EFCS Computer Failures and Law Degradation

Flight Control Fundamentals closed on a single safety claim: one computer of any type can fly and land the aircraft. This article is the other side of that claim — what the crew actually sees and does as the computers fail one at a time, and at what point the failures stop being a reset item and start genuinely stepping the control law down.

The article walks the failure gradient from the top: a single F/CTL PRIM 1 FAULT that a reset cures and leaves you in full Normal Law, through F/CTL LAWS REDUND LOST where the redundancy is spent but the law is still normal, into F/CTL ALTN LAW with its hard speed/altitude/landing limits, down to an all-PRIM failure flying SEC Direct Law with RUD WITH CARE ABV 160 KT, and finally F/CTL ELEV REDUND LOST — the alert that is not a single-box failure at all, but a warning that you are one failure away from losing pitch control. It deliberately stops at the procedure and the post-failure limitation: the internal mechanics of each law (how Alternate or Direct actually compute) live in Alternate Law, Direct Law, and Law Degradation and Reconfiguration; surface-servo faults (AIL / ELEV / RUDDER SERVO FAULT) live in Control Surface Fault Spectrum.

[!warning]- A single computer fault is not a law degradation. This is the whole point of the chapter.

The instinct on seeing F/CTL PRIM 1 FAULT is "the fly-by-wire is failing, I am about to lose control." The architecture is built so that the opposite is true: a single PRIM or SEC fault is most often the computer's own self-protection retiring it cleanly, the master role hands over, the surviving computers cover its tasks (spoilers excepted), and the law usually stays Normal with unchanged handling. Real degradation into Alternate or Direct Law needs a stack of failures — multiple computers, or computers combined with key sensors or hydraulics. Read every line below against the question "has the law actually changed, or have I just lost redundancy?"

1. The premise — one fault versus a degradation

Two outcomes sit at opposite ends of this article, and keeping them apart is the entire skill:

• Lose one PRIM or one SEC. The master role passes down the chain (P1 → P2 → P3), another computer executes the failed one's tasks (except for spoiler control), and the law stays Normal. The crew action is a single reset; the aircraft feels identical. This is covered by the master logic detailed in EFCS Computer Architecture.
• Fail enough to trigger Alternate or Direct Law. Only now do you enter the world of lost protections, hard speed and altitude limits, and USE MAN PITCH TRIM. The content of those laws is in Alternate Law and Direct Law; this article covers how you get there and what limits ride with each step.

So the chapter is a ladder of severity. The further down a failure pushes you, the fewer the protections, the tighter the limits, and the closer the handling comes to a bare aircraft — exactly the spectrum introduced in Flight Control Fundamentals, now read through the ECAM.

2. The failure gradient

Each rung is a named ECAM alert with its own triggering condition and its own crew action. The map:

 Single PRIM / SEC FAULT ───────────────► law stays NORMAL, handling unchanged
   ECAM: F/CTL PRIM 1(2)(3) / SEC 1(2)    master hands over P1►P2►P3
   Action: reset OFF THEN ON ► if fail OFF other computers cover (not spoilers)
        │  failures keep stacking
        ▼
 F/CTL LAWS REDUND LOST ────────────────► still NORMAL, redundancy spent
   only one PRIM can run normal law       reset PRIM 1+2(1+3)(2+3) OFF THEN ON
        │
        ▼
 F/CTL ALTN LAW ────────────────────────► protections degraded (see piece 12)
   MAX SPEED 330/.82 · MAX FL by weight    CONF 3 landing (FLAP LVR 3) · CAT 2
        │
        ▼
 ALL PRIM FAILURE ──────────────────────► each SEC self-masters in DIRECT
   RUD WITH CARE ABV 160 KT (limit frozen) SPD BRK DO NOT USE · STRG PEDAL lost
        │
        ▼
 F/CTL DIRECT LAW ──────────────────────► USE MAN PITCH TRIM (see piece 13)
   MAX SPEED 330/.80 · SPD BRK DO NOT USE
        │
        ▼
 Mechanical back-up ────────────────────► pitch = THS trim wheel · yaw = BCM

Running alongside this main spine are two alerts that do not fit on the ladder: F/CTL ELEV REDUND LOST (a pre-warning, §7) and F/CTL FCDC FAULT (loss of the watcher, not the control — §8).

A quick-reference index of the computer-class alerts, each row drawn from FCOM PRO-ABN-F/CTL:

3. Single PRIM / SEC FAULT — reset and carry on

The PRIM-fault triggering condition is as plain as the procedure that follows it. Per FCOM PRO-ABN-F/CTL:

This alert triggers when there is failure of one primary computer.

The action is a single reset attempt — the affected PRIM OFF THEN ON; if unsuccessful, OFF — and a pointer to the QRH for the deeper troubleshooting tree. Per FCOM PRO-ABN-F/CTL:

For additional information Refer to QRH/ABN-02 F/CTL - F/CTL malfunction.

Read against EFCS Computer Architecture: a PRIM annunciating FAULT is, in the great majority of cases, its COM/MON command-monitor pair disagreeing and the computer taking itself offline by design — not the aircraft losing control. If that computer was the master, the role passes P1 → P2 → P3; the surfaces it drove are picked up by another computer (except for spoilers, the one task no other computer takes over). The law therefore stays Normal and the feel is unchanged. Many such faults are transient, so the ECAM has you cycle the pushbutton OFF THEN ON once; if the reset does not take, you leave it OFF and fly on the remaining computers.

SEC 1(2) FAULT follows the same shape. Per FCOM PRO-ABN-F/CTL:

This alert triggers when there is failure of one secondary computer.

The reset is identical (OFF THEN ON, then OFF if unsuccessful), but the SEC fault adds two STATUS reminders that a PRIM fault does not always raise:

FUEL CONSUMPT INCRSD

FMS PRED UNRELIABLE

Treat those as a cue to disregard the raw FMS fuel prediction and apply the fuel-penalty correction rather than trust the displayed figure.

[!warning]- After resetting a computer, expect a transient — and verify your pitch trim before you trust the picture.

FCOM documents that reconfiguring a flight control computer is not always seamless. Per FCOM DSC-27-20-20-10: A jerk may be felt, in the case of flight control computers reconfiguration (due to hydraulic failure, computer failure, electrical transient...). Because the PRIMs own the auto-trim that drives the THS, a PRIM dropping offline and coming back can leave the stabiliser momentarily out of step. The documented fact is the reconfiguration jerk; the airmanship that follows — glance at the pitch-trim position after a PRIM reset so a release of back-pressure does not surprise you — is reasoning from that fact plus the architecture, not a quoted ECAM line. SEC resets do not carry the same emphasis, because the Normal-Law auto-trim is a PRIM task, not a SEC one.

4. F/CTL LAWS REDUND LOST — running out of Normal-Law redundancy

There is a distinct alert for the moment the Normal-Law redundancy is nearly gone — and it is not a vague "redundancy low" message but a specific named caution. Per FCOM PRO-ABN-F/CTL:

This alert triggers when only one PRIM is able to process the normal law, because the two other PRIMs are in degraded law, not active, or not powered.

The action is to attempt a paired reset of the two PRIMs that are no longer running Normal Law — the bracketed notation simply lists the three possible pairs. Per FCOM PRO-ABN-F/CTL:

PRIM 1+2(1+3)(2+3) ... OFF THEN ON.

The critical reading: at this point the law is still Normal. What you have lost is depth, not capability — only one PRIM is still computing the normal law. A successful reset pulls a degraded PRIM back and restores the cushion; an unsuccessful one leaves you flying full Normal Law on a single normal-capable computer, where the very next failure is the one that drops you out of Normal. It is the rung that says "still fine, but you are out of spares."

5. F/CTL ALTN LAW — the hard limits

When the failures stack far enough to trigger Alternate Law, the ECAM says so directly. Per FCOM PRO-ABN-F/CTL:

This alert triggers when the alternate law is active.

The handling content of Alternate Law belongs to Alternate Law; what matters operationally are the hard limits that arrive with the STATUS page, because these are what the crew must actually fly to:

• MAX SPEED 330/.82. The reason is stated by FCOM itself, so there is no need to infer it. Per FCOM PRO-ABN-F/CTL: Speed is limited due to degraded high speed protection. Note the value: .82 in Alternate, distinct from the .80 of Direct Law (§6) — a classic point to confuse.
• MAX FL by weight. The heavier the aircraft, the lower the ceiling, to preserve manoeuvre and low-energy margin after the protections degrade. The STATUS table:

• CONF 3 landing. The approach is flown to a CONF 3 landing; the ECAM rewrites the approach-procedure line to FOR LDG: FLAP LVR 3 as a reminder when CONF 3 is selected.
• Protections lost / CAT 2. The STATUS reads ALTN LAW: PROT LOST, with F/CTL PROT listed INOP and autoland capability reduced to CAT 2.

[!warning]- Plain Alternate Law does not forbid the speedbrakes — the SPD BRK DO NOT USE you may be expecting belongs to Direct Law and to dual/all-PRIM failures.

The Alternate-Law STATUS limits speed, altitude, landing configuration and autoland category, but it does not carry a blanket "SPD BRK DO NOT USE." The speedbrake ban is added only in specific cases: under an electrical emergency configuration the Alternate-Law procedure does add In case of ELEC EMER CONFIG: SPD BRK ... DO NOT USE, and the unconditional ban is a feature of Direct Law and of dual / all-PRIM failure (§6, §7). Filing "ALTN = no speedbrake" is a memory error; the speedbrake restriction tracks the PRIM-failure / Direct axis, not the Alternate law itself.

6. F/CTL DIRECT LAW — the bottom of the computed laws

Direct Law's internals are the subject of Direct Law; for the failure picture, three things matter. Per FCOM PRO-ABN-F/CTL:

This alert triggers when the direct law is active.

PFD displays «USE MAN PITCH TRIM» in amber.

Automatic trim is inoperative in direct law.

With auto-trim gone, the crew trims pitch by hand on the THS wheel — MAN PITCH TRIM ... USE (except with B+Y HYD LO PR). The STATUS limits are SPD BRK ... DO NOT USE and MAX SPEED 330/.80 — the .80 that pairs with Direct, against the .82 of Alternate. The STATUS also shows DIRECT LAW: PROT LOST, F/CTL PROT and AP 1+2 INOP, and CAT 2. The mechanical back-up beyond Direct (pitch on the trim wheel, yaw on the BCM) is covered in Mechanical Back-up and BCM.

7. All PRIM failure — RUD WITH CARE ABV 160 KT

If all three PRIMs fail, each SEC becomes its own master in Direct Law. The STATUS now gives a very specific rudder caution. Per FCOM PRO-ABN-F/CTL:

In the case of an all PRIM failure: RUD WITH CARE ABV 160 KT The rudder travel limit value is frozen at the value it had at the moment when the failure occurred. Therefore, rudder inputs must be limited at speeds above 160 kt, so as not to damage structure. At slats' extension, full rudder travel authority is recovered.

The mechanism ties back to Rudder and Yaw: the rudder travel limit — which restricts maximum deflection at high speed to protect the fin — is normally computed by the PRIMs as a function of airspeed. With all PRIMs gone, nothing is left to schedule it with speed, so the system freezes it at whatever value it held when the failure occurred. The system cannot guarantee that frozen value is small enough for the speed you are now flying, so it hands the job to you: above 160 kt, you are the travel limiter — small, smooth pedal inputs, no large or rapid deflections, which would otherwise overstress the structure. Extend the slats for approach and full rudder authority returns, because at low speed full deflection no longer threatens the fin. This is the "rudder has no protection, over-deflection breaks the fin" theme from Flight Control Fundamentals, made concrete for the all-PRIM case.

Two further pieces of logic ride in the same F/CTL PRIM 1(2)(3) FAULT procedure:

Why dual PRIM failure already calls SPD BRK DO NOT USE — the manual gives the actual reason, not a vague "avoid coupling." Per FCOM PRO-ABN-F/CTL:

In the case of dual PRIM failure: SPD BRK ... DO NOT USE. In the case of a third PRIM failure: If the speed brakes are out, they immediately retract, inducing a strong pitch down effect.

So the ban is preventive: with two PRIMs already lost, a third — completing the all-PRIM case — would snap any extended speedbrakes shut and pitch the nose sharply down. Forbidding speedbrake use after the second failure removes the surface that would produce that transient. (Direct Law bans the speedbrakes for the same family of reasons.)

Ground handling after the PRIMs are gone — taxi is still possible, but not on the pedals. Per FCOM PRO-ABN-F/CTL:

In the case of all PRIM failure, the steering handwheel remains available to steer the aircraft during taxi.

The STATUS lists STRG PEDAL as INOP for a triple-PRIM failure, and the procedure adds AT LDG ROLL: DIFF BRAKING ... AS RQRD. After landing, then, do not reach for pedal steering: hold the runway with differential braking and taxi at low speed on the steering handwheel.

8. F/CTL ELEV REDUND LOST — the third-failure pre-warning

F/CTL ELEV REDUND LOST is a different kind of alert. It does not announce "this box failed"; it announces that you are already on a double failure and a third would be dangerous. Per FCOM PRO-ABN-F/CTL:

This alert triggers, in case of dual failure, when a subsequent third failure affecting the F/CTL system may lead to degraded pitch control or pitch mechanical backup. Some failure combinations lead to an aileron preset to limit the pitch up effect in case of this third failure. If this third failure occurs, the ELEV REDUND LOST PROC and associated FL and speed limitations no longer apply. In this case, if the MAN PITCH TRIM ONLY message is displayed, it is recommended that the autothrust be disconnected to improve longitudinal control of the aircraft.

This is the ECAM embodiment of the "three failures lose a surface" principle from EFCS Computer Architecture: at the double-failure stage it both pre-warns you and, in some combinations, pre-positions the protection (an aileron preset, below). The quantitative limits it carries — which the crew must apply immediately — are, for the preset case. Per FCOM PRO-ABN-F/CTL:

The autopilot is not available. SPD BRK ... DO NOT USE. MAX FL ... 350. MAX SPEED ... M0.80.

and the conditions under which the preset is removed:

In case of an engine-out, the aileron preset is cancelled, and the autopilot may be recovered. ... Below 2 000 ft RA, or when in CONF ≥ 2, the aileron preset is cancelled. The autopilot is available (provided, it is not lost due to another failure, such as an elevator failure).

Three things to take from this: the autopilot is unavailable while the ailerons are preset (with a preset, AP behaviour is sub-optimal and it disconnects automatically); the limits tighten to MAX FL 350 / MAX SPEED M0.80 (below Alternate's M0.82); and the preset is cancelled at engine-out (to recover the AP) and below 2 000 ft RA or in CONF ≥ 2 (to ease the landing manoeuvre). (When no aileron preset is required, a different STATUS applies, with the AP available and limits of MAX FL 300/MORA and MAX SPEED M0.75.)

The aileron preset — the most worthwhile mechanism in the chapter

The FCTM explains why a perfectly good aileron is deliberately lifted before anything has failed. Per FCTM PR-AEP-F/CTL:

When an aileron is failed ..., it goes to its zero hinge moment corresponding to around 14 ° up. This produces a loss of lift which creates a pitch up moment.

and the design response:

a 12 ° upwards aileron preset is anticipated (before the third failure) ... This 12 ° upwards aileron preset is a compromise between fuel consumption increase (around 16 %) and the pitch up effect at the time of the third failure.

with the payoff:

As the ailerons were previously preset upwards (12 ° up), the transient is smooth. Only a slight upward movement occur but is controllable through the THS.

Chain it together. A failed aileron floats to its zero-hinge-moment position, ~14° up, and 14° up means a sudden loss of lift and a hard nose-up pitch. The system's counter is to act early: while you are still only on a double failure, it lifts the good aileron to 12° up in advance. Then if the third failure does come and the aileron snaps to 14°, it travels only the last 2° — the pitch-up is small, smooth, and the elevators/THS can absorb it. The price is paid up front: holding 12° of aileron preset raises fuel consumption by ~16%. That is the engineering trade — fuel burn now in exchange for a survivable transient later.

The FCTM also states why the two limits exist. Per FCTM PR-AEP-F/CTL:

The speed limitation is introduced to cope with aircraft structure effort, should a third dimensioning failure occur. The FL limitation is introduced to maintain stabilizer authority, should a third dimensioning failure occur.

So the speed cap guards the airframe against the structural load at the moment of the third failure, and the altitude cap preserves enough THS authority to trim through it. Seeing ELEV REDUND LOST, the message is unambiguous: you are fragile, avoid introducing a third failure at all costs, accept the limits, and be ready for USE MAN PITCH TRIM. (The failed-aileron geometry is developed further in Ailerons.)

9. FCDC faults — losing the watcher, not the control

The FCDCs command no surface; they take data from the PRIMs and SECs and feed the displays and maintenance. A single FCDC fault is therefore pure awareness. Per FCOM PRO-ABN-F/CTL:

This alert triggers when there is failure of one FCDC.

Crew awareness.

The STATUS lists only FCDC 1(2) INOP; control and handling are untouched (detail in FCDC Data Concentrators).

Losing both FCDCs is more interesting, and it is a clean demonstration that the data layer and the control layer are independent. Per FCOM PRO-ABN-F/CTL:

This alert triggers when there is failure of both FCDCs.

The note that follows confirms the law is intact even though the indications are not:

Control law remains normal ... F/CTL warnings are not available on ECAM ... Stall warning is available ... Bank and pitch limits become amber on the PFD ...

so the crew is told to watch the source of truth directly:

MONITOR F/CTL OVHD PNL

and a single hard limit is added:

ABOVE FL 200: SPD BRK ... DO NOT USE

The takeaway: with both FCDCs lost you still have Normal Law and a flyable aircraft, but you lose the F/CTL ECAM warning channel — so you monitor the overhead panel for the real computer state, accept that the protection markings on the PFD have gone amber, and keep the speedbrakes stowed above FL 200.

10. Walking the gradient

A scenario speed-run that turns the static ladder into a sequence:

1. F/CTL PRIM 2 FAULT (single). PRIM 2 box goes amber on the F/CTL SD page (Controls and Indications). Reset PRIM 2 OFF THEN ON; glance at the pitch trim. Law almost certainly still Normal — continue.
2. F/CTL SEC 1 FAULT. SEC 1 OFF THEN ON; if unsuccessful, OFF. Note FUEL CONSUMPT INCRSD / FMS PRED UNRELIABLE and reach for the fuel-penalty correction instead of the raw FMS figure.
3. More PRIMs stack → F/CTL ALTN LAW. Fly the hard limits: MAX SPEED 330/.82, MAX FL by weight (e.g. 220 t → FL 330), CONF 3 landing (FLAP LVR 3), autoland down to CAT 2. Handling is more responsive — fly smoothly.
4. ALL PRIM → SEC Direct + RUD WITH CARE ABV 160 KT. Above 160 kt you are the rudder travel limiter — small inputs only; slats out on approach restores full authority. SPD BRK DO NOT USE (so a third PRIM loss cannot snap them shut and pitch you down); pedal steering is gone — use differential braking, then the steering handwheel. USE MAN PITCH TRIM for pitch (Direct Law).
5. F/CTL ELEV REDUND LOST (double-failure pre-warning). Recognise "one more failure and I lose pitch." Accept the FL/speed limits and the aileron preset, do everything to avoid a third failure, and have manual pitch trim ready.
6. F/CTL FCDC 1 FAULT. Indication/maintenance only; law and handling unchanged; crew awareness (FCDC Data Concentrators).

This is the same discipline as every abnormal: Is the indication real? Which layer degraded — control or actuation? What is lost and what remains? What does ECAM ask? What is the degraded handling profile?

Self-test

[!note]- Q1. F/CTL PRIM 1 FAULT appears in the cruise. What is the standard action, and why is it worth checking pitch trim afterwards?

Reset the affected PRIM OFF THEN ON; if unsuccessful, leave it OFF (FCOM points to QRH/ABN-02 for deeper troubleshooting). A single PRIM fault is usually a clean COM/MON self-retirement, the master role hands over, other computers cover the failed one's tasks (spoilers excepted), and the law stays Normal with unchanged handling. The pitch-trim check is airmanship rather than a quoted ECAM step: FCOM documents that a jerk may be felt on flight-control-computer reconfiguration, and because the PRIMs own the Normal-Law auto-trim, a PRIM cycling offline and back can momentarily leave the THS out of step — so confirm the trim before you trust the picture.

[!note]- Q2. How many PRIMs must fail to drop out of Normal Law, and what announces that the redundancy is nearly exhausted?

A single PRIM fault normally leaves you in Normal Law (another PRIM takes over). When only one PRIM can still process Normal Law (the other two degraded, not active, or not powered), a dedicated caution F/CTL LAWS REDUND LOST triggers; the action is PRIM 1+2(1+3)(2+3) OFF THEN ON to reset the pair that is no longer running normal. At that point the law is still Normal but the redundancy is spent — the next failure is the dangerous one. Actually entering Alternate or Direct Law needs more computers, or computers combined with key sensors or hydraulics, to fail.

[!note]- Q3. List the hard limits of F/CTL ALTN LAW, and state the one limit people wrongly expect it to carry.

MAX SPEED 330/.82 (FCOM: Speed is limited due to degraded high speed protection), MAX FL by weight (160 t → FL 415 … 240 t → FL 310), CONF 3 landing (FLAP LVR 3), and autoland reduced to CAT 2 with F/CTL PROT INOP. The trap: plain Alternate Law does not carry a blanket SPD BRK DO NOT USE — that ban belongs to Direct Law and to dual/all-PRIM failures (and Alternate only adds it under ELEC EMER CONFIG). And mind the speed: .82 is Alternate, .80 is Direct.

[!note]- Q4. After all PRIMs fail, why does the STATUS say RUD WITH CARE ABV 160 KT?

The rudder travel limit — which restricts maximum deflection at high speed to protect the fin — is normally computed by the PRIMs as a function of airspeed. With all three PRIMs lost, nothing schedules it any more, so the system freezes the limit at the value it held when the failure occurred. That frozen value cannot be guaranteed small enough for the current speed, so above 160 kt the crew must limit pedal inputs personally to avoid overstressing the structure. Extending the slats for approach restores full rudder authority, because at low speed full deflection no longer threatens the fin.

[!note]- Q5. How does F/CTL ELEV REDUND LOST differ from an ordinary PRIM FAULT, and what is the 12° aileron preset for?

PRIM FAULT reports a single box failing — resettable, law usually Normal. ELEV REDUND LOST reports that you are already on a double failure and a third could degrade pitch control or force pitch mechanical back-up — it is a pre-warning, not a single-box fault. A failed aileron floats to its zero-hinge-moment position (14° up), losing lift and pitching the nose up hard; so in some combinations the system presets the good aileron 12° up in advance, so that if the third failure snaps the aileron to 14° it moves only the last 2° and the transient is smooth and THS-controllable. The cost is **16%** more fuel burn, and the AP is unavailable while the preset is in.

[!note]- Q6. Both FCDCs fail. Have you lost control of the aircraft?

No. The FCDCs command no surface — they only acquire data from the PRIMs/SECs and feed the displays and maintenance. With both lost, control law remains Normal and the aircraft is fully flyable; what you lose is the F/CTL ECAM warning channel (warnings not available on ECAM, protection markings amber on the PFD). The procedure is to MONITOR F/CTL OVHD PNL for the real computer state and to keep SPD BRK DO NOT USE above FL 200. It is a loss of indication, not of control.

Key takeaways

References

Per FCOM PRO-ABN-F/CTL (computer-class alerts — F/CTL PRIM 1(2)(3) FAULT: trigger, OFF THEN ON reset, QRH/ABN-02 pointer, dual-PRIM SPD BRK ban and its third-failure pitch-down rationale, all-PRIM RUD WITH CARE ABV 160 KT with travel-limit freeze, steering handwheel/STRG PEDAL/differential braking on the ground; F/CTL SEC 1(2) FAULT: trigger, reset, FUEL CONSUMPT INCRSD / FMS PRED UNRELIABLE; F/CTL LAWS REDUND LOST: trigger and PRIM 1+2(1+3)(2+3) reset; F/CTL ALTN LAW: trigger, MAX SPEED 330/.82, degraded high-speed-protection rationale, MAX FL weight table, CONF 3 / FLAP LVR 3, ALTN LAW PROT LOST / CAT 2; F/CTL DIRECT LAW: trigger, USE MAN PITCH TRIM, automatic trim inoperative, MAX SPEED 330/.80, SPD BRK DO NOT USE; F/CTL ELEV REDUND LOST: trigger, AP not available, MAX FL 350 / MAX SPEED M0.80, preset-cancel conditions; F/CTL FCDC 1(2) FAULT and FCDC 1+2 FAULT: triggers, crew awareness, control law remains normal, F/CTL warnings not available on ECAM, MONITOR F/CTL OVHD PNL, above FL 200 SPD BRK DO NOT USE). Per FCOM DSC-27-20-20-10 (reconfiguration jerk on flight-control-computer switching). Per FCTM PR-AEP-F/CTL (ELEV REDUND LOST design philosophy — failed aileron to zero-hinge-moment ~14° up and resulting pitch-up, 12° upwards preset as a ~16% fuel-burn / transient compromise, smooth transient, speed limitation for airframe structural effort and FL limitation for stabiliser authority). Master logic and COM/MON self-retirement per EFCS Computer Architecture (FCOM DSC-27-10-10). The "verify pitch trim after a PRIM reset" guidance is integrative airmanship from the documented reconfiguration jerk plus the architecture (PRIMs own Normal-Law auto-trim), not a verbatim procedure step.

Independent study material, not an Airbus publication and not endorsed by the manufacturer. Always defer to the current operator FCOM, FCTM, and QRH for operational use.