# Airbus control architecture - where does the actual autopilot live?

I'd like to ask for confirmation about the A320 (and, generally, Airbus family) control architecture. The book Aircraft Systems provides the following overview of A3XX computing architectures:

Focusing particularly on the A320 family, are the ELACs and SECs merely actuator controllers for the control surfaces, or do they also carry the autopilot flight control algorithms? Or is the "autopilot" a separate entity, which feeds desired control surface positions to the ELACs and SECs (i.e. these latter are simply "slaves" to the autopilot)?

This picture from an A320 Operating Manual makes it seem that ELACs and SECs are autopilots themselves (i.e. there is no separate entity that is the autopilot that feeds them signals):

However, the same manual has another figure which makes it seems that indeed there is a separate autopilot entity:

If the autopilot is indeed a separate "master" entity which feeds desired control surface position signals to the ELACs and SECs, is this a concept that generalizes to the rest of the Airbus family? Where does the autopilot software then live?

Short answer: Autopilot is a feature of the Flight Management And Guidance System (FMGS), and in particular each of the two Flight Management And Guidance computers (FMGC) manage its autopilot.

Are the ELACs and SECs merely actuator controllers for the control surfaces?

Correct, but they are reconfigurable in case of failure of one of the SEC, ELAC or FAC. In addition the ELACs are used to detect the excursion off the flight enveloppe (e.g. alpha prot). They inform the FMGC of such situations.

It seem that ELACs and SECs are autopilots themselves

No, AP is a separate function of the FMGC (and of the FAC).

FAC, ELAC, SEC are flight control computers, but are not equal.

• FAC (Flight Augmentation Computer) in particular is devoted primarily to rudder control, and all the associated functions (e.g. yaw damper). It is a main component of the autoflight system.

• Ailerons and elevators are directly controlled by the Flight Management and Guidance System (FMGS), which includes the autopilot.

Autoflight system presentation by Airbus:

The auto flight system (AFS) installed on the aircraft is made up of two types of computers :

• the flight management and guidance computer (FMGC)
• the flight augmentation computer (FAC)

and two types of control units :

• the flight control unit (FCU)
• the multipurpose control and display units (MCDU).

The functions of the FMGC are :

• autopilot (AP)
• flight director (FD)
• automatic thrust control (A/THR)
• flight management.

The functions of the FAC are:

• yaw damper
• rudder trim
• rudder travel limiting
• calculation of the characteristic speeds and flight envelope monitoring
• acquisition of the yaw AP order.

Redundant FMGS are divided in two functions: Command (issue commands to flight controllers) and Monitor (monitor the result of the commands, e.g. by analyzing air data and inertial data to detect anomalies).

The FMGS has different functions:

• It uses the navigation database containing aerodromes, waypoints, navaids, procedures, etc, for the routing of the aircraft.

• It takes into account aircraft performance data to manage the vertical aspects of the route.

• It controls navaid receivers (VOR, DME, ILS, etc) and use navigational data.

• It receives air data (from pitot, static pressure sensor, pitch angle probe) and inertial data.

• It monitors the progress of the aircraft on the route programmed into the flight plan.

• It issues flight guidance cues using the flight director indicators on the PFD.

• It takes into account short term instructions entered by the crew using the FCU, and long term instructions entered using the MCDU.

• It manages flight control laws and laws reconfiguration after controls failures.

• It is coordinated with the Autothrust system which, with the FADEC, control fuel flow and engine thrust (FMGC is interfaced with ECUs/EECs).

The manual way of controlling the aircraft is:

• FMGC gives instructions to the crew using the flight director cues and the yaw cue.

• The pilot follows the cues with the controls (rudder pedals, side stick)

• Pilot commands are taken into account by the flight control computers (FAC, SEC, ELAC) which determine the way control surfaces will be moved, possibly limiting the deflection ordered by the pilot to maintain the aircraft within its flight envelope.

• FAC, SEC and ELAC orders are sent to respective actuator controllers. Two notes on this transmission:

• There is a final control function on the actuator, to allow actuator redundancy for control surfaces, e.g. for elevators:

Each servojack has three control modes: Active: The jack position is electrically-controlled, Damping: The jack follows surface movement, Centering: The jack is hydraulically retained in the neutral position.
(Source)

• ELAC, SEC and FAC can be reconfigured according to law degradation status, the outputs of these FCC can be sent to different actuators, so the electrical circuit between an FCC output and an actuator input includes some switching circuitry.

Because of the two notes above, sending an electric order to the actuator doesn't mean the actuator will move the control surface, it depends on the current mode.

When the autopilot (AP) is engaged:

• The cues displayed by the FD and yaw indicators are converted directly into orders to the flight control computers. So AP is just automating what the pilot would have done when following the cues.

While in cruise only one AP can be engaged, landing may requires the two AP for automated approach and landing.

FMGS computer location

Source of all images: A320 family ATA-22 Autoflight Maintenance.

• There seems to be a small discrepancy in your and @ymb1 answers. You say "FAC, SEC and ELAC orders are sent to respective actuator controllers" while ymb1 says "ELAC is the computer that sends the commands via wires to the motors (hydraulic; electric)". So your answer makes it seem that there are further ACEs (actuator control electronics) after the ELAC/SEC while ymb1 makes it seem that the ELAC/SEC are ACEs themselves with further logic for flight envelope protection, etc. – space_voyager Dec 28 '17 at 12:42
• @space_voyager - No discrepancy to worry about, mins was more thorough, I focused on where the AP 'lived'. You can see part of that logic you refer to in the diagram in my answer (logic diagram). – ymb1 Dec 28 '17 at 17:30

Turning on the switch autopilot on/off changes a circuitry, just like a light switch. A passive FMGS receives the signal, and becomes active, taking over sending out commands as it has been programmed by the crew.

When the Autopilot (AP) is engaged, the Flight Management and Guidance Computer (FMGC) sends AP commands to the ELACs (Airbus maintenance manual).

Normally you can't program a stall, but you can close the thrust levers with the autopilot still engaged. Let's say the FMGS was flying straight and level, the speed will start to decay.

What does the FMGS do? For simplicity let's put aside the multi-channel redundancy and have one of each system. The FMGS wants to fly straight and level, as the speed decays, the lines of code say pitch up. It will keep pitching up until it's about to stall.

Who stops the stall and protects the flight envelope? The ELAC does.

But how does the ELAC know? The ADIRU is in touch with ELAC and is screaming commands at it. ELAC will understand it's time to turn off the FMGS light, and listen to the ADIRU and execute the protection program.

Note: ELAC is the computer that sends the commands via wires to the motors (hydraulic; electric) after fine tuning the inputs based on its programming.

So where does the AP live? It lives in the FMGS, and the AP should not be confused with the flight envelope protection.