Educational familiarization only. This original TechOpsBase lesson does not reproduce manufacturer pages, proprietary figures, maintenance procedures, numerical limits or controlled task data. Actual aircraft work requires current approved data, correct effectivity, operator procedures, authorization, safety controls and supervision.
Resource profile
- Aircraft: Airbus A350 family
- ATA: 49 - Airborne Auxiliary Power
- Audience: Enthusiasts, students, junior technicians and professionals
- Level: Intermediate-to-advanced
- Status: Draft pending technical review
Learning objectives
- Differentiate shutdown modes.
- Explain manual/automatic emergency stop.
- Recognize hidden control failures.
- Preserve shutdown evidence.
1. Purpose and system role
Normal shutdown protects the APU through load removal and cooldown. Protective and emergency shutdown remove fuel immediately when continued operation or fire risk takes priority.
2. Architecture and energy flow
The ECB controls normal/protective sequences.
Cockpit and external ground controls provide manual emergency stop.
Validated ground fire logic can automatically command emergency shutdown.
3. Major components
Master shutdown. Initiates normal load removal/cooldown. In normal service, the component must perform its role while the ECB or related aircraft system monitors command, feedback or the effect it produces. A defect may be electrical, mechanical, pneumatic, fuel-powered or caused by installation. Useful maintenance evidence includes sequence timing and flap closure. The technician should separate the command path from the actual physical response before replacing the component.
ECB protection. Stops for monitored unsafe conditions. In normal service, the component must perform its role while the ECB or related aircraft system monitors command, feedback or the effect it produces. A defect may be electrical, mechanical, pneumatic, fuel-powered or caused by installation. Useful maintenance evidence includes first fault, ground/flight logic and stored cause. The technician should separate the command path from the actual physical response before replacing the component.
Cockpit fire control. Commands immediate emergency stop. In normal service, the component must perform its role while the ECB or related aircraft system monitors command, feedback or the effect it produces. A defect may be electrical, mechanical, pneumatic, fuel-powered or caused by installation. Useful maintenance evidence includes switch, wiring and isolation response. The technician should separate the command path from the actual physical response before replacing the component.
External ground controls. Allow ground personnel to stop APU. In normal service, the component must perform its role while the ECB or related aircraft system monitors command, feedback or the effect it produces. A defect may be electrical, mechanical, pneumatic, fuel-powered or caused by installation. Useful maintenance evidence includes hidden open contact, false closed contact and relay path. The technician should separate the command path from the actual physical response before replacing the component.
Emergency relay/input. Delivers ground automatic stop. In normal service, the component must perform its role while the ECB or related aircraft system monitors command, feedback or the effect it produces. A defect may be electrical, mechanical, pneumatic, fuel-powered or caused by installation. Useful maintenance evidence includes fire command, relay and ECB input. The technician should separate the command path from the actual physical response before replacing the component.
4. Normal operation
Step 1: Normal
Remove services, cool, stop fuel, close flap.
Step 2: Protective
Immediate stop and store cause.
Step 3: Emergency
Immediate isolation without cooldown.
Step 4: Flight
Some protection may warn but not auto-stop.
5. Control, monitoring and protection
One failed manual stop can be hidden because another path remains.
A next-start abort can be linked to stored shutdown state.
6. Failure modes and maintenance reasoning
- False active input: Uncommanded shutdown.
- Open stop switch: One emergency path unavailable.
- Protection sensor fault: False or missing automatic protection.
- Shutdown sequence fault: Current stop completes but next start may be blocked.
7. Interfaces with other aircraft systems
- ATA 26 fire system.
- ATA 28 fuel isolation.
- ATA 24 generator.
- ATA 21/36 bleed.
- ATA 31 warnings.
8. Practical scenarios
Immediate stop with no fire
Separate ECB protection, emergency input and sudden fuel/power loss.
External switch fails test
Trace switch, wiring, relay and ECB input safely.
9. Technician takeaways
- Emergency stop omits cooldown.
- Ground and flight logic differ.
- Hot-battery/fire circuits may remain powered.
- Do not restart until cause is known.
Maintenance boundary
This resource teaches architecture, operating logic and troubleshooting reasoning. It excludes task steps, torque values, test limits, servicing quantities, start thresholds and dispatch decisions. The APU contains hot surfaces, rotating machinery, high-energy start circuits, pressurized fuel and oil, automatically moving components and fire-system interfaces. Use current approved AMM/TSM/WDM data and all required isolation procedures.
Review prompts
- What service should the subsystem provide?
- Which component creates the output and which component controls it?
- Which sensor or feedback proves the result?
- What is the command-versus-response evidence?
- Which ground/flight protection logic applies?
- Which other ATA system supplies or receives the command?
- What physical evidence should be preserved before reset?
- What heat, rotation, pressure, electrical or fire-boundary hazard remains?
