Mechanical Back-up and BCM

The mechanical back-up is the basement of the degradation ladder: Normal → Alternate (ALT 1 / ALT 2) → Direct → Mechanical Back-up. It is the one rung that is not a control law at all. When even the electronic flight control computers can no longer help — they are lost, or the aircraft has lost all electrical power — the aeroplane retreats to a physical survival mode in which two axes are flown by something that does not depend on the normal computer-and-hydraulic chain:

• Pitch is flown on the THS manual trim wheel — the single mechanical channel on the whole aircraft. The PFD shows MAN PITCH TRIM ONLY in red.
• Yaw is flown by the BCM (Back-up Control Module), an independent unit that makes its own electrical power, reads its own sensors, and drives the rudder directly from the pedals.

And the headline fact that re-frames the whole article: you will almost certainly never reach it. The fly-by-wire redundancy is so deep that the textbook "everything has failed" cases — an electrical emergency configuration, an all-engine flameout — still leave you in Alternate Law, several rungs above this one. The mechanical back-up exists to cover the extremely improbable last fraction of a percent. You must know it cold; you should not picture it as a routine degradation.

Two warnings up front, because both are exam traps:

[!warning]- The A330 yaw back-up is not a cable-and-pulley rudder. Clear the old mechanical-rudder mental model.

On a conventional airliner, the "last resort" in yaw is a mechanical run from the pedals to the rudder. The A330 has no such cable. The rudder is rudder-by-wire from end to end; its last resort is the BCM, an electronic unit that happens to be self-powered — it generates its own electricity from the Blue or Yellow hydraulic system and drives the rudder's hydraulic servocontrols. The only purely mechanical channel anywhere on the aircraft is the pitch trim wheel to the THS. If you carry "the rudder is the mechanical surface" into this chapter, the whole yaw back-up will read wrong.

[!warning]- USE MAN PITCH TRIM (amber) and MAN PITCH TRIM ONLY (red) look alike and mean opposite things.

Amber USE MAN PITCH TRIM belongs to Direct Law: auto-trim is gone, so you trim with the wheel — but the elevators still work and the sidestick still flies pitch. Red MAN PITCH TRIM ONLY is the pitch mechanical back-up: a left + right elevator fault is detected, the elevators can no longer be controlled, and pitch is left to the THS wheel alone. Amber adds a chore; red removes a control surface. Colour is the whole distinction.

1. Where this rung sits — and the "very unlikely" paradox

Tie the law articles together and the EFCS has a health spectrum: the more that fails, the further the law steps down, until at the very bottom the computers withdraw entirely. This article is that bottom.

 Normal ─► Alternate (ALT 1 / ALT 2) ─► Direct ─►  MECHANICAL BACK-UP
                                                          │
                       ┌──────────────────────────────────┼───────────────────────────┐
                       ▼                                   ▼                            ▼
                    PITCH                                YAW                          ROLL
              THS manual trim wheel               BCM (back-up brain)          no dedicated channel
              MAN PITCH TRIM ONLY (red)     direct pedal-to-rudder + yaw       (aileron/spoiler
              mechanical run, needs no       damping; self-powered by BPS       hydraulic redundancy
              electrical power               from B or Y hydraulic              covers it earlier)

By the end of this article you should be able to answer five things, which are the spine of everything below:

1. FCOM says the back-up is built to achieve all safety objectives in MMEL dispatch — which four failure cases does it cover?
2. What exactly is the pitch mechanical channel, and how does amber USE MAN PITCH TRIM differ from red MAN PITCH TRIM ONLY?
3. How can the BCM still move the rudder when the aircraft has lost all electrical power — where does its power, its sensing, and its servo authority come from?
4. Why does FCOM keep insisting the back-up is "very unlikely" to be used — and which law are you still in after an electrical emergency configuration or an all-engine flameout?
5. How are the "loss of both elevators" and "total loss of ailerons and spoilers" cases — which sound catastrophic — actually caught smoothly?

The single most important framing comes straight from the source. Per FCOM DSC-27-20-20-50:

It must be noted that it is very unlikely that the backup will be used, due to the fly-by-wire architecture. For example, in case of electrical emergency configuration, or an all-engine flameout, alternate law remains available.

[!warning]- The mechanical back-up is not an everyday fallback — even all-engines-out stays in Alternate Law.

The instinct is to imagine the mechanical back-up as the natural endpoint of "lots of things failing". It is not. The redundancy is deep enough that an electrical emergency configuration (running on the RAT) or an all-engine flameout still leaves Alternate Law available — protections reduced, but still a computer-shaped law, two rungs above this one. The QRH bears this out: in the electrical emergency configuration the cruise summary reads ALTN LAW: PROT LOST, not "mechanical back-up". Reaching this rung requires the far more extreme stack of losing the flight control computers themselves, or a total electrical failure. Know it is there and how it works; do not file it under "degradation I will see".

2. The purpose — four MMEL dispatch objectives

The reason the back-up exists is stated in one sentence, and every clause is load-bearing. Per FCOM DSC-27-20-20-50:

The purpose of the backup is to achieve all safety objectives in MMEL dispatch condition: To manage a temporary and total electrical loss, the temporary loss of five fly-by-wire computers, the loss of both elevators, or the total loss of ailerons and spoilers.

Read the framing carefully: this is not "when the aircraft is broken this badly, use the mechanical back-up." It is the other way round — because this last-ditch back-up exists, those four serious failures can be tolerated while still meeting the airworthiness safety objectives under MMEL dispatch. The back-up is the floor that makes the rest of the redundancy certifiable.

The four cases, and where each one lands in this article:

[!warning]- "Mechanical back-up" is not one master switch — it is the union of two independent fall-backs.

FCOM lists the four cases side by side, but they do not all have to happen at once. The mechanical back-up is best read not as a single mode you "drop into", but as the name for two separate things: pitch retreating to the THS wheel, and yaw retreating to the BCM. Any one of the four failures, taken to its limit, invokes the relevant axis's back-up. A double-elevator failure (case 3) puts pitch on the wheel while yaw may still be on the normal computers; a total electrical loss (case 1) invokes both at once. There is no cockpit "mechanical back-up" selector — each axis falls back on its own.

3. Pitch — the only mechanical channel is the THS trim wheel

The pitch back-up is the easier half to picture, because the mechanical channel was designed in from the very first principle of the system. Per FCOM DSC-27-10-10:

The flight control surfaces are all: Electrically-controlled, and Hydraulically-actuated. The stabilizer can also be mechanically-controlled.

That single also names the only mechanical channel on the whole aircraft. FCOM makes the stabiliser's dual identity explicit when it lists the pitch axis. Per FCOM DSC-27-10-10:

PITCH AXIS — Elevator control = Electrical. Stabilizer control = Electrical for normal or alternate control. Mechanical for manual trim control.

So the elevators are electrical only; the THS is electrical for normal/alternate control and mechanical for manual trim. The mechanical "handle" is the pair of trim wheels on the pedestal. Per FCOM DSC-27-10-10:

Two handwheels, on the center pedestal, are used to mechanically control the THS.

When the back-up is finally reached, the mechanical-back-up section compresses the whole pitch story into one line. Per FCOM DSC-27-20-20-50:

Pitch mechanical control is achieved through the THS, using manual trim control. «MAN PITCH TRIM ONLY» is displayed in red on the PFDs.

What this means for the pilot. When the elevators are gone, your only way to control pitch is to turn the wheel — a direct mechanical run that drives the THS screwjack (THS internals). Trimming has stopped being an auxiliary task; trimming is now your entire pitch control. The wheel turns slowly and the big stabiliser moves slowly, so this is a deliberate, anticipatory activity — lead the aircraft, use thrust and configuration in concert, and move the wheel gently, because the THS is large and powerful. The cue is red — and red on an Airbus PFD means this is all you have left, there is no rung below.

4. Amber USE MAN PITCH TRIM vs red MAN PITCH TRIM ONLY

This is the most-confused point in the whole subject, because Direct Law also puts a manual-trim message on the PFD. The colour and the wording differ, and they mean opposite things.

In Direct Law the cue is amber, and the elevators still fly. Per FCOM DSC-27-20-20-30:

As there is no automatic trim, the pilot has to use manual trim. The «USE MAN PITCH TRIM» amber message is displayed on the PFD. All protections are inoperative.

The PFD-reconfiguration legend pins the two cues to their exact triggers. Per FCOM DSC-27-20-20-30:

(4) USE MAN PITCH TRIM (amber) displayed in direct law, or in flare law without RA. (5) MAN PITCH TRIM ONLY (red) displayed, if a L + R elevator fault is detected.

Lay them side by side:

[!warning]- Seeing USE MAN PITCH TRIM does not mean the elevators have failed.

The common misread is "the manual-trim message is up, so the elevators must be gone." Predict it yourself first — are the elevators still there? With the amber USE MAN PITCH TRIM the elevators are still working; you still fly pitch on the sidestick, you simply have to trim by hand because Direct Law has switched auto-trim off. Only the red MAN PITCH TRIM ONLY means the elevators are genuinely lost and the THS wheel is the sole pitch control — that is the pitch mechanical back-up. Colour is the boundary: amber = elevators still there; red = THS only.

5. Yaw — the BCM: a self-powered, self-sensing back-up brain

Because the rudder is rudder-by-wire with no cable to fall back on, its last resort has to be a different electronic unit that can work when the normal computers (PRIM/SEC) are dead or the aircraft is unpowered. That unit is the BCM. FCOM states its job, its power, its sensing, its authority, and its trigger in one passage. Per FCOM DSC-27-10-10:

The BCM computer provides yaw damping, and direct rudder command with pedals, via an independent unit, in case of: Total electrical failure, or Loss of rudder control due to a Flight Control Computer (PRIM and SEC) failure. It includes: Its own electrical generator, referred to as the Backup Power Supply (BPS), which is supplied by the B or Y hydraulic system; Its own sensors (gyrometers and pedals deflection); Control of the B and Y hydraulic actuators. When activated, as in yaw alternate law, there is no turn coordination.

The mechanical-back-up section restates the same point under its lateral heading. Per FCOM DSC-27-20-20-50:

The Backup Control Module (BCM) computer provides yaw damping and direct rudder command with pedals. This computer includes its own electrical generator, supplied by the B or Y hydraulic system.

FCOM gives the what and the why-it-is-independent; the maintenance source gives the how it activates. Per AMM 27-99-00:

The electrical back-up provides the yaw control of the aircraft if the rudder normal servoing by the flight control computers is not operational. The electrical back-up transmits the pilot orders from the rudder pedals to the rudder and ensures Dutch roll damping.

and the activation logic, which is the heart of the design. Per AMM 27-99-00:

In the absence of inhibition signals from FCPC1 and FCSC1 (due to computer failure or centralized electrical power supply failure), the Back-up Power Supplies are activated and generate the electrical power for the Back-up Control Module if the corresponding hydraulic system is available. The Back-up Control Module becomes operative automatically in the absence of inhibition signal from FCPC2/3 and if it is electrically energized by at least one Back-up Power Supply. The Back-up Control Module selects and controls one rudder servocontrol at a time (Yellow in priority and Blue if the Yellow hydraulic system is not available).

Drawn as a logic topology from the AMM description:

   PEDALS  (CAPT + F/O, rigidly interconnected)
      │ deflection
      ▼
  ┌──────────────┐         gyrometers (yaw rate)
  │ pedal sensor │         internal to BCM
  │ (in PFTU)    │              │
  └──────┬───────┘              │
         ▼                      ▼
  ┌─────────────────────────────────────────────┐   inhibition signal
  │                  BCM                          │◄── from FCPC2/3
  │  pedal order + yaw rate ──► rudder command    │   (removed on FCC fail /
  │  = direct pedal-to-rudder + Dutch-roll damp   │    power loss → BCM goes active)
  └───────────────────┬───────────────────────────┘
                      │ selects ONE servo at a time
                      │ Yellow priority · Blue if Y unavailable
            ┌─────────┴─────────┐
            ▼                   ▼
       ┌─────────┐         ┌─────────┐
       │ Y rudder│         │ B rudder│
       │ servo   │         │ servo   │
       └────┬────┘         └────┬────┘
            ▲                   ▲
            │ powered by        │
       ┌────┴─────┐        ┌────┴─────┐    inhibition signal
       │ BPS (Y)  │        │ BPS (B)  │◄── from FCPC1 / FCSC1
       │ Y-hyd-   │        │ B-hyd-   │    (removed → BPS generates power
       │ driven   │        │ driven   │     if its hydraulic system is up)
       │ generator│        │ generator│
       └──────────┘        └──────────┘

Read four things off it:

1. The BCM makes its own electricity. The two BPS units are hydraulic-motor-driven generators: the Blue system spins BPS(B), the Yellow system spins BPS(Y). So a total electrical failure is not fatal to the BCM — it does not draw on the aircraft network at all, only on B or Y hydraulic pressure.
2. The BCM has its own senses. Yaw rate comes from gyrometers internal to the BCM; pedal position comes from a dedicated sensor in the PFTU (pedal feel and trim unit, 02). It needs nothing from the PRIM/SEC computers or the ADIRS.
3. Activation is by removal of inhibition, not by adding a command — it is fail-active. When healthy, FCPC1/FCSC1 hold the BPS inhibited and FCPC2/3 hold the BCM inhibited. Those inhibition signals are "live" — a working computer must keep sending them. When the computers fail or lose power, the signals vanish on their own, the BPS starts generating, and the BCM takes the rudder automatically. The thing comes up because its keepers went quiet; the crew throws no switch.
4. One servo at a time. The BCM drives a single rudder servocontrol — Yellow by priority, Blue only if Yellow is unavailable. One servo is enough for control; the second is redundancy. The hardware internals of the BCM and the BPS — the LRU boxes, the solenoid-valve detail — are deferred to Electrical Back-up BCM/BPS; this article stays on the law-and-operations view.

What this means for the pilot. When the BCM is driving the rudder you are, in FCOM's words, in yaw alternate law with no turn coordination. The computers are no longer automatically feeding in rudder to balance a roll demand — you must coordinate with your own feet. You still have Dutch-roll damping, so the aircraft will not diverge into a high-altitude oscillation, but there is no envelope protection on the rudder and no turn coordination. This is the recurring lesson of the back-up: it keeps you able to control, not comfortable to fly.

6. How objectives 3 & 4 are caught — the ELEV REDUND LOST transition

FCOM gives the conclusion (the four objectives); the FCTM shows the process for the two surface-loss cases — loss of both elevators (objective 3) and total loss of ailerons and spoilers (objective 4). This is the most engineering-rich part of the subject. Per FCTM PR-AEP-F_CTL:

a combination of three failures affecting flight control computers and/or servocontrol and/or hydraulic might lead to the loss of several ailerons and one or both elevators simultaneously. Although the aircraft can be flown in such a configuration, the F/CTL ELEV REDUND LOST procedure (triggered in case of dual failures case) has been developed to anticipate this three failure cases and is designed to smooth the aircraft handling transient.

6.1 The aileron preset — preparing for the blow before it lands

The cleverest piece is that the system gets ready for the third, dimensioning failure while it still has elevators to spare. Per FCTM PR-AEP-F_CTL:

a 12 ° upwards aileron preset is anticipated (before the third failure) and the resulting pitch up effect can be compensated by the elevators (which are available at this stage) and then trimmed by the THS

and when the failure actually arrives. Per FCTM PR-AEP-F_CTL:

If the third and dimensioning failure occurs, three ailerons and both elevators are lost. The failed ailerons go to their zero hinge moment (14 ° up). As the ailerons were previously preset upwards (12 ° up), the transient is smooth

Only a slight upward movement occur but is controllable through the THS. MAN PITCH TRIM ONLY is displayed on the top of PFD.

The mechanism: a failed aileron floats up to its zero-hinge-moment position (14° up), which would deliver a sudden nose-up jolt. The fix is to pre-position the ailerons to 12° up beforehand, while the elevators are still there to trim out that 12° via the THS. Then when the third failure hits and the ailerons jump from 12° to 14°, the change is only 2° — a slight nose-up that the THS can absorb. It is a deliberate trade. Per FCTM PR-AEP-F_CTL:

This 12 ° upwards aileron preset is a compromise between fuel consumption increase (around 16 %) and the pitch up effect at the time of the third failure.

So flying in the preset configuration costs around 16% extra fuel — accepted to convert a violent transition into a smooth one. Below ~2000 ft or in CONF 2 the preset is removed to give back normal landing control.

6.2 Two limitations, each guarding a different thing

The ELEV REDUND LOST procedure hangs a speed limit and a flight-level limit on the crew. They are not one conservative pair — they guard different failures. Per FCTM PR-AEP-F_CTL:

The ELEV REDUND LOST procedure requires both speed and FL limitations: The speed limitation is introduced to cope with aircraft structure effort, should a third dimensioning failure occur. The FL limitation is introduced to maintain stabilizer authority, should a third dimensioning failure occur.

Map each to its purpose:

• Speed limit → structure. At the instant the third failure hits, the ailerons snap to 14° and both elevators are lost, putting a sudden load into the airframe. Holding speed down (hence dynamic pressure down) keeps that impulse load within structural limits.
• FL limit → stabiliser authority. Once pitch is left to the THS alone, the stabiliser must have enough trim authority to hold the attitude; descending to a lower level guarantees the THS keeps sufficient authority in that configuration.

Crucially, once the third failure has actually happened and both elevators are gone, the two limitations no longer apply (§6.4) — their job was to protect against the third failure, which has now occurred.

6.3 The false aft-CG warning — a system that knows it is fooling itself

The aileron preset has a side effect worth a callout. Per FCTM PR-AEP-F_CTL:

The aft CG warning is generated by the Flight Envelope (FE) computer as a function of the THS position. In case of aileron preset, the THS position counteracts the pitch up effect inducing an erroneous CG computation. This is why any aft CG warning should be disregarded. CG, computed by the FCMC and displayed on ECAM, remains reliable.

[!warning]- In the ELEV REDUND LOST preset configuration, an aft-CG warning is false — disregard it.

The Flight Envelope computer infers CG from THS position. When the ailerons are preset up, the THS deflects the opposite way to cancel the nose-up moment — so the FE computer reads that THS position and computes an erroneous aft CG, raising a spurious warning. Do not chase it in the loadsheet or fuel, and do not try to "correct" the CG: nothing has moved aft. For the true CG, read the value the FCMC computes and displays on ECAM — that one remains reliable. It is a neat case of a system mis-reading itself, knowing it is mis-reading itself, and telling you to ignore the symptom.

6.4 When both elevators are finally gone

If the third failure does occur and takes both elevators, the FCTM gives three handling points. Per FCTM PR-AEP-F_CTL:

If a third dimensioning failure occurs leading to the loss of both elevators: The aircraft longitudinal control is ensured through MAN PITCH TRIM ONLY The A/THR may be disconnected to limit engine acceleration/deceleration thus facilitating the aircraft longitudinal control. The FL and speed limitations no longer apply.

The second point is the one to remember: with pitch on the THS wheel alone, disconnect the autothrust. The engines sit below the CG, so every thrust change is a pitch disturbance; leaving the A/THR free to accelerate and decelerate adds an uncommanded pitch input on top of the already-sluggish THS pitch control. Holding thrust steady by hand removes one disturbance from an axis you are now flying on the wheel.

6.5 Roll — there is no dedicated channel

The mechanical-back-up section names only pitch and lateral (BCM yaw); it gives no independent roll channel. That is not an omission. When the ailerons and spoilers are lost (objective 4), there is no roll surface left to dedicate.

The next step is integrative reasoning rather than a verbatim FCOM procedure (to be confirmed in Ailerons / Spoilers): with the roll surfaces gone and only the THS and BCM remaining, the only available roll source is rudder-induced yaw-roll — push rudder, the aircraft yaws, the outboard wing gains lift, and it rolls slowly that way. This is the generic "fly it on the rudder once the roll controls are gone" technique; FCOM does not write it up as a procedure because the configuration is so improbable. Flight Control Fundamentals already pegs the point: roll has no dedicated last resort because the aileron/spoiler hydraulic redundancy catches it long before that.

Adjacent but different — F/CTL STAB CTL FAULT. There is an intermediate state in which the stabiliser's electrical control is lost but the aircraft has not fallen to the mechanical back-up: pitch reverts to alternate law and auto-trim is still provided by the SEC through the elevators, while ECAM has the crew confirm the manual trim wheel is available. Do not confuse it with the mechanical back-up: in STAB CTL FAULT the elevators are still flying and the wheel is an aid to recover elevator authority; in the mechanical back-up the elevators are gone and the wheel is the only pitch control.

7. Operational view — when, and how, you reach it

Six scenes turn the static map into a moving picture, deliberately ordered to build a sense of scale:

1. F/CTL PRIM 1 FAULT (single computer). The master shifts to P2, the law is usually still Normal — nowhere near the mechanical back-up. Nothing in this article is in play. This is the calibration: single, even multiple, computer faults stay in Normal/Alternate.
2. Direct Law (amber USE MAN PITCH TRIM). The elevators are still there; you fly pitch on the sidestick but trim by hand because auto-trim is off. Still one rung above the mechanical back-up.
3. F/CTL ELEV REDUND LOST (dual failure, anticipating the third). The ailerons quietly preset 12° up (visible on the ECAM F/CTL page), and a speed and an FL limit are imposed. At this point both elevators and the ailerons are still working — the system is laying the groundwork for a "what-if".
4. The third, dimensioning failure → both elevators lost (red MAN PITCH TRIM ONLY). The ailerons jump 12° → 14°, the THS absorbs the slight nose-up, the speed/FL limits drop away. You disconnect the A/THR, fly pitch gently on the wheel, and coax roll with rudder. This is the pitch mechanical back-up in the flesh.
5. Total electrical loss / all five computers lost → BCM takes yaw. The rudder's normal control is gone; the BPS makes power from B or Y hydraulic and the BCM drives the rudder from its own pedal sensor and gyrometers. You command yaw straight from the pedals with Dutch-roll damping, but no turn coordination — coordinate with your feet.
6. All engines out. Engines stopped, but the RAT is out supplying power and Blue hydraulic and the computers are alive — you are still in Alternate Law, not the mechanical back-up. This is the living proof of FCOM's "very unlikely": even an all-engine flameout does not drive you to this rung.

The QRH nails scene 6 down: in the electrical emergency configuration the cruise summary reads ALTN LAW: PROT LOST — alternate law, not mechanical back-up — and the all-engine-failure procedure is likewise flown in alternate law. Hold onto that and you will never overestimate the chance of using the mechanical back-up.

Dispatch note. The back-up is also part of the ground safety net implied by FCOM's "in MMEL dispatch condition". Some operators' MEL, when a rudder-servo fault is carried for dispatch, require the back-up to be verified operative as a condition of release — operator-specific practice, but the same idea: the back-up is the last link in the redundancy chain, and the dispatch logic counts on it being there.

Self-test

[!note]- Q1. FCOM says the back-up is built to achieve all safety objectives in MMEL dispatch. Which four failure cases does it cover?

Per FCOM DSC-27-20-20-50: (1) a temporary and total electrical loss; (2) the temporary loss of the five fly-by-wire computers (3 PRIM + 2 SEC); (3) the loss of both elevators; (4) the total loss of ailerons and spoilers. Note the framing — it is not "the aircraft is broken this badly, so use the back-up", but "because this back-up exists, those four failures can be tolerated and still meet the airworthiness safety objectives under MMEL dispatch." And the back-up is not one master switch: it is the union of pitch falling to the THS wheel and yaw falling to the BCM; any one axis taken to its limit invokes its own fall-back.

[!note]- Q2. What is the difference between amber USE MAN PITCH TRIM and red MAN PITCH TRIM ONLY?

Colour is the whole distinction. Amber USE MAN PITCH TRIM appears in Direct Law (or flare law without RA): the elevators still work, you still fly pitch on the sidestick, but auto-trim is off so you trim with the wheel (FCOM DSC-27-20-20-30). Red MAN PITCH TRIM ONLY appears when a left + right elevator fault is detected: the elevators are gone and the THS wheel is the sole pitch control — that is the pitch mechanical back-up (FCOM DSC-27-20-20-50, and the PFD legend item (5) at DSC-27-20-20-30). In one line: amber = elevators still there; red = THS only.

[!note]- Q3. How can the BCM still control the rudder after a total electrical failure?

Because the BCM makes its own power and reads its own sensors. Its electricity comes from the BPS, a hydraulic-motor-driven generator spun by the Blue or Yellow hydraulic system, so it never touches the aircraft electrical network (FCOM DSC-27-10-10; AMM 27-99-00). Its inputs come from a dedicated pedal sensor in the PFTU plus internal yaw-rate gyrometers. Activation is by removal of inhibition: in normal operation FCPC1/FCSC1 inhibit the BPS and FCPC2/3 inhibit the BCM; when those computers fail or lose power the inhibition signals vanish, the BPS generates, and the BCM takes the rudder automatically — driving one servocontrol at a time, Yellow by priority, Blue if Yellow is unavailable. So a total electrical loss is survivable as long as B or Y hydraulic has pressure.

[!note]- Q4. Why does FCOM keep calling the mechanical back-up "very unlikely", and which law are you in after an all-engine flameout?

Because the fly-by-wire redundancy is deep enough to push the probability of reaching it to the extreme tail. Per FCOM DSC-27-20-20-50, even in case of electrical emergency configuration, or an all-engine flameout, alternate law remains available. The QRH confirms it — the electrical emergency configuration summary reads ALTN LAW: PROT LOST, and the all-engine-failure procedure is flown in alternate law. Only a stack like all five computers lost, or a total electrical failure actually reaches the mechanical back-up. So an all-engine flameout leaves you in Alternate Law, two rungs above this one.

[!note]- Q5. With both elevators about to fail, how does the system make the transition smooth instead of a sudden nose-up?

By presetting the ailerons. A failed aileron floats to its zero-hinge-moment position (14° up), which would give a sudden nose-up. So the ELEV REDUND LOST logic preset the ailerons to 12° up beforehand, while the elevators are still available to trim that out via the THS (FCTM PR-AEP-F_CTL). When the third failure actually hits, the ailerons move only from 12° to 14° — a 2° change, a slight nose-up the THS absorbs, and MAN PITCH TRIM ONLY appears. The cost is around 16% extra fuel from the preset (FCTM: a compromise between fuel consumption increase (around 16 %) and the pitch up effect at the time of the third failure); the preset is removed below ~2000 ft or in CONF 2 for landing. Operationally you also disconnect the A/THR so thrust changes do not disturb the now wheel-only pitch.

[!note]- Q6. The ELEV REDUND LOST procedure imposes both a speed limit and an FL limit. Are they the same conservative pair, and what about the aft-CG warning?

No — each guards a different failure (FCTM PR-AEP-F_CTL). The speed limit copes with the airframe structural effort at the instant of the third failure (lower speed = lower dynamic pressure = smaller impulse load). The FL limit preserves stabiliser authority once pitch is on the THS alone. Both apply only until the third failure happens — afterwards they no longer apply. As for the aft-CG warning: it is false in the preset configuration — the Flight Envelope computer infers CG from THS position, and the preset makes the THS deflect to cancel the nose-up, so it computes an erroneous aft CG. Disregard it; the true CG is the value the FCMC computes and shows on ECAM.

Key takeaways

The pilot's window into all of this is narrow — a red line on the PFD, a wheel on the pedestal, the pedals under foot. Everything else is the architecture quietly holding the floor so that this floor is almost never needed.

References

Per FCOM DSC-27-20-20-50 (Mechanical Back-up — purpose / four MMEL-dispatch failure objectives; "very unlikely … alternate law remains available"; PITCH — pitch mechanical control through the THS, "MAN PITCH TRIM ONLY" red on PFDs; LATERAL — BCM provides yaw damping and direct rudder command, own generator supplied by B or Y hydraulic). Per FCOM DSC-27-10-10 (General — surfaces all electrically-controlled/hydraulically-actuated, stabilizer can also be mechanically-controlled; PITCH AXIS elevator/stabilizer control split; two handwheels on the centre pedestal mechanically control the THS; BCM full description — yaw damping + direct pedal-to-rudder via an independent unit, own BPS generator from B/Y hydraulic, own gyrometers + pedal-deflection sensors, control of B and Y actuators, yaw alternate law with no turn coordination). Per FCOM DSC-27-20-20-30 (Reconfiguration Control Laws — "USE MAN PITCH TRIM" amber in direct law; PFD legend items (4) amber USE MAN PITCH TRIM and (5) red MAN PITCH TRIM ONLY on L+R elevator fault). Per AMM 27-99-00 (Electrical Back-up — yaw control and Dutch-roll damping when normal rudder servoing is unavailable; activation by removal of inhibition signals from FCPC1/FCSC1 (BPS) and FCPC2/3 (BCM); BCM controls one rudder servocontrol at a time, Yellow priority / Blue if Yellow unavailable). Per FCTM PR-AEP-F_CTL (ELEV REDUND LOST — three-failure combination and smoothing of the transient; 12° aileron preset before the third failure (a fuel-consumption compromise, around 16%) → failed ailerons to 14° zero-hinge-moment → smooth transition controllable through the THS, MAN PITCH TRIM ONLY on PFD; speed limit for structural effort and FL limit for stabiliser authority, both lifted after the third failure; aft-CG warning false in preset configuration — FE-computer THS-based, disregard, FCMC/ECAM CG reliable; loss of both elevators → MAN PITCH TRIM ONLY, A/THR may be disconnected). Per QRH (electrical emergency configuration cruise summary "ALTN LAW: PROT LOST"; all-engine-failure procedure in alternate law) — supporting evidence that the back-up is "very unlikely". The hardware internals of the BCM and BPS (LRU detail, solenoid-valve active/standby logic) are deferred to Electrical Back-up BCM/BPS, the THS mechanical run to Trimmable Horizontal Stabiliser, and the rudder-by-wire servo architecture to Rudder and Yaw. The "fail-active by removal of inhibition" reading, the rudder-induced yaw-roll as the only roll source once the roll surfaces are lost, the speed-limit-as-dynamic-pressure rationale, and the A/THR-disconnect thrust-line reasoning are integrative synthesis built on the verbatim statements above, to be confirmed in the relevant surface and computer articles; some operators' MEL dispatch requirements are operator-specific practice and may not generalise.

Independent study material, not an Airbus publication and not endorsed by the manufacturer. Always defer to the current operator FCOM, FCTM, and QRH for operational use.