ECMU — Contactor Management

The first five articles finished the sources — the IDGs, the GCUs, the APU generator, external power and the emergency generator. From here the chapter turns to a different question: once a source says it is ready, who decides where it connects, and who keeps two sources from ever fighting over the same bus? That job belongs to the Electrical Contactor Management System (ECMS) — a pair of identical Electrical Contactor Management Units, ECMU 1 and ECMU 2. The overview called them the network dispatcher, and the name is exact: every main AC and DC contactor except the TR and battery contactors is theirs to open and close, plus galley shedding, the on-ground No-Break Power Transfer, and the hardware that stops generators paralleling.

The cleanest way to hold the division of labour is a railway image. The station-masters — the GCUs and the GAPCU of articles 02/03/04 — each watch one train and report "mine is ready to depart" (the power-ready signal, PR). Throwing the points and routing the trains is the dispatcher's work: the source says "I am ready", the network decides "where you connect". One dispatcher works the left half of the line, the other the right, and either can throw the connecting points in the middle. This article owns the ECMU itself — its supply, interfaces and drive method — the three galley-shedding scenarios, the ECMU's view of NBPT and its synchronisation window, the ECMU layer of the paralleling trip, and the ECMU's monitoring outputs and failure surface. It leaves the operational narrative of NBPT to No-Break Power Transfer, the priority reasoning to Network Priority, the full ECMU FAULT procedure to ECMU Fault, and the physical galley feeders to Galley and Commercial Loads.

1. Scope and boundaries

By the end of this article you should be able to answer five questions:

1. How do ECMU 1 and ECMU 2 split their inputs and outputs, and which two contactors can either unit drive?
2. What are the ECMU's three supply paths? How does it stay alive when external power is plugged into a dead aeroplane? What is it doing in the emergency configuration?
3. How are the galleys shed in each of the three scenarios — in flight without APU GEN / in flight with APU GEN / on the ground?
4. Which numbers define the NBPT synchronisation window, and what — and where — is the FRU?
5. How many lines of defence does the paralleling trip have, and which contactor does the ECMU layer open first, which second?

What this article owns: the ECMU body (supply / interfaces / drive method), the three shedding scenarios, the ECMU view of NBPT and its synchronisation window, the ECMU layer of the inadvertent-paralleling trip, and the ECMU monitoring outputs. What is left to neighbours: the operational narrative and failure modes of NBPT (08); the priority derivation (07); the ECMU FAULT procedure (28); the physical layout of the galley feeders (15); and the ground-service-bus logic (16).

FCOM frames the two units in one passage — the four functions and the contactor split:

"Two identical Electrical Contactor Management Units (ECMUs) provide: ‐ AC and DC contactors control (excepted TR contactors, which are controlled by the TR itself) ‐ Galley shedding control ‐ No Break Power Transfer control (NBPT) ‐ Monitoring and indicating. … ECMU 1 controls: ‐ The Generator Line Contactor (GLC) 1. ‐ The AC Bus Tie Contactor (BTC) 1. ‐ The APU Generator Contactor. ‐ Both DC Tie Contactors. ‐ The BUS TIE Contactor ‐ The External Power Contactor B. ECMU 2 controls: ‐ The Generator Line Contactor (GLC) 2. ‐ The AC Bus Tie Contactor (BTC) 2. ‐ The External Power Contactor A. ‐ Both DC tie Contactors."

Per FCOM DSC-24-10-20-30. Note the cross-over already visible here: the APU contactor and EXT B belong to side 1, EXT A to side 2 — matching the "EXT B feeds the left half, EXT A the right" wiring of the overview. The two DC tie contactors are controllable by either ECMU (redundancy), and ECMU 1 alone owns the BUS TIE contactor — which the FCOM calls "the BUS TIE Contactor" and the AMM names the System Isolation Contactor (SIC), the same part under two names.

        SOURCE HOUSEKEEPERS                       NETWORK DISPATCHER
   GCU 1 / GCU 2 / GAPCU  (art. 02/03/04)          ECMU 1  +  ECMU 2
   "my source is ready" (PR) ───────────────►   decide where it connects
                                                          │
                          ┌───────────────────────────────┼───────────────────────────────┐
                          ▼                               ▼                               ▼
                 AC main contactors                 Galley RCCBs                  Ground/flight RCCBs
              GLC · BTC · SIC · APU GLC · EPC      + COMMERCIAL loads            + both DC tie contactors
              (every main contactor EXCEPT the TR and battery contactors)

2. Architecture

2.1 The dual-unit division of labour

The two units (FIN 1XM1 / 1XM2, in the avionics bay, zone 120) are identical and interchangeable; pin-programming sets the side, the galley option and the configuration variant. They are cooled by natural convection, each manages half the network, and either one can work on its own. The full passenger-configuration split, input and output:

Per AMM 24-29-00 D/O §3 (passenger-configuration table). Two points in this table reward a closer look.

Why does an ADIRU appear among the inputs? The ECMU's discrete-input acquisition diagram (AMM Fig. 13300) labels the ADIRU-1(3) signal into the ECMU explicitly as "LOW SPEED WARNING AC SPEED < 50 KTs" — a discrete that tells the ECMU "airspeed is below 50 kt". Combined with the LGCIU ground/flight signal, this is what lets the ECMU treat **slow on the ground (< 50 kt)** differently from a high-speed take-off run or flight — the speed gate behind the "battery-only on ground, V > 50 kt vs ≤ 50 kt" split seen in the overview distribution table. The same diagram confirms the ECMU also takes TR 1/TR 2 FAULT + OVER CURRENT as inputs.

The galley output is a "double signature", not a "cross-control". The AMM is decisive:

"the ECMU 1 and the ECMU 2 via the relay 2XA1 manage RCCB 1, 2, 3 and 10, ‐ the ECMU 2 and the ECMU 1 via the relay 2XA2 manage RCCB 4, 5 and 6."

Per AMM 24-26-00 D/O §4.A(1). Read it as each group of galley RCCBs is jointly managed by both ECMUs — the same-side unit controls directly, the opposite-side unit takes part through one 2XA relay. The left galley (RCCB 1/2/3/10) is managed by ECMU 1 directly + ECMU 2 through relay 2XA1; the right galley (RCCB 4/5/6) by ECMU 2 directly + ECMU 1 through relay 2XA2. The 2XA relay is simply the opposite unit's participation channel in that group — not one unit single-handedly reaching across to govern the other side's galleys.

2.2 Supply — three redundant paths, a ground back-door, and an emergency freeze

"In normal configuration: the ECMU 1 is supplied by the sub-busbars 301PP, 401PP and 701PP, the ECMU 2 is supplied by the sub-busbars 303PP, 403PP and 702PP. On ground: the ECMU 2 is supplied directly from the GAPCU EXT A internal supply, the ECMU 1 is supplied directly from the GAPCU EXT B internal supply."

Per AMM 24-29-00 D/O §4.A. Each unit takes three segments — a BAT segment (301/303PP), an ESS segment (401/403PP) and a HOT segment (701/702PP) — diode-isolated to block back-feed, with the ESS segment and the GAPCU internal supply taking priority over the HOT segment.

NORMAL (fed off the busbars):
   301PP (BAT seg) ─┐                              ┌─ 303PP (BAT seg)
   401PP (ESS seg) ─┼─ diode ─► ECMU 1    ECMU 2 ◄─┼─ 403PP (ESS seg)
   701PP (HOT seg) ─┘   (ESS seg + GAPCU internal   └─ 702PP (HOT seg)
                         supply prioritised over HOT)

GROUND BACK-DOOR (cold, dark aeroplane + external power plugged in):
   GAPCU EXT B internal supply ──► ECMU 1
   GAPCU EXT A internal supply ──► ECMU 2
   (wakes the ECMU before any busbar is live, so it can close the EPC)

The ground back-door solves a genuine chicken-and-egg problem. A cold aeroplane is fully dark; you plug in external power — but every busbar is unpowered, so what energises the ECMU to let it close the EPC? The answer is that the GAPCU hands its own internal supply straight across (ECMU 2 fed from the EXT A side, ECMU 1 from the EXT B side); the ECMU wakes, validates its logic, closes the contactor, and the whole network comes alive.

The emergency-configuration state is the article's heaviest counter-intuitive point:

"The ECMU(s) are in standby mode in the electrical emergency configuration. The ECMU(s) do not operate in electrical emergency configuration, but in case of successful engine start or APU start, the ECMU(s) become automatically operative to permit the normal network supply by the available generator."

Per AMM 24-29-00 D/O §4.A(3). In ELEC EMER CONFIG the dispatcher is frozen. The supply path that exists there — CSM/G → EMER GLC → the ESS family — is held entirely by the CSM/G's GCU and hard-wired logic (article 05), not by the ECMU. That is precisely why the emergency network is so "rigid", with no automatic-reconfiguration variety: the control room has gone dark, and only the fire-escape lighting (the hard-wired emergency path) stays lit on a pre-set route. The clause "automatically operative on a successful engine or APU start" guarantees the recovery: the moment a source returns, the dispatcher is back at the desk rebuilding the normal network — the electrical reason the EMER CONFIG procedure rates "consider starting the APU" so highly.

2.3 Sensing and drive

• Two position inputs per contactor. Each contactor reports through one normally-open and one normally-closed auxiliary contact; the acquisition circuit compares them. Both at the same level = an input fault, and the unit then takes a predefined state. A single failed sensing contact cannot, on its own, break anything (per AMM §5.A NOTE; the acquisition figure shows every RCCB reporting through an A/B contact pair).
• Two drive types. Type 1 — the coil power is external and the ECMU switches the ground return; Type 2 — the ECMU builds the coil power internally and switches that supply (per AMM §5.A(1)).
• The opposite side's bus state is computed, not measured. ECMU 1 directly measures only 1XP; it derives 2XP from a boolean equation over contactor states, and ECMU 2 derives 1XP symmetrically:

"1XP = GLC 1 OR (BTC 1 AND APU GLC) OR (BTC 1 AND EPCB) OR (BTC 1 AND SIC AND EPCA) OR (BTC 1 AND SIC AND GLC 2 AND BTC 2)."

Per AMM 24-29-00 D/O §7.A(1)(a). The two equations are mirror images — exactly the "each unit measures only its own side, the other side is computed from the contactor topology" symmetry. The green/amber bus tiles and the connecting lines on the ELEC AC page are the visualisation of these equations. The ECMU reports them to the SDAC over ARINC 429 (label 055) — and the primary source is internally inconsistent here, §5.C writing "label 55" while §7.A writes "055"; this article uses 055.

3. How it works

3.1 Galley shedding — three scenarios

The ECMU decides each galley RCCB by available source + whether there is an overload. The feeder numbering: side 1 = feeders 1/2/3/10, side 2 = feeders 4/5/6, with the sub-busbars 107XP/208XP (the sheddable segments, one per side) and 115XP (commercial). Three scenarios:

① In flight, no APU GEN (a single generator carrying the whole network — the tightest case).

"If one Integrated Drive Generator (IDG) fails, all the galley feeders, except one, are shed by ECMUs. The sub-busbars 107XP,208XP are also shed by ECMUs. The last galley feeder and the sub-busbar 115XP are shed if the ECMU 1 or 2 detects an overload. After this last shedding, no galley supply stays on the defective IDG side."

Per AMM 24-29-00 D/O §6.H(1).

② In flight, with APU GEN (the substitute is on line — the most relaxed case). One IDG failed with the APU GEN taking over: nothing is shed — "the power supply of the galley feeders and the sub-busbars is maintained"; only if the APU GEN itself overloads does it shed what is on its own books. Two IDGs failed (APU carrying the whole network alone): back to scenario ① and the "keep feeder 2" script.

③ On the ground (shed whatever overloads, on the overloaded source's books). Split sourcing (two external sources, or EXT A + APU): all supplied; if one source overloads, only that source's feeders are shed (EXT A's books = 4/5/6/10/208XP; EXT B's or APU's books = 1/2/3/107XP/115XP). One source carrying the whole network (a single GPU or single APU): all supplied until overload, then everything shed. A single IDG on the ground (no APU/GPU): the same logic as in flight.

The design philosophy (integrative): shedding is not all-or-nothing but a graded concession — shed down to "one feeder left" first (the passengers still have hot water), and only clear it to zero when the overload forces the issue; with the APU on line, nothing is shed because the spare power is sufficient. One layer up is the GCU's five-step overload script of article 02: the GCU detects for 10 s → sends the ground signal to the ECMU → and the RCCB action here is the execution end of that step.

3.2 NBPT — the ECMU executes, the GCU/GAPCU judges

In No-Break Power Transfer the roles split cleanly: the request comes from the source housekeeper (GCS switching / engine or APU start-stop / external-power pushbutton activation); the eligibility check is the "synchronisation window" signal; the execution (connect both in parallel briefly, swap fast, drop the parallel) is the ECMU opening and closing contactors; and it happens on the ground only. FCOM states it more plainly, and gives the timing magnitudes:

"This function avoids busbar power interruption during supply source transfer on ground in normal configuration. It is inhibited in flight. The ECMU controls the simultaneous connection of the two sources for a short time. To achieve this, both sources are synchronized on a frequency reference signal sent by the GPCU or GAPCU. Synchronization may take up to 15 s for the APU GEN with GPU, and some milliseconds in all other cases. If synchronization is not achieved within the allowed time, transfer is performed anyway (without simultaneous connection of two sources). This function has a backup in the GCU."

Per FCOM DSC-24-10-20-30. Two points worth fixing: ① NBPT is inhibited in flight (not merely "ground only" — FCOM says inhibited in flight); ② APU GEN ↔ GPU synchronisation can take up to 15 s, all other cases a few milliseconds — which explains the slight delay you feel on the ground when switching between the APU and a GPU (two drifting sources take the longest to beat-match), a useful cognitive anchor.

The synchronisation-window numbers (generator channel):

"the aircraft is on the ground, the power ready (PR) is true, the difference between the generator frequency and the Frequency Reference Unit (FRU) is less than 0.5 Hz, the average of the three phase voltages at POR is 115 VAC plus or minus 5 VAC, the difference between the generator phase and the FRU phase must be: plus or minus 15 degrees to capture, plus or minus 30 degrees to hold."

Per AMM 24-29-00 D/O §6.M(5)(b). The external-power channel is looser: PR true + frequency 400 ±10 Hz + three-phase average 115 ±5 VAC — and no phase check. Why? External power (or the reference calibrated from it) is itself the metronome; the one that has to fall into step is the speed-adjustable generator.

The FRU (Frequency Reference Unit) lives inside the GAPCU, and there are two of them: FRU L serves the left half (channel 1 + APU), FRU R serves the right half (channel 2), distributed to each GCU over a dedicated RS 422 link (per AMM §6.M(5)(c)). Two fall-backs: if any window condition is unmet, the ECMU abandons NBPT and performs an ordinary break-before-make transfer; if the FRU fails or its reference goes out of limits, each GCU reverts to its own internal 400 Hz reference and inhibits NBPT on that channel. (At the GAPCU level there is also the "inhibition latch escalating to a whole-aircraft drop" rule and the FC 889–893 failure-code family — article 04 §3.4, with the operational narrative closed out in article 08.)

3.3 IPT — two layers of defence, staged opening

"If two different sources are coupled in parallel for more than 80 ms, the ECMU opens the applicable contactors (BTC, APU GLC, EPC) to cancel the paralleling. If the paralleling persists (130 ms), the ECMU opens a second contactor. Each time a contactor is open, it is latched in this status until reset occurs."

Per AMM 24-29-00 D/O §6.N(1). The staged-opening table (the full set):

The rule is visible at a glance: open the "corridor" contactor first (BTC/SIC — the cheapest move, it only cuts the borrowing path), and the "source" contactor (GLC/EPC — kicking a source off the network) only if that fails. The IDG 2 side obeys the same logic: IDG 2/APU and IDG 2/EXT B both open SIC first (IDG 2 is on side 2, so borrowed power must cross the SIC corridor), while IDG 2/EXT A opens BTC 2 (the corridor) first and EPC A (the source) second — the mirror of IDG 1/EXT A.

Against the GCU protection table of article 02, the inadvertent-paralleling trip is two layers deep: the ECMU layer acts first at 80/130 ms; the GCU/GAPCU layer backs it up — IPT1 at 160 ms (locks the BTC), IPT2 at +60 ms (trips PRR/GCR), IPT3 at 200–500 ms (an analogue last-ditch). AMM §6.P states explicitly that "back-up protection is provided by each GCU and the GAPCU". A normal NBPT parallel does not trigger the IPT because it completes quickly inside the controlled window — the IPT exists to kill the unplanned, persistent parallel.

3.4 Protection latches and the three reset paths

Three classes of protective action latch: galley overload, the inadvertent-paralleling trip, and any contactor/RCCB short circuit. The reset paths are: ① the RESET pushbutton on the ECMU front face (maintenance, avionics bay); ② a CMS maintenance test; ③ a GALLEY pushbutton OFF → ON cycle — galley-overload latch only. Path ③ is the AMM substance behind the panel-chapter line "Switching OFF then AUTO resets the galleys which have been automatically shed". Note that the crew hold only path ③, and it clears only the galley latch; the IPT and short-circuit latches must be cleared by maintenance.

The crew-side recovery is set out in full by the QRH:

"ELEC — Commercial equipments and galleys — On ground: When the commercial equipment and/or galley loads have been shed by the ECMU, they can be recovered when more electrical power is available. • If COMMERCIAL OFF is displayed on the ELEC SD page: ‐ Switch the COMMERCIAL pb OFF then ON. • If GALLEY SHED or GALLEY PARTIALLY SHED is displayed on the ELEC SD page: ‐ Switch the GALLEY pb OFF then ON. Do not reset more than one pushbutton at a time."

Per QRH ABN-02 02.02A (System Reset table). Three points: ① COMMERCIAL and GALLEY are two independent recovery paths (COMMERCIAL OFF → COMMERCIAL pb; GALLEY SHED → GALLEY pb); ② on the ground only (a shed in flight cannot be recovered); ③ reset one pushbutton at a time. The text the crew read on the SD page is the full form — GALLEY SHED / GALLEY PARTIALLY SHED / COMMERCIAL OFF — the same items the ARINC labels abbreviate to GAL SHED / GAL PART SHED / COM OFF (§3.5).

3.5 Monitoring outputs and the failure surface

The ECMU sends the SDAC three classes of data over ARINC 429 (labels 055/002): bus powered/unpowered (including the boolean-computed opposite side), the six corridor-contactor states (BTC 1/2, APU GLC, EPC A/B, SIC — the connecting lines on the ELEC AC page), and the three shed messages (GAL SHED / GAL PART SHED / COM OFF — the source of the three-level display priority in the FCOM ECAM section).

A total loss of one ECMU shows up in the cockpit as a single chime + MASTER CAUT + EWD ECMU 1(2) FAULT. The AMM puts the impact bluntly:

"loss of the ECMU 1 = loss of side 1, the galley RCCB(s) and ground/flight busbars RCCB(s), loss of the ECMU 2 = same as the loss of the ECMU 1, but for the side 2 RCCB(s)."

Per AMM 24-29-00 D/O §6.L NOTE. Layered onto the §2.1 output table, the failure picture is complete: lose ECMU 1 = GLC 1/BTC 1/APU GLC/SIC/EPC B unmanaged (the APU's and EXT B's ability to connect is impaired); lose ECMU 2 = GLC 2/BTC 2/EPC A unmanaged.

[!warning]- Losing an ECMU is NOT losing power — the GLC self-holds

The single most important counter-intuitive point in this article: a lost ECMU does not drop its bus.

"loss of the ECMU 1: the closure control for GLC 1 is lost, but this contactor remains closed due to a self-holding function, the busbar 1XP remains supplied. BTC 1 and SIC control is lost, power supply of the network from the APU generator or the external power receptacle B is no longer possible."

Per AMM 24-29-00 D/O §6.F(3)(b).

Losing the ECMU loses the closure control for GLC 1 — but GLC 1 stays closed by a self-holding function, so 1XP stays supplied. What is actually lost is control of BTC 1 and SIC (the APU's and EXT B's connection ability). This is the mechanism behind the "GEN 1(2) … KEEP ON" line in the FCOM ECMU FAULT procedure: with the ECMU gone, do not switch the GEN off — the GLC is still self-held and the bus is still fed; switch the GEN pushbutton off and the self-holding falls away, and only then is the bus truly lost. The ECAM step is therefore not the vague "preserve generation" but the precise "do not touch the contactor that is still self-holding".

The procedure itself (expanded in article 28) states "The associated AC BUS TIE contactors open. The APU line contactor opens if ECMU 1 is affected", with a STATUS line GEN 1(2) … KEEP ON and an INOP SYS list that includes APU GEN when ECMU 1 is affected (per FCOM PRO-ABN-ELEC, ELEC ECMU 1(2) FAULT). The DC side has the matching "opposite TR takes over" mechanism (§6.F(4)(b)): with ECMU 1 lost, 1PP/2PP stay supplied and 3PP is recovered by ECMU 2 + TR 2 through 1PC1/1PC2 — the same family as the DC-tie reconfiguration of article 11.

4. Flight-deck operations and abnormals

4.1 Flight-deck scenarios

1. Cold cabin, plug in external power, whole aircraft energises. This single action contains the two boxes' "handshake across the gap": the GAPCU feeds its internal supply to wake the ECMUs (2 fed from the EXT A side, 1 from the EXT B side), and the ECMUs validate the logic and close the EPCs. If the GAPCU has failed, the analogue back-door of article 04 is used (EXT A only).
2. Cruise GEN 1 FAULT, APU not started. The ELEC AC page shows GALLEY SHED but no warning chime — scenario ①: feeders down to one. This is normal graded shedding (the execution end of the GCU five-step script of article 02), not a new fault.
3. After the APU GEN has taken over. The galleys are all back (scenario ②, "nothing shed"). To judge whether the galleys should have power, first ask "who is carrying the network now, and is it overloaded?".
4. In ELEC EMER CONFIG. Expect no automatic reconfiguration — the ECMU is in standby. The ESS supply chain you see is held entirely by the CSM/G's GCU and hard-wiring (article 05). The instant an APU start succeeds, the ECMU returns to work and the normal network rebuilds automatically — the electrical reason "consider starting the APU" carries such weight in the EMER CONFIG procedure.
5. ECMU 1 FAULT. Walk through the impact: APU GLC/SIC/EPC B unmanaged (the APU's connection ability impaired), left galley and ground-service RCCBs lost. Key action GEN 1 KEEP ON: GLC 1 is still self-held and 1XP still supplied — do not switch the GEN pushbutton off (switch it off and the self-holding falls away, and only then is the bus truly lost). Procedure in article 28.
6. Wanting to recover a shed galley on the ground. Cycle the GALLEY pushbutton OFF → AUTO (clears the overload latch only). No effect? The latch may be an IPT or short-circuit one — call maintenance (ECMU panel RESET or CMS).

4.2 Dispatch view (MEL)

"Can the aeroplane still fly with one ECMU failed?" is a real question for crew and dispatch, so it belongs here even though the full ECMU dispatch lives in article 28. Under the operator MEL item 24-29-01 (Electrical Contactor Management Unit, ECMU): repair interval Category C, 2 installed / 1 required, no placard. One may be inoperative provided that the AC and DC transfer functions on both sides are checked to be operative (per the maintenance reference AMM 24-29-00-040-801). The ECAM ELEC ECMU 1(2) FAULT routes to MEL item 24-29-01.

The point: a single ECMU INOP is dispatchable (2 installed / 1 required, Category C, no placard), but the dispatch precondition is maintenance confirming that both-side AC/DC transfer (reconfiguration) functions work — because the remaining unit has to carry the whole network's contactor management on its own (§2.1, "either one can work alone"). This mirrors the IDG dispatch logic of article 02: you may be one short, but the unit shouldering the redundancy must be verified healthy.

[!warning]- Common misconceptions — predict, then check

Read each statement, decide true or false, then check the truth in brackets.

1. "In ELEC EMER CONFIG the dispatcher is still reconfiguring, routing emergency power where it is needed." — False. In EMER CONFIG the ECMU is in standby and does not operate; the ESS supply chain is held entirely by the CSM/G's GCU + hard-wiring (article 05). The ECMU returns to work and rebuilds the normal network only after a successful engine/APU start (§2.2).
2. "Lose one IDG in flight and the galleys are certainly shed." — It depends. Watch for the APU GEN: only a single generator carrying the whole network triggers the graded shedding (keep feeder 2 first, clear to zero on overload); with the APU on line, nothing is shed ("the power supply of the galley feeders and the sub-busbars is maintained"), and only an APU overload sheds what is on the APU's books (§3.1).
3. "The NBPT window is just as tight for the generators and for external power — both must phase-match." — False. The generator channel checks phase (±15° capture / ±30° hold); the external-power channel does not check phase — external power is itself the metronome; the speed-adjustable generator is the one that must fall into step (§3.2).
4. "On a mis-parallel the ECMU kicks the offending source off the network at 80 ms." — Half true. What opens first is the "corridor" contactor (BTC/SIC — the cheapest move, only cutting the borrowing path); only at 130 ms does the "source" contactor (GLC/EPC) open and kick a source off. Graded concession, not an immediate shutdown (§3.3).
5. "A shed galley always recovers with a GALLEY pushbutton cycle." — It depends. The crew hold only the GALLEY pushbutton OFF → ON, and it clears only the galley-overload latch; an IPT or short-circuit latch must be cleared by maintenance (ECMU panel RESET or CMS) (§3.4).

Self-test

[!note]- Q1. How do ECMU 1 and ECMU 2 split their outputs, which contactors does either drive, and how are the galleys managed?

ECMU 1: GLC 1, BTC 1, APU GLC, SIC, EPC B + the left galley (RCCB 1/2/3/10) + ground/flight RCCBs. ECMU 2: GLC 2, BTC 2, EPC A + the right galley (RCCB 4/5/6) + ground/flight RCCBs. The two DC tie contactors 1PC1/1PC2 are driven by either unit (redundancy). The two units are identical and interchangeable, with pin-programming setting the side. The galleys are a double signature: each group is jointly managed by both ECMUs — the same-side unit directly, the opposite-side unit through one 2XA relay (RCCB 1/2/3/10 = ECMU 1 direct + ECMU 2 via 2XA1; RCCB 4/5/6 = ECMU 2 direct + ECMU 1 via 2XA2) — not a single-handed cross-control.

[!note]- Q2. What is the ECMU's supply, and what are its two special states?

Normal: three segments each — ECMU 1 = 301PP + 401PP + 701PP, ECMU 2 = 303PP + 403PP + 702PP (diode-isolated; the ESS segment and the GAPCU internal supply take priority over the HOT segment). Ground back-door: the GAPCU internal supply directly (ECMU 2 from the EXT A side, ECMU 1 from the EXT B side) — solving the chicken-and-egg of a cold aeroplane on external power. Emergency configuration: standby, not operating; it becomes automatically operative on a successful engine/APU start.

[!note]- Q3. In flight on a single generator carrying the whole network, how are the galleys shed? And with the APU on line?

Graded in two steps — immediately shed down to feeder 2 alone (shed 1/3/10 + 107XP and 4/5/6 + 208XP); if the ECMU then detects an overload, shed feeder 2 + 115XP, clearing the bad side's galleys to zero. With the APU GEN on line everything is maintained (only an APU overload sheds what is on the APU's books). On the ground the rule becomes "shed whatever overloads, on the overloaded source's books"; a single source carrying the whole network sheds everything on overload.

[!note]- Q4. What are the NBPT synchronisation-window numbers, what is the FRU, and how is the inadvertent-paralleling trip structured?

Generator channel: on the ground + PR true + frequency-to-FRU difference < 0.5 Hz + POR three-phase average 115 ±5 VAC + phase difference ±15° to capture / ±30° to hold; external-power channel: PR true + 400 ±10 Hz + 115 ±5 VAC (no phase check — external power is the metronome). The **FRU (Frequency Reference Unit) is inside the GAPCU**, two of them (FRU L for channel 1 + APU, FRU R for channel 2), sent to the GCUs over RS 422. NBPT is inhibited in flight, and APU GEN ↔ GPU synchronisation can take up to 15 s (a few ms otherwise). The IPT is two layers: the ECMU layer opens a corridor contactor (BTC/SIC) at > 80 ms and a source contactor (GLC/EPC) at 130 ms, latching on each opening; the GCU/GAPCU layer backs it up (IPT1 160 ms / IPT2 +60 ms / IPT3 200–500 ms).

[!note]- Q5. After ECMU 1 FAULT, is 1XP still powered, and why does the ECAM call for GEN KEEP ON?

Still powered. What is lost is the closure control for GLC 1, but GLC 1 stays closed by a self-holding function, so 1XP remains supplied (AMM §6.F(3)(b)). That is why the ECAM calls GEN 1 KEEP ON — switch the GEN pushbutton off and the self-holding falls away, and only then is the bus truly lost. What is actually lost is control of BTC 1/SIC (the APU's and EXT B's connection ability impaired). A single ECMU is MEL-dispatchable (Category C, with both-side AC/DC transfer functions checked operative — §4.2).

Key takeaways

References

Per AMM 24-29-00 D/O (the ECMS chapter): §3 (dual-unit interchangeability, the input list including ADIRU 1/3 and LGCIU 1, the output split table in passenger configuration, the ARINC dual bus); §4.A (three supply segments + priority + diode isolation, the ground GAPCU-internal supply with ECMU 2 ← EXT A and ECMU 1 ← EXT B, standby + automatic return in the emergency configuration); §5.A/B/C (two-contact acquisition comparison, the two drive types, labels 055/002); §6.A–E (interchangeability, pin-programming, convection cooling, the three latch classes and three reset paths, the function list); §6.G/H/J/K (the three galley-shedding scenarios in full); §6.M (the NBPT flow, the synchronisation-window numbers 0.5 Hz / ±5 V / ±15°·±30° / external 400 ±10, FRU L·R inside the GAPCU, the two fall-backs); §6.N/P (the IPT 80/130 ms staging and pair table, the GCU/GAPCU back-up layer); §6.L NOTE / §6.F(3)(b)(4)(b) / §7.A (the ECMU failure surface, GLC self-holding keeping the bus supplied, the DC-side opposite-TR takeover, the symmetric boolean bus equations, the three shed messages); and AMM 24-26-00 D/O §4.A(1) (the 2XA1/2XA2 double-signature management of the galley RCCBs); AMM Fig. 13300 (the ECMU discrete-input acquisition figure — the ADIRU "LOW SPEED WARNING AC SPEED < 50 KTs" discrete and the TR FAULT + OVER CURRENT inputs). Per FCOM DSC-24-10-20-30 (the four ECMU functions and the contactor split, NBPT inhibited in flight, the 15 s figure, the GCU back-up) and FCOM PRO-ABN-ELEC (ELEC ECMU 1(2) FAULT: GEN KEEP ON, AC BUS TIE open, APU line contactor open for ECMU 1, INOP SYS). Per QRH ABN-02 02.02A (the on-ground galley/commercial recovery, each pushbutton separately, one at a time). Per the operator MEL 24-29-01 (single ECMU dispatch: Category C, 2 installed / 1 required, both-side AC/DC transfer functions checked operative). The "network dispatcher" framing, the graded-shedding reading, the railway-dispatch analogy and the "normal NBPT does not trigger the IPT" window reasoning are integrative syntheses of the above and contain no facts from outside the library.

Independent study material, not an Airbus publication. Refer to current operator FCOM, FCTM, and QRH for operational use.