As I know, in the autopilot oriented airplanes like an A321 the plane doesn't let the pilots pitch down when the plane gets an over-speed warning.

So what if the pitot-static system isn't working properly and the plane is stalling but the flight management systems doesn't let the pilots pitch down?

What will happen? Will the plane crash or is there a button on the FMC that disables all the auto management and autopilot functions so the pilots can do whatever they want in an emergency?

How does it work without being too technical so someone like me can understand?

  • 5
    $\begingroup$ Possible duplicate of How does envelope protection work in Airbus vs. Boeing aircraft? $\endgroup$ – ymb1 Oct 14 '18 at 20:30
  • 1
    $\begingroup$ As the linked post says, "(...) the system disconnects features by itself if failures are detected, to allow control in degraded mode," i.e., "If pitot static system isn't working properly," the envelope protection (not to be confused with the autopilot) will step aside and let the pilot take the correct action. $\endgroup$ – ymb1 Oct 14 '18 at 20:30
  • 2
    $\begingroup$ There are more than one computers and they vote. When the vote has a tie then all computers gives in and hope the pilot could take over. $\endgroup$ – user3528438 Oct 14 '18 at 20:54
  • 2
    $\begingroup$ Well, voting is simple. There's simply not enough to write into an article unless being deeply technical. $\endgroup$ – user3528438 Oct 14 '18 at 21:50
  • 1
    $\begingroup$ Based on your comment, I've modified the question to request a simple answer. $\endgroup$ – ymb1 Oct 14 '18 at 23:15

First of all, I want to clear one thing. An Airbus when flown manually is like any other aircraft. It is not autopilot oriented. Only when the extremities of the aircraft envelope is hit do the protections activate. And these protections help the pilot in many situations. I would not go into the details, as it is beyond the scope of the question. But if you are interested you can go to this link:


So, can the Airbus protections be turned off? The simple answer is, Yes. If required it can be manually turned off and the aircraft control laws degraded from normal law to alternate law.

The easiest way to do it is to turn of two ADR (Air data reference) computers. There are three of them in Airbus aircraft. Once two are off, the flight control computers no longer have enough data from various sensors (pitot tubes, static ports, AOA sensors etc) to validate the information they receive. So, they will simply downgrade the control laws. Once the two ADRs are off all protections are lost except the load factor protection, which goes out only when the aircraft downgrades further into the direct law (in A320, direct law is activated as soon as gear is down in alternate law). We do this, when we practice stall and upset recoveries in the simulator. The instructor turns off the two ADRs and the fun begins.

enter image description here

The red boxes mark the three ADR control switches. You can turn two of them off to downgrade to alternate law. The mistake you can do here is turning off them using the knobs. Because if you do that the IR data will also go out. Keep in mind we want to get rid of air data not inertial data. Generally, ADR 2 and ADR 3 are switched off. Source:https://www.flickriver.com/photos/medau/4890404665/

The switching off ADRs cannot be found in the aircraft FCOM or the FCTM. Nevertheless, it is little secret all Airbus pilots are aware of. When I did my type rating on the aircraft, I learnt it when our instructor shut them off to practice stalls. Airbus however, mentioned the procedure in the Airbus initial type training course guide. There was a time though when Airbus had the procedure as a temporary OEB (Operational engineering bulleting) after a Lufthansa A321 suffered a spurious high angle of attack protection activation due to two faulty AOA sensors. The pilots were only able to control the aircraft by forcing it into alternate law by switching off ADR 2 and ADR 3 which was already rejected by the computers. The OEB Airbus released, numbered OEB 48, was there in the aircraft QRH until they got new angle of attack sensor modifications.

Here is a link to the BFU report:


enter image description here

The OEB 48. Source: https://flightacademy.info/oeb-48-abnormal-v-alpha-prot

The aircraft can also go into alternate law automatically if it detects erroneous data. For example, if two of the three ADRs give conflicting data, the computers can again no longer validate the data and simply force the aircraft into alternate law.

Then there is an abnormal attitude law. This law activates if the aircraft gets into a position where computers can no longer keep it in the envelope. Keep in mind that even though the aircraft is protected, in very tight situations things can go beyond the protections. In this case also the protections are turned off and alternate law activated which allows pilot to maneuver out of the situation. For the A320 the abnormal attitude law activates if any of the following conditions are met:

  • Bank angle above 125 °
  • Pitch attitude above 50 ° nose up or below 30 ° nose down
  • Speed below 60 to 90 kt (depending on the aircraft pitch attitude), or above 440 kt
  • Mach above 0.91
  • Angle of attack above 30 ° to 40 °, or below -10 °
  • $\begingroup$ Nice answer. Also what exactly happens if you disable the inertial reference too? $\endgroup$ – Delta Oscar Uniform Dec 10 '20 at 13:24
  • 2
    $\begingroup$ @DeltaOscarUniform You will lose almost everything. Pitch data, heading data and even the GPS so basically even the navigation. And it is irreversible in flight. $\endgroup$ – Anas Maaz Dec 10 '20 at 13:35
  • 1
    $\begingroup$ Excellent answer from someone who has "been there, done that". $\endgroup$ – FreeMan Dec 10 '20 at 17:09
  • $\begingroup$ @AnasMaaz "it is irreversible in flight" ? Really? Are you saying it can't be turned on again? What is supposed to happen, if someone would accidentally (or not) turn that thing off? Are you saying you'd have no more attitude indicator and you can't turn back on? I can't believe it... $\endgroup$ – kebs Jan 19 at 9:54

Autopilot vs FMS vs protection

The autopilot does not prevent a nose down, this task is done by the envelope protection, which is a different flight computer.

The FMS is what sends the autopilot commands, i.e., the autopilot is part of the FMS. The pilot interface with the autopilot is the CDU (which is basically a keypad and a screen), and the FCU (the autopilot panel on the glareshield).

When flying, it's either the pilot or the autopilot in control, it can't be both. (There are exceptions but this is to keep it simple.)

The commands of either are sent to a flight control computer, this is where the envelope protection lives.

enter image description here

Like any computer, there is input (stick forward), and output (elevator down).

The envelope protection has an additional input that comes from another computer, the ADIRU, and one of the ADIRU's inputs is the pitot-static system, so it can decide if pitching down is safe or not before sending the output.

If the ADIRU says the plane is over-speeding, the envelope protection will not pitch down.

  • What happens if the pitot-static is not working properly?

The engineers thought about your question, and decided to have 2 or 3 of each computer and pitot-static system.

The multiple ADIRUs are always chatting, making sure the inputs they get from each pitot-static system is similar. If they notice, by voting, that one of the data sources is not similar to the other two, the ADIRUs will tell the flight control computer, "our data is bad, don't trust it."

The advanced flight control computer will stop sending output and will disconnect the autopilot if it is engaged, then another simpler flight control computer will give more control to the pilots.

The pilots will be shown on their screens that there is an ADIRU issue, and from their training they will know what to do (memory items) to keep the plane from stalling (your example), and then they will run their checklists to make sure the ADIRU that is getting bad data is no longer voting. This is called a degraded fly-by-wire mode, i.e., not all the functions of the envelope protection are working.

The drawing is own work, which is a simplified version of the actual schematic.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.