FADEC Architecture

The FCOM introduces the engine's brain in five dense sentences:

"Each powerplant has a FADEC (Full Authority Digital Engine Control) system. FADEC is a digital control system that performs complete engine management. FADEC has two-channel redundancy, with one channel active and one standby. If one channel fails, the other automatically takes control. The system has a magnetic alternator for an internal power source. FADEC is mounted on the fan case. The Engine Interface Unit (EIVMU/EIU) transmits the data it uses for engine management to the FADEC."

Four identity features in one breath: two channels, self-powered, engine-mounted, talking to the aircraft through the EIVMU. "Full authority" has already been established in article 00: no cable runs from the cockpit to the fuel valve; the thrust levers are a request. This article opens the box: the dual-channel computer (EEC), the private power plant (dedicated alternator + PCU), the engine's identity card (DEP), the outpost weather station (P20T20 probe), and — most distinctive of all — an overspeed bodyguard (OPU) that takes orders from no one, draws its own pay, and can shut the engine down without the EEC's consent.

This article covers the hardware and interfaces. The control laws this hardware executes are article 05; the interface unit's internals are article 06.

1. The input/output panorama

 DIRECT to FADEC (not via EIVMU):                ┌─────────────┐  outputs (actuators):
   THRUST LEVER ANGLE ═══════════════════════►   │             │──► VSV/VIGV CONTROL UNIT
   ADIRS 1+2 ════════════════════════════════►   │             │──► FMU (FMV + HP SOV)
   N1 MODE pb ───────────────────────────────►   │             │──► PROBE HEAT (P20/T20)
                                                 │   FADEC     │──► IGNITION SYSTEM
 via EIVMU:                      ┌──────┐ ◄════► │   (EEC)     │──► ENGINE STABILITY &
   ENG MASTER (ON/OFF            │      │        │             │     HEAT MANAGEMENT
    + FIRE/FAULT lights)         │      │        │             │──► START VALVE
   ENG START selector            │EIVMU │        │             │──► THRUST REVERSER SYS
    (CRANK/NORM/IGN START)   ───►│      │        │             │──► FUEL/OIL HEAT MGMT
   ENG MAN START pb              │      │        │             │
   ZONE CONTROLLER ─────────────►│      │        │             │──► ECAM (E/WD + SD)
   LGCIU / SFCC ────────────────►│      │        └─────▲───▲───┘
   FMGS (A/THR EPR target) ─────►└──────┘   ENG SENSORS║   ║ N3 (via PCU)
                                                       ║
        P0 · P20/T20 (intake) · P30/T30 (HP compr.) · T25 · P50 (LP turbine) · N1 · N2 · EGT
        + position feedback: FMV · VIGV/VSV · IP8/HP3 bleed valves · TCC

Four reading points from the FCOM schematic. First — and most consequential — three things connect directly to the FADEC, bypassing the EIVMU entirely: the thrust lever angle, the ADIRS air data, and the N1 MODE pushbutton. The most vital inputs cut out the middleman: with the EIVMU dead, your thrust levers still command the engine (the foundation of the EIVMU FAULT discussion in article 19). Second, the start controls (MASTER, START selector, MAN START) and the aircraft systems (A/THR, LGCIU, SFCC, zone controller) speak through the EIVMU — these are "the aircraft's words", delivered by the diplomatic service. Third, a notation footnote: the FCOM schematic labels the sensors P2/T2, P3/T3, P5/T5 where the AMM writes P20/T20, P30/T30, P50 — same probes, two house styles, not a configuration difference. Fourth, N3 alone arrives via the PCU, because the N3 signal is embedded in the alternator's output frequency (§3) and needs no dedicated probe channel.

The family table

2. Two channels: one flies, one watches — and organs can be borrowed

"One channel is the monitor computer while the other Channel is the control computer. The control computer can access the input and the output interfaces of the monitor computer. This is so that it can stay in control if a related input or output becomes defective. A failure such as the failure of the control computer circuits causes control to be given to the monitor computer."

There is a subtlety here that is easy to read past: the channel redundancy works at two levels. Level one is replacement — the control computer's own circuits fail, and the monitor computer takes over (the FCOM's active/standby). Level two is organ borrowing — the control computer is healthy but one of its sensor interfaces has failed, and rather than surrendering control it simply reads the monitor channel's identical interface and carries on. This is why a single failed probe or bus in the FADEC family usually produces nothing more dramatic than a MINOR FAULT-class "carry on with a note in the logbook" (article 19). Physically, channels A and B share one EEC case but are separated by an internal barrier — one enclosure, two compartments, so a fault in one bay does not propagate to the other.

The bus weave: each channel can read all three input buses through the cross-channel links (two low-speed ARINC 429 buses carrying ADIRU data, one high-speed bus carrying EIVMU data); each channel drives two high-speed output buses, and output data always originates from whichever channel is in control.

3. Power: the 6 % gate and the 8 % gate

The supply backbone:

"The primary source of electrical power for the FADEC system is an EEC dedicated alternator. Three-phase power from the alternator is regulated by a PCU (Power Controller Unit) and supplied for each EEC Channel. One-phase power from the alternator is supplied directly to an OPU (Overspeed Protection Unit)."

The alternator is a permanent-magnet machine (the unit on the EGM front face) — no excitation, no external supply; spin the shaft and power exists. Its output frequency is proportional to N3, so the EEC reads N3 from the alternator itself — which is exactly why the panorama in §1 shows N3 arriving via the PCU. Two thresholds must be kept apart:

The switching logic comes from the system schematic's own annotation, worth quoting whole:

"THE EEC IS DESIGNED TO OPERATE WITH THE ENGINE NOT RUNNING AND IS ELECTRICALLY POWERED BY A/C 115VAC THROUGH THE EIVMU. THE A/C 115VAC PERMITS: ‐ GROUND CHECK OF FADEC BEFORE ENGINE RUNNING ‐ ENGINE STARTING ‐ POWERING OF THE EEC WHILE ENGINE IS RUNNING BELOW 8% N3. AS SOON AS THE ENGINE RUNS ABOVE 8% N3, THE FADEC AUTOMATICALLY SWITCHES FROM A/C POWER TO THE ENGINE ALTERNATOR POWER SUPPLY."

Six percent is "power exists"; eight percent is "formally switch over" — the logic point sits above the physical floor for margin. Above 8 % N3 the engine's control system is electrically independent of the aircraft: every bus on the aircraft can fail and the engine keeps running — the hardware behind article 00's "autonomous city" framing.

Backup and transfer. Aircraft 115 V AC is conditioned inside the PCU to the same 22 V DC standard as the alternator path. The two aircraft inputs have a fixed allocation — Normal 115 V feeds PCU channel B, Emergency 115 V feeds channel A — so in an emergency electrical configuration it is the A-side that survives (one reason ignition system A hangs on emergency power, article 11). While the alternator is healthy its priority actively isolates the aircraft-power pre-regulator; the moment an alternator winding fails, the same logic connects the aircraft regulator instantaneously — "no effect on the EEC power supply." Each channel's supply is dedicated: PCU channel A's 22 V feeds only EEC A, B only B. The OPU's single-phase feed is choosier still: if its normal winding fails, a spare single-phase winding exists on the alternator — but connecting it requires manually swapping a connector (the receptacle sits on the drain-collector-tank bracket). The bodyguard's pay never passes through anyone else's hands, even in backup.

The PCU also minds its own survival: high-emissivity paint and cooling fins, convection from the electronics-box through-draught — and an internal temperature sensor continuously monitored by the EEC, feeding the cockpit status behind the FADEC temperature alerts of article 20.

4. The DEP — the engine's identity card, and the truth about cockpit EGT

"The DEP is programmed with the data that follows: ‐ EPR trim ‐ Engine rating selection ‐ EGT trim ‐ Engine serial number ‐ Fan stall index ‐ Engine build standard ‐ Idle trim ‐ Intermix."

The Data Entry Plug is a twin-EEPROM plug (one identical data set per channel), lanyarded and Hi-Lok-locked to the electronics box so it cannot wander onto another engine. Two of its eight items deserve a close look.

EGT trim — the cockpit EGT is a standardised value:

"The EGT trim factors the actual engine EGT to a lower value for display in the cockpit. … The EGT trim is calculated at three temperatures equivalent to the aircraft cockpit ECAM limits for crew warning: 850 deg.C (maximum continuous), 900 deg.C (maximum take-off) and 920 deg.C (maximum overtemperature)."

In other words: the EGT you see is not the thermocouples' raw physical reading but a value calibrated against this individual engine's test data — anchored precisely at the three limit temperatures from article 00. Two engines of different age and deterioration showing the same 900 °C are equally close to their margin. EPR trim works the same way, using the engine and nozzle data-plate corrections to iron out individual P50-probe and nozzle differences, so that the same thrust shows the same EPR on every engine of the same standard. The fan stall index, meanwhile, selects which combination of stall detection / stall recovery / MEASTO functions is active on this engine (article 05).

[!warning]- "After an EEC change the engine must be recalibrated" — no All individual calibration lives in the DEP, which stays with the engine; the EEC is a generic unit. The genuinely dangerous error is the reverse — treating the DEP as interchangeable. That is why it is physically locked to the box.

5. Five upstream interfaces, and the outpost weather station

"The FADEC system has interfaces with these aircraft systems and aircraft installed components: ‐ The Air Data Inertial Reference System (ADIRS) ‐ The Auto-Flight System (AFS) ‐ The throttles ‐ The engine master switches ‐ The Engine Interface and Vibration Monitoring Unit (EIVMU)."

The grading principle (synthesis): a human's commands to the engine — levers, MASTER — run direct; an aircraft system's requests — A/THR — go through the EIVMU. Command paths are kept short and hard; request paths are allowed to be losable (EIVMU dead → A/THR gone, manual thrust untouched — article 19).

The P20T20 probe is the FADEC's own air-data source, cross-checked against ADIRS. Its design packs four disciplines into one instrument: P20 runs through tubing (a non-flowing system) to the EEC pressure modules, smoothed en route by a 60 in³ spherical accumulator (so a P20 transient cannot jolt the control loops) with a water trap at the low point; T20 uses two 100 Ω platinum elements, one per channel; the inlet path makes a sharp turn that slings out sand, hail and insects before the air reaches the sensing element; and the probe mouth is electrically anti-iced (115 V AC via the PCU, EEC-controlled). One probe — dual-channel, contamination-proofed, anti-iced, signal-smoothed: the FADEC input philosophy in miniature.

6. The OPU — the last line, answering to no one

"The primary function of the OPU is to give protection from an N1 or N2 overspeed. These engine shaft speeds are usually kept in safe limits by 'red-line' limiters in the EEC. But if a failure occurs such that these limiters can not prevent a shaft overspeed the OPU will shutdown the engine independently of the EEC."

The OPU's independence is total. Power-independent: single-phase feed straight from the alternator, not through the PCU's main path. Signal-independent: it connects directly to three N1 probes and three N2 probes, selects two healthy signals of each by its own BITE — and then forwards the selected signals to the EEC's two channels: the N1/N2 the EEC itself uses arrive second-hand from the OPU. Execution-independent: it drives the FMU's overspeed-valve torque motor directly, closing the pressure-raising and shut-off valve and cutting fuel without needing the EEC's agreement.

The anti-spurious voting is equally strict:

"If an ASIC finds an overspeed condition it will energize its output circuit. If the ASIC in the other Channel also energizes its output circuit, at the same time, then the condition is read as 'TRUE'. … If one ASIC energizes its output circuit and it reads that the other has not, then the OPU is automatically disabled. And a failure indication is transmitted (through the EEC) to the cockpit."

Both ASICs must agree before the cut is executed; if they disagree, the OPU disables itself and reports (the OVSPD PROT FAULT alert — articles 20/28). The design would rather forfeit the protection than wrongly kill a healthy engine. And note the division of labour: the OPU covers N1 and N2; N3 overspeed and LP shaft breakage (the TOS) are handled by the EEC itself — the action thresholds (N1 ≥ 110 %, N2 ≥ 117 %) and the full four-layer protection ledger are in articles 09 and 28.

7. The actuator roster

What the EEC actually commands, item by item:

8. A configuration check: the ACAC "contradiction"

The AMM contains a statement that flatly contradicts the FCOM's air-system description:

"POST SB 75-C033: The ACAC (4082KS) is not used on the engine. NOTE: The ACAC has been deleted from most engines. NOTE: If the ACAC is installed, its function has been mechanically and electrically disconnected."

Meanwhile the FCOM still describes HP3 air being cooled in the ACAC with a dual valve "fully open during hot day take-off and climb". The resolution: this is a service-bulletin configuration split — the FCOM describes the original build, the AMM configuration describes the post-SB state. The governing truth for any individual aircraft is its own SB embodiment status; on modified engines the internal-gearbox HP3 supply no longer passes through an ACAC. Two lessons travel beyond this example: an FCOM system description does not necessarily reflect the latest SB state; and the related ENG AIR EXCHANGER FAULT alert is unaffected, because it monitors the oil temperature control system (AOHE), not the ACAC (article 20).

9. The nine FCOM functions — the skeleton, closed out

The FCOM's FUNCTIONS list, with each item's home article: ① gas-generation control (fuel flow, acceleration/deceleration schedules, VSV/VIGV/bleed-valve schedules, turbine clearance, idle setting → 03/05/09); ② exceedance protection (N1/N2 overspeed via the OPU, turbine overspeed, ground-start EGT monitoring → §6, 05, 12); ③ power management (automatic rating, automatic N1-mode reversion, thrust-limit computation, manual + automatic power → 07/08); ④ automatic starting (start valve, HP fuel valve, fuel, ignition + monitoring of N1/N3/FF/EGT + ground-only abort/re-cycle + auto/quick relight → 12); ⑤ manual starting (passive monitoring → 12); ⑥ reverser control (→ 13); ⑦ parameter and status transmission to the cockpit (→ 14/15); ⑧ fuel-used computation (FF integration); ⑨ heat management + FADEC self-cooling + fault detection, isolation and recording (→ 03/19). The four stability protections (MEASTO, stall recovery, the keep-out zone, IPTOS) are quoted and developed in full in article 05.

10. Where this architecture meets the failure chapters

Self-test

[!note]- Q1. A sensor input interface on the control computer fails. Does control change channels? Not necessarily. The control computer can directly access the monitor channel's equivalent input/output interfaces and stay in control — organ borrowing. Channel handover happens only when the control computer's own circuits fail.

[!note]- Q2. Trace the FADEC's power timeline through a ground start. Before and during the early start: aircraft 115 V AC (through the EIVMU into the PCU, conditioned to 22 V DC; Normal supply → channel B, Emergency → channel A). The alternator's output becomes usable from about 6 % N3; at 8 % N3 the FADEC switches automatically to alternator power and is thereafter electrically self-sufficient.

[!note]- Q3. What is the relationship between the cockpit EGT and the thermocouples' physical reading? The cockpit value is the physical value factored by the DEP's EGT trim — calibrated at 850/900/920 °C, the exact ECAM limit temperatures — so that different individual engines display comparable values aligned to the warning limits.

[!note]- Q4. The OPU's two ASICs disagree about an overspeed. What happens? No shutdown — the cut requires both ASICs TRUE simultaneously. The OPU disables itself and reports through the EEC (OVSPD PROT FAULT): the design forfeits the protection rather than risk killing a good engine.

[!note]- Q5. With the EIVMU completely failed, do the thrust levers still work? Does A/THR? Levers: yes — TLA resolvers connect directly to the EEC. A/THR: no — the FMGEC's EPR target travels via the EIVMU. Commands run direct; conveniences are relayed.

Key takeaways

References

• FCOM DSC-70 (FADEC general + functions) — five-sentence architecture statement, nine-function list, I/O schematic.
• AMM 73-21 (FADEC, D/O) — channel roles and organ-borrowing, bus structure, power supply chain, DEP contents and EGT/EPR trim, five aircraft interfaces, P20T20 and accumulator, OPU function/independence/ASIC voting, actuator roster, ACAC post-SB status, PCU temperature monitoring.
• AMM 74-10 (ignition power supply, D/O) — Normal→PCU-B / Emergency→PCU-A allocation.
• ASM (FADEC power supply & reset schematic) — the 8 % N3 switchover annotation and the three uses of aircraft 115 V AC (quoted verbatim).
• Integrative synthesis (marked in text): the "city with a private power plant" framing; the 6 %-physical / 8 %-logical margin reading; the commands-direct/requests-relayed grading; the OPU/EEC protection split summary.

Independent study material, not an Airbus publication and not endorsed by the manufacturer. Always defer to the current operator FCOM, FCTM, and QRH for operational use.