Airbus A350 Auto Flight System: ATA 22, FGES & PRIM Architecture Explained

01 · System Concept

What is the Airbus A350 Auto Flight System (ATA 22)?

In earlier fly-by-wire aircraft such as the A320 and A330/A340 families, auto flight computation was housed in separate physical line-replaceable units called Flight Management and Guidance Computers (FMGCs) or Flight Management, Guidance and Envelope Computers (FMGC/FMAs). These units communicated externally with flight control computers and engine controllers over point-to-point ARINC 429 digital links.

On the Airbus A350 XWB, ATA 22 has been completely re-architected. The auto flight computation is partitioned into two main functional worlds:

1. The Flight Guidance and Envelope System (FGES): This software system is embedded directly inside each of the aircraft's three PRIMary Flight Control Computers (PRIM 1, PRIM 2, and PRIM 3). By placing flight guidance, envelope protections, autopilot trajectory calculation, and autothrust right inside the primary flight control hardware, the A350 eliminates signal lag between auto flight demands and flight control surface actuation.
2. The Flight Management System (FMS): Navigation, long-term flight planning, lateral and vertical predictions, performance optimization, and datalink functions are handled bythree identical Flight Management Computers (FMC-A, FMC-B, and FMC-C) interfacing with the Cockpit Display System (CDS) and the Keyboard and Cursor Control Units (KCCUs).

The primary role of the A350 Auto Flight System is to assist the crew in flying the aircraft safely and economically within structural and aerodynamic limits, from engine start, through takeoff, climb, cruise, descent, autoland flare, and ground rollout.

02 · Processing Core

FGES Architecture Hosted inside the PRIMs

Each A350 PRIM is built on a dual-channel architecture consisting of Side A andSide B. One side executes the command processing while the opposite side performs continuous independent monitoring. Both channels must operate normally for a PRIM to execute its assigned functions.

The FGES functions executed within the PRIMs are subdivided into four major operational domains:

Data Concentrators and Weight & Balance (FCDC & WBBC)

In addition to the three PRIMs, the AFS relies on two Flight Control Data Concentrators (FCDCs) implemented as core software applications hosted inside CPIOMs. The FCDCs concentrate maintenance data for the Central Maintenance System (CMS), compute approach capabilities (ILS, GLS, SLS, and autoland status), and host the Weight and Balance Backup Computation (WBBC).

03 · Flight Envelope & Protections

Flight Envelope (FE) Protections & Characteristic Speeds

The Flight Envelope (FE) function acts as an active aerodynamic guardian. It prevents flight control and engine thrust commands from driving the aircraft beyond structural load limits or stall margins.

Characteristic Speeds Computed by FE

The FE continuously computes real-time dynamic speeds displayed along the PFD speed tape:

• VLS (Lowest Selectable Speed): Represents minimum selectable speed with full margin.
• Vcprot: Target speed for manual protection when alphaprot is unavailable.
• Valphaprot & Valphamax: Speeds representing angle of attack protection limits.
• Valpha stall warning: Airspeed threshold triggering master warning and stall aural.
• GREEN Dot: Best lift-to-drag ratio speed in clean aerodynamic configuration.
• F, F2, F3: Flap retraction and approach target speeds for flap lever positions 1, 2, and 3.
• S: Minimum slat retraction speed towards clean configuration.
• VFE & VFEnext: Maximum permissible speed with extended flaps and next detent limit.
• VLE / MLE: Maximum flight speed and Mach number with landing gear locked down.
• VMAX: Absolute maximum allowable operating speed based on aircraft configuration.
• ARS (Automatic Flap Retraction Speed): Speed threshold triggering automatic flap relief.
• Vc Trend: Predicted calibrated airspeed 10 seconds into the future during acceleration.

Active Flight Safety Warnings and Protection Logics

04 · Trajectory Control

Autopilot (AP) & Flight Director (FD) Execution

The A350 Autopilot function computes guidance orders across all three axes:

• Pitch Axis: Short-term pitch commands to elevators; long-term pitch trim commands to the Trimmable Horizontal Stabilizer (THS).
• Roll Axis: Differential commands to inboard and outboard ailerons and roll spoilers.
• Yaw Axis: Coordinated turn commands, yaw damping, and engine failure compensation to the rudder.
• Ground Rollout: Direct steering commands to the nose gear wheels through the Wheel Steering Control System (WSCS) for autoland rollout.

Cockpit Control Locks (SSU & Rudder Pedals)

A signature safety feature of the A350 auto flight architecture is the physical locking mechanism on pilot control inceptors:

When an Autopilot is engaged (or when a PRIM requests it), an electro-mechanical locking mechanism stiffens and locks both Side Stick Units (SSUs) and rudder pedals in their neutral positions. This prevents inadvertent nudges from interfering with autopilot tracking. If a pilot applies intentional manual override force to an SSU or steps firmly on the rudder pedals, the lock mechanism releases and disengages the Autopilot immediately.

TCAS Resolution Advisory Handling

The A350 integrates Airborne Collision Avoidance System (TCAS) guidance directly into the auto flight computers. When a TCAS Resolution Advisory (RA) triggers:

• If the Autopilot is engaged, the vertical guidance mode automatically reverts to the dedicated TCAS vertical mode. The aircraft autonomously flies the required vertical rate trajectory to clear the conflicting traffic without requiring the pilots to disconnect the autopilot.
• If flying manually with Flight Directors, the FD crossbars re-target to display green vertical speed guidance bands matching the TCAS advisory on the PFD.

05 · Thrust Modulation

Autothrust (A/THR) Modes & Engine Thrust Control Loop

Autothrust computation runs as an integrated software module inside the PRIMs. The master PRIM calculates an N1 fan speed target and transmits it over high-speed AFDX digital buses to thePropulsion Control System (PCS), which commands the dual Full Authority Digital Engine Control (FADEC / EEC) units on each Rolls-Royce Trent XWB turbofan.

Three Engine Thrust Control Modes

1. Manual Thrust Mode: A/THR is disengaged or inactive. The pilot directly modulates engine thrust by physically moving the throttle control levers between IDLE and TOGA.
2. Automatic Thrust Mode: A/THR is engaged and active. The PRIM modulates engine thrust automatically to maintain either a target speed/Mach (Speed Mode) or a fixed thrust rating (Thrust Mode, e.g., CLIMB or MCT). The throttle levers remain stationary at the selected detent (normally CL).
3. Memo Thrust Mode: A unique protective mode. If A/THR is disengaged while actively modulating thrust—either because a pilot accidentally pushed the FCU A/THR button or because of a system sensor failure—the PRIM does not immediately snap thrust to the physical lever position. Instead, the system enters Memo Thrust, freezing thrust at the last commanded target. This prevents severe pitch and speed excursions until the crew consciously moves the throttle levers.

A/THR Active vs. Inactive Operational Ranges

The A350 throttle quadrant features distinct tactile mechanical detents:

• Between IDLE and CL (Climb): A/THR is Active (two engines running).
• Between IDLE and MCT (Max Continuous Thrust): A/THR is Active in single-engine conditions.
• Above CL / MCT: A/THR is Inactive. Engine thrust is set directly by the mechanical lever position.
• TO/GA Detent: Pushing levers to full forward TOGA detent automatically engages A/THR in TOGA thrust rating mode.

06 · Cockpit Controls

Flight Control Unit (FCU) & EFIS Control Panels

The cockpit glareshield assembly houses the Flight Control Unit (FCU), consisting of:

• One central AFS Control Panel for autopilot, autothrust, and target selections.
• Two flanking EFIS Control Panels (Captain on left, First Officer on right).
• Two independent display dimming knobs and the cockpit equipment power supply disconnect switch.

Dual-Channel Computing Architecture

Internally, the FCU is powered by two fully independent electronic computation channels:

• Channel 1: Powered by dedicated electrical bus. Directly controls and drives the Captain EFIS control panel.
• Channel 2: Powered by separate electrical bus. Directly controls and drives the First Officer EFIS control panel.
• AFS Panel Arbitration: The master PRIM selects either Channel 1 or Channel 2 to drive the digital display windows on the central AFS panel. If one channel fails, its associated EFIS panel is lost, but the opposite EFIS panel and the central AFS panel remain fully functional.

Direct Hardwired Discretes to the PRIMs

To safeguard the flight crew's ability to command auto flight under all circumstances, theAP1, AP2, and A/THR engagement pushbuttons are not solely transmitted over software multiplex buses. They are hardwired via discrete electrical connections directly to the PRIMs, backed up by digital ARINC 429 confirmation words.

Rotary Knob Operation: Push vs. Pull Philosophy

• Turn Knob: Modifies the target numerical value (speed, heading, altitude, vertical speed).
• Pull Knob: Engages Selected guidance mode (pilot manually takes tactical control of that parameter).
• Push Knob: Engages Managed guidance mode (hands guidance authority back to the FMS strategic flight plan).

07 · Emergency Redundancy

CPIOM-J FCU Backup Function: Disable vs. Active Modes

On conventional airliners, a physical failure of the glareshield FCU leaves pilots unable to adjust barometric references, autopilot modes, or target speeds. On the A350, Airbus introduced theFCU Backup Function, implemented across two integrated modular avionics computers:CPIOM-J71 (Software 1) and CPIOM-J72 (Software 2).

Operational Modes of the FCU Backup Application

Interactive MFD Pages via KCCU

When the FCU Backup is active, pilots access two dedicated tabs on the Multi-Function Display (MFD):

• AUTOFLIGHT Page: Provides interactive graphical toggles for AP1, AP2, FD, and A/THR; numeric data entry boxes for target speed, heading, altitude, and vertical speed/FPA; and mode arming buttons for LOC, APPR, and EXPED.
• EFIS Page: Replicates the lost glareshield EFIS knobs: Barometric pressure setting (hPa/in.Hg and STD mode selection), ND navigation display modes (ROSE, ARC, PLAN), range scales (10 NM to 640 NM plus ZOOM), and overlay filters (Weather radar, Terrain, Traffic, Waypoints, Constraints).

08 · Long-Range Navigation

Flight Management System (FMS): Triple FMC Operation

The A350 Flight Management System consists of three identical Flight Management Computers: FMC-A (1CC1), FMC-B (1CC2), and FMC-C (1CC3).

Five Core Software Suites per FMC

1. Operational Program Software: The executive code executing flight plan computations.
2. Performance Database: Aerodynamic drag tables, engine fuel burn models, and climb/descent profiles.
3. Magnetic Variation Database: Global magnetic declination models updated with latitude/longitude.
4. Airline Modifiable Information (AMI): Carrier-specific cost index policies, acceleration altitudes, and company routes.
5. Navigation Database: Worldwide aeronautical nav data (airports, runways, airways, SIDs, STARs, approaches) updated on a strict 28-day AIRAC cycle.

FMC Operating and Reconfiguration Modes

• Dual Mode (Normal): FMC-A (associated with Captain / FMS 1) and FMC-B (associated with First Officer / FMS 2) run simultaneously and cross-synchronize flight plan entries. FMC-C remains on hot standby. If AP1 is engaged or neither AP is on, FMC-A acts as the master for flight guidance. If AP2 is engaged, FMC-B takes over as master.
• Independent Mode: If a database mismatch or communication crosstalk failure occurs between FMC-A and FMC-B, the systems isolate. Each pilot works with their respective FMC independently without synchronization.
• Single Mode: If two FMCs suffer internal faults, the surviving unit drives both cockpit display suites. The crew can also manually force single mode using the cockpit FMS Source Selector switch (NORM, BOTH ON 1, BOTH ON 2).
• Standby Reconfiguration: If an active FMC fails, hot-standby unit FMC-C automatically takes over without loss of active flight plan data.
• Cockpit Reset Switches: A dedicated reset panel provides individual three-position reset switches for FMC-A, FMC-B, and FMC-C, enabling maintenance or flight crew to cycle an erratic FMC without pulling avionics bay circuit breakers.

09 · Advanced Integrations

Weight & Balance Backup (WBBC) & Brake to Vacate (BTV)

Weight and Balance Backup Computation (WBBC)

Accurate gross weight and Center of Gravity (CG) values are vital for calculating minimum safe flying speeds, takeoff trim settings, and stall protections. Normally, these values originate from theFuel Quantity and Management System (FQMS) sensors measuring fuel mass in wing and center tanks.

To provide total independence from fuel sensor failures, the A350 incorporates the Weight and Balance Backup Computation (WBBC) inside the FCDC software running on CPIOMs. The WBBC estimates aircraft weight and CG by mathematically processing aerodynamic parameters:

• Calibrated airspeed, Mach, and barometric altitude from ADIRS.
• Aircraft Angle of Attack (AoA) from external vanes.
• Trimmable Horizontal Stabilizer (THS) trim position recorded by the FCDC.
• Fuel mass flow measured by engine FADECs.

If a discrepancy arises between the FQMS sensor measurement and the WBBC aerodynamic estimate, the system alerts the crew with a Master Caution chime and an ECAM advisory. If both the FQMS interface and the WBBC fail, the PRIMs compute an internal emergency gross weight fallback.

Brake to Vacate (BTV) and Runway Overrun Protections

The Flight Envelope (FE) software interfaces directly with the Braking Control System (BCS)and the Onboard Airport Navigation System (OANS). During landing roll:

• Brake to Vacate (BTV): The crew selects an intended runway exit on the airport map. The auto flight system calculates the required deceleration profile and automatically regulates wheel braking to decelerate the aircraft smoothly, reaching the turn-off speed exactly as the chosen exit is reached.
• Runway Overrun Warning / Protection (ROW/ROP): If landing conditions or runway surface friction deteriorate, FE detects that the aircraft cannot stop within the remaining runway length and commands maximum braking force to the BCS while sounding aural alerts.

10 · Ground Operations

Ground Engagement & Disengagement Logic

To prevent dangerous surface movements or unexpected thrust bursts while the aircraft is parked or being serviced at the gate, the A350 enforces strict logic gates for auto flight engagement on the ground:

Ground AP/FD Engagement Prerequisites

Automatic Disengagement Triggers

• Autopilot Disengagement: AP key pushed; sidestick takeover/priority pushbutton pushed; manual force applied to sidestick or rudder pedals; an engine started on the ground; or sensor/hydraulic failure detected.
• Flight Director Disengagement: FD key released; aircraft speed drops below VLS; aircraft exceeds Vmo/Mmo; or sensor data invalid.

11 · Maintenance Engineering

A Maintenance Engineer's Mental Model for ATA 22

When troubleshooting an Auto Flight System fault on the Airbus A350, a maintenance engineer must avoid treating ATA 22 as a single black box. Instead, follow an 8-step cause-and-effect diagnostic chain:

1. Command Origin: Did the target demand originate from the pilot (sidestick/pedal), the glareshield FCU (selected target), the FMS (managed target), or an automatic envelope protection (Alpha floor, windshear)?
2. Computation Master: Which PRIM is currently acting as the active FGES master? Are both Side A (command) and Side B (monitor) channels operational?
3. Data Communication: Are the ARINC 429 digital channels, AFDX avionics network, and hardwired discrete lines between the FCU, PRIMs, and CPIOMs communicating without packet loss?
4. Sensor Inputs: Are all three ADIRS units and radio navigation receivers providing valid inertial, aerodynamic, and position data to the PRIMs?
5. Execution Effector: Which subsystem was commanded to move—the Primary Flight Control Surfaces via SECs, the nose wheel steering via WSCS, the Trent XWB engines via PCS/FADEC, or the brakes via BCS?
6. Feedback Confirmation: Did the surface position sensors, engine N1 feedback, or inertial acceleration prove that the aircraft complied with the command?
7. Reconfiguration Status: Did the system degrade gracefully—did CPIOM FCU Backup engage, did Memo Thrust freeze engine power, or did standby FMC-C take over navigation?
8. Central Maintenance BITE: What internal fault codes are stored in the PRIM, FCU, and FCDC data shop zones inside the Onboard Maintenance Terminal (OMT) CMS interface?

12 · Clarifications

Common Technical Misconceptions in A350 Auto Flight

Misconception 1: "The A350 has dedicated Autopilot and Autothrust computer boxes."

Reality: False. There are no standalone AP or A/THR computers on the A350. Both are software modules integrated directly into the Flight Guidance and Envelope System (FGES) hosted inside the three PRIMary flight control computers.

Misconception 2: "If the glareshield FCU fails, the pilots lose all ability to command autoflight modes."

Reality: False. The A350 features a hot-standby FCU Backup application running in CPIOM-J71 and CPIOM-J72. If the FCU fails or is switched off, the pilots can manage all autopilot, autothrust, target speeds, altitudes, and EFIS baro settings using interactive MFD pages via the KCCU.

Misconception 3: "Disconnecting Autothrust in flight always snaps engine thrust to the physical lever position."

Reality: False. If A/THR is disengaged via the FCU button or due to a system fault, the system engages Memo Thrust, freezing the thrust target at its current level to prevent violent airspeed and pitch upsets until the pilot manually moves the levers.

Misconception 4: "Aircraft gross weight and CG calculations rely solely on fuel tank quantity sensors."

Reality: False. The FCDC hosts the Weight and Balance Backup Computation (WBBC), which independently calculates weight and CG estimates from aerodynamic lift, pitch trim deflection, and airspeed to cross-check or replace fuel quantity system (FQMS) data.

13 · Technical Q&A

Frequently Asked Questions (FAQ)

Where are the Auto Flight functions hosted on the Airbus A350?

Unlike previous generations that used standalone Flight Management and Guidance Computers (FMGCs), the A350 hosts the Flight Guidance and Envelope System (FGES) inside the three PRIMary Flight Control Computers (PRIM 1, PRIM 2, and PRIM 3). Each PRIM houses two independent channels (Side A and Side B) configured in command and monitor roles.

What are the four core functions of the A350 FGES?

The four core functions are: Flight Envelope (FE) computation and safety warnings, Autopilot (AP) 3-axis flight path and nose-wheel steering execution, Flight Director (FD) visual guidance commands on PFDs, and Autothrust (A/THR) engine N1 target generation via the Propulsion Control System.

What happens if the A350 Flight Control Unit (FCU) fails in flight?

If the FCU fails or is turned off using the overhead 231VM equipment power switch, the system automatically transfers control to the FCU Backup application hosted in CPIOM-J71 and CPIOM-J72. The flight crew can manage autoflight targets, flight director, autopilot, and EFIS baro/display settings using interactive graphical pages on the Multi-Function Display (MFD) via the Keyboard and Cursor Control Unit (KCCU).

What is Memo Thrust mode in the A350 Autothrust system?

Memo Thrust is an automatic protective mode that engages when active Autothrust is disengaged via the FCU pushbutton or due to an unexpected system failure. Instead of allowing engine thrust to snap immediately to the physical throttle lever position, the system freezes thrust at the last commanded target value to avoid dangerous flight-path transients.

How many Flight Management Computers (FMCs) does the A350 have and how do they operate?

The A350 has three identical FMCs (FMC-A, FMC-B, and FMC-C). In normal operation, FMC-A (Captain/FMS 1) and FMC-B (First Officer/FMS 2) run in synchronized Dual Mode, while FMC-C remains on hot standby. If AP1 is engaged or neither AP is active, FMC-A acts as the master for flight guidance; if AP2 is engaged, FMC-B acts as master. If an active FMC fails, FMC-C automatically takes over.

What is the Weight and Balance Backup Computation (WBBC)?

WBBC is an independent software application hosted within the Flight Control Data Concentrators (FCDC) in the CPIOMs. It calculates aircraft weight and Center of Gravity (CG) estimates independently of the Fuel Quantity and Management System (FQMS) using ADIRS aerodynamic data (altitude, airspeed, angle of attack), pitch trim position, and fuel burn. If FQMS and WBBC disagree, a master caution and ECAM alert notify the crew.