FADEC Environment & Protection Faults

Article 19 covered the computer's internal illnesses. This article covers two different categories: the environment group — the FADEC's own body temperature (HI TEMP / OVHT), the heat exchanger it manages (AIR EXCHANGER), the position reports it stops receiving (BLEED STATUS), and the icing it cannot prevent (STATOR ICING) — and the protection-loss group, where three guardians each disable themselves and report it (OVSPD PROT / LP SHAFT PROT / XWIND PROT).

The grammar of the protection-loss trio was set in article 18: the protected object is fine; what is lost is the safety net — hence all awareness or light handling. The one big action in the whole group is FADEC OVHT, the family's only in-flight shutdown.

1. FADEC HI TEMP and FADEC OVHT — two grades of body temperature

"ENG 1(2) FADEC HI TEMP — This alert triggers when the FADEC reaches a significant high temperature. — Crew awareness."

The OVHT procedure: THR LEVER (AFFECTED ENGINE) IDLE / ENG MASTER (AFFECTED ENGINE) OFF — lever to idle, then shut the engine down.

The mechanical basis sits in articles 03/04: the EEC, PCU and OPU live in a titanium-skinned electronics box cooled by intake-duct through-flow, and the EEC continuously monitors the internal temperature. HI TEMP means the breeze has weakened — note it down. OVHT means the computer is approaching thermal failure — and an overheating full-authority computer may begin issuing untrustworthy commands. Rather than let it control the engine while sick, the procedure puts the engine into a safe state while the computer is still lucid: shutdown (synthesis). This is the only in-flight shutdown in the entire FADEC alert family — worth filing precisely because every neighbouring alert in the family is "no action".

(Boundary note: the triggering-condition sentence for OVHT sits at a block boundary in the source and is not carried verbatim here; the procedure is complete, and the "higher temperature grade" reading follows from the two-alert naming — marked as synthesis.)

2. AIR EXCHANGER FAULT — it is the AOHE, not the ACAC

"This alert triggers when the oil temperature control system is failed. — Crew awareness."

Article 04 left a question open: with the air-cooled air cooler (ACAC) deleted by service bulletin on post-mod engines, does this alert still apply? Answer: yes — because it was never the ACAC's alert. The triggering text says it plainly: oil temperature control system — that is the AOHE, the air/oil heat exchanger of article 10, with its torque-motor-driven valve modulated by the EEC against oil and fuel temperatures. The AOHE exists on every engine.

Why the consequence is mild (synthesis, via article 10): oil-temperature control still has the FOHE's fuel-cooling path, and oil temperature itself carries independent indication plus the OIL HI TEMP alert as a backstop (article 30). Two safety nets behind one failed controller — awareness it is.

3. BLEED STATUS FAULT — no position reports, so assume the worst

"This alert triggers when either bleed valves, pack valves, wing and engine anti-ice valves or crossbleed valve position status is not received by the active FADEC channel."

"ENG (affected) HI IDLE — FADEC increases minimum idle on the affected engine, as if bleed and pack valves were open. On ground BEFORE T.O: PACK 1+2 OFF / ENG (affected) ANTI ICE ON / WING ANTI ICE ON — BOTH PACKS AVAIL IN FLT."

The logic is FADEC to the bone (synthesis). Article 05 showed modulated idle rising with bleed demand — now the configuration reports have stopped arriving, so the FADEC assumes every air consumer is drawing at once and sets minimum idle for the maximum case. Better too high than too low: an idle set too low for the real bleed load risks insufficient supply; an idle set too high merely costs fuel.

The before-takeoff configuration items then turn the assumption into fact: since the FADEC is treating the valves as open, actually switch the anti-ice on and the packs off — align reality with the assumption rather than fight it. Both packs return in flight.

4. RISK OF STATOR ICING — an ice invoice with four line items

"This alert triggers if all the following conditions are satisfied: ‐ OAT below 1 °C ‐ Engine anti-ice set to ON ‐ Cumulative engine idle time since the previous landing above 40 min ‐ No engine core de-icing procedure performed. This alert is reset if: ‐ The aircraft is in flight, or ‐ The engine core de-icing procedure is performed. — IF FREEZING FOG: CORE DEICE PROC APPLY (Refer to PRO-NOR-SUP-ADVWXR Engine Ice Shedding on Ground)."

The mechanism links to article 03: the stator vanes are unheated — engine anti-ice warms only the intake cowl lip. During long cold-weather ground idling, core flow is small and cold, and moisture accretes slowly on the IP compressor stators; accumulate enough and it sheds during an acceleration, straight into the compressor — surge and damage territory.

This alert is therefore an invoice, not a detection: forty minutes of idle time runs up a debt, and one ice-shedding run (spool up per the supplementary procedure to throw the ice off) pays it. Note the bookkeeping grammar (synthesis): cumulative idle time, counted since the last landing, reset by getting airborne or by paying the invoice — a state-machine alert, not a sensor alert. Nothing has measured ice; four conditions have merely all come true.

5. XWIND PROT FAULT — the crosswind logic fails, the human substitutes

"This alert triggers when the thrust application logic for the automatic rolling takeoff is failed. — On the ground (if the auto rolling takeoff logic is inoperative): T.O THRUST SET SLOWLY. — In flight (if the auto rolling takeoff logic is active): ENG (AFFECTED) SLOW RESPONSE."

The protection's true identity is the crosswind/intake-distortion fan-stall logic of article 05 — the gradual EPR-per-second thrust application for rolling takeoffs. The two failure directions are perfectly symmetric: logic dead (on ground) → nobody performs the gradual application → you do it — SET SLOWLY is a manual version of the protection, your hand pacing the EPR where the software used to; logic stuck active (in flight) → thrust response permanently lags → the SLOW RESPONSE status tells you to expect it.

One alert completes the protection's biography (synthesis): in normal life you never feel it working — only when it breaks do you discover that the "feel" of the lever during a crosswind takeoff was its doing.

6. OVSPD PROT FAULT — the OPU disables itself, and offers a retest

"This alert triggers when the overspeed protection system is failed. — Maintenance action is due. In coordination with Maintenance support, a second engine start may be performed. If there is no failure message after this second attempt, it could be considered as spurious. — Crew awareness."

This is the cockpit face of article 04's mechanism: the OPU's two ASICs cross-check each other, and on disagreement the unit disables itself and reports. At this moment the engine has no hardware N1/N2 overspeed protection — though the EEC's red-line limiters (article 00) still govern at the control level.

The "second start to test for spurious" clause is the same design philosophy as the SLOW RESPONSE pass of article 19 — call it the FADEC family's spurious culture (synthesis): self-test logic can false-alarm in transients, so the system grants one retest. The difference is the fine print: this pass requires coordination with maintenance — not a crew-initiated retry.

7. LP SHAFT PROT LOSS — the shaft-break watchman goes blind

"This alert triggers when the LP shaft sensor is failed. Note: (a) Inhibited in the case of LP SHAFT PROT LOSS for only one engine. — Crew awareness."

Mechanism via articles 05/14: the turbine-overspeed protection detects a broken LP shaft by comparing two speed probes — compressor end against LP-turbine end. With the sensor failed, the comparison cannot be made and the control-level fuel-cut protection is lost. The mechanical layer survives: article 01's fail-safe shaft still stands — of the two layers of shaft-break protection, one remains.

The inhibition note rewards a second look (synthesis): when only one engine loses the protection, the alert is suppressed entirely — there is no crew action to take, so showing it would be pure distraction. Only when both engines lose it does the system speak up: a systemic gap in the protection scheme is worth knowing about. A clean specimen of the ECAM philosophy — tell the crew only what they need to know.

8. The eight alerts in one table

Self-test

[!note]- Q1. Why does FADEC OVHT shut the engine down when HI TEMP is mere awareness? Two temperature grades. HI TEMP is "significantly hot — note it". OVHT is the dangerous grade: an overheating full-authority computer may misbehave, so the engine is handed back to a safe state while the computer is still lucid. The only in-flight shutdown in the FADEC family.

[!note]- Q2. Can AIR EXCHANGER FAULT appear on an aircraft whose ACAC was deleted by service bulletin? Yes — its subject is the AOHE (the oil temperature control system), not the ACAC. The AOHE exists on every engine (article 10). This closes the question left open in article 04.

[!note]- Q3. Forty-five minutes of ramp idle after landing, OAT 0 °C, anti-ice on — what happens? All four conditions are met (OAT < 1 °C / anti-ice ON / cumulative idle > 40 min / no de-icing performed) → ENG RISK OF STATOR ICING triggers. In freezing fog, apply the core de-icing (ice shedding) procedure; getting airborne or completing the procedure resets the alert.

[!note]- Q4. XWIND PROT FAULT on the ground — how is takeoff thrust applied? SET SLOWLY. The automatic rolling-takeoff thrust logic is dead, so your hand replaces the EPR-per-second gradual application, protecting the fan through the low-speed regime (article 05).

[!note]- Q5. Why doesn't ECAM announce LP SHAFT PROT LOSS on a single engine? The single-engine case is inhibited (Note a) — no crew action exists, so the alert would be noise. Only a dual loss is announced. The mechanical fail-safe shaft of article 01 still guards the shaft-break case throughout.

Key takeaways

References

• FCOM PRO (engine abnormal procedures: FADEC HI TEMP / FADEC OVHT; AIR EXCHANGER FAULT; BLEED STATUS FAULT; RISK OF STATOR ICING; XWIND PROT FAULT; OVSPD PROT FAULT; LP SHAFT PROT LOSS) — triggering conditions, procedures, notes quoted verbatim; the core de-icing procedure itself lives in the supplementary procedures (see article 34).
• Integrative synthesis (marked in text): the OVHT shutdown rationale; the AOHE backstop pair; the worst-case-idle and align-reality readings; the invoice/state-machine framing; the manual-MEASTO substitution; the spurious-culture comparison; the single-engine-inhibition reading of ECAM philosophy.

Independent study material, not an Airbus publication and not endorsed by the manufacturer. Always defer to the current operator FCOM, FCTM, and QRH for operational use.