FCMS — the Fuel Computers

Everything "smart" in the A330 fuel system — automatic transfers, CG control, automatic refuelling, quantity computation — is run by the Fuel Control and Monitoring System (FCMS), whose hardware is two computers: FCMC1 and FCMC2. This article is about the brain itself: how the two computers share the job, why each one contains two processors, what a power interruption costs at 100 ms versus 300 ms versus 6 seconds, and what is left when both computers die.

Three misconceptions to demolish up front: the two FCMCs do not vote — one commands, one watches. A double FCMC failure does not paralyse the fuel system — it reverts to manual control. And the FCMC does not remember the aircraft's weight — that figure belongs to the FMS side and must be re-sent after a long power-down.

1. Architecture — two computers, two lanes each

FCMC1 (5QM1) and FCMC2 (5QM2) sit side by side in the forward avionics bay rack.

                 ┌──────────────── FCMS ────────────────┐
                 │                                       │
  ┌──────────── FCMC1 ─────────────┐  ┌──── FCMC2 ─────┐
  │ ┌─ command CPU ┐ ┌─ monitor ──┐│  │ ┌─cmd─┐┌─mon─┐ │
  │ │ decides,     │ │ re-checks  ││  │ │ ... ││ ... │ │
  │ │ sends cmds   │ │ every output││  │ └──┬──┘└──┬──┘ │
  │ └──────┬───────┘ └─────┬──────┘│  └────┼──────┼────┘
  └────────┼───────────────┼───────┘       │      │
           │  ◄── ARINC Bus D (health exchange) ──►│
     discrete commands                 (slave sends none)
           ▼
     pumps / valves / transfers (one set of actuators,
     driven by whichever FCMC is master)

Two layers of redundancy:

• Between computers — both receive all sensor data and both compute, but only the master (normally FCMC1) sends discrete commands; the slave monitors.
• Inside each computer:

"The FCMC has two microprocessors. One microprocessor is used for the command function and the other microprocessor is used for the monitor function. The internal structure is separated into two computer lanes which let the different functions operate independently."

"The monitor CPU reads all of the output data sent by the command CPU... If the outputs are incorrect, the monitor CPU cancels the command CPU outputs. Control of the fuel system will then be moved to the other FCMC."

The monitor CPU is a live auditor: a bad output is cancelled on the spot and control changes hands.

2. Sensor sharing — drive half, read all

"Each FCMC sends condition signals and gives the interface electronics for: approximately half of the fuel quantity probes, approximately half of the fuel temperature probes, one densitometer... if a CPU failure occurs, there is no deterioration of fuel quantity data because each FCMC receives all of the probe data."

Each computer excites half the probes but reads all of them — drive shared, data common. The one exception:

"One densitometer supplies data to one FCMC. There is no direct connection from one densitometer to the opposite FCMC."

[!warning]- The dispatch table exposes what "drive half" really costs Some operators' MEL treats the two computers very differently: FCMC1 inoperative — no dispatch. FCMC2 inoperative — dispatch is allowed, but the trim-tank fuel temperature indication is considered inoperative and the FQI runs in degraded mode (last two digits underlined) for the whole flight. Losing a whole computer kills the excitation for its half of the measurement chain — which the shared reading cannot recover. (The AMM's "no deterioration" sentence refers to a single CPU-lane failure inside one computer, where data sharing does save the day — two different failure levels, not a contradiction.)

3. Changeover — a truth table picks the master

"The FCMCs send serviceability data to each other through the ARINC Bus D... This data uses a truth-table to make a decision as to which FCMC is the master and which FCMC is the slave... If a change in status is necessary, a changeover occurs. This will cause the discrete outputs of the previous master to be set to off and (if it is corrupted) the ARINC outputs to be flagged to off."

Normally FCMC1 holds the keys; the healthier computer wins; and a deposed master exits cleanly — discretes off, corrupted data flagged — so two computers never command at once.

4. Power-down logic — what an interruption costs

"If the power-down is more than 220 milliseconds, the FCMC will do a cold-start procedure... the FCMC cannot get back the values of GW (gross weight) and CG (center of gravity). These values must be transmitted again from the FMGEC."

Why can't the FCMC remember the weight? Because GW/CG are not its own data — the FMGEC computes them from the crew-entered ZFW/ZFCG and feeds the result to the FCMC. The fuel computer is a user of the weight, not its source; lose it, and you go back to the source. That is the systems background to "why am I being asked to re-check the ZFW entry after a big electrical reconfiguration."

The ZFW/ZFCG delivery path has its own dispatch ladder in some operators' MEL: one FMGEC-to-FCMC link down — fine, the other FMGEC feeds both computers; both links down — dispatch with a manual forward transfer to be initiated at the start of cruise (don't park fuel aft you cannot manage), or with the trim tank empty/its contents treated as unusable and counted in the ZFW. No weight data, no aft-CG management — the MEL simply buys out the fuel-saving function in advance.

5. What the FCMS manages — and the CG rhythm

The FCOM's pilot-level summary:

"The FCMCs: ‐ Measure the fuel quantity and indicate it on the ECAM. ‐ Calculate the aircraft's Gross Weight and Center of gravity, based on the Zero Fuel Weight and the CG entered by the crew. ‐ Control transfer of fuel to the inner tanks for engine feed. ‐ Control transfers of fuel to and from the trim tank for CG control."

Plus, per the AMM list: water scavenge, automatic refuelling with high-level protection, fault reporting to the central maintenance system, data services to other computers — and on jettison-equipped aircraft, stopping a jettison.

One counter-intuitive rhythm worth installing early:

"Usually only one aft-transfer is made during each flight. But (while the fuel burns) many small forward-transfers are made to control the CG."

Aft transfer is a one-shot delivery to the tail; forward transfer is a drip-feed home. The CG articles build on this.

Valve letter codes

The FCMS commands its valves under letter codes used throughout the manuals (and this chapter):

6. How the FCMC talks to you — the colour code

"These quantities are shown with green figures. If the accuracy is degraded the FCMC causes the last two digits to change to amber horizontal dashes. If there is a fuel imbalance the display flashes. The display shows 'XX' when there is no valid data."

[!warning]- Amber dashes are not "no data" Dashes mean degraded but alive; XX means dead. The distinction drives different CG-control consequences (target moved forward 1.5 % vs CG control stopped), covered in the transfer articles.

7. Failure and reversion

"FCMC 1+2 FAULT — The ECAM shows this warning when no data is received from the FCMS. The fuel system is then manually controlled."

• Single FCMC failure: changeover, function essentially preserved — but see the dispatch asymmetry in Section 2.
• Double failure: the system reverts to manual control through the overhead override pushbuttons (OUTR TK XFR, CTR TANK XFR, T TANK MODE, T TANK FEED, X FEED). The pumps and valves are all alive; what died was the scheduling. The full "human FCMC timetable" is in FCMC and inerting faults.

Self-test

[!note]- Q1. Do the two FCMCs vote? No. A truth table over ARINC Bus D health data appoints one master (normally FCMC1) that alone sends discrete commands; the other monitors. Inside each computer a monitor CPU audits the command CPU and can cancel its outputs.

[!note]- Q2. After a 300 ms power interruption, what must happen before CG control is whole again? A cold start occurs and GW/CG are lost internally — the FMGEC must re-transmit them (the FCMC is a user, not the source, of weight data).

[!note]- Q3. Why is dispatch with FCMC2 failed allowed but not with FCMC1 failed? The master channel gets zero tolerance. FCMC2's loss is dispatchable but takes its excitation half with it: trim-tank temperature indication is lost and FQI runs degraded (underlined last digits) — visible, bounded penalties.

[!note]- Q4. Both FCMCs are dead. What still works? Everything mechanical and hard-wired: pumps, valves, the overhead override buttons, and the LP-valve cut-offs (which never depended on the FCMS). The crew schedules transfers manually.

[!note]- Q5. Amber dashes versus XX on the FUEL page? Dashes = degraded accuracy, still computing; XX = no valid data. Different downstream effects on CG control.

Key takeaways

References

• AMM 28-51-00 Description and Operation (architecture, lanes, changeover, power-down, sensor allocation, FUEL-page colour logic, valve codes).
• FCOM DSC-28-10-30 (pilot-level function list).
• Some operators' MEL, FCMS section (dispatch asymmetry; ZFW/ZFCG link ladder).
• Interpretive framing (failure-level distinction in Section 2) is integrative synthesis.

Independent study material, not an Airbus publication and not endorsed by the manufacturer. Always defer to the current operator FCOM, FCTM, and QRH for operational use.