As I know, in the autopilot oriented airplanes like an A321 the plane doesn't let the pilots pitch down when the plane gets an over-speed warning.

So what if the pitot-static system isn't working properly and the plane is stalling but the flight management systems doesn't let the pilots pitch down?

What will happen? Will the plane crash or is there a button on the FMC that disables all the auto management and autopilot functions so the pilots can do whatever they want in an emergency?

How does it work without being too technical so someone like me can understand?

  • 5
    $\begingroup$ Possible duplicate of How does envelope protection work in Airbus vs. Boeing aircraft? $\endgroup$ – ymb1 Oct 14 '18 at 20:30
  • 1
    $\begingroup$ As the linked post says, "(...) the system disconnects features by itself if failures are detected, to allow control in degraded mode," i.e., "If pitot static system isn't working properly," the envelope protection (not to be confused with the autopilot) will step aside and let the pilot take the correct action. $\endgroup$ – ymb1 Oct 14 '18 at 20:30
  • 2
    $\begingroup$ There are more than one computers and they vote. When the vote has a tie then all computers gives in and hope the pilot could take over. $\endgroup$ – user3528438 Oct 14 '18 at 20:54
  • 2
    $\begingroup$ Well, voting is simple. There's simply not enough to write into an article unless being deeply technical. $\endgroup$ – user3528438 Oct 14 '18 at 21:50
  • 1
    $\begingroup$ Based on your comment, I've modified the question to request a simple answer. $\endgroup$ – ymb1 Oct 14 '18 at 23:15

Autopilot vs FMS vs protection

The autopilot does not prevent a nose down, this task is done by the envelope protection, which is a different flight computer.

The FMS is what sends the autopilot commands, i.e., the autopilot is part of the FMS. The pilot interface with the autopilot is the CDU (which is basically a keypad and a screen), and the FCU (the autopilot panel on the glareshield).

When flying, it's either the pilot or the autopilot in control, it can't be both. (There are exceptions but this is to keep it simple.)

The commands of either are sent to a flight control computer, this is where the envelope protection lives.

enter image description here

Like any computer, there is input (stick forward), and output (elevator down).

The envelope protection has an additional input that comes from another computer, the ADIRU, and one of the ADIRU's inputs is the pitot-static system, so it can decide if pitching down is safe or not before sending the output.

If the ADIRU says the plane is over-speeding, the envelope protection will not pitch down.

  • What happens if the pitot-static is not working properly?

The engineers thought about your question, and decided to have 2 or 3 of each computer and pitot-static system.

The multiple ADIRUs are always chatting, making sure the inputs they get from each pitot-static system is similar. If they notice, by voting, that one of the data sources is not similar to the other two, the ADIRUs will tell the flight control computer, "our data is bad, don't trust it."

The advanced flight control computer will stop sending output and will disconnect the autopilot if it is engaged, then another simpler flight control computer will give more control to the pilots.

The pilots will be shown on their screens that there is an ADIRU issue, and from their training they will know what to do (memory items) to keep the plane from stalling (your example), and then they will run their checklists to make sure the ADIRU that is getting bad data is no longer voting. This is called a degraded fly-by-wire mode, i.e., not all the functions of the envelope protection are working.

The drawing is own work, which is a simplified version of the actual schematic.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.