FM Architecture — Dual, Independent, Single, and Backup

The FMGEC's fourth resident — FM, flight management — runs from here to article 29. The opening questions are organisational: how do the two FMs cooperate normally, and how does the system live after losing one, then both? For scope, the FMS's own job description. Per FCOM DSC-22_20-10-10:

The Flight Management System (FMS) provides: ‐ Flight planning and navigation information ‐ Performance calculation and optimization ‐ Long-term guidance targets. The FMS also has: ‐ An Engine-Out (EO) mode ‐ A print function ‐ A takeoff surveillance function ‐ A FMS landing system (FLS ) function.

Three core trades (the long-term targets — short-term is the FCU's, article 02) and four side jobs (printing is article 28; FLS is not installed on the baseline airframe).

1. Four modes of organisation

Per FCOM DSC-22_10-30:

The FMGES has four modes of operation: ‐ Dual mode (the normal mode) ‐ Independent mode. Each FMGEC being controlled by its associated MCDU ‐ Single mode (using one FMGEC only) ‐ Back-up navigation mode.

A degradation ladder: DUAL (the norm) → INDEPENDENT (each on its own) → SINGLE (one runs everything) → BACK-UP NAV (MCDU plus IRS, bare-bones). Who speaks for the pair in DUAL:

MASTER FMGEC LOGIC: ‐ If one autopilot (AP) is engaged, the related FMGEC is master: • It uses the onside FD for guidance • It controls the A/THR • It controls the FMA 1 and 2 ‐ If two APs are engaged, FMGEC1 is master. ‐ If no AP is engaged and • The FD1 pb is on, then FMGEC1 is master. • The FD1 pb is off, and FD2 pb on then FMGEC2 is master. ‐ If no AP/FD is engaged, A/THR is controlled by FMGEC1.

Three instruments of office: the onside FD's guidance, the A/THR (article 16's master, same office), and both FMAs.

2. DUAL — synchronised twin-work

Per FCOM DSC-22_10-30:

This is the normal mode. The two FMGECs are synchronized: each performs its own computations and exchanges data with the other through a crosstalk bus. One FMGEC is the master, the other the slave, so that some data in the slave FMGEC comes from the master. All data inserted into any MCDU is transferred to both FMGECs and to all peripherals.

The DUAL signature: enter once, everywhere effective. But DUAL is not perfect equality — both compute, yet the FMA, the A/THR and the guidance carry the master's answers; the slave is a hot standby and a monitor. (Article 06's forced mode synchronisation and article 12's lower-of-two capability both ride this crosstalk bus.)

3. INDEPENDENT — the partnership dissolves

Per FCOM DSC-22_10-30:

The system selects automatically this degraded mode under specific abnormal conditions (e.g. different database validity on both FMGECs). Each FMGEC works independently from the other and is linked to the peripherals on its owner side ('on side' peripheral) only. While this is occuring, 'INDEPENDENT OPERATION' message is displayed on both MCDUs scratchpads. The 'IND' annunciator light illuminates amber on the top of the MCDU.

The system chooses this, not you — the textbook trigger being different database cycles on the two sides (article 04's mismatch, airborne edition). The IND light closes article 03's loop: it lights only when both FMs are healthy — independence proves they are alive, merely not talking. Blind spots follow: POS/GPS MONITOR pages stop showing the opposite FM/GPS positions; RAD NAV and PROG stop showing the opposite side's tuning (fields blank). The procedure:

PROCEDURES IN FLIGHT DO NOT SWITCH the navigation databases. MAKE the same entries on both MCDUs to have both AP/FD similar orders. Both FGs being valid, 2 APs may be engaged for CAT II or CAT III operations.

No database switching in flight (a switch restarts the FM — article 29); duplicate every entry on both MCDUs; and note the reassurance — with both FGs valid, dual-AP CAT II/III remains available (after a go-around drops AP2, confirm the commanding FMGEC's plan and database first). On the ground: compare database numbers, crossload to restore DUAL (article 04). The QRH-level scenario adds the sharpest edge. Per FCOM DSC-22_20-40-30:

‐ no crosstalk between both FMGECs : they work independently ‐ Any entry on one MCDU must be achieved on the other one ‐ No monitoring between both FMGECs … Note: If the active F-PLN legs are different in both FMGECs, the flight director bars will only be centered on the engaged autopilot side. If the autopilot is then changed, the aircraft will turn towards the active leg of the other FMGEC.

No mutual monitoring — the cross-check is now entirely human. And the trap in the note: with different active legs on the two sides, switching autopilots turns the aircraft toward the other computer's leg. Align both plans before touching the AP selection.

4. SINGLE — one computer runs the house

Per FCOM DSC-22_10-30:

The system degrades to the single mode when one FMGEC has failed, and the flight crew has selected the FM source selector to the healthy FM. While this is occurring: ‐ Corresponding ND displays 'OFFSIDE FM CONTROL' amber message ‐ Both POS MONITOR pages display the same position (operative FMGEC position) ‐ Both FDs are driven by the same FMGEC ‐ Any entry on either MCDU is sent to the operative FMGEC.

Two entry requirements — a dead FM and the FM source selector moved to the healthy side (BOTH ON 1/2, article 03's listening ports earning their keep) — and three symptoms: the amber OFFSIDE FM CONTROL on the affected ND, both position monitors showing one position, both FDs on one computer. The nastiest sub-case first. Per FCOM DSC-22_20-40-30:

Note: If the FM fails on the master FG side with NAV mode engaged, the AP disengages ; the FD reverts to HDG (TRK) and SPD target reverts from managed to selected. Engage the other AP, NAV mode and SPD managed. Both PFD display the same FD (1FD1 or 2FD2 is displayed).

FM dying on the master's side mid-NAV costs three things at once — AP off, FD to HDG, speed to selected — and the recovery is the mirror: other AP, NAV back, managed back (the FMA's column 5 now reading 1FD1 or 2FD2, article 06's code). The FCTM adds two habits: consider the QRH FMGEC reset after a single failure (article 29), and the affected ND's map can be recovered by setting the same range as the opposite ND. One cold rule for the transient single mode during resynchronisation: while PLEASE WAIT is displayed, leave the MCDU alone.

5. BACK-UP NAV — the MCDU executes the will

Per FCOM DSC-22_10-30:

The flight crew selects on the MCDU MENU page this degraded mode when both FMGECs have failed. They recover the navigation function through the MCDU and IRS/GPS . The MCDU continuously memorizes the active flight plan, which was continuously downloaded from the FMGEC until it failed.

The FM wrote its will while alive — a condensed copy of the active plan continuously downloaded into the MCDU. The estate's specification. Per FCOM DSC-22_20-40-20:

While BACK UP NAV is not active, the FM downloads permanently a condensed form of the F-PLN in the MCDU. … Heading legs, course to fix legs, ..., computed INTCPT positions, pseudo waypoints, ..., cannot be downloaded. … Maximum of 150 waypoints are downloaded.

At most 150 waypoints, and leg types that cannot be condensed (heading legs, course-to-fix, computed intercepts, pseudo waypoints) become discontinuities — a backup plan freckled with breaks is the download format, not a fault. What you do not get:

The following features are not provided : ‐ No DATA BASE available : • No autotuning, NAVAIDS must be selected on RMP ... ‐ No performance data: • No CLB/DES/APP NAV/FINAL modes • No SPEED MANAGED ... ‐ Most of predictions are lost: • No EFOB • No XTRA • No ETA at DEST ‐ No multiple lateral F-PLN ‐ No AP/FD managed modes ‐ No crosstalk between MCDUs : F-PLN revisions have to be achieved on both MCDUs.

What you keep: onside IRS (or IRS3/GPIRS) position, the plan drawn on the ND, automatic waypoint sequencing, selected-mode guidance, limited lateral revisions (insert/delete waypoints, DIR TO, clear discontinuities), and true-track/time estimates. The recommended flying technique:

It is recommended to use the TRK/FPA modes : ‐ SELECT the required TRK on FCU at waypoint sequencing (as no AP/FD coupling exists in NAV B/UP). F-PLN sequencing is automatic. ‐ MONITOR the track of the next leg prior reaching the TO waypoint (track between TO and next waypoints is true track). ‐ ADJUST the track to follow the F-PLN with X-TRK = 0 ‐ USE OP DES or FPA to descend as suitable. FPA allows easy altitudes predictions : DNM = ▵(FL)/FPA°

Dial each leg's track into the FCU at sequencing (note: the displayed leg tracks are true tracks), keep the cross-track at zero, and descend on FPA with the mental-maths gift: distance required (NM) = altitude to lose (in FL) ÷ FPA in degrees — FL120 to lose at 3° is 40 NM. Three hard boundaries: MCDU 3 can never provide backup navigation (even while substituting — article 03); the FM source selector must be at NORM for the NAV B/UP prompt to exist at all; and the printed caution — with both sides on backup navigation, at least one FG must remain healthy for AP/A-THR engagement (the FM-dead-FG-alive half-life of article 05).

6. The failure spectrum — five rungs

The FCOM's own ladder (DSC-22_20-40-30), condensed:

Two margin notes from the same section: after losing one IRS, a 20 NM split between the remaining two before NAT-HLA entry is grounds to consider re-routing; and the dual-FM row carries a limitation of none — "two independent navigation systems remain" (two MCDU-IRS chains). The FCTM's dual-FM technique: with the FGs alive, first re-engage AP and A/THR, FDs off, fly TRK-FPA (bird plus blue track index), tune on the RMPs — only FG death on top of FM death is the true bare-airframe case.

7. EO mode — the FM's six automatic chores

Per FCOM DSC-22_20-10-50, at engine-out detection:

‐ The managed target speeds are immediately set to a value that depends upon the flight phase ‐ The system automatically calls up the current performance page, which has the E.O. CLR (engine-out clear) prompt... ‐ The PROG page shows the recommended engine-out maximum (E.O. REC MAX) altitude ‐ All preselected speeds, entered in the MCDU, are deleted... ‐ Step climb (or step descent), if entered, is deleted ‐ The time constraint is deleted.

Speeds re-referenced, the PERF page thrust into your face with its E.O. CLR prompt, EO REC MAX posted on PROG, and every optimistic entry — preselections, steps, time constraints — swept off the table. The FM clears out the fiction of continuing as planned. And the one-way door:

If the pilot presses the E.O. CLR key, the all engine operative predictions and performance will be restored. Reverting to one engine-out performance again is not possible, unless the system detects a new E.O. condition. Therefore, the pilot should not press the E.O. CLR key, if an actual engine-out is detected.

E.O. CLR exists for the spurious engine-out (clear it, re-engage the vertical mode, re-enter preselections — no other after-effects). With a real failure, never press it — you would delete the engine-out performance protection with no way back. The FG side's companion provisions (article 06): all selected modes retained, EO SRS speed references (V2…V2+15 / VAPP…VLS+15), and the bank schedule opening from 15° to 25° with speed margin.

8. Operations

Takeoff surveillance (TOS) — the data sanity-checker: an out-of-range ZFW draws ENTRY OUT OF RANGE; V1 ≤ VR ≤ V2 violated draws V1/VR/V2 DISAGREE (MCDU and ECAM); speeds below the VMCG/VMCA/VMU/VS1G legal floors draw T.O SPEEDS TOO LOW; nothing entered draws T.O SPEEDS NOT INSERTED — the last three firing on the T.O CONFIG press or the takeoff thrust push (FCOM DSC-22_20-10-70).

Erroneous predictions — and the first principle. Per FCOM DSC-22_20-40-40:

The FMGES may temporarily display erroneous predictions... The flight crew should not perform a reset of the FMS.

Do not reset for prediction weirdness. The three-step triage: check the WIND pages level by level (temperature and wind); a single strange leg → insert an intermediate waypoint; two arrival fixes within 3 NM sharing an AT-OR-BELOW constraint → put the same constraint on the lower one. Still wrong → copy ACTIVE into SEC, pull the STAR out, re-insert it later (STARs carry the most constraints and are the usual prediction-scramblers). Interfaces: the reset/resynchronisation machinery — including the latch that locks SINGLE after repeated resyncs — is article 29; the ECAM procedures (AUTO FLT FM 1+2 FAULT and family) are article 31.

[!warning]- Five misconceptions this article corrects (1) DUAL is not two equals — both compute, but FMA/A-THR/guidance carry the master's answers; the slave is hot standby plus monitor. (2) The IND light does not mean an FM died — the opposite: both must be healthy for it to light; they have merely stopped talking (check database cycles first). (3) In INDEPENDENT operation, switching APs can turn the aircraft — each side steers to its own active leg; align the plans before touching the AP. (4) A backup-navigation plan full of discontinuities is the download format (150 points, no heading/CF legs), not corruption. (5) E.O. CLR is a one-way door — pressing it after a real engine failure deletes the engine-out performance with no way back; it exists only for spurious detections.

Self-test

[!note]- Q1. The master's three instruments of office — and who controls the A/THR with nothing engaged?

The onside FD's guidance, the A/THR, and both FMAs. With no AP/FD engaged, FMGEC 1 controls the A/THR.

[!note]- Q2. Who selects INDEPENDENT operation, what is the classic trigger, and does IND mean an FM is dead?

The system selects it automatically — classically for different database validity between the sides. IND lights only when both FMs are healthy: alive, not talking.

[!note]- Q3. The risk of changing autopilots during INDEPENDENT operation?

If the two FMGECs hold different active legs, the FD bars centre only on the engaged AP's side — switching APs turns the aircraft toward the other computer's leg.

[!note]- Q4. SINGLE mode's two entry elements and three symptoms?

A failed FMGEC plus the FM source selector moved to the healthy side. Symptoms: amber OFFSIDE FM CONTROL on the affected ND; both POS MONITOR pages showing the operative FMGEC's position; both FDs driven by the same FMGEC (entries from either MCDU go to it).

[!note]- Q5. FM dies on the master FG side with NAV engaged — which three things degrade together?

The AP disengages, the FD reverts to HDG (TRK), and the speed target reverts from managed to selected. Recovery: engage the other AP, NAV, and managed speed.

[!note]- Q6. Why does a backup-navigation plan carry a string of discontinuities — and why must revisions be made twice?

The condensed download (max 150 waypoints) cannot carry heading legs, course-to-fix legs, computed intercepts or pseudo waypoints — they become clearable discontinuities. There is no crosstalk between MCDUs in B/UP, so each revision is entered on both.

[!note]- Q7. The backup-navigation descent mental formula — and are the displayed leg tracks magnetic or true?

Distance (NM) = altitude to lose in flight levels ÷ FPA in degrees (FL120 at 3° → 40 NM). The TO-to-next tracks are true tracks.

[!note]- Q8. Do you keep the AP after a dual-IRS failure? After a dual-FM failure?

Dual IRS: no — AP, FD and A/THR are all lost (the data is gone). Dual FM: quite possibly yes — with the FGs healthy, re-engage AP/A-THR and fly selected modes. Who supplies data versus who guides: the FMGEC four-part review in one contrast.

[!note]- Q9. The FM's six automatic engine-out actions — and the E.O. CLR rule?

EO-managed speeds set by phase; the current PERF page called up (with E.O. CLR); EO REC MAX on PROG; preselected speeds deleted; steps deleted; the time constraint deleted. E.O. CLR restores all-engine performance irreversibly — never press it with a real engine failure.

[!note]- Q10. The first principle for erroneous predictions — and the three-step triage?

Do not reset the FMS. Verify WIND-page winds/temperatures; insert an intermediate waypoint into the odd leg; duplicate the AT-OR-BELOW constraint onto the lower of two close arrival fixes — and if needed, copy to SEC and temporarily remove the STAR.

Key takeaways

References

Four operating modes, master logic and per-mode procedures per FCOM DSC-22_10-30; FMS functions per FCOM DSC-22_20-10-10; backup navigation (download specification, provisions, technique) per FCOM DSC-22_20-40-20; the failure spectrum, independent-operation notes and the master-side FM failure per FCOM DSC-22_20-40-30; erroneous-prediction triage and spurious engine-out per FCOM DSC-22_20-40-40; EO mode actions and FG provisions per FCOM DSC-22_20-10-50; takeoff surveillance per FCOM DSC-22_20-10-70. Single/dual FMGEC failure techniques per FCTM PR-AEP-AUTOFLT. The company-organisation framing is an integrative synthesis. FLS wording is quoted as printed; the function is not installed on the baseline airframe of this series.

Independent study material, not an Airbus publication and not endorsed by the manufacturer. Always defer to the current operator FCOM, FCTM, and QRH for operational use.