Hydraulic System Monitoring Unit (HSMU)

The HSMU is the central integrating computer of the A330 hydraulic architecture. Every prior chapter has touched it from one angle — the 150-second fire-shut-off-valve sequence, the reservoir-temperature correction, the electric-pump automatic triggers, the RAT-deployment logic, the leak-measurement-valve inhibit. This article consolidates the view: what the HSMU monitors, what it controls, how it is powered, what its sensors look like, and what happens when it fails.

Per AMM 29-31:

The HSMU controls the local warning on overhead panel and sends data, through the SDACs for the display of warnings on the ECAM system... In addition the HSMU sends the status of the hydraulic system to the CMC.

The HSMU is not a hydraulic component. It carries no fluid; it is a computer wired into the hydraulic system through sensors, logic outputs to valves and pumps, and data-bus connections to the rest of the avionics suite (SDACs → ECAM, and CMC for maintenance reporting). When it fails, hydraulic fluid continues to flow under the engine-driven pumps; the automatic logic is what is lost.

1. What the HSMU monitors — four classes of input

Per AMM 29-31, the HSMU monitors four classes of system parameter, each with its own sensor type:

HSMU monitors four classes of input
   │
   ├─ ① Hydraulic Fluid Quantity (level)
   │     Sensors: capacitive transmitter 9JS1/2/3 (1–9 V analog)
   │              + low-level reed switch 10JS1/2/3 (discrete)
   │
   ├─ ② Hydraulic Temperature
   │     Sensors: platinum-resistance 2JS1/2/3 at reservoir return port
   │              + temperature switch inside each electric pump body
   │
   ├─ ③ Reservoir Air Pressurisation
   │     Sensors: pressure switch 1JS1/2/3 (1.5 / 1.7 bar relative hysteresis)
   │
   └─ ④ Hydraulic Fluid Pressure
         Sensors: pressure switch 7JS1/2/3 on HP manifold (100 / 120.5 bar hysteresis)
                  + pressure transducer 6JS1/2/3 on HP manifold (1 V @ 0 bar to 5 V @ 200 bar, linear)
                  + EDP-internal pressure switch (120 ± 5 bar trigger)
                  + ELEC-pump pressure switch (100 ± 5 / 120 bar hysteresis, 5JV/5JC/5JJ)

The four classes cover the operating state of each hydraulic system — how much fluid is in the reservoir, how hot it is, whether the cushion above it is intact, and whether the system is producing pressure. The HSMU integrates these inputs and decides what indications and automatic actions to produce.

2. What the HSMU controls — seven classes of output

The HSMU drives seven categories of output. Each was covered in detail in the relevant article; the consolidated view:

Each output is a deterministic function of the inputs — the HSMU applies pre-defined logic to the sensor signals and decides the resulting command. The crew sees the results (FAULT lights, ECAM cautions, automatic pump runs, RAT deployment) without seeing the logic; the article that documents each function explains the trigger conditions in detail.

3. Power supply — five paths of 28 V DC

Per AMM 29-31:

The HSMU is powered by +28VDC: - From the 28VDC BUS1 busbar 103PP through the HSMU B/Part G circuit breaker 6JG. - From the 28VDC BUS2 busbar 202PP through the HSMU Y/Part G circuit breaker 7JG. - In addition the HSMU receives the 28VDC from busbar 403PP through the HYD RAT EXT SOL 2 C/B 5JR. It is used for automatic extension of the RAT and automatic closure of the Green fire shut-off valves. - 601PP SERVICE BUS and 206PP 28VDC BUS2 are used for Yellow Electrical pump control and monitoring, and for cargo door operation.

The five power paths:

Three architectural points:

• B/Part + Y/Part internal split. The HSMU is internally divided into a Blue/Part and a Yellow/Part, each independently powered. There is no separate G/Part (Green); the Green system's monitoring and control functions are shared across both parts. Loss of either main power path (1 or 2) puts the HSMU into a partial-function state, not a total-failure state.

• Dedicated power for safety-critical automatic functions. Path 3 (busbar 403PP via C/B 5JR) is specifically reserved for RAT automatic extension and Green fire shut-off valve automatic closure. These are the functions the architecture absolutely cannot lose during a major hydraulic event, so they get their own power path — independent of the main BUS1 and BUS2 supplies.

• Separate supply for Yellow-side ground operations. Paths 4 and 5 (601PP SERVICE BUS and 206PP) supply the Yellow electric pump control and cargo-door operation circuits. The separation means a fault in the ground-operations side does not affect the in-flight monitoring functions, and vice versa.

   28 V DC BUS1 (103PP) ───► [C/B 6JG] ────► HSMU B/Part G    } Main redundancy
   28 V DC BUS2 (202PP) ───► [C/B 7JG] ────► HSMU Y/Part G    } (BUS1 and BUS2 both)
   
   Busbar 403PP         ───► [C/B 5JR] ────► HSMU             ◄ Safety-critical:
                                                                RAT auto + Green FSOV auto
   
   601PP SERVICE BUS    ────────────────────► HSMU            } Yellow ELEC PUMP +
   206PP 28 V DC BUS2   ────────────────────► HSMU            } cargo-door circuits

4. What happens when the HSMU fails

Per AMM 29-00:

In the event of a total computer failure, the three hydraulic systems are still available.

The hydraulic systems continue to operate without HSMU support because the fluid mechanics are independent of the HSMU:

• EDPs self-regulate. Each EDP has its own internal compensator valve that maintains 3000 psi output without HSMU involvement (see Engine-Driven Pumps).
• Priority valves are pilot-operated. The priority valve uses hydraulic pressure feedback to close when system pressure drops; it has no electrical interface. The HSMU does not control it (see Priority and Fire Shutoff).
• Fire shut-off valves accept direct ENG FIRE pushbutton commands. The ENG FIRE pushbutton wiring runs directly to the fire shut-off valve actuators; HSMU is not in the path. Crew-commanded valve closure works without HSMU support. (The HSMU automatic closure on Green reservoir low level is lost, but the manual path is intact.)
• Cockpit pushbuttons retain manual function. ELEC PUMP pushbuttons can be selected ON manually; pumps run whenever the relevant power and signal paths are intact. The HSMU's automatic trigger logic is lost, but manual override works.

What is lost when the HSMU fails:

The fundamental design principle: fail-functional. The architecture continues to provide hydraulic pressure to the consumers under HSMU failure; what degrades is the crew's awareness and the automatic protections. The pilot's workload increases — manual monitoring of pressures and quantities replaces the automatic ECAM cautions — but the aircraft can be flown to landing safely.

5. The sensors in detail

5.1 Capacitive fluid-quantity transmitter — 9JS1/2/3

Per AMM 29-31:

An analog system, based on capacitive transmitters, permanently monitors the level of fluid in each hydraulic reservoir. Each transmitter delivers a 1V to 9V voltage which varies linearly as a function of the quantity of fluid in the related reservoir. 0 gageable volume: 1V. Maximum gageable volume: 9V.

The capacitive transmitter is the primary continuous-reading sensor for reservoir level. Its construction:

• An inner metal tube is inserted inside an insulating tube.
• An outer metal tube surrounds the assembly.
• The hydraulic fluid enters the annular space between the inner and outer tubes.
• The HSMU supplies the transmitter with 15 V DC.
• An AC potential voltage is applied to the inner tube, with the outer tube as the electrical reference.
• The result is a capacitor whose effective dielectric height changes with the fluid level — fluid is conductive, air is not, so the capacitance varies linearly with the fluid column in the annular space.

The output is a 1–9 V analog signal sent to the HSMU:

• 1 V = zero gauge-able volume (reservoir empty)
• 9 V = maximum gauge-able volume (reservoir full)
• Linear between

Why capacitive sensing (rather than float or ultrasonic):

• No mechanical wear — the only moving part is the fluid itself; capacitive sensing has no internal parts that abrade or stick.
• Long calibration stability — the geometry is fixed; the dielectric properties of phosphate-ester fluid are well-characterised; drift over time is minimal.
• Linear response — easier for the HSMU to convert to a calibrated display value without compensation tables.

5.2 Low-level reed switch — 10JS1/2/3

Per AMM 29-31:

On each reservoir this equipment includes a reed switch controlled by a magnet located inside a metallic float which follows the hydraulic fluid level in the reservoir.

The low-level switch is the second sensor for reservoir level — providing a discrete (on/off) indication independent of the analog capacitive transmitter. Construction:

• A metallic float containing a permanent magnet rides on the fluid level inside the reservoir.
• A reed switch (a glass-encapsulated pair of contacts that close in the presence of a magnetic field) is mounted on the reservoir wall.
• As the float drops with the fluid level, the magnet eventually comes close enough to the reed switch to close its contacts.
• The closed-contact signal is sent to the HSMU as a discrete LO LEVEL signal.

The float carries a metal damping shroud to suppress reaction to small fluid oscillations — important because reservoir-mounted sensors otherwise respond to every flap or gear cycle.

Why two sensors for the same parameter?

The capacitive transmitter (9JS) provides the analog reading visible to the crew on the SD HYD page. The reed switch (10JS) provides an independent discrete trigger for the LO LEVEL caution. The architecture uses dual sensors with different physical principles so that a single sensor's failure does not deprive the crew of both the reading and the warning. If the capacitive sensor fails, the reed switch still trips the LO LEVEL caution; if the reed switch fails, the capacitive reading still shows the dropping fluid level. The two sensors are independent signal chains.

5.3 Reservoir pressure switch — 1JS1/2/3

Per AMM 29-31:

The reservoirs are normally pressurized to 4.5 bars absolute. On each reservoir, a pressure switch (1JS1, 1JS2, 1JS3) sends a discrete signal to the HSMU and the SDACs. - When the air pressure in the reservoir decreases to 1.5 bar + or - 0.1 bar relative the contact opens. - When the air pressure increases to 1.7 bar + or - 0.1 bar relative the contact closes, the FAULT legends go off.

This is the source of the LO AIR PRESS caution. Precise thresholds:

The 0.2 bar hysteresis is what prevents a marginally pressurised reservoir from flickering between "caution" and "normal" indications. Once triggered, the caution stays on until the cushion has recovered by a clear margin (200 mbar above the trigger).

For full architecture context (where the 4.5 bar comes from, what feeds the cushion), see Reservoir Pressurisation.

5.4 System pressure switch — 7JS1/2/3

Per AMM 29-31:

They are of the same type as the electric pump pressure switch... They are directly installed on the HP manifolds and set to: 100 + or - 5 bars, pressure decreasing 120.5 bars, pressure increasing.

This is the system-level pressure switch — installed on the high-pressure manifold of each system, not on any individual pump. Its 100/120.5 bar hysteresis is the trigger for system-level low-pressure cautions.

5.5 The three-tier pressure-switch architecture

The architecture has three distinct pressure-switch tiers, each producing a different ECAM caution:

The three tiers exist because each answers a different diagnostic question:

• Pump-tier switches say "this specific pump is not producing pressure" — useful for identifying which component to switch off or replace.
• System-tier switch says "the system manifold itself is not at pressure" — useful for assessing whether downstream consumers (flight controls, brakes) are at risk.

A single-pump failure on Green can trigger a pump-tier caution without triggering the system-tier caution, because the second Green EDP carries the manifold. Both tiers must independently sense low pressure for the system-level caution to appear. See Pump vs System Failure for the full distinction.

5.6 System pressure transducer — 6JS1/2/3

Per AMM 29-31:

The transducers are supplied with 28VDC. The output voltage varies linearly from 1VDC for 0 bar to 5VDC for 200 bars.

The pressure transducer (analog) sits on each HP manifold alongside the pressure switch (discrete). It provides the SD HYD page with a continuous pressure reading — distinct from the on/off threshold detection of the pressure switch.

Specifications:

Working examples for the voltage-to-pressure conversion:

At 0 bar       → V = 1 V    (system depressurised)
At 100 bar     → V = 3 V    (about 1450 psi)
At 150 bar     → V = 4 V    (RAT-supplied band)
At 200 bar     → V = 5 V    (approximately 3000 psi system pressure)

Per AMM 29-31:

It includes a diaphragm which is under hydraulic pressure. The diaphragm causes a sensing element to operate on the wheatstone bridge principle, according to the pressure applied.

The Wheatstone bridge is a standard precision-measurement circuit: four resistors arranged in a diamond, with the bridge "balanced" at a specific resistance ratio. The diaphragm under hydraulic pressure deforms a strain gauge element, changing its resistance and unbalancing the bridge. The voltage across the bridge output is proportional to the strain — and therefore to the pressure. The benefit: excellent temperature compensation (because the bridge's design cancels out resistance changes from temperature, leaving only those from strain), high sensitivity, and linear output across the operating range.

5.7 Sensor identifier summary

The complete sensor inventory monitored by the HSMU:

The HSMU receives all of these and produces the cockpit indications and automatic actions documented in §2. The sensor IDs are useful when reading maintenance logs (a "9JS2 fault" is a Blue reservoir capacitive transmitter; a "1JS1 fault" is the Green reservoir pressure switch).

6. Data flow from sensor to pilot

[Sensors: 9JS, 10JS, 1JS, 2JS, 6JS, 7JS, EDP-internal, ELEC-internal]
   │
   │  Analog (1–9 V or 1–5 V) or discrete signals
   ▼
[HSMU]
   │
   ├─ ① Internal logic processing
   │      (temperature correction, threshold comparisons, latching logic)
   │
   ├─ ② Local warning output
   │      → Overhead 29 panel FAULT lights
   │
   ├─ ③ ARINC 429 unidirectional data bus
   │      → CMC (Centralized Maintenance Computer)
   │      Used for fault recording and post-flight maintenance reporting
   │
   └─ ④ Analog and discrete outputs
          → SDACs (System Data Acquisition Concentrators)
          → DMCs (Display Management Computers)
          → ECAM HYD page + E/WD warning area

The architecture is clean: sensors feed the HSMU; the HSMU produces local warnings and forwards data through SDACs to the cockpit displays. The CMC connection is unidirectional from HSMU to CMC — the CMC receives fault histories but does not command the HSMU.

The SDAC/DMC chain is the ECAM display path; the HSMU does not drive the display directly. This separation means a DMC failure (which would lose the SD HYD page) does not affect the HSMU's automatic control functions — the FAULT lights and the pump/RAT/valve commands continue to operate even if the cockpit display goes blank. The pilot loses visibility but retains protection.

7. HSMU and the Centralized Maintenance Computer (CMC)

The HSMU sends status data to the CMC continuously during operation. The CMC uses this to:

• Build a real-time picture of the hydraulic system health.
• Record fault histories for post-flight analysis.
• Make these available to maintenance personnel through the CMC's interface terminals.

The link is unidirectional ARINC 429 (a standard avionics digital data bus). The HSMU broadcasts; the CMC listens. Specific data fields, bit allocations, and update rates are documented in maintenance literature but are not exposed to the crew.

On the ground, the CMC can also command the HSMU to perform BITE (Built-In Test Equipment) functions — for example, an overheat test that artificially triggers the OVHT signal path to verify the chain works end-to-end. These tests are part of scheduled maintenance and are not invoked from the cockpit.

8. The HSMU's role across the chapter

This article has consolidated the HSMU view from the previous chapter material. Each prior article touched the HSMU from a specific angle:

The HSMU is the node that connects all of these. The other articles describe components; this article describes the controller that integrates them.

9. What the HSMU does not do

Useful to fix the boundary:

• The HSMU does not carry fluid. No hydraulic line passes through it. It is a computer in an electronic equipment bay, wired to the system but not part of the fluid path.
• The HSMU does not generate pressure. Pressure comes from the EDPs and electric pumps. The HSMU controls whether the pumps run, not how they generate pressure.
• The HSMU does not provide flight-control authority. Flight-control surfaces are commanded by FCPC/FCSC (ATA 27) and powered by hydraulic actuators; the HSMU is upstream of all this in the architecture and does not interact with flight-control commands.
• The HSMU does not store the LO LEVEL threshold or other settings. These are baked into the sensor switches themselves (1JS, 7JS, etc., have fixed mechanical settings). The HSMU receives the discrete signal at the threshold; it does not set the threshold.

Self-test

[!note]- Q1. If the HSMU fails completely, what happens to the three hydraulic systems?

Per the maintenance documentation, the three hydraulic systems remain available. The fluid mechanics — EDP pressure regulation, priority-valve operation, fire-shut-off-valve manual command via the ENG FIRE pushbutton — all function independently of the HSMU. What is lost is the automatic logic and the cockpit monitoring: ECAM HYD page may degrade, electric pumps no longer trigger automatically, RAT will not auto-deploy, FAULT lights may not illuminate correctly, the Green fire shut-off valve automatic closure on RSVR LO LVL is gone. The aircraft is flyable, but the crew's workload increases significantly and many automatic protections are no longer available.

[!note]- Q2. The HSMU has five separate 28 V DC power paths. What is each for, and why doesn't a single failure stop the HSMU?

The five paths: (1) 28 V DC BUS1 via C/B 6JG for the HSMU B/Part, (2) 28 V DC BUS2 via C/B 7JG for the HSMU Y/Part — these are the two main supplies, each powering half of the internal HSMU; (3) busbar 403PP via C/B 5JR specifically reserved for RAT automatic extension and Green fire-shut-off-valve automatic closure — the safety-critical functions; (4) 601PP SERVICE BUS and (5) 206PP 28 V DC BUS2 for Yellow electric pump control and cargo-door operation. The architecture ensures redundancy at the main supply level (BUS1 and BUS2 both must fail to lose primary HSMU function), and the safety-critical automatic functions are powered separately so that even with both main supplies degraded, the RAT and Green FSOV automatic logic can still operate.

[!note]- Q3. Each reservoir has two level sensors — a capacitive transmitter (9JS) and a low-level reed switch (10JS). Why two sensors for the same parameter?

The two sensors use different physical principles, providing redundancy through diversity. The capacitive transmitter gives a continuous 1–9 V analog reading used for the SD HYD page indication. The reed switch (driven by a magnetic float) gives a discrete signal at the low-level threshold, independent of the capacitive sensor's calibration or function. If the capacitive transmitter fails (electronic fault, wiring problem), the reed switch still triggers the LO LEVEL caution at the right threshold. If the reed switch fails (stuck float, broken contact), the capacitive transmitter still shows the dropping fluid level on the SD page. The architecture intentionally avoids putting both functions on the same physical sensor.

[!note]- Q4. The reservoir air pressure switch (1JS) has 1.5 bar trigger and 1.7 bar recovery. Why is the recovery threshold higher than the trigger threshold?

Hysteresis design. A single threshold would cause the caution to oscillate ("flutter") when the cushion pressure is near the threshold — the reservoir cushion varies slightly with temperature, demand, and bleed conditions. With a single threshold at 1.5 bar, every small fluctuation around that point would alternately trigger and clear the caution, producing nuisance alerts. The 0.2 bar gap between trigger (1.5) and recovery (1.7) ensures that once the caution triggers, the cushion must recover by a clear margin before the caution clears. This produces a stable indication: either the system is healthy or the system has a real cushion problem, no flickering at the boundary.

[!note]- Q5. The architecture has three tiers of pressure switches: pump-tier (EDP and ELEC) and system-tier (7JS on HP manifold). Why three tiers, and what does each tier tell the crew?

The three tiers answer different diagnostic questions. Pump-tier switches (in each EDP and electric pump) detect whether that specific pump is producing pressure — useful for identifying which component has failed. System-tier switches (7JS on the HP manifold) detect whether the manifold as a whole is at pressure — useful for assessing whether downstream consumers (flight controls, brakes) can be expected to work. A single pump's failure on Green triggers a pump-tier caution but not a system-tier caution, because the other Green EDP carries the manifold. Only when both pumps' outputs are insufficient does the system-tier caution also trigger. The two tiers are independent signal chains; they produce different ECAM cautions and lead to different procedural responses. Mistaking a pump-tier caution for a system-tier loss would mean over-reacting to a recoverable single-pump failure.

[!note]- Q6. The pressure transducer (6JS) outputs 1 V at 0 bar and 5 V at 200 bar. What voltage corresponds to the normal system operating pressure of 3000 psi (≈ 206 bar)?

The transducer's calibrated range is 0 to 200 bar (1 V to 5 V linear). Normal operating pressure of 206 bar is slightly above the calibrated maximum — the transducer's output would saturate just above 5 V at this pressure. In practice, the architecture treats the operating range as 0 to ~200 bar; system pressure values above 200 bar are reported as the saturation value. The conversion within the range is straightforward: bar = (V − 1) × 50. For example, 100 bar = 3 V, 150 bar = 4 V. The HSMU uses this analog reading for the SD HYD page numeric pressure indication, alongside the discrete 7JS switches that handle threshold detection for cautions.

References

Per FCOM DSC-29-10-20 (HSMU role and seven functions); AMM 29-31 (HSMU description, sensor specifications 9JS/10JS/1JS/2JS/6JS/7JS, power supply five paths, B/Part and Y/Part internal split, data flow to SDACs and CMC, BITE test capability); AMM 29-00 (HSMU failure consequences — three hydraulic systems remain available). Cross-references to the dedicated articles on each component the HSMU controls.

Independent study material, not an Airbus publication. Refer to current operator FCOM, FCTM, AMM, and QRH for operational use.