Airbus Fly-by-Wire, Normal Law, and the Flight Envelope Protection That Won't Let the Airplane Stall

Pull the sidestick full aft on an Airbus A320 in Normal Law, hold it in your lap, and the airplane will not stall. It climbs until it runs out of energy, settles into a nose-high mush at the edge of the envelope, and refuses to drop a wing. That behavior isn’t aerodynamics - it’s software deciding what your control input is allowed to mean, and it represents one of the most consequential design choices in the history of the airliner.

What Does Fly-by-Wire Actually Mean?

For most of aviation history, moving the yoke physically moved the control surfaces. Cables, pushrods, pulleys, and bellcranks ran the length of the airplane, and on larger aircraft hydraulics took the load off the pilot’s arms. Either way, there was a mechanical path from your hands to the flying surfaces. You could feel the airplane, and the airplane could feel you.

Fly-by-wire cuts that cable. When you move a fly-by-wire sidestick, you move a transducer - an electrical sensor that measures how far and how hard you pushed. That signal travels to a bank of computers, which decide what the surfaces should do and send electrical commands to hydraulic actuators on the wing and tail. The “wire” is literally an electrical wire carrying your intention as a number instead of a cable carrying it as tension.

Why Airbus’s Sidestick Commands a Result, Not a Position

Once a pilot’s input becomes a number and a computer sits in the middle, the designers face a profound choice: they get to decide what that number means.

One option is to keep the old meaning - stick back equals elevator up, one to one. That’s called a direct law, and the airplane flies like a conventional aircraft with wires replacing cables. Nothing clever.

When Airbus built the A320 in the 1980s, they made a different choice. In Normal Law, pulling back on the sidestick does not command the elevator to move up. It commands a load factor - a certain amount of G. Release the stick at neutral and you’re asking for 1 G, meaning the flight path you already have. The computers then move whatever surfaces are needed, by whatever amount is needed, to deliver that result and hold it.

That design has a powerful side effect. If the airplane holds 1 G whenever you release the stick, it holds its flight path. Trim it, take your hand off, and it stays. Hit turbulence and the computers counter the gust before you fully feel it, because a gust is simply an uncommanded change in G - and keeping G where you put it is the system’s entire job. Airbus pilots describe the airplane as uncannily stable, almost glued to its path. That stability isn’t aerodynamic. It’s a computer holding a number roughly a hundred times a second.

How Flight Envelope Protection Stops a Stall

Layered on top of that load-factor control is the protection that earns Normal Law its reputation. The system continuously monitors the entire flight envelope: angle of attack, airspeed, load factor, bank angle, and pitch attitude. As you approach an edge, the law changes what your stick inputs can do.

Consider the stall. In a conventional airplane, nothing stops a clumsy pilot from pulling into a full stall and even a spin - the airplane will let you kill yourself. On the Airbus, as angle of attack climbs, you reach alpha prot, the protection angle, and the stick stops commanding G and begins commanding angle of attack directly. Pull harder and you get more alpha, but only up to a hard limit called alpha max, which sits just below the actual stalling angle. Full aft stick delivers alpha max and not one degree more. The wing keeps flying, the ailerons and roll spoilers keep working, and in Normal Law you cannot stall it and you cannot spin it.

The other protections reinforce that envelope:

Bank angle protection: roll past 67 degrees and release the stick, and the airplane rolls itself back to 33 degrees.
Pitch attitude protection: the nose is limited to 30 degrees up and 15 degrees down.
High-speed protection: in a dive approaching never-exceed speed, the nose gently rises on its own to prevent overspeed.
Low-energy warning: the aircraft calls “speed, speed, speed” when the flight path is decaying, prompting the pilot to add thrust before falling behind the power curve.

Why Did Airbus Build Hard Protections?

The lazy explanation is that Airbus didn’t trust pilots. The real reason lives at the edges of the envelope during an emergency.

Picture a windshear encounter on approach, a ground-proximity warning at night in the mountains, or a traffic resolution advisory commanding an immediate climb. In every case the correct response is to pull hard and extract maximum performance from the wing right now. The classic, fatal failure mode is a startled pilot who either pulls too little and hits the terrain, or pulls too much and stalls into it.

Envelope protection collapses that decision. In an escape maneuver on an Airbus, you pull the stick full aft and leave it there. The airplane goes to alpha max - the ragged edge of maximum lift - and holds exactly there, wringing out every pound of performance physics allows, with no stall and no guesswork. For that one job, the protection is worth an enormous amount.

The Cost: Alternate Law and Air France 447

The protection only exists when the computers have good data and healthy systems. Normal Law depends on knowing airspeed and angle of attack. Feed the computers bad numbers and the edifice comes down: the system degrades into what Airbus calls Alternate Law, where most protections - including stall protection - are lost or reduced. Suddenly you’re flying an airplane that handles differently than it did five seconds ago, precisely when things are already going wrong.

That is what happened to Air France 447 over the Atlantic in 2009. The pitot tubes iced over and fed the computers garbage airspeed data. The airplane did exactly what it was designed to do: it distrusted its airspeed, dropped to Alternate Law, and disabled stall protection. A crew that had spent years inside the safety of Normal Law - an airplane that had never once let them near a stall - was handed an aircraft that could stall. One pilot held the stick back, the airplane stalled, and it fell more than 30,000 feet into the ocean. 228 people died.

The engineering lesson is uncomfortable: the protection that makes the airplane nearly impossible to stall for tens of thousands of hours may be the very thing that erodes a pilot’s readiness for the one hour when the protection is gone. If the airplane never lets you near the edge, you never practice the edge, and your hands forget where it is. The safety system and the skill decay are two sides of the same coin.

Mode Confusion: The Second Hidden Cost

The second problem applies to every automated cockpit, not just Airbus: mode confusion. The airplane is always flying in some law - Normal, Alternate, or Direct Law, the last electrical fallback - and the stick means something different in each. A tired crew at three in the morning doesn’t always hold a crisp picture of which state they’re in. The machine knows; the question is whether the human knows what the machine knows. That gap - between what the automation is doing and what the pilot believes it is doing - is where a startling number of accidents live.

Does Fly-by-Wire Still Make Sense? Airbus vs. Boeing

Despite those two stories, fly-by-wire is not a bad bet - not even close. The A320 family and the wide-bodies that followed have flown for decades with a statistically superb safety record. Envelope protection has quietly turned dozens of near-stalls and upsets into non-events, and the accident that doesn’t happen never makes a headline. The failures we remember are memorable precisely because they are rare.

Boeing reached the same problem and drew the line differently on the 777 and 787, which are also fly-by-wire. Boeing kept envelope protections but made them soft: pull hard enough on the yoke and you can override them, because the pilot retains final authority. Airbus made its protections hard - the pilot cannot override alpha max. Two teams of very smart engineers looked at the same problem and answered it differently, and after forty years the honest verdict is that both work, because both are backed by training and both are astonishingly reliable. The philosophy matters less than the discipline around it.

Where Cockpit Automation Goes Next

The frontier is no longer just protecting the envelope - it’s closing the loop further and taking over the decision, not only the control. Modern systems can coordinate a traffic-avoidance climb on their own and execute automatic emergency descent, diving to a breathable altitude by itself when it detects a cabin depressurization. At the edge, Airbus has been flight-testing a project called Dragonfly, an aircraft that can divert and land itself if the crew is incapacitated - reading the weather, picking the runway, and talking to the ground. That is the Normal Law philosophy grown all the way up: start by refusing to let the pilot stall, and end by flying the whole approach without one.

Every one of these systems trades a little pilot authority for a lot of protection against the worst human moments. On the good days it’s an excellent deal - the airplane and its passengers are safer. But the bill comes due on the one bad day when the automation quietly hands the airplane back, degraded, at the worst possible moment. The technology doesn’t remove the need for skill. It concentrates it, saves it up, and demands all of it at once in the rarest hour. No software solves that. Only training does.

The technical detail here draws on Airbus’s flight crew operating documentation, the final accident report from France’s BEA on Air France 447, and years of work by the Flight Safety Foundation on automation and manual flying skills.

Key Takeaways

In Normal Law, the Airbus sidestick commands a load factor (G), not a control-surface position, which makes the aircraft hold its flight path automatically.
Flight envelope protection limits angle of attack to alpha max, making the airplane nearly impossible to stall or spin as long as the computers have valid data.
Protections include bank angle limits (rolls back from 67° to 33°), pitch limits (30° up, 15° down), high-speed protection, and a low-energy warning.
When sensor data fails, the system drops to Alternate Law and loses stall protection - the scenario behind Air France 447 (2009), which killed 228 people.
Airbus uses hard protections the pilot can’t override, while Boeing (777/787) uses soft protections the pilot can; both have excellent safety records because both rely on disciplined training.