###Autopilot vs FMS vs protection

The autopilot does not prevent a nose down, this task is done by the envelope protection, which is a different flight computer.

The FMS is what sends the autopilot commands, i.e., the autopilot is part of the FMS. The pilot interface with the autopilot is the CDU (which is basically a keypad and a screen), and the FCU (the autopilot panel on the glareshield).

When flying, it's either the pilot or the autopilot in control, it can't be both. (There are exceptions but this is to keep it simple.)

The commands of either are sent to a flight control computer, this is where the envelope protection lives.

Like any computer, there is input (stick forward), and output (elevator down).

The envelope protection has an additional input that comes from another computer, the ADIRU, and one of the ADIRU's inputs is the pitot-static system, so it can decide if pitching down is safe or not before sending the output.

If the ADIRU says the plane is over-speeding, the envelope protection will not pitch down.

• What happens if the pitot-static is not working properly?

The engineers thought about your question, and decided to have 2 or 3 of each computer and pitot-static system.

The multiple ADIRUs are always chatting, making sure the inputs they get from each pitot-static system is similar. If they notice, by voting, that one of the data sources is not similar to the other two, the ADIRUs will tell the flight control computer, "our data is bad, don't trust it."

The advanced flight control computer will stop sending output and will disconnect the autopilot if it is engaged, then another simpler flight control computer will give more control to the pilots.

The pilots will be shown on their screens that there is an ADIRU issue, and from their training they will know what to do (memory items) to keep the plane from stalling (your example), and then they will run their checklists to make sure the ADIRU that is getting bad data is no longer voting. This is called a degraded fly-by-wire mode, i.e., not all the functions of the envelope protection are working.

The drawing is own work, which is a simplified version of the actual schematic.

Autopilot vs FMS vs protection

The autopilot does not prevent a nose down, this task is done by the envelope protection, which is a different flight computer.

The FMS is what sends the autopilot commands, i.e., the autopilot is part of the FMS. The pilot interface with the autopilot is the CDU (which is basically a keypad and a screen), and the FCU (the autopilot panel on the glareshield).

When flying, it's either the pilot or the autopilot in control, it can't be both. (There are exceptions but this is to keep it simple.)

The commands of either are sent to a flight control computer, this is where the envelope protection lives.

Like any computer, there is input (stick forward), and output (elevator down).

The envelope protection has an additional input that comes from another computer, the ADIRU, and one of the ADIRU's inputs is the pitot-static system, so it can decide if pitching down is safe or not before sending the output.

If the ADIRU says the plane is over-speeding, the envelope protection will not pitch down.

• What happens if the pitot-static is not working properly?

The engineers thought about your question, and decided to have 2 or 3 of each computer and pitot-static system.

The multiple ADIRUs are always chatting, making sure the inputs they get from each pitot-static system is similar. If they notice, by voting, that one of the data sources is not similar to the other two, the ADIRUs will tell the flight control computer, "our data is bad, don't trust it."

The advanced flight control computer will stop sending output and will disconnect the autopilot if it is engaged, then another simpler flight control computer will give more control to the pilots.

The pilots will be shown on their screens that there is an ADIRU issue, and from their training they will know what to do (memory items) to keep the plane from stalling (your example), and then they will run their checklists to make sure the ADIRU that is getting bad data is no longer voting. This is called a degraded fly-by-wire mode, i.e., not all the functions of the envelope protection are working.

The drawing is own work, which is a simplified version of the actual schematic.

###Autopilot vs FMS vs protection

The autopilot does not prevent a nose down, this task is done by the envelope protection, which is a different flight computer.

The FMS is what sends the autopilot commands, i.e., the autopilot is part of the FMS. The pilot interface with the autopilot is the CDU (which is basically a keypad and a screen), and the FCU (the autopilot panel on the glareshield).

When flying, it's either the pilot or the autopilot in control, it can't be both. (There are exceptions but this is to keep it simple.)

The commands of either are sent to a flight control computer, this is where the envelope protection lives.

Like any computer, there is input (stick forward), and output (elevator down).

The envelope protection has an additional input that comes from another computer, the ADIRU, and one of the ADIRU's inputs is the pitot-static system, so it can decide if pitching down is safe or not before sending the output.

If the ADIRU says the plane is over-speeding, the envelope protection will not pitch down.

• What happens if the pitot-static is not working properly?

The engineers thought about your question, and decided to have 2 or 3 of each computer and pitot-static system.

The multiple ADIRUs are always chatting, making sure the inputs they get from each pitot-static system is similar. If they notice, by voting, that one of the data sources is not similar to the other two, the ADIRUs will tell the flight control computer, "our data is bad, don't trust it."

The advanced flight control computer will stop sending output and will disconnect the autopilot if it is engaged, then another simpler flight control computer will give more control to the pilots.

The pilots will be shown on their screens that there is an ADIRU issue, and from their training they will know what to do (memory items) to keep the plane from stalling (your example), and then they will run their checklists to make sure the ADIRU that is getting bad data is no longer voting. This is called a degraded fly-by-wire mode, i.e., not all the functions of the envelope protection are working.

The drawing is own work, which is a simplified version of the actual schematic.

###Autopilot vs FMS vs protection

The autopilot does not prevent a nose down, this task is done by the envelope protection, which is a different flight computer.

The FMS is what sends the autopilot commands, i.e., the autopilot is part of the FMS. The pilot interface with the autopilot is the CDU (which is basically a keypad and a screen), and the FCU (the autopilot panel on the glareshield).

When flying, it's either the pilot or the autopilot in control, it can't be both. (There are exceptions but this is to keep it simple.)

The commands of either are sent to a flight control computer, this is where the envelope protection lives.

Like any computer, there is input (stick forward), and output (elevator down).

The envelope protection has an additional input that comes from another computer, the ADIRU, and one of the ADIRU's inputs is the pitot-static system, so it can decide if pitching down is safe or not before sending the output.

If the ADIRU says the plane is over-speeding, the envelope protection will not pitch down.

• What happens if the pitot-static is not working properly?

The engineers thought about your question, and decided to have 2 or 3 of each computer and pitot-static system.

The multiple ADIRUs are always chatting, making sure the inputs they get from each pitot-static system is similar. If they notice, by voting, that one of the data sources is not similar to the other two, the ADIRUs will tell the flight control computer, "our data is bad, don't trust it."

The advanced flight control computer will stop sending output and will disconnect the autopilot if it is engaged, then another simpler flight control computer will give more control to the pilots.

The pilots will be shown on their screens that there is an ADIRU issue, and from their training they will know what to do (memory items) to keep the plane from stalling (your example), and then they will run their checklists to make sure the ADIRU that is getting bad data is no longer voting. This is called a degraded fly-by-wire mode, i.e., not all the functions of the envelope protection are working.

The drawing is own work, which is a simplified version of the actual schematic.