# How does envelope protection work in Airbus vs. Boeing aircraft?

I keep reading this thing that "On Airbus the computer overrules the pilot, not on Boeing". Smells like urban myth or at least gross oversimplification. How does envelope protection work differently in Airbus and Boeing aircraft?

Boeing: as far as I understand it, it's possible to apply force on the column to override the autopilot and have zero limitations, i.e. you're free to (try to) fly the aircraft in whatever attitude you want.

Airbus: if all the systems are failure-free there's no way to override the autopilot, i.e. you cannot fly in any attitude you want.

Is my understanding/comparison accurate?

It would be really lovely if someone with factual knowledge on the matter elaborate more, maybe explaining the different laws and when they can be / are activated.

Related post What are the main differences piloting Boeing vs. Airbus aircraft? does not answer the question.

• Seen, that one, that's where I decided to ask this question. Really on airbus pilots have NO WAY (not even pulling breakers) to supersede the A/P? How is this comment, "On a Boeing, the pilot outranks the auto pilot", sarcastic? I'd like to have a serious, complete, overview of the pilots-a/p relationship on both. – Caterpillaraoz Oct 6 '17 at 11:28
• It's not the autopilot which can override the pilot inputs on Airbus aircraft, but the flight envelope protection (laws used in the control computers ELAC, FAC and SEC). The autopilot can be disengaged, the flight envelope is still protected. Related: Is a Control Law Degradation in Airbus Planes displayed on the ECAM? – mins Oct 6 '17 at 12:23
• There is quite a significant difference of envelope protection between the Boeing models. For example, the 737 is quite a different aircraft than the 787. Within the Airbus fleet the differences are less. If you want to prevent oversimplifications and generalisations, perhaps you want to limit the scope of the discussion to certain models. – DeltaLima Oct 6 '17 at 12:49
• @DeltaLima While this may be true, you would need to know the answer to this very question do properly limit the scope. This question may be broad in the number of planes it wants to compare, but very specific in what it wants to compare. – Sanchises Oct 6 '17 at 13:55
• I've edited my answer to the other question to improve the use of terminology that might have confused you. Sorry for that. – Federico Oct 6 '17 at 14:11

There are two sorts of "autopilots", and it is important to make a distinction between the two. One is for the behaviour of the aircraft around its Centre of Gravity (CoG), the other one is for defining the path of the CoG.

1. The Inner Loop autopilot: behaviour around CoG, or the aircraft attitude control. This autopilot should not be called autopilot since its characteristics are actually shielded from the pilot: it does its job without showing what it is doing. It only moves the control surfaces (elevator, ailerons) or helicopter swash plate, and not the flying controls (stick, wheel). To the pilot, the system is invisible and just results in a stable platform, in the case of the A320 and B777 a platform with envelope protection that does not allow for the aeroplane to enter a situation that would be dangerous. In helicopters this system is referred to as Stability Augmentation System (SAS).

2. The Outer Loop autopilot: defining the path of the CoG, which is ultimately what pilots are paid for :). They are in control of the flight path and administer this control by deflecting the flying controls (stick, pedals). The pilot can delegate this control to a feedback system that provides inputs to the same flying controls, via an actuator with a slip clutch. With an old fashioned mechanical linkage, the actuator moves the whole circuit from stick to surfaces (or swash plate in a helicopter); the pilot can override this input by applying a force greater than the override force of the slip clutch.

So normally, by design, the Outer Loop autopilot shows the pilots what it is doing by moving the flight path input devices for them, in a way that is transparent and can be intuitively overridden by applying a high force. It is this bit where the A320 has a different philosophy: the input stick never moves other than by the hand of the pilot. This main distinguishing feature between the two types of autopilot does not exist in an A320. It does in a B777, which also has an inner loop autopilot plus envelope protection, and an outer loop autopilot which actually does move the column/yoke. So the B777 is functionally identical to the A320 in every meaningful way, plus retains the feature of moving flying controls. It has no mechanical linkage, and it uses two separate sets of actuators for this function: one set for the surfaces, and one for the flying controls.

This is the situation on both Airbus > A320 and Boeing > 777, when all systems are functioning. These aircraft are all dynamically stable: aerodynamics take care of bringing back the aircraft attitude to a neutral position. The F16 for instance is aerodynamically unstable in order to provide high manoeuvrability: it always wants to pitch and roll already, and the flight control computers provide constant rapid inputs to elevators and ailerons to maintain attitude by active control. This is not the case with passenger aircraft, which do not need to be as manoeuvrable as a fighter jet and just need to bring the passengers home safely.

Therefore, both on the Airbuses & Boeings, the aircraft can fly without the Inner Loop autopilots as well, without any problems. The aircraft just lose their envelope protection and now it is possible to command them into potentially dangerous situations such as fully developed stalls. In both types, it is always possible to disconnect the outer loop autopilot. For the inner loop ones:

• The B737 does not have one.
• In the A320, it is not possible to disconnect the inner loop autopilots if all is functioning correctly, except by pulling circuit breakers for resetting the ELACs as this site indicates;
• In the B777 there is a guarded switch that allows disconnection of the envelope protection as @Cpt Reynolds pointed out.

In the latter two types, the system disconnects features by itself if failures are detected, to allow control in degraded mode. Both manufacturers have implemented a direct mode as the lowest mode, where surface deflection is a direct function of stick deflection. There is however no direct mechanical cable connection to the surfaces, even the direct mode is still an electrical input, so technically still Fly By Wire.

Above picture is from Aircraft Systems Mechanical, electrical, and avionics subsystems integration Third Edition Ian Moir Allan Seabridge, and shows the top level comparison of the implementation of the flight control loops. The redundancy features are different, functionality is much the same: both implementations prevent excessive AoA that brings the aircraft into a stall, and excessive bank angle.

So although the functionality of modern Airbuses and Boeings is very similar, we do often see the myth that Airbus ranks the automated systems higher than the pilot. There is a difference in user interface implementation, in that Airbus has sticks that are not coupled with each other, and have no means to be driven other than by hand. At the time of implementation, this was a new feature that pilots were not accustomed to, as was the envelope protection system. New features can be poorly understood by inexperienced users, and the aviation world is conservative: when the DC3 introduced a 3/4 control wheel, pilots were protesting that they might be gripping the bit of the wheel that was missing and that they were used to.

Ultimately, the most relevant fact is that both Airbus and Boeing have excellent and very similar safety numbers, and that both manufacturers make aircraft that enable the pilots to bring the passengers home safely in 99.9999999 % of flights.

• best explanation I’ve read in a long time. Another way to explain the two loops is that the inner loop is almost self-contained and does not need any external reference instruments (other than ADIRS) and orders the control surfaces in order to do things like eg: “keep wings level”, or “keep 5 deg pitch”. Outer loop uses external inputs (pitot,static,navs) and orders to the inner loop in order to do things like “climb 500 fpm” or “turn left hdg 230” – Radu094 Oct 7 '17 at 9:32
• @Radu094 The outer loop usually has its own input mechanism, separate from the stability augmentation system. – Koyovis Oct 7 '17 at 10:05
• I can't help but feel that you have done an excellent job at describing the differences between inner and outer loop control systems ("autopilots"), and how having one isn't necessarily related to having the other; but you haven't really discussed much about flight computer overrides by the pilot, or the differences in how Boeing and Airbus aircraft approach (no pun intended) flight envelope protection, which seems to be the focus of the OP's question, especially as OP is asking for clarification on the oft-quipped "on Airbus the computer overrules the pilot, not on Boeing" (and variants). – user Oct 7 '17 at 17:23
• Excellent explanation! The only comment I would like to add is that on the 777 there is a guarded switch to take out the „inner loop“ computers completely and render the aircraft, control-wise, a giant equivalent of a Cessna without any meaningful computing in the control loop but with all other functions intact. There is no equivalent of that switch in the A320 - there, it is still possible to disable the inner loop, but it will only be accomplished by sacrificing one aircraft function or another (e.g. some control surfaces will be locked out, or air data computer redundancy will be lost). – Cpt Reynolds Oct 7 '17 at 21:50
• There is another big difference between the inner loops. The Boeing one emulates direct controls within the flight envelope, but for the Airbus one, the side-stick deflection gives desired wing loading and roll rate and the computer calculates the surface position to achieve that. It makes the side-sticks simpler (no force feedback) and normal flying easier (automatic trim), but at the cost of feeling the plane (it won't tend to pitch down if it slows down and up if it accelerates except when it would leave the flight envelope). – Jan Hudec Oct 13 '17 at 21:15