GCU — AC Generation Control and Protection

The previous article followed the IDG's mechanical half — how the constant-speed unit turns the engine's variable speed into a constant 24 000 rpm. This article takes the electrical half: how a single permanent magnet inside the generator is amplified into 115/200 V three-phase AC through a brushless four-stage chain, how the Generator Control Unit (GCU) regulates voltage and frequency, and — the heart of the article — how the GCU's seventeen protection functions decide whether this generator is still wanted on the network at all.

It also closes two threads left open in the Electrical Overview. The overview quoted FCOM's "three BUS TIE contactors" without saying which three; here the AMM names them. And the overview's red line — "an overcurrent-tripped generator is not reconfigured, its bus is lost" — turns out to be one entry in a complete lock-out-BTC list that this article reconstructs in full.

1. Scope and boundaries

• This article owns: the generator's electrical body, the full GCU (regulation, protection, on-line logic), the GLC / BTC / SIC transmission circuit, and the current transformers and lightning modules.
• Left to neighbours: ECMU internal logic and No-Break Power Transfer (see ECMU Contactor Management and No-Break Power Transfer); the operational view of the priority chain (Network Priority); the step-by-step GEN FAULT ECAM procedure (Generator and IDG Failures); ECAM display-field semantics (ECAM ELEC Page).
• Cross-references to article 01: the LOW OIL PR / OIL OVERTEMP rows in the protection table are the same two FAULT triggers covered in the IDG article, and the 4900 RPM underspeed threshold is the very disconnect-inhibit criterion introduced there.

2. Architecture

2.1 One generation channel, end to end

Read this from the generator at top left to the AC bus at bottom right. The whole channel is self-sufficient while the engine turns — the PMG feeds the GCU, the GCU excites the generator, and nothing in this loop depends on the rest of the aircraft network.

┌────────── IDG 4000XU (generator half — oil-spray cooled, brushless) ──────────┐
│                                                                               │
│  PMG ───────────▶ Exciter ──────────▶ Rotating ────────▶ Main generator       │
│  permanent-magnet  6-pole stator       rectifier          2-pole rotor /       │
│  16-pole rotor     (GCU-fed field)     (6 Si diodes,      3-phase star stator  │
│  1681.3 Hz out          ▲              full-wave bridge)   neutral to airframe  │
│       │                 │ field current = the "voltage knob"                   │
│       │                 │                          generator CT ──────────┐    │
└───────┼─────────────────┼──────────────────────────────────────────────┼──┘
        │                 │            3-phase feeders (power cables)      │
┌─ GCU 1XU1 ──────────────┘                     │                          │
│ Supply 1: PMG → TRU → 28 V                     ├─ 19XU lightning module   │
│ Supply 2: aircraft DC backup 28 V              │                          │
│ ┌─────────────────────────┐                    ▼                          │
│ │ Voltage regulator (PWM)  │       6-hole CT 31XU (710VU, upstream GLC)    │
│ │ 17 protections           │◀──── differential Zone 1: two CT sets ────────┘
│ │ GCR / PRR / SVR          │                    │
│ └─────────────────────────┘                    ▼  POR (regulation point)
└──────────┬──────────────────┘          ┌────────────────┐
           │ PR status (ground signal)   │   GLC 9XU1     │◀─ PRR feeds 28 VDC
           ▼                             └───────┬────────┘   ECMU gives ground
      ECMU 1 (validates GLC logic eqn)           ▼
                                            AC BUS 1 (1XP)
  ── transmission: BTC1 11XU1 ─ SIC 12XU ─ BTC2 11XU2 ── (BUS TIE pb 13XU master) ──

2.2 Inside the GCU

Opening the "17 protections / GCR / PRR / SVR" black box, the schematic resolves into two halves — a measurement/protection side fed by the current transformers, and a control/on-line side carrying the voltage regulator and the GLC command.

┌──────────────────── GCU 1XU1 (ECMU1 1XM1 sits outside) ────────────────────┐
│ ◆ SUPPLY BOARD: 28 VDC / ±15 VDC / ±5 VDC                                   │
│    ◀ PMG 3-phase → internal TRU   |   ◀ 301PP 28 VDC →[4XU1 sw→blocking dio]│
│                                                                            │
│ ┌── measurement / protection ──────┐  ┌── control / on-line ─────────────┐ │
│ │ DIFFERENTIAL MEASURE & PROTECTION │  │ EXCITATION CTL & REGULATION → GCR │ │
│ │   ◀ 31XU1 6-hole CT               │  │ VOLTAGE REGULATOR (VR), at P.O.R  │ │
│ │   ◀ 6-wire CT (T1-L1 … T6-L6)     │  │ SUPPLY PROTECTION MODULE + IPT    │ │
│ │ 17 protection logics              │  │ PIN-PRG / SYNC WDW (sync window)  │ │
│ │ OIL LEVEL SENSOR input            │  │ PH SIGNAL / COMP RESET            │ │
│ │ ENG S/D (engine shutdown) input   │  │ GLC CONTROL → ECMU1 (FIN 13528)   │ │
│ └───────────────────────────────────┘  │   + LOCK OUT BTC output           │ │
│                                         └───────────────────────────────────┘ │
│ External: 9XU1 GLC1 / 11XU1 BTC1 / feeders φA·φB·φC / GEN pb 3XU1            │
└─────────────────────────────────────────────────────────────────────────────┘

Three things the schematic settles that prose alone cannot:

• The POR and the VR live in the same control block — the voltage-regulation loop (§5) is physically implemented on the GCU board, not at the generator terminals.
• "LOCK OUT BTC" is a discrete output line. The "locks BTC" entries in §8 are not abstract logic; they are a hardware signal the GCU drives out through its supply-protection module.
• The sync window and IPT timing share one block — the anti-paralleling defence (§8, IPT) keys off this sync-window criterion.

2.3 Components and values

3. The brushless four-stage chain

A conventional generator uses brushes to carry excitation current into the rotor — and brushes wear and arc. The A330 generator is brushless by turning the transfer of excitation current into an induction, at the cost of stringing four stages in series (per AMM 24-22-00 §6.A):

1. PMG (permanent magnet generator). A 16-pole iron-cobalt permanent-magnet rotor and a 16-pole three-phase star stator. As long as the shaft turns the PMG generates — it is the one element in the whole chain that needs no external supply. Its output feeds the GCU, which rectifies it to 28 VDC for its own use and for excitation.
2. Exciter. A 6-pole field winding on the stator (fed by the GCU through the voltage regulator) and a 6-pole three-phase rotor. The stationary field is crossed by the spinning rotor, inducing AC in it — and this is how excitation current crosses onto the shaft without a brush.
3. Rotating rectifier. Six silicon diodes form a three-phase full-wave bridge that spins with the shaft, rectifying the exciter rotor's AC to DC in place.
4. Main generator. That DC drives the 2-pole rotor winding, whose rotating field induces 115/200 V in the three-phase star stator. The neutral is bonded to the airframe structure; each phase is monitored through a CT.

Read the chain as a power-amplification ladder: the magnet's trickle (PMG) → a control stage (the GCU sets excitation) → an amplifier stage (exciter + rectifier) → the power stage (115 kVA main generator). The GCU turns the small current of the second stage and controls the large power of the fourth — which is why regulation can be both fast and fine.

The mechanical assembly anchors this electrical picture back to the IDG body of article 01:

"The exciter rotor and main field rotor are mounted on a common shaft. The permanent magnet generator rotor is mounted on the differential output ring gear. The permanent magnet generator stator, main stator, exciter field, and generator current transformer assembly are mounted in the IDG housing."

Per AMM 24-22-00 §6.A. Two hard interfaces fall out. First, the exciter rotor and main field rotor share a common shaft — so the rotating rectifier can spin with that shaft, which is the mechanical premise of "rotating" rectification and the whole point of being brushless. Second, the PMG rotor sits on the differential output ring gear — that is the CSD's constant-speed output stage from article 01. The PMG therefore takes its speed downstream of the CSD: it sees the constant 24 000 rpm (1681.3 Hz), not the engine's variable side. The GCU uses PMG frequency as the generator's "health pulse" (several protections in §8 key off PMG frequency) precisely because that pick-off point is held constant.

4. GCU power supply and the three relays

Dual supply. Per AMM 24-22-00 §4.A:

"Each GCU is supplied from two independent power sources: from the Permanent Magnetic Generator (PMG) of the IDG. When the aircraft engine runs, the PMG power supplies the GCU. The GCU then generates a 28VDC power supply via an internal Transformer Rectifier Unit (TRU) supply, with a back-up 28VDC from the aircraft DC network."

What this buys: while the engine turns, the channel is self-sufficient — even with the whole aircraft network dead, the GCU lives off the PMG and the generator is excited by the GCU. That is the basis on which the network can be rebuilt from the generator side. The aircraft DC backup lets the GCU work when the engine is not turning (for example, the post-shutdown oil-level interrogation of §11).

On the board, the two supplies merge through a diode-OR, not a hard parallel: the GCU makes 28 VDC / ±15 VDC / ±5 VDC on its SUPPLY BOARD (the lower rails feed its internal digital and analogue circuits), and the backup 28 VDC reaches the board through 301PP → the 4XU1 switch → a blocking diode. The diode gives one-way isolation: while the PMG supply is healthy the backup branch is held off and cannot back-feed; only when the PMG sags does the backup take over. For the flight deck the takeaway is one line — the GCU's two supplies are diode-selected; they do not fight each other.

The GCU's six main functions (AMM §6.B(5)) collect the responsibilities scattered through this article into one table:

The GCU also forwards three classes of IDG maintenance information (AMM §6.B(5)(c)2):

"The GCU provides also maintenance information related to the IDG: ‐ clogged filter, ‐ IDG disconnect status, ‐ low oil level."

Clogged filter is a mechanism article 01 did not expand: beyond oil pressure and temperature (which trigger IDG FAULT), the GCU also watches the filter differential in the background. That information runs the maintenance chain through the GAPCU to the central maintenance computer and does not raise a cockpit warning by itself — but it explains why, beyond IDG OIL SYS FAULT, there are finer maintenance items at dispatch.

The three relays (AMM §6.B(5)(c)) — every GCU decision ultimately lands on three switches:

5. Voltage regulation — PWM at the POR

"The regulator senses the average of the three phases at the point of regulation and compares it against a reference voltage. If a difference exists, the voltage regulator adjusts the generator exciter field current as needed to keep a constant voltage at the point of regulation. During overload, overcurrent, and differential current fault conditions, the excitation current to the IDG generator is automatically controlled to limit current and power from the associated generator to a safe level."

Per AMM 24-22-00 §6.B(5)(a). Three points:

• The regulation point is not at the generator terminals but at the feeder end (POR, upstream of the GLC) — compensating feeder voltage drop, so that the voltage the user receives is held constant rather than the voltage that leaves the factory.
• The means is pulse-width modulation of the excitation at constant frequency.
• Current limiting is the regulator's side-job. On a fault it actively pulls excitation down so the short-circuit current cannot run away — a layered idea of suppress first, trip second.

6. The on-line sequence

Pressing the GEN pb does not slam the generator onto the network. It runs a thresholded sequence:

"If the PMG frequency is above 1260 Hz and no protection function is triggered, the GCR closes (initial generator frequency = 300 Hz). 160 ms later, if the IDG input speed is above 4900 RPM, the PRR closes. The PRR provides 28 VDC to the GLC coil and a ground signal to the ECMU. From this ground signal, the ECMU validates the logic equation of the GLC and generates a ground signal to the GLC, which closes."

"When the IDG input speed decreases: the GLC opens when the IDG input speed is below 4680 RPM, the generator is de-energized when the generator frequency decreases to 300 Hz."

Per AMM 24-22-00 §7.A(2). Two design details:

• GLC closure takes two signatures — the GCU's and the ECMU's. The PRR supplies the coil; the ECMU supplies the ground (and must also clear the priority logic, see ECMU Contactor Management). Both must nod before the contactor closes.
• The 4900 RPM on / 4680 RPM off split is deliberate hysteresis — it stops the GLC chattering when idle speed wanders.

7. The transmission circuit — the three BUS TIE contactors

The overview's unnamed "three BUS TIE contactors" are resolved here. Per AMM 24-22-00 §3.D(1):

"The Bus Tie Contactors (BTC) and the System Isolation Contactor (SIC) are automatically controlled by the ECMUs. … When the BUS TIE pushbutton switch (13XU) is released, the BTCs and the SIC are not supplied. … The BTC1 (11XU1) and SIC (12XU) are controlled and monitored by the ECMU1. The BTC2 (11XU2) is controlled and monitored by the ECMU2."

So the three BUS TIE contactors = BTC1 + BTC2 + SIC. Topologically they form a "borrowing corridor": AC BUS 1 — BTC1 — a middle segment — SIC — BTC2 — AC BUS 2, with the APU GEN and both external sources tapped onto the middle segment (see the overview single-line). The BUS TIE pb in OFF is the physical master switch — all three de-energised, the two half-networks and the middle sources fully isolated.

The two networks are not symmetric — and this asymmetry is the topological premise of priority and reconfiguration. Per AMM 24-22-00 §3.B:

"The IDG1 supplies network 1 through the Generator Line Contactor 1 (GLC1) 9XU1. The network 1 includes: ‐ the AC BUS 1 (1XP), ‐ the AC ESS BUS (9XP), ‐ the AC SHED ESSENTIAL BUS (4XP). The IDG2 supplies through GLC2 (9XU2) the network 2 corresponding to the AC BUS 2 (2XP)."

Network 1 carries three buses (including the AC ESS BUS and the AC SHED ESS BUS); network 2 carries one. So an IDG1 loss is inherently wider-reaching than an IDG2 loss — the essential and sheddable-essential loads all hang on the left. This is the root of the asymmetric reconfiguration you will meet below, and of why "GEN 1 failure pulls more with it than GEN 2" in AC Bus Faults.

When a BTC actively closes to borrow power. Per AMM 24-22-00 §7.D(1):

"(1) Operation of the BTC1 — The BTC1 closes if there is no interlock condition on the GCU1: ‐ when the GEN1 is not available, in order to supply the network 1 from another power source (GEN2, APU GEN, EXT PWR A or EXT PWR B), ‐ to supply the network 2 from GEN1 if the GEN2, APU GEN, EXT PWR A and EXT PWR B are not available and GEN1 is available."

BTC2 mirrors this. So a BTC is a two-way door: it can bring outside help into its own network (when the local generator is gone), and it can push the local generator's output out to rescue the opposite network (when the opposite side and all common sources have failed). The iron precondition is no GCU interlock — i.e. none of the lock-BTC protections has fired (§8). That is exactly why overcurrent / GLCF / IPT can let a bus be accepted as lost: once the interlock is set, this door is welded shut and the borrowing corridor is closed to that side.

When the SIC closes (§7.D(3), four cases): (1) GEN2 and EXT A unavailable, while APU GEN or EXT B is available → the middle source feeds network 2 rightward; (2) GEN1, APU, EXT B unavailable, EXT A available → EXT A feeds leftward; (3) GEN1, APU, EXT A and EXT B all unavailable, only GEN2 left → GEN2 spans across to carry network 1; (4) GEN2, APU, EXT A and EXT B all unavailable, only GEN1 left → GEN1 spans across to carry network 2. In one line: the SIC is the gate for "borrowing across the centre line" — it closes only when power must cross the middle segment.

The AMM's per-bus priority order (finer than the FCOM operational text). Per AMM 24-22-00 §3.D(2):

"Each network (1, 2) is supplied according to the following priority order: 1XP = IDG1/APU GEN/EXT PWR B/EXT PWR A/IDG2, 2XP = IDG2/EXT PWR A/APU GEN/EXT PWR B/IDG1."

This agrees with the FCOM text version (DSC-24-10-30-10) but lays out all five sources' full ranking on each bus at once (operational scenarios in Network Priority).

BTC interlock (§7.D(4)): if GLC1 is welded (contacts stuck closed, cannot open) or the GEN1 channel has an uncleared short, BTC1 latches open. A welded contactor is more dangerous than one that will not close — it keeps a faulty channel permanently on the network, so the system would rather seal the borrowing corridor.

Who decides all this (§7.E):

"Each GLC, each BTC and the SIC is controlled by its associated ECMU through a control logic function, depending on the status of the AC main contactors and the GCU's. … Each logic function is programmed into a specific logic circuit."

So the GCU rules on whether this generator is wanted and healthy (protection + PR status), while whether each contactor closes is decided by the ECMU running a logic equation whose inputs are the whole network's contactor states plus every GCU's status. That is the division of labour — the GCU emits a health signal, the ECMU makes the network-wide decision (ECMU internals in ECMU Contactor Management). For this article it is enough to see that the GLC's "ECMU validates the logic equation" in §6 and the "no interlock condition" on every BTC/SIC closure in this section are the same §7.E logic circuits ruling underneath.

8. The seventeen protections

Read the trip combinations like this: tripping PRR cuts the GLC (drops the generator off-line); tripping GCR de-excites (the generator's fire goes out); tripping SVR stops frequency regulation; LOCK OUT BTC seals the borrowing corridor to this side (the bus is not restored).

Electrical parameters (voltage / frequency, dual-threshold)

(Frequency is monitored from PMG frequency; "inhibited by underspeed" means an underfrequency caused by the engine spooling down does not count as a fault.)

Current (the CTs are the eyes)

The differential idea is worth its own paragraph: one CT set sits at the generator outlet, the other upstream of the GLC. Normally "what goes in comes out" and the two read equal; if the middle feeder leaks or shorts, current "disappears en route" and the difference exceeding 50 A trips. The "Zone 1" it brackets is exactly the generator-plus-feeder run — the thickest power line, the highest fire risk, given the most sensitive protection.

The two CTs have distinct jobs, which is why different protections draw their thresholds from different sources. Per AMM 24-22-00 §6.C(1):

"(a) Generator CT — used for differential and overcurrent protections. (b) 6 holes CT — used for differential and open cable protections."

Map this back onto the tables: overcurrent OC/OL takes its current from the generator CT (nominal + 15 A, ΔI 75 A); open cable OPC takes its "<18 A / >38 A" from the 6-hole CT (which compares cable by cable, so it can tell that one cable of a phase has dropped); and differential DP uses both (one-in, one-out comparison). So the 6-hole CT is not a redundant part — it is the eye unique to open-cable protection.

Mechanism and status

Component health

One parallel action the "Trips" column omits — TURNS OFF VR. The tables record the three relays (PRR/GCR/SVR), but the REMARKS column of the AMM protection table separately writes TURNS OFF VR for OV/UV/OF/UF/DISC/FIRE/SOPMG/OPC/SRD/GLCCCF. So de-excitation (tripping GCR) usually also switches the voltage regulator off — a belt-and-braces measure ensuring excitation is truly cut and the generator cannot "falsely de-excite" on a residual regulator output. For the flight deck: de-excitation = open the excitation relay AND switch the regulator off, both at once.

Two cross-cutting patterns

1. The "reset limited to two" family: OV, OF fast stage, OC/OL, DP, IPT2, SV — all failures where "trying again will probably still be faulty, and repeated re-closure only widens the damage." FCOM's panel chapter names only the differential case ("If the protection trip is initiated by a differential fault, the reset action has no effect after two attempts", per FCOM DSC-24-20); the AMM gives the full family.
2. The "locks BTC" family = overcurrent/overload, GLCF, IPT (confirmed in the AMM §7.C note below). Their common thread: the fault may be on the bus side or in the contactor itself — so borrowing a good source over equals feeding the short-circuit point; the corridor is sealed and the bus is accepted as lost. FCOM's operational chapter writes only "overcurrent is not reconfigured"; the AMM completes the other two.

[!warning]- "GEN tripped and the bus went black" is the system protecting the network, not a reconfiguration failure

When you see a generator trip and the bus is not restored, the first thought should be: this is the lock-BTC family (overcurrent/overload, GLCF, IPT) at work, deliberately accepting the bus as lost. The fault may sit on the bus or in the contactor; closing a BTC there would feed a short. This is not the automatic transfer failing — it is the automatic transfer being forbidden on purpose (proceed to the AC Bus Faults procedure).

FIRE needs two layers to be complete

The FIRE row above is the GCU's internal view (the fire-handle signal trips PRR + GCR + SVR). What the crew actually sees when the handle is pulled is the FCOM panel-level description, per FCOM DSC-26-20-20:

"ENG FIRE PB-SW — When the flight crew pushes it, the PB-SW is released and sends an electrical signal that performs the following for the corresponding engine: ‐ Silences the aural fire warning ‐ Arms the fire extinguisher squibs ‐ Closes the low-pressure fuel valve ‐ Closes the hydraulic fire shut off valve ‐ Closes the engine bleed valve ‐ Closes the pack flow control valve ‐ Cuts off the FADEC power supply ‐ Deactivates the IDG."

The two layers together are the full chain: pull the handle → the electrical signal "Deactivates the IDG" (FCOM's whole-IDG wording) → the GCU's FIRE protection trips PRR/GCR/SVR → the generator de-excites and stops generating. This also explains the reset logic of §12 scenario 6: FCOM says the handle "deactivates" on the pull, the AMM says re-excitation needs PMG frequency = 0 — so if the engine is still turning (PMG still has frequency), cycling the GEN pb will not bring the generator back.

9. The standard trip script

Per AMM 24-22-00 §7.C:

"The PRR breaks the 28 VDC to the GLC and the corresponding ground signal to the relevant ECMU. Simultaneously the automatic transfer becomes effective. The respective ECMU energizes the relevant BTC in order to restore the lost busbar. NOTE: The BTC is locked out for the following protections: overcurrent/overload, GLC failure, IPT."

In the cockpit, simultaneously: the GEN pb amber FAULT + MASTER CAUT + single chime + EWD amber GEN 1(2) FAULT + the SD auto-calls the ELEC AC page. The reset action is GEN pb OFF/R then ON — the use of the panel's OFF/R position where "the GCU is reset". One easily-examined small print: the GEN pb FAULT light is also on whenever the GLC is open (§7.C note) — FAULT does not necessarily mean a protection trip; it can mean only that the contactor is not on-line (see Generator and IDG Failures).

10. The overload five-step script

An overloaded generator (e.g. a single source carrying the whole network with all galleys on) does not trip at once; it concedes load in stages:

Overload / overcurrent / short circuit detected by the GCU
  ① Protection initialises (excitation current-limit suppresses first, §5)
  ② Fault still present after 10 s → GCU sends the ECMU a ground signal → galleys shed automatically
  ③ Shedding effective → it ends here, with NO warning at all (the crew may never notice)
  ④ Shedding ineffective → GALLEY pb amber FAULT + MASTER CAUT
     + EWD "GEN 1(2)/APU GEN OVERLOAD" → crew manually presses GALLEY pb to shed all galleys
  ⑤ Still ineffective → protection time-out elapses → BTC latches open;
     if the fault persists → de-excitation + GLC opens

[!warning]- Automatic galley shedding fires silently — no warning at all

Step ③ is the counter-intuitive point: when automatic shedding succeeds there is no warning whatsoever; you see only a galley legend on the ECAM (display semantics in ECAM ELEC Page) with no caution. By the time the OVERLOAD caution actually sounds, automatic shedding has already failed to cope, and your manual GALLEY pb is the last load-reduction step (procedure in ECMU Fault).

The ECAM load field turning amber above 108 % for 10 s (per FCOM DSC-24-20) echoes the generator's "135.5 kVA for 5 min" overload capability (§2.3). Keep two event layers distinct: the field-amber threshold (>108 %, a display threshold) is not the ELEC OVERLOAD caution trigger (>100 % of rating, a protection/caution threshold, see Generator and IDG Failures) — do not read them as one "overload threshold". The takeaway: the ECAM prompt comes first, the hardware limit second, leaving you a minutes-scale rather than a seconds-scale handling window.

How shed loads are recovered — and only on the ground. Per QRH ABN-02 system reset table:

"ELEC — Commercial equipments and galleys — On ground: When the commercial equipment and/or galley loads have been shed by the ECMU, they can be recovered when more electrical power is available. • If COMMERCIAL OFF is displayed on the ELEC SD page: ‐ Switch the COMMERCIAL pb OFF then ON. • If GALLEY SHED or GALLEY PARTIALLY SHED is displayed on the ELEC SD page: ‐ Switch the GALLEY pb OFF then ON. Do not reset more than one pushbutton at a time."

Two counter-intuitive points: recovery is ground-only — galleys shed in flight cannot be recovered by this procedure (you must wait for adequate ground power); and the ELEC SD page shows three shed levels — COMMERCIAL OFF (all commercial off, shed first) > GALLEY SHED (all galleys) > GALLEY PARTIALLY SHED — recovered through the COMMERCIAL and GALLEY pushbuttons respectively.

A worthwhile negative fact: the QRH has no standalone GEN FAULT / GEN OVERLOAD procedure (ABN-16 ELEC carries only the ELEC EMER CONFIG series). That confirms the §9 / §10 judgement: GEN FAULT and GEN OVERLOAD are self-contained ECAM cautions; the QRH raises no separate summary and the crew simply follows the ECAM (step-by-step in Generator and IDG Failures).

11. ROLS — the post-shutdown oil-level check

The GCU hides an "after-hours" function. After engine shutdown (6 min in the PRE-SB 24-3053 configuration; 7 min POST-SB 24-3053) the GCU starts an oil-level interrogation sequence and, while the backup 28 VDC is available, repeats it every 6 minutes (both configurations). A detected low/high level sends a LOW/HIGH OIL LEVEL message through the GAPCU to the central maintenance computer plus an ECAM prompt to the crew.

Why wait a few minutes after shutdown? While running, oil churns around the circuit, and at the moment of shutdown it has not yet settled back into the housing — measuring immediately gives a false reading. Letting the oil "sit" before gauging is the same logic as waiting a few minutes with a car engine off before checking the oil. Maintenance note: after a low-level report, check the sight glass before deciding to add oil; after servicing, GEN pb OFF/ON resets the GCU.

12. Flight-deck operation

12.1 The GEN pb

"On: The generator field is energized and the line contactor closes, provided electrical parameters are normal. OFF/R: The generator field is de-energized and the line contactor opens. The associated Generator Control Unit (GCU) is reset. FAULT lt: Comes on amber associated with an ECAM caution in the event of protection trip initiated by the associated Generator Control Unit (GCU). The line contactor opens."

Per FCOM DSC-24-20. The "R" in OFF/R is Reset: for a resettable fault (a transient overvoltage, an external disturbance), one OFF/ON cycle gives the GCU one fresh chance to self-test and come back on-line; for the "two-attempt family" (§8), the GCU simply ignores the third cycle.

The AMM's "two-position switch" view corroborates and completes the OFF picture. Per AMM 24-22-00 §7.A(1):

"The GEN pushbutton switches … have two positions. (1) OFF position — When the pushbutton switch is released: the white OFF legend is on, the generator is shut down (de-energized) and the line contactor is open, GEN OFF warning is displayed on the EWD with the ELEC AC page displayed on the SD."

Distinguish two "white-light / warning" states: deliberately selecting OFF (crew intent to shut down) → white OFF legend + EWD "GEN OFF" (an advisory, not a fault); a GCU protection trip → amber FAULT light + EWD amber "GEN FAULT" (§9). The same pushbutton shows two entirely different colour/legend sets for "I turned it off" versus "it tripped" — the basis of the diagnosis in Generator and IDG Failures.

12.2 Six flight-deck scenarios

1. GEN 2 fails to come on-line after start. Think the on-line sequence first — PMG >1260 Hz? Engine at idle (the 4900 RPM threshold)? A phase-sequence block (PSEQ intercepts before on-line, so it leaves no FAULT-trip record) is something you see only with mis-wiring on the ground.
2. GEN 1 FAULT in cruise, trying to reset after the ECAM is complete. GEN 1 pb OFF/R → ON. Success on-line = a transient fault; trips again = your second chance is used — do not attempt a third. For OV/DP/IPT-type faults the GCU has already refused; repeated cycling only cooks the excitation.
3. GEN FAULT but AC BUS 1 is still alive. Check the BTC arrows on the ECAM ELEC AC page — the automatic transfer has re-hung AC BUS 1 on another source. This is the ordinary-trip script (§9).
4. GEN FAULT and AC BUS 1 is black. This is the lock-BTC family (overcurrent/GLCF/IPT) — the bus is accepted as lost; proceed to the AC BUS 1 FAULT procedure (AC Bus Faults). Read it as the system protecting the network, not a reconfiguration failure.
5. A single source carrying the whole network (the other GEN and the APU both gone). Rehearse the overload five-step script — galleys will be shed silently first; if the OVERLOAD caution sounds, your next step is a manual GALLEY OFF.
6. Wanting to restore the generator after an ENG 1 FIRE handle pull with the fire cleared. FIRE-protection reset needs "PMG frequency = 0 at the trip AND the fire signal cleared" — in an inadvertent-pull case with the engine still turning (PMG still has frequency), the generator will not come back; do not waste time cycling the GEN pb.

13. Five misconceptions

[!warning]- "An amber FAULT light on the GEN pb means a protection trip / a failed generator."

Conditional. A protection trip does light it, but the FAULT light is also on whenever the GLC is open (§9, AMM §7.C note) — FAULT does not necessarily equal a protection trip; it can mean only that the contactor is not on-line.

[!warning]- "On overload, the system always warns me before it sheds galleys."

False. Successful automatic shedding gives no warning at all — the crew may never notice (§10 step ③); you see only a galley legend on the ECAM with no caution. By the time the OVERLOAD caution sounds, automatic shedding has already failed and the manual GALLEY pb is your last resort.

[!warning]- "GEN 1 FAULT — repeated OFF/R → ON will always reset it back on-line."

Conditional. OV / OF fast stage / OC-OL / DP / IPT / SV are the "reset limited to two" family (§8); the GCU ignores the third cycle. Repeated cycling only cooks the excitation.

[!warning]- "GEN tripped and the AC bus is black — the automatic reconfiguration has failed."

False. This is the lock-BTC family (overcurrent/overload, GLCF, IPT) — accepting the bus as lost is the system protecting the network, not a reconfiguration failure (§8): the fault may sit on the bus or in the contactor, and borrowing would feed a short.

[!warning]- "Once the ENG FIRE handle is pulled and the fire is cleared, the generator can be restored."

Conditional. FIRE-protection reset needs "PMG frequency = 0 at the trip AND the fire signal cleared" (§8 table) — in an inadvertent-pull case with the engine still turning (PMG still has frequency) the generator will not come back; do not waste time cycling the GEN pb.

14. Dispatch boundary (MEL)

The electrical end of this article (GCU, line contactor, AC main generation system) maps to the operator MEL item for the AC main generation system (IDG, GCU, line contactor) — a shared item with article 01, but where article 01 looks at the IDG mechanical/oil side, this article looks at the GCU / line contactor / automatic transfer.

Which GEN-class alerts are dispatch-relevant (per the operator MEL, ME-24 alert routing):

Two counter-intuitive points: all three OVERLOAD classes (GEN / APU GEN / EXT PWR) route to the galley-supply item — the dispatch remedy for overload is not "repair the generator" but confirming the galley automatic-shedding function works (echoing the §10 five-step script: the system absorbs overload by shedding galleys, so dispatch only needs the shedding on-line); and the states truly "not related to the MEL" are the crew-selected OFF states — GEN 1(2) OFF / BUS TIE OFF / APU BAT OFF (you turned them off, the part is not broken). The genuine "no-go" items are the bus-level faults — AC/DC BUS, ESS, BAT, TR FAULT, EMER CONFIG, STATIC INV FAULT.

Preconditions for dispatching with one main generation system inoperative (per the operator MEL, MI-24-22, Category C, 2 installed / 1 required) — the key ones, all of which read straight back to the mechanisms above:

• no ETOPS beyond 180 min;
• the APU and the AC auxiliary generation system operating and used throughout the flight (the §7 priority chain — APU GEN stands in for the missing generator the whole flight);
• all busbars energised;
• a check, before the first MEL dispatch and daily thereafter, that the AC BUS 1 → AC BUS 2 automatic transfer works — this is exactly the §9 "the ECMU energises the BTC to restore the bus" verified at the dispatch layer;
• a weekly check that the APU aft-fuel-pump shed in the land-recovery configuration works (the LAND RECOVERY logic of the overview);
• sufficient APU oil for the planned flight before each flight.

Understanding the mechanisms turns these from isolated clauses into "which mechanism must have a stand-in in place before flying with the fault."

What it costs once dispatched (per the operator MEL, MO-24-22): one GEN INOP means the APU GEN runs the whole flight, with a quantified fuel cost:

(Also: with AC main generation system 2 inoperative, the lower-deck crew-rest compartment heating is unavailable.) Dispatching with one generator gone is not "one fewer, no matter" — it pulls the APU into the whole-flight must-use list: carry enough APU oil and pay its fuel burn (heavier the lower you fly and the more packs you carry). That is the hard ledger behind "dispatch is allowed, but at an operational cost."

A whole-fleet hook: this article covers one generator's GCU protection. If the seventeen protections drop both generators at once, the system-level result is ELEC EMER CONFIG — "The electrical emergency configuration is due essentially to the loss of all main AC BUS … All engine generators trip and the emergency generator is driven by the EDP." (per FCTM PR-AEP-ELEC) — taken up in Emergency Electrical Configuration.

Self-test

[!note]- Q1. How does excitation current "get onto the shaft" in a brushless generator?

By induction in the exciter. The GCU (supplied from the PMG) feeds DC to the exciter stator winding, forming a stationary field; the exciter rotor turning within it induces AC; the co-rotating rectifier (six silicon diodes, full-wave bridge) rectifies that AC to DC and feeds it straight to the main generator rotor winding. No brush contact anywhere; the amount of excitation is set by the GCU controlling the exciter-stator current.

[!note]- Q2. What does each GCR / PRR / SVR trip combination mean?

GCR = de-excite (the generator's fire goes out); PRR = cut the GLC's 28 VDC + withdraw the ECMU ground signal (drop off-line) + drive the FAULT light; SVR = stop frequency regulation (servo valve). Most electrical faults trip PRR + GCR; frequency faults add SVR; PSEQ is special — it does not "trip" but inhibits PRR closing (intercepting before on-line) while tripping GCR.

[!note]- Q3. What are the speed / frequency thresholds for coming on-line and dropping off-line?

On-line: PMG >1260 Hz (generator ≈300 Hz) with no protection → GCR closes; 160 ms later, IDG input >4900 RPM → PRR closes → GLC energised + the ECMU validates the logic and supplies the ground → GLC closes. Off-line: IDG input <4680 RPM → GLC opens (a hysteresis pair with 4900); frequency falling to 300 Hz → de-excite.

[!note]- Q4. Which three protections lock out the BTC, and why?

Overcurrent/overload, GLC failure (GLCF), and inadvertent paralleling trip (IPT). The common thread is that the fault may sit on the bus side or in the contactor itself — so closing a BTC to borrow power would connect a good source onto a short-circuit point / a welded contactor and spread the fault to the second half-network. The cost is the affected AC BUS accepted as lost (the full version of FCOM's "overcurrent is not reconfigured").

[!note]- Q5. What is the five-step overload chain, and where does the crew step in?

① Excitation current-limit suppresses → ② still overloaded after 10 s: the GCU has the ECMU shed galleys automatically → ③ effective → no warning (only a galley legend on ECAM) → ④ ineffective: GALLEY FAULT + GEN OVERLOAD caution, crew manually presses the GALLEY pb (the step-in point) → ⑤ still ineffective: BTC latches open, and if the fault persists, de-excitation + GLC opens. Shed galleys can be recovered only on the ground by GALLEY/COMMERCIAL pb OFF→ON, one pushbutton at a time.

[!note]- Q6. Which protections does each CT serve, and why is the 6-hole CT not merely redundant?

The generator CT serves differential + overcurrent (OC); the 6-hole CT serves differential + open cable (OPC); differential uses both. The 6-hole CT compares cable by cable ("one cable of a phase <18 A while the other >38 A"), which is the eye unique to open-cable protection — without it you cannot tell that one feeder cable has broken. So it is not redundant.

[!note]- Q7. For a single-GEN-inoperative dispatch, which condition maps directly to this article's "automatic transfer" mechanism, and at what operating cost?

The MI-24-22 condition "AC BUS 1 → AC BUS 2 automatic transfer works" is the §9 "ECMU energises the BTC to restore the bus" verified at the dispatch layer. The cost is the APU GEN running the whole flight: ground ≈215 / 140 kg/h, in flight FL200/300/410 ≈130 / 65 / 55 kg/h. Remember the routing too: GEN OVERLOAD → galley-supply item (dispatched by confirming galley shedding; all three OVERLOAD classes the same); GEN OFF / BUS TIE OFF → not related to the MEL (crew-selected, not a failed part).

Key takeaways

References

Per AMM 24-22-00 D/O (§3 control/monitoring and the transmission circuit with per-bus priority; §4 GCU dual supply; §6.A the brushless chain, rotor assembly, PMG 1681.3 Hz, 115 ±1 V / 400 ±0.3 Hz, overload 135.5 kVA 5 min / 180 kVA 5 s, CT 1:1000; §6.B the GCU's six functions, regulation at POR, the seventeen protections, maintenance information, ROLS; §6.C the two current transformers; §7.A the on-line sequence and GEN pb positions; §7.B the overload script; §7.C the trip script and BTC lock-out; §7.D BTC/SIC operation and interlock; §7.E the logic circuits); FCOM DSC-24-20 (GEN pb states, differential reset-twice, ECAM 108 % load), DSC-24-10-30-10 (priority order), DSC-26-20-20 (ENG FIRE handle actions); QRH ABN-02 system reset table (commercial/galley recovery on ground) and ABN-16 (no standalone GEN procedure); FCTM PR-AEP-ELEC (the all-generators-tripped hook to EMER CONFIG); the operator MEL (ME-24 alert routing, MI-24-22 single-generation dispatch preconditions, MO-24-22 APU fuel-burn cost). Architecture diagrams read from ASM 24-22-02 (GEN1 power supply and monitoring) and AMM figures 24-22-00-13450 (GCU schematic) and 24-22-00-15600 (GCU power supply). The power-amplification reading, the diode-OR supply reading, the ROLS "let the oil settle" rationale, and the MEL-to-mechanism mapping are integrative synthesis of the above, introducing no facts beyond the source library.

Independent study material, not an Airbus publication. Refer to current operator FCOM, FCTM, and QRH for operational use.