Is it possible to totally override the flight computer on the Airbus A320-family (in simple non-technical terms)?

Question

As I know, in the autopilot oriented airplanes like an A321 the plane doesn't let the pilots pitch down when the plane gets an over-speed warning.

So what if the pitot-static system isn't working properly and the plane is stalling but the flight management systems doesn't let the pilots pitch down?

What will happen? Will the plane crash or is there a button on the FMC that disables all the auto management and autopilot functions so the pilots can do whatever they want in an emergency?

How does it work without being too technical so someone like me can understand?

Answer 1

Autopilot vs FMS vs protection

The autopilot does not prevent a nose down, this task is done by the envelope protection, which is a different flight computer.

The FMS is what sends the autopilot commands, i.e., the autopilot is part of the FMS. The pilot interface with the autopilot is the CDU (which is basically a keypad and a screen), and the FCU (the autopilot panel on the glareshield).

When flying, it's either the pilot or the autopilot in control, it can't be both. (There are exceptions but this is to keep it simple.)

The commands of either are sent to a flight control computer, this is where the envelope protection lives.

Like any computer, there is input (stick forward), and output (elevator down).

The envelope protection has an additional input that comes from another computer, the ADIRU, and one of the ADIRU's inputs is the pitot-static system, so it can decide if pitching down is safe or not before sending the output.

If the ADIRU says the plane is over-speeding, the envelope protection will not pitch down.

• What happens if the pitot-static is not working properly?

The engineers thought about your question, and decided to have 2 or 3 of each computer and pitot-static system.

The multiple ADIRUs are always chatting, making sure the inputs they get from each pitot-static system is similar. If they notice, by voting, that one of the data sources is not similar to the other two, the ADIRUs will tell the flight control computer, "our data is bad, don't trust it."

The advanced flight control computer will stop sending output and will disconnect the autopilot if it is engaged, then another simpler flight control computer will give more control to the pilots.

The pilots will be shown on their screens that there is an ADIRU issue, and from their training they will know what to do (memory items) to keep the plane from stalling (your example), and then they will run their checklists to make sure the ADIRU that is getting bad data is no longer voting. This is called a degraded fly-by-wire mode, i.e., not all the functions of the envelope protection are working.

---

The drawing is own work, which is a simplified version of the actual schematic.

Answer 2

First of all, I want to clear one thing. An Airbus when flown manually is like any other aircraft. It is not autopilot oriented. Only when the extremities of the aircraft envelope is hit do the protections activate. And these protections help the pilot in many situations. I would not go into the details, as it is beyond the scope of the question. But if you are interested you can go to this link:

https://www.quora.com/Do-you-believe-that-Airbuss-philosophy-of-prioritizing-the-autopilot-over-the-pilot-and-not-permitting-the-latter-to-stress-the-aircraft-in-critical-situations-jeopardizes-safety-Would-you-prefer-a-Boeing-or-Airbus/answer/Anas-Maaz-1

So, can the Airbus protections be turned off? The simple answer is, Yes. If required it can be manually turned off and the aircraft control laws degraded from normal law to alternate law.

The easiest way to do it is to turn of two ADR (Air data reference) computers. There are three of them in Airbus aircraft. Once two are off, the flight control computers no longer have enough data from various sensors (pitot tubes, static ports, AOA sensors etc) to validate the information they receive. So, they will simply downgrade the control laws. Once the two ADRs are off all protections are lost except the load factor protection, which goes out only when the aircraft downgrades further into the direct law (in A320, direct law is activated as soon as gear is down in alternate law). We do this, when we practice stall and upset recoveries in the simulator. The instructor turns off the two ADRs and the fun begins.

The red boxes mark the three ADR control switches. You can turn two of them off to downgrade to alternate law. The mistake you can do here is turning off them using the knobs. Because if you do that the IR data will also go out. Keep in mind we want to get rid of air data not inertial data. Generally, ADR 2 and ADR 3 are switched off. Source:https://www.flickriver.com/photos/medau/4890404665/

The switching off ADRs cannot be found in the aircraft FCOM or the FCTM. Nevertheless, it is little secret all Airbus pilots are aware of. When I did my type rating on the aircraft, I learnt it when our instructor shut them off to practice stalls. Airbus however, mentioned the procedure in the Airbus initial type training course guide. There was a time though when Airbus had the procedure as a temporary OEB (Operational engineering bulleting) after a Lufthansa A321 suffered a spurious high angle of attack protection activation due to two faulty AOA sensors. The pilots were only able to control the aircraft by forcing it into alternate law by switching off ADR 2 and ADR 3 which was already rejected by the computers. The OEB Airbus released, numbered OEB 48, was there in the aircraft QRH until they got new angle of attack sensor modifications.

Here is a link to the BFU report:

https://www.bfu-web.de/EN/Publications/Interim_Reports/IR2014/I1_Report_14_6X014_A321_Pamplona.pdf?__blob=publicationFile

The OEB 48. Source: https://flightacademy.info/oeb-48-abnormal-v-alpha-prot

The aircraft can also go into alternate law automatically if it detects erroneous data. For example, if two of the three ADRs give conflicting data, the computers can again no longer validate the data and simply force the aircraft into alternate law.

Then there is an abnormal attitude law. This law activates if the aircraft gets into a position where computers can no longer keep it in the envelope. Keep in mind that even though the aircraft is protected, in very tight situations things can go beyond the protections. In this case also the protections are turned off and alternate law activated which allows pilot to maneuver out of the situation. For the A320 the abnormal attitude law activates if any of the following conditions are met:

• Bank angle above 125 °
• Pitch attitude above 50 ° nose up or below 30 ° nose down
• Speed below 60 to 90 kt (depending on the aircraft pitch attitude), or above 440 kt
• Mach above 0.91
• Angle of attack above 30 ° to 40 °, or below -10 °