AFS Architecture and the FMGES

The Auto Flight System is the hub of the A330's fly-by-wire-plus-automation design: it packs navigation (where am I, where am I going), guidance (how do I fly there), and envelope protection data (never leave the safe boundary) into one pair of computers. This opening article builds the skeleton that the rest of the chapter hangs on — the boxes, the redundancy philosophy, the databases, what survives a power blink, and how to know which optional functions your particular aircraft actually has. Component detail on the FCU comes in article 02, the MCDU in article 03, engagement logic in article 05, the dual-FM system in article 19, and resets in article 29.

Three names first, because Airbus uses them precisely. Per AMM 22-00-00:

The Auto Flight System (AFS) comprises : - two Flight Management, Guidance and Envelope Computers (FMGECs), - one Flight Control Unit (FCU), - three Multipurpose Control and Display Units (MCDUs).

The Flight Management, Guidance and Envelope System (FMGES) includes the computers, control units and associated peripherals.

So: FMGEC is the computer itself (a box in the avionics bay, one per side); AFS is the set of two FMGECs plus their controllers (one FCU, three MCDUs); FMGES is the whole system including the peripherals. Note what is absent: the A330 has no separate FAC and no separate FMC. Flight-envelope computation and flight management both live inside the FMGEC — which is exactly why the computer's name is so long.

1. One box, four crew members

The FCOM defines the internal split that structures this entire chapter. Per FCOM DSC-22_10-10:

Each FMGEC is divided in four main parts: ‐ The Flight Management (FM) part controls the following functions: • Navigation and management of navigation radios • Flight planning and management • Performance prediction and optimization • Display management. ‐ The Flight Guidance (FG) part performs the following functions: • Autopilot (AP) command • Flight Director (FD) command • Autothrust (A/THR) command.

The Flight Envelope (FE) part controls the following functions: • Computation of data for the flight envelope and speed functions • Monitoring of parameters used by FG and FE parts • Windshear and aft Center of Gravity (CG) detection • Computation of GW and CG information.

The Fault Isolation and Detection System (FIDS) part performs the following functions: • Acquisition and concentration of maintenance data • Interface with the Central Maintenance Computer (CMC).

A serviceable mental model: one body, a crew of four. FM is the navigator (thinks about the route, the fuel, the predictions). FG is the pilot flying (moves the surfaces and the thrust — AP, FD, A/THR commands). FE is the safety pilot (computes the characteristic speeds and envelope data, watches the parameters, detects windshear and aft CG, computes gross weight and CG). FIDS is the maintenance representative (collects fault data for the CMC). The AMM adds the structural point that matters in failure scenarios: per AMM 22-00-00, the FMGES is made up of four sections functionally independent. Functionally independent means FM can die while FG keeps flying the aircraft (the AP reverts to basic modes — article 19), and FG or FM can die while FE keeps computing your speed cues (article 18).

2. Where things live and how signals flow

Physically: FMGEC 1 sits in avionics-bay rack 841VU, FMGEC 2 in rack 842VU. The three MCDUs and the FCU are in the cockpit (centre pedestal and glareshield). Two lesser-known controls belong to the family: the NORTH REF pushbutton (overhead) and the SWITCHING/FM source selector (pedestal).

                ┌────────── FCU (glareshield, short-term orders) ─────────┐
  Pilots ─────► │  AP1 / AP2 / A-THR engage pb ──(hardwired discretes)──► │
                └───────────────┬──────────────────────────────────────────┘
                                ▼  AFS buses (x4, engine-segregated)
  MCDU x3 (long-term orders) ◄──► FMGEC 1 ◄──(intersystem bus)──► FMGEC 2
                                │
        ┌───────────────────────┼─────────────────────────────┐
        ▼ AP surface commands   ▼ A/THR thrust command         ▼ display data
   FCPC 1/2/3 ──► surfaces   FCU ─► EIVMU 1/2 ─► ECU/EEC    DMC 1/2/3 ─► PFD/ND
   (AP inner loop)            (FADEC executes)               FWC ─► ECAM warnings

Two execution chains are worth memorising, because every later failure story runs along one of them. Per AMM 22-00-00:

The system sends : - the surface deflection commands for the AP function to the Flight Control Primary Computers 1, 2 and 3 (FCPC). - the thrust command for the A/THR function to : . the Engine Control Unit 1 (ECU1)/Electronic Engine Control 1 (EEC 1) (to set the thrust command on the engine 1) via the Engine Interface Vibration Monitoring Unit 1 (EIVMU 1), . the ECU 2/EEC 2 (to set the thrust command on the engine 2) via the EIVMU 2.

So the AP never moves a surface itself — it sends outer-loop commands to the flight-control primary computers; and the A/THR never moves a throttle lever — it sends a thrust command through the FCU and the engine-interface units to FADEC. Which leads to the design decision every Airbus pilot must internalise. Per AMM 22-00-00:

The side stick controllers and the throttle control levers do not move when the AP and the A/THR are engaged.

No back-driving. The AP flies and the stick stays still; the A/THR changes thrust and the levers stay put. Your only window into what the automation is doing is the FMA plus the energy parameters — not the position of the controls. This single hardware fact is the root of the FCTM's thrust-monitoring philosophy developed in article 16. (The only "motion" on the stick side is that AP engagement energises locking coils that raise the stick and pedal force thresholds — article 05.)

The complete cockpit interface set, for orientation: controls = FCU, MCDUs, RMPs (backup navaid tuning); indications = PFD (with the FMA), ND, E/WD, SD; miscellaneous = sidestick takeover pushbuttons, A/THR instinctive-disconnect pushbuttons, NORTH REF pushbutton, SWITCHING/FM selector; warnings = MASTER WARN/MASTER CAUT, the red AUTO LAND light, and the DATA LINK advisory light. Each is developed in its own article.

3. Dual-dual — two locks on the same door

For AP and A/THR the redundancy is layered twice. Per AMM 22-00-00:

The FMGES is a dual-dual type system for the AP and A/THR functions.

Read "dual-dual" as two separate duals. The first dual: two FMGECs, each able to back the other up. The second dual: inside each FMGEC, the computation runs in a command channel and a monitoring channel. And the second dual is not two copies of the same thing. Per AMM 22-83-00:

The command and monitoring channels are physically segregated and the programs of the computation are dissimilar.

Each channel has its own I/O, processor, memory, and power supply, with unsynchronised clocks; the two cross-compare over ARINC 429 plus a few hardwired discretes. The point of dissimilar programs: one software bug cannot fool both channels at once. That dissimilarity is the root of why an FMGEC is trusted to land the aircraft in CAT III conditions (article 12).

Contrast this with the FCU in article 02: the FCU's two channels run the same software. The FCU is a messenger (selection and display); the FMGEC is a decision-maker whose outputs move flight controls. Different safety stakes, different redundancy philosophy.

One more architectural conviction. Per AMM 22-83-00:

all operational functions are performed by the software, and only a few safety critical items such as part of the internal monitoring and the engagement logic (AP/FD/A/THR) are implemented in the hardware.

Engagement logic in hardware means that "disengage the AP" stays reliable even if software dies — and it mates with the fact that the FCU's AP pushbuttons send hardwired discretes that bypass software processing (article 02): button to engagement logic is a pure-hardware chain.

How the four parts occupy the two channels (from AMM 22-83-00):

FM having no monitoring channel is not an oversight. FG and FE outputs move the aircraft, so they must self-monitor; an FM output (a route, a prediction) has people looking at it. FM's "monitor" is the other FM: the two FM parts cross-compare, and when key parameters disagree the system drops to INDEPENDENT operation with the amber IND light on the MCDUs (article 19). This is also why FM-side operating discipline is built on both pilots entering and cross-checking data.

And who is the boss? Priority is literally wired in. Per AMM 22-84-00:

the side 1 signals (CMD and MONG) wired to the ground on the FMGEC1 only (priority).

The operational master then slides with what is engaged — AP1 engaged → FMGEC 1 is master; only AP2 → FMGEC 2; only FD1 → FMGEC 1; nothing engaged → FMGEC 1 if valid (the full ladder is in article 05). But the built-in preferences (FIDS residence, default mastership) all sit on side 1 — one reason an operator's MEL treats FMGEC 1 failure more restrictively than FMGEC 2 (article 32).

4. Five databases, two of them yours

Per FCOM DSC-22_10-10:

Each FMGEC has its own set of databases. The individual databases can be independently loaded into their respective FMGEC, or independently copied from one FMGEC to the other.

The five, and who may change them:

On the update mechanics, per FCOM DSC-22_10-10:

The airline updates this part every 28 days, and is responsible for defining, acquiring, updating, loading, and using this data. The update operation takes 20 min to complete, or 5 min if crossloaded from the opposite FMGEC.

A configuration marker worth knowing: pilot-stored capacity identifies the FMS vendor. On Thales-equipped aircraft, per FCOM DSC-22_10-10:

Each FMGEC contains element stored by the flight crew that enable them to generate 99 waypoints, 10 runways, 20 navaids and 5 routes.

The Honeywell-equipped variant of the same FCOM page reads 20 waypoints, 10 runways, 20 navaids and 5 routes — so "99 versus 20 stored waypoints" is a quick tell of which FMS2 you are flying. Loading procedure and crossload operations are in article 04; database-validation requirements for RNAV/RNP operations are in article 34.

5. Power — and three different lengths of memory

The two FMGECs are deliberately fed from opposite sides of the electrical system: FMGEC 1 from the 28 VDC SHED ESS bus, FMGEC 2 from DC BUS 2; FCU side 1 from the DC ESS bus, FCU side 2 from DC BUS 2; MCDU 1 from AC ESS SHED, MCDU 2 from AC BUS 2 — and MCDU 3 from the AC ESS/STATIC INVERTER/SHED bus, which is why "MCDU 3 only" is what survives a battery-only electrical state (article 31). A dedicated FMGEC power-split relay (AP ELEC PWR SPLIT) guarantees each FMGEC an independent AC and DC source — this relay is the physical object behind the "ELECTRICAL POWER SUPPLY SPLIT" line in the CAT 3 DUAL equipment table (article 12). In the electrical emergency configuration, only FMGEC 1 remains supplied (on the emergency generator; on batteries alone, none) and the FCU is on a single channel throughout — the operational fallout is article 31's subject. (Honeywell-configured airframes route FMGEC 1 from DC BUS 1 instead — the two configurations differ in supply wiring, so quote by configuration.)

Now the part that answers a very practical question: the power flickers in turbulence — does the AP drop? Do my FCU selections survive? Is the flight plan gone? The FMGEC grades power interruptions into three tiers. Per AMM 22-83-00:

Short Power Fails (SPF): the cutoff duration is comprised between 10 ms and 200 ms. During this cutoff, the data in RAM memories and hardware engaged logic are saved. Upon power restoration, the computer restarts in the same configuration.

Long Power Fails (LPF): the cutoff duration is comprised between 200 ms and 5 s. Complete initialization of the system is performed, indicating the nature of the cutoff; the protection of data stored in the RAMs cannot be longer than 500 ms, except for the FM RAM that is backed up by the battery.

Very Long Power Fails (VLPF): the cutoff duration is longer than 5 s which leads to an automatic reset identical to a manually commanded hardware reset; it leads to safety tests on ground too.

And at system level, two recovery thresholds. Per AMM 22-84-00:

The FCU retrieves any selected data after an interruption of 5 min duration or less.

The FM retrieves the flight plan data for display on the MCDU whatever the interruption is.

Three different memory spans, then: below 200 ms the whole system is transparent — engaged logic saved, the computer restarts in the same configuration, the AP does not even drop. The FCU's memory for your selected speed/heading/altitude/V-S values lasts 5 minutes. The flight plan's memory is effectively unlimited — battery-backed FM RAM. (Honeywell-configured aircraft document their own figures: FMS/MCDU auto-recovery within 10 s on ground, and the same flight plan recoverable within 10 min in flight.) Reset procedures and the escalation rules live in article 29.

6. Interfaces built to shrug off single failures

One sentence from the AMM is a design principle you can lean on throughout the chapter. Per AMM 22-00-00:

The interconnection between the FMGECs and the peripherals is accomplished in such a way that a single failure of a peripheral has no effect on the AFS functions.

One ADIRU, one DMC, one MCDU failing — the AFS is designed not to notice. Whenever a later article discusses "single X failure", start from this sentence, then look at the specific degradation chain.

The thrust chain carries an extra cross-check. Per AMM 22-00-00:

To consolidate engine data, the FMGEC which has priority compares the output thrust target parameter from the FCU with its own available data by means of associated logic. Each FMGEC receives four buses for computation : two buses associated with the own side, two others associated with the opposite side.

Mechanically: the A/THR command path is FMGEC → FCU → EIVMU → FADEC, with the FCU acting purely as a relay (article 02 — its four AFS output buses carry identical content, split for engine segregation). The priority FMGEC then reads back the thrust target the FCU is re-broadcasting and compares it with its own data — the order-giver personally checking the messenger, protecting against transmission-layer corruption. It also explains why resetting an EIVMU costs A/THR on all engines plus the FLX/DRT data path (article 29): the interface box next to the messenger went down.

On the display side, the PFD receives the guidance targets, armed/engaged modes, engagement status and system messages, while the ND receives the flight plan, position and track, navigation elements and estimates. In other words: the FMA is FG's face, and the ND is FM's face (article 06 and article 27). Note also that the AFS's EFIS displays are driven through the DMCs, while ECAM warnings are generated by the FWCs — two independent data chains. The FMA shows what the FMGEC says about itself; ECAM shows what the FWC observes about the FMGEC. Complementary, not redundant copies.

7. FIDS and the ground-test gate

Three facts about the maintenance side are pilot-relevant. First, per AMM 22-00-00:

This function is performed in the FMGEC installed on the side 1 of the aircraft.

FIDS exists once, on FMGEC 1's command side: the concentrator of BITE reports from FE, FG, FM, FCU and MCDU, interfacing with the CMC. Its watchdog can trigger automatic resets — three unsuccessful attempts and the fault is latched.

Second, why maintenance tests cannot run in flight. Per AMM 22-90-00:

The FIDS only accepts the test request if its ground condition is met (NOSE GEAR PRESSED and ENGINES STOPPED).

And the LRU under test re-checks the same ground condition itself — a double gate — while test software has read-only access to operational software.

Third, the LAND test concept: after AFS component replacement (FCU, FMGEC), an aircraft operated to CAT III must pass a LAND CAT III capability test, which only starts once FIDS has collected acceptance from all four computation lanes (FG1 and FG2, command and monitoring each). The pilot-level takeaway: the CAT 3 capability you read on the FMA is not merely "installed equipment" — a dedicated ground verification stands behind it (article 13).

8. Two operating principles the architecture dictates

Short-term versus long-term orders. Per AMM 22-00-00:

The operational use of the AFS is based on the following principle: - the short-term pilot orders are entered through the FCU, - the long-term pilot orders are entered through the MCDU. This principle leads to two distinct operations : SELECTED and MANAGED controls.

Pull the knob and the aircraft obeys the FCU — selected. Push the knob and the aircraft obeys the FM — managed, with the FCU window showing dashes and the white dot lit (the altitude window is the exception: it always displays a value). This single principle is the doorway to article 05 and article 06; the FCTM turns it into task-sharing discipline (AP on — PF operates the FCU himself; AP off — PM operates it on PF's command, article 30).

A/THR: both engaged, one active. Per AMM 22-00-00:

Both systems are always engaged at the same time but only one system is active depending on engagement of AP and FD.

The selection ladder: AP1 engaged → A/THR 1 is active; only AP2 → A/THR 2; only FD1 → A/THR 1; only FD2 → A/THR 2; nothing engaged → A/THR 1 (A/THR 2 if it has failed). Note what this means for the FCU's A/THR pushbutton: it does not choose which A/THR — it only governs engagement; mastership follows the AP/FD automatically (article 16).

9. What the architecture writes into the MEL

Three no-dispatch lines in the ECAM-to-MEL cross-reference all trace back to this article's structure (developed in article 32):

• AUTO FLT FCU FAULT — no dispatch. The FCU is a single unit; its two channels share one box.
• AUTO FLT FM 1+2 FAULT — no dispatch. Both FMs gone leaves only backup navigation.
• AUTO FLT FMGEC VERSIONS DISAGREE — no dispatch. With different software standards in the two FMGECs, the premise of dual-dual cross-monitoring — comparison against a common standard — is broken.

A single FMGEC failure, by contrast, is dispatchable (rectification interval C): the deactivation is to pull that side's circuit breaker and placard the FCU, with the same-side FMS/AP/FD treated as inoperative and landing capability limited to CAT 3 SINGLE — per some operators' MEL practice.

[!warning]- Seven misconceptions this article corrects (1) There is no separate FAC or FMC on the A330 — envelope and management functions live inside the FMGEC. (2) Engaged AP/A-THR do not move the stick or the levers — monitor the FMA and the energy state, not control positions. (3) "Dual channel" is not one philosophy: the FCU's channels run identical software (messenger), the FMGEC's run dissimilar programs (decision-maker). (4) FM has no monitoring channel — its check is the other FM (INDEPENDENT mode, amber IND) plus two pilots cross-checking entries. (5) Power-fail memory is three different spans: under 200 ms fully transparent (AP stays), FCU selections last 5 minutes, the flight plan survives indefinitely (battery-backed RAM). (6) Content printed in the FCOM is not necessarily on your airframe — check the aircraft options list, then the FCOM GEN differences table, then the in-text option marks. (7) The A/THR pushbutton does not select which A/THR computer — mastership follows AP/FD engagement automatically.

10. Fleet standards and the options matrix

The FCOM's introduction block states the FMS2 standard per configuration:

The aircraft is equipped with FMS2 THALES Release 1A T5B and FGE H3.

The aircraft is equipped with FMS2 HONEYWELL Release 2 P6 and FGE H7.

A mixed fleet can carry both: one group of airframes with the Thales FMS2 (for the fleet modelled here, FSN 105-150 and 352-400) and another with the Honeywell FMS2 (FSN 003-050, 101-104, 201-350, 401-450). This series teaches the Thales group as its baseline and flags Honeywell differences line by line where they matter.

Which optional functions exist on your aircraft is answered by the aircraft-specific options list in the QRH. Per a representative operator QRH (OPS section):

For awareness and for the specified aircraft, the following table provides the flight crew with a list of optional aircraft systems and functions related to aircraft flight operations.

For the representative airframe used throughout this series, the ATA-22-relevant lines split as follows:

Teaching consequences applied throughout this series: FLS, GLS and SLS content is presented as awareness-only (not installed on the baseline airframe — article 11, article 34); AP/FD TCAS and RNP AR < 0.3 are treated as installed-and-trained (article 15, article 34). Your aircraft may differ — the reliable check order is: aircraft options list (QRH) → FCOM GEN differences table → the option marks against each FCOM paragraph.

Self-test

[!note]- Q1. What makes up the AFS, and how does FMGES differ from AFS?

AFS = two FMGECs + one FCU + three MCDUs. FMGES is the wider term: the computers plus control units plus associated peripherals. The FMGEC is the computer box itself. There is no separate FAC or FMC on the A330 — envelope and flight-management functions are parts of the FMGEC.

[!note]- Q2. What do the two "duals" in dual-dual mean, and how does FMGEC channel redundancy differ from the FCU's?

First dual: two FMGECs backing each other up. Second dual: within each FMGEC, a command channel and a monitoring channel — physically segregated, running dissimilar programs, with independent I/O/processor/memory/power and unsynchronised clocks, cross-comparing over ARINC 429. The FCU's two channels run identical software: it is a selector/relay, not a decision-maker, so it does not need dissimilarity.

[!note]- Q3. Which two databases can the airline change? What are the navigation-database cycle and load times, and the Thales/Honeywell stored-waypoint capacities?

The navigation database (28-day cycle) and the AMI. A load takes 20 min, or 5 min crossloaded from the opposite FMGEC. Pilot-stored elements: 99 waypoints (Thales) versus 20 (Honeywell), both with 10 runways, 20 navaids, 5 routes. The aircraft performance database is not airline-modifiable.

[!note]- Q4. Power interruptions of 150 ms, 3 s, and 8 s — what happens to the AP, the FCU selections, and the flight plan?

150 ms (SPF): RAM and hardware engaged logic saved, restart in the same configuration — AP stays engaged. 3 s (LPF): complete re-initialisation; RAM protection is limited to 500 ms except the battery-backed FM RAM — so the flight plan survives; FCU selected data are recoverable within 5 min. 8 s (VLPF): automatic reset equivalent to a manual hardware reset (plus ground safety tests). The FM retrieves the flight plan whatever the interruption.

[!note]- Q5. Why is FMGEC VERSIONS DISAGREE a no-dispatch item when a single failed FMGEC is dispatchable?

Dual-dual cross-monitoring presumes both computers compute to a common standard. Two different software versions break that premise — disagreement between them can no longer be arbitrated. A single failed FMGEC leaves one healthy dual-channel computer: dispatchable with the failed side's CB pulled and placarded, same-side FMS/AP/FD inoperative, and capability limited to CAT 3 SINGLE.

[!note]- Q6. How do you establish whether an optional function (say, FLS) is on your aircraft?

Three steps in order: the aircraft-specific options list in the QRH; the FCOM GEN differences table; the option marks against the FCOM paragraph itself. Never assume "printed in the FCOM" means "fitted on my airframe".

Key takeaways

References

A330 architecture per AMM 22-00-00 (Auto Flight — General: system composition, component locations, the two execution chains, non-back-driven controls, functional independence of the four sections, dual-dual definition, single-peripheral-failure immunity, four-bus thrust-target consolidation, short-term/long-term operating principle, A/THR dual-engagement, FIDS side-1 residence) and FCOM DSC-22_10-10 (FMGEC four parts, database set and update mechanics, FMS2 standards, stored-element capacities per vendor). Channel segregation, dissimilar software, hardware engagement logic, power-fail tiers and FIDS watchdog per AMM 22-83-00; bus assignments, recovery thresholds and side-1 priority wiring per AMM 22-84-00 (Honeywell-configuration supply differences per AMM 22-70-00 CONF01). Test ground gate per AMM 22-90-00 and the LAND CAT III test concept per AMM 22-97-00. The options matrix reflects one representative operator's aircraft-specific QRH options list; MEL dispatch consequences reflect some operators' MEL practice — both vary by operator and airframe. The signal-topology diagram and the "crew of four" framing are integrative syntheses of the AMM text. Maintenance-layer detail (rack/CB coordinates, BITE menus, ARINC labels) is intentionally excluded.

Independent study material, not an Airbus publication and not endorsed by the manufacturer. Always defer to the current operator FCOM, FCTM, and QRH for operational use.