ECMU Fault and Load Warnings

The dispatcher itself falls ill: ELEC ECMU 1(2) FAULT. The procedure is a single line — GEN KEEP ON — but that one line is the most elegant procedural expression of the "double-signature" mechanism from the GCU article. This article also closes out where the load-side warnings belong (OVERLOAD and the galley-shed failure were covered procedurally in GEN and IDG Failures and mechanically in Galley and Commercial Loads).

By the end you should be able to answer five questions: (1) the precise KEEP ON mechanism — why does cycling the GEN pb mean the contactor can never re-close? (2) what is the difference in impact between an ECMU 1 and an ECMU 2 fault? (3) what happens in the corridor? (4) what is the ground external-power consequence? (5) what automatic reconfiguration can still be relied on under this fault?

1. ELEC ECMU 1(2) FAULT — the one-line procedure

GEN 1(2) .......... KEEP ON

"The closure control of associated generator line contactors is lost, but these contactors remain closed provided the GEN pb-sw is at on. The associated AC BUS TIE contactors open. The APU line contactor opens if ECMU 1 is affected."

Per FCOM PRO-ABN-ELEC. The whole wisdom of the procedure is one phrase — do not touch it — and to understand why, return to the double signature.

[!warning]- Counter-intuitive: cycling the GEN pb after an ECMU fault means the GLC will never re-close

A GLC closes on a double signature: the GCU provides the power (the PRR's 28 VDC) and the ECMU provides the ground. With the ECMU ill, the "ground" half of the signature is unsigned. An already-closed GLC is held shut by its hold circuit (the GEN pb at ON maintains the PRR chain); but if you cycle the GEN pb, once the GLC opens it can never re-close — the ECMU half is missing and the closure command can no longer be completed. So the entire procedure reduces to leave it alone. (The source states the contactors "remain closed provided the GEN pb is at on"; the "cycle = permanent loss of closure" reading is integrative reasoning on the double-signature logic.)

The impact difference — the procedural realisation of the ECMU split table:

The real cost is not in what is felt now — every GLC is still closed and the network looks intact — but in the consequence. With the corridor BTC open and no one left to re-close it, losing the own-side generator now means losing that AC BUS directly: there is no automatic reconfiguration to borrow from the other side, and the crew goes straight into the AC BUS FAULT procedure. That is the true price of an ECMU fault: nothing felt now, redundancy already gone (an integrative deduction from the double-signature logic and the open-BTC state).

2. ELEC BUS TIE OFF

"This alert triggers when the BUS TIE pb-sw is set to OFF."

Per FCOM PRO-ABN-ELEC. The BUS TIE pb to OFF — by your hand, or required by a procedure such as the EMER CONFIG island isolation — opens all three contactors (BTC1 + BTC2 + SIC), physically splitting the left and right networks. It is a status-advisory level (not a fault): a tag that rides along with a non-default configuration (see ELEC ECAM Warnings, the status-annunciation family). It is the counterpart of the EMER CONFIG move: to restore power with the APU GEN you must first set the BUS TIE back to AUTO — the island isolation that locks out the faulty side also locks the APU GEN out of the network it reaches through the BUS TIE corridor.

3. Load-warning attribution

This is also where the load-side warnings are put on the map, so the failure chapter has one clear home for each:

• ELEC GEN / APU GEN / EXT PWR OVERLOAD (carrying the "galley automatic shedding has failed" meaning): the procedure and mechanism live in GEN and IDG Failures § the OVERLOAD step and the five-step chain in Galley and Commercial Loads — not repeated here.
• The galley under an ECMU fault: automatic shedding is unmanaged on one side (PART GALLEY) — but on an overload a manual GALLEY OFF still works, because the dual master-relay 2XA path runs via the other ECMU, plus the relay direct-pull (see Galley and Commercial Loads).

4. Flight-deck scenarios

1. Cruise ECMU 2 FAULT. GEN 2 KEEP ON — hands off the GEN 2 pb. Be aware the right corridor is now severed: from here, losing GEN 2 means losing AC BUS 2 directly (no reconfiguration). Run the AC BUS FAULT plan through your mind now, while there is time.
2. ECMU 1 FAULT, then thinking of the APU for redundancy. Even if you start the APU, it cannot join the network — no one is left to close the APU GLC, and APU GEN is already listed INOP. The only "redundancy" left is keeping both GENs healthy.
3. ECMU 1 FAULT on a turnaround. EXT PWR B is unmanaged — plan ground power on EXT A only (which you should be using anyway, see External Power).

[!warning]- Common misconceptions — predict, then check

Read each statement, decide true or false, then check the truth in brackets.

1. "An ECMU fault means a generator is lost." — False. Nothing is lost now — every GLC is still closed (GEN KEEP ON). What is lost is the closure control and the corridor BTC; the cost is latent.
2. "After an ECMU fault, cycling the GEN pb to 'reset' is harmless." — False. Once the GLC opens it can never re-close (the ECMU ground half is missing). The procedure is do not touch it.
3. "ECMU 1 and ECMU 2 faults have the same impact." — False. ECMU 1 also opens the APU GLC (APU GEN INOP) and unmanages EXT B; ECMU 2 unmanages EXT A. The APU asymmetry is the key difference.
4. "Start the APU and it will back up the network after an ECMU 1 fault." — False. With the APU GLC open and no one to close it, the APU GEN cannot join — APU GEN is INOP.

Self-test

[!note]- Q1. What is the KEEP ON mechanism?

A GLC closes on GCU power + ECMU ground (a double signature). With the ECMU ill, an already-closed GLC is held by the GEN pb ON hold chain; cycle the pb and the GLC opens and cannot re-close (the ECMU half is missing). The procedural wisdom is "do not touch it".

[!note]- Q2. What does ECMU 1 lose that ECMU 2 does not?

The APU GLC opens — the APU GEN's ability to join the network is lost (the APU GLC + SIC belong to ECMU 1). On the ground, ECMU 1 loses EXT B management, ECMU 2 loses EXT A management (the cross split).

[!note]- Q3. What is the real cost?

Nothing felt now (the GLCs are all still closed), but redundancy is already gone — the own-side corridor BTC is open with no one to re-close it, so losing the own-side GEN means losing that AC BUS directly (no automatic reconfiguration), straight to the AC BUS FAULT procedure.

[!note]- Q4. What happens to the galley, and does manual shedding still work?

Automatic shedding is unmanaged on one side (PART GALLEY). But a manual GALLEY OFF still works on an overload — the dual master-relay 2XA path runs via the other ECMU, plus the relay direct-pull. So the galley can still be shed by hand even with one ECMU ill.

[!note]- Q5. What automatic reconfiguration can still be relied on?

Everything the healthy ECMU manages carries on (the opposite corridor, the dual-controlled DC ties); the TRs are autonomous (unaffected — see Transformer-Rectifiers); the ESS transfer via the 3XC chain is normal (see AC ESS Feed Transfer). Only the sick side's corridor and the contactors in its name are down.

Key takeaways

References

Per FCOM PRO-ABN-ELEC (ECMU FAULT procedure, the KEEP ON verbatim, the BUS TIE OFF trigger), with the impact table grounded in that verbatim plus the double-signature split of ECMU — Contactor Management. The "cycle = permanent loss of closure" hold-circuit reading and the "nothing felt now, redundancy gone" consequence are integrative reasoning on the double-signature logic. The galley manual-shed path is from Galley and Commercial Loads. ECMU FAULT is a downstream fault, so this article carries no separate MEL section.

Independent study material, not an Airbus publication. Refer to current operator FCOM, FCTM, and QRH for operational use.