EFCS Computer Architecture — Three PRIM, Two SEC, and the Master Logic

Flight Control Fundamentals crossed the five computers in a single line: 3 PRIM + 2 SEC, and one computer of any type can fly and land the aircraft. This article opens those boxes. What does one PRIM or SEC look like inside (the COM/MON dual channel)? Which one issues the commands, who takes the baton when it cannot, why does a hydraulic loss change a computer role, what happens once every PRIM is gone, where do the five computers draw their power, and what are the ground-reset rules? Read this, and the whole reconfiguration story behind a single F/CTL PRIM 2 FAULT line on the ECAM should be something you can explain from memory.

Throughout, FCPC = PRIM and FCSC = SEC — the same box under its hardware name (FCPC/FCSC) and its operational name (PRIM/SEC). The sources mix the two freely; so will this article.

One frame goes in before anything else, because it is the most common misread of this chapter:

[!warning]- "Master" means the computer that issues the orders, not the computer that moves every surface.

All five computers are working at once, each driving its own servo loops. Only one of them — the master, P1 — turns sidestick demand → control law → surface command into orders and distributes them to the rest. So losing the master is a change of baton, not a loss of control. Hold this distinction or the reconfiguration logic below will read as far more dramatic than it is.

1. The five computers at a glance

The three-axis (pitch / roll / yaw) brain of the A330 is 3 PRIM + 2 SEC. Their headline functions come straight from FCOM. Per FCOM DSC-27-10-10, the three PRIM:

3 PRIM computers (Flight Control Primary Computer – FCPC), each of which is used for: Normal, alternate, and direct control laws; Speedbrake and ground spoiler control; Protection speed computation; Rudder travel limit.

and the two SEC:

2 SEC COMPUTERS (Flight Control Secondary Computer – FCSC) for: Direct control laws, including yaw damper function; Rudder trim, and rudder travel limit.

The dividing line is in the first bullet of each: only PRIM computes the normal and alternate laws and the protection speeds — every soft-wall protection (angle-of-attack, high-speed, bank) lives in PRIM. The moment a SEC has to take over, those protections are gone, because a SEC offers direct law only.

Two things to read off the table. First, FCPC1 and FCSC1 share the 915VU panel — the "side 1" pair. Keep that pairing in mind; it is the key to who survives a total electrical failure (§8). Second, note the counter-intuitive servo count.

[!warning]- The "weaker" SEC controls more servo actuators (11) than the "stronger" PRIM (8).

It looks like a typo, but it is deliberate. Per AMM, each FCPC can control and monitor eight servo actuators, while each FCSC can control and monitor eleven servo actuators. Capability tier and surface coverage are two different axes. A SEC only knows the simplest law (direct), yet it is wired to a wider spread of actuators (elevators, inboard and outboard ailerons, spoilers, rudder, plus rudder trim) precisely so that, as the last electrical line of defence, it can hold the largest possible surface set with the crudest possible law. "Lower tier" never means "covers less".

2. Inside one computer — COM computes, MON watches

Per AMM 27-93-00, the internal architecture the pilot-facing FCOM never shows:

Three FCPCs generate the commands necessary to deflect the primary flight control surfaces. To do this, they use the normal flight laws, or the direct and alternate laws. Each FCPC can control and monitor eight servo actuators. Each FCPC has two channels: a command channel (COM), a monitor channel (MON). The two channels are electrically segregated and mechanically separated by two partitions which form a ventilation well.

Two mechanisms hide in that paragraph.

• Control and monitor. A single PRIM is both the driver of its eight actuators and their supervisor — it commands the surface and watches, in real time, that the surface is doing what was ordered (runaway monitoring) and is not jammed (jamming monitoring).
• Two channels, electrically segregated and physically partitioned. Inside one PRIM are two independent electronic circuits, COM and MON, separated not only electrically but by two partitions forming a ventilation well. The whole point of that physical separation is to make "a single fault that disables both COM and MON together" an extremely improbable event. The computer drives a surface only while both channels agree; the instant any fault makes them disagree, the whole computer drops itself out and hands the work to another.

[!warning]- COM and MON are not two computers backing each other up. MON never drives a surface, and a disagreement retires the whole computer.

A frequent misconception is that COM and MON are two computers in hot/cold standby — "one fails, the other carries on." They are two channels inside one PRIM/SEC, always running together: COM computes and drives, MON only watches by independently sampling its own data (servo position, differential pressure, current) and comparing it against COM's. MON drives nothing. On a COM/MON disagreement the computer does not "switch to the other channel and keep flying" — the entire PRIM/SEC steps down: per AMM, it no longer energizes the solenoid valve of the servocontrol that it drives, the actuator reverts to damping, and the unit retires itself. The reason is that the worst failure in a flight-control computer is not "one computer fewer" (four remain) — it is "a computer that has miscalculated yet still drives the surface" (a runaway). COM/MON exists so that one channel watches the other to the point that driving-while-faulty is, by design, not a state that can persist. That is also why the ventilation-well partition matters so much: it keeps one physical fault from defeating both channels at once.

For the pilot, this reframes F/CTL PRIM 1 FAULT: in the great majority of cases it is a PRIM whose COM/MON vote failed and which therefore made a designed, safe exit — not a computer "crashing out of control". The aircraft is usually still in normal law and the handling is unchanged.

3. What PRIM does, what SEC does — and the rudder hand-off

PRIM's role was set in §1. SEC's relationship to PRIM is the key to the whole degradation ladder. Per AMM 27-94-00:

Two FCSCs generate the commands necessary to deflect the primary flight control surfaces. To do this, they use the laws generated by the FCPCs. If the FCPCs fail, the FCSCs can compute direct control laws. Each FCSC can control and monitor eleven servo actuators.

Three layers:

1. In normal operation a SEC is a hand, not a brain. They use the laws generated by the FCPCs — a SEC does not compute its own law; it executes what the master (P1) has computed and distributed, out on its own servo loops.
2. Only when every PRIM is lost does a SEC grow a brain. If the FCPCs fail, the FCSCs can compute direct control laws — each SEC then self-masters, but in the most basic direct law only (stick proportional to surface, no protections, no autotrim, "USE MAN PITCH TRIM"). This is the origin of the all-PRIM-lost → direct law rung from the fundamentals chapter.
3. SEC covers 11 actuators, PRIM 8 — the §1 counter-intuition again, now grounded: fewer laws, wider reach.

The same source pins the rudder hand-off, and it names a specific SEC. Per AMM 27-94-00:

The FCSC 1 becomes active for the rudder servoing when the three FCPCs lose the normal electrical servoing.

with the note that rudder trim still needs power of a different kind — at least one hydraulic system is necessary to allow servoing of the rudder trim. It is FCSC 1 (not FCSC 2) that picks up the rudder, which echoes the "915VU side-1 pair is the toughest" theme. Beyond SEC there is still the BCM for yaw, but only once PRIM and SEC are both gone — see Electrical Back-up BCM/BPS.

4. How the computers share the surfaces

§2 was inside one computer; this is how the computers divide the work between them — the wiring base that decides which surface is lost in which three-failure combination. FCOM does not carry it; AMM does.

4.1 The wiring base: which computers feed each actuator

Before "which PRIM commands which surface", AMM-27-90-00 fixes something lower-level — the electrical wiring of each servo. This is the true physical foundation of "one computer can land it". Per AMM 27-90-00:

The inboard aileron electrohydraulic servocontrols, the elevator electrohydraulic servocontrols and the middle rudder electrohydraulic servo control are each connected to two computers: one FCPC, one FCSC. Each of the upper and lower rudder electrohydraulic servocontrols is connected to one FCPC and to the BCM. The other servocontrols are connected to one FCPC or FCSC.

Read line by line:

• The critical actuators carry both a PRIM and a SEC line. Inboard aileron, elevator and middle-rudder servos each have one FCPC + one FCSC. Even with every PRIM retired, an independent SEC line can still drive them. This is what "any single computer ensures safe landing" actually rests on at the servo level — not just "a computer can compute", but "every critical surface is fed by two independent control lines; lose one, the other remains."
• Upper and lower rudder servos carry FCPC + BCM, not FCSC. Of the three rudder servos, the middle one is FCPC+FCSC, but the upper and lower hand their second line to the BCM — a control path outside the PRIM/SEC population. So even with PRIM and SEC both gone, the rudder keeps a path. This is the wiring reason why the BCM exists: yaw is the one axis that must survive the loss of all PRIM+SEC electrical control.
• The remaining servos (outboard ailerons, spoilers) carry one computer only. Shallower redundancy — which is exactly why, in a three-failure case, an outboard aileron is the last survivor, and why a spoiler (one panel, one actuator, one computer) has no one to cover it (§5).

4.2 The allocation: ailerons, elevators, THS

Ailerons — inboard to PRIM 1/2, outboard to PRIM 3. Per AMM 27-93-00:

inboard aileron for the FCPC 1 and 2 and outboard aileron for the FCPC 3

That single allocation is why, in the EFCS Computer Failures ELEV REDUND LOST cascade, the left outboard aileron is the last surface standing — it hangs off PRIM 3 and a specific hydraulic system, the last link in the redundancy chain to drop.

Elevators — two PRIM, one active and one standby, coordinated by mutual damping. Per AMM 27-93-00:

The FCPC 1 and 2 COM and MON channels are used for pitch servoing. The active computer drives its dedicated servovalve and energizes the solenoid valve in the adjacent servocontrol to put it in the damping mode. The computer in standby drives its dedicated servovalve (enabling monitoring) but does not energize the solenoid valve of the active servocontrol. In the event of a double hydraulic pressurization, the active computer no longer energizes the solenoid valve of the adjacent servocontrol (the two servocontrols are then active). NOTE: The servocontrol is in active mode when the two windings of its solenoid valve are not energized.

Each elevator has two actuators: normally one active (driving) and one damping (held following), while the standby computer behind it computes and monitors continuously, ready to take over instantly — much faster than a cold-standby switch. Double hydraulic pressurisation is the performance mode: with enough hydraulic power both actuators go active together.

THS — commanded via the DEM, which is why "check pitch trim after a PRIM reset". Per AMM 27-93-00:

The COM unit sends a bus to the servoing electronics (DEM) located on the THS actuator. On this bus, the FCPC sends a label which includes the deflection instruction, an engage boolean and a test request boolean. This request takes place when the FCPC detects a power rise and when it is on the ground.

and the protective comparison:

runaway monitoring obtained through comparison between the THS position and the estimated position, function of the order and of the electric and hydraulic motor modeling.

This gives the reset rule a hard mechanism: an FCPC, on detecting a power rise while on the ground (a reset is a power-off then power-on), sends a test request and re-initialises its THS channel — so the trim position can jump, which is exactly why the QRH tells you to verify pitch trim after a PRIM reset (§8). The runaway monitor (real position vs modelled position) is also how a THS runaway (STAB CTL FAULT) is caught — see Trimmable Horizontal Stabiliser.

Rudder — three PRIM in parallel, degrading triplex → duplex → simplex. Per AMM 27-93-00:

The FCPC 1, 2 and 3 COM and MON channels are used for rudder servoing. The three FCPCs are simultaneously active on the three servocontrols. NOTE: When a failure is detected, the FCPC no longer energizes the solenoid valve of the servocontrol that it drives. Therefore, only two servocontrols are active.

All three PRIM drive the rudder's three parallel servos at once, with effort synchronization to compensate force fighting between them. One PRIM detecting its own fault drops out and the rudder runs on two — the physical basis of triplex → duplex → simplex degradation, deepened in Rudder and Yaw.

4.3 The interface, as one diagram

A single FCPC, read off the AMM interface description (inputs → processing → outputs):

   INPUTS                       ONE FCPC (PRIM 1 / 2 / 3)              OUTPUTS
                            ┌──────────────────────────────┐
 sidesticks ────┐          │  (1) validate inputs          │          ┌─ aileron
 pedals ────────┤          │  (2) compute control law      │   servo  │  rudder
 accel / gyros ─┤ analogue │  (3) drive + monitor servos   ├─ current ┤  elevator
 hyd pressure ──┼─ digital ►│      (engage + servo loop)    │          └─ spoiler
 THS wheel ─────┤ discrete │  (4) self-monitor + flag fault│
 ADIRU / EEC ───┤          │   ┌──────────┐  ┌──────────┐   ├─ ARINC 429 ► FCDC, FMGEC,
 other FCC ─────┘          │   │   COM    │  │   MON    │   │            BSCU/FCSC, DEM
                           │   │ compute  │  │  watch   │   │
                           │   │ + drive  │  │  only    │   ├─ relay ► servo solenoid-valve
                           │   └──────────┘  └──────────┘   │          cut-off, battery cut-off
                           └───────────────┬────────────────┘
   hydraulic pressure switches ────────────┘ tell the FCPC which of G / B / Y is pressurised

Read three things off it. The PRIM is not just a sidestick reader — it ingests many sensors, several digital buses (other computers, ADIRS, landing-gear LGCIU, engine EEC) and discretes; the hydraulic pressure switches sit right here, and are how the computer knows which of Green/Blue/Yellow still has pressure (the physical sense behind §6's green-loss master switch). The four processing steps are the whole job of a PRIM. And the relay outputs include servo solenoid-valve cut-off and battery cut-off — the physical means by which a computer that has detected its own fault steps off the surface and out of the power chain.

5. The master logic

This is the core paragraph of the chapter; it carries five separate rules. Per FCOM DSC-27-10-10:

In normal operation, one PRIM computer is declared to be the master (P1). It processes the orders and sends them to the other computers (P1 / P2 / P3 / S1 / S2), which will then execute them on their related servo-control. If one computer is unable to execute the orders sent by the master, another computer executes the task of the affected computer (except for spoiler control). If the master computer (P1) cannot be the master, then P2 (or P3, if P2 is not available) becomes the master. Note: When the green hydraulic system is lost, P2 replaces P1 as the master computer. In case all PRIM computers are lost, each SEC is its own master and controls its associated servoloop in direct law. A single SEC can provide complete aircraft control in direct law.

The five rules, unpacked:

1. Master = the single order-issuer. P1 computes sidestick → law → surface command and distributes to P1/P2/P3/S1/S2, each of which executes on its own servo loop. The role is only about who computes and distributes.
2. Whoever cannot execute is covered by another — except the spoiler. A failed computer's surface is taken over by another, except for spoiler control. Each spoiler panel is hard-bound one-panel-one-actuator-one-computer, with no spare allocation, so spoiler faults show up as "these particular panels are unavailable" rather than being silently covered — see Spoilers.
3. Master succession is P1 → P2 → P3. The hand-over chain when the master computer itself cannot be master.
4. Green hydraulic loss → P2 master, even with P1 healthy — the chapter's sharpest counter-intuition, taken apart in §6.
5. All PRIM lost → each SEC self-masters in direct law. With all three PRIM gone, the two SEC stop waiting for orders and each becomes its own master in direct law; a single SEC can provide complete aircraft control in direct law — the last electrical rung before the mechanical/BCM back-ups.

The succession and the green-loss exception together:

  P1 master ──(P1 cannot be master)──► P2 ──(P2 n/a)──► P3
      │
      ├─(GREEN lost, P1 still healthy) ─────► P2 becomes master
      │
      └─(all 3 PRIM lost) ─► each SEC self-masters in DIRECT LAW
                             (a single SEC controls the whole aircraft)

6. Why green-hydraulic loss moves the master

[!warning]- A master change does not mean the master computer failed. Green hydraulic loss moves the master from P1 to P2 with P1 perfectly healthy.

The everyday hand-over is "P1 cannot be master, so P2 takes over". But FCOM adds a separate rule: when the green hydraulic system is lost, P2 replaces P1 as the master computer — and here P1 has not failed at all. It is a hydraulic state driving a computer role, independent of P1's own health. This is a high-frequency trap in recurrent simulator checks and theory exams.

FCOM gives the conclusion; FCTM gives the mechanism. Per FCTM PR-AEP-F_CTL (technical background):

Green hydraulic power is lost. Flight controls computers will switch, this allows the ailerons and elevators to be recovered.

Put the two together and the loop closes (this last step is integrative reasoning, not a single verbatim line): the actuators driven by P1 are tied more closely to the Green system. When Green is lost, P1's drivable surface set collapses; promoting P2 — tied more completely to Blue/Yellow — re-distributes the orders so that the ailerons and elevators that would otherwise have been lost are recovered via other hydraulic actuators. That is precisely what FCTM's computers will switch... allows the ailerons and elevators to be recovered describes. So:

• Green loss → master to P2 is about preserving actuation capability, not about P1 being sick.
• It is a genuine coupling point: a hydraulic state (ATA-29), sensed through the computer's pressure-switch discretes (§4.3), directly rewrites the computer role allocation (ATA-27). Hydraulics and flight control are conjoined here.

7. One computer flies and lands — and what it takes to lose a surface

The safety claim, restated in this article's context. Per FCOM DSC-27-10-10:

One computer of any type is capable of controlling the aircraft and of assuring safe flight and landing.

The other face of "one is enough" is knowing how bad it must get to actually lose a surface. FCTM draws that boundary concretely — the real "end of redundancy". Per FCTM PR-AEP-F_CTL (introduction):

Each ailerons and each elevators are hydraulically powered either by the Green or the Blue or the Yellow circuit and are controlled either by the PRIM or the SEC. This architecture, detailed in QRH/ Operational Data, provides a high level of redundancy. However, a combination of three failures affecting flight control computers and/or servocontrol and/or hydraulic might lead to the loss of several ailerons and one or both elevators simultaneously. Although the aircraft can be flown in such a configuration, the F/CTL ELEV REDUND LOST procedure (triggered in case of dual failures case) has been developed to anticipate this three failure cases and is designed to smooth the aircraft handling transient.

Losing a surface is not a single-computer event. It takes three failures stacked across the computer, the servocontrol and the hydraulic dimensions. FCTM's worked example is loss of Green + PRIM 2 (which triggers ELEV REDUND LOST) + SEC 2 — only after those three steps do both elevators go and the left outboard aileron remain. That is exactly why one computer suffices yet five are fitted: to push "loss of a surface" out to a three-failure stack, an extremely improbable event. The procedure detail is in Control Surface Fault Spectrum.

8. Power supply, transients, and ground reset

8.1 Where the five computers draw power

The supply decides who dies first under electrical failure. Per AMM 27-00-00:

The flight controls are supplied with DC power from the essential busbars 4PP, 8PP and the normal busbar 2PP.

and the side-1 pair has a private route:

The FCPC1 and FCSC1 power supply is performed through a PSDU (diode box).

The FCPC1 and FCSC1 also can be supplied from the batteries if at least one hydraulic system is pressurized. This condition is achieved via relays and a logic built into each computer, which control relay cutoff if the pressures in the three hydraulic systems are detected low.

Three pilot-level points:

1. Flight-control computers run on DC, off 4PP/8PP (essential) and 2PP (normal) busbars.
2. FCPC1 + FCSC1 (the 915VU side-1 pair) can draw from the batteries — the reason they are the toughest — but only while at least one hydraulic system is pressurised. If all three lose pressure, the battery feed is cut, because with no hydraulics a powered computer can drive nothing, so holding battery power would be pointless. This ties "electrical" back to "hydraulic" once more.
3. Bus loss reconfigures deliberately. Losing 2PP drops most flight-control components, except the FCSC2 (re-fed from 403PP) and the PFTU-TRIM2 (re-fed from 801PP) via a dedicated relay. The full reconfiguration fault tree is in EFCS Computer Failures.

8.2 Riding through electrical transients

Will the computer "reboot" during a bus switch? AMM gives a precise duration-vs-consequence table. Per AMM 27-94-00:

(1) Transparency: The computer behavior is not affected by a power cut less than or equal to 10 ms. (2) Power cut between 10 ms and 200 ms: All the RAMs are saved and the computer is re-activated in less than 150 ms. (3) Power cut between 200 ms and 5s: The computer re-initializes all its RAMs before starting again. (4) Power cut greater than 5s: If the aircraft is on the ground, with the engines shut down, i.e. if the three hydraulic system pressures are low, the computer runs safety tests.

and the airborne case:

If the aircraft is in flight, the computer behavior is the same as for a power cut of between 200 ms and 5s (no safety tests).

Three counter-intuitive readings:

1. A cut of 10 ms or less is invisible — which is why a momentary bus transfer never downgrades the flight controls; the transient is far shorter than 10 ms and the computer rides through transparently.
2. Safety tests never run in flight. The lengthy self-test only runs on the ground, engines shut down, all three hydraulics low. Airborne, even a long cut takes the fast re-initialisation path with no self-test — because in the air you need the computer back immediately, not stopping for a check-up. Same philosophy as the ground-only THS test request in §4.2.
3. The "5 times" limit is a ground-maintenance trap. On the ground, skipping the interrupted safety test is allowed only 5 times — which is why ground troubleshooting cannot endlessly power-cycle a computer.

8.3 The ground-reset rules

When a computer misbehaves on the ground, the QRH gives hard rules. Per QRH ABN 02.02A (System Reset Table, F/CTL):

PRIM/SEC may be reset, except in the following case: The ELEC DC BUS 2 FAULT caution is present. Note: Do not attempt a reset because this would result in a loss of related PRIM/SEC. The reset must be followed by a flight controls' check. WARNING Do not reset more than one computer at a time. Note: When a PRIM reset is performed, the crew must check the pitch trim position.

Commit three: ground only; one computer at a time; check pitch trim after a PRIM reset (because PRIM owns autotrim and, per §4.2, the THS channel re-initialises on power-up, so the trim position can jump). And the exception: do not reset with ELEC DC BUS 2 FAULT present, or you lose the related PRIM/SEC.

9. The computers also command outward

The interface diagram's discrete outputs are not just status flags — two of them are the flight controls issuing orders to other systems. Per AMM 27-93-00 (discrete outputs), the FCPC signals include:

Start of EMP Blue authorized and inhibition of EMP Green

and:

AP1 AUTHORIZED

Two high-value cross-system couplings:

• The FCPC commands the hydraulic electric pumps. The flight controls do not just passively consume hydraulics — a PRIM actively authorises the Blue electric pump to start while inhibiting the Green electric pump, scheduling hydraulic resources to its own needs. This is a more active coupling with ATA-29 than the passive "green-loss master switch".
• The FCPC authorises autopilot engagement. Whether the autopilot can engage requires PRIM's consent (AP1/AP2 AUTHORIZED). This is why a severe flight-control degradation drops or inhibits the AP — not because the AP itself failed, but because PRIM withdrew the authorisation. The AP sends its demands through PRIM (via the FMGEC, see Flight Control Fundamentals), and PRIM in turn gates whether the AP may come online — a two-way relationship.

10. The five computers across a flight

Six short scenes turn the static architecture into a moving picture:

1. Normal take-off — P1 (master) computes the elevator command in ground/flight mode and distributes to P1/P2/P3/S1/S2, each executing on its own servos; all three PRIM drive the rudder's three parallel servos at once. You feel nothing — that is normal law working.
2. One PRIM retires (F/CTL PRIM 2 FAULT) — most often a COM/MON vote failure and a designed exit. Its surfaces are taken over by another computer (spoilers excepted); if it was the master, succession runs P1 → P2 → P3. The law is usually still normal and the feel unchanged — you mainly see an ECAM note and work the procedure.
3. Green hydraulic loss — the master moves from P1 to P2 with P1 healthy, and the switch recovers the ailerons and elevators (§6). Hydraulics moving a computer role, live.
4. Ground reset of a computer — ground only, one at a time, and check pitch trim after a PRIM reset; do not reset with ELEC DC BUS 2 FAULT present (§8.3).
5. All PRIM lost — both SEC self-master in direct law, FCSC 1 picks up the rudder; protections and autotrim are gone (USE MAN PITCH TRIM), yet a single SEC still flies the aircraft home. Only below this does yaw fall to the BCM.
6. Three failures stacked (ELEV REDUND LOST) — Green loss + PRIM 2 loss + SEC 2 loss: both elevators gone, left outboard aileron remaining. FCTM built the ELEV REDUND LOST procedure specifically for this extremely improbable stack, smoothing the handling transient. This is the end of redundancy — it takes three independent failures to reach it.

Self-test

[!note]- Q1. How many PRIM and SEC are there, which laws does each compute, and how many servos does each control? Why does the "lower-tier" SEC control more actuators?

3 PRIM (FCPC) compute normal/alternate/direct laws plus speedbrake + ground spoiler, protection-speed computation and rudder travel limit, and each controls and monitors eight servo actuators. 2 SEC (FCSC) normally only execute the laws the PRIM computed; only if all PRIM fail does a SEC compute direct law itself (including the yaw damper), and it also handles rudder trim — each controls and monitors eleven servo actuators. There is no contradiction: capability tier (how many laws, whether it carries protections) and surface coverage (how many actuators) are different axes. The SEC is designed to hold the widest surface set with the simplest law, as the last electrical line of defence.

[!note]- Q2. What is the master? Who succeeds P1? Why does green-hydraulic loss make P2 the master, and is that the same as "P1 failed, so P2 took over"?

The master is the single order-issuer: P1 turns sidestick + law into surface commands and distributes them to P1/P2/P3/S1/S2 — it is not "the only one working". If P1 cannot be master, succession is P1 → P2 → P3. But when the green hydraulic system is lost, P2 replaces P1 as the master even with P1 healthy — which is not the same as a computer-failure hand-over. The mechanism: P1's actuators are tied more closely to Green, so after Green is lost, making P2 (tied more completely to Blue/Yellow) the master recovers the ailerons and elevators via other hydraulic actuators — per FCTM, flight controls computers will switch, this allows the ailerons and elevators to be recovered.

[!note]- Q3. What do the COM and MON channels of one PRIM each do, and what happens on a disagreement? Why is it not "switch to the other channel and keep flying"?

COM computes and drives the servos; MON only watches, by independently sampling its own data (position, differential pressure, current) and comparing it against COM's — MON drives nothing. On a disagreement the whole PRIM steps down: it stops energising the servo solenoid valve, the actuator reverts to damping, and the computer retires itself. It is not a channel swap, because the worst flight-control failure is a computer that miscalculates yet keeps driving (a runaway); the entire purpose of COM/MON is to make "driving while faulty" impossible to sustain. The two channels are electrically segregated and physically split by two partitions forming a ventilation well, so one physical fault cannot defeat both.

[!note]- Q4. Why is one computer enough to land, and conversely how bad must it get to actually lose a surface?

FCOM states one computer of any type is capable of controlling the aircraft and of assuring safe flight and landing, because each aileron/elevator is powered by one of Green/Blue/Yellow and controlled by a PRIM or a SEC. The deeper wiring base: inboard ailerons, elevators and the middle rudder servo are each fed by one FCPC + one FCSC (upper/lower rudder by one FCPC + BCM), so one control line can fail and the other still drives the surface. To actually lose a surface needs three stacked failures across computer + servocontrol + hydraulic — typically Green loss + PRIM 2 + SEC 2 — before both elevators go and only the left outboard aileron remains. Five computers exist to push "loss of a surface" out to that three-failure improbability.

[!note]- Q5. How are the five computers powered, which two can run on batteries, and what are the ground-reset rules?

They run on DC, off 4PP/8PP (essential) and 2PP (normal) busbars. FCPC1 + FCSC1 (the 915VU side-1 pair) are fed through a PSDU (diode box) and can be supplied from the batteries if at least one hydraulic system is pressurised (all three low → battery feed cut). Ground reset: ground only; one computer at a time; check pitch trim after a PRIM reset; and do not reset with ELEC DC BUS 2 FAULT present (it would lose the related PRIM/SEC).

[!note]- Q6. Does the flight-control computer reboot during a bus transfer, and does it self-test in flight?

A power cut of 10 ms or less is transparent — the computer behaviour is unaffected, which is why a momentary bus transfer never downgrades the controls. Between 10–200 ms it re-activates in under 150 ms with RAM saved; 200 ms–5 s forces a RAM re-initialisation. The long safety test runs only on the ground, engines shut down, all three hydraulics low (and may be skipped only 5 times). In flight the computer never runs the safety test — even a long cut takes the fast re-initialisation path, because airborne you need it back immediately, not stopping for a check-up.

Key takeaways

References

Per FCOM DSC-27-10-10 (PRIM and SEC functions; master logic incl. green-loss P2 swap, all-PRIM-lost SEC self-master, single SEC complete control; one computer of any type ensures safe flight and landing). Per AMM 27-90-00 (computer–actuator arrangement: inboard aileron / elevator / middle rudder each on one FCPC + one FCSC, upper/lower rudder on one FCPC + BCM, others on a single computer). Per AMM 27-93-00 (FCPC: three computers, eight servos, COM/MON dual channel + ventilation well; aileron allocation inboard PRIM 1/2, outboard PRIM 3; elevator active/standby damping pairing; THS via DEM, ground power-up test request, runaway monitoring; rudder triplex with effort synchronisation; discrete outputs — EMP Blue start / EMP Green inhibition, AP1 AUTHORIZED). Per AMM 27-94-00 (FCSC: two computers, use FCPC laws, compute direct law if FCPC fail, eleven servos, FCSC 1 takes rudder, rudder trim needs ≥1 hydraulic; power-up behaviour four tiers, no in-flight safety test, five-times limit). Per AMM 27-00-00 §3.B (DC supply 4PP/8PP/2PP, PSDU diode box, FCPC1/FCSC1 battery supply condition and relay cutoff, 2PP-loss reconfiguration). Per FCTM PR-AEP-F_CTL (green-loss computer switch recovers ailerons and elevators; three-failure combination and ELEV REDUND LOST background). Per QRH ABN 02.02A (PRIM/SEC reset: ground only, one at a time, check pitch trim, ELEC DC BUS 2 FAULT exception). The interface diagram is redrawn from the AMM 27-93-00 FCPC interface description. Couplings flagged as reasoning (P1's actuators being more closely tied to Green; "915VU side-1 pair is the toughest") are integrative synthesis of the cited FCOM/FCTM/AMM statements, to be confirmed at actuator level in Servocontrols and Actuation, not verbatim manual statements.

Independent study material, not an Airbus publication and not endorsed by the manufacturer. Always defer to the current operator FCOM, FCTM, and QRH for operational use.