ECB — Control and Monitoring

Every previous article in this chapter keeps naming the same box. The Inlet Guide Vanes are positioned by it; the surge control valve is scheduled by it; fuel is metered by it; the start sequence is orchestrated by it; the ignition window is timed by it; the protective limits are guarded by it. That box is the Electronic Control Box (ECB) 59KD — a Full Authority Digital Electronic Control unit that is, in effect, the APU's FADEC. This article opens the box on its own: what it controls, how it controls it, what it runs on, and — most importantly — its single most consequential design choice: when the ECB will keep a sick APU running rather than shut it down.

This article covers the ECB hardware and its location, the full extent of its authority and why the crew cannot trim it, constant-speed governing, the four-feed power supply with internal voltage monitoring, the three-versus-thirteen shutdown philosophy with the exact protective thresholds behind it, the normal-shutdown cooldown sequence and its altitude rule, and the life-data architecture. The pilot-visible automatic-shutdown condition table (ground versus air) is developed in Automatic Shutdown, and the three emergency-shutdown triggers in Emergency Shutdown; here we deal with the underlying mechanism.

1. What the ECB is, and what "full authority" means

The ECB is a single digital controller that owns the APU end to end. The AMM states its role and internal split plainly:

"A Full Authority Digital Electronic Control system is contained in the ECB 59KD. The ECB 59KD provides control for the operation and monitoring of the Auxiliary Power Unit (APU). It also provides the communication to the aircraft other systems. The ECB 59KD has two Onboard Replaceable Modules (OBRMs) which contain the software, one for the control and monitoring and one for the communications. The ECB gives: - the control for the automatic operation of the APU, - the control for the APU at a constant speed, - the protection of the APU if a failure or an overload occurs, - the supply of pneumatic and shaft power, - the monitoring of the Line Replaceable Units (LRUs), - the tests on the APU system."

The FCOM gives the same idea in operating-manual shorthand:

"The Electronic Control Box (ECB) is primarily a full authority digital electronic controller that performs the APU system logic for all modes of APU operation such as : ‐ Sequence the start and monitors it ‐ Monitors speed and temperature ‐ Monitors bleed air (IGV) ‐ Sequence the shut down (manual, protective or inhibited)"

Two structural facts to anchor here. First, the two OBRMs are functionally split: one carries the control-and-monitoring software, the other carries the communications software. The split lets each module be loaded and replaced without disturbing the other. Second, the ECB itself is a microprocessor machine:

"The ECB is a microprocessor-based digital electronic controller that does the primary part of the APU system logic."

References: AMM D/O 49-61-00 (ECB general description, two OBRMs, microprocessor); FCOM DSC-49-10-20 (ECB functional summary).

2. Where the ECB sits, and the I/O architecture

The ECB lives in an avionics rack, not in the APU bay. Placing the brain in a cool pressurised compartment, well clear of the hot tailcone fire zone, is the sensible layout. The AMM control-and-monitoring section gives the location and the authority span in one passage:

"The ECB is installed adjacent to the BULK cargo compartment on the right side, between FR71 and FR72. It is held in an ARINC 600-6 mounting rack. The ECB provides full authority digital APU control from the start initialization, during the acceleration, at the governor speed to the shutdown. The ECB monitors the APU speed, the APU temperatures, the load compressor air flow, and other critical parameters based on signal inputs from the accessory sensors and the control switches."

The engine-controls overview adds that the compartment is pressurised:

"The main part of the power control system is the Electrical Control Box (ECB), a full authority electronic control. It monitors the APU, controls its performance and gives self protection. The ECB is installed behind a rack in the RH sidewall panel in the BULK cargo compartment. The compartment is pressurized."

[!warning]- The manual disagrees with itself on which sidewall — and it does not matter to the crew The two ECB-specific sections (AMM 49-60-00 and 49-61-00) place the box on the right (RH) sidewall, between FR71 and FR72. The system-overview section (AMM 49-00-00) instead says the ECB is "installed in a rack behind the LH sidewall panel in the BULK cargo compartment." This is an internal AMM inconsistency, not a configuration difference. For pilot purposes the load-bearing facts are the ones both agree on: the ECB is in a rack behind a BULK cargo-compartment sidewall panel, and the compartment is pressurised. Treat the exact side as a maintenance-floor detail; confirm it on the airframe if you ever need to.

The I/O panorama

The value of a full-authority controller is that everything converges on it. The AMM describes the electrical interface as analog, discrete and digital, conditioned and converted inside the box:

"The electrical interfaces between the APU and the ECB and between the ECB and the aircraft other systems are analog, discrete or digital signals. The ECB controls all the input and output signals from the aircraft and the APU. An analog-to-digital converter and frequency-to-digital converter are used to convert analog inputs to digital words. The outputs to the torque motors go through the digital-to-analog converters. Solenoids and indicators are energized through discrete drivers. The ECB sends signals to and receives signals from the aircraft other systems through the ARINC 429 bus."

"All signals are filtered by lightning strike protection and Electro-Magnetic Interference (EMI) filters."

Drawn out from the AMM input/output tables, the picture is one box with three input families and three output paths:

            ECB 59KD — input/output panorama (AMM D/O 49-61-00, §5 Interface)

  CREW INTENTS (discrete)            ┌───────────────────────────┐    CONTINUOUS OUTPUTS
  MASTER SW 14KD  ──start/stop────►  │                           │ ──► FCU torque motor (fuel flow)
  START pb 2KA    ──start cmd─────►  │        ECB 59KD           │ ──► IGV torque motor (bleed demand)
  APU BLEED 7HV   ──bleed activate►  │  ARINC 600-6 rack, behind │ ──► SCV torque motor (surge ctl)
  EMER stop       ──emer stop─────►  │  BULK cargo sidewall      │      (3 separate torque-motor
                                     │  (pressurised compartment)│       currents — analog)
  A/C DEMANDS (ARINC 429/discrete)   │                           │
  ECS demand (630HK) ────────────►   │  OBRM-1: control+monitor  │    DISCRETE OUTPUTS (solenoids/
  MES (from EIVMU)   ────────────►   │  OBRM-2: communications   │    contactors/indicators)
  GCU                ────────────►   │                           │ ──► start contactor
  ground/air, wing-ice cmd ──────►   │  A/D + freq-to-digital    │ ──► ignition exciter
                                     │  → CPU → D/A → torque mtr │ ──► FCU fuel solenoid
  APU SENSORS (analog/discrete)      │  discrete drivers → sol.  │ ──► de-oil / ecology-drain sol.
  2x speed sensor / 2x EGT rake /    │  lightning + EMI filters  │ ──► bleed valve solenoid
  LC inlet temp / LC outlet temp /   │                           │ ──► air intake flap actuator
  inlet+total+delta pressure /       │  4x 28 V DC feeds +        │ ──► A/C relay
  oil temp (low/high/GEN) / fuel     │  internal voltage monitor │
  temp / fuel flowmeter / IGV LVDT / │                           │    ARINC 429 TO AIRCRAFT
  SCV LVDT / oil-press switch /      │  memory module (life data │ ──► AVAIL / FAULT
  fuel-press switch / oil-qty sw /   │   stored in parallel)     │ ──► CMC / ECAM / ACMS
  chip detector / oil-filter sw ──►  └───────────────────────────┘

Three things this layout makes explicit. (1) Every signal — the three crew pushbuttons, the aircraft demands (ECS, MES, GCU), and the full set of APU sensors — arrives at this one box. (2) The ECB answers with three kinds of output: continuous torque-motor currents for the three modulated effectors (fuel, IGV, SCV), discrete driver outputs to switch contactors, solenoids and indicators, and ARINC 429 traffic to talk to the aeroplane. (3) The two OBRMs divide the job — control/monitoring on one, communications on the other.

References: AMM D/O 49-61-00 (ECB location, full-authority span, I/O signal families, A/D and D/A conversion, lightning/EMI filtering); AMM D/O 49-60-00 (power-control system, pressurised BULK compartment); AMM D/O 49-00-00 (system overview — sidewall-side inconsistency noted above).

3. The scope of authority — and why the crew cannot trim it

"Full authority" means the ECB computes and commands every APU action from power-up to spin-down. The crew supply only three intents — MASTER, START, and APU BLEED (see APU Overview). Everything downstream is the ECB's:

"These data are used for the calculation and to continuously control: - the fuel flow, - the IGV position, - the surge control valve butterfly plate position. The ECB also controls the subsequent systems: - the starter motor, - the igniters, - the fuel control shutoff valve, - the air intake flap."

"The subsequent LRUs are controlled by separate torque motor currents: - the fuel control assembly, - the IGV actuator, - the surge control valve."

So the three modulated quantities — fuel flow, IGV position, and SCV butterfly position — are each driven by an independent torque-motor current, while the on/off effectors (starter, igniters, fuel shutoff, air intake flap) are switched through discrete drivers.

Can the crew intervene? No. How much fuel, how far the IGVs open, when ignition fires, what the protective limits are — all of that is internal ECB logic with no manual trim. The only crew "reset" is the one the FCOM names:

"Note: Switching the MASTER SW off then ON, resets the ECB."

[!warning]- The most "advanced" thing a pilot can do to a misbehaving ECB is reboot it Faced with abnormal (non-fire, non-emergency) APU behaviour, the crew's single high-level action is MASTER OFF then ON to reset the ECB — the equivalent of power-cycling the brain. There is no manual fuel adjustment, no manual IGV positioning, no protective-limit override. Anything beyond the reset belongs to the ECB.

References: AMM D/O 49-61-00 (full-authority span, three torque-motor effectors, discrete-driven systems); FCOM DSC-49-20 (MASTER SW reset note).

4. Constant-speed governing

The APU is a constant-speed machine (see Power Section). What pins it at 100 % N is the ECB's governor function, which takes over near the top of the start:

"At 95 % speed the ECB: - sends an on command to the governed APU speed control, - at the START P/BSW 2KA the ON legend goes off, - at the START P/BSW 2KA the AVAIL legend comes on."

Once the start accelerates through 95 %, the governor takes the loop. Reading the two speed sensors, it trims fuel against load: when load rises and speed tends to droop, it adds fuel; when load drops and speed tends to overshoot, it cuts fuel — holding N at 100 %. This is the control-loop root of the rule developed in Power Section: because N is held fixed, a change in load shows up in fuel flow (hence EGT) and in IGV/SCV position — not in N. Bleed demand reaches the governor through one of two modes:

"The zone temperature controller 630HK sends the ECS demand through the ARINC bus to the ECB. ... This sets the IGV position in proportion to the ECS demand signal."

"The MES mode operates when an MES signal from an Engine Interface and Vibration Monitoring Unit (EIVMU) is available and the APU BLEED P/BSW is pushed to the ON position. This sets the IGV position in a fixed position in proportion to the inlet temperature, or 0 deg. if the A/C is in flight."

In ECS mode the IGV opening tracks the ECS demand; in MES mode the IGVs sit at a fixed position set by inlet temperature — or fully closed (0°) if the aircraft is airborne.

References: AMM D/O 49-61-00 (governed-speed command at 95 %, ECS and MES IGV scheduling).

5. Power supply — four feeds and internal voltage monitoring

For a full-authority controller, losing power means losing control of the APU. The supply is therefore quad-fed, and the ECB watches its own rails:

"The ECB gets the electrical power from the DC network of the aircraft. It is supplied with 28 V DC from: - the 709PP APU HOT BUS through the C/B 58KD, - the 401PP ESS BUS through the C/B 35KD, - the 309PP APU BAT BUS through the C/B 1KD, - the 909PP APU TRU BUS through the C/B 3KD. The ECB continuously monitors its internal voltages and starts a shutdown if a voltage failure occurs."

The four feeds — including the APU HOT BUS and the APU BAT BUS — keep the ECB alive even when the main aircraft network is degraded. That redundancy is essential to the APU's emergency-power role (see APU Overview): the APU must be startable and runnable precisely when the aeroplane has lost normal sources, so its controller cannot depend on the main network alone. At the same time the ECB monitors its own internal voltages and commands a shutdown on a voltage failure — the brain stops the engine safely before it loses control of it, rather than running on while it browns out.

References: AMM D/O 49-61-00 (four 28 V DC feeds, internal voltage monitoring leading to shutdown).

6. The shutdown philosophy — three always-active, thirteen inhibited in flight

This is the ECB's deepest design decision and the one a pilot should understand best. There are three families of shutdown:

"There are three possible shutdowns: - the normal shutdown, - the automatic shutdown (if it is not inhibited), - the emergency shutdown."

The automatic-shutdown family is not a flat list of equals. It splits into protections that always fire and protections that are deliberately suppressed in flight.

Always active — three red lines. These run with no cooldown and no self-test:

"An automatic shutdown is always started from the subsequent shutdown logics: - the overspeed shutdown, - the ECB 1A shutdown, - the emergency shutdown. If the ECB receives one of these shutdown commands, the ECB starts an APU shutdown without a cooldown cycle and without a BITE check."

Inhibited in flight or with engines running — thirteen protections. These are switched off across the running phase:

"The subsequent shutdowns are inhibited (when the aircraft is in flight or on ground) between the 1st main engine start and the last main engine shut down and if the APU speed is above 95 %: - the underspeed shutdown, - the no acceleration shutdown, - the low oil pressure shutdown, - the air intake flap not open shutdown, - the load compressor overtemperature shutdown, - the high oil temperature shutdown, - the generator high oil temperature shutdown, - the ECB 1B shutdown, - the main power interrupt shutdown, - the overtemperature shutdown, - the clogged oil filter shutdown, - the no flame shutdown, - the sensor failure shutdown."

Why suppress thirteen protections in flight? Because when the APU is the lifeline — supplying electrical power in the air, or driving a main-engine start — letting it shut itself down for a non-catastrophic fault is more dangerous than letting it soldier on. Picture a dual-engine-failure case running on the APU when the oil temperature climbs high: if the high-oil-temperature protection fired, the aeroplane would lose its remaining power source. The ECB's choice is the opposite — let the oil run hot and keep the APU alive. The condition has to be active (between the first engine start and the last engine shutdown, with APU speed above 95 %) for the inhibit to apply.

But three red lines are never relaxed, because each corresponds to something that immediately threatens the aircraft or the APU's integrity:

• Overspeed (N above 107 %) — rotor centrifugal stress beyond limit, with a burst risk (see the hub-containment discussion in Power Section); stop now.
• ECB 1A shutdown — the ECB's own control-monitoring channel has failed; if the brain is unreliable, the APU must not be left running under it.
• Emergency shutdown — fire or manual emergency action (see Emergency Shutdown); life-safety overrides everything.

[!warning]- "Any APU fault triggers a protective shutdown" — false in flight A common belief is that any APU fault will protect itself by shutting down. In flight, or between the first and last main-engine start with APU speed above 95 %, thirteen protective shutdowns are deliberately inhibited and the APU will keep running on a fault. Only overspeed, ECB 1A, and emergency force a stop. It is only on the ground with no engines running — when the APU is not the lifeline and can afford to be fussy — that nearly every fault shuts it down. That ground-versus-air split is exactly the pilot-visible table in Automatic Shutdown; the inhibit logic here is the mechanism behind it.

One-line summary of the philosophy: when the APU is a lifeline, availability outranks self-protection — only the three failures that can burst, lose control, or burn force a stop; everything else is tolerated.

References: AMM D/O 49-61-00 (three shutdown families; always-active set with no cooldown/no BITE; inhibit conditions and the thirteen inhibited shutdowns).

7. The protective-shutdown thresholds

Knowing "three red lines versus thirteen inhibited" is not enough at instructor level — you should be able to state the exact trigger for each protection. AMM 49-61-00 §6.D (APU Protective Shutdowns) lists them. These are the numbers behind the pilot-visible table in Automatic Shutdown:

Two things to draw out of this table.

*First, the overspeed red line is "N above 107 % and held for 0.02 seconds."* That 0.02 s is a debounce — it confirms the event against a transient spike before acting — but once confirmed it stops the APU with no cooldown, to keep the rotor below burst (see Power Section).

Second, the overtemperature logic uses two temperatures, and it watches T4, not EGT — T4 above 1260 °C during start, T4 above 1232.23 °C while running. This T4 is the ECB's calculated Turbine Inlet Temperature (TIT), not the EGT you read on ECAM. The thermocouple rakes measure exhaust gas temperature; the ECB computes TIT from it:

"Turbine Inlet Temperature (TIT) Logic This logics calculates the turbine inlet temperature which is used for the inlet guide vane position control and the speed controls."

That is why the ECAM EGT redline behaves as a proxy: the true limit the ECB enforces is on the calculated TIT. The pilot-visible classification of these thresholds (which fault stops on the ground, which in the air) and the ECAM handling are developed in Automatic Shutdown and Indicating; this article supplies the mechanism and the numbers.

[!note]- Note: §6.D enumerates one more inhibited protection than the §3.D list The §3.D headline names thirteen inhibited shutdowns. The detailed §6.D enumeration both splits the "start-aborted" shutdown into its sub-cases (no acceleration #1/#2, overtemperature during start, no flame, sensor fail) and adds oil chip detection to the inhibited set. The two passages are consistent in spirit; the table above follows the §6.D values, which is why oil chip detection appears as inhibited here.

References: AMM D/O 49-61-00 §6.D (all protective-shutdown thresholds verbatim); AMM D/O 49-61-00 §6.C (TIT logic — calculated turbine inlet temperature).

8. The normal shutdown sequence — 85 s cooldown and the altitude rule

The ECB's normal-shutdown logic resolves a discrepancy noted in Fuel and Control — the FCOM's "85 s if bleed was used" against a coarser "100 s" elsewhere. The control section gives the authoritative sequence:

"With the MASTER SW set to off, the ECB provides a time slot of 15 seconds to allow a No Break Power Transfer (NBPT) between the APU electrical generator and other active electrical power sources (engine/external power). After this NBPT period the field excitation of the APU generator is de-energized and the ECB starts a low speed cooldown period of 85 seconds, whether bleed was selected or not, and the altitude is not higher than 23000 ft. (7010.27 m). In this period the APU decelerates at 1%/sec to 84 % speed and then deceleration is reduced with 0.5%/sec to 82 % speed. In the remaining 65 seconds the APU stays on 82 % speed. If the altitude is higher than 23000 ft. (7010.27 m) the normal cooldown period is set to zero (0) seconds after 15 sec (NBPT) and the APU decelerates from 100 % down to 0 % continuously."

Resolving the layers:

• The authoritative value is a 15 s NBPT followed by an 85 s low-speed cooldown — whether or not bleed was selected — provided the altitude is 23000 ft or below. The 15 s + 85 s ≈ the "100 s" total quoted in coarser form elsewhere; both describe the same thing.
• The FCOM's "If the APU BLEED was selected, the APU performs a cooling period of 85 s at 82 % speed" is the crew-level simplification. The difference from the ECB description (85 s regardless of bleed) is one of depth, not contradiction: the FCOM hands the crew an easy mnemonic, the ECB runs the real logic.
• Above 23000 ft the cooldown is zero — after the 15 s NBPT the APU runs straight down from 100 % to 0 %. At high altitude the thin air makes a low-speed cooldown pointless, so it is skipped. This is the high-altitude shutdown behaviour not covered in Fuel and Control, filled in here.

The remaining shutdown actions (which interlock with the ecology drain and the oil system) follow the same passage: after the cooldown the ECB tests the overspeed-protection circuit and the APU enters the shutdown state, with the AVAIL legend going off at 95 % speed; during shutdown the ECB activates the ecology drain solenoid and de-energises the FCU fuel solenoid, and the de-oiling valve opens; at 7 % APU speed it de-energises the FWD fuel feed pump, the de-oiling valve, the ecology drain solenoid, the aircraft APU fuel valves, the APU fuel feed pump(s) and the air intake flap; once the flap is fully closed it de-energises the A/C relay.

References: AMM D/O 49-61-00 (normal-shutdown sequence — NBPT, 85 s cooldown, altitude rule, 7 % de-energisation set, A/C relay); FCOM DSC-49-20 (crew-level "85 s if bleed selected" cooling note).

9. Life-data and the memory module

The ECB also keeps the APU's health record, and it does so redundantly:

"The ECB keeps the life time data of the APU. The memory module also keeps the APU life time data in parallel with the ECB. When the memory module fails, the ECB continues to store the data. When you install the new memory module, the ECB transmits all life data to the memory module. When you install a new ECB, the memory module transmits the memory data to the ECB. The APU life time data contains: - the APU serial number, - the APU operating hours, - the APU starts, - the number of unsuccessful starts, - the number of hot starts, - the turbine life consumed."

The design point is the parallel store: the ECB and the memory module each hold a copy. Replace the ECB and the memory module reloads the new box; replace the memory module and the ECB reloads it — so the life data is never lost when a unit is swapped. The unsuccessful-start count, the hot-start count and the turbine life consumed are the parameters maintenance uses to judge APU health over time.

References: AMM D/O 49-61-00 (life-time data content; ECB/memory-module parallel storage and cross-loading).

10. Crew-facing scenarios

• Single sensor faults on the ground, no engines running. With the APU not acting as a lifeline, most faults will trigger a protective shutdown; the crew gets an APU FAULT indication and works the procedure (see Automatic Shutdown).
• Dual-engine failure, APU supplying power, oil temperature high. In flight above 95 %, the high-oil-temperature shutdown is inhibited; the APU keeps running on the fault — availability first. Watch only for the three red lines (§6).
• Overspeed in flight, N at or above 107 %. Red line — immediate shutdown, no cooldown, to keep the rotor below burst. Never inhibited.
• Abnormal APU behaviour (not fire, not emergency). Cycle MASTER OFF then ON to reset the ECB; leave the rest to the box. There is no manual fuel/IGV trim.
• Shutdown above 23000 ft. No 85 s low-speed cooldown — the APU runs straight down from 100 % after the NBPT. The 85 s at 82 % only applies at or below 23000 ft.
• Main network degraded but the APU is needed. The four ECB feeds (including the HOT BUS and the BAT BUS) keep the brain alive; the ECB also watches its own voltage and shuts down safely before it browns out.

Self-test

[!note]- Q1. Where is the ECB, what do the two OBRMs do, and how far does "full authority" reach?

It sits in an ARINC 600-6 rack behind a BULK cargo-compartment sidewall panel — a cool, pressurised space well clear of the tailcone fire zone (the two ECB-specific AMM sections say the right/RH side, FR71–FR72; the overview section says LH — an internal inconsistency that does not matter to the crew). The two OBRMs split the software: one control-and-monitoring, one communications. "Full authority" means the ECB computes and commands everything from start initialisation through acceleration, governed speed and shutdown — fuel flow, IGV and SCV via three separate torque-motor currents, plus the starter, igniters, fuel shutoff valve and air intake flap. The crew cannot trim any of it; the only high-level action is MASTER OFF then ON to reset the ECB.

[!note]- Q2. How does the ECB hold the APU at constant speed, and how does that connect to "read EGT, not N, for load"?

At 95 % the ECB sends the on-command to the governed-speed control. Reading the two speed sensors, the governor trims fuel against load — more fuel when load droops the speed, less when load overshoots it — holding N at 100 %. Because N is pinned, a change in load shows up in fuel flow (hence EGT) and in IGV/SCV position rather than in N. That is the control-loop reason the APU's load is read on EGT and bleed indications, not on N.

[!note]- Q3. Why four power feeds, and what does the ECB do if its own supply fails?

Four 28 V DC feeds — APU HOT BUS, ESS BUS, APU BAT BUS, APU TRU BUS — so the controller stays alive even when the main network is degraded, which is essential when the APU is the emergency power source. The ECB continuously monitors its own internal voltages and commands a shutdown on a voltage failure, stopping the APU safely before it loses control of it.

[!note]- Q4. (core) Name the three shutdown families, the three protections that always fire, and why thirteen are inhibited in flight.

The three families: normal, automatic (inhibitable), and emergency. Three red lines always fire, with no cooldown and no BITE check: overspeed (N above 107 % for 0.02 s), ECB 1A (control-monitoring microprocessor failure), and emergency (fire/manual). Thirteen protections are inhibited between the first and last main-engine start with APU speed above 95 %: underspeed, no acceleration, low oil pressure, air-intake-flap-not-open, load-compressor overtemperature, high oil temperature, generator high oil temperature, ECB 1B, main power interrupt, overtemperature, clogged oil filter, no flame, and sensor failure. The philosophy: when the APU is a lifeline, availability outranks self-protection — only failures that can burst the rotor, lose control of the engine, or signal fire force a stop.

[!note]- Q5. How long is the normal cooldown, and how does the 23000 ft rule change it?

At or below 23000 ft: a 15 s NBPT followed by an 85 s low-speed cooldown, whether or not bleed was selected — 1 %/s to 84 %, then 0.5 %/s to 82 %, then 82 % held for the remaining 65 s. Above 23000 ft: zero cooldown after the 15 s NBPT — the APU runs continuously from 100 % to 0 %. The FCOM's "85 s if APU BLEED was selected" is a crew-level simplification; the ECB description (85 s regardless of bleed) is the real logic, and the two differ only in depth. The 15 s + 85 s also reconciles with the coarser "100 s" quoted elsewhere.

Key takeaways

References

Per AMM D/O 49-61-00 (ECB general description and two OBRMs; ECB location and ARINC 600-6 rack; full-authority span; three torque-motor effectors and discrete-driven systems; I/O signal families with A/D, D/A and frequency conversion plus lightning/EMI filtering; constant-speed governing at 95 %; ECS and MES IGV scheduling; four 28 V DC feeds and internal voltage monitoring; three shutdown families; always-active vs inhibited sets; §6.C control logics including the TIT calculation; §6.D protective-shutdown thresholds; normal-shutdown sequence with NBPT, 85 s cooldown and the 23000 ft rule; life-time data and the memory module). Per AMM D/O 49-60-00 (power-control system; pressurised BULK compartment). Per AMM D/O 49-00-00 (system overview — sidewall-side inconsistency). Per FCOM DSC-49-10-20 (ECB functional summary). Per FCOM DSC-49-20 (MASTER SW reset note; crew-level 85 s cooling note).

Independent study material, not an Airbus publication. Refer to current operator FCOM, FCTM, AMM, and QRH for operational use.