CTL SYS FAULT & FADEC Faults

Article 04 described the FADEC's two layers of redundancy — swap the channel, borrow the organ. This article covers what happens after the redundancy is spent. Seven alerts, and they are really answering three different questions: is control still there (CTL SYS FAULT — actuators or sensors failed), is communication still there (FADEC FAULT — the reporting link to ECAM is broken; EIVMU FAULT — the interface link to the aircraft is broken), and is the configuration data still trustworthy (FADEC IDENT FAULT — the engine-identification function has failed).

The family temperament was established in article 18: mostly crew awareness, no action in flight, MEL on the ground — with exceptions worth memorising immediately. CTL SYS FAULT has four branches, each with its own action; and the one member of the wider family that actually shuts an engine down is FADEC OVHT, the overheat protection covered in article 20.

1. ENG 1(2) CTL SYS FAULT — actuators or sensors failed

"This alert triggers when: ‐ Variable Bleed Valve (VBV) or Variable Stator Vane (VSV) is failed, or ‐ Parameters (PS3, T25, T3, N1, N2) are lost, or ‐ Fuel Meter Valve (FMV) or VSV position is lost."

Three trigger groups, three classes of hardware: the acting muscles (the bleed valves and variable stator vanes of article 03), the senses (the core parameters of the measurement chains in article 14), and the position feedback (the FMV resolver of article 09, the VSV LVDT of article 03). The handling splits four ways by what was lost:

2. The start-transient "pass": an official exemption clause

"During engine start, a transient fault may trigger the ENG 1(2) CTL SYS FAULT alert associated with the ENG 1(2) SLOW RESPONSE status … due to the EEC that starts the monitoring of Fuel Metering Valve (FMV) too early during the engine start sequence."

The FCOM took a known system characteristic — the EEC begins monitoring the FMV too early in the start sequence — and wrote it into an official decision tree. Reconstructed in full: before touching the MASTER, check the STATUS page for SLOW RESPONSE → present = you hold the "try once more" pass (a CAUTION restricts the second start attempt to this case only) → if the second start does not re-trigger, the fault was spurious and needs no maintenance action; if it re-triggers, maintenance → no SLOW RESPONSE on STATUS = do not retry; straight to maintenance.

The pass has exactly one valid stamp — SLOW RESPONSE. No other accompanying status qualifies. And the order of operations matters: the evidence lives on the STATUS page of the running (faulted) configuration — shut the MASTER off too eagerly and you void your own pass.

3. ENG 1(2) FADEC FAULT — reporting lost, control intact

"This alert triggers when the data bus between FADEC and ECAM is failed."

"CONFIRM ENG STATUS ON DISPLAYS — Since engine indications are lost; other system pages such as HYD SD page, ELEC AC SD page, or BLEED SD page must be used to confirm engine status. IF ABN ENG OPERATION: THR LEVER IDLE / ENG MASTER OFF."

The most alarming name in the family with the gentlest procedure. One sentence to remember it by: mute, not paralysed — the FADEC is still controlling the engine normally; it just cannot report to ECAM. The "confirm on other displays" technique is articles 01/02 put to work (synthesis): if that side's EDP still delivers hydraulic pressure (HYD page), the IDG still generates (ELEC AC page), and bleed air still flows (BLEED page), the engine is demonstrably running — the three loads on the accessory gearbox testify on behalf of an engine that has lost its own voice. Only if the engine actually behaves abnormally does the lever-idle / MASTER-off ending apply.

4. ENG 1(2) FADEC SYS FAULT — "no dispatch" grade, yet no action in flight

"This alert triggers when a NO DISPATCH failure affects one or both channels (failure of sensor, channel, etc…). On ground: THRUST LEVER 1(2) IDLE / ENG MASTER 1(2) OFF."

"NO DISPATCH" and "no action in flight" are not a contradiction (synthesis): the failure is severe enough that the next sector may not be released, but the current flight is still being carried by the remaining redundancy — finish the sector, park the aircraft. No alert illustrates better that the dispatch ledger and the flight-safety ledger are two separate books.

5. ENG 1(2) FADEC IDENT FAULT — identity unknown, but only a memo

"This alert triggers when the FADEC cannot identify the engine configuration. — Crew awareness."

The mechanism links back to the DEP of article 04: "engine configuration" is exactly what the Data Entry Plug stores — build standard, rating selection, the engine's identity papers. An identification failure is awareness grade: the EEC keeps working on its existing valid data, and the ground sorts it out. The name sounds graver than the disease.

6. MINOR FAULT and SENSOR FAULT — two awareness memos

"ENG 1(2) MINOR FAULT — This alert triggers when a minor fault is detected. Crew awareness."

"ENG 1(2) SENSOR FAULT — This alert triggers when the FADEC is not able to measure the temperature in engine zone 1 (fan zone). Crew awareness."

SENSOR FAULT's name is misleading — it is not "some sensor somewhere failed" (that territory belongs to CTL SYS FAULT or MINOR FAULT). It is specifically the zone 1 (fan zone) temperature measurement — the environmental monitoring of the cool zone mapped in articles 02/03. MINOR FAULT, meanwhile, is the alert-shaped incarnation of article 04's organ-borrowing philosophy: a single point failed, the redundancy took over, one line for the record.

7. ENG 1(2) EIVMU FAULT — the diplomatic line goes down

"This alert triggers when the databus between the EIVMU and the FADEC is failed. The following consequences affect the aircraft: ‐ Autothrust control is lost, ‐ Thrust reverser is lost on the affected engine, ‐ When idle is selected, only high ground idle is available on the affected engine, ‐ Bleed corrections on N1 limit are lost on the affected engine, ‐ Manual start is lost on the affected engine, ‐ Flex takeoff is lost. … THR LEVER (affected engine) MAN ADJUST."

Each consequence maps one-to-one onto the interface inventory of article 06: autothrust (the EPR target rides the E-bus), the reverser (the relay/DCU 28 V permission), the idle selection discretes (with the mode-idle words lost, only high ground idle remains), the bleed-configuration data (the thrust-limit corrections of article 05), the MAN START pushbutton's voice (the "fine words can't get through" of article 12), and the FLEX temperature downlink. The associated STATUS/INOP set completes the picture: GA THR: TOGA ONLY (on go-around-soft configurations) / LDG DIST PROC APPLY / ENG AUTOSTART ONLY / CAT 2 ONLY; INOP: A/THR, REV 1(2), CAT 3, GA SOFT.

And yet the procedure is a single line — MAN ADJUST the affected lever. The justification is article 04's direct-wired TLA: every degree of the thrust lever still counts. What the EIVMU carried was convenience and coordination; what the lever carries is command. Lose the diplomat, keep the throne.

8. The family in one table

9. Scenario walk-throughs

Cruise, one engine, CTL SYS FAULT + SLOW RESPONSE. Expect sluggish thrust response; lead your lever inputs. And file one reflex for later: both engines reporting SLOW RESPONSE together points to a common cause — fuel contamination attacking both metering valves (article 31 owns that fingerprint).

First start of a cold aircraft trips CTL SYS FAULT. Look at STATUS before touching the MASTER — the SLOW RESPONSE pass is only readable while the evidence is up.

FADEC FAULT on approach. That engine's parameters are gone for the duration; brief the proxy-confirmation scan (HYD/ELEC/BLEED) and settle the go-around decision early.

EIVMU FAULT on approach. CAT 2 only, landing-distance procedure applies, one reverser short — the performance arithmetic belongs in the briefing, not the flare (article 34).

Self-test

[!note]- Q1. CTL SYS FAULT with STATUS showing AVOID RAPID THR CHANGES — what was lost? P30 (HP compressor delivery pressure) — the surge-fingerprint sensor. The fuel schedule has lost its P30-follower protection (article 05), so rapid lever movements are to be avoided.

[!note]- Q2. CTL SYS FAULT during start — what is the "try once more" pass? ENG 1(2) SLOW RESPONSE on the STATUS page, and only that (CAUTION-limited). Second attempt clean = spurious, case closed; re-trigger or no SLOW RESPONSE = maintenance.

[!note]- Q3. After FADEC FAULT, how do you know the engine is still healthy? Engine indications are lost, so use the accessory loads as witnesses: EDP on the HYD page, IDG on the ELEC AC page, bleed on the BLEED page. Three normal pages = a normally running engine. Only abnormal behaviour earns IDLE + OFF.

[!note]- Q4. IDENT FAULT vs SYS FAULT — grades? And who in the family actually shuts down? Both carry no in-flight action — IDENT is awareness, SYS FAULT means no dispatch for the next sector. The family member that shuts an engine down is FADEC OVHT (article 20).

[!note]- Q5. After EIVMU FAULT, can the affected engine still be started? Is idle normal? Yes — automatic start only (the manual-start command cannot reach the FADEC without the EIVMU). Idle is reduced to high ground idle only: the idle-selection discretes are gone, and with them the three-idle repertoire of articles 05/12.

Key takeaways

References

• FCOM PRO (engine abnormal procedures: CTL SYS FAULT; FADEC FAULT / SYS FAULT / IDENT FAULT; MINOR FAULT; SENSOR FAULT; EIVMU FAULT, both versions) — all triggering conditions, branch actions, STATUS/INOP sets quoted verbatim.
• FCOM DSC-70 (start-transient supplementary information) — the SLOW RESPONSE decision tree and its CAUTION.
• Integrative synthesis (marked in text): the three-questions framing; the branch-meaning column; the accessory-witness technique; the two-ledgers reading; the common-cause reflex for dual SLOW RESPONSE.

Independent study material, not an Airbus publication and not endorsed by the manufacturer. Always defer to the current operator FCOM, FCTM, and QRH for operational use.