EIVMU — The Engine Interface Unit

The AMM gives this system a name considerably longer than its acronym:

"The Engine Interface and Vibration Monitoring System (EIVMS) consists in: ‐ one computer (EIVMU) per engine ‐ one separate Remote Charge Connector (RCC) per engine."

The name declares its dual identity: Interface plus Vibration Monitoring. Functionally it is the diplomatic service between engine and aircraft — almost everything the two have to say to each other passes through it. This article opens the unit up: its five internal modules, its three data buses, and its three power-cutting relays. Note the establishment first: one EIVMU per engine, and the two units owe each other nothing. That separation is itself a listed design function — engine-to-engine segregation — guaranteeing that a fault in one engine's signal chain can never contaminate the other's.

1. The control-and-monitoring panorama

 ENGINE SIDE — sensors/actuators                    AIRCRAFT SIDE
 (each tagged CH A / CH B)
 ┌──────────────────────────────┐                  ┌────────────────┐
 │ nacelle temp TC · oil temp   │      ┌─────┐     │ DMC 1-3 (disp.)│
 │ TC ×2 · T30 TCs · oil filter │      │ FMU │     │ FWC 1+2 (warn) │
 │ ΔP · fuel temp TC · oil qty  │◄────►│ 4 × │     │ FMGEC 1+2      │
 │ · oil press ×2 · AOHE ·      │      │torque     │ SDAC·FDIU·DMU  │
 │ IP turbine ovht TC fwd/rear  │  ┌──►│motors     │ CMC · printer  │
 │ · fuel filter clog · fuel LP │  │   └─────┘     │ BMC · ZC · CPC │
 │ sw · TIC solenoid · VSV act. │  │   ┌─────┐     └───────▲────────┘
 │ ×2 · VIGV · bleed-valve ctrl │  │   │ OPU │◄─ N1 ×3     │ A1/A2 buses
 │ · start valve · reverser     │  │   │     │◄─ N2 ×3 ┌───┴─────────┐
 │ ICU/DCU · reverser lock      │  │   └──▲──┘        │  EIVMU 1(2)  │
 │ switches ×8                  │  │      │ alternator│ ┌ GPM (brain)│
 └──────────────┬───────────────┘  │      │ 1-phase   │ ├ DIM discrete
                ▼                  │      │           │ ├ SPM vibr. ◄┼── RCC ◄─ accelerometer
            ┌───────┐──────────────┘   ┌──┴───┐ E bus │ ├ APM ARINC │
            │  EEC  │◄─────────────────│ PCU  │◄──────│ ├ PSM power │◄─ 28 V DC
            │ CH A/B│   22 V DC        └──────┘115VAC │ └ relays ×3 │
            └───┬───┘                                 └─────────────┘
                │ 4 output buses (A1/A2/B1/B2)        ignition units 1+2 ◄─(115 VAC via R2)
                └────────────────────────────────►  + direct to FWC/DMC/FMGEC

Four reading points from the block diagram. First, every sensor on the engine-side list carries a channel tag — CH A, CH B or CH A&B: the "dual inputs" of article 04 are not an abstraction; the oil-temperature thermocouples exist twice (one per channel), the oil-pressure transmitters twice, while genuinely single sensors (oil quantity) are shared by both channels. Second, the FMU-to-EEC connection is a bundle of torque-motor lines — full authority's last inch is electrical signal driving fuel-hydraulic muscle (article 09). Third, the OPU's input wiring stands apart: three N1 and three N2 probes run straight into the OPU, which then forwards selected signals to the EEC — the diagram's confirmation that the EEC receives its N1/N2 second-hand (article 04). Fourth, the legend distinguishes two line types — discrete/analog hardwires versus ARINC buses: life-and-death words (FIRE, MASTER OFF) travel on hardwires, data travels on buses. The relay logic of §3 grows directly out of that distinction.

2. The five modules

"The EIVMU contains: ‐ one General Processing Module (GPM) ‐ one Discrete Input Module (DIM) ‐ one Signal Processing Module (SPM) ‐ one ARINC Processing Module (APM) ‐ one Power Supply Module (PSM) ‐ four relays (one is not used)."

"The brain is always the slave" is counter-intuitive and excellent design (synthesis): a master that never initiates communication can never be dragged down by one module's failure — each module reports at its own pace, and the mail-box decouples fast tasks from slow ones.

3. The three scissors: relays R1, R2 and R4

The official function list places "airframe electrical supplies to engine control" in the EIVMU's hands; the implementation is three relays, each armed by one hardware condition and one processed (software) condition:

"EEC supply switching (through PCU): The two following conditions energize the relay R1: ‐ one hardware condition (FIRE ON) ‐ one processed condition (on ground, ENG/MASTER switch in off position for at least 5 minutes). Upon energization of the relay R1, the EEC power supply is cut."

The software condition answers a question every line pilot has wondered about: why does the ECAM keep showing engine data for a while after shutdown? Because after MASTER OFF on the ground, the FADEC keeps its aircraft power for five more minutes (the alternator died with N3) — a window in which it finishes transmitting maintenance data and feeds the residual ECAM indications. At the five-minute mark, the EIVMU pulls the plug. The hardware condition is the opposite temperament: the ENG FIRE pushbutton cuts EEC power instantly, by hardwire — a fire waits for no software vote (article 17).

R2 (ignition supply): energised by FIRE ON or MASTER OFF — the shutdown gesture itself cuts the igniters' power, a second lock ensuring fuel-off is never accompanied by live sparks. R4 (reverser supply): energised only when the EIVMU receives valid data from the throttle control unit — the 28 V DC permission switch in the reverser chain (article 13).

4. Bus geography: E in, A1/A2 out

"The EIVMU has three data transfer buses: ‐ the E bus transmits data from aircraft to the corresponding engine ‐ the A1 and A2 buses transmit data from corresponding engine to the aircraft."

The two outbound buses serve distinct customer lists:

The input side is likewise three-flavoured: buses (EEC, FCU, zone controller, CMC, printer), analogs (bleed pressure sensor, the once-per-rev signal used for N1 trim balance, RCC vibration), and discretes (MASTER, throttle control unit, START selector, engine and wing anti-ice, ENG FIRE, MAN START, FADEC GND PWR, LGCIU, SFCC). The air/ground signal that gates the rain-hail protection of article 05 enters here, through the LGCIU line.

5. The EEC's complementary sensors — and the frozen-last-value trap

The interface chapter completes the sensor picture begun in article 04:

"Each ADIRU ARINC 429 bus is wired to one channel of the EEC and crosswired internally to the other channel. … In addition, the EEC has dedicated sensors that provide a complete complement to the ADIRU sensors. … The following EEC sensors are of the dual element type (one element per channel): ‐ ambient pressure sensor (PO) ‐ total temperature probe (T12) ‐ air inlet pressure sensor (PS12)."

(A naming note: this chapter writes T12/PS12 by station convention where the FADEC chapter says "P20T20 probe" — the same intake measurement system; both notations exist in the source and are preserved as found.) That "complete complement" is the hardware precondition for the four-tier air-data vote of article 05: one in-house set plus two ADIRUs is what makes a vote possible at all.

On the output side hides a detail worth a pilot's suspicion. EEC output parameters fall into classes, and for the class served by a single sensing element, when the cross-channel link is down:

"When the cross-channel is not functioning, the channel without the direct access to the sensing element will output the last value before the cross channel communication failure."

A frozen old value — not invalid, not zeroed: stopped at a moment in the past. This explains the occasional failure signature of "a parameter that looks normal but never moves". When reading displays, a motionless parameter and a healthy parameter are not the same thing — cross-check against the other channel or another display source before concluding "steady" (articles 14/19).

6. One discrete, aircraft-wide ripples: "engine not running"

Among the EEC's discrete outputs sits an unassuming line whose mailing list reveals the engine's weight in whole-aircraft logic:

"Each EEC sends one 'engine not running' signal to: ‐ Hydraulic System Monitoring Unit (HSMU) for automatic Ram Air Turbine (RAT) extension and automatic electrical pump activation ‐ flight control system for surface deflection speed limitation in case of RAT extension ‐ electrical shedding logics."

Place that in the dual-engine-failure scenario (article 33): both EECs assert not running → the HSMU extends the RAT automatically, the flight controls enter their hydraulic-thrifty surface-rate limitation, the electrical network sheds load — the aircraft's entire first wave of automatic response to a double flameout originates in these two discrete bits, each monitored by its EIVMU.

The EIVMU broadcasts its own discretes in turn: HP shut-off valve closed → zone controller; engine not running → weight-and-balance computer and radio altimeters; TLA at the takeoff position → zone controller and cabin pressure control; pack-off commands; APU boost → the APU's ECB; and — most flavoursome of all — "low oil pressure on ground" → the external-horn logic, CIDS, the CVR, windshield heating, probe heating and the FCDCs. Consider what that last one means (synthesis): when the aircraft needs to know that an engine has truly, finally stopped, it does not ask the tachometers — a windmilling engine keeps them lying — it asks the oil pressure. The CVR stops recording, the ground horn becomes permitted, the heating logics switch over, all on the word of a pressure switch.

7. Power discrimination: a dead EIVMU is not a runaway engine

The EIVMU itself eats aircraft 28 V DC. Setting the three supply layers side by side keeps them straight:

8. Where this interface meets operations

Self-test

[!note]- Q1. Which module performs the transfer function, and how does it talk to the brain? The APM (all digital I/O plus the transfer function); it communicates with the GPM through a mail-box mechanism — and the GPM is always the slave in internal communications, so no module's failure can drag the master logic down.

[!note]- Q2. After a normal ground shutdown, when does the EEC lose power, and who cuts it? About five minutes after MASTER OFF, by EIVMU relay R1 (processed condition: on ground + MASTER off ≥ 5 min), acting through the PCU. Pressing ENG FIRE is R1's hardware condition and cuts the supply instantly.

[!note]- Q3. Who reads the A1 bus, and who reads A2? A1 → CMC, FDIU, SDAC, DMC, DMU (recording and display). A2 → BMC and the printer. The E bus runs the opposite way — aircraft to engine.

[!note]- Q4. With the cross-channel link failed, what does the channel without direct access to a single-element sensor output? The last value received before the failure — frozen, not flagged. Interpretation rule: a perfectly motionless parameter may be a frozen value, not a stable one; cross-check before calling it normal.

[!note]- Q5. Why does the RAT deploy by itself the moment both engines quit? Both EECs' "engine not running" discretes assert → the HSMU automatically extends the RAT and activates electric pumps, flight controls limit surface rates, and the electrical network sheds load — the source of the aircraft's first automatic wave.

Key takeaways

References

• AMM 73-25 (EIVMU, D/O) — EIVMS composition, five modules and the slave-GPM design, the three relays and their dual conditions, three buses and customer lists, input flavours, EEC complementary sensors and the frozen-last-value behaviour, the engine-not-running and low-oil-pressure broadcast lists, power supply.
• ASM (engine control & monitoring block diagram) — channel tagging, OPU probe routing, hardwire-versus-bus legend (described from direct reading).
• Integrative synthesis (marked in text): the diplomat framing; the never-initiates-master reading; the oil-pressure-as-truth observation.

Independent study material, not an Airbus publication and not endorsed by the manufacturer. Always defer to the current operator FCOM, FCTM, and QRH for operational use.