   rapid descent (e.g. emergency descent)
        ▼ external pressure rises fast (6000+ ft/min)
   cabin pressure lags (the controller's valve rate is limited)
        ▼ cabin < ambient → negative ΔP builds
        ├─ ΔP near −0.261 PSI → safety-valve stem moves → air in (small, precise)
        └─ cabin stays below ambient → negative-relief valve opens → air in (large, fast)
        ▼ cabin pressure recovers toward ambient
   ΔP near 0 → both close → cabin safe

13. ECAM — safety valve open

Safety Valve Open. If a safety valve 316HL (317HL, 318HL) is open on the ground or open for more than 60 seconds in flight: a single chime is heard, the amber MASTER CAUT lights come on, ... CAB PR SAFETY VALVE OPEN and the necessary steps are shown, a related failure message is sent to the Central Maintenance System (CMS), ... the PRESS page comes on and the safety valve symbol is shown amber and open. — AMM 21-31-00 §7.D (1)

[!warning]- In flight, a safety valve open for 60 s triggers the ECAM — it does not warn the instant it opens

A brief open (< 60 s) in flight is normal: a cruise ΔP spike near 8.847 PSI opens the valve for a few seconds to relieve, then it closes; a rapid descent has it briefly admit air, then close. The 60 s threshold means "open continuously for over 60 s" → a persistent ΔP anomaly (not a transient) → a real problem for the crew. On the ground it triggers immediately — the cabin should be fully depressurised, so any open is abnormal. Pilot meaning: a brief amber symbol for a few seconds → no concern, no ECAM; persistent amber > 60 s → ECAM caution → handle per the procedure.

14. MMEL 21-31-03A — safety-valve dispatch

MMEL 21-31-03A PRESSURE SAFETY VALVE — AMM 21-31-00-440-806-A (Reactivation of the Safety Valve)

[!note]- The MMEL allows dispatch with a safety valve inoperative — the benefit of three-fold redundancy

One might think "a failed safety valve grounds the aircraft". In fact the three valves are redundant, and dispatch with one inoperative is permitted (per the operator MMEL), because two working valves still protect the ΔP limits. The inoperative valve is secured closed (per the AMM deactivation procedure) and does not take part in ΔP protection. Redundancy = flexible dispatch = fewer maintenance delays. Specific conditions/limitations are in the operator MMEL.

Self-test

[!note]- Q1. Where are the three safety valves, and why above the flotation line?

On the aft pressure bulkhead, all three together, above the flotation line. Below-the-line openings (outflow valves, negative-relief valve) are closed by the DITCHING pb to keep water out; above-the-line parts (safety valves) are not — so even in a ditching they can still pneumatically relieve/admit air. Same location for all three: a pneumatic mechanical valve needs no dispersed redundancy; one location eases maintenance; the three work in parallel — one open is enough, so even two failed leaves the third working.

[!note]- Q2. The +8.847 / −0.261 PSI thresholds — why asymmetric?

Structural asymmetry. Inside-out (positive ΔP): the fuselage is designed for 8.6 PSI + margin → +8.847 PSI. Outside-in (negative ΔP): the shell buckles inward easily → low tolerance (0.3 PSI class) → only −0.261 PSI before the valve admits air. Pilot meaning: never deliberately let the cabin fall below ambient — a structural risk worse than overpressure; in manual mode, stop reducing cabin pressure as ΔP nears 0.

[!note]- Q3. Why a separate negative-relief valve — aren't the safety valves enough?

The AMM states it directly: "because of the large volume of the aircraft." A large cabin volume → a rapid descent produces a large ΔP change per unit time → the cabin lags the rising external pressure → a strong negative ΔP. The safety-valve flow alone is insufficient → the negative-relief valve gives a larger flow (rectangular opening vs poppet bore) and a faster response (pure mechanical, 4 springs + 4 rods, vs pneumatic + control circuit), at a separate location (forward vs aft). Dual protection: precise limit + large fast flow.

[!note]- Q4. Is the RPCU a computer or a relay? Its relation to the CPC? Does it go through the CPC?

An electronic box (a simple electronic circuit + two connectors, permanently on the 28 V DC essential bus). Not a computer (no CPU, software, or ARINC). Not a simple relay (it has the four-condition logic). Fully independent of the CPC. Flow: four conditions met → RPCU activates → not through the CPC → external relays 22/23HL → 28 V DC direct to the manual motors 313HL5/315HL5 → gearbox drives the gates open. The "both controllers failed and it still works" hardware backstop.

[!note]- Q5. Why does an in-flight safety valve trigger the ECAM at 60 s but a ground open triggers immediately?

A brief in-flight open (< 60 s) is normal (a cruise ΔP spike relieves; a descent admits air). The 60 s threshold means a persistent ΔP anomaly, not a transient. On the ground the cabin should be fully depressurised — any open is abnormal, so it triggers immediately. Brief amber for a few seconds → no concern; persistent > 60 s → ECAM → handle.

Key takeaways

Common misconceptions

Scope — what this deep-dive covers and defers

References

A330 specifics per AMM 21-31-00 §3.D/§3.E/§3.F + §6.D/§6.E/§6.F + §7.D(1) (the three poppet-type pneumatic safety valves on the aft pressure bulkhead above the flotation line, the valve/control-part construction, the +0.61 bar/8.847 PSI relieve and −0.018 bar/0.261 PSI admit thresholds, the safety-valve filter, the position switch to the SDACs, the FSN 105-150 valve-assembly configuration, the rectangular negative-relief valve with four springs on four spring rods installed forward "because of the large volume of the aircraft", the RPCU as a standalone electronic box on the 28 V DC essential bus 301PP driving the manual motors directly via relays 22/23HL, and the safety-valve-open ECAM logic) and AMM 21-31-00-710-805-A / -710-806-A / -440-806-A (the position-indication check, the by-hand negative-relief-valve test, and MMEL 21-31-03A reactivation), with FCOM DSC-21-20-20 for the system-level safety/negative-relief/RPCU description. Where the FCOM safety-valve figures differ slightly from the AMM (the AMM precise values are used here), the AMM governs. The above/below-flotation-line differentiation logic, the structural reason for the asymmetric thresholds, and the RPCU "electronic box, not a relay, not a computer" categorisation are integrative syntheses. All engineering detail is from the A330 knowledge base; no cross-type comparison is made, and no fleet tail numbers appear.

Independent study material, not an Airbus publication and not endorsed by the manufacturer. Always defer to the current operator FCOM, FCTM, and QRH for operational use.