Servocontrols and Actuation

Flight Control Fundamentals fixed the chapter's founding rule: every A330 surface is electrically-controlled and hydraulically-actuated. EFCS Computer Architecture opened the "electrically-controlled" half — who issues the order (3 PRIM + 2 SEC) — and Pilot Controls covered how the order gets in (sidestick and pedal sensors). This article is the last link in that chain: once a computer has decided "this surface should move by X degrees", how does that electrical figure become a real surface angle?

The hardware that does it is the electrohydraulic servocontrol (the FCOM also calls it a servojack). One end takes the computer's electrical signal through an electro-to-hydraulic converter called the servovalve; the other end taps one of the three hydraulic systems (Green / Blue / Yellow); and a separate mode selector valve (a solenoid valve) decides whether that jack is, at this instant, driving the surface, acting as a damper, or being held in neutral. And the computer is not only commanding — through its two internal channels it is watching every actuator continuously for runaway, jam, and oscillation. That watching is the "monitoring" in this article's title.

[!warning]- "Damping" does not mean disconnected, and "energised solenoid" does not mean "on". Drop both intuitions now.

Two reflexes will mislead you all the way through this chapter. First, a servocontrol in Damping mode is not failed or idle — it is a live hydraulic damper, still loaded, still self-checking, ready to take over in a fraction of a second. Second, energising a servocontrol's mode-selector solenoid does not mean "switch the jack on". On the elevator the polarity is the opposite of what you would guess: a de-energised solenoid leaves the jack active. Both points are deliberate fail-safe engineering, and both are spelled out below.

By the end you should be able to answer five things without notes:

1. What do the three servocontrol modes Active / Damping / Centering mean, and which mode is each of an elevator's two jacks in during normal flight?
2. Is the "standby" jack disconnected and idle? What is it — and its computer — actually doing?
3. On an elevator servocontrol, does energising the solenoid give Active or Damping? Why is that fail-safe, and why is the aileron the other way round?
4. Which hydraulic system and which computer drives each surface, and why don't the rudder's three simultaneously-active servos fight each other?
5. How does a computer know a servocontrol has run away? What do the COM and MON channels each do?

This article stays at the actuator layer: the three modes, master/standby switching, the hydraulic-and-computer allocation, COM/MON monitoring, and the rudder's three-servo parallel arrangement. The surface-specific behaviour that sits above the actuator — maximum deflections, aileron droop with flaps, rudder travel limit versus speed, ground-spoiler and speedbrake automatics, rudder trim — is named here only where allocation requires it and is deepened in the per-surface articles (Ailerons, Elevators, Rudder and Yaw, THS, Spoilers).

1. Anatomy of one servocontrol — the closed electrohydraulic loop

Take one elevator jack apart and the loop is always the same shape: the computer's two channels drive a servovalve and a mode selector valve; hydraulic power moves a jack; the jack moves the surface; a position transducer (plus, on the rudder, a differential-pressure transducer) feeds the real result back to both channels.

        ELECTRICAL CONTROL                  HYDRAULIC ACTUATION
   ┌────────────────────────────────────────────────────┐
   │                one FCPC (PRIM)                     │
   │   ┌──────────┐      ┌──────────┐                   │
   │   │   COM    │◄────►│   MON    │  two segregated   │
   │   │ commands │      │ watches  │  channels: each   │
   │   └──────────┘      └──────────┘  computes, then   │
   │                                   cross-checks     │
   └───────────────┬────────────────────────────────────┘
          SV current  │  EV drive
   ┌───────────────▼────────────────────────────────────┐
   │  servovalve (SV) ......... meters "how much"       │
   │  mode selector valve (EV) ... sets the mode        │
   └───────────────┬────────────────────────────────────┘
               ⇒ Green / Blue / Yellow hydraulic power
   ┌───────────────▼────────────────────────────────────┐
   │  hydraulic jack (servojack)                        │
   │    Active     jack position electrically set       │
   │    Damping    jack follows the surface             │
   │    Centering  jack hydraulically held neutral      │
   └───────────────┬────────────────────────────────────┘
            surface moves → position (+ Δpressure on the
            rudder) transducer feeds back to COM and MON

Three things to read off it before any detail:

• The mode is set by the solenoid valve, not the servovalve. The servovalve (SV) meters how far the jack drives; the mode selector valve (EV) decides whether this jack counts as the worker or the damper. They are separate drive paths from the computer — separate physical functions.
• The computer sends a metered current, not "a number". The current to the servovalve is built up from several terms, and the recipe differs per surface (§9). That is why surfaces position so precisely and so steadily.
• The loop closes on transducers feeding both channels. Surface position (and rudder differential pressure) return to COM and MON alike. Without them the computer is blind, which is exactly why range-monitoring of those transducers is done on both sides.

The "FCPC" in the diagram is the hardware name for a PRIM; FCSC is the hardware name for a SEC (see EFCS Computer Architecture). Each box carries two internally-segregated channels. Per AMM 27-93-00:

Each FCPC can control and monitor eight servo actuators. Each FCPC has two channels: a command channel (COM), a monitor channel (MON). The two channels are electrically segregated and mechanically separated by two partitions which form a ventilation well.

COM computes and issues the order; MON independently recomputes and checks. They are isolated electrically and physically (the ventilation well keeps a fault or overheat in one from taking the other), so a single internal failure cannot make the computer both command and approve a wrong output. A SEC carries more actuators than a PRIM — per AMM 27-94-00:

Each FCSC can control and monitor eleven servo actuators. Each FCSC has two channels: a command channel (COM), a monitor channel (MON).

2. The three modes — Active, Damping, Centering

The FCOM defines the modes on the elevator jack, and this is the dictionary page for the whole article. Per FCOM DSC-27-10-20:

Two electrically controlled hydraulic servojacks drive each elevator. Each servojack has three control modes: • Active: Jack position is electrically controlled. • Damping: Jack follows surface movement. • Centering: Jack is hydraulically maintained in neutral position.

In plain terms:

• Active — the working jack. The computer meters hydraulic fluid through the servovalve and drives the surface precisely to the commanded angle. At any instant at least one jack per elevator is active.
• Damping — a damper, not a disconnect. This is the most-misread mode. A damping jack is not switched off and not idle; it becomes a hydraulic damper — the two chambers communicate through a restrictor, so the jack trails the surface and damps it, preventing flutter from aerodynamic excitation. It can be switched back to active in a fraction of a second to replace the worker.
• Centering — hydraulically held neutral. When all of a surface's jacks lose electrical control, hydraulics no longer let them trail freely but instead hold the surface in neutral so an unattended surface cannot drift. Note the precondition: Centering needs hydraulic pressure still present; lose the pressure too and the jack can only damp (trail).

These modes are invisible and unselectable from the flight deck — there is no mode word on the PFD or ECAM. They are automatic actuator-layer behaviour. But knowing them lets you read the physics behind an ECAM F/CTL indication that a jack is unavailable: the surface either goes to damping (still backed by the other jack) or, in the extreme, to centering (locked neutral).

3. Master and standby — the standby jack is hot, not idle

The FCOM writes the elevator's one-worker/one-damper switching cleanly. Per FCOM DSC-27-10-20:

In normal operation: • One jack is in active mode. • The other jack is in damping mode. • Some maneuvers cause the second jack to become active. If the active servojack fails, the damped one becomes active and the failed jack is automatically switched to the damping mode. If neither jack is being controlled electrically nor hydraulically, both are automatically switched to the damping mode. If neither of the four jacks is being controlled electrically, the four jacks are automatically switched to the centering mode.

The AMM then says what the standby jack — and its computer — is actually doing, down to the solenoid. Per AMM 27-93-00:

The active computer drives its dedicated servovalve and energizes the solenoid valve in the adjacent servocontrol to put it in the damping mode. The computer in standby drives its dedicated servovalve (enabling monitoring) but does not energize the solenoid valve of the active servocontrol. In the event of a double hydraulic pressurization, the active computer no longer energizes the solenoid valve of the adjacent servocontrol (the two servocontrols are then active).

Put the two together and three mechanisms surface:

1. The standby computer runs in parallel the whole time. It drives its own servovalve purely for monitoring — computing the same demand so it can verify, in real time, that it could take over cleanly. "Standby" is therefore not cold reserve but hot standby with continuous self-check, which is why the handover is seamless when the worker fails.
2. "Some manoeuvres make the second jack active too." The FCOM line maps to the AMM's double hydraulic pressurization: in a large, high-load manoeuvre a single jack's authority is not enough, so the system lets both jacks drive together (both active) for combined hinge moment. It is temporary reinforcement when performance demands it.
3. All four jacks to centering is the ultimate backstop. If the two elevators' four jacks all lose electrical control, hydraulics hold both surfaces neutral, so unattended elevators cannot flap in the airflow and disturb pitch. This is the physical precondition of the Direct Law / mechanical-backup case where pitch is flown on the THS trim wheel: the elevators are already locked neutral, and pitch is handed to the stabiliser.

[!warning]- If the active elevator jack fails, does the aircraft twitch? No — the damping jack takes over seamlessly.

The instinct is that "losing the working jack" must produce a pitch transient. It does not, because the damping jack is already loaded, trailing the surface, and its computer has been recomputing the demand all along. When the worker fails, the damped one becomes active and the failed one drops to damping — a baton change inside the same surface, not a loss of control.

4. Surface, hydraulic, computer — the allocation and its cross-wiring

The FCOM states the elevator/THS pitch allocation, and it is the source of the table below. Per FCOM DSC-27-10-20:

In normal operations, the PRIM 1 controls the elevators and the horizontal stabilizer, and the green hydraulic jacks drive the left and right elevator surfaces. The THS is driven by N° 1 of three electric motors. If a failure occurs in PRIM 1 or the associated hydraulic systems or hydraulic jacks, the system shifts pitch control to PRIM 2. PRIM 2 then controls the elevators via the blue and yellow hydraulic jacks and controls the THS via the N° 2 electric motor. If neither PRIM 1 nor PRIM 2 are available, the system shifts pitch control to SEC 1 for elevator control, and to PRIM 3 for THS control via the N° 3 electric motor.

Every surface is fed by more than one hydraulic system so that the loss of any single system still leaves every axis with a working surface. The full actuator-layer allocation:

Three counter-intuitive points sit inside this table, each developed below: the elevator's and aileron's "two jacks" are one worker, one standby, not two working at once (§3); the rudder's "three servos" are three working at once (§8); and the THS has none of the Active/Damping/Centering scheme — it is a screwjack on twin hydraulic motors with a three-motor-or-wheel selector, a different drive train entirely (§10).

The elevator's hydraulic split is the chapter's first genuinely useful piece of cross-wiring. The green jacks are the normal workers on both elevators (under PRIM 1). Lose Green and the left elevator switches to its blue jack, the right to its yellow jack, with PRIM 2 taking over. That is exactly the actuator-level reason behind the rule introduced in Flight Control Fundamentals: loss of Green moves the master from P1 to P2 even though P1 is healthy. P1's elevator workers are all green; with Green gone, P1 has no grip on the elevators, so handing mastership to P2 (driving the blue/yellow jacks) preserves both elevator surfaces.

The ailerons follow the same philosophy. Per FCOM DSC-27-10-20:

Inner ailerons are normally controlled by PRIM 1 (LH) and 2 (RH) with each of these computers being capable of controlling both sides. SEC 1 and 2 provide the back up control in case of PRIM 1 and 2 failure. The outboard ailerons are normally controlled by PRIM 3.

and on the aileron jacks themselves:

Two electrically-controlled hydraulic servojacks drive each aileron. Each servojack has two control modes: Active... Damping... The system automatically selects damping mode, in the event of green and yellow or blue and green low pressure, or if the respective computer fails.

Note that an aileron jack has only two modes — Active and Damping, no Centering. The hydraulic cross-coverage is the key: the inner ailerons are fed by Green + Blue, the outer ailerons by Green + Yellow. Each aileron is therefore covered by two different systems, so the loss of any one hydraulic system still leaves every aileron with a live jack. That is the actuator-layer reason the roll axis needs no dedicated mechanical backup — the cross-coverage carries it (the open synthesis flagged in Fundamentals Q4, pinned down here).

Aileron droop with flaps, the outboard-aileron lockout to zero above 190 kt, and the outboard-aileron switch to damping on RAT supply are all in FCOM DSC-27-10-20, but they are surface-behaviour layer — deepened in Ailerons. This article takes only the "two jacks + two modes + hydraulic allocation" actuator thread.

5. The fail-safe polarity — elevator and aileron solenoids are opposite

This is the most counter-intuitive hardware detail in the chapter, and the one worth carrying in your head. The AMM gives the solenoid-state truth tables (the hardware layer — a different abstraction from the FCOM "three modes", and not to be merged). For the elevator, per AMM 27-93-00:

The servocontrol is in active mode when the two windings of its solenoid valve are not energized.

Elevator servocontrol solenoid (two windings EV1, EV2):

Aileron servocontrol solenoid (single winding EV):

The aileron drive logic, per AMM 27-93-00:

The active computer drives its dedicated servovalve and energizes the solenoid valves of its servocontrol to make it active. The computer in standby drives its dedicated servovalve (for monitoring purposes) and does not energize the solenoid valves of its servocontrol (in order to keep it in the damping mode).

The two polarities are exactly opposite, and it is deliberate fail-safe design, not a manual slip:

• Elevator: energised = damping, de-energised = active. Meaning a power loss defaults to active. Pitch is the life-and-death axis, so if solenoid supply is lost the elevator jack stays in the mode that can still drive the surface — the aircraft remains controllable. The fail-safe leans toward available.
• Aileron: energised = active, de-energised = damping. A single failed aileron costs little in roll (spoilers and the opposite aileron carry it), so a power loss defaulting to damping — a quiet damper — avoids a spurious surface movement. The fail-safe leans toward safe and silent.
• One more difference not to miss: the elevator active computer energises the adjacent (other) jack's solenoid to make it the damper; the aileron active computer energises its own jack's solenoid to make it active. One manages its neighbour, one manages itself — matching the elevator's "two jacks of one surface cooperate" topology against the aileron's "left and right computers each own a surface" topology.

[!warning]- "Energise the solenoid to turn the jack on" is true for the aileron and wrong for the elevator.

The natural mental model — energised means working — holds for the aileron but is inverted for the elevator, where a de-energised solenoid is what leaves the jack active. The polarity is chosen per axis: pitch defaults to drivable on power loss, roll defaults to a quiet damper. If you carry one rule across both surfaces, you will read the wrong failure mode.

6. COM/MON monitoring — how the computer catches a runaway

Inside each FCPC are the two segregated circuits of §1: COM (command) and MON (monitor), each computing independently and cross-checking. The AMM lists their built-in checks for the elevator; the pilot-relevant ones:

• COM checks: the servoing transducer is within range; the delivered current matches the computed current (the real current is measured across a resistor and compared, to catch a servovalve issuing a phantom output); and the servovalve transducer.
• MON checks: the control-surface position transducer range; the servovalve position transducer range; control-surface runaway; the mode-selector-valve transducer; the mode of the adjacent servocontrol (an active computer confirms the adjacent jack really is damping; a standby computer confirms it really is active); and control-surface oscillation.

Runaway detection is the heart of it. Per AMM 27-93-00, MON does:

monitoring of control surface runaway by comparison between the servovalve spool position and what it would be if driven in MON

In words: MON compares the actual servovalve spool position with where it would be if MON itself were driving — a disagreement means the surface is running away from the commanded value, and the channel acts. A COM/MON disagreement downgrades that actuator (drops it to damping, or hands the surface to another computer). Every F/CTL ... SERVO or runaway-type ECAM alert is, underneath, MON having caught COM or the actuator out of agreement — the physical basis of EFCS Computer Failures and the Control Surface Fault Spectrum.

One SEC simplification is worth remembering. When a SEC servoes the elevator or inner aileron, surface oscillation is monitored only on the ground (the in-flight oscillation check is dropped), the principle otherwise matching the FCPC — per AMM 27-94-00, the only difference is that the surface oscillation is monitored only on the ground. These are the economies of the SEC acting as the secondary computer.

7. The rudder — three servos in parallel and effort synchronisation

The rudder is this article's special case. Where the elevator and aileron run one worker, one standby, the rudder runs three servocontrols simultaneously active. Per FCOM DSC-27-10-20:

The rudder is actuated by 3 independent hydraulic servo controls operating in parallel. In normal operation, the 3 servo controls are simultaneously in active mode. In case of an electrical or hydraulic failure, the corresponding servo control is in damping mode.

The electrical allocation, per FCOM DSC-27-10-20, is one PRIM per colour:

PRIM 1 controls the green hydraulic servo control, PRIM 2 controls the blue hydraulic servo control, and PRIM 3 controls the yellow hydraulic servo control. If all the 3 PRIMs fail, SEC 1 controls the green hydraulic servo control. In case of a total electrical failure, or loss of rudder control due to flight control computers failure, the Backup Control Module (BCM) controls the yellow hydraulic servo control, or the blue hydraulic servo control, if the yellow hydraulic servo control is not available.

Three jacks driving one surface raises an immediate question: won't they fight each other? The AMM answers with an effort-synchronisation term. Per AMM 27-93-00:

The three FCPCs are simultaneously active on the three servocontrols. NOTE: When a failure is detected, the FCPC no longer energizes the solenoid valve of the servocontrol that it drives. Therefore, only two servocontrols are active. The current sent to the servovalve is the resultant of: a term directly related to the servoing error and a term related to the effort synchronization to compensate force fighting between the three servocontrols simultaneously active.

If three jacks push one surface and each computes alone, a small disagreement makes them work against each other inside the surface — one wanting a touch more, one a touch less — building internal stress, wear, and even oscillation. The effort-synchronisation term lets the three computers reconcile their outputs into one clean force. The rudder's MON checks are built for this triple redundancy: it carries differential-pressure-transducer monitoring, force-fighting-compensation monitoring (triplex, duplex), and simplex runaway monitoring. When one servo fails, its FCPC withdraws — it stops energising that servo's solenoid, dropping the servo to damping — and the remaining two continue, the synchronisation term stepping from triplex to duplex.

When all three FCPCs lose normal rudder servoing, SEC 1 takes the green servo, and here the recipe simplifies — there is no force-fighting to cancel because only one channel is driving. Per AMM 27-94-00:

The FCSC 1 becomes active for the rudder servoing when the three FCPCs lose the normal electrical servoing... The current sent to the servovalve is the resultant of a term directly related to the servoing error.

Rudder travel limit (deflection narrowing with speed), turn coordination, rudder trim operation, and the BCM backup are all in FCOM DSC-27-10-20 but belong to Rudder and Yaw and Electrical Backup BCM/BPS. This article takes only the "three parallel servos + effort synchronisation + mode switching" actuator thread.

8. The servovalve current recipe — each surface's fingerprint

Gather the scattered current terms and a pattern appears: the current a computer sends its servovalve is a sum of terms, and the precise recipe is a fingerprint of each surface's mode capability. The AMM gives four different recipes for the four surface types.

The AMM wording for each, all verbatim:

The current sent to the servovalve is the resultant of three terms: - a term directly related to the servoing error - a term related to the mechanical centering compensation - a term used to compensate the servovalve false zero; this term is the limited integral of the servoing error. (elevator)

The current sent to the servovalve is the resultant of 2 terms: - a term directly related to the servoing error, and - a term for compensation of the servovalve false zero. (aileron)

The current sent to the servovalve is the resultant of two terms: - a term directly related to the servoing error and - a term (not shown on the diagram) for compensation of the servovalve mechanical bias (this bias enables the spoiler to be pressed against the wing without any control current). (spoiler)

You do not memorise the terms; you keep the rule: the current recipe maps directly to the surface's mode capability. The elevator carries an extra centering term because it alone has a Centering mode; the aileron lacks it because it has no Centering; the spoiler's bias term is the electrical root of its "press flat against the wing on power loss" behaviour; the rudder's synchronisation term is what keeps three parallel servos from fighting — and falls away when only one servo (SEC 1) is left. Reading a surface's recipe tells you how many modes it has and which safe state it defaults to — the key that ties the actuator's modes back to the control laws.

9. How the computer knows a hydraulic system has lost pressure

One question has been hanging under all of §2–§7: the Centering mode needs "hydraulics still present"; the aileron auto-selects damping on "green and yellow or blue and green low pressure"; the truth tables' first column is PRESSURE ON / OFF; the rudder servo goes to damping on "a hydraulic failure". The whole mode-switching logic keeps using whether a system has pressure as its input. So by what part, and at what pressure, does a computer call a system PRESSURE OFF? The answer is a dedicated component in this chapter (27-92): the hydraulic pressure switch. Per AMM 27-92-00:

The three identical hydraulic pressure switches feed the FCPC 1 and FCSC 1 with information about the pressurized or non-pressurized status of the Green, Blue and Yellow hydraulic systems (For FCPC 2, 3 and FCSC 2, this information is given by the hydraulic switches referenced ATA29).

and the threshold, the number at the heart of it:

The nominal pressure detected is 100 +5 bar or -5 bar (1450.3770 +72.5189 psi or -72.5189 psi).

Three points anchor that PRESSURE column to reality:

1. The column is a single switch-supplied bit. The "PRESSURE ON / OFF" in the truth tables is not a continuous pressure the computer reads — it is one boolean (pressurised / non-pressurised) handed over by the switch. The switch answers only "is there pressure", not "how many psi" — which is why the tables have just ON/OFF and no intermediate value.
2. At ≈100 bar (≈1450 psi), far below the 3000 psi system rating, this is a basic-loss detector, not a slight-droop detector. The three systems run at 3000 psi normally (see ATA-29 Hydraulic Fundamentals); the switch only flips to "non-pressurised" near 1450 psi. So an actuator does not scramble to damping on a mild droop (say 3000 to 2500) — only when pressure has collapsed below roughly half the rating and the system can effectively no longer do work. It is a deliberate "steady, don't twitch" threshold that reserves mode-switching for a real loss and stops normal pressure ripple from chattering the actuators.
3. PRIM 1 / SEC 1 use this chapter's own switches; the rest get the same fact from ATA-29. PRIM 1 and SEC 1 have their own three dedicated switches (one per colour); PRIM 2, PRIM 3 and SEC 2 read the ATA-29 hydraulic-system switches. The same "is there pressure" fact reaches different computers from two independent sources, so a failure of one set cannot blind every computer to hydraulic state at once.

For the flight deck this explains a quiet detail: an actuator's response to hydraulic degradation is all-or-nothing. Either the system is above ≈1450 psi and the jack stays active, or it has collapsed below and is treated as lost — there is no half-pressure, half-working grey zone. It is also why an ECAM hydraulic LO PR caution and an F/CTL actuator downgrade so often appear together.

10. THS and spoilers — two other actuation paths

For completeness, the two surfaces that do not use the Active/Damping/Centering jack scheme (each deepened in its own article):

Trimmable Horizontal Stabiliser. Not a servojack at all. Per FCOM DSC-27-10-20:

A screwjack driven by two hydraulic motors drives the stabilizer. The two hydraulic motors are controlled by: one of three electric motors, or the mechanical trim wheel.

A screwjack on twin hydraulic motors, selected by one of three electric motors or the mechanical trim wheel. Below that, the FCPC sends the THS its demand digitally — its COM channel drives a bus to the servoing electronics (the DEM, a digital electronic module) mounted on the THS actuator, carrying a deflection instruction plus engage and test booleans, with the DEM returning test results and a label echo; a mismatch loses that DEM's THS function. The mechanical path has priority and stays available on either of two systems — per FCOM DSC-27-10-20, mechanical control of the THS is available from the pitch trim wheel, at any time, if either the blue or the yellow hydraulic system is functioning, and mechanical control from the pitch trim wheel has priority over electrical control. Deepened in THS.

Spoilers. One servojack per panel, each fed by Green, Yellow, or Blue, each allocated to a PRIM or SEC. Per FCOM DSC-27-10-20:

The system automatically retracts the spoilers to their zero position, if it detects a fault or loses electrical control. If the system loses hydraulic pressure, the spoiler retains the deflection it had at the time of the loss, or a lesser deflection if aerodynamic forces push it down.

So a fault or electrical loss retracts the panel to zero, while a hydraulic loss leaves it where it was (or lets aero push it down). The actuator-layer root of "sits flat with no current" is the mechanical-bias term in the servovalve current (§8). Ground-spoiler and speedbrake automatics go to Spoilers and Ground Spoilers.

11. The actuation layer across a flight

Six scenes turn the static map into a moving one:

1. Normal cruise, steady flight. On each elevator, one green jack is active while the other (blue or yellow) damps; the standby computer is still driving its servovalve to self-check. All three rudder servos are active with effort-synchronisation holding their outputs together. You feel nothing — it all runs silently at the actuator layer.

2. A large manoeuvre (avoidance, recovery). The elevator enters double pressurisation: the second jack also goes active and the two jacks combine for full pitch hinge moment. It reverts to one-worker/one-standby when the manoeuvre ends.

3. Loss of Green. Each elevator's green worker depressurises and drops to damping; the left elevator picks up its blue jack (PRIM 2), the right its yellow jack; the master shifts P1→P2. Both elevators stay available and pitch feel is unchanged (still Normal Law). This is §4's cross-wiring doing its job.

4. One aileron lost entirely (hydraulic + electrical + jack). The FCTM gives the actuator-layer physics. Per FCTM PR-AEP-F/CTL:

   When an aileron is failed (due to failure of its hydraulic supply and/or electrical control and/or servojack), it goes to its zero hinge moment corresponding to around 14 ° up. This produces a loss of lift which creates a pitch up moment. The elevators, when available, compensate this effect.

   This is why a chain of three flight-control failures triggers the F/CTL ELEV REDUND LOST procedure with a 12° upward aileron preset to smooth the transient. Deepened in Control Surface Fault Spectrum.

5. THS loses electrical control (F/CTL STAB CTL FAULT). Pitch law goes to alternate; autotrim continues (commanded through the elevators); in some cases the wheel still moves the THS, and ECAM has the crew verify the wheel and then trim the elevators toward neutral for maximum authority. This is §10's THS path.

6. Wanting to reset a PRIM or SEC on the ground. Per the QRH System Reset Table, F/CTL PRIM and SEC are On ground only — an in-flight actuator or computer fault is not cleared by reset but covered by automatic reconfiguration.

Self-test

[!note]- Q1. Each elevator has two servocontrols. In normal flight, what mode is each in, and is the "standby" one disconnected and idle?

One is active (the working jack, driving the surface to the commanded angle); the other is in damping (a live hydraulic damper that trails the surface and prevents flutter). The damping jack is not disconnected or idle — its standby computer keeps driving its own servovalve purely for monitoring, recomputing the demand in real time so it can take over seamlessly the instant the worker fails. In a large, high-load manoeuvre (double pressurisation) both jacks go active together for combined hinge moment.

[!note]- Q2. On an elevator servocontrol, does energising the solenoid give Active or Damping? And on the aileron? Why are they opposite?

Elevator: both windings de-energised = active; either/both energised = damping. Aileron: energised = active, de-energised = damping. They are deliberately opposite for fail-safe. Pitch is the life-and-death axis, so the elevator defaults to active on a power loss — solenoid supply failing leaves the jack able to drive the surface. A single aileron failure costs little in roll, so the aileron defaults to damping on a power loss — a quiet damper that avoids a spurious roll input. The fail-safe direction follows each axis's safety priority.

[!note]- Q3. The rudder has three servos and the elevator has two. How do they work differently, and why don't three simultaneously-active servos fight each other?

The elevator's two jacks are one worker, one standby (one active, one damping). The rudder's three servos are three active in parallel at once, one per hydraulic system (PRIM 1 green, PRIM 2 blue, PRIM 3 yellow). Three jacks on one surface would fight (force fighting) if each computed alone, so the servovalve current carries an effort-synchronisation term that reconciles the three outputs into one clean force. If one servo fails its PRIM withdraws (de-energises that servo's solenoid → damping) and the other two continue, the synchronisation stepping triplex → duplex. When only SEC 1 is left driving, the term disappears — nothing to synchronise.

[!note]- Q4. Which hydraulic systems feed each elevator and each aileron, and how does that connect to "loss of Green moves the master to P2"?

Left elevator = Green + Blue, right elevator = Green + Yellow; inner ailerons = Green + Blue, outer ailerons = Green + Yellow. The green jacks are the normal elevator workers under PRIM 1; lose Green and PRIM 1 loses its elevator workers, so PRIM 2 (driving the blue/yellow jacks) must become master to keep both elevators — that is the actuator-level reason for "Green loss → P2 takes over from P1" even with P1 healthy. Each aileron is cross-covered by two different systems, so any single hydraulic loss leaves every aileron a live jack — which is why the roll axis needs no dedicated mechanical backup.

[!note]- Q5. How does a computer detect that a servocontrol has run away, and what do COM and MON each do?

Each FCPC has electrically- and mechanically-segregated COM (command) and MON (monitor) channels that each compute and cross-check. COM issues the order and checks delivered-versus-computed current; MON issues no order and monitors independently. Runaway detection is MON comparing the actual servovalve spool position with where it would be if MON were driving — a mismatch means runaway. MON also checks surface position range, mode-selector state, oscillation, and jamming. A COM/MON disagreement downgrades the actuator (to damping, or to another computer) — the source of the F/CTL servo-type ECAM alerts.

[!note]- Q6. At what pressure does a computer declare a hydraulic system "PRESSURE OFF", and why does it matter that the threshold is so low?

A dedicated hydraulic pressure switch supplies the computer a single boolean (pressurised / non-pressurised); the nominal detection pressure is 100 ±5 bar (≈1450 psi), far below the 3000 psi system rating. So it is a basic-loss detector, not a slight-droop one: the actuator does not switch to damping on a mild droop, only when pressure has collapsed below roughly half rating. The response to hydraulic degradation is therefore all-or-nothing — above ≈1450 psi the jack stays active; below, the system is treated as lost. PRIM 1 / SEC 1 use this chapter's own switches; the other computers get the same fact from ATA-29 switches, so no single switch set can blind every computer.

Key takeaways

The flight deck never sees any of this directly — no mode word, no jack count, only the F/CTL and STATUS pages when something downgrades. But the actuator layer is where "move surface X by Y degrees" finally becomes a real angle, and where most F/CTL cautions are physically born. The per-surface articles enlarge each block — deflections, droop, travel limit, ground spoilers — on top of this foundation.

References

Per FCOM DSC-27-10-20 (Actuation and electrical-control allocation — elevator three modes and master/standby switching; PRIM 1→PRIM 2→SEC 1 pitch allocation and green/blue/yellow elevator jacks; inner/outer aileron control and two modes with auto-damping on dual low pressure; spoiler retract-to-zero and hydraulic-loss behaviour; rudder three parallel servos, simultaneous active, PRIM 1/2/3 per colour, SEC 1 and BCM takeover; THS screwjack on two hydraulic motors, three-motor-or-wheel selection, mechanical-wheel priority and blue/yellow availability). Per AMM 27-93-00 (FCPC servoing and monitoring — active computer energises the adjacent servocontrol to damping, standby drives its servovalve for monitoring, double-pressurisation dual-active; elevator and aileron solenoid truth tables; servovalve current terms — elevator three, aileron two, spoiler two with mechanical bias; COM/MON checks and runaway by servovalve spool comparison; rudder three-FCPC parallel and effort synchronisation; THS DEM bus). Per AMM 27-94-00 (FCSC — eleven servo actuators per computer; surface oscillation monitored on the ground only; FCSC 1 rudder takeover with error-only current). Per AMM 27-92-00 (hydraulic pressure switches feeding FCPC 1 / FCSC 1, others via ATA-29; nominal detection 100 ±5 bar / ≈1450 psi). Per FCTM PR-AEP-F/CTL (failed aileron to ≈14° up zero-hinge-moment, pitch-up compensated by elevators). Per QRH System Reset Table (F/CTL PRIM and SEC resettable on ground only). The 3000 psi system rating used for the basic-loss comparison is cross-referenced from ATA-29; the per-surface hydraulic-colour mapping is corroborated by AMM maintenance allocation and is consistent with the FCOM control-shift text. Surface-behaviour items (deflections, aileron droop, rudder travel limit, ground-spoiler automatics, rudder trim) are deferred to the per-surface articles as noted, not omitted.

Independent study material, not an Airbus publication and not endorsed by the manufacturer. Always defer to the current operator FCOM, FCTM, and QRH for operational use.