Educational familiarization only. This original TechOpsBase lesson does not reproduce manufacturer pages, proprietary figures, maintenance procedures, numerical limits or controlled task data. Actual aircraft work requires current approved data, correct effectivity, operator procedures, authorization, safety controls and supervision.
Resource profile
- Aircraft: Airbus A350 family
- ATA: 49 - Airborne Auxiliary Power
- Audience: Enthusiasts, students, junior technicians and professionals
- Level: Intermediate-to-advanced
- Status: Draft pending technical review
Learning objectives
- Explain ECB inputs/outputs.
- Describe DMM/BITE.
- Differentiate shutdown modes.
- Interpret system-page messages.
- Use ground/flight protection logic.
1. Purpose and system role
The ECB sequences and protects the APU, controls fuel and air actuators, communicates with the SGCU/aircraft, stores faults and drives operational indications.
2. Architecture and energy flow
Sensor inputs include speed, EGT, inlet temperature, oil, fuel and actuator position.
Outputs include fuel schedule, intake flap, IGV/SCV/bleed commands and shutdown control.
DMM preserves identity/life/event data; aircraft networks carry warnings, displays and CMS information.
3. Major components
ECB. Full-authority start/run/shutdown controller. In normal service, the component must perform its role while the ECB or related aircraft system monitors command, feedback or the effect it produces. A defect may be electrical, mechanical, pneumatic, fuel-powered or caused by installation. Useful maintenance evidence includes command/feedback, first fault, internal BITE and network status. The technician should separate the command path from the actual physical response before replacing the component.
DMM. Stores APU identity and operating history. In normal service, the component must perform its role while the ECB or related aircraft system monitors command, feedback or the effect it produces. A defect may be electrical, mechanical, pneumatic, fuel-powered or caused by installation. Useful maintenance evidence includes serial association, life counters and repeated events. The technician should separate the command path from the actual physical response before replacing the component.
Speed/EGT sensors. Protect and control gas-turbine operation. In normal service, the component must perform its role while the ECB or related aircraft system monitors command, feedback or the effect it produces. A defect may be electrical, mechanical, pneumatic, fuel-powered or caused by installation. Useful maintenance evidence includes redundancy, plausibility, wiring and trend. The technician should separate the command path from the actual physical response before replacing the component.
Oil/fuel/inlet sensors. Support protection and maintenance messages. In normal service, the component must perform its role while the ECB or related aircraft system monitors command, feedback or the effect it produces. A defect may be electrical, mechanical, pneumatic, fuel-powered or caused by installation. Useful maintenance evidence includes actual condition versus sensor/wiring fault. The technician should separate the command path from the actual physical response before replacing the component.
Emergency controls/relays. Command immediate stop from cockpit or ground. In normal service, the component must perform its role while the ECB or related aircraft system monitors command, feedback or the effect it produces. A defect may be electrical, mechanical, pneumatic, fuel-powered or caused by installation. Useful maintenance evidence includes switch state, relay, wiring and ECB input. The technician should separate the command path from the actual physical response before replacing the component.
4. Normal operation
Step 1: Normal shutdown
Loads removed, cooldown performed, fuel stops and flap closes.
Step 2: Protective shutdown
ECB detects unsafe condition and stops immediately.
Step 3: Emergency shutdown
Cockpit/external/fire command causes immediate isolation.
Step 4: Flight protection
Some ground auto-shutdowns may be inhibited to preserve backup service.
Step 5: Indicating
System page and warnings summarize state while CMS gives detail.
5. Control, monitoring and protection
A message identifies a function, not always failed hardware. Use current/historical data and related parameters.
Emergency controls can have hidden open-contact failures or unwanted closed-contact shutdowns.
6. Failure modes and maintenance reasoning
- ECB input fault: False or missing sensor/command and protection changes.
- ECB output/control fault: Incorrect actuator/fuel command or sequence abort.
- DMM fault: Loss of history/identity data without immediate APU loss.
- Emergency input false active: Uncommanded immediate shutdown.
- Shutdown path failed: One emergency stop method unavailable, with redundancy possibly remaining.
7. Interfaces with other aircraft systems
- SGCU and ATA 24.
- Fire protection ATA 26.
- Fuel feed ATA 28.
- Bleed/pack systems ATA 21/36.
- Displays/warning/CMS ATA 31/46.
- Ground/flight and air data ATA 32/34.
8. Practical scenarios
Immediate stop with no cooldown
Establish protective, emergency, fire, fuel or power-loss path before restart.
One EGT input lost in flight
Review redundancy and phase-dependent protection rather than assuming total loss.
Fault disappears after master cycle
Use stored first-fault and phase information; reset can hide evidence.
9. Technician takeaways
- Ground and flight logic differ.
- No current warning does not prove no fault.
- Protect event data before reset.
- Test the complete shutdown and indication path after repair.
Maintenance boundary
This resource teaches architecture, operating logic and troubleshooting reasoning. It excludes task steps, torque values, test limits, servicing quantities, start thresholds and dispatch decisions. The APU contains hot surfaces, rotating machinery, high-energy start circuits, pressurized fuel and oil, automatically moving components and fire-system interfaces. Use current approved AMM/TSM/WDM data and all required isolation procedures.
Review prompts
- What service should the subsystem provide?
- Which component creates the output and which component controls it?
- Which sensor or feedback proves the result?
- What is the command-versus-response evidence?
- Which ground/flight protection logic applies?
- Which other ATA system supplies or receives the command?
- What physical evidence should be preserved before reset?
- What heat, rotation, pressure, electrical or fire-boundary hazard remains?
