Automatic Reconfiguration — Overview

This article opens the failure and abnormal half of ATA 24. The earlier articles built the network — its sources, buses, contactors and control units; the next group dismantles it one fault at a time, from a single lost generator through combined failures to total loss. Before walking those individual procedures, one map has to be drawn whole: the automatic reconfiguration rules of FCOM DSC-24-10-30-30. That map is the skeleton of every downstream article, so it is set out here in one place, with the detailed procedures (articles 22–30) left to expand each branch.

Two threads run through the whole failure phase, and both are established here. The first is "the system acts before you do" — by the time a caution rings, most of the reconfiguration is already complete, so the first crew action is to read, not to switch. The second is the "overcurrent — no reconfiguration" red line, the same philosophy applied symmetrically to the AC and DC sides: the network would rather drop a bus than feed a healthy source into a suspected short circuit.

1. Where this article sits

By the end of this article you should be able to answer five questions, each of which a downstream article then expands:

1. What is the automatic action chain after a single engine-generator failure, and what is the exception?
2. After AC BUS 1 fails, what migrates automatically — and why is AC BUS 2 different?
3. The TR-failure spectrum has four combinations; what is left in each?
4. What is the physical form of "overcurrent — no reconfiguration" on the AC side and on the DC side?
5. What is the double cost of a differential-protection failure?

Scope. This article owns the reconfiguration map — the front half of FCOM DSC-24-10-30-30, taken as the skeleton. It carries no new mechanism: every action chain traces back to a component already covered (GCU protection, the ECMU, the priority order, the AC ESS feed transfer, the TRs, the DC network transfer and the batteries). The ECAM-by-ECAM procedure for each fault — the actual PRO-ABN steps — belongs to GEN/IDG failures, AC bus faults, AC ESS bus fault/shed, DC bus faults, DC ESS bus fault/shed, TR/battery faults, ECMU fault, the emergency electrical configuration and battery-only flight.

The reconfiguration cascade in one picture (an integrative synthesis of §§2–5; each rung is verbatim-sourced in its own section):

Normal: GEN 1 + GEN 2 ────────────────── whole network, 100 %
  │ lose one generator (§2)
  ▼
Source substitution: APU GEN if available, else the other engine GEN
   carries the whole network ──── network held (galley/commercial shed)
   ⚠ red line 1: a generator tripped on OVERCURRENT is NOT reconfigured;
                  its AC BUS is accepted as lost
   ⚠ red line 2: differential-protection failure → generator not replaced
                  AND its TR switched off (AC and DC both shrink)
  │ lose AC BUS 1 (§3)
  ▼
Half-network: AC ESS family transfers to AC BUS 2 (≈ 3 s) ── ESS held
  │ lose AC BUS 1 + AC BUS 2 — all main AC gone (§5)
  ▼
Emergency layer: EMER GEN auto-supplies the AC ESS bus
   (Green from engine pumps, or from the RAT if both engines lost)
  │ EMER GEN also unavailable, or slats extended on the RAT
  ▼
Last resort: batteries + static inverter ── DC ESS + AC ESS core

2. Single engine-generator failure

The governing FCOM passage, verbatim:

"ECMU provides automatic reconfiguration. Complete network remains supplied. Note: If a generator is lost due to overcurrent detection, reconfiguration does not occur and the related AC BUS is lost."

and, immediately following, the substitution rule:

"The system automatically replaces the failed generator with: ‐ The APU generator if available or, ‐ The other engine generator (automatically shedding part of the galley load and some commercial loads)."

Per FCOM DSC-24-10-30-30.

The action chain. The GCU detects the fault and trips its generator line contactor, removing the source from its half-network. The ECMU then closes the corresponding bus tie contactor (BTC) to borrow power from a healthy source, and the substitute is chosen by the priority order: the APU generator stands second in line, the opposite engine generator last — and when it is the opposite generator that carries both halves, the load now exceeds one generator's rating, so the ECMU sheds part of the galley and commercial loads first (the "secondary priority" mechanism — see Galley and Commercial Loads). All of this is automatic and complete in milliseconds.

The exception, in full. FCOM's operations chapter names only the most common lock — overcurrent — but the BTC latch-open logic is wider. The AMM gives the complete condition set: the BTC is latched open on a "GLC welded" failure or a "non-clarified short circuit" on that generator channel, and on an Inadvertent Paralleling Trip (IPT) — the hardware that enforces the "generators never parallel" rule (see No-Break Power Transfer). The unifying logic: in each of these cases the network suspects a short, or cannot rule one out, so it refuses to feed a second source into the fault and accepts the loss of that AC BUS.

3. Loss of AC BUS 1

The FCOM line for AC BUS 1 loss is a single sentence:

"The AC BUS 2 supplies the AC ESS BUS and the ESS TR automatically."

Per FCOM DSC-24-10-30-30.

Behind that one sentence sits the whole AC ESS feed transfer: the essential family — AC ESS BUS, AC SHED ESS BUS, and downstream the ESS TR feeding DC ESS — migrates wholesale from AC BUS 1 to AC BUS 2, on the order of three seconds, and in flight it does not switch back automatically.

Why there is no "AC BUS 2 failure" line. FCOM lists no separate paragraph for AC BUS 2 loss — and the omission is meaningful, not careless. The essential family hangs on the left network only; AC BUS 2 carries no part of it. Losing AC BUS 2 therefore drops only the right-network loads and TR2 (whose DC job TR1 recovers), and triggers no migration. The two outcomes are deliberately asymmetric — this is the failure face of the left-heavy topology established in the overview, and the procedural difference is worked through in AC Bus Faults.

4. The TR-failure spectrum

The TRs are the one family of power contactors the ECMU does not manage — each TR judges its own faults and opens its own contactor:

"The contactor of each TR automatically opens, in case of: ‐ Overheat, ‐ Minimum current, ‐ Overcurrent, ‐ Open or short circuit. The ECMU provides automatic reconfiguration (except for APU TR). Note: If a TR is lost due to overcurrent detection, reconfiguration does not occur and the related DC BUS is lost."

Per FCOM DSC-24-10-30-30.

Two things to read carefully. First, APU TR is outside the automatic-reconfiguration spectrum — it serves APU start / APU battery charging, not the flight DC network, so it is never reconfigured. Second, the four trip conditions are the FCOM summary of the TR's protection set (overheat / minimum current / overcurrent / open-or-short — covered in detail in Transformer-Rectifiers).

The four reconfiguration combinations (a synthesis of the AMM symmetric-recovery rules quoted in the overview §5 and detailed in DC Network Transfer):

The counter-intuitive pair: with only one main TR surviving, DC ESS is dropped (TR1 must first hand its own job to TR2 before it can cover the ESS TR); yet with both main TRs lost, DC ESS survives — because the ESS TR sits outside the main-TR fault chain. That "both mains lost but DC ESS alive" state is the key background for the DC bus faults article.

5. Total main-generation loss → the emergency generator takes over

The reconfiguration ladder does not stop at generator-to-generator substitution. Its next rung — the loss of all main generators — hands the network to the emergency layer:

"In case of main generators loss: The emergency generator automatically supplies AC power to the aircraft electrical system."

Per FCOM DSC-24-10-30-30. The Green hydraulic source that drives the emergency generator splits two ways:

"The green hydraulic pressure, which powers the emergency generator, is provided by: ‐ Engine(s) driven pump(s), if at least one engine is running, or ‐ The Ram Air Turbine (RAT), if both engines are lost. In this failure case, the RAT automatically extends."

Per FCOM DSC-24-10-30-30. So the trigger is the loss of both AC BUSes, not the loss of both engines: with at least one engine still turning, the engine-driven pumps supply Green pressure (the "pure electrical" case); with both engines stopped, the RAT extends automatically and supplies it. The bus the emergency generator reaches, and at what power, depends on that source split — worked through in Emergency Generator and Emergency Electrical Configuration.

One inhibition, carried on the RAT branch:

"If powered by the RAT only: The EMER GEN is inhibited when slats are extended."

Per FCOM DSC-24-10-30-30 — so in a both-engines-out approach, extending the slats stands the emergency generator down (dedicating the RAT to flight controls), and the landing is flown on batteries (see Battery-Only Flight). The crew also retains a manual override:

"The flight crew can also manually activate the emergency generator by pushing the [EMER GEN] switch."

Per FCOM DSC-24-10-30-30. With this rung in place the reconfiguration cascade is complete: generator substitution → emergency generator → batteries.

6. The two red lines

Red line 1 — overcurrent, no reconfiguration. Its physical form differs on each side but the philosophy is identical. On the AC side it is the GCU latching the BTC open (overcurrent, a welded GLC, an unresolved short, or an IPT — §2). On the DC side it is the TR's own contactor latching open on overcurrent, with no ECMU cover (§4). Both say the same thing: a suspected bus short circuit must not be "rescued", because rescuing it means feeding fresh current into the fault.

Red line 2 — the double cost of a differential-protection failure. The FCOM distribution-table footnote:

"In case of differential protection failure: • The affected generator is not replaced; • The associated TR is switched off."

Per FCOM DSC-24-10-30-40. The differential zone covers the generator and its feeder. When that feeder is suspected, the cost is paid twice: the generator is not replaced, and the TR drawing its power from that feeder is also switched off. One differential trip therefore shrinks the AC and DC layers at the same time — a point easy to underestimate as "just one generator down".

7. Reconfiguration is silent — the handling philosophy

Pull the handling mindset for the whole failure phase together here (the claim that reconfiguration completes before the warning is an integrative inference: the primary source gives each protection an individual millisecond-level delay, and "faster than the eye, faster than the ECAM" is the inductive sum of those).

The A330 network reconfigures before it warns you. The interval from a GCU trip to a BTC closing is measured in milliseconds; by the time the ECAM caution rings, what you see is usually the world after reconfiguration. So the first action in any electrical failure is to read the ELEC page — the four-layer scan of ECAM ELEC Page — to confirm who is now feeding what, not to reach for a switch. Only three classes of event actually need a crew action: a latched BTC (the bus is accepted as lost → run the matching BUS FAULT procedure); a failed auto-shed (an OVERLOAD caution → you press GALLEY); and an AC ESS feeder fault of its own (the AC ESS FEED FAULT legend with AC BUS 1 healthy → you select ALTN — see AC ESS Feed and Transfer).

A memory aid for the whole map (a learning device, not a quote): trip-and-swap in a millisecond — the caution rings on a changed world; overcurrent welds and mis-parallels are refused, the bus declared lost and left un-fed; one differential trip shrinks two layers — so read the page before you act.

[!warning]- Common misconceptions — predict, then check

Read each statement, decide true or false, then check the truth in brackets.

1. "Lose a generator and the ECMU always reconfigures, the whole network stays supplied." — Conditional. The condition is non-overcurrent. If a generator is lost on overcurrent detection, reconfiguration does not occur and the related AC BUS is lost (FCOM). The TR side is the same — overcurrent loses the related DC BUS (§2, §4, §6).
2. "AC BUS 1 and AC BUS 2 failures are mirror images." — False. Losing AC BUS 1 triggers the wholesale migration of the ESS family to AC BUS 2 (≈ 3 s); losing AC BUS 2 triggers no migration — FCOM lists no AC BUS 2 paragraph, because nothing of the ESS family hangs on it. A left-heavy failure face (§3).
3. "An electrical fault is mine to switch out first." — False. Reconfiguration completes before the caution rings; the first action is always to read the ELEC page and confirm the post-reconfiguration state. Only three exception classes need you (§7).
4. "A differential-protection trip just means one generator fewer." — False. It is a double cost — the generator is not replaced and the TR it feeds is switched off — the AC and DC layers shrink together (§6).
5. "After any TR failure the ECMU reconfigures and covers it." — Conditional. FCOM: automatic reconfiguration (except for APU TR) — the APU TR is outside the reconfiguration spectrum (§4).

Self-test

[!note]- Q1. Give the single-generator-failure action chain and its exception.

The GCU trips its line contactor → the ECMU closes the corresponding BTC to borrow power → the substitute is chosen by priority: the APU generator if available, otherwise the opposite engine generator (which then sheds part of the galley/commercial loads, being over one generator's rating). The whole network stays supplied. Exception: if the generator tripped on overcurrent (or a welded GLC / unresolved short / IPT — the BTC latch-open set), reconfiguration does not occur and that AC BUS is accepted as lost.

[!note]- Q2. Why are AC BUS 1 and AC BUS 2 failures asymmetric?

Losing AC BUS 1 auto-transfers the whole essential family (AC ESS BUS + AC SHED ESS BUS, and the ESS TR feeding DC ESS) to AC BUS 2 in ≈ 3 s. Losing AC BUS 2 triggers no migration — FCOM has no AC BUS 2 paragraph because nothing of the ESS family sits on it; only the right-network loads and TR2 are lost, and TR1 recovers TR2's DC job. This is the failure face of the left-heavy topology.

[!note]- Q3. State the four TR-failure combinations and what survives in each.

(1) One main TR (TR1 or TR2) → the surviving main TR restores the lost DC BUS + DC BAT BUS. (2) ESS TR, TR2 available → TR1 recovers DC ESS BUS + DC SHED ESS BUS via the DC BAT BUS / DC BUS 1 (non-overcurrent, both main TRs alive). (3) ESS TR + one main TR → the remaining main TR feeds the two normal DC buses + DC BAT BUS; DC ESS is lost. (4) TR1 + TR2 → DC BUS 1/2 lost at once, DC BAT BUS lost after 7 s, but DC ESS stays alive on the independent ESS TR.

[!note]- Q4. What are the two red lines, in physical form?

Red line 1 — overcurrent, no reconfiguration: AC side = the GCU latches the BTC open (overcurrent / welded GLC / unresolved short / IPT); DC side = the TR latches its own contactor open on overcurrent with no ECMU cover. Both refuse to feed current into a suspected bus short. Red line 2 — differential-protection failure, double cost: the affected generator is not replaced AND the TR it feeds is switched off — AC and DC shrink together.

[!note]- Q5. What is the first crew action in any electrical failure, and what are the exceptions?

Read the ELEC page (the four-layer scan) to confirm the post-reconfiguration state — the system has already acted in milliseconds. Only three exception classes need a crew action: a latched BTC (bus accepted as lost → run the BUS FAULT procedure), a failed auto-shed (OVERLOAD → press GALLEY), and an AC ESS feeder fault (AC ESS FEED FAULT with AC BUS 1 healthy → select ALTN).

Key takeaways

References

Per FCOM DSC-24-10-30-30 (the reconfiguration rules: single engine-generator failure with the overcurrent note and the APU-GEN/other-GEN substitution; AC BUS 1 loss transferring the essential family to AC BUS 2; the TR-failure spectrum with the four trip conditions, the APU-TR exception and the DC overcurrent note; total main-generation loss, the emergency generator auto-supply, the Green engine-pump/RAT source split, the slats-extension inhibition and manual activation) and DSC-24-10-30-40 (the differential-protection-failure footnote: generator not replaced + TR switched off; the batteries-only DC BAT BUS "lost after 7 s"); AMM 24-00-00 D/O (the BTC latch-open set — welded GLC / unresolved short / IPT — and the symmetric TR-recovery rules underpinning the §4 table). Mechanism cross-references — GCU/BTC trip, ECMU contactor management, priority order, the ≈ 3 s essential-family transfer, the DC BAT BUS path, the 7 s battery bridge — are carried in articles 02 / 06 / 07 / 09 / 10 / 11 / 12, where each is quoted at source. The "reconfiguration is silent" handling philosophy and the reconfiguration-cascade diagram are an integrative synthesis of the above and contain no facts from outside the library.

Independent study material, not an Airbus publication. Refer to current operator FCOM, FCTM, and QRH for operational use.