More on the difference between Airbus and Boeing control systems

An MR reader writes to me:

Chances are you have received an email similar to this from other airline pilots, but in the off case you have not:

The article you posted contains what I believe to be some oversimplifications of the A/B control system philosophy differences.

It’s commonly stated that the Airbus will override the pilot and the Boeing will not.  This isn’t entirely true.

A more accurate statement would be this:  All jet aircraft have override/feedback systems that will warn or resist the pilot at the edges of the aerodynamic envelope.  Airbus has a slightly larger number of these systems, and they are set to trigger slightly earlier.

Both aircraft will automatically throttle back if in an overspeed condition.
Both aircraft will automatically shake the yoke, and then automatically push over, in a stall condition.


Airbus, in addition, will limit max G forces on the aircraft.  Boeing does not.

The advantage of the Airbus approach is that you can haul back on the stick as hard as you want without breaking the aircraft (and turning it into several smaller, less-airworthy aircraft).  You are limited to G forces that produce no damage to the aircraft.

The advantage of the Boeing approach is that you can generate any g forces you want.  This gives you the opportunity to fly in the region that generates enough G to bend the aircraft, but not to break it.  That extra G force may help you avoid a mountain.  Of course, you may extend into the part of the envelope that breaks the aircraft.

These differences are relatively minor, as the vast majority of crashes do not occur at the edges of the envelope, and are categorized as CFIT (Controlled Flight Into Terrain).  When within the aerodynamic envelope, Boeing and Airbus aircraft are usually under the control of the same sort interchangeable flight management computers.

Both the Asiana (Boeing) and Air France (Airbus) crashes were caused by crew that did not understand the systems of the aircraft they were flying.  Both aircraft impacted terrain under full control.


One of the more interesting situations arises at the transition of automation and manual modes in the Airbus philosophy. The issue always is, how does automation respond when it goes into a fault condition and cannot make sense of its state.

e.g. The transition from one flight law to another in Airbus controls. When you go from Normal Law to Alternate I think you lose stall protection. For a pilot used to flying under alpha protection this may be a critical transition especially if he doesn't realize it.

My impression is how to handle failure modes gracefully is going to be critical for all the "driverlesss" gadgets we come up with.

PS. I'm no pilot so I may be wrong about the details.

This gives me great comfort, except when I am reminded of those classic Yale psych experiments where the guy in the lab coat (think: Boing, Airbus automated systems) kept telling the person to give shocks to the guy in the other room despite his screams.

Is the automated system "warning or telling" the pilot what to do the guy in the lab coat? What if the guy in the lab coat is relying on poor data from another part of the system.

System error, or override system?

What did the guy getting instructions from the guy in the lab coat do?

'System error, or override system?'

Well, there was also this incident -

'Flight 611's pilots on the Boeing jet initially followed the TCAS instructions and initiated a descent, but could not immediately inform the controller due to the fact that he was dealing with Flight 2937. About eight seconds before the collision, Flight 611's descent rate was about 2,400 feet per minute (12 m/s), not as rapid as the 2,500 to 3,000 ft/min (13 to 15 m/s) range advised by TCAS. The Russian pilot on the Tupolev disregarded the TCAS instruction to climb and instead began to descend, as instructed by the controller, thus both planes were now descending.[BFU 1]

Unaware of the TCAS-issued alerts, Nielsen repeated his instruction to Flight 2937 to descend, giving the Tupolev crew incorrect information as to the position of the DHL plane. Maintenance work was being carried out on the main radar system, which meant that the controllers were forced to use a slower system.'Überlingen_mid-air_collision

Essentially, if both pilots had followed TCAS instructions, instead of only one, the collision would not have occurred. In this case, the system error involved disregarding the safety equipment designed to prevent what actually happened - a mid-air collision.

prior, You actually have a more interesting variant, and one which is more consistent with the point I made. In your example, the machine spoke, and another human being told a different human being to ignore the machine. This is more like the Yale experiment. Posit what would have happened had the person in the control tower had not given assurances to override the technical system.

Actually, I believe, the person in the control tower was unaware of the TACS instructions (this incident was a regional story from the point it happened, to the jailing of the man that murdered the air traffic controller - including the fact that the Karlsruhe air traffic controllers tried to get in touch with the Swiss controller to prevent the accident). In addition, (military) pilots in the (Soviet) Russian system are taught to blindly follow the instructions of ground controllers.

The real problem with something like the TACS system is that people do override it, instead of blindly following it.

The FAA (not sure about other aircraft regulatory bodies) continues to insist that TCAS RAs (resolution advisories, when TCAS tells the pilot to maneuver, as opposed to Traffic Advisories, where TCAS alerts the pilot to traffic in the area) must be confirmed visually before pilot action; every pilot I know (and I know quite a few) calls BS on that and will try to visually confirm an RA but will also follow it within a couple of seconds regardless of visual confirmation success. Every pilot with lots of time in TCAS-equipped aircraft has stories of RAs that couldn't be visually confirmed until after the event, and invariably the RA was correct. The FAA needs to get its head out of its ass about TCAS.

Econo-junk speak for airplane crash: "Controlled Flight Into Terrain."

Nope. CFIT is a subset of crashes. Not all crashes are CFITs.

then it should be called a "controlled crash into terrain." instead, the use of the word "flight" is an evasive euphemism for crash.

More like aero-speak for "flew the plane straight into a mountain" as opposed to a failure of the aircraft.

Yes - exactly. Or a marsh, or the sea, or whatever. "Pilot error". Somebody - the pilot or the ATC - missed a precious bit of available data, and voila - boom.

Regarding pilots and automation, here's an interesting comment I found on slashdot:

I'm a manager at a world leading flight training company targeting major airlines all around the world, we train cadets from scratch on small aircraft and flight simulators in order to develop these basic skills and beyond (eg: ATPL and HPAT, type specific training etc.). I assist with developing syllabi and ensuring their compliance with numerous safety authorities all over the world. We looked into the Air France disaster to see how we can improve out syllabi to give students the skills to handle these atypical situations. To make a long story, the growing trend for airlines to want to cut costs on training and even remove what they call "unnecessary" training from syllabi is what is leading to this problem. The MPL is the prime example of this, this is my solution:
- Stop treating us like a factory, each student is different and can they can take longer to learn certain concepts. Fixed length integrated courses don't work if they don't have good margins for this.

- English is the language of aviation. If you bring us cadets who can't speak it, we have to teach them english within your timetable which degrades outcomes.
- Redo the MPL and bring back spinning, hand and feet skills etc.
- Whilst the MPL has a heavy focus on simulators, it needs to be a much bigger part of their renewals and professional development in order to re-enforce what they learnt during early stages of their career and training when they start working.
- Some airlines have poor quality control in their recruitment phases, is susceptible to corruption or have too many "token" cadets. Some people just aren't cut out to be pilots, identify this early not late.
- Airline and safety authority audits are a joke, Standards/QA Manager(s) should be mandatory, I've seen our competitors teach students very bad techniques because of a bad instructor or two and it poisons entire batches of students. Auditing needs to be proactive, integrated into systems and workflows and not just a visit a few times a year. to look through paper records or merely reactive in the case of a safety incident.
Remember, the training doesn't stop when the student is finished their course. Operators and manufacturer (Airbus, I'm looking at you) need to stop treating pilots like bus drivers and focusing only on fuel optimisation.
- This is minor but still important. Shock material. We aren't allowed to show students the imagery of air disasters any more. They can be and usually are gruesome by statistically effective, safety incidents in classes that were shown this material were halved compared to classes that weren't.

This opinion is my own and doesn't reflect that of my employer, doing it anonymously because our media policy prohibits these types of comments. I'd love to hear people's feedback on how training could be furthered improved, it's what gets me up in the morning, trying to fight the system.

English, or lack thereof, and the nuisances of a New York accent, were at play in Brazil when that private jet collided with a jumbo a while ago. Habla Espanol?¿. Also at play was the fact that under GPS guidance the planes impacted almost dead on since erroneously programmed on the same flight path by the control tower--had GPS not been used more "slop" would have been present and the planes would likely not have collided. Further, the New York plane had its ID transponder turned off by mistake. Miraculously in that crash the smaller NY plane survived, and even more amazing, the NY pilots were not imprisoned, since ultimately it was deemed the Brazilian control tower was at fault more than the NY pilots.

Another thing that fascinates me is the "coffin corner", the part of the flight envelope where a plane cannot escape the forces that cause it to crash, no matter how skilled the pilot is. I've read somewhere that it takes about a minimum of 30 seconds for a jumbo to reach the "coffin corner". If so, that means a suicidal or inattentive pilot who is not on auto-pilot can crash a jumbo jet in a minimum of less than a minute, from any altitude (obviously at a very low altitude he can do it faster, but I'm taking about any altitude, even a high altitude). Is that apparent severe CAT (Clear Air Turbulance) air pocket drop really the result of CAT or is the insane pilot muttering "Tawakkalt ala Allah" (I rely on God) as in EgyptAir 990? If the drop lasts more than a few seconds or say ten seconds you best make your final prayers. Happy flying!

They are mandated by their stockholders to treat you like a factory. Reduction of costs, especially employee costs, is the best way to maximize profits. And if it leads to airplane crashes, who cares? Neither the courts nor the government will hold the airline company or manufacturer liable. Besides, it's not really a crash anyway, it's only a CFIT.

Yep, having your planes crash always perks up the stock price.
Notice how they always happen towards the end of the quarter?

I am waiting for this suspense thriller to appear:

Large plane overtaken by terrorists heads towards a nuclear power plant.

Pilot, still in control, with a gun at his head tries to destroy the airplane by doing plane destructive maneuvers.

But, the airplane system overrides the pilot.

Pilots = ZMP hostages.

I like the idea, but won't it override the terrorists who want to crash into the nuclear plant too? And why didn't the terrorists bring their own pilot?

OK, how about this: The terrorist brought his own autopilot and was trying to install it in the system while the human pilot was trying to death maneuvers.

How about a GPS spoofer that makes the nuclear power plant look like it's the main runway?


There goes my faith in the machine.

And Bruce Willis could star in it. We'll call it Die Hard 2.

In terms of current Boeing technology, this writeup of the experience of a United 777 pilot becoming rated on the new 787 is fascinating. I don't think the stereotypes of Airbus vs Boeing philosophy differences remain as stark differences the way they - perhaps - once were.

@ Gary Leff - good link

Pilot says this: "A computer nerd would describe the 787 as 17 computer servers packaged in a kevlar frame. The central brains is the Common Core System (CCS). Two Common Computing Resources (CCRs) coordinate the communications of all the computer systems, isolating faults and covering failed systems with working systems. When battery power is first applied to the airplane in the morning, it takes about 50 seconds for the L CCR to boot up. After this, a few displays light up and you can start the APU. If there is a major loss of cockpit displays, this may require a CCR reboot, which would take about a minute. "

And I was thinking: fifty seconds is too long, since the 'coffin corner' (see upstream in this MR post) is about that long.

Then, in the comments section, I read this: "Andras said,Wow! The only thing I am concerned about the 50sec boot time..."

Happy flying! Yes I think flying is safe and I'm not worried about it. Chances are if power is lost it will be when the plane is on autopilot (e.g., say due to a severe lightning strike) and the control surfaces of the plane should not change radically, if at all, if power is lost. It's unlikely that power will be lost when a pilot is making a radical maneuver, since most of the time such maneuvers are not being made. Of course if power is already lost, it's possible that a radical maneuver is being made, but that's confusing cause and effect.

Difficult to see the overall point in these discussions. Seems to be some random armchair gee-whiz curiosity about commercial piloting and planes, in an economics blog. But it is a slow week.

The Airbus versus Boeing debate is like the Apple versus Microsoft -- all over the internet for a long, long time.

Commercial flying is safer than ever. Boeing aircraft have a better overall safety record (fatal crashes per total sorties) than Airbus, but it is hard to isolate "design philosophy" in causation analysis. The leading cause of aircraft mishaps everywhere has always been "pilot error" since the Wright Brothers. Pilots not understanding how their critical aircraft systems operate -- fits that category, no matter who designed the aircraft. Each flight is a choice for both pilots and passengers.

I agree. A lot of commenting from keyboard warriors that seem to think that googling, wikipedia with a quick copy and paste enables compentency to comment on aviation matters.

Regarding "pilot error", while this is certainly the cause of many accidents, the NTSB will spend months analyzing what startled pilots did in the space of a few seconds. It's much easier to determine the proper course of action sitting on the ground and studying the data for over a year . Doing this on the flightdeck in a time sensitive emergency with conflicting and confusing information is somewhat more difficult.

The impact of the difference in Boeing vs. Airbus control philosophies is likely overshadowedI by the trend toward fewer ex-military pilots in the airline industry (Uncle Sam has decreed ever-longer service commitments for his pilots which, combined with large retention bonuses, and retirement after 20 years strongly incentivizes military pilots to stay in). I've had flight training in both the civillian and military programs; the latter are an order of magnitude better: lots of flight time, training that uses very complex machines, and the budget to take those complex machines up and repeat emergency scenarios again and again and again and again. Looking at the Air France crash through that lens, my thoughts were "how does some jackass claim to be a professional pilot and not instantaneously (and without thinking!) respond to a stall by maxing the throttle, relaxing the stick, and rolling level? Compare Chesley Sullenberger (former Captain, USAF), who managed to glide to a water landing that not only didn't break everyone's back, but also left the airplane in one piece.

Maybe in the good old days of unlimited Pentagon bucks. The military pilots I know barely get enough hours to stay current.

Maybe government subsidies to airline training were a good thing.

I fly around Asia a fair bit, often to smaller cities on budget airlines, and the transfer of flight control from the 20-something pilot to HAL can't happen soon enough.

Almost all accidents in the region are due to pilot decision: Lion crash in Bali, runway in Taipei, suicide over Sumatra etc.

Good one on the Sumatra crash, and it confirms what I said upstream about the coffin corner: takes less than a minute to reach in a jumbo jet, best case: "The time it took the aircraft to dive from cruise altitude to the river was less than one minute. The plane was traveling faster than the speed of sound for a few seconds before impact" (Wikipedia on SilkAir Flight 185)

My big problem in the Boeing-vs-Airbus debate isn't cockpit automation; it's fault detection and isolation in the flight-critical sensors: the inertial system, the GPS, the air data. I work with some of the world experts in this kind of stuff (and I'm not too bad at it either, if I do say so myself), and Airbus is much weaker in this area. For an example, see this: These kind of failures are currently rare because the underlying hardware is pretty reliable, but as cockpit automation increases and the sophistication of the flight control laws increase too, there will be more opportunities for these kind of glitches to cause problems. I admit that because of this, I avoid Airbus aircraft when feasible, just like I avoided Boeing 737s for a while until they figured out and fixed the rudder actuator problem that led to multiple crashes.

The airfrance control issue is very distinct:

When two pilots were operating the controls simultaneously, the control software 1) averaged their control inputs together and 2) have no warning about this. This is not how a traditional man-machine interface functions and therefore was surprising.

This design decision killed hundreds. It has nothing to do with design philosophy in the sense of override the pilot or not. It has to do with the challenge of specifying and implement a complex system and having corner cases that the designer must decide to handle. As an engineering manager, my experience is identifying, discussing and testing these corner cases is a significant portion of the program effort. In digital systems, it's particularly easy to resolve a corner case without physical intuition. So this problem has gotten worse as we've moved from mechanical to digital controls.

This the same problem we see in the design of complex laws.

'This design decision killed hundreds.'

Not really - the decision to continue to use equipment which did not give accurate air speed readings, and in having pilots at the controls that did not understand the plane was in an aerodynamic stall, are what caused a passenger airliner to literally drop from the sky into the ocean, engines running at full power - 'The aircraft remained stalled during its entire 3 minute 30 second descent from 38,000 feet.'

This is the crux of the actual matter - 'While the inconsistent airspeed data caused the disengagement of the autopilot, the reason the pilots lost control of the aircraft remains something of a mystery, in particular because pilots would normally try to lower the nose in case of a stall.[171][172][173] Multiple sensors provide the pitch (attitude) information and there was no indication that any of them were malfunctioning.' There is simply no explanation why the pilots at the controls during this descent did not understand such a basic fact.

"When two pilots were operating the controls simultaneously, the control software 1) averaged their control inputs together and 2) have no warning about this. This is not how a traditional man-machine interface functions and therefore was surprising."

That's just a blatant flaw. In most scenario's averaging both inputs is worse than just randomly picking one or the other.

Also, "man-machine interface" has been declared sexist and the new PC approved vernacular is human-machine interface (HMI). ;)

I can only speak as a passenger, but one with tons of frequent flyer miles having flown 'way too many red-eyes.
The Airbus fidgets as it flies. It constantly corrects itself, almost fluttering as it flies.This is not turbulence; in ordinary flight it constantly makes small readjustments that are noticeable.
You can watch the wing making these constant slight adjustments.
The Boeing is a smoother ride, with no fidgeting. The wings are steady.

Out of curiousity, which Airbus and which Boeing are you talking about when you say one is fidgety and one is a smoother ride?

Comments for this post are closed