Electrical Back-up — BCM and BPS

The A330 rudder is rudder-by-wire: the pedals feed position sensors, the PRIM and SEC computers turn that into a command, and three hydraulic servocontrols supply the force (see Rudder and Yaw). That design has one congenital weak spot — kill the computers and you kill the electrical signal, and the rudder stops moving. Pitch has a ready answer to the same weakness: the THS manual trim wheel, a mechanical run that needs no electrical power (THS). Roll is covered by the multiple hydraulic redundancy of the ailerons and spoilers. Yaw alone has neither a mechanical cable nor spare surfaces — yet the rudder still has to be available, because it is what trims an engine-failure and damps the Dutch roll. So Airbus gives yaw its own miniature, self-contained back-up: the Back-up Control Module (BCM) with its Back-up Power Supply (BPS). This article is the engineering enlargement of the one line in Flight Control Fundamentals — "for yaw, the last resort is the BCM."

Two framing warnings up front:

[!warning]- The A330 electrical back-up is rudder-only. No other surface has a self-powered electrical back-up actuator — the A330 has no EHA or EBHA.

The only electrical back-up actuation anywhere on this aircraft is for the rudder, through the BCM/BPS. Do not imagine each surface carrying its own self-powered electrical back-up: there is none. Every other surface (ailerons, elevators, spoilers) is moved purely by hydraulic servocontrols commanded by the flight control computers, and the THS keeps its mechanical trim-wheel channel. If you carry a "back-up actuators everywhere" mental model into this chapter, you will badly over-estimate what survives a total computer or electrical loss — outside yaw, nothing electrical backs the surfaces up.

[!warning]- "Self-generated power" does not mean a battery.

The BPS does not store charge. It is a hydraulic-driven generator that turns hydraulic flow into electricity in real time. That single fact re-routes the lifeline of the yaw back-up from electrical endurance to hydraulic availability — the BCM has power for exactly as long as the Blue or Yellow hydraulic system has pressure, and not one second longer. This is why ATA-29 is a hard prerequisite for this article.

1. Why yaw needs a dedicated back-up — the three-axis asymmetry

The whole reason this subsystem exists is an asymmetry between the axes when everything electrical and computer-driven is gone:

Pitch and yaw are the two axes that must keep some authority right down to the bottom of the failure ladder. Pitch gets it for free — a wheel and a cable to the stabiliser. Yaw cannot, because the rudder is rudder-by-wire with no mechanical run to the surface, so the only way to keep yaw alive after the computers die is to bolt on a completely independent little system that does not share anything that would die with them: its own power, its own sensors, its own control logic, its own direct path to a servo. That is the BCM/BPS, and "independent" is the word the whole design turns on.

2. The architecture — a self-contained island

The AMM describes the back-up as a small loop with five jobs packed into it: who makes power, who computes, which servo is driven, where the signals come from, and who holds it inhibited. Built from the AMM 27-99-00-00 Description and Operation text, the topology is:

   INHIBIT (normal: back-up held OFF)        SELF-CONTAINED ISLAND
                                             (shares nothing that dies
                                              with the main system)
  ┌───────────────┐  inhibit   ┌────────────────────────────────┐
  │ FCPC1 + FCSC1 │───────────►│  BPS.B  ◄── Blue   hydraulic    │
  └───────────────┘            │  BPS.Y  ◄── Yellow hydraulic    │
                               │  hyd motor → AC generator       │
  ┌───────────────┐  inhibit   └───────────────┬────────────────┘
  │   FCPC2 / 3   │──────┐        3-phase AC    │ power
  └───────────────┘      │                      ▼
                         │       ┌────────────────────────────────┐
  ┌────────────────┐pedal│       │             B C M              │
  │ Pedal transducer├─────┴──────►  pedal position → yaw order    │
  │   (in PFTU)    │ position    │  rate gyro      → yaw damping   │
  └────────────────┘             │  closed-loop control of 1 servo│
  ┌────────────────┐ rudder pos  │  selects ONE servo (Y, else B) │
  │ Rudder position│◄───────────►│                                │
  │   transducer   │             └──┬──────────────────────┬──────┘
  └────────────────┘    test/status │                      │ command
                          ┌─────────▼──┐          ┌─────────▼────────┐
                          │   FCDC 1   │          │  Yellow rudder   │
                          └────────────┘          │  servo (Blue if  │
                                                  │  Y not available)│
                                                  └─────────┬────────┘
                                                            ▼  RUDDER

Four things to read off it:

1. The BCM is an information island. Its two inputs — pedal position (from a dedicated transducer inside the Pedal Feel and Trim Unit) and yaw rate (from its own rate gyro) — bypass the flight control computers and bypass the ADIRS entirely. That is precisely why it can still work when "the computers are all dead": it does not depend on anything that dies with them.
2. There are two BPS, each fed by one hydraulic system (BPS.B on Blue, BPS.Y on Yellow), wired in parallel to power the BCM. Either one alive means the BCM has power.
3. Inhibition is the activation key, and it is two-level. FCPC1 + FCSC1 hold the BPS inhibited; FCPC2/3 hold the BCM inhibited. In normal flight the back-up is actively held down by the live computers; only when those inhibit signals disappear does it wake by itself. It is a "wait passively, take over automatically" design.
4. At the rudder end the BCM drives one servo only — Yellow first, Blue if Yellow is unavailable — not the three-servo parallel set the PRIMs use. Enough to move the surface; no attempt at the normal triple redundancy.

2.1 Parts, traced to the AMM

The shape to memorise: two generators, one brain, and its own eyes and ears. Two BPS make the power, one BCM does the computing, and the BCM carries its own rate gyro (an "ear" for yaw rate) and its own dedicated pedal transducer interface (an "eye" for how hard you are pushing). Nothing in that list is borrowed from a system that could fail alongside it.

3. What it is and when it activates — the FCOM definition

The pilot-facing FCOM compresses the BCM into one paragraph. Per FCOM DSC-27-10-10:

The BCM computer provides yaw damping, and direct rudder command with pedals, via an independent unit, in case of: Total electrical failure, or Loss of rudder control due to a Flight Control Computer (PRIM and SEC) failure. It includes: Its own electrical generator, referred to as the Backup Power Supply (BPS), which is supplied by the B or Y hydraulic system; Its own sensors (gyrometers and pedals deflection); Control of the B and Y hydraulic actuators. When activated, as in yaw alternate law, there is no turn coordination.

Unpack it clause by clause:

• "in case of: total electrical failure, OR loss of rudder control due to PRIM and SEC failure." Two activation conditions — and the second one means PRIM and SEC are both out, not a single failed box. The normal rudder chain runs PRIMs first, then SEC; only when neither can still drive the rudder does the BCM get its turn. This is an extremely deep redundancy floor: all five main flight control computers must be unable to control yaw, or the whole aircraft must lose electrical power.
• "via an independent unit." The soul of the design. The BCM shares no power, no sensors, no computing with the five main computers. The price of that independence is a deliberately minimal feature set (pedal-to-rudder plus damping, and nothing else); the reward is "however the main system dies, this does not die with it."
• "its own sensors (gyrometers and pedals deflection)." Its own gyro and its own pedal-deflection sensing — not the ADIRS, not the computers' sensors. §5 nails this down from the AMM.
• "when activated, as in yaw alternate law, there is no turn coordination." The behaviour change the pilot must remember. In normal law a roll demand is automatically coordinated in yaw by the computers and you do not touch the pedals; once the BCM takes over, that automatic coordination is gone — to coordinate a turn and kill sideslip you now use your feet.

What this means in the cockpit: the BCM is something you will, in all probability, never reach in a flying career on type — it takes all five computers down, or a total electrical failure. But if it does activate, your yaw control degrades: the rudder follows your pedals (with damping), and the automatic coordination is gone. You fly yaw the way an older aircraft is flown — actively, with your feet.

4. Where the BCM sits in the rudder control chain

The detailed FCOM architecture section slots the BCM into the rudder's electrical control sequence — which computer drives which servo, and where the BCM falls in line. Per FCOM DSC-27-10-20:

In normal operation, PRIM 1 controls the green hydraulic servo control, PRIM 2 controls the blue hydraulic servo control, and PRIM 3 controls the yellow hydraulic servo control. If all the 3 PRIMs fail, SEC 1 controls the green hydraulic servo control. In case of a total electrical failure, or loss of rudder control due to flight control computers failure, the Backup Control Module (BCM) controls the yellow hydraulic servo control, or the blue hydraulic servo control, if the yellow hydraulic servo control is not available.

Read alongside the rudder actuation rule, this explains why the BCM needs only one servo. Per FCOM DSC-27-10-20:

The rudder is actuated by 3 independent hydraulic servo controls operating in parallel. In normal operation, the 3 servo controls are simultaneously in active mode. In case of an electrical or hydraulic failure, the corresponding servo control is in damping mode.

The chain therefore steps down like this (the linking is synthesis, not a verbatim line):

  PRIM 1/2/3   ──►  SEC 1        ──►  BCM
  (G, B, Y      (3 PRIM lost:    (PRIM AND SEC lost / total elec
   servos,       Green servo)     failure: Yellow servo, or Blue
   parallel)                      if Yellow not available)

Notice that by the time control reaches the BCM, the Green servo has already been handed off at the SEC 1 stage — so the BCM only ever chooses between Yellow and Blue, which is exactly the pair of hydraulic systems the BPS draws its power from (§6).

Why Yellow first? The FCOM and AMM both state only the conclusion — Yellow in priority, Blue as the fallback — and give no reason for the priority. The precise selection and inhibition logic lives in the ASM schematics (27-98-73/74), which are not consulted here, so the rationale is left unresolved rather than guessed (marked INSUFFICIENT).

[!warning]- Do not rationalise "Yellow first" by claiming the Yellow system has more sources, or a RAT, and is therefore more available — that reasoning is built on a wrong fact.

The Yellow system is pressurised by an Engine 2 pump, an electric pump, and a hand pump — there is no RAT on Yellow. Per FCOM DSC-29-10-20, A pump, driven by Engine 2 pressurizes the yellow system. In addition, an electric pump which can be manually or automatically controlled can also pressurize the yellow system. The RAT drives the Green system: A pump, driven by a Ram Air Turbine (RAT), pressurizes the green system in the event of an emergency. So the popular "Yellow has the RAT, hence more available, hence priority" story is a frame-up — wrong source, wrong axis. The genuine priority rationale is not in the consulted manuals and is left open (see ATA-29 Hydraulic Fundamentals).

5. Inside the BCM — an analog brain that does one thing

The FCOM stops at the definition; how the BCM is built, computes, and tests itself is all in the AMM. Start with the system description. Per AMM 27-99-00-00 (General):

The electrical back-up provides the yaw control of the aircraft if the rudder normal servoing by the flight control computers is not operational. The electrical back-up transmits the pilot orders from the rudder pedals to the rudder and ensures Dutch roll damping.

Note that the AMM makes the FCOM's generic "yaw damping" specific: Dutch roll damping — the lateral-directional coupled oscillation that a large swept-wing aircraft most needs electronic help to suppress. The BCM holds onto that function even in the most extreme configuration, which tells you it is not merely "letting you push the pedals" — it must also keep the aircraft from diverging in Dutch roll.

The system description then gives the activation logic and the signal chain in one block. Per AMM 27-99-00-00 (System Description):

In the absence of inhibition signals from FCPC1 and FCSC1 (due to computer failure or centralized electrical power supply failure), the Back-up Power Supplies are activated and generate the electrical power for the Back-up Control Module if the corresponding hydraulic system is available. The Back-up Control Module becomes operative automatically in the absence of inhibition signal from FCPC2/3 and if it is electrically energized by at least one Back-up Power Supply. The Back-up Control Module selects and controls one rudder servocontrol at a time (Yellow in priority and Blue if the Yellow hydraulic system is not available). The rudder order is processed by the Back-up Control Module according to a pedal position command signal from a dedicated transducer in the Pedal Feel and Trim Unit. The yaw damper order is computed according to the yaw rate measured by a dedicated rate gyro in the Back-up Control Module.

Three mechanisms to pull out:

1. Two-level inhibition. The BPS watch FCPC1 + FCSC1; the BCM watches FCPC2/3. Both levels must "stand down" before the whole back-up runs. Spreading the inhibit across several computers stops one misbehaving computer from spuriously activating the back-up — and a spurious activation would suddenly strip turn coordination in otherwise normal flight.
2. The pedal signal comes from a dedicated transducer in the PFTU — a separate sensor from the one feeding the normal control chain. Even if the normal pedal sensing dies with the computers, the BCM's own pedal transducer survives (Pilot Controls).
3. Damping runs on the BCM's own rate gyro — not the ADIRS attitude/rate. The ADIRS can be lost in a total electrical failure, so the damping function must carry its own "ear."

Now the physical build (maintenance-layer detail removed, mechanism retained). Per AMM 27-99-00-00 (Back-up Control Module):

The Back-up Control Module consists of: a sealed housing attached to the structure at four points, a rate gyro that measures the yaw rate, an analog electronic circuit that has these functions: regulation of the power supply voltages from the Back-up Power Supply, power supply of dedicated pedal and rudder position transducers, Selection of the laws and filter adapted to the aircraft configuration using the A/C wiring pin prog, generation of rudder position orders calculated on the basis of pedal position and yaw rate via the control law, closed loop control of the rudder servocontrol, selection of one of the two rudder servocontrols on the basis of the selection logic, test of the capability to perform its functions. This test is controlled from the FCDC 1.

[!warning]- Many pilots assume a flight-control back-up must itself be a digital computer. The BCM is an analog electronic circuit, not software.

The BCM's core is an analog electronic circuit, and it does not even load its control law as software — it selects the law and filter from the aircraft wiring pin-prog, hard-wired to the airframe configuration. This is deliberate: an analog circuit is structurally simple, has few failure modes, and depends on no software load or power-up self-test sequence — exactly the qualities you want in a "last line of defence", where simpler is more reliable. The cost is that it does only two things (pedal-to-rudder and Dutch-roll damping), and that minimalism is the very thing that buys "whatever happens to the main system, this keeps working."

Two couplings worth holding: the BCM's self-test is initiated by FCDC 1, and the BCM reports its "energised / active" status back to FCDC 1. So whatever health indication you see for the electrical back-up reaches the displays through FCDC 1 (FCDC).

Putting the BCM's interfaces together (synthesis), it is a deliberately closed island with only four kinds of connection: (a) in — its own dedicated pedal and rudder position transducers, which it powers itself; (b) out — a direct closed-loop drive to the Yellow (or Blue) rudder servo, bypassing PRIM and SEC — this direct physical path is the hardware root of "yaw still moves after every flight control computer is gone"; (c) the inhibit lines from the flight control computers, deciding when it activates; and (d) the self-test / status link to FCDC 1. It needs nothing from the main flight control system but those two thin wires — inhibit in, status out. That is exactly why it can run with the main controls dead and the buses unpowered: it is a true off-grid lifeboat.

6. Inside the BPS — squeezing hydraulics into electricity

The BCM needs power before it can do anything, and that power comes from the BPS, which is at heart a hydraulic-driven AC generator. The FCOM says only "supplied by the B or Y hydraulic system"; the AMM gives the build. Per AMM 27-99-00-00 (Back-up Power Supply):

The Back-up Power Supply consists of: a housing attached to the structure at four points, a hydraulic motor with a rotating wheel which directly drives the rotor of the electrical power generator, an electrical power generator that delivers 3-phase variable-frequency AC voltage to the Back-up Control Module, a solenoid valve with two segregated windings for switching to active or standby mode, a hydraulic filter, two electrical connectors that are the interface with the flight control computers and the Back-up Control Module.

Those two connectors are the BPS's whole relationship with the rest of the aircraft (synthesis): one carries the inhibit signal in from FCPC1/FCSC1 — while the main flight controls are alive and the inhibit is present, the BPS is held in standby and does not start — and the path carries the generated 3-phase variable-frequency AC out to the BCM. One port decides when it should wake, the other decides whom it feeds.

Built from the AMM operating description, the generation chain is:

  Blue OR Yellow                  ┌────────────────────────────┐
  hydraulic pressure ───────────► │ solenoid valve             │
                                  │  de-energised = ACTIVE     │
  ◄── return ─────────────────────┤  energised    = STANDBY    │
                                  └─────────────┬──────────────┘
                                   filtered flow │
                                                 ▼
                                  ┌────────────────────────────┐
                                  │ hydraulic motor            │
                                  │  (rotating wheel)          │
                                  └─────────────┬──────────────┘
                                   direct drive │
                                                ▼
                                  ┌────────────────────────────┐
                                  │ AC generator               │──► 3-phase
                                  │  (rotor driven directly)   │   variable-
                                  └────────────────────────────┘   frequency
                                                                   AC → BCM

The two operating modes are where the clever bit hides. Per AMM 27-99-00-00 (Back-up Power Supply operation):

active mode: the solenoid valve is de-energized, the hydraulic flow supplies the hydraulic motor which drives the electrical power generator. The electrical power generator delivers electrical power to the Back-up Control Module.

In standby mode the logic is the mirror image: at least one winding of the solenoid valve is energised, the hydraulic motor is no longer supplied, and the generator delivers no power.

[!warning]- The BPS is de-energised to run — a fail-safe that is exactly what makes "total electrical failure" survivable.

The solenoid valve logic is energised = standby (no power), de-energised = active (generating). So at the instant the aircraft loses all electrical power, the valve loses its energising current, drops to de-energised, and the BPS automatically falls into its generating mode. Were it the other way round — "energise to generate" — a total electrical failure would leave nothing to drive the valve to the generating state, a logical dead-end. This de-energise-to-run choice (a fail-safe rationale, synthesised here) is precisely what lets the BPS cover the total electrical failure case.

The supply source is the two cross-system hydraulics. Per AMM 27-99-00-00 (Power Supply): The Back-up Power Supplies are supplied from the Blue and Yellow hydraulic systems. So as long as either Blue or Yellow still has pressure, a BPS can generate and the BCM stays alive. And because the BPS converts hydraulic energy to electrical energy in real time rather than storing it, the back-up's endurance is governed by hydraulic availability, not by any battery charge — the point made in the opening warning, and the reason ATA-29 underpins this whole article.

7. The crew view — when you actually reach the BCM

Walk the back-up through six scenes:

1. A whole normal flight. The BCM/BPS sit inhibited the entire time by FCPC1/FCSC1/FCPC2/3; the BPS solenoid is energised and not generating. You never sense it and ECAM is silent — a parachute you carry but never open.
2. One PRIM fails (F/CTL PRIM 1 FAULT). The inhibit signals are still present (other computers still command the rudder), so the BCM does not activate. The rudder is driven by a remaining PRIM, the law may still be Normal. The BCM is nowhere near being needed.
3. All three PRIM fail. The rudder passes to SEC 1 (Green servo); the BCM still does not activate, because SEC is still in charge. This is the FCOM "if all 3 PRIMs fail, SEC 1 controls" stage.
4. PRIM and SEC both lost (an extreme multiple failure). The inhibit stands down → BPS activates and generates → the BCM takes over automatically, driving the Yellow servo (Blue if Yellow is unavailable). You are now in yaw alternate law: the rudder follows the pedals directly, with Dutch-roll damping, but with no turn coordination. Rolling into a turn, you add the rudder yourself to kill sideslip.
5. Total electrical failure (the extreme in which even RAT/emergency configuration cannot bring the computers back). The BPS solenoid de-energises with the power loss and falls into generating mode; the BCM takes yaw on its own gyro and pedal transducer. This is its ultimate reason to exist. Keep the Fundamentals caveat in mind — even an electrical emergency configuration or an all-engine flameout still leaves alternate law available; reaching the BCM as the sole yaw controller is an improbability stacked on an improbability (Mechanical Back-up and BCM).
6. Loss of both yaw dampers (not necessarily the BCM, but the same technique). Per FCTM AS-RUD: Loss of both yaw damper systems: The flight crew uses the rudder pedals as deemed necessary, for turn coordination to prevent excessive sideslip. That is a rehearsal of what the BCM asks of you — no automatic coordination, so coordinate with your feet, but gently, because the rudder never had envelope protection and over-use can overstress the fin (QRH Jam and Loss of Control).

7.1 What the crew sees and is told to do

In scenes 4 and 5, the moment the BCM takes the rudder, ECAM raises F/CTL RUD NORM CTL FAULT. The FCTM "use the rudder gently" is the general principle; the A330-specific, executable numbers, the capability gap, and the crew prompts are in the procedure. Per FCOM PRO-ABN-F_CTL:

The backup control module takes over the rudder control but cannot ensure the rudder travel limit function. Therefore, to prevent damage to the aircraft structure, use the rudder with care, when the speed is above 160 kt. However, aerodynamic limitations ensure that excessive load cannot be reached on the rudder.

and the STATUS expansion. Per FCOM PRO-ABN-F_CTL:

The rudder travel limit value is frozen at the value it had at the moment when the failure occurred. Therefore, rudder inputs must be limited at speeds above 160 kt, so as not to damage structure. At slats' extension, full rudder travel authority is recovered.

with the STATUS / INOP items reading RUD WITH CARE ABV 160 KT, USE RUD FOR TURN COORD, and RUD BACKUP CTL (footnoted Rudder via the rudder backup module), and under INOP SYS, GLS AUTOLAND and CAT 2.

Three A330-specific facts fall out — the things you actually see on ECAM and actually have to do:

1. The core capability lost is the rudder travel limit function. Normally the PRIMs compute this limit, progressively reducing the maximum rudder deflection as speed rises so that a large deflection at high speed cannot damage the fin (mechanism in Rudder and Yaw). With the BCM in command, that function is gone — the FCOM is explicit: it cannot ensure the rudder travel limit function. This is the price of the BCM's minimalism: it lets you push the pedals and gives you damping, but the layer that protects the structure for you is absent.
2. 160 kt is the hard line. With the travel limit gone, the executable red line is 160 kt: above it, large or rapid pedal inputs can damage the structure, so use the rudder with care. The limit value is frozen at the value it had when the failure occurred, and full rudder travel authority is recovered only at slats' extension (i.e. in the low-speed configuration). The FCOM does add a reassurance — aerodynamic limitations ensure that excessive load cannot be reached on the rudder — but that is "do not panic, but stay careful", not licence to stamp on it.
3. No one coordinates the turn for you, and the autoland capability drops. STATUS tells you to USE RUD FOR TURN COORD — the crew-action form of §3's "no turn coordination" — while INOP SYS lists GLS AUTOLAND and CAT 2 as inoperative. Read the Airbus way, a bare category under INOP SYS is the capability that is lost (the same convention by which CAT 3 DUAL under INOP means CAT 3 SINGLE remains). So CAT 2 (and with it CAT 3) is gone, leaving CAT 1 approach capability only — no GLS autoland, no CAT 2 / CAT 3 landing.

Self-test

[!note]- Q1. Under what conditions does the BCM activate? If a single PRIM fails, does it take over?

No. The BCM activates only in two extremes: (1) total electrical failure, or (2) loss of rudder control due to PRIM and SEC failure (FCOM DSC-27-10-10). The rudder degrades PRIM (three servos) → all 3 PRIM lost: SEC 1 (Green servo) → only when both PRIM and SEC can no longer drive the rudder does the BCM take over (Yellow servo, Blue if Yellow unavailable) (FCOM DSC-27-10-20). Mechanically, the BPS watch the FCPC1/FCSC1 inhibit and the BCM watches the FCPC2/3 inhibit — both must disappear before the BPS generate and the BCM goes operative (AMM 27-99-00-00). With one PRIM failed the inhibit signals remain, so the BCM stays quietly in standby.

[!note]- Q2. How does the BPS make power? Is "self-generated power" a battery? With all aircraft power lost, can it still generate?

Not a battery. The BPS is a hydraulic-driven AC generator — hydraulic flow drives a hydraulic motor, the motor directly drives the generator rotor, and it delivers 3-phase variable-frequency AC to the BCM (AMM 27-99-00-00). It is supplied from the Blue and Yellow hydraulic systems. The key is the solenoid valve logic: de-energised = active (generating), energised = standby — so at the instant of a total electrical failure the valve de-energises and the BPS automatically enters generating mode. Whether it can generate depends not on stored charge but on whether Blue or Yellow still has pressure — the yaw back-up's lifeline is hydraulic, not electrical.

[!note]- Q3. The BCM computes a pedal order and a yaw-damping order. Where do those two signals come from, and why not use the ADIRS and the normal pedal sensors?

The pedal order comes from a dedicated transducer inside the PFTU, and the yaw damping from the BCM's own dedicated rate gyro (AMM 27-99-00-00). Both bypass the flight control computers and the ADIRS. That is exactly because the BCM must cover "all computers lost / total electrical failure" — in those states the ADIRS and the normal pedal-sensing chain can fail together, so a back-up that borrowed them would die with them. The BCM has to be an information island with its own eyes (pedal transducer) and ears (rate gyro).

[!note]- Q4. After the BCM takes over, how does yaw handling differ from normal, and what does it demand of you on the pedals?

It is equivalent to yaw alternate law, with no turn coordination (FCOM DSC-27-10-10). Normally a roll demand is auto-coordinated by the computers and you leave the pedals alone; with the BCM in command the rudder becomes direct pedal control (with Dutch-roll damping) and you must coordinate turns and kill sideslip with your feet (ECAM STATUS literally says USE RUD FOR TURN COORD). Critically, the BCM cannot ensure the rudder travel limit function, so the FCOM sets a hard line — use the rudder with care above 160 kt to avoid fin overstress (full travel authority is recovered at slats' extension) — and INOP SYS lists GLS AUTOLAND and CAT 2 as inoperative, i.e. GLS autoland is lost and CAT 2 (with CAT 3) is gone, leaving CAT 1 only (FCOM PRO-ABN-F_CTL). Since the rudder never had envelope protection, large, reversing or rapid inputs can damage the structure, so under the BCM use the rudder actively but gently (FCTM AS-RUD).

[!note]- Q5. Why is the BCM described as an "analog circuit" rather than a digital computer, and what is the benefit?

The AMM states its core is an analog electronic circuit, and it even selects its control law by the aircraft wiring pin-prog rather than a software load (AMM 27-99-00-00). The benefits: structurally simple, few failure modes, no dependence on software or a power-up self-test sequence — fitting the "the last line of defence should be as dumb and reliable as possible" philosophy. It does only two things — direct pedal-to-rudder and Dutch-roll damping — and that minimalism is precisely what buys independence from however the main system fails.

[!note]- Q6. Does the A330 carry electrical back-up actuators on every surface?

No. The only electrical back-up actuation on the aircraft is for the rudder, via the BCM/BPS. Every other surface (ailerons, elevators, spoilers) is moved purely by hydraulic servocontrols commanded by the flight control computers, and the THS keeps a mechanical trim-wheel channel — there is no self-powered electrical back-up behind any of them. Yaw is the special case because the rudder is rudder-by-wire with no mechanical run, yet must stay available; pitch and roll are covered by the trim wheel and by hydraulic redundancy respectively.

Key takeaways

The BCM/BPS is the deepest, least-visited corner of the A330 yaw chain — a small, dumb, independent system whose entire value is that it survives the failure that takes everything else. Know it is there, know it strips your turn coordination and your travel-limit protection, and know that under it the rudder is yours to fly with your feet.

References

Per FCOM DSC-27-10-10 (BCM definition — activation conditions, independent unit, own BPS and sensors, control of B/Y actuators, yaw alternate law with no turn coordination). Per FCOM DSC-27-10-20 (electrical rudder control degradation chain PRIM → SEC 1 → BCM with Yellow priority / Blue fallback; rudder actuated by three parallel servocontrols and damping mode; travel limit frozen at failure and recovered at slats' extension). Per FCOM PRO-ABN-F_CTL (F/CTL RUD NORM CTL FAULT — BCM takeover, loss of the rudder travel limit function, "use the rudder with care above 160 kt", aerodynamic load reassurance, STATUS items USE RUD FOR TURN COORD / RUD WITH CARE ABV 160 KT / RUD BACKUP CTL, INOP GLS AUTOLAND / CAT 2). Per FCOM DSC-29-10-20 (Yellow system sources — Engine 2 pump + electric pump; RAT pressurises the Green system — correcting the "Yellow has the RAT" misconception). Per AMM 27-99-00-00 (General — electrical back-up provides yaw control, transmits pedal orders, ensures Dutch roll damping; System Description — two-level FCPC1/FCSC1 and FCPC2/3 inhibition, Yellow-priority servo selection, dedicated PFTU pedal transducer, dedicated rate gyro; Power Supply — BPS supplied from Blue and Yellow; §5.A BPS build — hydraulic motor directly driving an AC generator, 3-phase variable-frequency AC, two-winding solenoid valve, hydraulic filter, two connectors; §5.B BCM build — sealed housing, rate gyro, analog electronic circuit, pin-prog law selection, closed-loop servo control, single-servo selection, FCDC 1 self-test and status; §6.A active/standby solenoid modes). Per FCTM AS-RUD (operational recommendations — loss of both yaw dampers, use the rudder pedals for turn coordination to prevent excessive sideslip). The ASCII topology and generation-chain diagrams are drawn from the AMM 27-99-00-00 Description and Operation text. Items flagged as synthesis (the Yellow-priority rationale — not stated in the consulted FCOM/AMM and left INSUFFICIENT, with the precise selection/inhibition logic residing in ASM 27-98-73/74 not consulted here; "analog circuit chosen for reliability"; "de-energise-to-run as a fail-safe for total power loss"; the BCM-as-information-island reading) are integrative reasoning, not verbatim manual statements. Hydraulic-system dependency per ATA-29.

Independent study material, not an Airbus publication and not endorsed by the manufacturer. Always defer to the current operator FCOM, FCTM, and QRH for operational use.